@spec executable() :: {:ok, String.t()} | {:error, term()}

Returns the resolved pdfium-cli executable path.

This is provided for provenance checks around optional PDFium-based evidence.

@spec form_fields(
  String.t(),
  keyword()
) :: {:ok, [form_field()]} | {:error, term()}

Returns form field observations from pdfium form --output-type json.

@spec info(
  String.t(),
  keyword()
) :: {:ok, map()} | {:error, term()}

Returns PDF metadata from pdfium info.

On success returns {:ok, metadata_map} with string keys (for example "PDF Version").

@spec provenance_executable() :: {:ok, String.t()} | {:error, term()}

Returns the executable artifact used to establish PDFium provenance.

Most environments execute the pinned binary directly, so this is the same path as executable/0. A container command wrapper may set RENDRO_PDFIUM_PROVENANCE_CLI (or the application configuration :pdfium_cli_provenance_executable) to the mounted binary it invokes; the caller must still hash this returned artifact before accepting evidence.

@spec render(
  binary(),
  keyword()
) :: {:ok, [binary()]} | {:error, term()}

Rasterizes a PDF binary to a list of PNG binaries using pdfium-cli.

Accepts a PDF binary and keyword opts:

• dpi: — dots per inch (positive integer, default 150)
• pages: — page range string passed to pdfium-cli --pages (non-empty string, default nil = all pages)

Writes the PDF to an isolated tmp directory (chmod 0o700 dir, chmod 0o600 file), invokes pdfium-cli render with list-form args (no shell interpolation), collects output PNG binaries sorted by page number, and cleans up the tmp directory unconditionally.

Returns {:ok, [png_binary]} on success, or {:error, term()} on failure.

@spec version(keyword()) :: {:ok, String.t()} | {:error, term()}

Returns the pdfium-cli version string (for example "v0.10.3").