PDF Page Integrity Packager — Mapping & Hash Evidence

Rebuild pages from one or two inline Base64 PDFs into up to three packages, preserving requested selection, order, duplicates, merge/split, and 90-degree rotations together with source-to-output mapping and SHA-256 evidence. Runtime network and filesystem operations are always zero.

Input contains only sources[].pdfBase64 and packages[].pages[] with sourceIndex, 1-based pageNumber, and clockwise rotate (0|90|180|270). Canonical standard RFC 4648 Base64 is required. URLs, paths, passwords, metadata, output names, unknown fields, and boolean integers are rejected.

Fixed boundary

• one or two sources, 2 MiB decoded total, 50 source pages total
• one to three packages, one to 50 page references each
• 4 MiB total output Base64
• resolved graph: 10,000 objects and depth 64 per scan
• in-memory BytesIO only; no temporary file, external request, Browser, Proxy, or Secret

Before copying, the Actor strictly parses the PDF and resolves its forward object graph. Encrypted, malformed, incomplete, zero-page, over-limit, unresolved, unknown, or unsafe cyclic graphs fail. Any action dictionary or Additional Action, OpenAction, JavaScript, Launch, SubmitForm, ImportData, RichMedia/multimedia, AcroForm/XFA, attachment, EmbeddedFiles/EF/AF, FileAttachment, or unknown action type fails without output or charge.

Only page content, resources, MediaBox/CropBox and related page boxes, and normalized rotation are copied into a new empty writer. Annotations are inspected before removal and are never inherited. Source metadata, outline/bookmarks, forms, attachments, name trees, open actions, transition/structure keys, and other page keys are not inherited. Output is parsed and scanned again before the single Dataset item is pushed.

sourcePdfHash hashes decoded source bytes. packageId hashes all source hashes plus requested page references. mappingHash hashes the output-order mapping, and outputPdfHash hashes rebuilt PDF bytes. pypdf output is deterministic for the same fixed input, actor parser, and dependency version.

Annotation removal is reported only as PAGE_ANNOTATIONS_REMOVED plus a count. Raw source Base64/binary, PDF objects, text, images, and metadata are not emitted or normally logged. Successful output necessarily retains source page content, which may contain PII or confidential information. This is not a redaction, signature-preservation, malware-analysis, OCR, extraction, repair, or compression product.

Dependency gate and local verification

Official PyPI JSON checked 2026-08-15: pypdf==6.16.1, BSD-3-Clause, Python >=3.9, non-yanked pure-Python py3-none-any wheel, and no default runtime dependency on Python 3.14. A synthetic in-memory gate verified deterministic copy/reorder/rotation, annotation removal, document-level non-inheritance, unsafe-marker rejection, and unresolved/cycle/depth/object fail-closed handling. The initial probe also found that PageObject.rotate() can retain 360, so the Actor explicitly writes (sourceRotation + rotate) % 360.

..\..\.venv\Scripts\python.exe -m unittest discover -s tests -v
..\..\.venv\Scripts\python.exe tools/local_actor_smoke.py

Valid requests create exactly one default Dataset item and one built-in apify-default-dataset-item; all failures create zero. No actor-start or custom PPE event is used.

Unapproved pricing hypothesis: $0.005 per successful summary Dataset item, at most $0.005/run. Real-PDF compatibility, signed-PDF impact, Cloud memory/cold-start/cost, demand, revenue, profit, margin, and break-even remain null.