modern-pdf-lib 0.33.0 → 0.35.0

package/dist/{src-zeRl33xQ.mjs → src-BlUlmYsU.mjs}

@@ -1,8 +1,8 @@
-import { A as encodeUTCTime, Br as rectangle, Bt as PageSizes, C as encodeInteger, E as encodeOctetString, F as parseDerTlv, Gr as setLineWidth, H as mergePdfs, I as toBuffer, Jr as beginText, Kn as applyFillColor, L as computeSignatureHash, M as extractIssuerAndSerial, N as extractSubjectPublicKeyInfo, O as encodeSequence, P as getSubtle, Pr as fill, Rn as restoreState, Rr as lineTo, S as encodeContextTag, Sn as formatPdfDate, T as encodeOID, Vn as saveState, Vr as setDashPattern, Xr as moveText, Yn as cmykToRgb, Yr as endText, at as sha256, b as detectKeyAlgorithm, ei as setFont, gn as buildAnnotationDict, gt as PdfParseError, k as encodeSet, mn as PdfAnnotation, n as StandardFonts, oi as setWordSpacing, qn as applyStrokeColor, qr as stroke, r as createPdf, s as setPageLabels, si as showText$1, t as PdfDocument, x as detectNamedCurve, y as decodeOidBytes, z as findSignatures, zr as moveTo } from "./pdfDocument-Cgkkk8F8.mjs";
-import { c as PdfRef, i as PdfName, l as PdfStream, n as PdfBool, o as PdfNumber, r as PdfDict, t as PdfArray, u as PdfString } from "./pdfObjects-CB7TEdbW.mjs";
+import { $r as beginText, A as encodeUTCTime, C as encodeInteger, Dn as formatPdfDate, E as encodeOctetString, F as parseDerTlv, Gr as rectangle, Gt as PageSizes, I as toBuffer, Kn as saveState, Kr as setDashPattern, M as extractIssuerAndSerial, N as extractSubjectPublicKeyInfo, O as encodeSequence, P as getSubtle, Qn as applyStrokeColor, Qr as stroke, S as encodeContextTag, T as encodeOID, Tn as buildInfoDict, Un as restoreState, Ur as lineTo, Ut as serializePdf, V as findSignatures, W as mergePdfs, Wr as moveTo, Xr as setLineWidth, Zn as applyFillColor, ai as setFont, b as detectKeyAlgorithm, bt as PdfLexer, di as setWordSpacing, ei as endText, er as cmykToRgb, fi as showText$1, k as encodeSet, n as StandardFonts, nt as loadPdf, r as createPdf, rt as PdfEncryptionHandler, s as setPageLabels, st as sha256, t as PdfDocument, ti as moveText, vt as XrefParser, x as detectNamedCurve, xn as buildAnnotationDict, xt as PdfParseError, y as decodeOidBytes, yn as PdfAnnotation, yt as PdfObjectParser, z as computeSignatureHash, zr as fill } from "./pdfDocument-Q0wrwKEZ.mjs";
+import { c as PdfRef, i as PdfName, l as PdfStream, n as PdfBool, o as PdfNumber, r as PdfDict, s as PdfObjectRegistry, t as PdfArray, u as PdfString } from "./pdfObjects-CB7TEdbW.mjs";
 import { n as decodeStreamData, r as getStreamFilters } from "./streamDecode-DCpgTocN.mjs";
 import { g as FieldFlags, v as numVal } from "./pdfForm-CfLnlsj-.mjs";
-import { i as parseContentStream } from "./compressionAnalysis-BEd_745I.mjs";
+import { i as parseContentStream, o as extractTextWithPositions } from "./compressionAnalysis-BEd_745I.mjs";
 import { n as decodeJpegWasm } from "./bridge-7dhURZj7.mjs";
 import { r as detectRuntime } from "./loader-DkrXz-h4.mjs";
 import { deflateSync, inflateSync, unzlibSync } from "fflate";
@@ -277,7 +277,7 @@ function compressStream(stream, level) {
 * @returns              The incremental save result.
 */
 async function saveDocumentIncremental(originalBytes, doc, options) {
-	const { buildDocumentStructure } = await import("./pdfDocument-Cgkkk8F8.mjs").then((n) => n.Cn);
+	const { buildDocumentStructure } = await import("./pdfDocument-Q0wrwKEZ.mjs").then((n) => n.On);
 	const registry = doc.getRegistry();
 	const structure = buildDocumentStructure(doc.getInternalPages().map((p) => p.finalize()), {
 		producer: doc.getProducer(),
@@ -4280,7 +4280,7 @@ function findChangedObjects(original, modified) {
 			continue;
 		}
 		if (computeObjectHash(origObj.content) !== computeObjectHash(modObj.content)) {
-			if (!bytesEqual(origObj.content, modObj.content)) changedObjNums.push(objNum);
+			if (!bytesEqual$1(origObj.content, modObj.content)) changedObjNums.push(objNum);
 		}
 	}
 	return changedObjNums.sort((a, b) => a - b);
@@ -4288,7 +4288,7 @@ function findChangedObjects(original, modified) {
 /**
 * Compare two Uint8Arrays for equality.
 */
-function bytesEqual(a, b) {
+function bytesEqual$1(a, b) {
 	if (a.length !== b.length) return false;
 	for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
 	return true;
@@ -4326,7 +4326,7 @@ function optimizeIncrementalSave(originalPdf, changes) {
 		const changeHash = computeObjectHash(change.newContent);
 		const origObj = originalObjs.get(change.objectNumber);
 		if (origObj) {
-			if (computeObjectHash(origObj.content) === changeHash && bytesEqual(origObj.content, change.newContent)) continue;
+			if (computeObjectHash(origObj.content) === changeHash && bytesEqual$1(origObj.content, change.newContent)) continue;
 		}
 		const dedupeKey = `${change.objectNumber}:${change.generationNumber}:${changeHash}`;
 		if (seenHashes.has(dedupeKey)) continue;
@@ -24457,7 +24457,7 @@ function extractCrlUrls(cert) {
 /**
 * Extract the DER-encoded subject Name from a certificate.
 */
-function extractSubjectDer$1(certDer) {
+function extractSubjectDer$2(certDer) {
 	const tbsCert = parseDerTlv(certDer, 0).children[0];
 	let idx = 0;
 	if (tbsCert.children[0].tag === 160) idx = 1;
@@ -24468,7 +24468,7 @@ function extractSubjectDer$1(certDer) {
 /**
 * Extract the DER-encoded issuer Name from a certificate.
 */
-function extractIssuerDer$1(certDer) {
+function extractIssuerDer$2(certDer) {
 	const tbsCert = parseDerTlv(certDer, 0).children[0];
 	let idx = 0;
 	if (tbsCert.children[0].tag === 160) idx = 1;
@@ -24590,7 +24590,7 @@ var TrustStore = class {
 	*/
 	async isTrusted(cert) {
 		await this._ready;
-		const key = await computeSubjectKey(extractSubjectDer$1(cert));
+		const key = await computeSubjectKey(extractSubjectDer$2(cert));
 		const entries = this._certs.get(key);
 		if (!entries) return false;
 		return entries.some((e) => compareBytes$1(e.der, cert));
@@ -24607,7 +24607,7 @@ var TrustStore = class {
 	*/
 	async findIssuer(cert) {
 		await this._ready;
-		const key = await computeSubjectKey(extractIssuerDer$1(cert));
+		const key = await computeSubjectKey(extractIssuerDer$2(cert));
 		const entries = this._certs.get(key);
 		if (!entries || entries.length === 0) return null;
 		return entries[0].der;
@@ -24641,7 +24641,7 @@ var TrustStore = class {
 	* Add a single certificate to the store.
 	*/
 	async _addOne(cert) {
-		const key = await computeSubjectKey(extractSubjectDer$1(cert));
+		const key = await computeSubjectKey(extractSubjectDer$2(cert));
 		const entry = {
 			der: cert,
 			serialBytes: extractSerialBytes(cert),
@@ -26729,7 +26729,7 @@ function parseAsn1Time(node) {
 /**
 * Extract the subject raw DER bytes from a certificate.
 */
-function extractSubjectDer(certDer) {
+function extractSubjectDer$1(certDer) {
 	const tbsCert = parseDerTlv(certDer, 0).children[0];
 	let idx = 0;
 	if (tbsCert.children[0].tag === 160) idx = 1;
@@ -26740,7 +26740,7 @@ function extractSubjectDer(certDer) {
 /**
 * Extract the issuer raw DER bytes from a certificate.
 */
-function extractIssuerDer(certDer) {
+function extractIssuerDer$1(certDer) {
 	const tbsCert = parseDerTlv(certDer, 0).children[0];
 	let idx = 0;
 	if (tbsCert.children[0].tag === 160) idx = 1;
@@ -26794,8 +26794,8 @@ function isCA(certDer) {
 * Check if a certificate is self-signed (subject === issuer).
 */
 function isSelfSigned(certDer) {
-	const subjectDer = extractSubjectDer(certDer);
-	const issuerDer = extractIssuerDer(certDer);
+	const subjectDer = extractSubjectDer$1(certDer);
+	const issuerDer = extractIssuerDer$1(certDer);
 	if (subjectDer.length !== issuerDer.length) return false;
 	for (let i = 0; i < subjectDer.length; i++) if (subjectDer[i] !== issuerDer[i]) return false;
 	return true;
@@ -26993,9 +26993,9 @@ function buildCertificateChain(leaf, intermediates) {
 			chain,
 			complete: true
 		};
-		const currentIssuerDer = extractIssuerDer(current);
+		const currentIssuerDer = extractIssuerDer$1(current);
 		let foundIdx = -1;
-		for (let i = 0; i < available.length; i++) if (namesEqual(currentIssuerDer, extractSubjectDer(available[i]))) {
+		for (let i = 0; i < available.length; i++) if (namesEqual(currentIssuerDer, extractSubjectDer$1(available[i]))) {
 			foundIdx = i;
 			break;
 		}
@@ -27083,8 +27083,8 @@ async function validateCertificateChain(chain, options) {
 			if (!signatureValid) certErrors.push("Root certificate self-signature verification failed");
 		} else {
 			let foundTrusted = false;
-			const certIssuerDer = extractIssuerDer(certDer);
-			for (const trusted of trustedCerts) if (namesEqual(certIssuerDer, extractSubjectDer(trusted))) {
+			const certIssuerDer = extractIssuerDer$1(certDer);
+			for (const trusted of trustedCerts) if (namesEqual(certIssuerDer, extractSubjectDer$1(trusted))) {
 				signatureValid = await verifyCertSignature(certDer, trusted);
 				foundTrusted = true;
 				break;
@@ -27841,6 +27841,1281 @@ function extractNodeBytesFromParent(fullBuffer, parent, child) {
 	return fullBuffer.subarray(start, start + child.totalLength);
 }
 //#endregion
+//#region src/signature/certPathBuilder.ts
+/**
+* @module signature/certPathBuilder
+*
+* Certification-path (trust-chain) construction per RFC 5280 §6.1.
+*
+* Given a leaf certificate, a pool of intermediate CA certificates, and a
+* set of trust anchors, {@link buildCertPath} assembles the ordered chain
+*
+* ```
+* leaf -> intermediate -> ... -> (issuer that is a trust anchor)
+* ```
+*
+* by matching, at each step, the *current* certificate's **issuer** Name to
+* a candidate certificate's **subject** Name (RFC 5280 §4.1.2.4 / §4.1.2.6).
+* When both certificates additionally carry the relevant key-identifier
+* extensions, the candidate's **Subject Key Identifier** (SKI, OID
+* `2.5.29.14`, RFC 5280 §4.2.1.2) must equal the current certificate's
+* **Authority Key Identifier** (AKI `keyIdentifier`, OID `2.5.29.35`,
+* RFC 5280 §4.2.1.1) for the link to be accepted. If only one side carries
+* the identifier, name matching alone is used (RFC 5280 §6.1.4 treats key
+* identifiers as a hint, not a hard requirement).
+*
+* Building stops when:
+* - the current certificate (or a matched issuer) is a member of `anchors`
+*   → `complete: true`, `anchor` set, and `path` excludes the anchor; or
+* - no issuer can be found among `intermediates`/`anchors`
+*   → `complete: false` (partial path returned).
+*
+* Loop protection: a certificate already present in the constructed path is
+* never revisited (RFC 5280 §6.1 prohibits a certificate appearing more than
+* once in a certification path).
+*
+* Name matching uses byte-for-byte equality of the DER-encoded `Name`. This
+* is the exact-match comparison permitted by RFC 5280 §7.1 when both names
+* are produced by conforming encoders (as is the case for fixtures generated
+* here and for the overwhelming majority of real-world CAs).
+*
+* References:
+* - RFC 5280 §4.1.2.4 (issuer), §4.1.2.6 (subject)
+* - RFC 5280 §4.2.1.1 (Authority Key Identifier, OID 2.5.29.35)
+* - RFC 5280 §4.2.1.2 (Subject Key Identifier, OID 2.5.29.14)
+* - RFC 5280 §6.1 (Certification Path Validation — path construction)
+*
+* @packageDocumentation
+*/
+/** Subject Key Identifier — RFC 5280 §4.2.1.2. */
+const OID_SUBJECT_KEY_IDENTIFIER = "2.5.29.14";
+/** Authority Key Identifier — RFC 5280 §4.2.1.1. */
+const OID_AUTHORITY_KEY_IDENTIFIER = "2.5.29.35";
+/**
+* Reconstruct the absolute byte range of a child node within the original
+* certificate buffer, returning the full TLV (header + value) as a subarray
+* that shares the cert's underlying ArrayBuffer.
+*
+* `parentNode.data` is a subarray of `certDer`; `child.offset` is the child's
+* offset within that parent value; `child.totalLength` covers header + value.
+*/
+function sliceChild(certDer, parentNode, child) {
+	const start = child.offset + (parentNode.data.byteOffset - certDer.byteOffset);
+	return certDer.subarray(start, start + child.totalLength);
+}
+/**
+* Resolve the TBSCertificate node and the index offset that accounts for the
+* optional `version [0] EXPLICIT` field.
+*
+* TBSCertificate ::= SEQUENCE {
+*   version         [0] EXPLICIT INTEGER DEFAULT v1,   -- tag 0xA0 when present
+*   serialNumber        INTEGER,
+*   signature           AlgorithmIdentifier,
+*   issuer              Name,
+*   validity            Validity,
+*   subject             Name,
+*   subjectPublicKeyInfo SubjectPublicKeyInfo,
+*   ... extensions [3] EXPLICIT ...
+* }
+*/
+function tbsContext(certDer) {
+	const tbs = parseDerTlv(certDer, 0).children[0];
+	if (!tbs) throw new Error("Malformed certificate: missing TBSCertificate");
+	const first = tbs.children[0];
+	return {
+		tbs,
+		idx: first && first.tag === 160 ? 1 : 0
+	};
+}
+/** Extract the raw DER bytes of the issuer Name (RFC 5280 §4.1.2.4). */
+function extractIssuerDer(certDer) {
+	const { tbs, idx } = tbsContext(certDer);
+	const issuerNode = tbs.children[idx + 2];
+	if (!issuerNode) throw new Error("Malformed certificate: missing issuer");
+	return sliceChild(certDer, tbs, issuerNode);
+}
+/** Extract the raw DER bytes of the subject Name (RFC 5280 §4.1.2.6). */
+function extractSubjectDer(certDer) {
+	const { tbs, idx } = tbsContext(certDer);
+	const subjectNode = tbs.children[idx + 4];
+	if (!subjectNode) throw new Error("Malformed certificate: missing subject");
+	return sliceChild(certDer, tbs, subjectNode);
+}
+/**
+* Extract the list of Extension nodes (each a SEQUENCE) from a certificate,
+* or an empty array when no extensions are present.
+*
+* extensions [3] EXPLICIT SEQUENCE OF Extension
+* Extension ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE, extnValue OCTET STRING }
+*/
+function extractExtensionNodes(certDer) {
+	try {
+		const { tbs } = tbsContext(certDer);
+		for (const child of tbs.children) if (child.tag === 163 && child.children.length > 0) return child.children[0].children;
+	} catch {}
+	return [];
+}
+/**
+* Locate the `extnValue` OCTET STRING contents for a given extension OID.
+* Returns the raw bytes inside the OCTET STRING (the DER of the extension's
+* value), or `undefined` if the extension is absent.
+*/
+function findExtensionValue(certDer, oid) {
+	for (const ext of extractExtensionNodes(certDer)) {
+		const oidNode = ext.children[0];
+		if (!oidNode) continue;
+		if (decodeOidBytes(oidNode.data) !== oid) continue;
+		const valueNode = ext.children[ext.children.length - 1];
+		if (!valueNode) return void 0;
+		return valueNode.data;
+	}
+}
+/**
+* Extract the Subject Key Identifier (key bytes) — RFC 5280 §4.2.1.2.
+*
+* SubjectKeyIdentifier ::= KeyIdentifier
+* KeyIdentifier ::= OCTET STRING
+*
+* extnValue (an OCTET STRING) wraps the KeyIdentifier OCTET STRING, so we
+* parse one inner OCTET STRING to obtain the raw identifier bytes.
+*/
+function extractSki(certDer) {
+	const extnValue = findExtensionValue(certDer, OID_SUBJECT_KEY_IDENTIFIER);
+	if (!extnValue) return void 0;
+	try {
+		const inner = parseDerTlv(extnValue, 0);
+		if (inner.tag !== 4) return void 0;
+		return inner.data;
+	} catch {
+		return;
+	}
+}
+/**
+* Extract the Authority Key Identifier `keyIdentifier` — RFC 5280 §4.2.1.1.
+*
+* AuthorityKeyIdentifier ::= SEQUENCE {
+*   keyIdentifier             [0] KeyIdentifier OPTIONAL,   -- IMPLICIT OCTET STRING, tag 0x80
+*   authorityCertIssuer       [1] GeneralNames OPTIONAL,
+*   authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
+*
+* extnValue (an OCTET STRING) wraps the SEQUENCE. We return the bytes of the
+* `[0]` IMPLICIT field (context tag 0x80), or `undefined` if absent.
+*/
+function extractAkiKeyId(certDer) {
+	const extnValue = findExtensionValue(certDer, OID_AUTHORITY_KEY_IDENTIFIER);
+	if (!extnValue) return void 0;
+	try {
+		const seq = parseDerTlv(extnValue, 0);
+		if (seq.tag !== 48) return void 0;
+		for (const field of seq.children) if (field.tag === 128) return field.data;
+	} catch {
+		return;
+	}
+}
+/** Byte-for-byte equality of two arrays. */
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+/**
+* Determine whether `candidate` could be the issuer of `cert`:
+* the candidate's subject DN must equal the cert's issuer DN, and — only when
+* BOTH key identifiers are present — the candidate's SKI must equal the cert's
+* AKI keyIdentifier (RFC 5280 §6.1.4 / §4.2.1.1).
+*/
+function isIssuerOf(cert, candidate) {
+	if (!bytesEqual(extractIssuerDer(cert), extractSubjectDer(candidate))) return false;
+	const aki = extractAkiKeyId(cert);
+	const ski = extractSki(candidate);
+	if (aki && ski) return bytesEqual(aki, ski);
+	return true;
+}
+/**
+* Build an ordered certification path from a leaf certificate to a trust
+* anchor per RFC 5280 §6.1.
+*
+* @param leafCertDer   DER-encoded end-entity (leaf) certificate.
+* @param intermediates DER-encoded intermediate CA certificates (any order).
+* @param anchors       DER-encoded trust anchors (root or directly-trusted CAs).
+* @returns             {@link CertPathResult} — `path` is leaf-first and
+*                      excludes the anchor; `anchor` is reported separately
+*                      when the path is `complete`.
+*
+* @example
+* ```ts
+* const { path, complete, anchor } = buildCertPath(leaf, [intermediate], [root]);
+* // path = [leaf, intermediate], complete = true, anchor = root
+* ```
+*/
+function buildCertPath(leafCertDer, intermediates, anchors) {
+	const leafAnchor = anchors.find((a) => bytesEqual(a, leafCertDer));
+	if (leafAnchor) return {
+		path: [leafCertDer],
+		complete: true,
+		anchor: leafAnchor
+	};
+	const path = [leafCertDer];
+	let current = leafCertDer;
+	const maxDepth = intermediates.length + anchors.length + 2;
+	for (let depth = 0; depth < maxDepth; depth++) {
+		const anchor = anchors.find((a) => isIssuerOf(current, a));
+		if (anchor) return {
+			path,
+			complete: true,
+			anchor
+		};
+		const next = intermediates.find((c) => isIssuerOf(current, c) && !path.some((p) => bytesEqual(p, c)));
+		if (!next) return {
+			path,
+			complete: false,
+			anchor: void 0
+		};
+		path.push(next);
+		current = next;
+	}
+	return {
+		path,
+		complete: false,
+		anchor: void 0
+	};
+}
+//#endregion
+//#region src/security/threatScanner.ts
+/** Numeric rank for severities so we can take a maximum. */
+const SEVERITY_RANK = {
+	low: 1,
+	medium: 2,
+	high: 3
+};
+/** Reverse lookup from rank back to severity. */
+const RANK_SEVERITY = [
+	"low",
+	"medium",
+	"high"
+];
+/**
+* File-name extensions that denote directly executable / script payloads.
+* An attachment ending in one of these is treated as high severity because a
+* viewer's "open attachment" (or a `/Launch` action targeting it) can run it.
+*/
+const EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+	"exe",
+	"com",
+	"scr",
+	"pif",
+	"cpl",
+	"msi",
+	"msp",
+	"mst",
+	"dll",
+	"sys",
+	"drv",
+	"ocx",
+	"bat",
+	"cmd",
+	"ps1",
+	"psm1",
+	"vbs",
+	"vbe",
+	"vb",
+	"wsf",
+	"wsh",
+	"js",
+	"jse",
+	"jar",
+	"class",
+	"sh",
+	"bash",
+	"zsh",
+	"ksh",
+	"csh",
+	"command",
+	"app",
+	"dmg",
+	"pkg",
+	"lnk",
+	"url",
+	"reg",
+	"hta",
+	"gadget",
+	"inf",
+	"scf",
+	"apk",
+	"deb",
+	"rpm",
+	"run",
+	"bin",
+	"elf",
+	"so",
+	"dylib",
+	"py",
+	"pyc",
+	"pyw",
+	"rb",
+	"pl",
+	"php"
+]);
+/** Read a `PdfName` value (without the leading `/`) from a dict entry. */
+function nameValue$1(obj) {
+	if (obj !== void 0 && obj.kind === "name") {
+		const v = obj.value;
+		return v.startsWith("/") ? v.slice(1) : v;
+	}
+}
+/** Read a `PdfString` value from a dict entry. */
+function stringValue(obj) {
+	if (obj !== void 0 && obj.kind === "string") return obj.value;
+}
+/** Format a `PdfRef` as the canonical `"N G R"` string, if available. */
+function refString(ref) {
+	return ref ? `${ref.objectNumber} ${ref.generationNumber} R` : void 0;
+}
+/** Lower-case file extension of a name, or `''` when there is none. */
+function extensionOf(name) {
+	const base = name.replace(/[\\/]+/g, "/").split("/").pop() ?? name;
+	const dot = base.lastIndexOf(".");
+	if (dot < 0 || dot === base.length - 1) return "";
+	return base.slice(dot + 1).toLowerCase();
+}
+/**
+* Scan a PDF for hostile constructs and return a {@link ThreatReport}.
+*
+* The scan never executes any document content. It parses the PDF and walks
+* the parsed object graph (see the module header for the precise method and
+* ISO 32000 references). When parsing fails, a guarded raw-byte fallback runs.
+*
+* @param pdf  Raw PDF bytes.
+* @returns    A report of findings plus the aggregate `riskLevel`.
+*/
+async function scanPdfThreats(pdf) {
+	const findings = [];
+	let scannedGraph = false;
+	try {
+		scanObjectGraph((await loadPdf(pdf, { ignoreEncryption: true })).getRegistry(), findings);
+		scannedGraph = true;
+	} catch {
+		scannedGraph = false;
+	}
+	if (!scannedGraph) scanRawBytesFallback(pdf, findings);
+	return {
+		findings,
+		riskLevel: aggregateRisk(findings)
+	};
+}
+/**
+* Walk every registered object and emit findings.
+*
+* We iterate the registry (every resolved indirect object). For each
+* dictionary (including stream dictionaries) we inspect that dict's *own
+* keys* and, where relevant, the resolved action-subtype `/S` *name*. Content
+* streams' raw bytes are never substring-scanned here, which is what makes the
+* scan precise (drawn text that merely says "JavaScript" is not a finding).
+*/
+function scanObjectGraph(registry, findings) {
+	for (const entry of registry) {
+		const obj = entry.object;
+		const refStr = refString(entry.ref);
+		let dict;
+		if (obj.kind === "dict") dict = obj;
+		else if (obj.kind === "stream") dict = obj.dict;
+		if (dict === void 0) continue;
+		inspectDict(dict, refStr, findings);
+	}
+}
+/**
+* Inspect a single dictionary's keys/values for dangerous constructs.
+*
+* @param dict     The dictionary (or stream dictionary).
+* @param refStr   The owning object's `"N G R"` string, if known.
+* @param findings Accumulator.
+*/
+function inspectDict(dict, refStr, findings) {
+	if (dict.has("/OpenAction")) findings.push({
+		category: "OpenAction",
+		severity: "medium",
+		detail: "Document defines an /OpenAction that runs automatically when the PDF is opened (ISO 32000 §12.6.3).",
+		objectRef: refStr
+	});
+	if (dict.has("/AA")) findings.push({
+		category: "AA",
+		severity: "medium",
+		detail: "Document or object defines /AA additional actions that fire on viewer events such as open/close/print/save (ISO 32000 §12.6.2).",
+		objectRef: refStr
+	});
+	if (dict.has("/JavaScript")) findings.push({
+		category: "JavaScript",
+		severity: "high",
+		detail: "A /JavaScript name tree (catalog /Names → /JavaScript) is present; these scripts execute automatically on open (ISO 32000 §12.6.4.16, §7.7.4).",
+		objectRef: refStr
+	});
+	const subtype = nameValue$1(dict.get("/S"));
+	if (subtype !== void 0) inspectActionSubtype(subtype, dict, refStr, findings);
+	if (dict.has("/XFA")) findings.push({
+		category: "XFA",
+		severity: "low",
+		detail: "Document contains an XFA form (/AcroForm → /XFA, ISO 32000 §12.7.8); XFA carries its own scripting and data-binding model.",
+		objectRef: refStr
+	});
+	const annotSubtype = nameValue$1(dict.get("/Subtype"));
+	if (annotSubtype === "RichMedia") findings.push({
+		category: "RichMedia",
+		severity: "low",
+		detail: "Rich-media annotation (/Subtype /RichMedia, ISO 32000-2 §13.6) embeds interactive multimedia (e.g. Flash/video).",
+		objectRef: refStr
+	});
+	else if (annotSubtype === "Movie") findings.push({
+		category: "Movie",
+		severity: "low",
+		detail: "Movie annotation (/Subtype /Movie, ISO 32000 §13.4) embeds video/animation content.",
+		objectRef: refStr
+	});
+	else if (annotSubtype === "Sound") findings.push({
+		category: "Sound",
+		severity: "low",
+		detail: "Sound annotation (/Subtype /Sound, ISO 32000 §13.3) embeds audio content.",
+		objectRef: refStr
+	});
+	if (dict.has("/RichMedia") && annotSubtype !== "RichMedia") findings.push({
+		category: "RichMedia",
+		severity: "low",
+		detail: "Object references rich-media content via a /RichMedia entry (ISO 32000-2 §13.6).",
+		objectRef: refStr
+	});
+	if (dict.has("/Movie") && annotSubtype !== "Movie") findings.push({
+		category: "Movie",
+		severity: "low",
+		detail: "Object references movie content via a /Movie entry (ISO 32000 §13.4).",
+		objectRef: refStr
+	});
+	if (dict.has("/Sound") && annotSubtype !== "Sound" && subtype !== "Sound") findings.push({
+		category: "Sound",
+		severity: "low",
+		detail: "Object references sound content via a /Sound entry (ISO 32000 §13.3).",
+		objectRef: refStr
+	});
+	if (nameValue$1(dict.get("/Type")) === "Filespec" || dict.has("/EF")) {
+		const fileName = stringValue(dict.get("/UF")) ?? stringValue(dict.get("/F"));
+		if (fileName !== void 0) {
+			const ext = extensionOf(fileName);
+			if (ext !== "" && EXECUTABLE_EXTENSIONS.has(ext)) findings.push({
+				category: "EmbeddedFile",
+				severity: "high",
+				detail: `Embedded file "${fileName}" has an executable/script extension ".${ext}" (ISO 32000 §7.11.3/§7.11.4); opening it can run code.`,
+				objectRef: refStr
+			});
+		}
+	}
+}
+/**
+* Flag a dangerous action `/S` subtype. Subtypes are ISO 32000 §12.6.4 /
+* §12.7.5 action types.
+*/
+function inspectActionSubtype(subtype, dict, refStr, findings) {
+	switch (subtype) {
+		case "JavaScript":
+			findings.push({
+				category: "JavaScript",
+				severity: "high",
+				detail: "JavaScript action (/S /JavaScript, ISO 32000 §12.6.4.16) executes script in the viewer.",
+				objectRef: refStr
+			});
+			break;
+		case "Launch":
+			findings.push({
+				category: "Launch",
+				severity: "high",
+				detail: "Launch action (/S /Launch, ISO 32000 §12.6.4.5) can run an external application or open a file.",
+				objectRef: refStr
+			});
+			break;
+		case "URI":
+			findings.push({
+				category: "URI",
+				severity: "medium",
+				detail: `URI action (/S /URI, ISO 32000 §12.6.4.7) opens a remote URL ${describeUri(dict)}.`,
+				objectRef: refStr
+			});
+			break;
+		case "SubmitForm":
+			findings.push({
+				category: "SubmitForm",
+				severity: "medium",
+				detail: "SubmitForm action (/S /SubmitForm, ISO 32000 §12.7.5.2) sends form data to a URL (potential data exfiltration).",
+				objectRef: refStr
+			});
+			break;
+		case "ImportData":
+			findings.push({
+				category: "ImportData",
+				severity: "low",
+				detail: "ImportData action (/S /ImportData, ISO 32000 §12.7.5.4) imports external form data.",
+				objectRef: refStr
+			});
+			break;
+		case "GoToR":
+			findings.push({
+				category: "GoToR",
+				severity: "low",
+				detail: "Remote Go-To action (/S /GoToR, ISO 32000 §12.6.4.3) targets an external document.",
+				objectRef: refStr
+			});
+			break;
+		case "Movie":
+			findings.push({
+				category: "Movie",
+				severity: "low",
+				detail: "Movie action (/S /Movie, ISO 32000 §12.6.4.10) plays embedded video.",
+				objectRef: refStr
+			});
+			break;
+		case "Sound":
+			findings.push({
+				category: "Sound",
+				severity: "low",
+				detail: "Sound action (/S /Sound, ISO 32000 §12.6.4.8) plays embedded audio.",
+				objectRef: refStr
+			});
+			break;
+		default: break;
+	}
+}
+/** Append the target URL of a /URI action to the detail string, if present. */
+function describeUri(dict) {
+	const uri = stringValue(dict.get("/URI"));
+	return uri !== void 0 ? `→ "${uri}"` : "";
+}
+/**
+* Best-effort raw-byte fallback used only when the PDF cannot be parsed.
+*
+* To stay precise we match constructs only in their *structural* dictionary
+* form — action subtypes as `/S /Type` (optionally without the inner space)
+* and `/OpenAction`/`/AA`/`/JavaScript` as dictionary keys (a `/` immediately
+* followed by the token and then a PDF delimiter). This avoids flagging the
+* same words when they appear as content-stream text or inside a literal
+* string. It is heuristic and clearly less reliable than the graph walk.
+*/
+function scanRawBytesFallback(pdf, findings) {
+	const text = new TextDecoder("latin1").decode(pdf);
+	const keyForm = (key) => new RegExp(`/${key}(?=[\\s/(<\\[\\]>]|$)`);
+	if (keyForm("OpenAction").test(text)) findings.push({
+		category: "OpenAction",
+		severity: "medium",
+		detail: "Raw scan: /OpenAction key present (ISO 32000 §12.6.3)."
+	});
+	if (keyForm("AA").test(text)) findings.push({
+		category: "AA",
+		severity: "medium",
+		detail: "Raw scan: /AA additional-actions key present (ISO 32000 §12.6.2)."
+	});
+	if (keyForm("JavaScript").test(text) || /\/S\s*\/JavaScript\b/.test(text)) findings.push({
+		category: "JavaScript",
+		severity: "high",
+		detail: "Raw scan: JavaScript action/name tree present (ISO 32000 §12.6.4.16)."
+	});
+	if (/\/S\s*\/Launch\b/.test(text)) findings.push({
+		category: "Launch",
+		severity: "high",
+		detail: "Raw scan: /S /Launch action present (ISO 32000 §12.6.4.5)."
+	});
+	if (/\/S\s*\/URI\b/.test(text)) findings.push({
+		category: "URI",
+		severity: "medium",
+		detail: "Raw scan: /S /URI action present (ISO 32000 §12.6.4.7)."
+	});
+	if (/\/S\s*\/SubmitForm\b/.test(text)) findings.push({
+		category: "SubmitForm",
+		severity: "medium",
+		detail: "Raw scan: /S /SubmitForm action present (ISO 32000 §12.7.5.2)."
+	});
+	if (/\/S\s*\/ImportData\b/.test(text)) findings.push({
+		category: "ImportData",
+		severity: "low",
+		detail: "Raw scan: /S /ImportData action present (ISO 32000 §12.7.5.4)."
+	});
+	if (/\/S\s*\/GoToR\b/.test(text)) findings.push({
+		category: "GoToR",
+		severity: "low",
+		detail: "Raw scan: /S /GoToR remote go-to present (ISO 32000 §12.6.4.3)."
+	});
+	if (/\/Subtype\s*\/RichMedia\b/.test(text) || keyForm("RichMedia").test(text)) findings.push({
+		category: "RichMedia",
+		severity: "low",
+		detail: "Raw scan: RichMedia annotation present (ISO 32000-2 §13.6)."
+	});
+	if (/\/Subtype\s*\/Movie\b/.test(text) || /\/S\s*\/Movie\b/.test(text)) findings.push({
+		category: "Movie",
+		severity: "low",
+		detail: "Raw scan: Movie content/action present (ISO 32000 §13.4)."
+	});
+	if (/\/Subtype\s*\/Sound\b/.test(text) || /\/S\s*\/Sound\b/.test(text)) findings.push({
+		category: "Sound",
+		severity: "low",
+		detail: "Raw scan: Sound content/action present (ISO 32000 §13.3)."
+	});
+	if (keyForm("XFA").test(text)) findings.push({
+		category: "XFA",
+		severity: "low",
+		detail: "Raw scan: /XFA form present (ISO 32000 §12.7.8)."
+	});
+}
+/** Maximum severity across findings, or `'none'` when there are none. */
+function aggregateRisk(findings) {
+	let maxRank = 0;
+	for (const f of findings) {
+		const rank = SEVERITY_RANK[f.severity];
+		if (rank > maxRank) maxRank = rank;
+	}
+	if (maxRank === 0) return "none";
+	return RANK_SEVERITY[maxRank - 1];
+}
+//#endregion
+//#region src/security/sanitize.ts
+/**
+* @module security/sanitize
+*
+* PDF sanitizer — produce a cleaned copy of a PDF with active / hidden
+* content neutralised.
+*
+* The sanitizer removes four classes of potentially dangerous or
+* privacy-leaking content from a document, each independently toggleable:
+*
+* - **javascript** — document-level JavaScript: the catalog's
+*   `/Names → /JavaScript` name tree (ISO 32000-1 §7.7.4 / §12.6.4.16)
+*   and the catalog's `/AA` (document additional-actions) dictionary
+*   (§12.6.3) plus any page-level `/AA`.
+* - **openActions** — the catalog's auto-run `/OpenAction` (§12.3.4 / §12.6.4).
+* - **embeddedFiles** — embedded file attachments: the catalog's
+*   `/Names → /EmbeddedFiles` name tree (§7.7.4 / §7.11.4) and the
+*   PDF 2.0 catalog `/AF` (associated files) array (§7.11.4).
+* - **metadata** — the XMP `/Metadata` stream (§14.3.2) and the document
+*   information `/Info` dictionary (§14.3.3).
+*
+* Implementation strategy (verified against this library's parser/writer):
+* the cleaned bytes are produced by mutating the *parsed object graph* in
+* place and re-serializing the registry directly through
+* {@link serializePdf}, **without** rebuilding the catalog. This is what
+* lets a disabled option genuinely preserve its content — the original
+* catalog (minus the removed references) is written verbatim.
+*
+* Removing a reference from the catalog is not sufficient on its own: the
+* underlying object (a JavaScript action dictionary, an `/EmbeddedFile`
+* stream, an XMP metadata stream, …) would otherwise remain physically
+* present in the output as an orphan. To guarantee the payload bytes are
+* actually gone, after deleting references this module runs the registry's
+* reachability filter from the catalog + info roots, dropping every object
+* no longer referenced.
+*
+* @packageDocumentation
+*/
+/**
+* Resolve a {@link PdfObject} that may be an indirect reference to its
+* underlying value using the registry. Non-refs are returned as-is.
+* Returns `undefined` if a ref cannot be resolved.
+*/
+function resolve$2(obj, registry) {
+	if (obj === void 0) return void 0;
+	if (obj instanceof PdfRef) return registry.resolve(obj);
+	return obj;
+}
+/** Resolve `obj` and return it only if it is a {@link PdfDict}. */
+function asDict(obj, registry) {
+	const resolved = resolve$2(obj, registry);
+	return resolved instanceof PdfDict ? resolved : void 0;
+}
+/** Read a {@link PdfString} value, resolving an indirect reference if needed. */
+function asStringValue(obj, registry) {
+	const resolved = resolve$2(obj, registry);
+	return resolved instanceof PdfString ? resolved.value : void 0;
+}
+/**
+* Collect every distinct `/Type /Catalog` dictionary registered in the
+* document, paired with its reference. A well-formed PDF has exactly one,
+* but malformed or incrementally-updated files can register more than one;
+* sanitizing all of them is the conservative, correct choice. The first
+* entry is treated as the document root.
+*/
+function findCatalogEntries(registry) {
+	const byObjNum = /* @__PURE__ */ new Map();
+	for (const { ref, object } of registry) if (object instanceof PdfDict) {
+		const type = object.get("/Type");
+		if (type instanceof PdfName && type.value === "/Catalog") {
+			if (!byObjNum.has(ref.objectNumber)) byObjNum.set(ref.objectNumber, {
+				ref,
+				dict: object
+			});
+		}
+	}
+	return [...byObjNum.values()];
+}
+/** Collect every distinct `/Type /Page` dictionary in the registry. */
+function findPages(registry) {
+	const pages = /* @__PURE__ */ new Set();
+	for (const { object } of registry) if (object instanceof PdfDict) {
+		const type = object.get("/Type");
+		if (type instanceof PdfName && type.value === "/Page") pages.add(object);
+	}
+	return [...pages];
+}
+/**
+* Determine whether a PDF name tree (ISO 32000-1 §7.7.4) contains at least
+* one entry. A name-tree node holds either a `/Names` array of
+* `[key value key value …]` pairs (leaf) or a `/Kids` array of child node
+* references (intermediate). The tree is walked recursively with a visited
+* guard against cyclic references in malformed files.
+*/
+function nameTreeHasEntries(node, registry, visited = /* @__PURE__ */ new Set()) {
+	const dict = asDict(node, registry);
+	if (dict === void 0 || visited.has(dict)) return false;
+	visited.add(dict);
+	const names = resolve$2(dict.get("/Names"), registry);
+	if (names instanceof PdfArray && names.length >= 2) return true;
+	const kids = resolve$2(dict.get("/Kids"), registry);
+	if (kids instanceof PdfArray) {
+		for (const kid of kids.items) if (nameTreeHasEntries(kid, registry, visited)) return true;
+	}
+	return false;
+}
+/** Return the catalog's resolved `/Names` sub-dictionary, if present. */
+function getNamesDict(catalog, registry) {
+	return asDict(catalog.get("/Names"), registry);
+}
+/**
+* Determine whether an additional-actions (`/AA`) dictionary contains any
+* action whose `/S` (action type) is `/JavaScript`. Each value in an `/AA`
+* dictionary is itself an action dictionary (§12.6.3).
+*/
+function aaHasJavaScript(aa, registry) {
+	if (aa === void 0) return false;
+	for (const [, value] of aa) {
+		const action = asDict(value, registry);
+		if (action === void 0) continue;
+		const s = action.get("/S");
+		if (s instanceof PdfName && s.value === "/JavaScript") return true;
+	}
+	return false;
+}
+/**
+* Descriptive `/Info` keys that constitute identifying metadata. The
+* auto-generated `/Producer`, `/CreationDate`, and `/ModDate` are NOT
+* treated as "present" for reporting purposes: a freshly created document
+* carries those by default and must still be considered clean. (When
+* metadata removal runs, the entire `/Info` dict is dropped regardless.)
+*/
+const DESCRIPTIVE_INFO_KEYS = [
+	"/Title",
+	"/Author",
+	"/Subject",
+	"/Keywords",
+	"/Creator"
+];
+/**
+* Locate the trailer's `/Info` dictionary in the registry. The parser does
+* not expose the trailer publicly, so the Info dict is identified
+* structurally: it is a dictionary that is NOT a catalog/page/pages node
+* and carries at least one recognised document-information key.
+*/
+function findInfoDict(registry, catalogs) {
+	const catalogDicts = new Set(catalogs.map((c) => c.dict));
+	const INFO_KEYS = [
+		"/Title",
+		"/Author",
+		"/Subject",
+		"/Keywords",
+		"/Creator",
+		"/Producer",
+		"/CreationDate",
+		"/ModDate",
+		"/Trapped"
+	];
+	for (const { object } of registry) {
+		if (!(object instanceof PdfDict) || catalogDicts.has(object)) continue;
+		const type = object.get("/Type");
+		if (type instanceof PdfName) {
+			const v = type.value;
+			if (v === "/Catalog" || v === "/Pages" || v === "/Page" || v === "/Font") continue;
+		}
+		if (INFO_KEYS.some((k) => object.has(k))) return object;
+	}
+}
+/** Read descriptive metadata from an `/Info` dict into a typed bag. */
+function readInfoMetadata(info, registry) {
+	const meta = {};
+	if (info === void 0) return meta;
+	const title = asStringValue(info.get("/Title"), registry);
+	if (title !== void 0) meta.title = title;
+	const author = asStringValue(info.get("/Author"), registry);
+	if (author !== void 0) meta.author = author;
+	const subject = asStringValue(info.get("/Subject"), registry);
+	if (subject !== void 0) meta.subject = subject;
+	const keywords = asStringValue(info.get("/Keywords"), registry);
+	if (keywords !== void 0) meta.keywords = keywords;
+	const creator = asStringValue(info.get("/Creator"), registry);
+	if (creator !== void 0) meta.creator = creator;
+	const producer = asStringValue(info.get("/Producer"), registry);
+	if (producer !== void 0) meta.producer = producer;
+	return meta;
+}
+/**
+* Produce a cleaned copy of a PDF with active / hidden content neutralised.
+*
+* Loads the PDF, removes each enabled class of content from the parsed
+* object graph, prunes the orphaned objects, re-serializes the cleaned
+* document, and returns the new bytes alongside a report listing the
+* classes that were actually present and removed.
+*
+* @param pdf      The source PDF bytes.
+* @param options  Which classes to remove (each defaults to `true`).
+* @returns        The cleaned PDF bytes and a {@link SanitizeReport}.
+*
+* @example
+* ```ts
+* const { pdf, report } = await sanitizePdf(bytes);
+* // report.removed === ['javascript', 'embeddedFiles', 'metadata']
+* ```
+*/
+async function sanitizePdf(pdf, options) {
+	const removeJavaScript = options?.javascript ?? true;
+	const removeOpenActions = options?.openActions ?? true;
+	const removeEmbeddedFiles = options?.embeddedFiles ?? true;
+	const removeMetadata = options?.metadata ?? true;
+	const registry = (await loadPdf(pdf)).getRegistry();
+	const catalogs = findCatalogEntries(registry);
+	if (catalogs.length === 0) return {
+		pdf,
+		report: { removed: [] }
+	};
+	const pages = findPages(registry);
+	const infoDict = findInfoDict(registry, catalogs);
+	const removed = /* @__PURE__ */ new Set();
+	if (removeJavaScript) {
+		for (const { dict: catalog } of catalogs) {
+			const names = getNamesDict(catalog, registry);
+			if (names !== void 0 && nameTreeHasEntries(names.get("/JavaScript"), registry)) removed.add("javascript");
+			if (aaHasJavaScript(asDict(catalog.get("/AA"), registry), registry)) removed.add("javascript");
+		}
+		for (const page of pages) if (aaHasJavaScript(asDict(page.get("/AA"), registry), registry)) removed.add("javascript");
+		for (const { dict: catalog } of catalogs) {
+			const names = getNamesDict(catalog, registry);
+			if (names !== void 0) {
+				names.delete("/JavaScript");
+				if (names.size === 0) catalog.delete("/Names");
+			}
+			catalog.delete("/AA");
+		}
+		for (const page of pages) page.delete("/AA");
+	}
+	if (removeOpenActions) {
+		for (const { dict: catalog } of catalogs) if (catalog.has("/OpenAction")) {
+			removed.add("openActions");
+			catalog.delete("/OpenAction");
+		}
+	}
+	if (removeEmbeddedFiles) {
+		for (const { dict: catalog } of catalogs) {
+			const names = getNamesDict(catalog, registry);
+			if (names !== void 0 && nameTreeHasEntries(names.get("/EmbeddedFiles"), registry)) removed.add("embeddedFiles");
+			const af = resolve$2(catalog.get("/AF"), registry);
+			if (af instanceof PdfArray && af.length > 0) removed.add("embeddedFiles");
+		}
+		for (const { dict: catalog } of catalogs) {
+			const names = getNamesDict(catalog, registry);
+			if (names !== void 0) {
+				names.delete("/EmbeddedFiles");
+				if (names.size === 0) catalog.delete("/Names");
+			}
+			catalog.delete("/AF");
+		}
+	}
+	const preservedMeta = readInfoMetadata(infoDict, registry);
+	if (removeMetadata) {
+		let metadataPresent = false;
+		for (const { dict: catalog } of catalogs) if (resolve$2(catalog.get("/Metadata"), registry) instanceof PdfStream) metadataPresent = true;
+		if (infoDict !== void 0 && DESCRIPTIVE_INFO_KEYS.some((k) => infoDict.has(k))) metadataPresent = true;
+		if (metadataPresent) removed.add("metadata");
+		for (const { dict: catalog } of catalogs) catalog.delete("/Metadata");
+		if (infoDict !== void 0) for (const [key] of [...infoDict]) infoDict.delete(key);
+	}
+	const root = catalogs[0];
+	const pagesRef = root.dict.get("/Pages");
+	let infoRef;
+	if (removeMetadata) infoRef = buildInfoDict({}, registry);
+	else infoRef = buildInfoDict(preservedMeta, registry);
+	const structure = {
+		catalogRef: root.ref,
+		infoRef,
+		pagesRef: pagesRef instanceof PdfRef ? pagesRef : root.ref
+	};
+	registry.filterReachable([structure.catalogRef, structure.infoRef]);
+	return {
+		pdf: await serializePdf(registry, structure, { compress: true }),
+		report: { removed: [...removed] }
+	};
+}
+//#endregion
+//#region src/security/redactionVerifier.ts
+/**
+* @module security/redactionVerifier
+*
+* Detect FAILED / fake redactions — text that is still extractable underneath
+* a redaction region.
+*
+* A *secure* redaction physically removes the underlying text-showing
+* operators from the page content stream (see `redactRegions` in
+* `../render/redactContent.js`), so the redacted text cannot be recovered by
+* copy/paste, text extraction, or raw stream inspection.  A *fake* redaction
+* merely paints an opaque black box on top of the page while the original text
+* remains in the byte stream — a genuine, well-documented security failure
+* (the "select-all-and-copy" leak).  This verifier finds those leaks.
+*
+* ## How it works
+*
+* For each page named by a region:
+* 1. The page's content stream is decoded
+*    (`PdfPage.getContentStream()`) and parsed (`parseContentStream`).
+* 2. `extractTextWithPositions` replays the text/graphics-state machine and
+*    yields one positioned {@link import('../parser/textExtractor.js').TextItem}
+*    per shown text run, with its page-space origin and size.
+* 3. Every text item whose bounding box intersects a region rectangle is
+*    reported as a leak.  `clean` is true iff there are no leaks.
+*
+* ## Coordinate / encoding conventions (confirmed, not assumed)
+*
+* - **Space:** PDF user space — the coordinate space produced by
+*   `extractTextWithPositions`.  Origin is **bottom-left**, the y-axis points
+*   **up**, and units are **PDF points** (1/72 inch).  This matches
+*   `RedactRect` in `../render/redactContent.js` ("page space, PDF points,
+*   y-up, lower-left origin"), so a {@link RedactionRegion} uses exactly the
+*   same convention: `(x, y)` is the lower-left corner and `width` / `height`
+*   extend in the +x / +y directions.
+* - **Glyph box:** a `TextItem` reports `(x, y)` = the text origin
+*   (baseline-left), `width` extending +x, and `height` (equal to the font
+*   size) extending +y.  The run's axis-aligned box is therefore
+*   `[x, y, x + width, y + height]`.  Note `width`/`height` are heuristic
+*   estimates from `extractTextWithPositions` (0.5·fontSize per character;
+*   height = fontSize) because per-glyph font metrics are not available there;
+*   intersection testing tolerates this by treating any overlap as a leak.
+* - **Text decoding:** strings are decoded by `extractTextWithPositions` using
+*   the font's `/ToUnicode` CMap when present, else WinAnsiEncoding (1-byte) or
+*   2-byte Identity-H for CID fonts — see `../parser/textExtractor.js`.
+*
+* ## Region auto-detection is intentionally NOT performed
+*
+* The `regions` argument is **required**.  Deriving candidate regions from the
+* PDF itself is not reliable through the public API and is not fabricated here:
+*   - Filled black rectangles in the content stream are indistinguishable from
+*     legitimate black-filled graphics (chart bars, rules, design elements), so
+*     a heuristic would produce false positives/negatives.
+*   - `/Redact` annotations (ISO 32000-2 §12.5.6.23) *do* carry explicit
+*     `/Rect` / `/QuadPoints` regions, but a loaded page's original annotation
+*     dictionaries are not exposed through a stable public `PdfPage` accessor,
+*     so reading them here is not possible without reaching into private state.
+* Callers must therefore pass the regions they redacted (or believe were
+* redacted).  When `regions` is omitted or empty, {@link verifyRedactions}
+* throws.
+*
+* @packageDocumentation
+*/
+/**
+* Axis-aligned bounding box of a text run in page space (bottom-left origin).
+* `width`/`height` may be zero (empty text); such runs never intersect.
+*/
+function itemBox(item) {
+	const x0 = item.x;
+	const y0 = item.y;
+	const x1 = item.x + item.width;
+	const y1 = item.y + item.height;
+	return {
+		minX: Math.min(x0, x1),
+		minY: Math.min(y0, y1),
+		maxX: Math.max(x0, x1),
+		maxY: Math.max(y0, y1)
+	};
+}
+/**
+* Whether a text run's box overlaps a region rectangle.
+*
+* Uses the standard separating-axis test for axis-aligned rectangles: they
+* overlap unless one is entirely to the left/right/above/below the other.
+* Touching edges count as overlap (inclusive bounds), matching the intersection
+* test in `../render/redactContent.js`.
+*/
+function intersects$1(box, region) {
+	const rMinX = region.x;
+	const rMinY = region.y;
+	const rMaxX = region.x + region.width;
+	const rMaxY = region.y + region.height;
+	return box.minX <= rMaxX && box.maxX >= rMinX && box.minY <= rMaxY && box.maxY >= rMinY;
+}
+/**
+* Verify that the given regions of a PDF contain no still-extractable text,
+* detecting fake / failed redactions.
+*
+* For each region, the corresponding page's text is extracted with positions
+* and any text run whose bounding box intersects the region is reported as a
+* {@link RedactionLeak}.  A clean result means no text was found under any
+* region (the redactions truly removed the content, or there was none to begin
+* with).
+*
+* @param pdf      The PDF file bytes to inspect.
+* @param regions  The regions to check (REQUIRED — see the module docs for why
+*                 automatic region detection is not performed).  Coordinates are
+*                 in PDF user space: origin bottom-left, y-up, units in points;
+*                 `(x, y)` is the lower-left corner.
+* @returns        A report listing every leak; `clean` is true iff there are
+*                 none.
+* @throws         `TypeError` if `regions` is omitted or empty.
+*
+* @example
+* ```ts
+* const report = await verifyRedactions(pdfBytes, [
+*   { page: 0, x: 45, y: 545, width: 120, height: 25 },
+* ]);
+* if (!report.clean) {
+*   for (const leak of report.leaks) {
+*     console.warn(`Leak on page ${leak.page}: "${leak.text}"`);
+*   }
+* }
+* ```
+*/
+async function verifyRedactions(pdf, regions) {
+	if (regions === void 0 || regions.length === 0) throw new TypeError("verifyRedactions requires an explicit, non-empty `regions` array. Automatic redaction-region detection is not performed: black-filled rectangles are indistinguishable from legitimate graphics, and a loaded page's original /Redact annotations are not exposed through a stable public API. Pass the regions you redacted (PDF points, bottom-left origin, y-up).");
+	const doc = await loadPdf(pdf);
+	const pageCount = doc.getPageCount();
+	const itemsByPage = /* @__PURE__ */ new Map();
+	const getItems = (pageIndex) => {
+		const cached = itemsByPage.get(pageIndex);
+		if (cached !== void 0) return cached;
+		let items = [];
+		if (pageIndex >= 0 && pageIndex < pageCount) {
+			const page = doc.getPage(pageIndex);
+			items = extractTextWithPositions(parseContentStream(page.getContentStream()), page.getOriginalResources());
+		}
+		itemsByPage.set(pageIndex, items);
+		return items;
+	};
+	const leaks = [];
+	for (const region of regions) {
+		if (region.width <= 0 || region.height <= 0) continue;
+		const items = getItems(region.page);
+		for (const item of items) {
+			if (item.text.length === 0) continue;
+			const box = itemBox(item);
+			if (box.maxX === box.minX && box.maxY === box.minY) continue;
+			if (intersects$1(box, region)) leaks.push({
+				page: region.page,
+				text: item.text,
+				x: item.x,
+				y: item.y
+			});
+		}
+	}
+	return {
+		leaks,
+		clean: leaks.length === 0,
+		regionsChecked: regions.length
+	};
+}
+//#endregion
+//#region src/security/encryptionInspector.ts
+const BIT_PRINT = 4;
+const BIT_MODIFY = 8;
+const BIT_COPY = 16;
+const BIT_ANNOTATE = 32;
+const BIT_FILL_FORMS = 256;
+const BIT_ASSEMBLE = 1024;
+const BIT_PRINT_HIGH_RES = 2048;
+/**
+* Inspect a PDF's encryption + permission posture.
+*
+* @param pdf  The raw PDF file bytes.
+* @returns    A {@link EncryptionReport}.  If the trailer has no
+*             `/Encrypt` entry (or the file is unparseable) the report is
+*             `{ encrypted: false }`.
+*/
+async function inspectEncryption(pdf) {
+	const located = await locateEncryptDict(pdf);
+	if (located === void 0) return { encrypted: false };
+	const { encryptDict, fileId, encryptRef } = located;
+	const filterName = getName(encryptDict, "/Filter");
+	let handler;
+	if (filterName === "/Standard") handler = "password";
+	else if (filterName === "/Adobe.PubSec") handler = "publicKey";
+	const version = getNumber(encryptDict, "/V");
+	const revision = getNumber(encryptDict, "/R");
+	const { method, keyBits } = decodeAlgorithm(encryptDict, version);
+	let permissions;
+	const pValue = getNumber(encryptDict, "/P");
+	if (handler === "password" && pValue !== void 0) permissions = decodePermissionBits(pValue);
+	let emptyUserPassword;
+	if (handler === "password") emptyUserPassword = await testEmptyUserPassword(encryptDict, fileId);
+	const report = { encrypted: true };
+	if (method !== void 0) report.method = method;
+	if (keyBits !== void 0) report.keyBits = keyBits;
+	if (version !== void 0) report.version = version;
+	if (revision !== void 0) report.revision = revision;
+	if (handler !== void 0) report.handler = handler;
+	if (emptyUserPassword !== void 0) report.emptyUserPassword = emptyUserPassword;
+	if (permissions !== void 0) report.permissions = permissions;
+	return report;
+}
+/**
+* Parse just enough of the PDF (header + xref + trailer) to resolve the
+* `/Encrypt` dictionary and the first element of the `/ID` array.
+*
+* Returns `undefined` when the file has no `/Encrypt` entry or when it
+* cannot be parsed far enough to find one.
+*/
+async function locateEncryptDict(pdf) {
+	if (pdf.length < 8) return void 0;
+	let encryptRef;
+	let fileIdFirst;
+	let entry;
+	let objectParser;
+	try {
+		objectParser = new PdfObjectParser(new PdfLexer(pdf), new PdfObjectRegistry());
+		const { entries, trailer } = await new XrefParser(pdf, objectParser).parseXref();
+		encryptRef = trailer.encryptRef;
+		if (encryptRef === void 0) return void 0;
+		fileIdFirst = trailer.id?.[0] ?? /* @__PURE__ */ new Uint8Array(0);
+		entry = entries.get(encryptRef.objectNumber);
+	} catch {
+		return;
+	}
+	if (entry === void 0 || entry.type !== "in-use") return void 0;
+	let encryptObj;
+	try {
+		const { object } = objectParser.parseIndirectObjectAt(entry.offset);
+		encryptObj = object;
+	} catch {
+		return;
+	}
+	if (encryptObj.kind !== "dict") return void 0;
+	return {
+		encryptDict: encryptObj,
+		encryptRef,
+		fileId: fileIdFirst
+	};
+}
+/**
+* Decode the bulk cipher and key length from an encryption dictionary.
+*
+* - V=1: 40-bit RC4 (Table 20/21).
+* - V=2: RC4 with `/Length` bits.
+* - V=4: inspect the crypt filter `/CFM` of the filter named by `/StmF`
+*   (falling back to `/StdCF`): `/V2` → RC4, `/AESV2` → 128-bit AES,
+*   `/AESV3` → 256-bit AES, `/Identity`/`/None` → no encryption.
+* - V=5: 256-bit AES (`/AESV3`).
+*/
+function decodeAlgorithm(dict, version) {
+	const lengthBits = getNumber(dict, "/Length");
+	if (version === 1) return {
+		method: "rc4",
+		keyBits: 40
+	};
+	if (version === 2) return {
+		method: "rc4",
+		keyBits: lengthBits ?? 40
+	};
+	if (version === 5) return {
+		method: "aes",
+		keyBits: 256
+	};
+	if (version === 4) {
+		const cfm = resolveCryptFilterMethod(dict);
+		if (cfm === "/AESV3") return {
+			method: "aes",
+			keyBits: 256
+		};
+		if (cfm === "/AESV2") return {
+			method: "aes",
+			keyBits: lengthBits ?? 128
+		};
+		if (cfm === "/V2") return {
+			method: "rc4",
+			keyBits: lengthBits ?? 128
+		};
+		return {
+			method: void 0,
+			keyBits: lengthBits ?? void 0
+		};
+	}
+	return {
+		method: void 0,
+		keyBits: lengthBits ?? void 0
+	};
+}
+/**
+* For V=4 documents, resolve the `/CFM` (crypt filter method) name of the
+* stream crypt filter.  Looks up `/StmF` in `/CF`, then falls back to the
+* conventional `/StdCF` entry.
+*/
+function resolveCryptFilterMethod(dict) {
+	const cf = dict.get("/CF");
+	if (cf === void 0 || cf.kind !== "dict") return void 0;
+	const cfDict = cf;
+	let filterName = getName(dict, "/StmF");
+	if (filterName === "/Identity") return "/Identity";
+	let stdCf = filterName !== void 0 ? cfDict.get(filterName) : void 0;
+	if (stdCf === void 0 || stdCf.kind !== "dict") {
+		stdCf = cfDict.get("/StdCF");
+		filterName = "/StdCF";
+	}
+	if (stdCf === void 0 || stdCf.kind !== "dict") return void 0;
+	return getName(stdCf, "/CFM");
+}
+/**
+* Decode the 32-bit `/P` integer into individual permission flags.
+*
+* The `/P` value is a *signed* 32-bit integer; bitwise AND in JavaScript
+* operates on the 32-bit two's-complement representation, so masks apply
+* correctly even when `/P` is negative (the usual case, since reserved
+* high bits are set to 1).
+*/
+function decodePermissionBits(p) {
+	const has = (mask) => (p & mask) !== 0;
+	const copy = has(BIT_COPY);
+	return {
+		print: has(BIT_PRINT),
+		modify: has(BIT_MODIFY),
+		copy,
+		annotate: has(BIT_ANNOTATE),
+		fillForms: has(BIT_FILL_FORMS),
+		extract: copy,
+		assemble: has(BIT_ASSEMBLE),
+		printHighRes: has(BIT_PRINT_HIGH_RES)
+	};
+}
+/**
+* Test whether the empty user password (`""`) authenticates against the
+* standard security handler.  Reuses {@link PdfEncryptionHandler.fromEncryptDict},
+* which throws when the password is incorrect; a successful return means
+* the empty password derived a valid file key.
+*
+* Returns `undefined` when the test cannot be performed (e.g. the handler
+* implementation does not support the document's /V/R).
+*/
+async function testEmptyUserPassword(dict, fileId) {
+	try {
+		await PdfEncryptionHandler.fromEncryptDict(dict, fileId, "");
+		return true;
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (/password/i.test(message)) return false;
+		return;
+	}
+}
+/** Read a `/Name` value (including the leading `/`) from a dict. */
+function getName(dict, key) {
+	const obj = dict.get(key);
+	if (obj !== void 0 && obj.kind === "name") return obj.value;
+}
+/** Read a numeric value from a dict. */
+function getNumber(dict, key) {
+	const obj = dict.get(key);
+	if (obj !== void 0 && obj.kind === "number") return obj.value;
+}
+//#endregion
 //#region src/render/matrix.ts
 /** The identity transform. */
 function identity() {
@@ -31649,15 +32924,15 @@ async function initWasm(options) {
 	if (wasmInitialized) return;
 	const inits = [];
 	if (options.deflate || options.deflateWasm) inits.push((async () => {
-		const { initDeflateWasm } = await import("./pdfDocument-Cgkkk8F8.mjs").then((n) => n.zt);
+		const { initDeflateWasm } = await import("./pdfDocument-Q0wrwKEZ.mjs").then((n) => n.Wt);
 		await initDeflateWasm(options.deflateWasm);
 	})());
 	if (options.png || options.pngWasm) inits.push((async () => {
-		const { initPngWasm } = await import("./pdfDocument-Cgkkk8F8.mjs").then((n) => n.At);
+		const { initPngWasm } = await import("./pdfDocument-Q0wrwKEZ.mjs").then((n) => n.Ft);
 		await initPngWasm(options.pngWasm);
 	})());
 	if (options.fonts || options.fontWasm) inits.push((async () => {
-		const { initSubsetWasm } = await import("./pdfDocument-Cgkkk8F8.mjs").then((n) => n.Pt);
+		const { initSubsetWasm } = await import("./pdfDocument-Q0wrwKEZ.mjs").then((n) => n.zt);
 		await initSubsetWasm(options.fontWasm);
 	})());
 	if (options.jpeg || options.jpegWasm) inits.push((async () => {
@@ -31668,6 +32943,6 @@ async function initWasm(options) {
 	wasmInitialized = true;
 }
 //#endregion
-export { extractEmbeddedRevocationData as $, PdfSquareAnnotation as $a, getSupportedLevels as $i, timestampPlugin as $n, readEan13 as $r, h as $t, buildSoftMaskNone as A, buildDocMdpReference as Aa, webpToPng as Ai, DEFAULT_DOC_TIMESTAMP_CONTENTS_SIZE as An, StreamingParseError as Ar, extractOcspUrl as At, redactRegions as B, parseTimestampResponse as Ba, recompressImage as Bi, MATHML_NAMESPACE as Bn, estimateTextWidth as Br, formatDate as Bt, tagTableHeaderCell as C, getCounterSignatures as Ca, valuesToModules as Ci, identityTransferFunction as Cn, saveDocumentIncremental as Co, InvalidFieldNamePartError as Cr, parseTileInfo as Ct, buildImageSoftMask as D, getFieldLocks as Da, encodePngFromPixels as Di, buildCollection as Dn, PluginError as Dr, extractCrlUrls as Dt, buildColorKeyMask as E, buildFieldLockDict as Ea, embedTiffDirect as Ei, markdownToPdf as En, NoSuchFieldError as Er, downloadCrl as Et, attachAssociatedFiles as F, findExistingSignatures as Fa, injectJpegMetadata as Fi, labToRgb as Fn, replaceTemplateVariables as Fr, addVisibilityAction as Ft, extractImages as G, PdfPopupAnnotation as Ga, countOccurrences as Gi, buildRequirement as Gn, applyTablePreset as Gr, isWoff as Gt, compareImages as H, searchTextItems as Ha, enforcePdfAFull as Hi, buildNamespace as Hn, truncateText as Hr, AFNumber_Format as Ht, registerEmbeddedFile as I, parseExistingTrailer as Ia, analyzeJpegMarkers as Ii, DEFAULT_SARIF_TOOL_NAME as In, toAlpha as Ir, setFieldVisibility as It, renderPageToCanvas as J, PdfStampAnnotation as Ja, createAssociatedFile as Ji, extractTables as Jn, professionalPreset as Jr, signDeferred as Jt, generateThumbnail as K, PdfRedactAnnotation as Ka, stripProhibitedFeatures as Ki, buildRequirements as Kn, borderedPreset as Kr, isWoff2 as Kt, RenderCache as L, saveIncrementalWithSignaturePreservation as La, downscaleImage as Li, SARIF_SCHEMA_URI as Ln, toRoman as Lr, validateFieldValue as Lt, buildUnencryptedWrapper as M, setCertificationLevel as Ma, embedTiffCmyk as Mi, buildCalGray as Mn, applyHeaderFooter as Mr, getFieldValue as Mt, attachOutputIntents as N, validateSignatureChain as Na, isCmykTiff as Ni, buildCalRGB as Nn, applyHeaderFooterToPage as Nr, resolveFieldReference as Nt, buildStencilMask as O, detectModifications as Oa, recompressWebP as Oi, reconstructLines as On, RemovePageFromEmptyDocumentError as Or, isCertificateRevoked as Ot, buildPageOutputIntent as P, appendIncrementalUpdate as Pa, extractJpegMetadata as Pi, buildLab as Pn, formatDate$1 as Pr, setFieldValue as Pt, interpretPage as Q, PdfPolygonAnnotation as Qa, getProfile as Qi, metadataPlugin as Qn, readCode39 as Qr, gtsPdfVtVersion as Qt, computeTileGrid as R, validateByteRangeIntegrity as Ra, estimateJpegQuality as Ri, toJsonReport as Rn, applyOverflow as Rr, AFSpecial_Format as Rt, tagTableDataCell as S, addCounterSignature as Sa, encodeCode128Values as Si, buildType5Halftone as Sn, ChangeTracker as So, InvalidColorError as Sr, decodeTileRegion as St, buildBlackPointCompensationExtGState as T, addFieldLock as Ta, canDirectEmbed as Ti, evaluateFunction as Tn, MissingOnValueCheckError as Tr, TrustStore as Tt, comparePages as U, PdfFileAttachmentAnnotation as Ua, generatePdfAXmp as Ui, buildNamespacesArray as Un, wrapText$2 as Ur, formatNumber$1 as Ut, applyOcr as V, requestTimestamp as Va, applyRedaction as Vi, PDF2_NAMESPACE as Vn, shrinkFontSize as Vr, parseAcrobatDate as Vt, extractFonts as W, PdfCaretAnnotation as Wa, generatePdfAXmpBytes as Wi, buildPieceInfo as Wn, applyPreset as Wr, decodeWoff as Wt, renderPageToImage as X, PdfLineAnnotation as Xa, parseXmpMetadata as Xi, tableToJson as Xn, readBarcode as Xr, buildPdfVtDParts as Xt, rasterize as Y, PdfCircleAnnotation as Ya, extractXmpMetadata as Yi, tableToCsv as Yn, stripedPreset as Yr, createWorkerPool as Yt, interpretContentStream as Z, PdfPolyLineAnnotation as Za, validateXmpMetadata as Zi, accessibilityPlugin as Zn, readCode128 as Zr, buildVtDpm as Zt, tagLink as _, findChangedObjects as _a, code39ToOperators as _i, validateBoxGeometry as _n, createXmpStream as _o, ExceededMaxLengthError as _r, offsetSignedToUnsigned as _t, assembleFacturX as a, buildOutputIntent as aa, dataMatrixToOperators as ai, generateXRechnungCii as an, generateCircleAppearance as ao, batchMerge as ar, buildCertificateChain as at, tagParagraph as b, embedLtvData as ba, code128ToOperators as bi, buildThresholdHalftone as bn, buildDeviceNColorSpace as bo, FontNotEmbeddedError as br, assembleTiles as bt, buildWtpdfIdentificationXmp as c, detectTransparency as ca, encodeUpcA as ci, buildFunctionShading as cn, generateInkAppearance as co, getBookmarks as cr, layoutColumns as ct, autoTagPage as d, validatePdfA as da, ean13ToOperators as di, levenshtein as dn, generateSquigglyAppearance as do, flattenField as dr, buildPdfXOutputIntent as dt, isValidLevel as ea, readEan8 as ei, renderToPdf as en, PdfHighlightAnnotation as eo, StreamingPdfParser as er, verifyOfflineRevocation as et, buildPdfUa2Xmp as f, delinearizePdf as fa, ean8ToOperators as fi, renderCodeFrame as fn, generateStrikeOutAppearance as fo, flattenFields as fr, enforcePdfX as ft, tagHeading as g, computeObjectHash as ga, itfToOperators as gi, buildPdfX6OutputIntent as gn, buildXmpMetadata as go, EncryptedPdfError as gr, normalizeComponentDepth as gt, tagFigure as h, linearizePdf as ha, encodeItf as hi, buildGtsPdfxVersion as hn, PdfTextAnnotation as ho, CombedTextLayoutError as hr, getComponentDepths as ht, validateEn16931 as i, getToUnicodeCmap as ia, pdf417ToOperators as ii, generateOrderX as in, PdfFreeTextAnnotation as io, batchFlatten as ir, validateKeyUsage as it, buildEncryptedPayload as j, getCertificationLevel as ja, convertTiffCmykToRgb as ji, buildDocTimeStampDict as jn, UnexpectedFieldTypeError as jr, createSandbox as jt, buildSoftMaskGroupExtGState as k, MdpPermission as ka, webpToJpeg as ki, reconstructParagraphs as kn, RichTextFieldReadError as kr, checkCertificateStatus as kt, convertPdfAConformanceXmp as l, flattenTransparency as la, upcAToOperators as li, sampleShadingColor as ln, generateLineAppearance as lo, removeAllBookmarks as lr, layoutParagraph as lt, LIST_NUMBERING_KEY as m, isLinearized as ma, encodeEan8 as mi, buildBoxDict as mn, PdfLinkAnnotation as mo, BatchProcessingError as mr, downscale16To8 as mt, detectFacturXProfile as n, generateWinAnsiToUnicodeCmap as na, renderStyledBarcode as ni, resolveFallback as nn, PdfStrikeOutAnnotation as no, enforcePdfUa as nr, validateCertificatePolicy as nt, buildFacturXXmp as o, SRGB_ICC_PROFILE as oa, encodeDataMatrix as oi, buildPdfA4Xmp as on, generateFreeTextAppearance as oo, processBatch as or, validateCertificateChain as ot, validatePdfUa2 as p, getLinearizationInfo as pa, encodeEan13 as pi, generateCiiXml as pn, generateUnderlineAppearance as po, flattenForm as pr, validatePdfX as pt, renderDisplayListToCanvas as q, PdfInkAnnotation as qa, buildAfArray as qi, buildDPartRoot as qn, minimalPreset as qr, readWoffHeader as qt, parseCiiXml as r, generateZapfDingbatsToUnicodeCmap as ra, encodePdf417 as ri, splitByScript as rn, PdfUnderlineAnnotation as ro, validatePdfUa as rr, validateExtendedKeyUsage as rt, buildPdfRIdentificationXmp as s, generateSrgbIccProfile as sa, calculateUpcCheckDigit as si, pdfA4Rules as sn, generateHighlightAppearance as so, addBookmark as sr, findHyphenationPoints as st, initWasm as t, generateSymbolToUnicodeCmap as ta, calculateBarcodeDimensions as ti, createRangeFetcher as tn, PdfSquigglyAnnotation as to, PdfDocumentBuilder as tr, EKU_OIDS as tt, preflightPdfA as u, enforcePdfA as ua, calculateEanCheckDigit as ui, didYouMean as un, generateSquareAppearance as uo, removeBookmark as ur, layoutTextFlow as ut, tagList as v, optimizeIncrementalSave as va, computeCode39CheckDigit as vi, STANDARD_SPOT_FUNCTIONS as vn, parseXmpMetadata$1 as vo, FieldAlreadyExistsError as vr, summarizeBitDepth as vt, tagTableRow as w, diffSignedContent as wa, PdfWorker as wi, nameHalftone as wn, saveIncremental as wo, InvalidPageSizeError as wr, verifySignatureDetailed as wt, tagTable as x, hasLtvData as xa, encodeCode128 as xi, buildType1Halftone as xn, buildSeparationColorSpace as xo, ForeignPageError as xr, decodeTile as xt, tagListItem as y, buildDssDictionary as ya, encodeCode39 as yi, buildSampledTransferFunction as yn, PDFOperator as yo, FieldExistsAsNonTerminalError as yr, upscale8To16 as yt, renderPageTile as z, buildTimestampRequest as za, optimizeImage as zi, toSarif as zn, ellipsisText as zr, AFDate_FormatEx as zt };
+export { inspectEncryption as $, PdfStampAnnotation as $a, createAssociatedFile as $i, extractTables as $n, professionalPreset as $r, signDeferred as $t, buildSoftMaskNone as A, addFieldLock as Aa, canDirectEmbed as Ai, evaluateFunction as An, MissingOnValueCheckError as Ar, TrustStore as At, redactRegions as B, findExistingSignatures as Ba, injectJpegMetadata as Bi, labToRgb as Bn, replaceTemplateVariables as Br, addVisibilityAction as Bt, tagTableHeaderCell as C, optimizeIncrementalSave as Ca, computeCode39CheckDigit as Ci, STANDARD_SPOT_FUNCTIONS as Cn, parseXmpMetadata$1 as Co, FieldAlreadyExistsError as Cr, summarizeBitDepth as Ct, buildImageSoftMask as D, addCounterSignature as Da, encodeCode128Values as Di, buildType5Halftone as Dn, ChangeTracker as Do, InvalidColorError as Dr, decodeTileRegion as Dt, buildColorKeyMask as E, hasLtvData as Ea, encodeCode128 as Ei, buildType1Halftone as En, buildSeparationColorSpace as Eo, ForeignPageError as Er, decodeTile as Et, attachAssociatedFiles as F, buildDocMdpReference as Fa, webpToPng as Fi, DEFAULT_DOC_TIMESTAMP_CONTENTS_SIZE as Fn, StreamingParseError as Fr, extractOcspUrl as Ft, extractImages as G, parseTimestampResponse as Ga, recompressImage as Gi, MATHML_NAMESPACE as Gn, estimateTextWidth as Gr, formatDate as Gt, compareImages as H, saveIncrementalWithSignaturePreservation as Ha, downscaleImage as Hi, SARIF_SCHEMA_URI as Hn, toRoman as Hr, validateFieldValue as Ht, registerEmbeddedFile as I, getCertificationLevel as Ia, convertTiffCmykToRgb as Ii, buildDocTimeStampDict as In, UnexpectedFieldTypeError as Ir, createSandbox as It, renderPageToCanvas as J, PdfFileAttachmentAnnotation as Ja, generatePdfAXmp as Ji, buildNamespacesArray as Jn, wrapText$2 as Jr, formatNumber$1 as Jt, generateThumbnail as K, requestTimestamp as Ka, applyRedaction as Ki, PDF2_NAMESPACE as Kn, shrinkFontSize as Kr, parseAcrobatDate as Kt, RenderCache as L, setCertificationLevel as La, embedTiffCmyk as Li, buildCalGray as Ln, applyHeaderFooter as Lr, getFieldValue as Lt, buildUnencryptedWrapper as M, getFieldLocks as Ma, encodePngFromPixels as Mi, buildCollection as Mn, PluginError as Mr, extractCrlUrls as Mt, attachOutputIntents as N, detectModifications as Na, recompressWebP as Ni, reconstructLines as Nn, RemovePageFromEmptyDocumentError as Nr, isCertificateRevoked as Nt, buildStencilMask as O, getCounterSignatures as Oa, valuesToModules as Oi, identityTransferFunction as On, saveDocumentIncremental as Oo, InvalidFieldNamePartError as Or, parseTileInfo as Ot, buildPageOutputIntent as P, MdpPermission as Pa, webpToJpeg as Pi, reconstructParagraphs as Pn, RichTextFieldReadError as Pr, checkCertificateStatus as Pt, interpretPage as Q, PdfInkAnnotation as Qa, buildAfArray as Qi, buildDPartRoot as Qn, minimalPreset as Qr, readWoffHeader as Qt, computeTileGrid as R, validateSignatureChain as Ra, isCmykTiff as Ri, buildCalRGB as Rn, applyHeaderFooterToPage as Rr, resolveFieldReference as Rt, tagTableDataCell as S, findChangedObjects as Sa, code39ToOperators as Si, validateBoxGeometry as Sn, createXmpStream as So, ExceededMaxLengthError as Sr, offsetSignedToUnsigned as St, buildBlackPointCompensationExtGState as T, embedLtvData as Ta, code128ToOperators as Ti, buildThresholdHalftone as Tn, buildDeviceNColorSpace as To, FontNotEmbeddedError as Tr, assembleTiles as Tt, comparePages as U, validateByteRangeIntegrity as Ua, estimateJpegQuality as Ui, toJsonReport as Un, applyOverflow as Ur, AFSpecial_Format as Ut, applyOcr as V, parseExistingTrailer as Va, analyzeJpegMarkers as Vi, DEFAULT_SARIF_TOOL_NAME as Vn, toAlpha as Vr, setFieldVisibility as Vt, extractFonts as W, buildTimestampRequest as Wa, optimizeImage as Wi, toSarif as Wn, ellipsisText as Wr, AFDate_FormatEx as Wt, renderPageToImage as X, PdfPopupAnnotation as Xa, countOccurrences as Xi, buildRequirement as Xn, applyTablePreset as Xr, isWoff as Xt, rasterize as Y, PdfCaretAnnotation as Ya, generatePdfAXmpBytes as Yi, buildPieceInfo as Yn, applyPreset as Yr, decodeWoff as Yt, interpretContentStream as Z, PdfRedactAnnotation as Za, stripProhibitedFeatures as Zi, buildRequirements as Zn, borderedPreset as Zr, isWoff2 as Zt, tagLink as _, delinearizePdf as _a, ean8ToOperators as _i, renderCodeFrame as _n, generateStrikeOutAppearance as _o, flattenFields as _r, enforcePdfX as _t, assembleFacturX as a, isValidLevel as aa, readEan8 as ai, renderToPdf as an, PdfHighlightAnnotation as ao, StreamingPdfParser as ar, verifyOfflineRevocation as at, tagParagraph as b, linearizePdf as ba, encodeItf as bi, buildGtsPdfxVersion as bn, PdfTextAnnotation as bo, CombedTextLayoutError as br, getComponentDepths as bt, buildWtpdfIdentificationXmp as c, generateZapfDingbatsToUnicodeCmap as ca, encodePdf417 as ci, splitByScript as cn, PdfUnderlineAnnotation as co, validatePdfUa as cr, validateExtendedKeyUsage as ct, autoTagPage as d, SRGB_ICC_PROFILE as da, encodeDataMatrix as di, buildPdfA4Xmp as dn, generateFreeTextAppearance as do, processBatch as dr, validateCertificateChain as dt, extractXmpMetadata as ea, stripedPreset as ei, createWorkerPool as en, PdfCircleAnnotation as eo, tableToCsv as er, verifyRedactions as et, buildPdfUa2Xmp as f, generateSrgbIccProfile as fa, calculateUpcCheckDigit as fi, pdfA4Rules as fn, generateHighlightAppearance as fo, addBookmark as fr, findHyphenationPoints as ft, tagHeading as g, validatePdfA as ga, ean13ToOperators as gi, levenshtein as gn, generateSquigglyAppearance as go, flattenField as gr, buildPdfXOutputIntent as gt, tagFigure as h, enforcePdfA as ha, calculateEanCheckDigit as hi, didYouMean as hn, generateSquareAppearance as ho, removeBookmark as hr, layoutTextFlow as ht, validateEn16931 as i, getSupportedLevels as ia, readEan13 as ii, h as in, PdfSquareAnnotation as io, timestampPlugin as ir, extractEmbeddedRevocationData as it, buildEncryptedPayload as j, buildFieldLockDict as ja, embedTiffDirect as ji, markdownToPdf as jn, NoSuchFieldError as jr, downloadCrl as jt, buildSoftMaskGroupExtGState as k, diffSignedContent as ka, PdfWorker as ki, nameHalftone as kn, saveIncremental as ko, InvalidPageSizeError as kr, verifySignatureDetailed as kt, convertPdfAConformanceXmp as l, getToUnicodeCmap as la, pdf417ToOperators as li, generateOrderX as ln, PdfFreeTextAnnotation as lo, batchFlatten as lr, validateKeyUsage as lt, LIST_NUMBERING_KEY as m, flattenTransparency as ma, upcAToOperators as mi, sampleShadingColor as mn, generateLineAppearance as mo, removeAllBookmarks as mr, layoutParagraph as mt, detectFacturXProfile as n, validateXmpMetadata as na, readCode128 as ni, buildVtDpm as nn, PdfPolyLineAnnotation as no, accessibilityPlugin as nr, scanPdfThreats as nt, buildFacturXXmp as o, generateSymbolToUnicodeCmap as oa, calculateBarcodeDimensions as oi, createRangeFetcher as on, PdfSquigglyAnnotation as oo, PdfDocumentBuilder as or, EKU_OIDS as ot, validatePdfUa2 as p, detectTransparency as pa, encodeUpcA as pi, buildFunctionShading as pn, generateInkAppearance as po, getBookmarks as pr, layoutColumns as pt, renderDisplayListToCanvas as q, searchTextItems as qa, enforcePdfAFull as qi, buildNamespace as qn, truncateText as qr, AFNumber_Format as qt, parseCiiXml as r, getProfile as ra, readCode39 as ri, gtsPdfVtVersion as rn, PdfPolygonAnnotation as ro, metadataPlugin as rr, buildCertPath as rt, buildPdfRIdentificationXmp as s, generateWinAnsiToUnicodeCmap as sa, renderStyledBarcode as si, resolveFallback as sn, PdfStrikeOutAnnotation as so, enforcePdfUa as sr, validateCertificatePolicy as st, initWasm as t, parseXmpMetadata as ta, readBarcode as ti, buildPdfVtDParts as tn, PdfLineAnnotation as to, tableToJson as tr, sanitizePdf as tt, preflightPdfA as u, buildOutputIntent as ua, dataMatrixToOperators as ui, generateXRechnungCii as un, generateCircleAppearance as uo, batchMerge as ur, buildCertificateChain as ut, tagList as v, getLinearizationInfo as va, encodeEan13 as vi, generateCiiXml as vn, generateUnderlineAppearance as vo, flattenForm as vr, validatePdfX as vt, tagTableRow as w, buildDssDictionary as wa, encodeCode39 as wi, buildSampledTransferFunction as wn, PDFOperator as wo, FieldExistsAsNonTerminalError as wr, upscale8To16 as wt, tagTable as x, computeObjectHash as xa, itfToOperators as xi, buildPdfX6OutputIntent as xn, buildXmpMetadata as xo, EncryptedPdfError as xr, normalizeComponentDepth as xt, tagListItem as y, isLinearized as ya, encodeEan8 as yi, buildBoxDict as yn, PdfLinkAnnotation as yo, BatchProcessingError as yr, downscale16To8 as yt, renderPageTile as z, appendIncrementalUpdate as za, extractJpegMetadata as zi, buildLab as zn, formatDate$1 as zr, setFieldValue as zt };
 
-//# sourceMappingURL=src-zeRl33xQ.mjs.map
+//# sourceMappingURL=src-BlUlmYsU.mjs.map