PDF Toolbox vendored runtime assets

Generated by npm run pdftoolbox:vendor (scripts/copy-pdftoolbox-vendor.mjs). Do not hand-edit; re-run the script after upgrading a package.

Dir	npm package	version	files
pdfjs	`pdfjs-dist`	6.1.200	pdf.min.mjs (442 KB) pdf.worker.min.mjs (1226 KB)
sortable	`sortablejs`	1.15.7	Sortable.min.js (44 KB)
gs	`@jspawn/ghostscript-wasm`	0.0.2	gs.mjs (1 KB) browser.js (0 KB) gs.js (104 KB) gs.wasm (15798 KB) LICENSE (34 KB)

Total vendored: 17.23 MB across 8 files.

pdf-lib is NOT vendored here

The worker imports pdf-lib with a literal specifier, so esbuild bundles it INTO dist/js/tools/pdftoolbox-worker.js. Only assets loaded BY URL at runtime (pdf.js, SortableJS, Ghostscript) are vendored.

@jspawn/ghostscript-wasm is a real, pinned npm package (deps: none).
gs.wasm is a single ~16 MB file, well under the 25 MiB Cloudflare Pages per-file limit.
The emscripten glue uses no eval / new Function; wasm loads via WebAssembly.instantiate, which satisfies the /tools/* CSP (script-src 'self' 'wasm-unsafe-eval'). The worker lazy-imports gs.mjs BY URL and sets locateFile so gs.js fetches gs.wasm from /assets/vendor/pdftoolbox/gs/ only when a compress job runs.
Verified end to end in Node: a -dPDFSETTINGS=/screen run returns a valid smaller PDF (rc 0).

pdf.js only needs CMap tables for predefined-CID / CJK glyph mapping. The Toolbox rasters thumbnails only; missing cmaps drop a few CJK glyphs at worst, never fail. Shipping the 169-file cmap set would add megabytes for a case the tool does not target. Vendor pdfjs-dist/cmaps/ and set pdf.js cMapUrl here if full CJK thumbnail fidelity is ever needed.