# PDF.js 6.4.299 and decoder preferred sources

The package registry identifies PDF.js commit `d0991a0d53f3bb3a7307e3b83f279c1d117aafb3`. The included build-source archive retains all source, build configuration, licences and decoder binaries from that commit. It omits only the upstream test PDF/bidi-data directories and example PDF, which are not inputs to the website runtime build; no source file was changed. The full original archive URL/hash is recorded in manifest.json.

The website build uses the exact unmodified `pdfjs-dist` npm package pinned by its runtime lockfile. To build PDF.js itself, follow the included upstream README and gulpfile at this exact commit (`npm ci`, then the upstream generic/build distribution target). Upstream build tool dependencies are described by its package-lock.json. The website does not require rebuilding PDF.js or enabling PDF scripting. QuickJS interpreter assets are not distributed by this website.

## OpenJPEG

PDF.js commit `f78635555020f8ffc271d911db89b8a5069d295e` updates OpenJPEG to `8314119b067c0fc77834731168daaebd379fdb12`. The matching Mozilla wrapper commit `13eaf130b252d748560569fffb83fd9432597840` pins exactly that C revision in its Dockerfile. Both wrapper and complete OpenJPEG C sources are included. The wrapper includes the buffer-stream patch applied by Docker, compile scripts, C wrapper, package.json/lock and licences. Its documented entry points are `node build.js -C` then `node build.js -co OUTPUT_DIRECTORY`. The Dockerfile uses `emscripten/emsdk:latest`, not a fixed compiler image; no exact compiler version is inferred here.

## JBIG2 and CCITT

PDF.js commit `c3a2798726365a6a36f7dd78bcaa51dc298395f6` updates JBIG2 to PDFium `bb1f9f71e7b15afdd5937adf8cfe5807522b882f`. The matching Mozilla wrapper commit `15f6f9357c5e5e30285eb83aa08e5fe1a16ab77a` pins that revision. The wrapper and full PDFium source from the Chromium project's mirror are included; the canonical upstream repository is https://pdfium.googlesource.com/pdfium. Build instructions are in the wrapper README and compile.sh, with the same `node build.js -C` / `node build.js -co OUTPUT_DIRECTORY` flow. Only the JBIG2/fax decoder and referenced PDFium helpers are compiled. Optional PartitionAlloc, Skia and test framework code is not enabled by those build flags. Emscripten standard headers are toolchain inputs. This Dockerfile also selects `emscripten/emsdk:latest`; exact historical compiler versions are not claimed.

## qcms

PDF.js commit `e7acffcef36eec7e77ade4f77e5e8ca0639c44d2` explicitly identifies wrapper `2ae4ee72334782928210ba4050e3e77d9b2d35be`. The complete Rust wrapper, Cargo.toml/lock, JS binding helpers and build files are included. Every registry crate in its checked-in Cargo.lock, including qcms 0.3.0 and wasm-bindgen 0.2.100, is mirrored here with its Cargo SHA-256 verified. The documented wrapper command is `node build.js --compile --output OUTPUT_DIRECTORY`. Its upstream Dockerfile uses `rust:latest`, installs wasm-pack and wasm-bindgen-cli, and runs `cargo update`; it does not copy/use the checked-in Cargo.lock during that Docker build. The complete lockfile sources are provided for inspection/rebuilds, but this packet does not assert that an unpinned historical Docker build selected exactly those tool versions. Rust MSRV in Cargo.toml is 1.88.

## Verification

The distributed OpenJPEG/JBIG2/qcms WASM and fallback JS files match the exact PDF.js source commit's external files byte-for-byte (see binary-correspondence.json). Wrapper/source revisions are traced to the upstream decoder update commits and the wrapper's own pinned library revisions. Original sources/notices and npm packages are included, not reconstructed from decompiled WASM.

No downloaded upstream script, Docker image or compiler was executed during collection. Decoder compilation and byte-identical WASM reproduction are unverified. Official build instructions retain their original prerequisites/unpinned toolchain choices rather than inventing a more precise build provenance.