@embedpdf/engine-core 3.0.0-next.12 → 3.0.0-next.13

package/dist/conformance.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_fold = require("./fold-C7I5GpBz.cjs");
-const require_PageInsertBlankInput = require("./PageInsertBlankInput-CzShuSJI.cjs");
-const require_AbortError = require("./AbortError-CRSooKsk.cjs");
-const require_schemas = require("./schemas-RChsAMWw.cjs");
+const require_fold = require("./fold-2V29cxCV.cjs");
+const require_PageInsertBlankInput = require("./PageInsertBlankInput-CqXBmFhN.cjs");
+const require_AbortError = require("./AbortError-Cq2igpZ6.cjs");
+const require_schemas = require("./schemas-DIqFMmrC.cjs");
 //#region src/conformance/runMetadataConformance.ts
 /**
 * The conformance harness is transport-agnostic. It takes the test runner as
@@ -389,7 +389,7 @@ function runActionsConformance(runner, opts) {
 			if (engine) await engine.destroy();
 		});
 		test("reads catalog additional actions and preserves /CO identity", async () => {
-			const doc = await open(engine, opts, opts.fixtures.document);
+			const doc = await open$1(engine, opts, opts.fixtures.document);
 			try {
 				expect(Boolean(doc.actions)).toBe(true);
 				const snapshot = await doc.actions.read();
@@ -410,7 +410,7 @@ function runActionsConformance(runner, opts) {
 			}
 		});
 		test("attaches page /AA to PageLayout", async () => {
-			const doc = await open(engine, opts, opts.fixtures.page);
+			const doc = await open$1(engine, opts, opts.fixtures.page);
 			try {
 				const pages = await doc.pages.list();
 				expect(pages.pages[0].actions?.open?.root?.type).toBe("goto-embedded");
@@ -422,7 +422,7 @@ function runActionsConformance(runner, opts) {
 			}
 		});
 		test("attaches activation actions to AnnotationBase, including links", async () => {
-			const doc = await open(engine, opts, opts.fixtures.annotation);
+			const doc = await open$1(engine, opts, opts.fixtures.annotation);
 			try {
 				const firstPage = (await doc.pages.list()).pages[0];
 				const snapshot = await doc.page(firstPage.pageObjectNumber).annotations.list();
@@ -439,7 +439,7 @@ function runActionsConformance(runner, opts) {
 		test("classifies a /S /JavaScript link target, script staying on base.actions", async () => {
 			const fixture = opts.fixtures.javascriptLink;
 			if (!fixture) return;
-			const doc = await open(engine, opts, fixture);
+			const doc = await open$1(engine, opts, fixture);
 			try {
 				const firstPage = (await doc.pages.list()).pages[0];
 				const link = (await doc.page(firstPage.pageObjectNumber).annotations.list()).annotations.find((annotation) => annotation.subtype === "link");
@@ -452,7 +452,7 @@ function runActionsConformance(runner, opts) {
 			}
 		});
 		test("keeps field actions separate from merged widget events", async () => {
-			const doc = await open(engine, opts, opts.fixtures.field);
+			const doc = await open$1(engine, opts, opts.fixtures.field);
 			try {
 				const form = await doc.forms.list();
 				expect(form.fields).toHaveLength(1);
@@ -466,7 +466,7 @@ function runActionsConformance(runner, opts) {
 			}
 		});
 		test("carries interpreter payloads on every executable node", async () => {
-			const doc = await open(engine, opts, opts.fixtures.payloads);
+			const doc = await open$1(engine, opts, opts.fixtures.payloads);
 			try {
 				const page = (await doc.pages.list()).pages[0];
 				const snapshot = await doc.page(page.pageObjectNumber).annotations.list();
@@ -627,7 +627,7 @@ function runActionsConformance(runner, opts) {
 			}
 		});
 		test("degrades unreadable payloads to unknown with payload-dropped", async () => {
-			const doc = await open(engine, opts, opts.fixtures.payloads);
+			const doc = await open$1(engine, opts, opts.fixtures.payloads);
 			try {
 				const page = (await doc.pages.list()).pages[0];
 				const snapshot = await doc.page(page.pageObjectNumber).annotations.list();
@@ -651,7 +651,7 @@ function runActionsConformance(runner, opts) {
 			}
 		});
 		test("reads a destination-form /OpenAction as openDestination", async () => {
-			const doc = await open(engine, opts, opts.fixtures.openDestination);
+			const doc = await open$1(engine, opts, opts.fixtures.openDestination);
 			try {
 				expect(Boolean(doc.actions)).toBe(true);
 				const snapshot = await doc.actions.read();
@@ -671,7 +671,7 @@ function runActionsConformance(runner, opts) {
 		});
 	});
 }
-async function open(engine, opts, fixture) {
+async function open$1(engine, opts, fixture) {
 	if (opts.openKind === "bytes") return engine.open({
 		kind: "bytes",
 		id: fixture.id,
@@ -1519,6 +1519,287 @@ function runAnnotationMutationConformance(runner, opts) {
 				await doc.close();
 			}
 		});
+		test("rich text: a plain draft reads back body-style paragraphs and a body from its font", async () => {
+			const doc = await openFixture$18(engine, opts);
+			try {
+				const created = await doc.page(fix.pageObjectNumber).annotations.create({
+					subtype: "free-text",
+					intent: "free-text",
+					contents: "Plain\rtext",
+					rect: shapeRect,
+					fontFamily: "helvetica-bold",
+					fontSize: 18,
+					textAlign: "center",
+					color: {
+						r: 0,
+						g: 0,
+						b: 0
+					}
+				});
+				expect(created.created.subtype).toBe("free-text");
+				if (created.created.subtype === "free-text") {
+					const rich = created.created.richText;
+					expect(created.created.fontFamily).toBe("helvetica-bold");
+					expect(rich.body.family).toBe("Helvetica");
+					expect(rich.body.weight).toBe(700);
+					expect(rich.body.italic).toBe(false);
+					expect(rich.body.size).toBe(18);
+					expect(rich.body.align).toBe("center");
+					expect(rich.paragraphs).toEqual([{ runs: [{ text: "Plain" }] }, { runs: [{ text: "text" }] }]);
+				}
+			} finally {
+				await doc.close();
+			}
+		});
+		test("rich text: a draft with runs round-trips the body, the runs and the plain projection", async () => {
+			const doc = await openFixture$18(engine, opts);
+			try {
+				const page = doc.page(fix.pageObjectNumber);
+				const created = await page.annotations.create({
+					subtype: "free-text",
+					intent: "free-text",
+					rect: shapeRect,
+					fontFamily: "helvetica",
+					fontSize: 12,
+					textAlign: "left",
+					color: {
+						r: 0,
+						g: 0,
+						b: 255
+					},
+					richText: {
+						body: {
+							family: "Helvetica",
+							size: 18,
+							color: "#102030"
+						},
+						paragraphs: [{ runs: [
+							{ text: "Hello " },
+							{
+								text: "bold",
+								style: { weight: 700 }
+							},
+							{
+								text: " red",
+								style: { color: "#FF0000" }
+							}
+						] }, {
+							align: "center",
+							runs: [{ text: "H" }, {
+								text: "2",
+								style: { script: "sub" }
+							}]
+						}]
+					}
+				});
+				expect(require_schemas.AnnotationCreateResultSchema.safeParse(created).success).toBe(true);
+				expect(created.created.subtype).toBe("free-text");
+				if (created.created.subtype === "free-text") {
+					const dto = created.created;
+					expect(dto.contents).toBe("Hello bold red\rH2");
+					expect(dto.fontFamily).toBe("helvetica");
+					expect(dto.fontSize).toBe(18);
+					expect(dto.color).toMatchObject({
+						r: 0,
+						g: 0,
+						b: 255
+					});
+					expect(dto.richText.body.color).toBe("#102030");
+					expect(dto.richText.paragraphs[0].runs).toEqual([
+						{ text: "Hello " },
+						{
+							text: "bold",
+							style: { weight: 700 }
+						},
+						{
+							text: " red",
+							style: { color: "#FF0000" }
+						}
+					]);
+					expect(dto.richText.paragraphs[1].align).toBe("center");
+					expect(dto.richText.paragraphs[1].runs[1]).toEqual({
+						text: "2",
+						style: { script: "sub" }
+					});
+				}
+				const listed = (await page.annotations.list()).annotations.find((a) => a.index === created.created.index);
+				expect(listed?.subtype).toBe("free-text");
+				if (listed?.subtype === "free-text") expect(listed.richText.paragraphs[0].runs[1]).toEqual({
+					text: "bold",
+					style: { weight: 700 }
+				});
+			} finally {
+				await doc.close();
+			}
+		});
+		test("rich text: paragraphs-only patch keeps the body; contents-only rewrites body-style paragraphs", async () => {
+			const doc = await openFixture$18(engine, opts);
+			try {
+				const page = doc.page(fix.pageObjectNumber);
+				const ref = (await page.annotations.create({
+					subtype: "free-text",
+					intent: "free-text",
+					rect: shapeRect,
+					fontFamily: "helvetica",
+					fontSize: 14,
+					textAlign: "center",
+					color: {
+						r: 0,
+						g: 0,
+						b: 0
+					},
+					richText: {
+						body: {
+							family: "Helvetica",
+							size: 14
+						},
+						paragraphs: [{ runs: [{ text: "a" }, {
+							text: "b",
+							style: { weight: 700 }
+						}] }]
+					}
+				})).created.ref;
+				const restyled = await page.annotations.update(ref, {
+					subtype: "free-text",
+					richText: { paragraphs: [{ runs: [{
+						text: "ab",
+						style: { italic: true }
+					}, { text: "c" }] }] }
+				});
+				expect(require_schemas.AnnotationUpdateResultSchema.safeParse(restyled).success).toBe(true);
+				expect(restyled.updated.subtype).toBe("free-text");
+				if (restyled.updated.subtype === "free-text") {
+					expect(restyled.updated.contents).toBe("abc");
+					expect(restyled.updated.richText.body.size).toBe(14);
+					expect(restyled.updated.richText.body.align).toBe("center");
+					expect(restyled.updated.textAlign).toBe("center");
+					expect(restyled.updated.richText.paragraphs[0].runs[0]).toEqual({
+						text: "ab",
+						style: { italic: true }
+					});
+				}
+				const rewritten = await page.annotations.update(ref, {
+					subtype: "free-text",
+					contents: "one\rtwo"
+				});
+				expect(rewritten.updated.subtype).toBe("free-text");
+				if (rewritten.updated.subtype === "free-text") {
+					expect(rewritten.updated.contents).toBe("one\rtwo");
+					expect(rewritten.updated.richText.paragraphs).toEqual([{ runs: [{ text: "one" }] }, { runs: [{ text: "two" }] }]);
+					expect(rewritten.updated.richText.body.size).toBe(14);
+				}
+				expect(rewritten.meta.weakRefsInvalidated).toBe(false);
+			} finally {
+				await doc.close();
+			}
+		});
+		test("rich text: fontSize / fontColor / fontFamily move the body while runs keep their deltas", async () => {
+			const doc = await openFixture$18(engine, opts);
+			try {
+				const page = doc.page(fix.pageObjectNumber);
+				const created = await page.annotations.create({
+					subtype: "free-text",
+					intent: "free-text",
+					rect: shapeRect,
+					fontFamily: "helvetica",
+					fontSize: 14,
+					textAlign: "left",
+					color: {
+						r: 0,
+						g: 0,
+						b: 0
+					},
+					richText: {
+						body: {
+							family: "Helvetica",
+							size: 14
+						},
+						paragraphs: [{ runs: [{ text: "a" }, {
+							text: "b",
+							style: { size: 30 }
+						}] }]
+					}
+				});
+				const updated = await page.annotations.update(created.created.ref, {
+					subtype: "free-text",
+					fontSize: 20,
+					fontColor: {
+						r: 255,
+						g: 0,
+						b: 0
+					},
+					fontFamily: "times-bold"
+				});
+				expect(updated.updated.subtype).toBe("free-text");
+				if (updated.updated.subtype === "free-text") {
+					const dto = updated.updated;
+					expect(dto.fontSize).toBe(20);
+					expect(dto.fontFamily).toBe("times-bold");
+					expect(dto.richText.body.size).toBe(20);
+					expect(dto.richText.body.color).toBe("#FF0000");
+					expect(dto.richText.body.family).toBe("Times");
+					expect(dto.richText.body.weight).toBe(700);
+					expect(dto.richText.paragraphs[0].runs[1]).toEqual({
+						text: "b",
+						style: { size: 30 }
+					});
+				}
+			} finally {
+				await doc.close();
+			}
+		});
+		test("rich text: contents and richText that disagree reject with InvalidArg; agreeing writes the runs", async () => {
+			const doc = await openFixture$18(engine, opts);
+			try {
+				const page = doc.page(fix.pageObjectNumber);
+				const created = await page.annotations.create({
+					subtype: "free-text",
+					intent: "free-text",
+					contents: "x",
+					rect: shapeRect,
+					fontFamily: "helvetica",
+					fontSize: 14,
+					textAlign: "left",
+					color: {
+						r: 0,
+						g: 0,
+						b: 0
+					}
+				});
+				const ref = created.created.ref;
+				let caught;
+				try {
+					await page.annotations.update(ref, {
+						subtype: "free-text",
+						contents: "stale",
+						richText: { paragraphs: [{ runs: [{ text: "fresh" }] }] }
+					});
+				} catch (err) {
+					caught = err;
+				}
+				expect(require_fold.EngineError.is(caught, require_PageInsertBlankInput.EngineErrorCode.InvalidArg)).toBe(true);
+				const after = (await page.annotations.list()).annotations.find((a) => a.index === created.created.index);
+				expect(after?.contents).toBe("x");
+				const agreed = await page.annotations.update(ref, {
+					subtype: "free-text",
+					contents: "fresh",
+					richText: { paragraphs: [{ runs: [{ text: "fr" }, {
+						text: "esh",
+						style: { weight: 700 }
+					}] }] }
+				});
+				expect(agreed.updated.subtype).toBe("free-text");
+				if (agreed.updated.subtype === "free-text") {
+					expect(agreed.updated.contents).toBe("fresh");
+					expect(agreed.updated.richText.paragraphs[0].runs[1]).toEqual({
+						text: "esh",
+						style: { weight: 700 }
+					});
+				}
+			} finally {
+				await doc.close();
+			}
+		});
 		test("create redact (area + text) round-trips label + colour fields", async () => {
 			const doc = await openFixture$18(engine, opts);
 			try {
@@ -6675,6 +6956,790 @@ function diffAnnotation(i, a, b, errs) {
 	if (a.nm !== b.nm) errs.push(`annotations[${i}].nm mismatch: ${a.nm} vs ${b.nm}`);
 }
 //#endregion
+//#region src/conformance/runSignatureConformance.ts
+/**
+* Digital signatures, read side. The service is OPTIONAL on the contract
+* (`downloadLayer?` pattern) — the suite runs only where the engine
+* provides it.
+*
+* Invariants:
+*   1. Byte facts describe the LOADED bytes: a revision is a byte prefix,
+*      a whole-revision signature seals exactly one, the digest over its
+*      `/ByteRange` is what the file's bytes hash to, and an unsaved edit
+*      changes none of it.
+*   2. Protection is derived from the signatures in the file and applied
+*      as document-derived capabilities: a certification with permission 2
+*      takes page assembly and annotation writes away, a FieldMDP freezes
+*      the fields it names, a rewrite save is refused. Under
+*      `signedDocumentPolicy: 'permit'` none of that applies and the
+*      analysis is unchanged.
+*   3. The same answers come from a plain session and from a layer
+*      session over the same bytes.
+*/
+function runSignatureConformance(runner, opts) {
+	const { describe, test, beforeAll, afterAll, expect } = runner;
+	describe(`signatures conformance: ${opts.label}`, () => {
+		let engine;
+		let permitEngine = null;
+		let supported = false;
+		beforeAll(async () => {
+			engine = await opts.makeEngine();
+			const probe = await open(engine, opts, opts.fixtures.unsignedForm);
+			supported = probe.signatures !== void 0;
+			await probe.close();
+			if (supported && opts.makePermitEngine) permitEngine = await opts.makePermitEngine();
+		});
+		afterAll(async () => {
+			if (permitEngine) await permitEngine.destroy();
+			if (engine) await engine.destroy();
+		});
+		test("an unsigned form has no signatures and no protection; version() hashes the loaded bytes", async () => {
+			if (!supported) return;
+			const bytes = await opts.fixtures.unsignedForm.bytes();
+			const doc = await open(engine, opts, opts.fixtures.unsignedForm);
+			try {
+				const snapshot = await doc.signatures.list();
+				expect(snapshot.chainValid).toBe(true);
+				expect(snapshot.signatures).toEqual([]);
+				expect(snapshot.revisions.length >= 1).toBe(true);
+				expect(snapshot.protection.judged).toBeNull();
+				expect(snapshot.protection.enforced).toBeNull();
+				expect(snapshot.protection.certification).toBeNull();
+				expect(snapshot.protection.fieldLocks).toEqual([]);
+				expect(doc.security.allows("doc.pages.assemble")).toBe(true);
+				if (doc.version) {
+					const version = await doc.version();
+					expect(version.byteLength).toBe(bytes.byteLength);
+					expect(version.sha256).toBe(await sha256Hex(bytes));
+				}
+				let caught;
+				try {
+					await doc.signatures.contents({
+						kind: "fqn",
+						name: "no-such-field"
+					});
+				} catch (err) {
+					caught = err;
+				}
+				expect(require_fold.EngineError.is(caught, require_PageInsertBlankInput.EngineErrorCode.NotFound)).toBe(true);
+			} finally {
+				await doc.close();
+			}
+		});
+		test("two approval signatures: revisions, coverage, digests, contents, revision bytes", async () => {
+			if (!supported) return;
+			const fixture = opts.fixtures.twoApprovals;
+			const bytes = await fixture.bytes();
+			const doc = await open(engine, opts, fixture);
+			try {
+				const snapshot = await doc.signatures.list();
+				expect(snapshot.chainValid).toBe(true);
+				expect(snapshot.revisions).toHaveLength(3);
+				expect(snapshot.signatures).toHaveLength(2);
+				expect(snapshot.revisions[2].end).toBe(bytes.byteLength);
+				for (const [i, sig] of snapshot.signatures.entries()) {
+					expect(sig.index).toBe(i);
+					expect(sig.signed).toBe(true);
+					expect(sig.kind).toBe("signature");
+					expect(sig.field.kind).toBe("objectNumber");
+					expect(sig.fieldName).toBe(fixture.fieldNames[i]);
+					expect(sig.coverage).toBe("whole-revision");
+					expect(sig.revisionIndex).toBe(i + 1);
+					expect(snapshot.revisions[i + 1].signatureIndex).toBe(i);
+					expect(sig.subFilter).toBe("ETSI.CAdES.detached");
+					expect(typeof sig.signer.claimedTime).toBe("string");
+					expect(sig.docMdp).toBeNull();
+					expect(sig.catalogCertification).toBe(false);
+					expect(sig.contentsSize > 0).toBe(true);
+					expect(sig.byteRange[0]).toBe(0);
+					expect(sig.byteRange[2] + sig.byteRange[3]).toBe(snapshot.revisions[i + 1].end);
+				}
+				expect(snapshot.protection.judged).toBe("annotate");
+				expect(snapshot.protection.enforced).toBeNull();
+				expect(snapshot.protection.certification).toBeNull();
+				expect(snapshot.protection.fieldLocks).toEqual([]);
+				const first = snapshot.signatures[0];
+				const contents = await doc.signatures.contents(first.field);
+				expect(contents.byteLength).toBe(first.contentsSize);
+				expect(contents[0]).toBe(48);
+				const [a, b, c, d] = first.byteRange;
+				const sealed = await doc.signatures.revisionBytes(1);
+				expect(sealed.byteLength).toBe(snapshot.revisions[1].end);
+				expect(bytesEqual(sealed, bytes.subarray(0, sealed.byteLength))).toBe(true);
+				const signedBytes = concat(sealed.subarray(a, a + b), sealed.subarray(c, c + d));
+				const digest = await doc.signatures.digest(first.field, "sha256");
+				expect(digest.byteLength).toBe(32);
+				expect(toHex(digest)).toBe(await sha256Hex(signedBytes));
+				expect((await doc.signatures.digest(first.field, "sha512")).byteLength).toBe(64);
+				const byName = await doc.signatures.digest({
+					kind: "fqn",
+					name: first.fieldName
+				}, "sha256");
+				expect(toHex(byName)).toBe(toHex(digest));
+				const text = (await doc.forms.list()).fields.find((f) => f.name === fixture.textField);
+				expect(text).toBeTruthy();
+				await doc.forms.setValue({
+					kind: "objectNumber",
+					fieldObjectNumber: text.fieldObjectNumber
+				}, {
+					type: "text",
+					value: "unsaved"
+				});
+				const again = await doc.signatures.list();
+				expect(again.revisions).toEqual(snapshot.revisions);
+				expect(again.signatures.map((s) => [
+					s.coverage,
+					s.revisionIndex,
+					s.byteRange
+				])).toEqual(snapshot.signatures.map((s) => [
+					s.coverage,
+					s.revisionIndex,
+					s.byteRange
+				]));
+				expect(toHex(await doc.signatures.digest(first.field, "sha256"))).toBe(toHex(digest));
+				if (doc.version) expect((await doc.version()).sha256).toBe(await sha256Hex(bytes));
+			} finally {
+				await doc.close();
+			}
+		});
+		test("a certification takes structural capabilities away; permit lifts it", async () => {
+			if (!supported) return;
+			const fixture = opts.fixtures.certified;
+			const doc = await open(engine, opts, fixture);
+			try {
+				const snapshot = await doc.signatures.list();
+				const signed = snapshot.signatures.filter((s) => s.signed);
+				expect(signed).toHaveLength(1);
+				const sig = signed[0];
+				expect(sig.fieldName).toBe(fixture.fieldName);
+				expect(sig.coverage).toBe("whole-revision");
+				expect(sig.docMdp).toBe(2);
+				expect(sig.catalogCertification).toBe(true);
+				expect(snapshot.protection.judged).toBe("fill");
+				expect(snapshot.protection.enforced).toBe("fill");
+				expect(snapshot.protection.certification).toEqual({
+					signatureIndex: sig.index,
+					permission: 2
+				});
+				expect(doc.security.allows("doc.forms.read")).toBe(true);
+				expect(doc.security.allows("doc.forms.fill")).toBe(true);
+				expect(doc.security.allows("doc.annotate.modify")).toBe(false);
+				expect(doc.security.allows("doc.pages.assemble")).toBe(false);
+				expect(doc.security.allows("doc.redact")).toBe(false);
+				const list = await doc.pages.list();
+				let caught;
+				try {
+					await doc.pages.delete([list.pages[0].pageObjectNumber]);
+				} catch (err) {
+					caught = err;
+				}
+				expect(require_fold.EngineError.is(caught, require_PageInsertBlankInput.EngineErrorCode.ProtectedDocument)).toBe(true);
+				caught = void 0;
+				try {
+					await doc.download({ mode: "rewrite" });
+				} catch (err) {
+					caught = err;
+				}
+				expect(require_fold.EngineError.is(caught, require_PageInsertBlankInput.EngineErrorCode.ProtectedDocument)).toBe(true);
+				const saved = await doc.download();
+				expect(saved.byteLength >= snapshot.revisions[1].end).toBe(true);
+			} finally {
+				await doc.close();
+			}
+			if (!permitEngine) return;
+			const permitted = await open(permitEngine, opts, fixture);
+			try {
+				const snapshot = await permitted.signatures.list();
+				expect(snapshot.protection.judged).toBe("fill");
+				expect(snapshot.protection.enforced).toBe("fill");
+				expect(permitted.security.allows("doc.pages.assemble")).toBe(true);
+				const rewritten = await permitted.download({ mode: "rewrite" });
+				expect(rewritten.byteLength > 0).toBe(true);
+			} finally {
+				await permitted.close();
+			}
+		});
+		test("a FieldMDP freezes the fields it names; permit lifts it", async () => {
+			if (!supported) return;
+			const fixture = opts.fixtures.fieldMdp;
+			const doc = await open(engine, opts, fixture);
+			const lockedRef = {
+				kind: "fqn",
+				name: fixture.lockedField
+			};
+			try {
+				const snapshot = await doc.signatures.list();
+				const sig = snapshot.signatures[0];
+				expect(sig.fieldName).toBe(fixture.fieldName);
+				expect(sig.fieldMdp).toEqual({
+					action: "include",
+					fields: [fixture.lockedField]
+				});
+				expect(snapshot.protection.judged).toBe("annotate");
+				expect(snapshot.protection.enforced).toBeNull();
+				expect(snapshot.protection.fieldLocks[0]).toEqual({
+					signatureIndex: 0,
+					source: "fieldmdp",
+					spec: {
+						action: "include",
+						fields: [fixture.lockedField]
+					}
+				});
+				for (const lock of snapshot.protection.fieldLocks) {
+					expect(lock.signatureIndex).toBe(0);
+					expect(lock.spec).toEqual({
+						action: "include",
+						fields: [fixture.lockedField]
+					});
+				}
+				expect(doc.security.allows("doc.forms.fill")).toBe(true);
+				let caught;
+				try {
+					await doc.forms.setValue(lockedRef, {
+						type: "text",
+						value: "changed"
+					});
+				} catch (err) {
+					caught = err;
+				}
+				expect(require_fold.EngineError.is(caught, require_PageInsertBlankInput.EngineErrorCode.ProtectedDocument)).toBe(true);
+				const field = await doc.forms.get(lockedRef);
+				expect(field.family).toBe("text");
+				expect(field.value === "changed").toBe(false);
+			} finally {
+				await doc.close();
+			}
+			if (!permitEngine) return;
+			const permitted = await open(permitEngine, opts, fixture);
+			try {
+				const result = await permitted.forms.setValue(lockedRef, {
+					type: "text",
+					value: "changed"
+				});
+				expect(result.field.name).toBe(fixture.lockedField);
+			} finally {
+				await permitted.close();
+			}
+		});
+		test("well-formed ranges that seal no revision are partial, with no revision index", async () => {
+			if (!supported) return;
+			const doc = await open(engine, opts, opts.fixtures.partialChain);
+			try {
+				const snapshot = await doc.signatures.list();
+				expect(snapshot.chainValid).toBe(true);
+				expect(snapshot.revisions).toHaveLength(3);
+				expect(snapshot.signatures).toHaveLength(2);
+				for (const sig of snapshot.signatures) {
+					expect(sig.signed).toBe(true);
+					expect(sig.coverage).toBe("partial");
+					expect(sig.revisionIndex).toBeNull();
+					expect(sig.contentsSize).toBe(13);
+					expect((await doc.signatures.contents(sig.field)).byteLength).toBe(13);
+					expect((await doc.signatures.digest(sig.field, "sha256")).byteLength).toBe(32);
+				}
+				expect(snapshot.revisions.every((r) => r.signatureIndex === null)).toBe(true);
+				expect(snapshot.protection.judged).toBe("annotate");
+				expect(snapshot.protection.enforced).toBeNull();
+				let caught;
+				try {
+					await doc.signatures.revisionBytes(3);
+				} catch (err) {
+					caught = err;
+				}
+				expect(require_fold.EngineError.is(caught, require_PageInsertBlankInput.EngineErrorCode.NotFound)).toBe(true);
+			} finally {
+				await doc.close();
+			}
+		});
+		if (opts.openKind !== "id") {
+			runSigningTests(runner, opts, () => engine, () => supported);
+			runAnalysisTests(runner, opts, () => engine, () => permitEngine, () => supported);
+		}
+	});
+}
+function runAnalysisTests(runner, opts, engineOf, permitEngineOf, supported) {
+	const { test, expect } = runner;
+	test("analyze: a form fill and a second signature after an approval are permitted", async () => {
+		if (!supported()) return;
+		const doc = await open(engineOf(), opts, opts.fixtures.twoApprovals);
+		try {
+			const analysis = await doc.signatures.analyze({ since: { signatureIndex: 0 } });
+			expect(analysis.mode).toBe("authoritative");
+			expect(analysis.basis.source).toBe("persisted");
+			expect(analysis.since).toEqual({
+				revisionIndex: 1,
+				signatureIndex: 0
+			});
+			expect(analysis.until.revisionIndex).toBe(2);
+			expect(analysis.steps).toHaveLength(1);
+			const [step] = analysis.steps;
+			expect(step.levelInForce).toBe("annotate");
+			expect(step.verdict).toBe("permitted");
+			expect(step.changes.length > 0).toBe(true);
+			const rules = new Set(step.findings.filter((f) => f.verdict === "permitted").map((f) => f.rule));
+			expect(rules.has("form-fill")).toBe(true);
+			expect(rules.has("signature-added")).toBe(true);
+			expect(step.findings.filter((f) => f.verdict === "forbidden")).toEqual([]);
+			expect(analysis.verdict).toBe("permitted");
+			const latest = await doc.signatures.analyze({ since: { signatureIndex: 1 } });
+			expect(latest.steps).toHaveLength(0);
+			expect(latest.verdict).toBe("unchanged");
+			const historic = await doc.signatures.analyze({
+				since: { revisionIndex: 0 },
+				until: { revisionIndex: 1 }
+			});
+			expect(historic.steps).toHaveLength(1);
+			expect(historic.verdict).toBe("permitted");
+		} finally {
+			await doc.close();
+		}
+	});
+	test("analyze: the working copy is one more revision; a partial signature cannot anchor", async () => {
+		if (!supported()) return;
+		const fx = opts.fixtures.unsignedSigField;
+		const doc = await open(engineOf(), opts, fx);
+		try {
+			const prepared = await doc.signatures.prepare({
+				field: {
+					kind: "fqn",
+					name: fx.fieldName
+				},
+				certify: { permission: 2 }
+			});
+			await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			const clean = await doc.signatures.analyze({
+				since: { signatureIndex: 0 },
+				until: "working-copy"
+			});
+			expect(clean.steps).toHaveLength(0);
+			expect(clean.verdict).toBe("unchanged");
+			await doc.forms.setValue({
+				kind: "fqn",
+				name: fx.textField
+			}, {
+				type: "text",
+				value: "draft"
+			});
+			const persisted = await doc.signatures.analyze({ since: { signatureIndex: 0 } });
+			expect(persisted.steps).toHaveLength(0);
+			const working = await doc.signatures.analyze({
+				since: { signatureIndex: 0 },
+				until: "working-copy"
+			});
+			expect(working.basis.source).toBe("working-copy");
+			expect(working.steps).toHaveLength(1);
+			expect(working.steps[0].levelInForce).toBe("fill");
+			expect(working.verdict).toBe("permitted");
+			expect(working.steps[0].findings.some((f) => f.rule === "form-fill" && f.verdict === "permitted")).toBe(true);
+		} finally {
+			await doc.close();
+		}
+		const partial = await open(engineOf(), opts, opts.fixtures.partialChain);
+		try {
+			expect(await caughtCode(() => partial.signatures.analyze({ since: { signatureIndex: 0 } }))).toBe(require_PageInsertBlankInput.EngineErrorCode.InvalidArg);
+			const byRevision = await partial.signatures.analyze({ since: { revisionIndex: 0 } });
+			expect(byRevision.later.revisionCount).toBe(2);
+			expect(byRevision.steps).toHaveLength(0);
+			const inFull = await partial.signatures.analyze({
+				since: { revisionIndex: 0 },
+				detail: "full"
+			});
+			expect(inFull.steps).toHaveLength(2);
+			expect(inFull.current.verdict).toBe(byRevision.current.verdict);
+		} finally {
+			await partial.close();
+		}
+	});
+	test("analyze: a page edit under a certification and a locked field edit are forbidden", async () => {
+		if (!supported()) return;
+		const permit = permitEngineOf();
+		if (!permit) return;
+		const certified = await open(permit, opts, opts.fixtures.certified);
+		let reopened = null;
+		try {
+			const list = await certified.pages.list();
+			await certified.pages.rotate([list.pages[0].pageObjectNumber], 90);
+			const working = await certified.signatures.analyze({
+				since: { signatureIndex: 0 },
+				until: "working-copy"
+			});
+			expect(working.verdict).toBe("forbidden");
+			const bytes = await certified.download();
+			reopened = await reopen(permit, opts, `${opts.fixtures.certified.id}-tampered`, bytes);
+			const analysis = await reopened.signatures.analyze({ since: { signatureIndex: 0 } });
+			expect(analysis.verdict).toBe("forbidden");
+			expect(analysis.steps[0].findings.some((f) => f.verdict === "forbidden")).toBe(true);
+		} finally {
+			if (reopened) await reopened.close();
+			await certified.close();
+		}
+		const locked = await open(permit, opts, opts.fixtures.fieldMdp);
+		try {
+			await locked.forms.setValue({
+				kind: "fqn",
+				name: opts.fixtures.fieldMdp.lockedField
+			}, {
+				type: "text",
+				value: "tampered"
+			});
+			const working = await locked.signatures.analyze({
+				since: { signatureIndex: 0 },
+				until: "working-copy"
+			});
+			expect(working.verdict).toBe("forbidden");
+			expect(working.steps[0].findings.some((f) => f.rule === "field-lock")).toBe(true);
+		} finally {
+			await locked.close();
+		}
+	});
+}
+/** A minimal DER SEQUENCE standing in for a CMS: the engine's job ends at the bytes. */
+const FAKE_CMS = new Uint8Array([
+	48,
+	6,
+	2,
+	1,
+	1,
+	2,
+	1,
+	2
+]);
+async function caughtCode(run) {
+	try {
+		await run();
+		return null;
+	} catch (err) {
+		return err instanceof require_fold.EngineError ? err.code : "not-an-engine-error";
+	}
+}
+function runSigningTests(runner, opts, engineOf, supported) {
+	const { test, expect } = runner;
+	const fx = () => opts.fixtures.unsignedSigField;
+	const sigRef = () => ({
+		kind: "fqn",
+		name: fx().fieldName
+	});
+	const textRef = () => ({
+		kind: "fqn",
+		name: fx().textField
+	});
+	test("sign: prepare seals a candidate, complete installs it, download returns it verbatim", async () => {
+		if (!supported()) return;
+		const engine = engineOf();
+		const doc = await open(engine, opts, fx());
+		const events = [];
+		const unsubscribe = doc.events.subscribe((event) => events.push(event.type));
+		let reopened = null;
+		try {
+			const v0 = await doc.version();
+			const before = await doc.signatures.list();
+			expect(before.revisions).toHaveLength(1);
+			expect(before.signatures).toHaveLength(1);
+			expect(before.signatures[0].signed).toBe(false);
+			expect(before.protection.judged).toBeNull();
+			const prepared = await doc.signatures.prepare({
+				field: sigRef(),
+				subFilter: "ETSI.CAdES.detached",
+				digest: "sha256",
+				contentsSize: 1024,
+				attribution: { reason: "conformance" }
+			});
+			expect(prepared.digest.byteLength).toBe(32);
+			expect(prepared.algorithm).toBe("sha256");
+			expect(prepared.subFilter).toBe("ETSI.CAdES.detached");
+			expect(prepared.contentsSize).toBe(1024);
+			expect(prepared.byteRange[0]).toBe(0);
+			expect(prepared.byteRange[2] > prepared.byteRange[1]).toBe(true);
+			expect(prepared.expectedVersion.baseSha256).toBe(v0.sha256);
+			expect(await caughtCode(() => doc.signatures.prepare({ field: sigRef() }))).toBe(require_PageInsertBlankInput.EngineErrorCode.SigningPending);
+			expect(await caughtCode(() => doc.forms.setValue(textRef(), {
+				type: "text",
+				value: "x"
+			}))).toBe(require_PageInsertBlankInput.EngineErrorCode.SigningPending);
+			const during = await doc.signatures.list();
+			expect(during.signatures[0].signed).toBe(false);
+			expect((await doc.version()).sha256).toBe(v0.sha256);
+			expect(await caughtCode(() => doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: {
+					baseSha256: prepared.expectedVersion.baseSha256,
+					editsVersion: prepared.expectedVersion.editsVersion + 1
+				}
+			}))).toBe(require_PageInsertBlankInput.EngineErrorCode.SigningVersionMismatch);
+			const result = await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			expect(result.status).toBe("completed");
+			expect(result.signature.signed).toBe(true);
+			expect(result.signature.fieldName).toBe(fx().fieldName);
+			expect(result.signature.coverage).toBe("whole-revision");
+			expect(result.signature.revisionIndex).toBe(1);
+			expect(result.signature.subFilter).toBe("ETSI.CAdES.detached");
+			expect(result.signature.signer.reason).toBe("conformance");
+			expect(result.signature.contentsSize).toBe(FAKE_CMS.byteLength);
+			expect(result.previous).toEqual(prepared.expectedVersion);
+			expect(result.version.sha256 === v0.sha256).toBe(false);
+			expect(result.protection.judged).toBe("annotate");
+			expect(result.protection.enforced).toBeNull();
+			expect(result.meta.affectedPages.length >= 1).toBe(true);
+			expect(await doc.version()).toEqual(result.version);
+			const after = await doc.signatures.list();
+			expect(after.revisions).toHaveLength(2);
+			expect(after.signatures[0].signed).toBe(true);
+			expect(after.signatures[0].revisionIndex).toBe(1);
+			expect(after.revisions[1].signatureIndex).toBe(0);
+			expect(toHex(await doc.signatures.digest(sigRef(), "sha256"))).toBe(toHex(prepared.digest));
+			expect(bytesEqual(await doc.signatures.contents(sigRef()), FAKE_CMS)).toBe(true);
+			const bytes = await doc.download();
+			expect(bytes.byteLength).toBe(result.version.byteLength);
+			expect(await sha256Hex(bytes)).toBe(result.version.sha256);
+			reopened = await reopen(engine, opts, `${fx().id}-signed`, bytes);
+			const fresh = await reopened.signatures.list();
+			expect(fresh.revisions).toHaveLength(2);
+			expect(fresh.signatures[0].coverage).toBe("whole-revision");
+			expect(toHex(await reopened.signatures.digest(sigRef(), "sha256"))).toBe(toHex(prepared.digest));
+			const replay = await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			expect(replay.status).toBe("already-completed");
+			expect(replay.version).toEqual(result.version);
+			expect((await doc.signatures.abort(prepared.signingId)).status).toBe("already-completed");
+			expect((await doc.signatures.abort("never-prepared")).status).toBe("unknown");
+			await doc.forms.setValue(textRef(), {
+				type: "text",
+				value: "after"
+			});
+			expect(await caughtCode(() => doc.signatures.prepare({ field: sigRef() }))).toBe(require_PageInsertBlankInput.EngineErrorCode.SignatureRefused);
+			expect(events.filter((t) => t === "signature.prepared")).toHaveLength(1);
+			expect(events.filter((t) => t === "signature.completed")).toHaveLength(1);
+			expect(events.filter((t) => t === "document.versioned")).toHaveLength(1);
+		} finally {
+			unsubscribe();
+			if (reopened) await reopened.close();
+			await doc.close();
+		}
+	});
+	test("sign: unsaved edits are sealed in the signature's own revision (layer session)", async () => {
+		if (!supported()) return;
+		const doc = await open(engineOf(), opts, fx());
+		try {
+			await doc.forms.setValue(textRef(), {
+				type: "text",
+				value: "unsaved"
+			});
+			const prepared = await doc.signatures.prepare({ field: sigRef() });
+			const result = await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			expect(result.signature.revisionIndex).toBe(1);
+			const after = await doc.signatures.list();
+			expect(after.revisions).toHaveLength(2);
+			const text = await doc.forms.get(textRef());
+			expect(text.value).toBe("unsaved");
+			const bytes = await doc.download();
+			expect(await sha256Hex(bytes)).toBe(result.version.sha256);
+		} finally {
+			await doc.close();
+		}
+	});
+	test("sign: a certification protects the document from the moment it completes", async () => {
+		if (!supported()) return;
+		const doc = await open(engineOf(), opts, fx());
+		try {
+			expect(doc.security.allows("doc.pages.assemble")).toBe(true);
+			const prepared = await doc.signatures.prepare({
+				field: sigRef(),
+				certify: { permission: 2 },
+				subFilter: "adbe.pkcs7.detached"
+			});
+			const result = await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			expect(result.signature.docMdp).toBe(2);
+			expect(result.signature.catalogCertification).toBe(true);
+			expect(result.protection.judged).toBe("fill");
+			expect(result.protection.enforced).toBe("fill");
+			expect(result.protection.certification).toEqual({
+				signatureIndex: result.signature.index,
+				permission: 2
+			});
+			expect(doc.security.allows("doc.pages.assemble")).toBe(false);
+			expect(doc.security.allows("doc.forms.fill")).toBe(true);
+			const list = await doc.pages.list();
+			expect(await caughtCode(() => doc.pages.delete([list.pages[0].pageObjectNumber]))).toBe(require_PageInsertBlankInput.EngineErrorCode.ProtectedDocument);
+			expect(await caughtCode(() => doc.download({ mode: "rewrite" }))).toBe(require_PageInsertBlankInput.EngineErrorCode.ProtectedDocument);
+			await doc.forms.setValue(textRef(), {
+				type: "text",
+				value: "filled"
+			});
+			const after = await doc.signatures.list();
+			expect(after.signatures[0].coverage).toBe("whole-revision");
+		} finally {
+			await doc.close();
+		}
+	});
+	test("sign: a lock freezes the named fields and is mirrored on the field", async () => {
+		if (!supported()) return;
+		const doc = await open(engineOf(), opts, fx());
+		try {
+			const prepared = await doc.signatures.prepare({
+				field: sigRef(),
+				lock: {
+					action: "include",
+					fields: [fx().textField]
+				}
+			});
+			const result = await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			expect(result.signature.fieldMdp).toEqual({
+				action: "include",
+				fields: [fx().textField]
+			});
+			expect(result.signature.lock).toEqual({
+				action: "include",
+				fields: [fx().textField]
+			});
+			expect(result.protection.fieldLocks.length >= 1).toBe(true);
+			expect(await caughtCode(() => doc.forms.setValue(textRef(), {
+				type: "text",
+				value: "nope"
+			}))).toBe(require_PageInsertBlankInput.EngineErrorCode.ProtectedDocument);
+		} finally {
+			await doc.close();
+		}
+	});
+	test("sign: abort discards the candidate and lifts the fence", async () => {
+		if (!supported()) return;
+		const doc = await open(engineOf(), opts, fx());
+		try {
+			const v0 = await doc.version();
+			const prepared = await doc.signatures.prepare({ field: sigRef() });
+			expect((await doc.signatures.abort(prepared.signingId)).status).toBe("aborted");
+			expect((await doc.signatures.list()).signatures[0].signed).toBe(false);
+			expect((await doc.version()).sha256).toBe(v0.sha256);
+			await doc.forms.setValue(textRef(), {
+				type: "text",
+				value: "free again"
+			});
+			expect(await caughtCode(() => doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			}))).toBe(require_PageInsertBlankInput.EngineErrorCode.NotFound);
+		} finally {
+			await doc.close();
+		}
+	});
+	test("sign: artwork from a PDF page lands on the widget", async () => {
+		if (!supported()) return;
+		const doc = await open(engineOf(), opts, fx());
+		try {
+			const artwork = await opts.fixtures.artwork.bytes();
+			const prepared = await doc.signatures.prepare({
+				field: sigRef(),
+				appearance: {
+					pdf: artwork,
+					pageIndex: 0
+				}
+			});
+			const result = await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			expect(result.signature.coverage).toBe("whole-revision");
+			expect(result.signature.widget).toBeTruthy();
+			const widget = (await doc.page(result.signature.widget.pageObjectNumber).annotations.list()).annotations.find((a) => a.ref.kind === "objectNumber" && a.ref.annotObjectNumber === result.signature.widget.annotObjectNumber);
+			expect(widget).toBeTruthy();
+		} finally {
+			await doc.close();
+		}
+	});
+	if (opts.openKind === "layerBytes") test("sign: a layer session keeps its kind, with an empty layer over the new base", async () => {
+		if (!supported()) return;
+		const doc = await open(engineOf(), opts, fx());
+		try {
+			const prepared = await doc.signatures.prepare({ field: sigRef() });
+			const result = await doc.signatures.complete({
+				signingId: prepared.signingId,
+				cms: FAKE_CMS,
+				expectedVersion: prepared.expectedVersion
+			});
+			const layer = await doc.downloadLayer();
+			expect(layer.byteLength > 0).toBe(true);
+			expect(await sha256Hex(await doc.download())).toBe(result.version.sha256);
+		} finally {
+			await doc.close();
+		}
+	});
+}
+async function reopen(engine, opts, id, bytes) {
+	if (opts.openKind === "layerBytes") return engine.open({
+		kind: "layerBytes",
+		id,
+		baseBytes: bytes
+	});
+	return engine.open({
+		kind: "bytes",
+		id,
+		bytes
+	});
+}
+async function open(engine, opts, fixture) {
+	if (opts.openKind === "bytes") return engine.open({
+		kind: "bytes",
+		id: fixture.id,
+		bytes: await fixture.bytes()
+	});
+	if (opts.openKind === "layerBytes") return engine.open({
+		kind: "layerBytes",
+		id: `${fixture.id}-layer`,
+		baseBytes: await fixture.bytes()
+	});
+	return engine.open({
+		kind: "id",
+		id: fixture.cloudId ?? fixture.id
+	});
+}
+function concat(a, b) {
+	const out = new Uint8Array(a.byteLength + b.byteLength);
+	out.set(a, 0);
+	out.set(b, a.byteLength);
+	return out;
+}
+function bytesEqual(a, b) {
+	if (a.byteLength !== b.byteLength) return false;
+	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+async function sha256Hex(bytes) {
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", copy);
+	return toHex(new Uint8Array(digest));
+}
+//#endregion
 exports.TEXT_DIVERGENCE_CASES = TEXT_DIVERGENCE_CASES;
 exports.diffAnnotationListSnapshot = diffAnnotationListSnapshot;
 exports.diffAnnotationListSnapshotAll = diffAnnotationListSnapshotAll;
@@ -6701,6 +7766,7 @@ exports.runPageTextConformance = runPageTextConformance;
 exports.runPieceInfoConformance = runPieceInfoConformance;
 exports.runRedactionApplyConformance = runRedactionApplyConformance;
 exports.runSearchConformance = runSearchConformance;
+exports.runSignatureConformance = runSignatureConformance;
 exports.runTextDivergenceConformance = runTextDivergenceConformance;
 
 //# sourceMappingURL=conformance.cjs.map