@embedpdf/engine-core 3.0.0-next.11 → 3.0.0-next.13

package/dist/{AnnotationListSnapshot-C1U3XUxP.d.ts → AnnotationListSnapshot-D3mFut1e.d.ts}

@@ -684,7 +684,7 @@ interface AnnotationDraftBase {
  * expands these capabilities. PDF bits are NEVER consulted unless
  * `pdf.permissions` is in scope.
  */
-type DocCapability = 'doc.open' | 'doc.render' | 'doc.text.select' | 'doc.text.copy' | 'doc.text.search' | 'doc.content.copy' | 'doc.download' | 'doc.download.flattened' | 'doc.print' | 'doc.print.high' | 'doc.pages.modify' | 'doc.pages.assemble' | 'doc.forms.read' | 'doc.forms.fill' | 'doc.forms.modify' | 'doc.forms.submit' | 'doc.annotate.read' | 'doc.annotate.modify' | 'doc.metadata.modify' | 'doc.attachments.modify' | 'doc.redact';
+type DocCapability = 'doc.open' | 'doc.render' | 'doc.text.select' | 'doc.text.copy' | 'doc.text.search' | 'doc.content.copy' | 'doc.download' | 'doc.download.flattened' | 'doc.print' | 'doc.print.high' | 'doc.pages.modify' | 'doc.pages.assemble' | 'doc.forms.read' | 'doc.forms.fill' | 'doc.forms.modify' | 'doc.forms.submit' | 'doc.annotate.read' | 'doc.annotate.modify' | 'doc.metadata.modify' | 'doc.attachments.modify' | 'doc.redact' | 'doc.sign' | 'doc.sign.certify';
 /**
  * Single-entity collaboration vocabulary. Only annotations are
  * collab-scoped today; future entities slot into the same grammar.
@@ -869,6 +869,419 @@ declare class MissingIdentity extends Error {
   constructor(scope: string);
 }
 //#endregion
+//#region src/identity/FormFieldRef.d.ts
+/**
+ * How callers address a logical form field.
+ *
+ * - `objectNumber` — the indirect object number of the field dictionary.
+ *   ISO 32000 guarantees every real AcroForm field dictionary is an
+ *   indirect object, and the layer runtime never renumbers (frozen base +
+ *   incremental deltas), so this is the durable identity for the lifetime
+ *   of a document. Preferred for all engine calls.
+ * - `fqn` — the fully qualified field name ("billing.name"). The portable,
+ *   semantic identity used by interchange formats (FDF/XFDF) and analytics;
+ *   survives document rewrites but is only as unique as the producer made
+ *   it. The engine resolves it against the reconciled field tree.
+ */
+type FormFieldRef = {
+  kind: 'objectNumber';
+  fieldObjectNumber: number;
+} | {
+  kind: 'fqn';
+  name: string;
+};
+/**
+ * URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
+ * the `:fieldKey` route parameter. Decoded by the server back into a
+ * `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
+ * `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
+ * read the same on the wire:
+ *
+ *   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
+ *   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
+ *
+ * The caller is responsible for `encodeURIComponent`-ing the result before
+ * splicing it into a URL path; the `wirePaths.layerFormField*` builders
+ * already do that. FQNs are opaque strings and may contain anything; the
+ * `fqn:` prefix keeps them unambiguous from numeric ids.
+ */
+declare function encodeFieldRefKey(ref: FormFieldRef): string;
+/**
+ * Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
+ * server can answer 400 InvalidArg with a useful message instead of
+ * throwing. The input is the already-`decodeURIComponent`-ed segment from
+ * the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
+ * valid identity.
+ */
+declare function decodeFieldRefKey(key: string): FormFieldRef | null;
+/** A widget annotation of a field, as the forms subsystem sees it. */
+interface FormWidgetRef {
+  /**
+   * Indirect object number of the widget annotation — the join key to the
+   * annotation subsystem's `objectNumber` refs. `0` when the widget is
+   * stored as a direct object (spec-violating; cannot be addressed).
+   */
+  annotObjectNumber: number;
+  /**
+   * Object number of the page whose /Annots array references the widget.
+   * `0` when the widget is not reachable from any page ("unplaced").
+   */
+  pageObjectNumber: PageObjectNumber;
+}
+//#endregion
+//#region src/dto/CachePins.d.ts
+/**
+ * Per-page cache-busting integers embedded in immutable cloud/CDN leaf URLs.
+ *
+ * These are not page state. They are read coordinates for cacheable endpoints:
+ * `/text` uses `contentVersion`; `/annotations` uses `annotationVersion`.
+ */
+interface CachePins {
+  contentVersion: number;
+  annotationVersion: number;
+}
+//#endregion
+//#region src/revision/WeakAnnotationState.d.ts
+/**
+ * Tri-state knowledge about weak annotation identities on a page.
+ *
+ * `known(false)` is a stronger claim than "we have not looked yet": it means
+ * the page's annotations were scanned and every annotation had a durable
+ * identity. Cloud/CDN manifests must only publish boolean weak flags from a
+ * known state.
+ */
+type WeakAnnotationState = {
+  kind: 'unknown';
+} | {
+  kind: 'known';
+  hasAnyWeakAnnotations: boolean;
+};
+declare const UNKNOWN_WEAK_ANNOTATION_STATE: WeakAnnotationState;
+declare function knownWeakAnnotationState(hasAnyWeakAnnotations: boolean): WeakAnnotationState;
+//#endregion
+//#region src/revision/PageState.d.ts
+/**
+ * Per-page liveness envelope returned with annotation reads and mutation
+ * metadata. Deliberately scoped to annotation liveness: page identity,
+ * weak-ref revision state, and explicit knowledge about weak annotations.
+ *
+ * Geometry/display order is NOT here — it lives in `PageLayout` (returned by
+ * `pages.list()`), joined to this by `pageObjectNumber`. The two change on
+ * different cadences (annotation edits vs. structural ops), so they are kept
+ * orthogonal and never merged into one struct.
+ */
+interface PageState {
+  pageObjectNumber: PageObjectNumber;
+  revision: RevisionToken;
+  /**
+   * Explicit knowledge state for the weak-annotation scan. `unknown` means the
+   * page has not been scanned yet; it must not be published as a CDN/cache
+   * boolean.
+   */
+  weakAnnotationState: WeakAnnotationState;
+}
+//#endregion
+//#region src/mutation/MutationMeta.d.ts
+/**
+ * Cache pin patch returned by cloud mutations after the durable DB transaction
+ * commits.
+ *
+ * `previousDocVersion` makes partial page deltas safe: clients may apply the
+ * patch only when their cached manifest is exactly at that version. Otherwise
+ * they must refresh instead of manufacturing a mixed-version manifest.
+ *
+ * Deliberately does NOT carry plane scopes: scopes only ever move
+ * base → layer, and each mutation kind knows exactly which planes it owns, so
+ * the client flips them locally when absorbing this delta (the monotone-flip
+ * rule); the manifest is the authoritative source and the 404 → refresh rail
+ * the backstop.
+ */
+interface CacheDelta {
+  previousDocVersion: number;
+  docVersion: number;
+  /**
+   * New doc-level bulk annotations pin, present when this mutation bumped
+   * it (annotation CRUD, page insert/delete, redaction, flatten, form
+   * structure — see `DocumentManifest.annotationsVersion`). Absorbing it
+   * keeps the client's cached manifest addressing the fresh bulk leaf
+   * without a 404-refresh round trip.
+   */
+  annotationsVersion?: number;
+  /**
+   * The layer's write serial after this mutation and whether an artifact
+   * now exists (cloud only). Absorbing them keeps the client's cached
+   * manifest an honest `DocumentVersionRef` source between refreshes.
+   */
+  layerVersion?: number;
+  working?: boolean;
+  pages: Array<{
+    pageObjectNumber: PageObjectNumber;
+    cache: CachePins;
+  }>;
+}
+/**
+ * Base envelope for every layer-mutating operation.
+ *
+ * `affectedPages` is the state delta. `cacheDelta` is the cloud/CDN URL pin
+ * delta and is `null` for local engines.
+ */
+interface MutationMeta {
+  affectedPages: PageState[];
+  cacheDelta: CacheDelta | null;
+}
+//#endregion
+//#region src/signature/types.d.ts
+/**
+ * Digital signatures, read side.
+ *
+ * Three facts, kept apart on purpose (see the signing plan): a signature
+ * is a *bytes* fact (a `/ByteRange` + `/Contents` that seal a byte prefix
+ * of the file), cryptography and trust live in `@embedpdf/core-signature`,
+ * and what changed after a signature is judged per revision. Everything
+ * here is read from the bytes the document was loaded from — for a layer
+ * document, the base followed by the delta it was opened with — never
+ * from unsaved in-memory edits.
+ */
+/**
+ * Whether the engine enforces what a document's signatures forbid
+ * (`protect`, the default: document-derived capabilities are subtracted
+ * and locked fields refuse writes) or leaves every edit to the caller
+ * (`permit`: for tools whose job is to produce or test invalid files).
+ * Analysis never depends on it.
+ */
+type SignedDocumentPolicy = 'protect' | 'permit';
+/** Hash algorithms the engine can compute over a byte range. SHA-1 is read-only: legacy signatures verify with it, new ones never use it. */
+type DigestAlgorithm = 'sha1' | 'sha256' | 'sha384' | 'sha512';
+/** The two `/SubFilter` values the engine can author. Read-side `subFilter` is the raw name and may be anything. */
+type SignatureSubFilter = 'adbe.pkcs7.detached' | 'ETSI.CAdES.detached';
+type SignatureKind = 'signature' | 'timestamp';
+/**
+ * How the signature's `/ByteRange` relates to the file:
+ *   - `whole-revision`: `[0,a) ∪ [b,c)` is exactly one chained revision
+ *     and the hole is this signature's own `/Contents`.
+ *   - `partial`: well-formed ranges that do not seal a revision.
+ *   - `malformed`: unusable ranges or a `/Contents` that is not one DER
+ *     object with zero padding.
+ */
+type SignatureCoverage = 'whole-revision' | 'partial' | 'malformed';
+/** DocMDP / `/Lock /P` permission values (ISO 32000-2 Table 257). */
+type DocMdpPermission = 1 | 2 | 3;
+/**
+ * The modification level a signed document allows, as a product policy:
+ *   - `none`: no byte change at all (not a DocMDP value)
+ *   - `lta`: DSS and document timestamps only (P = 1)
+ *   - `fill`: + form fill, signatures, new signature fields (P = 2, and how a
+ *     validator reads an approval signature)
+ *   - `annotate`: + annotations (P = 3)
+ */
+type ModificationLevel = 'none' | 'lta' | 'fill' | 'annotate';
+type FieldLockAction = 'all' | 'include' | 'exclude';
+/** A FieldMDP transform or a field `/Lock`: which fields it freezes, and an optional `/P` tightening. */
+interface FieldLockSpec {
+  action: FieldLockAction;
+  /** Fully qualified names; a name covers its descendants (`group` covers `group.total`). Empty for `all`. */
+  fields: string[];
+  permission?: DocMdpPermission;
+}
+/**
+ * One saved revision of the file: a byte prefix `[0, end)` closed by a
+ * cross-reference section reachable from the final `startxref`.
+ */
+interface PdfRevision {
+  /** 0 = the original document. */
+  index: number;
+  /** File offset just past the `%%EOF` line ending. */
+  end: number;
+  /** File offset of the cross-reference section the revision's startxref names. */
+  xrefOffset: number;
+  /** The signature that seals exactly this revision, when one does. */
+  signatureIndex: number | null;
+}
+/** What the signer claimed in the signature dictionary. None of it is verified here; `/M` in particular is a claim. */
+interface SignatureSigner {
+  name: string | null;
+  reason: string | null;
+  location: string | null;
+  contactInfo: string | null;
+  /** `/M` as written (PDF date string). */
+  claimedTime: string | null;
+}
+/** The field's `/SV` seed value: what a signature on this field must satisfy. */
+interface SignatureSeedValue {
+  /** `/Ff` bits: which of the entries below are requirements rather than suggestions. */
+  requiredFlags: number;
+  /** Which entries are present at all (same bit layout, plus Cert/MDP/TimeStamp). */
+  presentFlags: number;
+  /** `/V`: the seed-value parser capability the signer needs (1 = PDF 1.5, 2 = PDF 1.7). */
+  version: number | null;
+  /** `/MDP /P` when present: 0 = approval signature only. */
+  mdp: 0 | 1 | 2 | 3 | null;
+  filter: string | null;
+  subFilters: string[];
+  digestMethods: string[];
+  reasons: string[];
+  /** A required entry this engine does not implement — signing this field is refused. */
+  unsupportedRequired: boolean;
+}
+interface SignatureDTO {
+  /** Position in `SignatureSnapshot.signatures` (field order). */
+  index: number;
+  /** Always an `objectNumber` ref: the durable identity. */
+  field: FormFieldRef;
+  fieldName: string;
+  widget: FormWidgetRef | null;
+  signed: boolean;
+  kind: SignatureKind;
+  /** Raw `/Filter` and `/SubFilter` names. */
+  filter: string | null;
+  subFilter: string | null;
+  byteRange: [number, number, number, number] | null;
+  /** DER length of `/Contents` as its TLV declares (0 when unsigned or malformed). */
+  contentsSize: number;
+  /** `null` when unsigned. */
+  coverage: SignatureCoverage | null;
+  /** Which revision the signature seals; `null` unless coverage is `whole-revision`. */
+  revisionIndex: number | null;
+  signer: SignatureSigner;
+  /** The DocMDP permission the signature carries (its `/Reference`), whether or not the catalog points at it. */
+  docMdp: DocMdpPermission | null;
+  /** `/Root /Perms /DocMDP` names this signature: it is THE certification. */
+  catalogCertification: boolean;
+  /** The FieldMDP transform this signature carries. */
+  fieldMdp: FieldLockSpec | null;
+  /** The field's own `/Lock`. */
+  lock: FieldLockSpec | null;
+  seedValue: SignatureSeedValue | null;
+}
+/** A lock an earlier signature established on the current bytes. */
+interface DocumentFieldLock {
+  signatureIndex: number;
+  source: 'fieldmdp' | 'lock';
+  spec: FieldLockSpec;
+}
+/**
+ * What the signatures already in a document mean for what comes after, in
+ * two separate answers:
+ *
+ *   - `enforced`: what a signer DECLARED — a certification's /P, a signed
+ *     field's /Lock /P. The engine refuses what it forbids (mapped onto
+ *     capabilities like encryption permission bits). A plain approval
+ *     signature declares nothing: `null`.
+ *   - `judged`: what a validator holds later changes to — the declared level,
+ *     or the approval baseline (`fill`: form fill-in and signing keep the
+ *     signature valid, anything else does not; Acrobat's reading, ISO 32000
+ *     is silent) when only approval signatures exist. Never refused, only
+ *     judged: an annotation after an approval signature is allowed and then
+ *     reads as invalidating, exactly as in Acrobat.
+ */
+interface DocumentProtection {
+  /** Declared and enforced; `null` when nothing declared (unsigned, or approval signatures only). */
+  enforced: ModificationLevel | null;
+  /** Judged; `null` when nothing is signed. */
+  judged: ModificationLevel | null;
+  certification: {
+    signatureIndex: number;
+    permission: DocMdpPermission;
+  } | null;
+  fieldLocks: DocumentFieldLock[];
+  /** The versioned product policy that derived this. */
+  policyVersion: number;
+}
+interface SignatureSnapshot {
+  /** `false` when the cross-reference chain is broken or was rebuilt: every byte fact is then indeterminate. */
+  chainValid: boolean;
+  /** Oldest first. Empty when `chainValid` is false. */
+  revisions: PdfRevision[];
+  signatures: SignatureDTO[];
+  protection: DocumentProtection;
+}
+/**
+ * The saved bytes a session is on. Locally the hash of the loaded bytes
+ * (for a layer session: of its base); on the cloud the document's base
+ * version. A completed signature always produces a new one.
+ */
+interface BaseVersionInfo {
+  sha256: string;
+  byteLength: number;
+}
+/**
+ * What a signing candidate was built on. Both publish fences are named:
+ * the base the candidate extends and how many edits over it it includes
+ * (the layer's write serial on the cloud, the session's mutation sequence
+ * locally). `complete` must present the same pair.
+ */
+interface DocumentVersionRef {
+  baseSha256: string;
+  editsVersion: number;
+}
+/**
+ * Widget artwork for the signature, as a page of a PDF (the same path
+ * stamps take: the page is drawn into the widget's appearance stream).
+ */
+interface SignatureAppearanceInput {
+  /** A PDF whose page carries the artwork. */
+  pdf: Uint8Array;
+  /** Which page; default 0. */
+  pageIndex?: number;
+}
+interface SignaturePrepareInput {
+  field: FormFieldRef;
+  kind?: SignatureKind;
+  subFilter?: SignatureSubFilter;
+  digest?: Exclude<DigestAlgorithm, 'sha1'>;
+  /** Room reserved for the CMS, in bytes (256 .. 4 MiB). Default 8192. */
+  contentsSize?: number;
+  /** What the signature dictionary says about the signer: `/Name`, `/Reason`, `/Location`, `/ContactInfo`. */
+  attribution?: {
+    name?: string;
+    reason?: string;
+    location?: string;
+    contactInfo?: string;
+  };
+  /** PDF date string for `/M`; default: now. */
+  signingTime?: string;
+  /** Make this the certification signature (`/Root /Perms /DocMDP`). Only ever the first signature. */
+  certify?: {
+    permission: DocMdpPermission;
+  };
+  /** FieldMDP for this signature plus a mirroring `/Lock` on the field. */
+  lock?: FieldLockSpec;
+  appearance?: SignatureAppearanceInput;
+}
+interface SignaturePrepared {
+  signingId: string;
+  digest: Uint8Array;
+  algorithm: Exclude<DigestAlgorithm, 'sha1'>;
+  byteRange: [number, number, number, number];
+  contentsSize: number;
+  subFilter: SignatureSubFilter | 'ETSI.RFC3161';
+  expectedVersion: DocumentVersionRef;
+  /** ISO timestamp after which the candidate is discarded. */
+  expiresAt: string | null;
+}
+interface SignatureCompleteInput {
+  signingId: string;
+  /** The detached CMS (PKCS#7 / CAdES SignedData) over the prepared digest. */
+  cms: Uint8Array;
+  expectedVersion: DocumentVersionRef;
+}
+interface SignatureCompleteResult {
+  /** `already-completed` on an idempotent replay with the same CMS. */
+  status: 'completed' | 'already-completed';
+  signature: SignatureDTO;
+  /** The version the sealed bytes became. */
+  version: BaseVersionInfo;
+  /** What it was built on. */
+  previous: DocumentVersionRef;
+  /** What the document's signatures forbid from now on. */
+  protection: DocumentProtection;
+  /** Every page is re-pinned: the session moved to new bytes. */
+  meta: MutationMeta;
+}
+interface SignatureAbortResult {
+  status: 'aborted' | 'already-completed' | 'unknown';
+}
+//#endregion
 //#region src/auth/scope/resolver.d.ts
 /**
  * Resolved collab subject — the per-record identity bits used to test
@@ -886,13 +1299,13 @@ interface CollabTarget {
  * Wildcard `*` short-circuits to true. Anything not explicitly granted
  * (or expanded from `pdf.permissions`) is denied.
  */
-declare function checkCapability(capability: DocCapability, rawScope: ReadonlyArray<string>, pdfBits: PdfBits): boolean;
+declare function checkCapability(capability: DocCapability, rawScope: ReadonlyArray<string>, pdfBits: PdfBits, protection?: DocumentProtection | null): boolean;
 /**
  * True iff the scope grants AT LEAST ONE of `capabilities`. Convenience
  * for routes like `/text` (`doc.text.copy` OR `doc.text.search`) and
  * `/geometry` (`doc.text.select` OR `doc.text.search`).
  */
-declare function checkAnyCapability(capabilities: ReadonlyArray<DocCapability>, rawScope: ReadonlyArray<string>, pdfBits: PdfBits): boolean;
+declare function checkAnyCapability(capabilities: ReadonlyArray<DocCapability>, rawScope: ReadonlyArray<string>, pdfBits: PdfBits, protection?: DocumentProtection | null): boolean;
 /**
  * True iff the scope grants the collab action against the target record.
  *
@@ -933,13 +1346,13 @@ declare function checkCollab(action: CollabAction, target: CollabTarget, rawScop
  * before calling this. Returning the expanded set is useful for the
  * `/access` response's `effectiveScope` and for advisory UI surfacing.
  */
-declare function expandedCapabilities(parsed: ReadonlyArray<ParsedScope>, pdfBits: PdfBits): Set<DocCapability>;
+declare function expandedCapabilities(parsed: ReadonlyArray<ParsedScope>, pdfBits: PdfBits, protection?: DocumentProtection | null): Set<DocCapability>;
 /**
  * Convenience wrapper: takes the raw scope array, parses each entry,
  * returns the expanded capability set. Exposed for the `/access`
  * endpoint and for the SDK helper that surfaces `effectiveScope`.
  */
-declare function expandRawScope(rawScope: ReadonlyArray<string>, pdfBits: PdfBits): Set<DocCapability>;
+declare function expandRawScope(rawScope: ReadonlyArray<string>, pdfBits: PdfBits, protection?: DocumentProtection | null): Set<DocCapability>;
 /**
  * Test a single collab filter against a target record + the caller's
  * identity. Pure function — no side effects, no implicit rules.
@@ -1229,7 +1642,37 @@ interface OpenInputShare {
   sharePassword?: string;
   password?: string | null;
 }
-type OpenInput = OpenInputBytes | OpenInputLayerBytes | OpenInputById | OpenInputToken | OpenInputShare;
+type OpenInputLayerFileSource = {
+  kind: 'fresh';
+} | {
+  kind: 'artifact';
+  bytes: Uint8Array | ArrayBuffer;
+} | {
+  kind: 'artifact-file';
+  path: string;
+};
+/**
+ * Local-engine layer open over a base FILE (Node runtimes only): the base
+ * is range-read from disk by PDFium and never loaded into JS, and a
+ * signing candidate for such a session is written beside it rather than
+ * held in memory. What a server does for every document; useful locally
+ * for large files.
+ *
+ * Rejected by `@cloudpdf/engine` and by the wasm runtime.
+ */
+interface OpenInputLayerFile {
+  kind: 'layerFile';
+  /** Caller-supplied stable id for this layer document handle. */
+  id: string;
+  /** Optional sharing key for the loaded base. Defaults to the path. */
+  baseKey?: string;
+  basePath: string;
+  /** A verified SHA-256 (hex) of the base file, when the caller has one. */
+  baseSha256?: string;
+  layer?: OpenInputLayerFileSource;
+  password?: string | null;
+}
+type OpenInput = OpenInputBytes | OpenInputLayerBytes | OpenInputLayerFile | OpenInputById | OpenInputToken | OpenInputShare;
 interface OpenOptions {
   password?: string | null;
   /**
@@ -1299,6 +1742,45 @@ interface MetadataPatch {
   custom?: Record<string, string | null>;
 }
 //#endregion
+//#region src/dto/NamedPage.d.ts
+/**
+ * What a `/Names /Pages` or `/Names /Templates` registration resolves to.
+ *
+ *   - `page`: a page in the page tree — the normal case; addressable through
+ *     `doc.page(pageObjectNumber)` and present in `PageListSnapshot.pages`.
+ *   - `template`: a `/Type /Template` dictionary OUTSIDE the page tree
+ *     (ISO 32000-2 §12.7.7): never listed as a page, never renderable,
+ *     `doc.page()` does not accept its object number. Reported so consumers
+ *     can diagnose hidden templates instead of silently ignoring them.
+ *   - `dangling`: the value is null, missing, or not a page/template
+ *     dictionary. Engines remove `/Pages` registrations when their page is
+ *     deleted, so this is only observable in files authored elsewhere.
+ */
+type NamedPageTarget = {
+  kind: 'page';
+  pageObjectNumber: PageObjectNumber;
+} | {
+  kind: 'template';
+  objectNumber: number;
+} | {
+  kind: 'dangling';
+};
+/**
+ * One entry of the catalog's named-page trees, in tree (key-sorted) order.
+ * Page-identity data like `PageLayout.label`, so it rides
+ * `PageListSnapshot` and shares the layout plane's version — a key only
+ * means something against the page set that contains its target.
+ *
+ * `name` is the decoded key text and the identity for `pages.setName` /
+ * `pages.removeName`; the engine re-encodes it. The engine never interprets
+ * the text — Acrobat's stamp-library convention (`identifier=label`) is a
+ * consumer concern.
+ */
+interface NamedPageEntry {
+  name: string;
+  target: NamedPageTarget;
+}
+//#endregion
 //#region src/dto/PageLayout.d.ts
 /**
  * @deprecated Use `PdfRotation` from `../geometry`. A page's display rotation
@@ -1376,6 +1858,13 @@ interface PageLayout {
 interface PageListSnapshot {
   pageCount: number;
   pages: PageLayout[];
+  /**
+   * The catalog's `/Names /Pages` and `/Names /Templates` registrations, in
+   * tree order — see {@link NamedPageEntry}. Absent when the producing
+   * engine predates the field (an older cloud server): consumers treat
+   * absent as "unknown", never as "no registrations".
+   */
+  namedPages?: NamedPageEntry[];
 }
 //#endregion
 //#region src/geometry/convert.d.ts
@@ -1772,46 +2261,6 @@ interface PageImageBlobSource {
 }
 declare function createPageImageHandle(result: PageImageResult, blobSource: PageImageBlobSource): PageImageHandle;
 //#endregion
-//#region src/revision/WeakAnnotationState.d.ts
-/**
- * Tri-state knowledge about weak annotation identities on a page.
- *
- * `known(false)` is a stronger claim than "we have not looked yet": it means
- * the page's annotations were scanned and every annotation had a durable
- * identity. Cloud/CDN manifests must only publish boolean weak flags from a
- * known state.
- */
-type WeakAnnotationState = {
-  kind: 'unknown';
-} | {
-  kind: 'known';
-  hasAnyWeakAnnotations: boolean;
-};
-declare const UNKNOWN_WEAK_ANNOTATION_STATE: WeakAnnotationState;
-declare function knownWeakAnnotationState(hasAnyWeakAnnotations: boolean): WeakAnnotationState;
-//#endregion
-//#region src/revision/PageState.d.ts
-/**
- * Per-page liveness envelope returned with annotation reads and mutation
- * metadata. Deliberately scoped to annotation liveness: page identity,
- * weak-ref revision state, and explicit knowledge about weak annotations.
- *
- * Geometry/display order is NOT here — it lives in `PageLayout` (returned by
- * `pages.list()`), joined to this by `pageObjectNumber`. The two change on
- * different cadences (annotation edits vs. structural ops), so they are kept
- * orthogonal and never merged into one struct.
- */
-interface PageState {
-  pageObjectNumber: PageObjectNumber;
-  revision: RevisionToken;
-  /**
-   * Explicit knowledge state for the weak-annotation scan. `unknown` means the
-   * page has not been scanned yet; it must not be published as a CDN/cache
-   * boolean.
-   */
-  weakAnnotationState: WeakAnnotationState;
-}
-//#endregion
 //#region src/dto/AnnotationRender.d.ts
 /**
  * Which `/AP` sub-dictionary to render. PDFium exposes Normal (`/N`),
@@ -1952,22 +2401,29 @@ interface AnnotationAppearanceManifest {
   appearances: AnnotationAppearanceManifestEntry[];
 }
 //#endregion
-//#region src/dto/CachePins.d.ts
-/**
- * Per-page cache-busting integers embedded in immutable cloud/CDN leaf URLs.
- *
- * These are not page state. They are read coordinates for cacheable endpoints:
- * `/text` uses `contentVersion`; `/annotations` uses `annotationVersion`.
- */
-interface CachePins {
-  contentVersion: number;
-  annotationVersion: number;
-}
-//#endregion
 //#region src/dto/PdfSaveMode.d.ts
 type PdfSaveMode = 'incremental' | 'rewrite';
 declare const DEFAULT_PDF_SAVE_MODE: PdfSaveMode;
 //#endregion
+//#region src/dto/SessionKind.d.ts
+/**
+ * The shape a document session takes inside the engine.
+ *
+ * - `layer` (the default): the bytes become an immutable base with a layer of
+ *   edits on top. Reads fall through to the base; a write promotes only the
+ *   object it touches. A save appends exactly what changed, `download()` on an
+ *   unchanged document returns the loaded bytes verbatim, `downloadLayer()`
+ *   exports the edits alone, and a signature keeps its validity across later
+ *   edits because the signature dictionary is never rewritten.
+ * - `plain`: one in-memory PDFium document, the classic shape. A save rewrites
+ *   every loaded object. Kept for comparison and for the rare embedder that
+ *   depends on that shape; a document that already carries a signature opens
+ *   as `layer` regardless, because a plain save would void it.
+ *
+ * The handle looks the same either way.
+ */
+type SessionKind = 'layer' | 'plain';
+//#endregion
 //#region src/dto/FontSpec.d.ts
 /**
  * Runtime font registration DTOs.
@@ -2018,15 +2474,123 @@ interface FontSpec {
   /** Font file bytes (TTF/OTF). */
   data: Uint8Array | ArrayBuffer;
 }
-/** A successfully registered font. Returned by {@link FontService.register}. */
-interface FontHandle {
-  readonly key: FontKey;
-  /** Resolved base font name (the inferred name when `familyName` was empty). */
+/**
+ * The OS/2 `fsType` embedding permission of a registered font. Registration
+ * refuses restricted and bitmap-only fonts outright. A preview-and-print font
+ * renders existing text and may be embedded, but may not author NEW text
+ * (a FreeText naming it fails, and missing-glyph fallback skips it) until
+ * the application asserts a licence with {@link FontService.authorizeEditing}.
+ */
+type FontEmbeddingPermission = 'installable' | 'editable' | 'preview-and-print';
+/**
+ * What the runtime resolved at registration. This is the persistent
+ * identity of the face: a saved document names it by family, weight and
+ * italic (the font descriptor's `/FontFamily`, `/FontWeight`,
+ * `/ItalicAngle`), and a rich text body reads back with the same values, so
+ * a host can map them back to its own `key`.
+ */
+interface FontIdentityInfo {
+  /** The family as registered, else the font's own family name. */
   readonly familyName: string;
-  /** Resolved style weight (the inferred weight when `0`/omitted was passed). */
+  /** 100..900. */
   readonly weight: number;
   readonly italic: boolean;
+  readonly embeddingPermission: FontEmbeddingPermission;
+  /** Whether new text may be authored with the font (see the permission). */
+  readonly editingAuthorized: boolean;
+  /** True when the registered program is a static instance made from a
+   *  variable font at registration (axes pinned, `wght` to the weight). */
+  readonly instanced: boolean;
 }
+/** A successfully registered font. Returned by {@link FontService.register}. */
+interface FontHandle extends FontIdentityInfo {
+  readonly key: FontKey;
+}
+//#endregion
+//#region src/dto/RichText.d.ts
+/**
+ * Rich text of a FreeText annotation (`/RC` + `/DS`), the model the engine
+ * lays out and writes. Runs carry only the style they override (deltas
+ * against the body), exactly as the XHTML spans do, so changing the body
+ * style moves every run that did not override that property.
+ *
+ * Families name faces the way a PDF does: a standard-14 family
+ * (`"Helvetica"`), a font registered through `engine.fonts` (its family, or
+ * its `key` — the engine resolves either), or a family already embedded in
+ * the document. A family that resolves nowhere substitutes Helvetica; the
+ * appearance still renders and the box still edits.
+ */
+type RichTextDecoration = 'underline' | 'line-through' | 'word';
+type RichTextScript = 'normal' | 'sub' | 'super';
+type RichTextAlign = TextAlignment | 'justify';
+type RichTextDirection = 'ltr' | 'rtl';
+interface RichTextRunStyle {
+  family: string;
+  /** 100..900. */
+  weight: number;
+  italic: boolean;
+  /** Points. */
+  size: number;
+  /** `#RRGGBB`. */
+  color: string;
+  decoration: RichTextDecoration[];
+  script: RichTextScript;
+  /** Points, added after every glyph. */
+  letterSpacing: number;
+  /** 1 = normal (`xfa-font-horizontal-scale` / 100). */
+  horizontalScale: number;
+  /** CSS declarations the engine does not model, kept verbatim. */
+  unknown?: string;
+}
+interface RichTextMargins {
+  top: number;
+  bottom: number;
+  left: number;
+  right: number;
+}
+interface RichTextParagraphProps {
+  align: RichTextAlign;
+  dir: RichTextDirection;
+  /** Points; absent = the normal line box. */
+  lineHeight?: number;
+  margins?: RichTextMargins;
+  textIndent?: number;
+  unknown?: string;
+}
+interface RichTextRun {
+  /** May contain `\r`: a hard line break inside the paragraph. */
+  text: string;
+  /** The properties this run overrides. Absent = the body style. */
+  style?: Partial<RichTextRunStyle>;
+}
+/** A paragraph: its own alignment/direction when they differ from the body's. */
+interface RichTextParagraph extends Partial<RichTextParagraphProps> {
+  runs: RichTextRun[];
+}
+type RichTextBody = RichTextRunStyle & RichTextParagraphProps;
+/** What an annotation reads back: a complete body, every paragraph resolved. */
+interface RichTextDocument {
+  body: RichTextBody;
+  paragraphs: RichTextParagraph[];
+}
+/**
+ * What a draft or patch writes. `body` may be omitted (the annotation's
+ * current body style stays — the "plain text replacement" of the patch
+ * table) or partial (missing properties take the engine's defaults:
+ * Helvetica 12 pt black, left-aligned, ltr).
+ */
+interface RichTextDocumentInput {
+  body?: Partial<RichTextBody>;
+  paragraphs: RichTextParagraph[];
+}
+/** The plain-text projection of a rich document: paragraphs joined by `\r`,
+ *  runs concatenated — what the engine writes to `/Contents`. */
+declare function richTextPlainText(doc: {
+  paragraphs: readonly RichTextParagraph[];
+}): string;
+/** Plain text as rich paragraphs: one per line break, one run each, no
+ *  overrides (the engine's own `/Contents` fallback shape). */
+declare function richTextParagraphsFromPlainText(text: string): RichTextParagraph[];
 //#endregion
 //#region src/errors/EngineErrorCode.d.ts
 declare const EngineErrorCode: {
@@ -2101,6 +2665,41 @@ declare const EngineErrorCode: {
    * doesn't exist).
    */
   readonly MalformedPdf: "MalformedPdf";
+  /**
+   * A signing candidate is parked on this session: every mutation is
+   * refused until `signatures.complete` or `signatures.abort`.
+   */
+  readonly SigningPending: "SigningPending";
+  /** The candidate's TTL elapsed; prepare again. */
+  readonly SigningExpired: "SigningExpired";
+  /**
+   * `complete` presented a version the candidate was not built on (the
+   * document or the layer moved since `prepare`). The CMS cannot be
+   * reused: it signs a digest of bytes that will never be the head.
+   * Prepare again on the current version.
+   */
+  readonly SigningVersionMismatch: "SigningVersionMismatch";
+  /**
+   * The engine refused to author the signature: the field is signed,
+   * read-only, or locked by an earlier signature; a certification is
+   * requested after a signature exists; the seed value requires what the
+   * engine does not implement; the request is inconsistent. The message
+   * names the reason.
+   */
+  readonly SignatureRefused: "SignatureRefused";
+  /**
+   * A signature already in the document forbids this change (a
+   * certification's permission, a FieldMDP or `/Lock`, or the approval
+   * baseline). The message names the signature and the restriction. The
+   * engine option `signedDocumentPolicy: 'permit'` disables the guard.
+   */
+  readonly ProtectedDocument: "ProtectedDocument";
+  /**
+   * The layer is built on a base version that is no longer the
+   * document's head (another signing completed); it can be read and
+   * edited but not signed from.
+   */
+  readonly StaleBase: "StaleBase";
 };
 type EngineErrorCode = (typeof EngineErrorCode)[keyof typeof EngineErrorCode];
 //#endregion
@@ -2436,8 +3035,13 @@ interface BinaryPayload {
   name?: string;
 }
 /**
- * A resolved binary payload in wire form: bytes detached from any Blob and
- * ready to ship (worker transfer list or multipart part body).
+ * A resolved binary payload in wire form: a PRIVATE COPY of the caller's
+ * bytes, owned by the call and ready to ship (worker transfer list or
+ * multipart part body). Ownership is the whole point: the local engine puts
+ * `bytes` on a postMessage transfer list, which detaches the buffer, and a
+ * `BinarySource` is a borrowed argument — never the caller's buffer to lose.
+ * Blob sources yield fresh bytes by construction; Uint8Array sources are
+ * copied here so a full-span view is not silently aliased and killed.
  */
 interface WireResource {
   bytes: ArrayBuffer;
@@ -3001,6 +3605,20 @@ interface DocumentManifest {
    */
   auditHead: number;
   baseSha: string;
+  /**
+   * The layer's write serial (`layers.current_version`; 0 for the base view
+   * and for a never-written layer) — the `editsVersion` half of the
+   * `DocumentVersionRef` a signing pins at `prepare` and checks at `complete`.
+   */
+  layerVersion: number;
+  /**
+   * An artifact exists: the layer holds edits not yet sealed into a base
+   * version. After a signature publishes a version the layer is clean again
+   * while `layerVersion` keeps counting, so this is the only honest signal.
+   */
+  working: boolean;
+  /** Byte length of `baseSha`'s file — with the sha, the `BaseVersionInfo` a client signs. */
+  baseByteLength: number;
   /**
    * Plane scopes (layer manifests only; absent on base manifests and
    * on pre-plane servers = all-`'layer'`). Whole-layer by design — edge
@@ -3049,67 +3667,25 @@ type PdfLinkTarget = {
   path: string;
 } | {
   kind: 'javascript';
-} |
-/** `/S /Named` — a viewer verb (`NextPage`, `PrevPage`, `FirstPage`,
- *  `LastPage`, …). Read-only in v1; common in TOC/nav links. */
-{
-  kind: 'named';
-  name: string;
-} | {
-  kind: 'unsupported';
-};
-/**
- * The subset of {@link PdfLinkTarget} that drafts/patches may author:
- * in-document destinations and URIs. Keeping `goto-remote`/`launch` out of
- * the WRITE surface is deliberate (executable-shaped actions are a security
- * liability the viewer never needs to author), and `unsupported` carries
- * nothing to write.
- */
-type PdfLinkTargetWritable = Extract<PdfLinkTarget, {
-  kind: 'goto' | 'uri';
-}>;
-//#endregion
-//#region src/mutation/MutationMeta.d.ts
-/**
- * Cache pin patch returned by cloud mutations after the durable DB transaction
- * commits.
- *
- * `previousDocVersion` makes partial page deltas safe: clients may apply the
- * patch only when their cached manifest is exactly at that version. Otherwise
- * they must refresh instead of manufacturing a mixed-version manifest.
- *
- * Deliberately does NOT carry plane scopes: scopes only ever move
- * base → layer, and each mutation kind knows exactly which planes it owns, so
- * the client flips them locally when absorbing this delta (the monotone-flip
- * rule); the manifest is the authoritative source and the 404 → refresh rail
- * the backstop.
- */
-interface CacheDelta {
-  previousDocVersion: number;
-  docVersion: number;
-  /**
-   * New doc-level bulk annotations pin, present when this mutation bumped
-   * it (annotation CRUD, page insert/delete, redaction, flatten, form
-   * structure — see `DocumentManifest.annotationsVersion`). Absorbing it
-   * keeps the client's cached manifest addressing the fresh bulk leaf
-   * without a 404-refresh round trip.
-   */
-  annotationsVersion?: number;
-  pages: Array<{
-    pageObjectNumber: PageObjectNumber;
-    cache: CachePins;
-  }>;
-}
+} |
+/** `/S /Named` — a viewer verb (`NextPage`, `PrevPage`, `FirstPage`,
+ *  `LastPage`, …). Read-only in v1; common in TOC/nav links. */
+{
+  kind: 'named';
+  name: string;
+} | {
+  kind: 'unsupported';
+};
 /**
- * Base envelope for every layer-mutating operation.
- *
- * `affectedPages` is the state delta. `cacheDelta` is the cloud/CDN URL pin
- * delta and is `null` for local engines.
+ * The subset of {@link PdfLinkTarget} that drafts/patches may author:
+ * in-document destinations and URIs. Keeping `goto-remote`/`launch` out of
+ * the WRITE surface is deliberate (executable-shaped actions are a security
+ * liability the viewer never needs to author), and `unsupported` carries
+ * nothing to write.
  */
-interface MutationMeta {
-  affectedPages: PageState[];
-  cacheDelta: CacheDelta | null;
-}
+type PdfLinkTargetWritable = Extract<PdfLinkTarget, {
+  kind: 'goto' | 'uri';
+}>;
 //#endregion
 //#region src/mutation/RefetchReason.d.ts
 /**
@@ -3309,66 +3885,6 @@ interface AnnotationMoveResult {
   meta: AnnotationListMutationMeta;
 }
 //#endregion
-//#region src/identity/FormFieldRef.d.ts
-/**
- * How callers address a logical form field.
- *
- * - `objectNumber` — the indirect object number of the field dictionary.
- *   ISO 32000 guarantees every real AcroForm field dictionary is an
- *   indirect object, and the layer runtime never renumbers (frozen base +
- *   incremental deltas), so this is the durable identity for the lifetime
- *   of a document. Preferred for all engine calls.
- * - `fqn` — the fully qualified field name ("billing.name"). The portable,
- *   semantic identity used by interchange formats (FDF/XFDF) and analytics;
- *   survives document rewrites but is only as unique as the producer made
- *   it. The engine resolves it against the reconciled field tree.
- */
-type FormFieldRef = {
-  kind: 'objectNumber';
-  fieldObjectNumber: number;
-} | {
-  kind: 'fqn';
-  name: string;
-};
-/**
- * URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
- * the `:fieldKey` route parameter. Decoded by the server back into a
- * `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
- * `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
- * read the same on the wire:
- *
- *   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
- *   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
- *
- * The caller is responsible for `encodeURIComponent`-ing the result before
- * splicing it into a URL path; the `wirePaths.layerFormField*` builders
- * already do that. FQNs are opaque strings and may contain anything; the
- * `fqn:` prefix keeps them unambiguous from numeric ids.
- */
-declare function encodeFieldRefKey(ref: FormFieldRef): string;
-/**
- * Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
- * server can answer 400 InvalidArg with a useful message instead of
- * throwing. The input is the already-`decodeURIComponent`-ed segment from
- * the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
- * valid identity.
- */
-declare function decodeFieldRefKey(key: string): FormFieldRef | null;
-/** A widget annotation of a field, as the forms subsystem sees it. */
-interface FormWidgetRef {
-  /**
-   * Indirect object number of the widget annotation — the join key to the
-   * annotation subsystem's `objectNumber` refs. `0` when the widget is
-   * stored as a direct object (spec-violating; cannot be addressed).
-   */
-  annotObjectNumber: number;
-  /**
-   * Object number of the page whose /Annots array references the widget.
-   * `0` when the widget is not reachable from any page ("unplaced").
-   */
-  pageObjectNumber: PageObjectNumber;
-}
-//#endregion
 //#region src/forms/value-entry.d.ts
 /** Lossless shape of a field's effective PDF `/V` or `/DV` object. */
 type FormValueEntry = {
@@ -3718,11 +4234,20 @@ interface ListBoxFieldDraft extends FormFieldDraftBase {
   options?: FormFieldOptionInput[];
   widget?: WidgetPlacement;
 }
+/**
+ * A signature field: identity and (usually) one widget. Created unsigned;
+ * signing it is `doc.signatures`' job, drawing a mark into it without
+ * signing is `doc.forms.setSignatureAppearance`.
+ */
+interface SignatureFieldDraft extends FormFieldDraftBase {
+  family: 'signature';
+  widget?: WidgetPlacement;
+}
 /**
  * What `doc.forms.createField` takes: per-family, mirroring the DTO union.
- * Push buttons and signatures are not authorable.
+ * Push buttons are not authorable.
  */
-type FormFieldDraft = TextFieldDraft | CheckboxFieldDraft | RadioFieldDraft | ComboBoxFieldDraft | ListBoxFieldDraft;
+type FormFieldDraft = TextFieldDraft | CheckboxFieldDraft | RadioFieldDraft | ComboBoxFieldDraft | ListBoxFieldDraft | SignatureFieldDraft;
 //#endregion
 //#region src/forms/patch.d.ts
 /**
@@ -3901,6 +4426,488 @@ interface FormEffectsResult {
   meta: MutationMeta | null;
 }
 //#endregion
+//#region src/signature/analysis/types.d.ts
+/**
+ * The shallow serialisation of a PDF object as the fork's revision diff
+ * emits it, parsed. A stream carries its length and SHA-256 rather than
+ * its data; every nested value is direct (references stay references).
+ */
+type PdfValue = {
+  t: 'dict';
+  entries: Record<string, PdfValue>;
+} | {
+  t: 'array';
+  items: PdfValue[];
+} | {
+  t: 'ref';
+  num: number;
+} | {
+  t: 'name';
+  v: string;
+} | {
+  t: 'string';
+  v: string;
+} | {
+  t: 'number';
+  v: number;
+} | {
+  t: 'bool';
+  v: boolean;
+} | {
+  t: 'null';
+} | {
+  t: 'stream';
+  length: number;
+  sha256: string;
+  dict: Record<string, PdfValue>;
+};
+/**
+ * One inbound reference: the referring object (0 = the trailer) and the
+ * label leading to the reference inside it. Edges are *anchored*: a
+ * reference from an unchanged, non-structural object is resolved through
+ * that object to the nearest changed or structural ancestor, and `via`
+ * lists the objects it was resolved through, from the anchor's side down
+ * to the object. A widget's appearance stream reached through an unchanged
+ * indirect `/AP` dictionary is therefore
+ * `{ parent: widget, label: 'AP/N', via: [apDict] }`.
+ */
+interface ObjectReferrer {
+  parent: number;
+  /** Escaped dictionary keys and `[n]` indexes joined by `/`, e.g. `AcroForm/Fields/[0]`, `AP/N`. */
+  label: string;
+  via?: number[];
+}
+type ObjectChangeType = 'added' | 'modified' | 'freed';
+/**
+ * What reading the object from one revision's bytes came to. `failed` is a
+ * live mapping whose bytes do not parse (or a stream whose data cannot be
+ * read): the side is present and its value is NOT evidence - two failed
+ * reads are never "the same value".
+ */
+type ObjectReadStatus = 'ok' | 'failed' | 'absent';
+/**
+ * Facts about one revision as a whole that decide whether later changes to
+ * it can be judged at all. Acrobat treats a document with a sparse
+ * cross-reference table (object numbers below /Size with no entry of any
+ * kind) or a reachable bare-reference object (an indirect object whose
+ * whole body is a reference) as corrupted the moment any revision follows
+ * the signed one; a verdict on such a base would disagree with it.
+ */
+interface RevisionHealth {
+  sparseXref: boolean;
+  bareReferences: number;
+  /** False when the reachability walk hit its budget: usage on that side is a lower bound. */
+  referrersComplete: boolean;
+}
+type ObjectChangeKind = 'dictionary' | 'stream' | 'array' | 'scalar' | 'xref' | 'objstm' | 'trailer';
+/**
+ * One object whose cross-reference mapping differs between two revisions,
+ * with its value in both and every object that references it in both.
+ * The trailer is object number 0. Objects that serialise identically are
+ * still listed (their mapping changed): the identical-rewrite rule judges them.
+ */
+interface ObjectChange {
+  objectNumber: number;
+  change: ObjectChangeType;
+  kind: ObjectChangeKind;
+  /**
+   * Whether the object exists on each side. Derived from `change` by the
+   * transport (`added` → no old side, `freed` → no new side); the trailer
+   * exists on both sides and carries no generation numbers.
+   */
+  present: {
+    old: boolean;
+    new: boolean;
+  };
+  generation: {
+    old: number | null;
+    new: number | null;
+  };
+  /**
+   * The values, or null where the side is absent. A present side with a
+   * null value is *missing evidence*: the evaluator treats it as truncated.
+   */
+  value: {
+    old: PdfValue | null;
+    new: PdfValue | null;
+    truncated: boolean;
+  };
+  /** The serialisation as emitted, for exact comparison. */
+  raw: {
+    old: string | null;
+    new: string | null;
+  };
+  /** Per-side read status; absent on older transports (then `ok` for present sides). */
+  read?: {
+    old: ObjectReadStatus;
+    new: ObjectReadStatus;
+  };
+  streamDataChanged: boolean;
+  /** Anchored inbound edges per side (see `ObjectReferrer`). */
+  usage: {
+    old: ObjectReferrer[];
+    new: ObjectReferrer[];
+  };
+  /**
+   * Set when the transport could not resolve every edge within its budget
+   * (depth, fan-out, total reads). Treated like a truncated value: the step
+   * is indeterminate, never permitted.
+   */
+  usageIncomplete?: boolean;
+}
+interface RevisionField {
+  objectNumber: number;
+  /** Fully qualified name. */
+  name: string;
+  family: FormFieldFamily;
+  /** Widget annotation object numbers (a merged field-widget lists its own number). */
+  widgets: number[];
+  /**
+   * The effective `/Ff` (inherited through the field tree), as the form
+   * model sees it. A lock landing on a field writes `effective | ReadOnly`
+   * into the terminal dictionary, so judging that write needs the effective
+   * flags, not the terminal's own (possibly absent) entry.
+   */
+  flags?: number;
+}
+/**
+ * What one revision looks like structurally: enough to give every object
+ * a role (the catalog, a page, a field, a widget, a signature value)
+ * without walking paths from the root.
+ */
+interface RevisionStructure {
+  root: number;
+  acroForm: number;
+  pagesRoot: number;
+  pages: number[];
+  fields: RevisionField[];
+  signatures: SignatureDTO[];
+}
+interface ChangeFinding {
+  rule: string;
+  verdict: 'permitted' | 'forbidden' | 'incomplete';
+  objectNumber: number;
+  /** The specific edge (`parent:label`) this finding vouches for or condemns, when it is about one. */
+  edge?: string;
+  detail?: string;
+}
+type StepVerdict = 'unchanged' | 'permitted' | 'forbidden' | 'indeterminate';
+interface RevisionAnalysis {
+  older: number;
+  newer: number;
+  /** The level in force after the restrictions established up to `older`. */
+  levelInForce: ModificationLevel;
+  /** Locks in force for this step (from the signatures in `older`). */
+  locks: DocumentFieldLock[];
+  verdict: StepVerdict;
+  findings: ChangeFinding[];
+  changes: ObjectChange[];
+}
+/**
+ * A restriction in force for the judged window: a DocMDP certification or a
+ * FieldMDP/lock, and whose it is. A FieldMDP lock is a promise the locking
+ * signature makes about its own window and binds no other signature's
+ * verdict (corpus v3/85); a certification's level is inherited by every
+ * later window as well (conservative until observed otherwise).
+ */
+interface RestrictionAnchor {
+  signatureIndex: number;
+  revisionIndex: number;
+  source: 'docmdp' | 'fieldmdp' | 'lock';
+  /** Declared by the signature being judged, as opposed to inherited. */
+  own: boolean;
+  permission?: DocMdpPermission;
+  fields?: FieldLockSpec;
+}
+/** One judgement with its evidence status; `complete: false` never coexists with a passing verdict. */
+interface Assessment {
+  verdict: StepVerdict;
+  complete: boolean;
+  /** The finding that decided a forbidden or indeterminate verdict, or the most notable permitted one. */
+  primary?: ChangeFinding;
+  findings: ChangeFinding[];
+}
+interface AnalyzeInput {
+  /** Start from the revision a signature seals, or from any revision. */
+  since: {
+    signatureIndex: number;
+  } | {
+    revisionIndex: number;
+  };
+  /**
+   * `persisted` (default): the loaded bytes. `working-copy`: the session's
+   * unsaved state, snapshotted the way a save would write it, as one more
+   * revision. A revision index compares against history only.
+   */
+  until?: 'persisted' | 'working-copy' | {
+    revisionIndex: number;
+  };
+  /**
+   * Exploratory only: evaluate as if this level were in force. The result
+   * is tagged `mode: 'exploratory'` and never becomes a verdict.
+   */
+  exploratoryLevel?: ModificationLevel;
+  /**
+   * `summary` (default): the verdict and its findings. `full`: also every
+   * pairwise step between `since` and `until`, with each step's changes
+   * (large; for diagnostics and tooling).
+   */
+  detail?: 'summary' | 'full';
+}
+/**
+ * How the judged revision stands against the revision the signature
+ * sealed. The verdict is the NET state - `until` compared with `since`
+ * directly - the way Acrobat judges an approval signature (a page changed
+ * and byte-restored later is unchanged; corpus v2/15, 42, 44, v3/81, 85).
+ * A certification window replays every intervening revision as well
+ * (v3/82-83), and any step's violation joins the verdict.
+ */
+interface ChangeAnalysis {
+  mode: 'authoritative' | 'exploratory';
+  policyVersion: number;
+  basis: {
+    version: BaseVersionInfo;
+    editsVersion: number;
+    source: 'persisted' | 'working-copy';
+  };
+  since: {
+    revisionIndex: number;
+    signatureIndex: number | null;
+  };
+  until: {
+    revisionIndex: number;
+  };
+  /** The restrictions this window was judged under (see `RestrictionAnchor`). */
+  restrictions: RestrictionAnchor[];
+  /** THE verdict, with the findings behind it. */
+  current: Assessment & {
+    method: 'net-state' | 'net-state+replay';
+  };
+  /** Facts about the revisions between `since` and `until`; never a verdict. */
+  later: {
+    revisionCount: number;
+    /** Objects rewritten after `since` that hold the sealed value again in `until`. */
+    undoneObjectNumbers: number[];
+  };
+  /** Equals `current.verdict`: one field for every consumer that only needs the answer. */
+  verdict: StepVerdict;
+  /**
+   * The pairwise steps: the single step when one revision follows `since`,
+   * every step of a certification replay, or every step with
+   * `detail: 'full'`. Empty otherwise (a multi-revision approval window in
+   * summary mode is judged on its net state alone).
+   */
+  steps: RevisionAnalysis[];
+}
+/** Everything one pairwise step needs; JSON in, JSON out. */
+interface StepInput {
+  older: number;
+  newer: number;
+  changes: ObjectChange[];
+  before: RevisionStructure;
+  after: RevisionStructure;
+  /** What the transport learned about each revision as a whole (see `RevisionHealth`). */
+  health?: {
+    old: RevisionHealth;
+    new: RevisionHealth;
+  };
+  /**
+   * The restrictions to judge under. Absent: derived from every signature
+   * in `before` (a revision-anchored analysis). Present: the judged
+   * signature's own locks and the inherited certification level.
+   */
+  restrictions?: {
+    level: ModificationLevel;
+    locks: DocumentFieldLock[];
+  };
+  /** Overrides the level derived from `before` (exploratory mode only). */
+  levelOverride?: ModificationLevel;
+}
+//#endregion
+//#region src/signature/analysis/pdf-value.d.ts
+/**
+ * Parse the fork's canonical shallow serialisation:
+ *   dict     <</Key value/Key2 value>>        (keys sorted, `#xx`-escaped)
+ *   array    [item item]
+ *   ref      n 0 R
+ *   stream   stream(length,sha256hex)<<dict>>
+ *   name     /Name (with #xx escapes)
+ *   string   (literal with backslash escapes) or <hex>
+ *   number   -12.5   bool  true|false   null
+ */
+declare function parsePdfValue(text: string): PdfValue;
+/** Structural equality of two parsed values. */
+declare function pdfValueEquals(a: PdfValue | null, b: PdfValue | null): boolean;
+declare function stableStringify(value: PdfValue | null): string;
+declare function dictEntries(value: PdfValue | null): Record<string, PdfValue> | null;
+/** Keys whose value differs (added, removed, or changed) between two dictionaries. */
+declare function changedKeys(a: PdfValue | null, b: PdfValue | null): Set<string>;
+declare function refsOf(value: PdfValue | null | undefined): number[];
+//#endregion
+//#region src/signature/analysis/evaluate.d.ts
+/** The level a step runs at, and the locks it enforces: what the OLDER revision's signatures established. */
+declare function restrictionsOf(before: RevisionStructure): {
+  level: ModificationLevel;
+  locks: DocumentFieldLock[];
+};
+/**
+ * Judge one pairwise step. Every reference to a changed object, in the
+ * older AND the newer revision, must be claimed by a rule that inspected
+ * that use; an unclaimed reference is `unexplained` and forbidden. A
+ * truncated value is `incomplete`, never permitted. Pure: JSON in, JSON
+ * out, the same code in the browser worker, on the server and in tests.
+ */
+declare function evaluateStep(input: StepInput): RevisionAnalysis;
+/**
+ * Same effective value on both sides: same canonical serialisation (keys
+ * sorted, whitespace normalised - Acrobat compares dictionaries by value,
+ * corpus v3/61-62), same stream data (by bytes, v2/45), and both sides
+ * actually read. A failed read serialises as "null" and would match another
+ * failed read - evidence of nothing.
+ */
+declare function sameEffectiveValue(c: ObjectChange): boolean;
+//#endregion
+//#region src/signature/analysis/restrictions.d.ts
+/**
+ * The restrictions a window is judged under, read from the SEALED
+ * revision's structure (what that revision declared, not what the final
+ * file says).
+ *
+ *   - `judged` given (a signature-anchored analysis): its own FieldMDP and
+ *     /Lock bind the window; other signatures' locks do not (corpus v3/85:
+ *     a second signature is valid with a fill of a field the first locked).
+ *     Every certification's level, own or earlier, applies (inherited:
+ *     conservative until observed otherwise), as does a /Lock's /P.
+ *   - no `judged` (a revision-anchored analysis): every signed signature's
+ *     locks and levels, as before.
+ */
+declare function restrictionsFor(before: RevisionStructure, judged: SignatureDTO | null): {
+  anchors: RestrictionAnchor[];
+  level: ModificationLevel;
+  locks: DocumentFieldLock[];
+};
+//#endregion
+//#region src/signature/analysis/resolve.d.ts
+/**
+ * Limits on edge resolution. Exceeding any of them makes the object's usage
+ * `incomplete`, which the evaluator turns into an indeterminate step: an
+ * adversary can make evidence expensive, never make it disappear.
+ */
+interface EdgeResolverBudget {
+  /** Longest chain of unchanged objects an edge may be resolved through. */
+  maxDepth: number;
+  /** Most anchored edges one object may end up with. */
+  maxEdgesPerObject: number;
+  /** Most referrer reads per resolver (one per side per step). */
+  maxReads: number;
+}
+declare const DEFAULT_EDGE_RESOLVER_BUDGET: EdgeResolverBudget;
+declare const USAGE_INCOMPLETE = "incomplete";
+type ResolvedUsage = ObjectReferrer[] | typeof USAGE_INCOMPLETE;
+/**
+ * Resolves the raw inbound edges of an object (from the fork's referrer
+ * index, which covers every reachable object of a revision) into edges
+ * from *anchors*: the changed objects and the structural objects of the
+ * revision (trailer, catalog, AcroForm, page tree root, pages, fields,
+ * widgets). An edge from an unchanged, non-structural parent is replaced by
+ * that parent's own anchored edges with the labels joined, so an
+ * appearance stream under an unchanged indirect `/AP` dictionary reads
+ * `widget:AP/N` rather than `apDict:N`.
+ *
+ * A graph traversal, not a path enumeration: results are memoised per
+ * object, so a lattice of shared unchanged objects costs its size, not the
+ * number of paths through it. Cycle edges contribute no anchors and are
+ * skipped; a result computed while skipping one is not memoised.
+ */
+declare class EdgeResolver {
+  private readonly read;
+  private readonly anchors;
+  private readonly budget;
+  private readonly memo;
+  private reads;
+  private exhausted;
+  constructor(read: (objectNumber: number) => ObjectReferrer[], anchors: ReadonlySet<number>, budget?: EdgeResolverBudget);
+  /** Anchored edges of `objectNumber`, or `incomplete` when a budget was exceeded. */
+  resolve(objectNumber: number): ResolvedUsage;
+  private resolveInner;
+}
+//#endregion
+//#region src/signature/analysis/verdict.d.ts
+/** The worst of several verdicts (a certification replay's steps). */
+declare function worstVerdict(steps: ReadonlyArray<{
+  verdict: StepVerdict;
+}>): StepVerdict;
+/**
+ * One aggregation rule everywhere: a proven violation decides, whatever
+ * else could not be established; missing evidence never becomes a pass.
+ */
+declare function conclude(findings: ReadonlyArray<ChangeFinding>, hasEffectiveChanges: boolean): StepVerdict;
+/** The finding that explains a verdict: the violation, else the gap, else the most notable allowance. */
+declare function primaryFinding(findings: ReadonlyArray<ChangeFinding>): ChangeFinding | undefined;
+declare function assessmentOf(step: RevisionAnalysis): Assessment;
+/**
+ * A certification window: the net verdict and every replayed step, under
+ * the same rule. A step's violation is a violation of the certification
+ * even when the final state no longer shows it (corpus v3/83).
+ */
+declare function combine(net: RevisionAnalysis, steps: ReadonlyArray<RevisionAnalysis>): Assessment;
+//#endregion
+//#region src/signature/protection.d.ts
+/**
+ * Bumped whenever the derivation below (or a judgement rule) changes meaning.
+ * Rides every protection and every analysis, and keys the cloud's immutable
+ * analysis URLs. v4 (the `signature-compat` corpus, 91 Acrobat observations):
+ * each signature is judged on the net state of the document against the
+ * revision it sealed; an object written again with the sealed value is not
+ * a modification; an approval signature permits commenting; field
+ * properties are judged per level; a lock binds only the signature that
+ * declares it; a changed shared resource must be allowed by every use.
+ */
+declare const SIGNATURE_POLICY_VERSION = 4;
+/** DocMDP `/P` → the modification level it permits. */
+declare function levelFromPermission(permission: DocMdpPermission): ModificationLevel;
+declare function minLevel(a: ModificationLevel, b: ModificationLevel): ModificationLevel;
+/** Whether `level` (null = unsigned, everything allowed) permits changes of kind `needed`. */
+declare function levelAllows(level: ModificationLevel | null, needed: ModificationLevel): boolean;
+/** Hierarchical name match: `group` covers `group.total`. */
+declare function lockNameCovers(lockedName: string, fieldName: string): boolean;
+declare function lockCovers(spec: FieldLockSpec, fieldName: string): boolean;
+/**
+ * Derive what the signatures already in a document mean for what comes
+ * after. Pure and versioned (`SIGNATURE_POLICY_VERSION`); the same function
+ * runs in the browser worker, on the native server, and in the conformance
+ * suite.
+ *
+ *   enforced = min(certification P, every signed field's /Lock /P), or null
+ *              when nothing was declared. What the engine refuses.
+ *   judged   = enforced, or the approval baseline when signatures exist
+ *              without a declaration, or null when nothing is signed. What
+ *              the revision analysis judges later changes against. A
+ *              declaration governs the judgement too: a P=3 certifier really
+ *              did allow annotations.
+ *   fieldLocks = every signed signature's FieldMDP and the /Lock of every
+ *              signed field. Unsigned fields' /Lock entries describe a
+ *              FUTURE signature and lock nothing yet.
+ */
+declare function deriveProtection(signatures: ReadonlyArray<SignatureDTO>): DocumentProtection;
+/** The lock that freezes `fieldName`, if any. */
+declare function fieldLockFor(protection: DocumentProtection, fieldName: string): DocumentFieldLock | null;
+/**
+ * The capabilities a protection removes from every caller, admin scope
+ * included — document-derived authority, exactly like encryption bits.
+ *
+ * Only what was DECLARED is refused: a refusal is a promise a signer made,
+ * never a guess about a validator. A certification (or a lock with /P)
+ * declares what may follow, and everything outside that — page edits,
+ * redaction, field authoring, attachments, and below P=3 annotations, below
+ * P=2 form fill — is refused. A plain approval signature declares nothing:
+ * the same edits stay possible and are then JUDGED, the verdict saying the
+ * signature no longer holds, exactly as Acrobat does. The one exception is a
+ * rewrite: it does not invalidate signatures, it erases them, so any signed
+ * document refuses it. Per-field locks are enforced by the form mutator.
+ */
+declare function protectedCapabilities(protection: DocumentProtection | null): Set<DocCapability>;
+//#endregion
 //#region src/mutation/FormMutationResults.d.ts
 /**
  * Result of a value write (`setValue` / `reset`).
@@ -4462,6 +5469,94 @@ interface PageMoveResult {
   cache: PageMoveCache | null;
 }
 //#endregion
+//#region src/mutation/PageNameInput.d.ts
+/**
+ * Input for `pages.setName()`: register `name` → the page in
+ * `/Names /Pages`. An existing registration with the same decoded key is
+ * replaced (idempotent). With `replace`, that other key is removed in the
+ * SAME job — a rename or retarget as one mutation.
+ *
+ * `name` must be non-empty; the engine never interprets it. Only pages in
+ * the page tree may be registered (hidden templates are refused).
+ */
+interface PageNameInput {
+  name: string;
+  pageObjectNumber: PageObjectNumber;
+  /** An existing key to drop in the same job (rename). */
+  replace?: string;
+}
+/** Input for `pages.removeName()`: the registration to drop; the page stays. */
+interface PageRemoveNameInput {
+  name: string;
+}
+//#endregion
+//#region src/mutation/PageNameResult.d.ts
+/**
+ * Result of `pages.setName()` / `pages.removeName()`. Named pages are
+ * LAYOUT: the post-mutation snapshot (with `namedPages`) is returned whole,
+ * and the cache pins say `docVersion` + `layoutVersion` advanced — per-page
+ * content/annotation pins never move (same shape as `PageMoveResult` on
+ * purpose). `cache` is null on local engines.
+ */
+interface PageNameResult {
+  layout: PageListSnapshot;
+  cache: PageStructureCache | null;
+}
+//#endregion
+//#region src/mutation/PageFlattenResult.d.ts
+type PageFlattenUsage = 'display' | 'print';
+type PageFlattenStatus = 'applied' | 'unchanged' | 'failed' | 'skipped';
+interface PageFlattenInput {
+  pageObjectNumbers: PageObjectNumber[];
+  usage: PageFlattenUsage;
+}
+interface PageFlattenItemResult {
+  pageObjectNumber: PageObjectNumber;
+  status: PageFlattenStatus;
+  error?: SerializedEngineError;
+}
+/** Flatten is a content + annotation mutation, never a layout mutation. */
+interface PageFlattenResult {
+  /** The original ordered request, retained for audit/event replay. */
+  pageObjectNumbers: PageObjectNumber[];
+  usage: PageFlattenUsage;
+  results: PageFlattenItemResult[];
+  meta: MutationMeta | null;
+}
+//#endregion
+//#region src/mutation/AnnotationFlattenResult.d.ts
+/** Input for `page(pon).annotations.flatten()`: the refs (all on that page). */
+interface AnnotationFlattenInput {
+  refs: AnnotationRef[];
+  usage: PageFlattenUsage;
+}
+/**
+ * Per-ref outcome. `applied`: painted into the page content and removed.
+ * `skipped`: left in place — hidden for the usage, a Popup, or without a
+ * usable normal appearance. A ref that is not on the page rejects the whole
+ * call with `InvalidArg` before anything is mutated, so it never appears here.
+ */
+interface AnnotationFlattenItemResult {
+  ref: AnnotationRef;
+  status: 'applied' | 'skipped';
+}
+/**
+ * Result of `page(pon).annotations.flatten()` — `pages.flatten` for a chosen
+ * set. A content + annotation mutation of ONE page: `meta` carries that
+ * page's new pins (null when nothing was applied), exactly like
+ * `PageFlattenResult`.
+ */
+interface AnnotationFlattenResult {
+  pageObjectNumber: PageObjectNumber;
+  usage: PageFlattenUsage;
+  results: AnnotationFlattenItemResult[];
+  meta: MutationMeta | null;
+}
+/** Input for `page(pon).annotations.exportAppearance()`. */
+interface AnnotationAppearanceExportInput {
+  refs: AnnotationRef[];
+}
+//#endregion
 //#region src/mutation/PageRotateInput.d.ts
 /**
  * Input to `pages.rotate()`. Rotation is ABSOLUTE ("set to"), never relative
@@ -4574,27 +5669,6 @@ interface PageInsertBlankSpec {
   count?: number;
 }
 //#endregion
-//#region src/mutation/PageFlattenResult.d.ts
-type PageFlattenUsage = 'display' | 'print';
-type PageFlattenStatus = 'applied' | 'unchanged' | 'failed' | 'skipped';
-interface PageFlattenInput {
-  pageObjectNumbers: PageObjectNumber[];
-  usage: PageFlattenUsage;
-}
-interface PageFlattenItemResult {
-  pageObjectNumber: PageObjectNumber;
-  status: PageFlattenStatus;
-  error?: SerializedEngineError;
-}
-/** Flatten is a content + annotation mutation, never a layout mutation. */
-interface PageFlattenResult {
-  /** The original ordered request, retained for audit/event replay. */
-  pageObjectNumbers: PageObjectNumber[];
-  usage: PageFlattenUsage;
-  results: PageFlattenItemResult[];
-  meta: MutationMeta | null;
-}
-//#endregion
 //#region src/mutation/RedactionApplyResult.d.ts
 type RedactionApplyStatus = 'applied' | 'unchanged' | 'failed' | 'skipped';
 /**
@@ -5113,6 +6187,12 @@ interface FreeTextDraft extends AnnotationDraftBase {
   fontFamily: FreeTextFont;
   fontSize: number;
   textAlign: TextAlignment;
+  /**
+   * Rich text (`/RC`). When given, its body is the annotation's body style
+   * (the `/DA` font and size follow it) and its paragraphs are the text;
+   * `contents`, if also given, must equal its plain projection.
+   */
+  richText?: RichTextDocumentInput;
   /** `/Rect` bounding box — required (computed by the caller/plugin). */
   rect: PdfRect;
   /** `/DA` colour (border + default text). */
@@ -5147,12 +6227,24 @@ type FreeTextAnnotationDTO = AnnotationBase & {
   subtype: 'free-text';
   /** `/IT` intent. */
   intent: FreeTextIntent;
-  /** `/DA` font. */
-  fontFamily: StandardFont;
+  /**
+   * The body face: a standard font name, the `key` of a registered font
+   * whose family/weight/italic match the body, or — for a face the
+   * document embeds but this session did not register — its family name.
+   */
+  fontFamily: FreeTextFont;
   /** `/DA` font size, in points. */
   fontSize: number;
   /** `/Q` horizontal text alignment. */
   textAlign: TextAlignment;
+  /**
+   * The text, as a rich document — always. The annotation's `/RC` when it has
+   * one, else the same shape synthesised from `/Contents`, `/DA` and `/Q`
+   * (one paragraph per line, no run deltas). `contents` is its plain
+   * projection. Every write goes back through the rich path, so a box has
+   * no "plain mode" to fall out of.
+   */
+  richText: RichTextDocument;
   /** `/DA` colour: the border colour and the default text colour. */
   color: Color;
   /** Text colour override (`TextColor`). Absent when the text follows `color`. */
@@ -5187,6 +6279,16 @@ interface FreeTextPatch extends AnnotationPatchBase {
   fontFamily?: FreeTextFont;
   fontSize?: number;
   textAlign?: TextAlignment;
+  /**
+   * Rich replacement: `/RC`, `/DS`, `/DA`, `/Contents` and the appearance
+   * are all regenerated. A patch that also carries `contents` must agree
+   * with the rich text's plain projection (`InvalidArg` otherwise). A
+   * `contents`-only patch on an annotation with `/RC` rewrites the rich
+   * text as body-style paragraphs: run formatting is lost by design.
+   * `fontFamily` / `fontSize` / `fontColor` on such an annotation change the
+   * body style; runs are deltas, so every run that did not override follows.
+   */
+  richText?: RichTextDocumentInput;
   rect?: PdfRect;
   color?: Color;
   fontColor?: Color;
@@ -5360,7 +6462,13 @@ interface StampDraft extends AnnotationDraftBase {
   rect: PdfRect;
   /** What the stamp displays: PNG, JPEG, or single-page PDF bytes. */
   source: BinarySource;
-  /** `/Name` — advisory stamp label ('Approved', 'Draft', …). */
+  /**
+   * `/Name` — the stamp's identifier: a standard name ('Approved', 'Draft',
+   * …) or any custom name such as an Acrobat library identifier
+   * ('#LBGiYhk8V_oAfmqAPENiwD'). Written as a PDF name object; the engine
+   * escapes it. Predefined sets are a reader's rendering concern, so nothing
+   * is validated beyond non-empty.
+   */
   name?: string;
   /** Scaling of the content into `rect`. Default `'contain'` (preserves aspect). */
   fit?: StampFit;
@@ -5411,7 +6519,8 @@ interface StampPatch extends AnnotationPatchBase {
   subtype: 'stamp';
   rect?: PdfRect;
   source?: BinarySource;
-  name?: string;
+  /** `/Name`; `null` removes it (the reader then reports the default). */
+  name?: string | null;
   fit?: StampFit;
   rotation?: number | null;
   unrotatedRect?: PdfRect | null;
@@ -5421,7 +6530,7 @@ interface StampWirePatch extends AnnotationPatchBase {
   subtype: 'stamp';
   rect?: PdfRect;
   source?: ResourceRef;
-  name?: string;
+  name?: string | null;
   fit?: StampFit;
   rotation?: number | null;
   unrotatedRect?: PdfRect | null;
@@ -5758,5 +6867,5 @@ interface AnnotationListPageSnapshot {
   annotations: AnnotationDTO[];
 }
 //#endregion
-export { CaretDraftSchema as $, AttachmentFileInfo as $a, Rect as $c, AnnotationUpdateResult as $i, canonicalSearchQuery as $n, knownWeakAnnotationState as $o, FormEffectsResult as $r, OpenInputLayerSource as $s, CircleDraftSchema as $t, FileAttachmentWireDraftSchema as A, AnnotationKindModule as Aa, ParsedCollab as Ac, CheckboxFieldDTO as Ai, isValidPageObjectNumber as Al, HighlightDraft as An, SerializedEngineError as Ao, SearchSnippet as Ar, charMapViolation as As, LineDraft as At, StampAnnotationDTO as B, FileAttachmentWireDraft as Ba, AnnotationFlags as Bc, RadioFieldDTO as Bi, PageFlattenStatus as Bn, AnnotationAppearanceImage as Bo, textGlyphQuad as Br, pdfRectHeight as Bs, PolygonPatch as Bt, RedactDraft as C, buildCommentThreads as Ca, AnnotationActor as Cc, FormKind as Ci, PdfFieldActions as Cl, UnderlineAnnotationDTO as Cn, AnnotationBase as Co, toOriginalRange as Cr, glyphLooseQuad as Cs, LinkAnnotationDTO as Ct, FileAttachmentDTOSchema as D, buildThreads as Da, DocCapability as Dc, WidgetStyleDraftFields as Di, decodeSubmitFormFlags as Dl, HighlightPatchSchema as Dn, encodeStableIdKey as Do, SearchRequest as Dr, CharMapAnchor as Ds, LinePatchSchema as Dt, WidgetDraft as E, AnnotationThread as Ea, CollabFilter as Ec, WidgetAppearanceSchema as Ei, SubmitFormPayload as El, HighlightDraftSchema as En, decodeStableIdKey as Eo, SearchQuery as Er, CharBoundaryBias as Es, LineDraftSchema as Et, StampDTOSchema as F, AttachmentDeleteResult as Fa, AnnotationDraftBase as Fc, FormFieldFlags as Fi, RedactionApplyScope as Fn, FontKey as Fo, TextLayoutRun as Fr, normalizePdfRect as Fs, PolylineAnnotationDTO as Ft, TextDTOSchema as G, FilledStyleDraftFields as Ga, FreeTextFont as Gc, FormValueEntry as Gi, PageDeleteResult as Gn, AnnotationAppearanceMode as Go, FormFieldUpdateResult as Gr, PageBoxes as Gs, VertexPatchFields as Gt, StampFit as H, ColorStyleDraftFields as Ha, BlendMode as Hc, TextFieldDTO as Hi, PAGE_INSERT_BLANK_MAX_COUNT as Hn, AnnotationAppearanceImagesResult as Ho, FormDataExport as Hr, pdfRectToOriginSize as Hs, PolygonDraft as Ht, StampWireDraftSchema as I, AttachmentsCache as Ia, AnnotationRef as Ic, FormFieldOption as Ii, RedactionApplyStatus as In, FontSpec as Io, buildPageTextLayout as Ir, pdfQuadBounds as Is, PolylineDraft as It, TextPatch as J, GeometryStyleDraftFields as Ja, LineEnding as Jc, decodeFieldRefKey as Ji, PageRotateInput as Jn, AnnotationAppearancesQuery as Jo, FormSetValueResult as Jr, MetadataPatch as Js, SquarePatchSchema as Jt, TextDraftSchema as K, FilledStyleFields as Ka, FreeTextIntent as Kc, FormFieldRef as Ki, PageDeleteInput as Kn, AnnotationAppearanceRaster as Ko, FormImportResult as Kr, PageLayout as Ks, SquareDTOSchema as Kt, StampWirePatchSchema as L, normalizeAttachmentFileSource as La, RevisionToken as Lc, FormFieldOrigin as Li, PageFlattenInput as Ln, DEFAULT_PDF_SAVE_MODE as Lo, expandTextRangeToLine as Lr, pdfQuadCorners as Ls, PolygonDTOSchema as Lt, FileAttachmentPatch as M, DraftOfKind as Ma, ParsedVirtual as Mc, FormFieldBase as Mi, DocumentMetadataTrapped as Ml, MetadataUpdateResult as Mn, serializeError as Mo, PdfTextSegment as Mr, sliceTextByChars as Ms, PolylineDraftSchema as Mt, FileAttachmentAnnotationDTO as N, PatchOfKind as Na, ParsedWildcard as Nc, FormFieldDTO as Ni, RedactionApplyItemResult as Nn, EngineErrorCode as No, TextLayoutFrame as Nr, PdfOriginSize as Ns, PolylinePatchSchema as Nt, FileAttachmentIconSchema as O, classifyRelation as Oa, IdentityClaims as Oc, WidgetStyleFields as Oi, PdfDestination as Ol, HighlightPatch as On, EngineError as Oo, SearchSlice as Or, boundaryTextOffset as Os, LinePatch as Ot, ResourceRefSchema as P, AttachmentCreateResult as Pa, PdfBits as Pc, FormFieldFamily as Pi, RedactionApplyResult as Pn, FontHandle as Po, TextLayoutGlyph as Pr, PdfQuadCorners as Ps, PolylinePatch as Pt, CaretDTOSchema as Q, AttachmentFileBase as Qa, Point as Qc, AnnotationMoveResult as Qi, PageMoveInput as Qn, WeakAnnotationState as Qo, FormEffectStatus as Qr, OpenInputLayerBytes as Qs, CircleDTOSchema as Qt, StampPatch as R, FileAttachmentDraft as Ra, revisionTokensEqual as Rc, ListBoxFieldDTO as Ri, PageFlattenItemResult as Rn, PdfSaveMode as Ro, expandTextRangeToWord as Rr, pdfQuadFromCorners as Rs, PolygonDraftSchema as Rt, RedactAnnotationDTO as S, ReviewStatus as Sa, decodePdfBits as Sc, WidgetPlacement as Si, PdfAnnotationActions as Sl, UnderlinePatch as Sn, AnnotationPatchBase as So, foldText as Sr, glyphLooseBounds as Ss, LinkPatch as St, WidgetAnnotationDTO as T, AnnotationRelationKind as Ta, CollabEntity as Tc, WidgetAppearance as Ti, SubmitFormFlags as Tl, HighlightDTOSchema as Tn, AnnotationStableId as To, SearchMode as Tr, PageTextSnapshot as Ts, LineDTOSchema as Tt, StampWireDraft as U, ColorStyleFields as Ua, CaretIntent as Uc, ToggleFieldWidget as Ui, PageInsertBlankSpec as Un, AnnotationAppearanceManifest as Uo, FormFieldCreateResult as Ur, pdfRectWidth as Us, VertexAnnotationFields as Ut, StampDraft as V, WireAttachmentFile as Va, AnnotationReplyType as Vc, SignatureFieldDTO as Vi, PageFlattenUsage as Vn, AnnotationAppearanceImageOptions as Vo, textSegmentsForRange as Vr, pdfRectSize as Vs, PolygonAnnotationDTO as Vt, NoteIconSchema as W, ColorStylePatchFields as Wa, Color as Wc, UnknownFieldDTO as Wi, PageInsertResult as Wn, AnnotationAppearanceManifestEntry as Wo, FormFieldDeleteResult as Wr, PageListSnapshot as Ws, VertexDraftFields as Wt, NoteIcon as X, GeometryStylePatchFields as Xa, NO_ANNOTATION_FLAGS as Xc, AnnotationCreateResult as Xi, PageMoveResult as Xn, PageState as Xo, FormEffect as Xr, OpenInputById as Xs, SquareAnnotationDTO as Xt, TextAnnotationDTO as Y, GeometryStyleFields as Ya, LineEndings as Yc, encodeFieldRefKey as Yi, PageMoveCache as Yn, AnnotationAppearancesResult as Yo, FormWidgetLinkResult as Yr, OpenInput as Ys, SquarePatch as Yt, TextDraft as Z, AttachmentContent as Za, PdfRectDifferences as Zc, AnnotationDeleteResult as Zi, PageStructureCache as Zn, UNKNOWN_WEAK_ANNOTATION_STATE as Zo, FormEffectResult as Zr, OpenInputBytes as Zs, SquareDraft as Zt, UnsupportedPatchSchema as _, LayerScopePlane as _a, MissingIdentity as _c, FormFieldDraft as _i, PdfActionNode as _l, SquigglyAnnotationDTO as _n, AnnotationSubtype as _o, wordBefore as _r, PageGeometryRun as _s, LinkDraftSchema as _t, AnnotationDTOSchema as a, AnnotationMutationKind as aa, collab as ac, FormSubmissionRequest as ai, CalloutLine as al, ShapeDraftFields as an, normalizeAnnotationDraft as ao, matchPageText as ar, PageImageSource as as, FreeTextDraftSchema as at, UnsupportedAnnotationDTO as b, CommentThread as ba, validateScopeArray as bc, RadioFieldDraft as bi, PdfActionType as bl, UnderlineDraftSchema as bn, PdfAnnotationSubtypeCode as bo, SEARCH_FOLD_VERSION as br, RotatedGeometryRun as bs, PdfLinkTargetWritableSchema as bt, AnnotationKind as c, shiftsExistingAnnotationIndices as ca, CollabTarget as cc, FormFieldValue as ci, LinePoints as cl, StrikeoutDraftSchema as cn, BinaryMimeType as co, SearchQueryValidation as cr, PageRenderBackground as cs, FreeTextAnnotationDTO as ct, AnnotationSubtypeOfKind as d, CacheDelta as da, checkCollab as dc, FormFieldPatch as di, PdfRect as dl, StrikeoutAnnotationDTO as dn, BinarySource as do, matchRegex as dr, PageRenderOptions as ds, InkDraftSchema as dt, AppearanceAction as ea, OpenInputShare as ec, FormFieldDisplay as ei, Rotation as el, CirclePatchSchema as en, AttachmentFileSource as eo, searchContentEpoch as er, PageImageBlobSource as es, CaretPatchSchema as et, KIND_BY_SUBTYPE as f, MutationMeta as fa, checkSetGroup as fc, ListBoxFieldPatch as fi, PdfRotation as fl, StrikeoutDraft as fn, ResourceRef as fo, validateSearchQuery as fr, PageRenderQuery as fs, InkPatchSchema as ft, UnsupportedDraftSchema as g, ManifestPage as ga, InvalidScope as gc, ComboBoxFieldDraft as gi, NamedJavaScriptAction as gl, SquigglyPatch as gn, ANNOTATION_SUBTYPES as go, wordAt as gr, PageGeometryGlyph as gs, LinkDTOSchema as gt, UnsupportedDTOSchema as h, DocumentManifest as ha, filterMatches as hc, CheckboxFieldDraft as hi, DocumentActionsSnapshot as hl, SquigglyPatchSchema as hn, resolveBinarySource as ho, matchLiteral as hr, createPageImageHandle as hs, InkDraft as ht, AnnotationDTO as i, semanticEqual as ia, caps as ic, FormSubmissionReceiptSchema as ii, TextAlignment as il, ShapeAnnotationFields as in, NormalizedPatch as io, buildSnippet as ir, PageImageResult as is, FreeTextDTOSchema as it, WireAttachmentFileSchema as j, DTOOfKind as ja, ParsedScope as jc, ComboBoxFieldDTO as ji, DocumentMetadata as jl, MetadataCache as jn, deserializeError as jo, PageTextLayout as jr, charRangeForTextOffsets as js, PolylineDTOSchema as jt, FileAttachmentPatchSchema as k, refKey as ka, ParsedCapability as kc, WidgetStylePatchFields as ki, PageObjectNumber as kl, HighlightAnnotationDTO as kn, EngineErrorOptions as ko, SearchSliceBudget as kr, charBoundaryAtTextOffset as ks, LineAnnotationDTO as kt, AnnotationPatch as l, AnnotationListMutationMeta as la, checkAnyCapability as lc, CheckboxFieldPatch as li, PdfPoint as ll, StrikeoutPatchSchema as ln, sniffBinaryMetadata as lo, SearchRegexIssue as lr, PageRenderEncodedFormat as ls, FreeTextDraft as lt, WireAnnotationPatch as m, PdfLinkTargetWritable as ma, expandedCapabilities as mc, TextFieldPatch as mi, ActionReadBudget as ml, SquigglyDraftSchema as mn, WireResourceMap as mo, foldOptionsFor as mr, PageRenderViewport as ms, InkAnnotationDTO as mt, AnnotationListSnapshotAllPages as n, AppearanceOutcome as na, OpenOptions as nc, FormSubmissionEntrySchema as ni, StandardFont as nl, CircleAnnotationDTO as nn, EmbeddedFileRef as no, searchSegmentsForRange as nr, PageImageObjectUrl as ns, CaretAnnotationDTO as nt, AnnotationDraft as o, changesAnnotationList as oa, materializePdfPermissions as oc, FormSubmissionRequestSchema as oi, InkList as ol, ShapePatchFields as on, normalizeAnnotationPatch as oo, SEARCH_REGEX_MAX_LENGTH as or, PageNetworkRenderFormat as os, FreeTextPatchSchema as ot, WireAnnotationDraft as p, PdfLinkTarget as pa, expandRawScope as pc, RadioFieldPatch as pi, PdfSize as pl, SquigglyDTOSchema as pn, WireResource as po, validateSearchRegex as pr, PageRenderTarget as ps, InkPatch as pt, TextPatchSchema as q, FilledStylePatchFields as qa, InkIntent as qc, FormWidgetRef as qi, PageRotateResult as qn, AnnotationAppearanceRenderOptions as qo, FormRepairResult as qr, PageRotation as qs, SquareDraftSchema as qt, ANNOTATION_KINDS as r, appearanceImpactOf as ra, TokenSource as rc, FormSubmissionReceipt as ri, StrikeoutIntent as rl, CircleDraft as rn, NormalizedDraft as ro, SEARCH_SNIPPET_CONTEXT as rr, PageImageOptions as rs, CaretDraft as rt, AnnotationDraftSchema as s, invalidatesWeakIndexRefs as sa, pdfPermissions as sc, FormDataFormat as si, InkStroke as sl, StrikeoutDTOSchema as sn, BinaryMetadata as so, SearchQueryIssue as sr, PageRaster as ss, FreeTextPatch as st, AnnotationListPageSnapshot as t, AppearanceImpact as ta, OpenInputToken as tc, FormSubmissionEntry as ti, Size as tl, CirclePatch as tn, EmbeddedFileItem as to, searchRectsForRange as tr, PageImageHandle as ts, CaretPatch as tt, AnnotationPatchSchema as u, RefetchReason as ua, checkCapability as uc, ComboBoxFieldPatch as ui, PdfQuad as ul, StrikeoutPatch as un, BinaryPayload as uo, SearchRegexValidation as ur, PageRenderFormat as us, InkDTOSchema as ut, UnsupportedPatch as v, LayerScopes as va, PermissionDenied as vc, FormFieldOptionInput as vi, PdfActionTargetRef as vl, SquigglyDraft as vn, PDF_CODE_TO_SUBTYPE as vo, FoldOptions as vr, PageGeometrySnapshot as vs, LinkPatchSchema as vt, WidgetPatch as w, isStateAnnotation as wa, CollabAction as wc, FormSnapshot as wi, PdfPageActions as wl, UnderlineDraft as wn, AnnotationIdentityQuality as wo, SearchMatch as wr, isRotatedGeometryRun as ws, LinkDraft as wt, RedactPatch as x, CommentThreadReview as xa, PDF_BITS as xc, TextFieldDraft as xi, PdfActionWarning as xl, UnderlinePatchSchema as xn, subtypeFromCode as xo, SearchMatchRange as xr, UprightGeometryRun as xs, PdfDestinationSchema as xt, UnsupportedDraft as y, BuildCommentThreadsOptions as ya, parseScope as yc, ListBoxFieldDraft as yi, PdfActionTree as yl, UnderlineDTOSchema as yn, PDF_SUBTYPE_TO_CODE as yo, FoldedText as yr, RotatedGeometryGlyph as ys, PdfLinkTargetSchema as yt, StampWirePatch as z, FileAttachmentIcon as za, AnnotationBorderStyle as zc, PushButtonFieldDTO as zi, PageFlattenResult as zn, CachePins as zo, textGlyphAt as zr, pdfRectFromOriginSize as zs, PolygonPatchSchema as zt };
-//# sourceMappingURL=AnnotationListSnapshot-C1U3XUxP.d.ts.map
+export { CaretDraftSchema as $, semanticEqual as $a, NamedPageEntry as $c, FormFieldDisplay as $i, CachePins as $l, PageNameResult as $n, normalizeAnnotationPatch as $o, FormImportResult as $r, AnnotationAppearanceManifestEntry as $s, CircleDraftSchema as $t, PdfRect as $u, FileAttachmentWireDraftSchema as A, ComboBoxFieldDTO as Aa, PageTextSnapshot as Ac, refsOf as Ai, FieldLockSpec as Al, HighlightDraft as An, normalizeAttachmentFileSource as Ao, toOriginalRange as Ar, RichTextDirection as As, LineDraft as At, BlendMode as Au, StampAnnotationDTO as B, SignatureFieldDTO as Ba, normalizePdfRect as Bc, ObjectReferrer as Bi, SignaturePrepareInput as Bl, PageDeleteResult as Bn, FilledStylePatchFields as Bo, TextLayoutFrame as Br, richTextPlainText as Bs, PolygonPatch as Bt, Point as Bu, RedactDraft as C, FormSnapshot as Ca, PageGeometrySnapshot as Cc, evaluateStep as Ci, BaseVersionInfo as Cl, UnderlineAnnotationDTO as Cn, AnnotationKindModule as Co, wordAt as Cr, SerializedEngineError as Cs, LinkAnnotationDTO as Ct, AnnotationDraftBase as Cu, FileAttachmentDTOSchema as D, WidgetStyleFields as Da, glyphLooseBounds as Dc, dictEntries as Di, DocumentProtection as Dl, HighlightPatchSchema as Dn, AttachmentCreateResult as Do, SEARCH_FOLD_VERSION as Dr, RichTextAlign as Ds, LinePatchSchema as Dt, AnnotationBorderStyle as Du, WidgetDraft as E, WidgetStyleDraftFields as Ea, UprightGeometryRun as Ec, changedKeys as Ei, DocumentFieldLock as El, HighlightDraftSchema as En, PatchOfKind as Eo, FoldedText as Er, EngineErrorCode as Es, LineDraftSchema as Et, revisionTokensEqual as Eu, StampDTOSchema as F, FormFieldOption as Fa, charMapViolation as Fc, ChangeFinding as Fi, SignatureCompleteInput as Fl, RedactionApplyScope as Fn, ColorStyleDraftFields as Fo, SearchSlice as Fr, RichTextParagraphProps as Fs, PolylineAnnotationDTO as Ft, InkIntent as Fu, TextDTOSchema as G, AnnotationCreateResult as Ga, pdfRectHeight as Gc, RevisionHealth as Gi, SignatureSubFilter as Gl, AnnotationFlattenInput as Gn, AttachmentFileBase as Go, expandTextRangeToWord as Gr, FontSpec as Gs, VertexPatchFields as Gt, StrikeoutIntent as Gu, StampFit as H, ToggleFieldWidget as Ha, pdfQuadCorners as Hc, RestrictionAnchor as Hi, SignatureSeedValue as Hl, PageRotateResult as Hn, GeometryStyleFields as Ho, TextLayoutRun as Hr, FontHandle as Hs, PolygonDraft as Ht, Rotation as Hu, StampWireDraftSchema as I, FormFieldOrigin as Ia, charRangeForTextOffsets as Ic, ObjectChange as Ii, SignatureCompleteResult as Il, RedactionApplyStatus as In, ColorStyleFields as Io, SearchSliceBudget as Ir, RichTextRun as Is, PolylineDraft as It, LineEnding as Iu, TextPatch as J, AnnotationUpdateResult as Ja, pdfRectWidth as Jc, StepVerdict as Ji, MutationMeta as Jl, PageFlattenInput as Jn, EmbeddedFileItem as Jo, textSegmentsForRange as Jr, PdfSaveMode as Js, SquarePatchSchema as Jt, InkList as Ju, TextDraftSchema as K, AnnotationDeleteResult as Ka, pdfRectSize as Kc, RevisionStructure as Ki, SignedDocumentPolicy as Kl, AnnotationFlattenItemResult as Kn, AttachmentFileInfo as Ko, textGlyphAt as Kr, SessionKind as Ks, SquareDTOSchema as Kt, TextAlignment as Ku, StampWirePatchSchema as L, ListBoxFieldDTO as La, sliceTextByChars as Lc, ObjectChangeKind as Li, SignatureCoverage as Ll, PAGE_INSERT_BLANK_MAX_COUNT as Ln, ColorStylePatchFields as Lo, SearchSnippet as Lr, RichTextRunStyle as Ls, PolygonDTOSchema as Lt, LineEndings as Lu, FileAttachmentPatch as M, FormFieldDTO as Ma, CharMapAnchor as Mc, AnalyzeInput as Mi, PdfRevision as Ml, MetadataUpdateResult as Mn, FileAttachmentIcon as Mo, SearchMode as Mr, RichTextDocumentInput as Ms, PolylineDraftSchema as Mt, Color as Mu, FileAttachmentAnnotationDTO as N, FormFieldFamily as Na, boundaryTextOffset as Nc, Assessment as Ni, SignatureAbortResult as Nl, RedactionApplyItemResult as Nn, FileAttachmentWireDraft as No, SearchQuery as Nr, RichTextMargins as Ns, PolylinePatchSchema as Nt, FreeTextFont as Nu, FileAttachmentIconSchema as O, WidgetStylePatchFields as Oa, glyphLooseQuad as Oc, parsePdfValue as Oi, DocumentVersionRef as Ol, HighlightPatch as On, AttachmentDeleteResult as Oo, SearchMatchRange as Or, RichTextBody as Os, LinePatch as Ot, AnnotationFlags as Ou, ResourceRefSchema as P, FormFieldFlags as Pa, charBoundaryAtTextOffset as Pc, ChangeAnalysis as Pi, SignatureAppearanceInput as Pl, RedactionApplyResult as Pn, WireAttachmentFile as Po, SearchRequest as Pr, RichTextParagraph as Ps, PolylinePatch as Pt, FreeTextIntent as Pu, CaretDTOSchema as Q, appearanceImpactOf as Qa, PageRotation as Qc, FormEffectsResult as Qi, knownWeakAnnotationState as Ql, PageFlattenUsage as Qn, normalizeAnnotationDraft as Qo, FormFieldUpdateResult as Qr, AnnotationAppearanceManifest as Qs, CircleDTOSchema as Qt, PdfQuad as Qu, StampPatch as R, PushButtonFieldDTO as Ra, PdfOriginSize as Rc, ObjectChangeType as Ri, SignatureDTO as Rl, PageInsertBlankSpec as Rn, FilledStyleDraftFields as Ro, PageTextLayout as Rr, RichTextScript as Rs, PolygonDraftSchema as Rt, NO_ANNOTATION_FLAGS as Ru, RedactAnnotationDTO as S, FormKind as Sa, PageGeometryRun as Sc, restrictionsFor as Si, filterMatches as Sl, UnderlinePatch as Sn, refKey as So, matchLiteral as Sr, EngineErrorOptions as Ss, LinkPatch as St, PdfBits as Su, WidgetAnnotationDTO as T, WidgetAppearanceSchema as Ta, RotatedGeometryRun as Tc, sameEffectiveValue as Ti, DocMdpPermission as Tl, HighlightDTOSchema as Tn, DraftOfKind as To, FoldOptions as Tr, serializeError as Ts, LineDTOSchema as Tt, RevisionToken as Tu, StampWireDraft as U, UnknownFieldDTO as Ua, pdfQuadFromCorners as Uc, RevisionAnalysis as Ui, SignatureSigner as Ul, PageRotateInput as Un, GeometryStylePatchFields as Uo, buildPageTextLayout as Ur, FontIdentityInfo as Us, VertexAnnotationFields as Ut, Size as Uu, StampDraft as V, TextFieldDTO as Va, pdfQuadBounds as Vc, PdfValue as Vi, SignaturePrepared as Vl, PageDeleteInput as Vn, GeometryStyleDraftFields as Vo, TextLayoutGlyph as Vr, FontEmbeddingPermission as Vs, PolygonAnnotationDTO as Vt, Rect as Vu, NoteIconSchema as W, FormValueEntry as Wa, pdfRectFromOriginSize as Wc, RevisionField as Wi, SignatureSnapshot as Wl, AnnotationAppearanceExportInput as Wn, AttachmentContent as Wo, expandTextRangeToLine as Wr, FontKey as Ws, VertexDraftFields as Wt, StandardFont as Wu, NoteIcon as X, AppearanceImpact as Xa, PageBoxes as Xc, FormEffectResult as Xi, UNKNOWN_WEAK_ANNOTATION_STATE as Xl, PageFlattenResult as Xn, NormalizedDraft as Xo, FormFieldCreateResult as Xr, AnnotationAppearanceImageOptions as Xs, SquareAnnotationDTO as Xt, LinePoints as Xu, TextAnnotationDTO as Y, AppearanceAction as Ya, PageListSnapshot as Yc, FormEffect as Yi, PageState as Yl, PageFlattenItemResult as Yn, EmbeddedFileRef as Yo, FormDataExport as Yr, AnnotationAppearanceImage as Ys, SquarePatch as Yt, InkStroke as Yu, TextDraft as Z, AppearanceOutcome as Za, PageLayout as Zc, FormEffectStatus as Zi, WeakAnnotationState as Zl, PageFlattenStatus as Zn, NormalizedPatch as Zo, FormFieldDeleteResult as Zr, AnnotationAppearanceImagesResult as Zs, SquareDraft as Zt, PdfPoint as Zu, UnsupportedPatchSchema as _, FormFieldOptionInput as _a, PageRenderQuery as _c, PageObjectNumber as _d, DEFAULT_EDGE_RESOLVER_BUDGET as _i, checkCapability as _l, SquigglyAnnotationDTO as _n, isStateAnnotation as _o, SearchRegexValidation as _r, AnnotationIdentityQuality as _s, LinkDraftSchema as _t, ParsedCapability as _u, AnnotationDTOSchema as a, FormSubmissionRequestSchema as aa, PageImageBlobSource as ac, PdfActionNode as ad, fieldLockFor as ai, OpenInputLayerBytes as al, ShapeDraftFields as an, RefetchReason as ao, PageMoveInput as ar, ResourceRef as as, FreeTextDraftSchema as at, MissingIdentity as au, UnsupportedAnnotationDTO as b, TextFieldDraft as ba, createPageImageHandle as bc, DocumentMetadataTrapped as bd, ResolvedUsage as bi, expandRawScope as bl, UnderlineDraftSchema as bn, buildThreads as bo, validateSearchRegex as br, encodeStableIdKey as bs, PdfLinkTargetWritableSchema as bt, ParsedVirtual as bu, AnnotationKind as c, CheckboxFieldPatch as ca, PageImageOptions as cc, PdfActionType as cd, lockCovers as ci, OpenInputToken as cl, StrikeoutDraftSchema as cn, DocumentManifest as co, searchRectsForRange as cr, resolveBinarySource as cs, FreeTextAnnotationDTO as ct, validateScopeArray as cu, AnnotationSubtypeOfKind as d, ListBoxFieldPatch as da, PageNetworkRenderFormat as dc, PdfFieldActions as dd, protectedCapabilities as di, caps as dl, StrikeoutAnnotationDTO as dn, LayerScopes as do, buildSnippet as dr, PDF_CODE_TO_SUBTYPE as ds, InkDraftSchema as dt, AnnotationActor as du, FormSubmissionEntry as ea, AnnotationAppearanceMode as ec, PdfRotation as ed, FormRepairResult as ei, NamedPageTarget as el, CirclePatchSchema as en, AnnotationMutationKind as eo, PageNameInput as er, BinaryMetadata as es, CaretPatchSchema as et, FormFieldRef as eu, KIND_BY_SUBTYPE as f, RadioFieldPatch as fa, PageRaster as fc, PdfPageActions as fd, assessmentOf as fi, collab as fl, StrikeoutDraft as fn, BuildCommentThreadsOptions as fo, matchPageText as fr, PDF_SUBTYPE_TO_CODE as fs, InkPatchSchema as ft, CollabAction as fu, UnsupportedDraftSchema as g, FormFieldDraft as ga, PageRenderOptions as gc, PdfDestination as gd, worstVerdict as gi, checkAnyCapability as gl, SquigglyPatch as gn, buildCommentThreads as go, SearchRegexIssue as gr, AnnotationBase as gs, LinkDTOSchema as gt, IdentityClaims as gu, UnsupportedDTOSchema as h, ComboBoxFieldDraft as ha, PageRenderFormat as hc, decodeSubmitFormFlags as hd, primaryFinding as hi, CollabTarget as hl, SquigglyPatchSchema as hn, ReviewStatus as ho, SearchQueryValidation as hr, AnnotationPatchBase as hs, InkDraft as ht, DocCapability as hu, AnnotationDTO as i, FormSubmissionRequest as ia, AnnotationAppearancesResult as ic, NamedJavaScriptAction as id, deriveProtection as ii, OpenInputBytes as il, ShapeAnnotationFields as in, AnnotationListMutationMeta as io, PageStructureCache as ir, BinarySource as is, FreeTextDTOSchema as it, InvalidScope as iu, WireAttachmentFileSchema as j, FormFieldBase as ja, CharBoundaryBias as jc, stableStringify as ji, ModificationLevel as jl, MetadataCache as jn, FileAttachmentDraft as jo, SearchMatch as jr, RichTextDocument as js, PolylineDTOSchema as jt, CaretIntent as ju, FileAttachmentPatchSchema as k, CheckboxFieldDTO as ka, isRotatedGeometryRun as kc, pdfValueEquals as ki, FieldLockAction as kl, HighlightAnnotationDTO as kn, AttachmentsCache as ko, foldText as kr, RichTextDecoration as ks, LineAnnotationDTO as kt, AnnotationReplyType as ku, AnnotationPatch as l, ComboBoxFieldPatch as la, PageImageResult as lc, PdfActionWarning as ld, lockNameCovers as li, OpenOptions as ll, StrikeoutPatchSchema as ln, ManifestPage as lo, searchSegmentsForRange as lr, ANNOTATION_SUBTYPES as ls, FreeTextDraft as lt, PDF_BITS as lu, WireAnnotationPatch as m, CheckboxFieldDraft as ma, PageRenderEncodedFormat as mc, SubmitFormPayload as md, conclude as mi, pdfPermissions as ml, SquigglyDraftSchema as mn, CommentThreadReview as mo, SearchQueryIssue as mr, subtypeFromCode as ms, InkAnnotationDTO as mt, CollabFilter as mu, AnnotationListSnapshotAllPages as n, FormSubmissionReceipt as na, AnnotationAppearanceRenderOptions as nc, ActionReadBudget as nd, FormWidgetLinkResult as ni, OpenInput as nl, CircleAnnotationDTO as nn, invalidatesWeakIndexRefs as no, PageMoveCache as nr, sniffBinaryMetadata as ns, CaretAnnotationDTO as nt, decodeFieldRefKey as nu, AnnotationDraft as o, FormDataFormat as oa, PageImageHandle as oc, PdfActionTargetRef as od, levelAllows as oi, OpenInputLayerSource as ol, ShapePatchFields as on, PdfLinkTarget as oo, canonicalSearchQuery as or, WireResource as os, FreeTextPatchSchema as ot, PermissionDenied as ou, WireAnnotationDraft as p, TextFieldPatch as pa, PageRenderBackground as pc, SubmitFormFlags as pd, combine as pi, materializePdfPermissions as pl, SquigglyDTOSchema as pn, CommentThread as po, SEARCH_REGEX_MAX_LENGTH as pr, PdfAnnotationSubtypeCode as ps, InkPatch as pt, CollabEntity as pu, TextPatchSchema as q, AnnotationMoveResult as qa, pdfRectToOriginSize as qc, StepInput as qi, CacheDelta as ql, AnnotationFlattenResult as qn, AttachmentFileSource as qo, textGlyphQuad as qr, DEFAULT_PDF_SAVE_MODE as qs, SquareDraftSchema as qt, CalloutLine as qu, ANNOTATION_KINDS as r, FormSubmissionReceiptSchema as ra, AnnotationAppearancesQuery as rc, DocumentActionsSnapshot as rd, SIGNATURE_POLICY_VERSION as ri, OpenInputById as rl, CircleDraft as rn, shiftsExistingAnnotationIndices as ro, PageMoveResult as rr, BinaryPayload as rs, CaretDraft as rt, encodeFieldRefKey as ru, AnnotationDraftSchema as s, FormFieldValue as sa, PageImageObjectUrl as sc, PdfActionTree as sd, levelFromPermission as si, OpenInputShare as sl, StrikeoutDTOSchema as sn, PdfLinkTargetWritable as so, searchContentEpoch as sr, WireResourceMap as ss, FreeTextPatch as st, parseScope as su, AnnotationListPageSnapshot as t, FormSubmissionEntrySchema as ta, AnnotationAppearanceRaster as tc, PdfSize as td, FormSetValueResult as ti, MetadataPatch as tl, CirclePatch as tn, changesAnnotationList as to, PageRemoveNameInput as tr, BinaryMimeType as ts, CaretPatch as tt, FormWidgetRef as tu, AnnotationPatchSchema as u, FormFieldPatch as ua, PageImageSource as uc, PdfAnnotationActions as ud, minLevel as ui, TokenSource as ul, StrikeoutPatch as un, LayerScopePlane as uo, SEARCH_SNIPPET_CONTEXT as ur, AnnotationSubtype as us, InkDTOSchema as ut, decodePdfBits as uu, UnsupportedPatch as v, ListBoxFieldDraft as va, PageRenderTarget as vc, isValidPageObjectNumber as vd, EdgeResolver as vi, checkCollab as vl, SquigglyDraft as vn, AnnotationRelationKind as vo, matchRegex as vr, AnnotationStableId as vs, LinkPatchSchema as vt, ParsedCollab as vu, WidgetPatch as w, WidgetAppearance as wa, RotatedGeometryGlyph as wc, restrictionsOf as wi, DigestAlgorithm as wl, UnderlineDraft as wn, DTOOfKind as wo, wordBefore as wr, deserializeError as ws, LinkDraft as wt, AnnotationRef as wu, RedactPatch as x, WidgetPlacement as xa, PageGeometryGlyph as xc, USAGE_INCOMPLETE as xi, expandedCapabilities as xl, UnderlinePatchSchema as xn, classifyRelation as xo, foldOptionsFor as xr, EngineError as xs, PdfDestinationSchema as xt, ParsedWildcard as xu, UnsupportedDraft as y, RadioFieldDraft as ya, PageRenderViewport as yc, DocumentMetadata as yd, EdgeResolverBudget as yi, checkSetGroup as yl, UnderlineDTOSchema as yn, AnnotationThread as yo, validateSearchQuery as yr, decodeStableIdKey as ys, PdfLinkTargetSchema as yt, ParsedScope as yu, StampWirePatch as z, RadioFieldDTO as za, PdfQuadCorners as zc, ObjectReadStatus as zi, SignatureKind as zl, PageInsertResult as zn, FilledStyleFields as zo, PdfTextSegment as zr, richTextParagraphsFromPlainText as zs, PolygonPatchSchema as zt, PdfRectDifferences as zu };
+//# sourceMappingURL=AnnotationListSnapshot-D3mFut1e.d.ts.map