Responsibility

Generation happens on the device that asked for it. PDFs are assembled in the calling process — Node, a browser tab, a Worker, Deno, Bun, an edge runtime. There is no SaaS round-trip, so a document does not leave the user's machine unless the application chooses to send it. Every playground on this site is a demonstration: they generate real PDFs with nothing but the page you already loaded.

Verify it: src/ · the scale playground generates 100,000 pages client-side

The engine has no runtime dependencies. pdfnative ships with no dependencies field at all: nothing transitive to install, audit, or patch.

Scoped honestly, because the ecosystem is not uniform: pdfnative-cli depends only on pdfnative itself. pdfnative-react adds one real runtime dependency, react-reconciler, with React and pdfnative as peers. pdfnative-mcp adds two, @modelcontextprotocol/sdk and zod. And this documentation site itself loads Prism, marked and DOMPurify from a CDN — pinned, with subresource-integrity hashes.

Verify it: package.json (no dependencies key) · pdfnative-react/package.json · pdfnative-mcp/package.json

The library never opens a socket. No telemetry endpoint, no auto-update channel, no remote font fetch. Searching the engine source for any of the ways JavaScript can reach the network — fetch, XMLHttpRequest, WebSocket, node:http, sendBeacon — returns no matches at all.

One scoped exception, stated because it is real: pdfnative-cli verify can fetch OCSP and CRL responses when checking whether a signing certificate has been revoked. It does not do so by default — the default reads only the revocation data already embedded in the document, and network checks require --revocation online. RFC 3161 timestamps are validated from the embedded token; the CLI does not contact a timestamp authority, and sign --timestamp reports that it is not yet implemented.

Verify it: grep -rE "fetch\(|XMLHttpRequest|WebSocket|node:http" src/ · SECURITY.md

Only what you import is shipped. All four packages declare "sideEffects": false, so bundlers can drop unused features. Fonts are separate modules loaded on demand — a Latin-only invoice never pays for the CJK or emoji data.

Verify it: package.json · font registration in the quick start

Large documents do not need proportionally large machines — up to a point. buildDocumentPDFStreamTrue emits the PDF as chunks and frees each part as it goes, so the fully-joined binary never exists. That lifts the ~512 MB single-string ceiling the simpler streaming variant hits. It does not make generation constant-memory: every part is built before the first chunk is emitted, so peak usage still scales with output size. The streaming guide states the exact profile.

Verify it: src/core/pdf-stream-writer.ts

Published builds are signed and attributable. All four packages publish with npm provenance through GitHub Actions OIDC, producing a Sigstore attestation that ties each tarball to the commit and workflow that built it.

Verify it: .github/workflows/publish.yml · the provenance badge on npm

A CycloneDX SBOM is attached to releases — for two of the four packages. pdfnative-cli and pdfnative-react generate and upload one. pdfnative and pdfnative-mcp currently do not. Saying "SBOM for every package" would be easier and would be false.

Verify it: pdfnative-cli publish.yml · pdfnative-react publish.yml

Static analysis and dependency hygiene run on every repository. CodeQL scanning, OSSF Scorecard, and Dependabot on a weekly grouped schedule with major upgrades pinned. The engine's own npm audit --audit-level=high gate runs in CI.

Verify it: codeql.yml · scorecard.yml · dependabot.yml

The documentation checks itself. Version numbers, tool counts and command counts are declared once in a manifest, and a CI rule fails the build when any page disagrees with it — or references an API that is not declared anywhere in the source. That rule exists because these numbers had drifted a full release apart across some forty files.

Verify it: assets/ecosystem.json · scripts/verify-docs.ts

22 writing systems with real shaping, in the box. Arabic and Hebrew bidirectional text (UAX #9), Devanagari, Bengali, Tamil, Telugu, Sinhala, Thai, Khmer, Myanmar, Tibetan, Ethiopic, CJK and more — with GSUB/GPOS OpenType shaping, not just codepoint mapping. Most PDF tooling in this ecosystem handles Latin well and degrades from there. Documents that people can actually read in their own script is an accessibility argument before it is a feature list.

Verify it: src/shaping/ · all-scripts playground · extreme-scripts playground

Accessible output is a first-class API, not an afterthought. Tagged PDF with a real structure tree, /ActualText, language tagging, and a validatePdfUA() function that checks the structural requirements of PDF/UA-1 (ISO 14289-1): MarkInfo, StructTreeRoot, ParentTree, /Lang, per-page MCID uniqueness.

What that function does not do — and cannot — is judge whether your reading order makes sense or your alt text is meaningful. Those remain the author's responsibility, and no validator substitutes for them.

Verify it: src/parser/pdf-ua-validator.ts · accessibility guide

Documents meant to outlive their software. PDF/A-1b, 2b, 2u and 3b output, checked against the veraPDF reference validator in CI on every commit — not merely asserted. veraPDF is a Java tool invoked by the workflow; it is never bundled with the package, so the zero-dependency property survives.

Verify it: .github/workflows/verapdf.yml · scripts/validate-pdfa.ts · PDF/A guide

AI agents draft; humans decide. pdfnative is built with AI coding assistants and governs them explicitly. A machine-readable contract keeps agents in a draftsman role: they may propose changes into .github/drafts/, but a human reviews, approves and submits everything under their own identity. Nothing reaches GitHub autonomously, and agents may not add a runtime dependency.

Verify it: .github/ai-governance.json · .github/AGENT_RULES.md · AI governance guide

MIT licensed, citable, with a published security policy. All four packages are MIT. A CITATION.cff makes the project citable in academic work, and SECURITY.md documents the disclosure process and the threat model the parser is hardened against.

Verify it: LICENSE · CITATION.cff · SECURITY.md · CODE_OF_CONDUCT.md