@cloudpdf/engine 3.0.0-next.15 → 3.0.0-next.16

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { AbortablePromise, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationBundle, AnnotationCreateOptions, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationExportSelection, AnnotationFlattenResult, AnnotationImportOptions, AnnotationImportResult, AnnotationList, AnnotationListOptions, AnnotationPatch, AnnotationPosition, AnnotationRef, AnnotationReorderResult, AnnotationResourceRole, AnnotationUpdateOptions, AnnotationUpdateResult, BundleLimits, CallFacts, Change, ChangeAnswer, ChangeResult, CustomMetadataService, DocumentActionsService, DocumentAnnotationsService, DocumentAttachmentsService, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentMetadata, DocumentPagesService, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSignaturesService, DownloadOptions, EditSessionAccess, EditSessionStatus, Engine, EngineError, FlattenWriteOptions, MetadataPatch, MetadataService, MetadataUpdateResult, MutationMeta, ObjectNumberPool, ObjectNumberRange, ObjectNumbersLost, OpenInput, OpenOptions, PageAnnotationsService, PageCoordinates, PageDeleteResult, PageFlattenResult, PageFormsService, PageHandle, PageImageOptions, PageInsertBlankOptions, PageInsertBlankSpec, PageInsertResult, PageLayerRights, PageLayout, PageListSnapshot, PageMeasureService, PageMeasurementViewportList, PageNameInput, PageNameResult, PagePosition, PageRef, PageRemoveNameInput, PageRenderImage, PageRenderService, PageReorderResult, PageRotateResult, PageScaleResult, PageTextService, PageTextSnapshot, PdfMeasure, PdfRotation, SearchRequest, SearchSlice, SessionEventPublisher, TextLayout, TextRange, TokenSource, WireAnnotationResources, WorkingSetPage, WriteOptions } from "@embedpdf/engine-core/runtime";
+import { AbortablePromise, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationBundle, AnnotationCreateOptions, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationExportSelection, AnnotationFlattenResult, AnnotationImportOptions, AnnotationImportResult, AnnotationList, AnnotationListOptions, AnnotationPatch, AnnotationPosition, AnnotationRef, AnnotationReorderResult, AnnotationResourceRole, AnnotationUpdateOptions, AnnotationUpdateResult, BundleLimits, CallFacts, Change, ChangeAnswer, ChangeResult, CustomMetadataService, DocumentActionsService, DocumentAnnotationsService, DocumentAttachmentsService, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentMetadata, DocumentOutlineService, DocumentPagesService, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSignaturesService, DownloadOptions, EditSessionAccess, EditSessionStatus, Engine, EngineError, FlattenWriteOptions, MetadataPatch, MetadataService, MetadataUpdateResult, MutationMeta, ObjectNumberPool, ObjectNumberRange, ObjectNumbersLost, OpenInput, OpenOptions, PageAnnotationsService, PageCoordinates, PageExtractOptions, PageFlattenResult, PageFormsService, PageHandle, PageImageOptions, PageLayerRights, PageLayout, PageListSnapshot, PageMeasureService, PageMeasurementViewportList, PageNameInput, PageNameResult, PagePrintRights, PageRef, PageRemoveNameInput, PageRenderImage, PageRenderService, PageScaleResult, PageStructureVerb, PageTextService, PageTextSnapshot, PdfMeasure, SearchRequest, SearchSlice, SessionEventPublisher, TextLayout, TextRange, TokenSource, WireAnnotationResources, WorkingSetPage, WriteOptions } from "@embedpdf/engine-core/runtime";
 import { CdnAccessInfoForApply, DocumentHead, DocumentManifest, LayerScopePlane } from "@embedpdf/engine-core/wire";
 export * from "@embedpdf/engine-core/public";
 //#region src/transport/HttpClient.d.ts
@@ -93,11 +93,7 @@ interface RequestOptions {
   /** Sent as the editing session though not a write: `/access`, the bulk reservation. */
   readonly session?: boolean;
 }
-/**
- * A raw-bytes response plus its headers. The attachment-file leaves carry
- * their metadata as headers (`Content-Type`, `X-EmbedPDF-File-Name`), so
- * unlike `getBytes` the caller needs the `Headers` object back.
- */
+/** A raw-bytes response plus its headers. */
 interface HttpFileResponse {
   bytes: Uint8Array;
   headers: Headers;
@@ -271,6 +267,33 @@ declare class CloudEngine implements Engine {
   destroy(): AbortablePromise<void>;
 }
 //#endregion
+//#region src/document/CloudDocumentSearchService.d.ts
+/**
+ * Cloud search transport: versioned GETs, one per budgeted slice.
+ *
+ * Every slice URL is a canonical cache key — the search token pins the
+ * layer's content epoch (computed from the cached manifest), the
+ * canonical query (default-fold literals collapse case/diacritic
+ * variants into one entry), and the resume position. Identical searches
+ * from any reader of the document hit the same CDN entry; matches are
+ * all that ever crosses the trust boundary, and the rects/full endpoint
+ * split keeps permission tiers in disjoint cache namespaces.
+ *
+ * Staleness rides the standard versioned-read signal: a first slice
+ * answered `NotFound` means our manifest is stale → refresh and retry
+ * once; a continuation answered `NotFound` means the document changed
+ * mid-search → `InvalidArg`, same contract as the local engine's cursor.
+ */
+declare class CloudDocumentSearchService implements DocumentSearchService {
+  private readonly http;
+  private readonly docId;
+  private readonly layerName;
+  private readonly isClosed;
+  private readonly manifest;
+  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor);
+  query(request: SearchRequest): AbortablePromise<SearchSlice>;
+}
+//#endregion
 //#region src/document/CloudObjectNumberPool.d.ts
 interface CloudObjectNumberPoolOptions {
   /** `POST …/object-numbers`: `count` more numbers for this editing session. */
@@ -447,101 +470,6 @@ declare class CloudWrites {
   private send;
 }
 //#endregion
-//#region src/document/CloudDocumentPagesService.d.ts
-/**
- * Cloud-side document pages service. Mirrors `LocalDocumentPagesService`
- * over HTTP: GET /pages for `list`, POST /pages/reorder for the reorder.
- *
- * Page identity rule (locked with the user, do not change):
- *   - Pages are addressed exclusively by `PageRef` (their indirect
- *     `pageObjectNumber`); mutation bodies ship `{ pages: PageRef[] }`.
- *     The wire never sends a page index for a mutation. This keeps
- *     multi-call client logic from having to account for index drift
- *     between requests.
- *   - Successful `reorder()` returns the new `layout` (order + geometry) plus
- *     cloud coherence pins. A page reorder bumps only `docVersion` +
- *     `layoutVersion`; every per-page pin stays warm.
- */
-declare class CloudDocumentPagesService implements DocumentPagesService {
-  private readonly http;
-  private readonly docId;
-  private readonly layerName;
-  private readonly isClosed;
-  private readonly manifest;
-  private readonly publisher;
-  private readonly writes;
-  /** The last layout leaf read by {@link pageLayout}, keyed by its URL path. */
-  private layoutMemo;
-  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites);
-  /**
-   * Page-geometry list. The geometry bytes live at the content-addressed
-   * `/layout@layoutVersion=N` leaf (not in the manifest); the manifest only
-   * publishes the `layoutVersion` pointer. So `list()` reads `layoutVersion`
-   * from the cached manifest, fetches the layout leaf, and on a 404 (stale
-   * pointer) transparently refreshes the manifest and retries once — the
-   * same ladder the per-page text/geometry reads use. `layoutVersion` bumps
-   * only on structural page ops, so this leaf stays cached across content
-   * and annotation edits.
-   */
-  list(): AbortablePromise<PageListSnapshot>;
-  /**
-   * One page's layout, for renders to size their image without a round
-   * trip per tile. The layout leaf never changes at a given URL, so the
-   * last one read is kept and shared until the manifest points elsewhere.
-   */
-  pageLayout(ref: PageRef, signal: AbortSignal): Promise<PageLayout>;
-  /**
-   * Plane-scope rule: the layout leaf depends on the `layout` plane —
-   * while inherited (no reorder/rotate/insert/delete ever ran), every
-   * visitor's page list is one doc-level URL served from the base
-   * session; the SDK open sequence creates no layer session.
-   */
-  private layoutPath;
-  private fetchLayout;
-  reorder(pages: PageRef[], position: PagePosition, options?: WriteOptions): AbortablePromise<PageReorderResult>;
-  setName(input: PageNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
-  removeName(input: PageRemoveNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
-  /**
-   * Named pages are layout: both verbs share the page-reorder patch exactly —
-   * docVersion + layoutVersion advance, no per-page pin changes, so the
-   * cached manifest is patched in place and the fresh layout is published.
-   */
-  private runNameMutation;
-  rotate(pages: PageRef[], rotation: PdfRotation, options?: WriteOptions): AbortablePromise<PageRotateResult>;
-  delete(pages: PageRef[], options?: WriteOptions): AbortablePromise<PageDeleteResult>;
-  insert(bytes: Uint8Array | ArrayBuffer, position?: PagePosition, options?: WriteOptions): AbortablePromise<PageInsertResult>;
-  insertBlank(spec: PageInsertBlankSpec, position?: PagePosition, options?: PageInsertBlankOptions): AbortablePromise<PageInsertResult>;
-  extract(pages: PageRef[]): AbortablePromise<Uint8Array>;
-  flatten(pages: PageRef[], options?: FlattenWriteOptions): AbortablePromise<PageFlattenResult>;
-}
-//#endregion
-//#region src/document/CloudDocumentSearchService.d.ts
-/**
- * Cloud search transport: versioned GETs, one per budgeted slice.
- *
- * Every slice URL is a canonical cache key — the search token pins the
- * layer's content epoch (computed from the cached manifest), the
- * canonical query (default-fold literals collapse case/diacritic
- * variants into one entry), and the resume position. Identical searches
- * from any reader of the document hit the same CDN entry; matches are
- * all that ever crosses the trust boundary, and the rects/full endpoint
- * split keeps permission tiers in disjoint cache namespaces.
- *
- * Staleness rides the standard versioned-read signal: a first slice
- * answered `NotFound` means our manifest is stale → refresh and retry
- * once; a continuation answered `NotFound` means the document changed
- * mid-search → `InvalidArg`, same contract as the local engine's cursor.
- */
-declare class CloudDocumentSearchService implements DocumentSearchService {
-  private readonly http;
-  private readonly docId;
-  private readonly layerName;
-  private readonly isClosed;
-  private readonly manifest;
-  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor);
-  query(request: SearchRequest): AbortablePromise<SearchSlice>;
-}
-//#endregion
 //#region src/document/CloudMetadataService.d.ts
 declare class CloudMetadataService implements MetadataService {
   readonly custom: CustomMetadataService;
@@ -589,11 +517,14 @@ declare class CloudDocumentHandle implements DocumentHandle {
   readonly metadata: CloudMetadataService;
   readonly annotations: DocumentAnnotationsService;
   readonly actions: DocumentActionsService;
+  readonly outline: DocumentOutlineService;
   readonly attachments: DocumentAttachmentsService;
   readonly signatures: DocumentSignaturesService;
   readonly forms: DocumentFormsService;
   readonly search: CloudDocumentSearchService;
-  readonly pages: CloudDocumentPagesService;
+  readonly pages: DocumentPagesService;
+  /** The page reads behind `pages`, the layout per page among them. */
+  private readonly pageReads;
   readonly redaction: DocumentRedactionService;
   readonly security: DocumentSecurityService;
   readonly render: DocumentRenderService;
@@ -709,7 +640,9 @@ declare class CloudDocumentHandle implements DocumentHandle {
   private releaseRemoteStream;
   /** Patch the cached manifest from a remote event's coherence pins — the
    *  same absorb rails local mutations use, so reads stay warm no matter
-   *  whose hand caused the change. */
+   *  whose hand caused the change. Every event kind is named below, so a new
+   *  one can't be forgotten: a missed one leaves this client reading the
+   *  old version from an immutable, cached URL. */
   private absorbRemoteEvent;
 }
 //#endregion
@@ -777,6 +710,70 @@ declare class CloudDocumentAnnotationsService implements DocumentAnnotationsServ
   private versionedPagePath;
 }
 //#endregion
+//#region src/document/CloudDocumentPagesService.d.ts
+/**
+ * Cloud-side document pages service: the reads, extract, flatten and the page
+ * names, over HTTP, as `LocalDocumentPagesService` has them. The structure
+ * verbs are changes (`pageVerbs`), so they can be undone.
+ *
+ * Page identity rule (locked with the user, do not change):
+ *   - Pages are addressed exclusively by `PageRef` (their indirect
+ *     `pageObjectNumber`); mutation bodies ship `{ pages: PageRef[] }`.
+ *     The wire never sends a page index for a mutation. This keeps
+ *     multi-call client logic from having to account for index drift
+ *     between requests.
+ *   - A page reorder (a change) returns the new `layout` (order + geometry)
+ *     plus cloud coherence pins. It bumps only `docVersion` +
+ *     `layoutVersion`; every per-page pin stays warm.
+ */
+declare class CloudDocumentPagesService implements Omit<DocumentPagesService, PageStructureVerb> {
+  private readonly http;
+  private readonly docId;
+  private readonly layerName;
+  private readonly isClosed;
+  private readonly manifest;
+  private readonly publisher;
+  private readonly writes;
+  /** The last layout leaf read by {@link pageLayout}, keyed by its URL path. */
+  private layoutMemo;
+  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites);
+  /**
+   * Page-geometry list. The geometry bytes live at the content-addressed
+   * `/layout@layoutVersion=N` leaf (not in the manifest); the manifest only
+   * publishes the `layoutVersion` pointer. So `list()` reads `layoutVersion`
+   * from the cached manifest, fetches the layout leaf, and on a 404 (stale
+   * pointer) transparently refreshes the manifest and retries once — the
+   * same ladder the per-page text/geometry reads use. `layoutVersion` bumps
+   * only on structural page ops, so this leaf stays cached across content
+   * and annotation edits.
+   */
+  list(): AbortablePromise<PageListSnapshot>;
+  /**
+   * One page's layout, for renders to size their image without a round
+   * trip per tile. The layout leaf never changes at a given URL, so the
+   * last one read is kept and shared until the manifest points elsewhere.
+   */
+  pageLayout(ref: PageRef, signal: AbortSignal): Promise<PageLayout>;
+  /**
+   * Plane-scope rule: the layout leaf depends on the `layout` plane —
+   * while inherited (no reorder/rotate/insert/delete ever ran), every
+   * visitor's page list is one doc-level URL served from the base
+   * session; the SDK open sequence creates no layer session.
+   */
+  private layoutPath;
+  private fetchLayout;
+  setName(input: PageNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
+  removeName(input: PageRemoveNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
+  /**
+   * Named pages are layout: both verbs share the page-reorder patch exactly —
+   * docVersion + layoutVersion advance, no per-page pin changes, so the
+   * cached manifest is patched in place and the fresh layout is published.
+   */
+  private runNameMutation;
+  extract(pages: PageRef[], options?: PageExtractOptions): AbortablePromise<Uint8Array>;
+  flatten(pages: PageRef[], options?: FlattenWriteOptions): AbortablePromise<PageFlattenResult>;
+}
+//#endregion
 //#region src/document/CloudPageAnnotationsService.d.ts
 /**
  * Cloud-side page annotation service. Mirrors the local wiring: each
@@ -856,9 +853,13 @@ declare class CloudPageRenderService implements PageRenderService {
   private readonly layout;
   /** What the caller may read, when the client can know it; null leaves it to the server. */
   private readonly layerRights;
+  /** What the caller may print, when the client can know it; null leaves it to the server. */
+  private readonly printRights;
   constructor(http: HttpClient, docId: string, layerName: string, pageRef: PageRef, isClosed: () => boolean, manifest: ManifestAccessor, layout: (signal: AbortSignal) => Promise<PageLayout>,
   /** What the caller may read, when the client can know it; null leaves it to the server. */
-  layerRights: () => PageLayerRights | null);
+  layerRights: () => PageLayerRights | null,
+  /** What the caller may print, when the client can know it; null leaves it to the server. */
+  printRights: () => PagePrintRights | null);
   image(options?: PageImageOptions): AbortablePromise<PageRenderImage>;
   /**
    * The image's transform, computed like the server's render (the same
@@ -923,7 +924,7 @@ declare class CloudPageHandle implements PageHandle {
   readonly text: CloudPageTextService;
   readonly render: CloudPageRenderService;
   readonly measure: CloudPageMeasureService;
-  constructor(ref: PageRef, http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites, layout: (signal: AbortSignal) => Promise<PageLayout>, layerRights: () => PageLayerRights | null);
+  constructor(ref: PageRef, http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites, layout: (signal: AbortSignal) => Promise<PageLayout>, layerRights: () => PageLayerRights | null, printRights: () => PagePrintRights | null);
 }
 //#endregion
 //#region src/transport/decodeUnverifiedClaims.d.ts

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AbortablePromise, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationBundle, AnnotationCreateOptions, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationExportSelection, AnnotationFlattenResult, AnnotationImportOptions, AnnotationImportResult, AnnotationList, AnnotationListOptions, AnnotationPatch, AnnotationPosition, AnnotationRef, AnnotationReorderResult, AnnotationResourceRole, AnnotationUpdateOptions, AnnotationUpdateResult, BundleLimits, CallFacts, Change, ChangeAnswer, ChangeResult, CustomMetadataService, DocumentActionsService, DocumentAnnotationsService, DocumentAttachmentsService, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentMetadata, DocumentPagesService, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSignaturesService, DownloadOptions, EditSessionAccess, EditSessionStatus, Engine, EngineError, FlattenWriteOptions, MetadataPatch, MetadataService, MetadataUpdateResult, MutationMeta, ObjectNumberPool, ObjectNumberRange, ObjectNumbersLost, OpenInput, OpenOptions, PageAnnotationsService, PageCoordinates, PageDeleteResult, PageFlattenResult, PageFormsService, PageHandle, PageImageOptions, PageInsertBlankOptions, PageInsertBlankSpec, PageInsertResult, PageLayerRights, PageLayout, PageListSnapshot, PageMeasureService, PageMeasurementViewportList, PageNameInput, PageNameResult, PagePosition, PageRef, PageRemoveNameInput, PageRenderImage, PageRenderService, PageReorderResult, PageRotateResult, PageScaleResult, PageTextService, PageTextSnapshot, PdfMeasure, PdfRotation, SearchRequest, SearchSlice, SessionEventPublisher, TextLayout, TextRange, TokenSource, WireAnnotationResources, WorkingSetPage, WriteOptions } from "@embedpdf/engine-core/runtime";
+import { AbortablePromise, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationBundle, AnnotationCreateOptions, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationExportSelection, AnnotationFlattenResult, AnnotationImportOptions, AnnotationImportResult, AnnotationList, AnnotationListOptions, AnnotationPatch, AnnotationPosition, AnnotationRef, AnnotationReorderResult, AnnotationResourceRole, AnnotationUpdateOptions, AnnotationUpdateResult, BundleLimits, CallFacts, Change, ChangeAnswer, ChangeResult, CustomMetadataService, DocumentActionsService, DocumentAnnotationsService, DocumentAttachmentsService, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentMetadata, DocumentOutlineService, DocumentPagesService, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSignaturesService, DownloadOptions, EditSessionAccess, EditSessionStatus, Engine, EngineError, FlattenWriteOptions, MetadataPatch, MetadataService, MetadataUpdateResult, MutationMeta, ObjectNumberPool, ObjectNumberRange, ObjectNumbersLost, OpenInput, OpenOptions, PageAnnotationsService, PageCoordinates, PageExtractOptions, PageFlattenResult, PageFormsService, PageHandle, PageImageOptions, PageLayerRights, PageLayout, PageListSnapshot, PageMeasureService, PageMeasurementViewportList, PageNameInput, PageNameResult, PagePrintRights, PageRef, PageRemoveNameInput, PageRenderImage, PageRenderService, PageScaleResult, PageStructureVerb, PageTextService, PageTextSnapshot, PdfMeasure, SearchRequest, SearchSlice, SessionEventPublisher, TextLayout, TextRange, TokenSource, WireAnnotationResources, WorkingSetPage, WriteOptions } from "@embedpdf/engine-core/runtime";
 import { CdnAccessInfoForApply, DocumentHead, DocumentManifest, LayerScopePlane } from "@embedpdf/engine-core/wire";
 export * from "@embedpdf/engine-core/public";
 //#region src/transport/HttpClient.d.ts
@@ -93,11 +93,7 @@ interface RequestOptions {
   /** Sent as the editing session though not a write: `/access`, the bulk reservation. */
   readonly session?: boolean;
 }
-/**
- * A raw-bytes response plus its headers. The attachment-file leaves carry
- * their metadata as headers (`Content-Type`, `X-EmbedPDF-File-Name`), so
- * unlike `getBytes` the caller needs the `Headers` object back.
- */
+/** A raw-bytes response plus its headers. */
 interface HttpFileResponse {
   bytes: Uint8Array;
   headers: Headers;
@@ -271,6 +267,33 @@ declare class CloudEngine implements Engine {
   destroy(): AbortablePromise<void>;
 }
 //#endregion
+//#region src/document/CloudDocumentSearchService.d.ts
+/**
+ * Cloud search transport: versioned GETs, one per budgeted slice.
+ *
+ * Every slice URL is a canonical cache key — the search token pins the
+ * layer's content epoch (computed from the cached manifest), the
+ * canonical query (default-fold literals collapse case/diacritic
+ * variants into one entry), and the resume position. Identical searches
+ * from any reader of the document hit the same CDN entry; matches are
+ * all that ever crosses the trust boundary, and the rects/full endpoint
+ * split keeps permission tiers in disjoint cache namespaces.
+ *
+ * Staleness rides the standard versioned-read signal: a first slice
+ * answered `NotFound` means our manifest is stale → refresh and retry
+ * once; a continuation answered `NotFound` means the document changed
+ * mid-search → `InvalidArg`, same contract as the local engine's cursor.
+ */
+declare class CloudDocumentSearchService implements DocumentSearchService {
+  private readonly http;
+  private readonly docId;
+  private readonly layerName;
+  private readonly isClosed;
+  private readonly manifest;
+  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor);
+  query(request: SearchRequest): AbortablePromise<SearchSlice>;
+}
+//#endregion
 //#region src/document/CloudObjectNumberPool.d.ts
 interface CloudObjectNumberPoolOptions {
   /** `POST …/object-numbers`: `count` more numbers for this editing session. */
@@ -447,101 +470,6 @@ declare class CloudWrites {
   private send;
 }
 //#endregion
-//#region src/document/CloudDocumentPagesService.d.ts
-/**
- * Cloud-side document pages service. Mirrors `LocalDocumentPagesService`
- * over HTTP: GET /pages for `list`, POST /pages/reorder for the reorder.
- *
- * Page identity rule (locked with the user, do not change):
- *   - Pages are addressed exclusively by `PageRef` (their indirect
- *     `pageObjectNumber`); mutation bodies ship `{ pages: PageRef[] }`.
- *     The wire never sends a page index for a mutation. This keeps
- *     multi-call client logic from having to account for index drift
- *     between requests.
- *   - Successful `reorder()` returns the new `layout` (order + geometry) plus
- *     cloud coherence pins. A page reorder bumps only `docVersion` +
- *     `layoutVersion`; every per-page pin stays warm.
- */
-declare class CloudDocumentPagesService implements DocumentPagesService {
-  private readonly http;
-  private readonly docId;
-  private readonly layerName;
-  private readonly isClosed;
-  private readonly manifest;
-  private readonly publisher;
-  private readonly writes;
-  /** The last layout leaf read by {@link pageLayout}, keyed by its URL path. */
-  private layoutMemo;
-  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites);
-  /**
-   * Page-geometry list. The geometry bytes live at the content-addressed
-   * `/layout@layoutVersion=N` leaf (not in the manifest); the manifest only
-   * publishes the `layoutVersion` pointer. So `list()` reads `layoutVersion`
-   * from the cached manifest, fetches the layout leaf, and on a 404 (stale
-   * pointer) transparently refreshes the manifest and retries once — the
-   * same ladder the per-page text/geometry reads use. `layoutVersion` bumps
-   * only on structural page ops, so this leaf stays cached across content
-   * and annotation edits.
-   */
-  list(): AbortablePromise<PageListSnapshot>;
-  /**
-   * One page's layout, for renders to size their image without a round
-   * trip per tile. The layout leaf never changes at a given URL, so the
-   * last one read is kept and shared until the manifest points elsewhere.
-   */
-  pageLayout(ref: PageRef, signal: AbortSignal): Promise<PageLayout>;
-  /**
-   * Plane-scope rule: the layout leaf depends on the `layout` plane —
-   * while inherited (no reorder/rotate/insert/delete ever ran), every
-   * visitor's page list is one doc-level URL served from the base
-   * session; the SDK open sequence creates no layer session.
-   */
-  private layoutPath;
-  private fetchLayout;
-  reorder(pages: PageRef[], position: PagePosition, options?: WriteOptions): AbortablePromise<PageReorderResult>;
-  setName(input: PageNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
-  removeName(input: PageRemoveNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
-  /**
-   * Named pages are layout: both verbs share the page-reorder patch exactly —
-   * docVersion + layoutVersion advance, no per-page pin changes, so the
-   * cached manifest is patched in place and the fresh layout is published.
-   */
-  private runNameMutation;
-  rotate(pages: PageRef[], rotation: PdfRotation, options?: WriteOptions): AbortablePromise<PageRotateResult>;
-  delete(pages: PageRef[], options?: WriteOptions): AbortablePromise<PageDeleteResult>;
-  insert(bytes: Uint8Array | ArrayBuffer, position?: PagePosition, options?: WriteOptions): AbortablePromise<PageInsertResult>;
-  insertBlank(spec: PageInsertBlankSpec, position?: PagePosition, options?: PageInsertBlankOptions): AbortablePromise<PageInsertResult>;
-  extract(pages: PageRef[]): AbortablePromise<Uint8Array>;
-  flatten(pages: PageRef[], options?: FlattenWriteOptions): AbortablePromise<PageFlattenResult>;
-}
-//#endregion
-//#region src/document/CloudDocumentSearchService.d.ts
-/**
- * Cloud search transport: versioned GETs, one per budgeted slice.
- *
- * Every slice URL is a canonical cache key — the search token pins the
- * layer's content epoch (computed from the cached manifest), the
- * canonical query (default-fold literals collapse case/diacritic
- * variants into one entry), and the resume position. Identical searches
- * from any reader of the document hit the same CDN entry; matches are
- * all that ever crosses the trust boundary, and the rects/full endpoint
- * split keeps permission tiers in disjoint cache namespaces.
- *
- * Staleness rides the standard versioned-read signal: a first slice
- * answered `NotFound` means our manifest is stale → refresh and retry
- * once; a continuation answered `NotFound` means the document changed
- * mid-search → `InvalidArg`, same contract as the local engine's cursor.
- */
-declare class CloudDocumentSearchService implements DocumentSearchService {
-  private readonly http;
-  private readonly docId;
-  private readonly layerName;
-  private readonly isClosed;
-  private readonly manifest;
-  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor);
-  query(request: SearchRequest): AbortablePromise<SearchSlice>;
-}
-//#endregion
 //#region src/document/CloudMetadataService.d.ts
 declare class CloudMetadataService implements MetadataService {
   readonly custom: CustomMetadataService;
@@ -589,11 +517,14 @@ declare class CloudDocumentHandle implements DocumentHandle {
   readonly metadata: CloudMetadataService;
   readonly annotations: DocumentAnnotationsService;
   readonly actions: DocumentActionsService;
+  readonly outline: DocumentOutlineService;
   readonly attachments: DocumentAttachmentsService;
   readonly signatures: DocumentSignaturesService;
   readonly forms: DocumentFormsService;
   readonly search: CloudDocumentSearchService;
-  readonly pages: CloudDocumentPagesService;
+  readonly pages: DocumentPagesService;
+  /** The page reads behind `pages`, the layout per page among them. */
+  private readonly pageReads;
   readonly redaction: DocumentRedactionService;
   readonly security: DocumentSecurityService;
   readonly render: DocumentRenderService;
@@ -709,7 +640,9 @@ declare class CloudDocumentHandle implements DocumentHandle {
   private releaseRemoteStream;
   /** Patch the cached manifest from a remote event's coherence pins — the
    *  same absorb rails local mutations use, so reads stay warm no matter
-   *  whose hand caused the change. */
+   *  whose hand caused the change. Every event kind is named below, so a new
+   *  one can't be forgotten: a missed one leaves this client reading the
+   *  old version from an immutable, cached URL. */
   private absorbRemoteEvent;
 }
 //#endregion
@@ -777,6 +710,70 @@ declare class CloudDocumentAnnotationsService implements DocumentAnnotationsServ
   private versionedPagePath;
 }
 //#endregion
+//#region src/document/CloudDocumentPagesService.d.ts
+/**
+ * Cloud-side document pages service: the reads, extract, flatten and the page
+ * names, over HTTP, as `LocalDocumentPagesService` has them. The structure
+ * verbs are changes (`pageVerbs`), so they can be undone.
+ *
+ * Page identity rule (locked with the user, do not change):
+ *   - Pages are addressed exclusively by `PageRef` (their indirect
+ *     `pageObjectNumber`); mutation bodies ship `{ pages: PageRef[] }`.
+ *     The wire never sends a page index for a mutation. This keeps
+ *     multi-call client logic from having to account for index drift
+ *     between requests.
+ *   - A page reorder (a change) returns the new `layout` (order + geometry)
+ *     plus cloud coherence pins. It bumps only `docVersion` +
+ *     `layoutVersion`; every per-page pin stays warm.
+ */
+declare class CloudDocumentPagesService implements Omit<DocumentPagesService, PageStructureVerb> {
+  private readonly http;
+  private readonly docId;
+  private readonly layerName;
+  private readonly isClosed;
+  private readonly manifest;
+  private readonly publisher;
+  private readonly writes;
+  /** The last layout leaf read by {@link pageLayout}, keyed by its URL path. */
+  private layoutMemo;
+  constructor(http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites);
+  /**
+   * Page-geometry list. The geometry bytes live at the content-addressed
+   * `/layout@layoutVersion=N` leaf (not in the manifest); the manifest only
+   * publishes the `layoutVersion` pointer. So `list()` reads `layoutVersion`
+   * from the cached manifest, fetches the layout leaf, and on a 404 (stale
+   * pointer) transparently refreshes the manifest and retries once — the
+   * same ladder the per-page text/geometry reads use. `layoutVersion` bumps
+   * only on structural page ops, so this leaf stays cached across content
+   * and annotation edits.
+   */
+  list(): AbortablePromise<PageListSnapshot>;
+  /**
+   * One page's layout, for renders to size their image without a round
+   * trip per tile. The layout leaf never changes at a given URL, so the
+   * last one read is kept and shared until the manifest points elsewhere.
+   */
+  pageLayout(ref: PageRef, signal: AbortSignal): Promise<PageLayout>;
+  /**
+   * Plane-scope rule: the layout leaf depends on the `layout` plane —
+   * while inherited (no reorder/rotate/insert/delete ever ran), every
+   * visitor's page list is one doc-level URL served from the base
+   * session; the SDK open sequence creates no layer session.
+   */
+  private layoutPath;
+  private fetchLayout;
+  setName(input: PageNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
+  removeName(input: PageRemoveNameInput, options?: WriteOptions): AbortablePromise<PageNameResult>;
+  /**
+   * Named pages are layout: both verbs share the page-reorder patch exactly —
+   * docVersion + layoutVersion advance, no per-page pin changes, so the
+   * cached manifest is patched in place and the fresh layout is published.
+   */
+  private runNameMutation;
+  extract(pages: PageRef[], options?: PageExtractOptions): AbortablePromise<Uint8Array>;
+  flatten(pages: PageRef[], options?: FlattenWriteOptions): AbortablePromise<PageFlattenResult>;
+}
+//#endregion
 //#region src/document/CloudPageAnnotationsService.d.ts
 /**
  * Cloud-side page annotation service. Mirrors the local wiring: each
@@ -856,9 +853,13 @@ declare class CloudPageRenderService implements PageRenderService {
   private readonly layout;
   /** What the caller may read, when the client can know it; null leaves it to the server. */
   private readonly layerRights;
+  /** What the caller may print, when the client can know it; null leaves it to the server. */
+  private readonly printRights;
   constructor(http: HttpClient, docId: string, layerName: string, pageRef: PageRef, isClosed: () => boolean, manifest: ManifestAccessor, layout: (signal: AbortSignal) => Promise<PageLayout>,
   /** What the caller may read, when the client can know it; null leaves it to the server. */
-  layerRights: () => PageLayerRights | null);
+  layerRights: () => PageLayerRights | null,
+  /** What the caller may print, when the client can know it; null leaves it to the server. */
+  printRights: () => PagePrintRights | null);
   image(options?: PageImageOptions): AbortablePromise<PageRenderImage>;
   /**
    * The image's transform, computed like the server's render (the same
@@ -923,7 +924,7 @@ declare class CloudPageHandle implements PageHandle {
   readonly text: CloudPageTextService;
   readonly render: CloudPageRenderService;
   readonly measure: CloudPageMeasureService;
-  constructor(ref: PageRef, http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites, layout: (signal: AbortSignal) => Promise<PageLayout>, layerRights: () => PageLayerRights | null);
+  constructor(ref: PageRef, http: HttpClient, docId: string, layerName: string, isClosed: () => boolean, manifest: ManifestAccessor, publisher: SessionEventPublisher, writes: CloudWrites, layout: (signal: AbortSignal) => Promise<PageLayout>, layerRights: () => PageLayerRights | null, printRights: () => PagePrintRights | null);
 }
 //#endregion
 //#region src/transport/decodeUnverifiedClaims.d.ts