@embedpdf/engine-core 3.0.0-next.12 → 3.0.0-next.13

package/dist/{DocumentSecurityService-CK0pejAK.d.cts → DocumentSecurityService-ClTZc0zO.d.cts}

@@ -1,4 +1,4 @@
-import { Ic as DocCapability, Lc as IdentityClaims, Uc as PdfBits, _c as CollabTarget } from "./AnnotationListSnapshot-x6tKulNV.cjs";
+import { Su as PdfBits, gu as IdentityClaims, hl as CollabTarget, hu as DocCapability } from "./AnnotationListSnapshot-D3mFut1e.cjs";
 //#region src/promise/AbortablePromise.d.ts
 type AbortableExecutor<T, P> = (resolve: (value: T | PromiseLike<T>) => void, reject: (reason: unknown) => void, progress: (p: P) => void, signal: AbortSignal) => void;
 /**
@@ -360,4 +360,4 @@ interface DocumentSecurityService {
 }
 //#endregion
 export { DocumentEncryptionState as a, DocumentSecurityState as c, PdfPermissionAdvisory as d, PdfPermissionInfo as f, AbortablePromise as g, AbortableExecutor as h, DocumentAccessReason as i, DocumentUnlockInput as l, passwordPromptFromState as m, CdnAdapter as n, DocumentOpenMode as o, PasswordPrompt as p, DocumentAccessInfo as r, DocumentSecurityService as s, CdnAccessInfo as t, DocumentUnlockResult as u };
-//# sourceMappingURL=DocumentSecurityService-CK0pejAK.d.cts.map
+//# sourceMappingURL=DocumentSecurityService-ClTZc0zO.d.cts.map

package/dist/{DocumentSecurityService-9MawYxP-.d.ts → DocumentSecurityService-_JRjqvoI.d.ts}

@@ -1,4 +1,4 @@
-import { Ic as DocCapability, Lc as IdentityClaims, Uc as PdfBits, _c as CollabTarget } from "./AnnotationListSnapshot-x6tKulNV.js";
+import { Su as PdfBits, gu as IdentityClaims, hl as CollabTarget, hu as DocCapability } from "./AnnotationListSnapshot-D3mFut1e.js";
 //#region src/promise/AbortablePromise.d.ts
 type AbortableExecutor<T, P> = (resolve: (value: T | PromiseLike<T>) => void, reject: (reason: unknown) => void, progress: (p: P) => void, signal: AbortSignal) => void;
 /**
@@ -360,4 +360,4 @@ interface DocumentSecurityService {
 }
 //#endregion
 export { DocumentEncryptionState as a, DocumentSecurityState as c, PdfPermissionAdvisory as d, PdfPermissionInfo as f, AbortablePromise as g, AbortableExecutor as h, DocumentAccessReason as i, DocumentUnlockInput as l, passwordPromptFromState as m, CdnAdapter as n, DocumentOpenMode as o, PasswordPrompt as p, DocumentAccessInfo as r, DocumentSecurityService as s, CdnAccessInfo as t, DocumentUnlockResult as u };
-//# sourceMappingURL=DocumentSecurityService-9MawYxP-.d.ts.map
+//# sourceMappingURL=DocumentSecurityService-_JRjqvoI.d.ts.map

package/dist/{Engine-Ds0ytbl6.d.ts → Engine-Bx0NOfmd.d.cts}

@@ -1,5 +1,5 @@
-import { $i as FormFieldRef, $n as PageNameResult, $r as FormImportResult, Bi as FormFieldDTO, Bl as DocumentMetadata, Bn as PageDeleteResult, Fn as RedactionApplyScope, Fr as SearchSlice, Gc as AnnotationRef, Go as PdfSaveMode, Ha as AttachmentDeleteResult, Hn as PageRotateResult, Ho as FontKey, Jo as AnnotationAppearanceImageOptions, Mn as MetadataUpdateResult, Ms as PageTextSnapshot, Pn as RedactionApplyResult, Pr as SearchRequest, Qn as PageFlattenUsage, Qr as FormFieldUpdateResult, Rl as PageObjectNumber, Rn as PageInsertBlankSpec, Ts as PageGeometrySnapshot, Uo as FontSpec, Va as AttachmentCreateResult, Vo as FontHandle, Xn as PageFlattenResult, Xr as FormFieldCreateResult, Yo as AnnotationAppearanceImagesResult, Yr as FormDataExport, Zr as FormFieldDeleteResult, Zs as PageListSnapshot, aa as AnnotationMoveResult, co as EmbeddedFileItem, cs as PageImageHandle, dc as OpenOptions, ea as FormWidgetRef, ei as FormRepairResult, er as PageNameInput, es as AnnotationAppearanceRenderOptions, fi as FormSubmissionRequest, hi as FormFieldValue, ia as AnnotationDeleteResult, ic as OpenInput, io as AttachmentContent, ji as FormSnapshot, l as AnnotationPatch, lo as EmbeddedFileRef, mi as FormDataFormat, ms as PageRaster, n as AnnotationListSnapshotAllPages, ni as FormWidgetLinkResult, ns as AnnotationAppearancesResult, o as AnnotationDraft, oa as AnnotationUpdateResult, oi as FormEffectsResult, qn as AnnotationFlattenResult, ra as AnnotationCreateResult, rc as MetadataPatch, ri as FormEffect, rr as PageMoveResult, so as AttachmentFileSource, t as AnnotationListPageSnapshot, ti as FormSetValueResult, tr as PageRemoveNameInput, ui as FormSubmissionReceipt, us as PageImageOptions, vi as FormFieldPatch, vs as PageRenderOptions, wi as FormFieldDraft, wl as DocumentActionsSnapshot, xl as PdfRotation, xs as PageRenderViewport, zn as PageInsertResult } from "./AnnotationListSnapshot-x6tKulNV.js";
-import { g as AbortablePromise, s as DocumentSecurityService } from "./DocumentSecurityService-9MawYxP-.js";
+import { $n as PageNameResult, $r as FormImportResult, Ac as PageTextSnapshot, Bl as SignaturePrepareInput, Bn as PageDeleteResult, Ca as FormSnapshot, Cc as PageGeometrySnapshot, Cl as BaseVersionInfo, Do as AttachmentCreateResult, Fl as SignatureCompleteInput, Fn as RedactionApplyScope, Fr as SearchSlice, Ga as AnnotationCreateResult, Gs as FontSpec, Hn as PageRotateResult, Hs as FontHandle, Il as SignatureCompleteResult, Ja as AnnotationUpdateResult, Jo as EmbeddedFileItem, Js as PdfSaveMode, Ka as AnnotationDeleteResult, Ma as FormFieldDTO, Mi as AnalyzeInput, Mn as MetadataUpdateResult, Nl as SignatureAbortResult, Oo as AttachmentDeleteResult, Pi as ChangeAnalysis, Pl as SignatureAppearanceInput, Pn as RedactionApplyResult, Pr as SearchRequest, Qi as FormEffectsResult, Qn as PageFlattenUsage, Qr as FormFieldUpdateResult, Rn as PageInsertBlankSpec, Vl as SignaturePrepared, Wl as SignatureSnapshot, Wo as AttachmentContent, Ws as FontKey, Xn as PageFlattenResult, Xr as FormFieldCreateResult, Xs as AnnotationAppearanceImageOptions, Yc as PageListSnapshot, Yi as FormEffect, Yo as EmbeddedFileRef, Yr as FormDataExport, Zr as FormFieldDeleteResult, Zs as AnnotationAppearanceImagesResult, _d as PageObjectNumber, cc as PageImageOptions, ed as PdfRotation, ei as FormRepairResult, er as PageNameInput, eu as FormFieldRef, fc as PageRaster, ga as FormFieldDraft, gc as PageRenderOptions, ia as FormSubmissionRequest, ic as AnnotationAppearancesResult, l as AnnotationPatch, ll as OpenOptions, n as AnnotationListSnapshotAllPages, na as FormSubmissionReceipt, nc as AnnotationAppearanceRenderOptions, ni as FormWidgetLinkResult, nl as OpenInput, o as AnnotationDraft, oa as FormDataFormat, oc as PageImageHandle, qa as AnnotationMoveResult, qn as AnnotationFlattenResult, qo as AttachmentFileSource, rd as DocumentActionsSnapshot, rr as PageMoveResult, sa as FormFieldValue, t as AnnotationListPageSnapshot, ti as FormSetValueResult, tl as MetadataPatch, tr as PageRemoveNameInput, tu as FormWidgetRef, ua as FormFieldPatch, wl as DigestAlgorithm, wu as AnnotationRef, yc as PageRenderViewport, yd as DocumentMetadata, zn as PageInsertResult } from "./AnnotationListSnapshot-D3mFut1e.cjs";
+import { g as AbortablePromise, s as DocumentSecurityService } from "./DocumentSecurityService-ClTZc0zO.cjs";
 //#region src/engine/DocumentActionsService.d.ts
 /** Lazy, catalog-owned PDF action read. This API extracts; it never executes. */
 interface DocumentActionsService {
@@ -83,6 +83,31 @@ interface DocumentAttachmentsService {
   delete?(ref: EmbeddedFileRef): AbortablePromise<AttachmentDeleteResult>;
 }
 //#endregion
+//#region src/engine/DocumentFontSettings.d.ts
+/**
+ * How much of a registered font's program the appearances authored in this
+ * document carry. `default` subsets annotation text (FreeText, redaction
+ * labels) and embeds form-field text whole; `subset` and `full` apply to
+ * both. A font whose licence forbids subsetting is embedded whole under
+ * every policy; programs already in the document are never re-embedded.
+ */
+type FontEmbeddingPolicy = 'default' | 'subset' | 'full';
+/**
+ * Per-document font and text-layout settings: session state of this
+ * document handle, never written to the file, applied to appearances
+ * generated after the call. Local engine only (`doc.fonts` is undefined on
+ * engines that do not lay text out in-process).
+ */
+interface DocumentFontSettings {
+  setEmbeddingPolicy(policy: FontEmbeddingPolicy): AbortablePromise<void>;
+  /**
+   * Latin typographic features (kerning, ligatures) when shaping rich text.
+   * Off by default: Acrobat's appearances show plain advance widths and no
+   * ligatures, and parity with what Acrobat draws wins.
+   */
+  setTypographicFeatures(enabled: boolean): AbortablePromise<void>;
+}
+//#endregion
 //#region src/engine/DocumentFormsService.d.ts
 /** Options for {@link DocumentFormsService.repair}. */
 interface FormRepairOptions {
@@ -181,6 +206,14 @@ interface DocumentFormsService {
    * `form.fieldUpdated`.
    */
   updateField(ref: FormFieldRef, patch: FormFieldPatch): AbortablePromise<FormFieldUpdateResult>;
+  /**
+   * Draw a PDF page into every widget of an UNSIGNED signature field — the
+   * visual "sign" of a viewer that has no signer. The field's value stays
+   * empty and nothing is sealed; a signed field is refused. Gated by
+   * `doc.forms.fill`. Emits `form.fieldUpdated`. Absent on engines that
+   * cannot draw appearances.
+   */
+  setSignatureAppearance?(ref: FormFieldRef, appearance: SignatureAppearanceInput): AbortablePromise<FormFieldUpdateResult>;
   /**
    * Delete a terminal field and cascade: every widget is removed from its
    * page, the field leaves the tree, and empty ancestors are pruned.
@@ -339,9 +372,12 @@ interface DocumentPagesService {
  * rewrites THIS LAYER's bytes only. The immutable base document still
  * contains the original content — byte-perfect original recovery is a
  * feature of the storage model, not a leak. Redacted content becomes truly
- * unrecoverable only in what leaves the system: a layer download/export, or
- * a local document saved after apply. Surfaces that promise "permanent
- * removal" must scope that promise to the exported artifact.
+ * unrecoverable only in a full-rewrite export after apply. Callers MUST select
+ * `download({ mode: 'rewrite' })` (or the corresponding file/cloud save mode)
+ * before sharing the redacted PDF. The default incremental download preserves
+ * the original content in prior revisions; apply does not change that default.
+ * Surfaces that promise "permanent removal" must scope that promise to the
+ * full-rewrite exported artifact.
  *
  * Applying is irreversible within the layer (no undo). Emits a
  * `redaction.applied` document event; content-scope raster invalidation and
@@ -488,6 +524,64 @@ interface DocumentSearchService {
   query(request: SearchRequest): AbortablePromise<SearchSlice>;
 }
 //#endregion
+//#region src/engine/DocumentSignaturesService.d.ts
+/**
+ * Digital signatures on the document: the read side (what is signed, what
+ * it seals, what it forbids) and the two-phase signing protocol. The
+ * engine does the PDF job — candidate file, digest, sealing — and never
+ * holds a key; the CMS comes from the caller (`@embedpdf/core-signature`
+ * builds one from a raw signer, or a signing service returns it).
+ *
+ * Every read here describes the bytes the document was loaded from
+ * (for a layer document: base + the delta it was opened with). Unsaved
+ * edits are not part of any revision until `prepare` snapshots them.
+ *
+ * Reads ride `doc.forms.read`; `revisionBytes` rides `doc.download`;
+ * `prepare`/`complete`/`abort` ride `doc.sign`, a certification
+ * additionally `doc.sign.certify`.
+ */
+interface DocumentSignaturesService {
+  /** Revisions, every signature field with its signed state, and the protection in force. */
+  list(): AbortablePromise<SignatureSnapshot>;
+  /** The DER `/Contents` of a signed field (exactly `contentsSize` bytes, padding stripped). `NotFound` for an unsigned field. */
+  contents(field: FormFieldRef): AbortablePromise<Uint8Array>;
+  /**
+   * Hash the signed field's `/ByteRange` with `algorithm`, straight from
+   * the loaded bytes. What a CMS verifier compares its message digest to.
+   */
+  digest(field: FormFieldRef, algorithm: DigestAlgorithm): AbortablePromise<Uint8Array>;
+  /** The exact bytes of revision `revisionIndex` (`[0, end)`): what a signature over it signed. */
+  revisionBytes(revisionIndex: number): AbortablePromise<Uint8Array>;
+  /**
+   * What changed after a signature (or after any revision), judged
+   * revision by revision against the restrictions in force: every object
+   * whose cross-reference mapping moved, with its value and every
+   * reference to it in both revisions, and the rule that explains each —
+   * or the reference no rule explains. `until: 'working-copy'` snapshots
+   * unsaved edits as one more revision first. A truncated value is never
+   * permitted; a broken chain is `indeterminate`.
+   */
+  analyze(input: AnalyzeInput): AbortablePromise<ChangeAnalysis>;
+  /**
+   * Build the candidate (unsaved edits become their own revision, the
+   * signature lands in a fresh update over it), seal it, and return the
+   * digest to sign. The live document is untouched and read-only until
+   * `complete` or `abort` (`SigningPending`). Refusals are
+   * `SignatureRefused` with the reason in the message.
+   */
+  prepare(input: SignaturePrepareInput): AbortablePromise<SignaturePrepared>;
+  /**
+   * Write the CMS into the candidate and install the sealed bytes as the
+   * document's new version. `expectedVersion` must be what `prepare`
+   * returned (`SigningVersionMismatch` otherwise). Idempotent: a replay
+   * with the same CMS answers `already-completed`. Emits
+   * `signature.completed` and `document.versioned`.
+   */
+  complete(input: SignatureCompleteInput): AbortablePromise<SignatureCompleteResult>;
+  /** Discard a pending candidate. */
+  abort(signingId: string): AbortablePromise<SignatureAbortResult>;
+}
+//#endregion
 //#region src/engine/MetadataService.d.ts
 interface MetadataService {
   read(): AbortablePromise<DocumentMetadata>;
@@ -866,6 +960,30 @@ type DocumentEvent = ({
   type: 'redaction.applied';
   origin: EventOrigin;
 } & RedactionApplyResult) | {
+  /** A signing candidate was parked: the document is read-only until it completes or aborts. */
+  type: 'signature.prepared';
+  signingId: string;
+  field: FormFieldRef;
+  origin: EventOrigin;
+} | ({
+  /** The sealed bytes are installed; `version` is what they became. */
+  type: 'signature.completed';
+  signingId: string;
+  origin: EventOrigin;
+} & SignatureCompleteResult) | {
+  type: 'signature.aborted';
+  signingId: string;
+  origin: EventOrigin;
+} | {
+  /**
+   * The session moved to a new saved version (a completed signature,
+   * here or in another session). Byte-level facts — revisions,
+   * coverage, digests, verdicts — must be re-read.
+   */
+  type: 'document.versioned';
+  version: BaseVersionInfo;
+  origin: EventOrigin;
+} | {
   /**
    * Cloud only: the live event stream fell too far behind to replay
    * (the server's SSE `full-refresh`) — state derived from earlier
@@ -936,6 +1054,13 @@ interface DocumentHandle {
   readonly attachments?: DocumentAttachmentsService;
   /** The document's interactive form (AcroForm): fields, values, interchange. */
   readonly forms: DocumentFormsService;
+  /**
+   * Font embedding and text layout settings of this document (session
+   * state). Optional: the local engine implements it; engines that do not
+   * lay text out in-process omit it — feature-detect with
+   * `doc.fonts !== undefined`.
+   */
+  readonly fonts?: DocumentFontSettings;
   /**
    * CATALOG-level `/PieceInfo` private application data (ISO 32000 §14.5)
    * — e.g. a stamp library's display name. Optional: the local engine
@@ -969,6 +1094,13 @@ interface DocumentHandle {
    * ship it — feature-detect with `doc.redaction !== undefined`.
    */
   readonly redaction?: DocumentRedactionService;
+  /**
+   * Digital signatures: the read side (revisions, signed fields, the
+   * protection they impose) and the two-phase signing protocol. Optional
+   * while engines ship it — feature-detect with
+   * `doc.signatures !== undefined`.
+   */
+  readonly signatures?: DocumentSignaturesService;
   /**
    * The document's event stream — every confirmed mutation, exactly once,
    * identical shape on local and cloud engines (see `DocumentEvent`). The
@@ -984,13 +1116,29 @@ interface DocumentHandle {
   download(opts?: {
     mode?: PdfSaveMode;
   }): AbortablePromise<Uint8Array>;
+  /**
+   * Local Node engines only: write the document to a local file without
+   * moving its bytes through JS. An untouched session (no unsaved edits,
+   * incremental mode) is streamed out verbatim — for a signed document,
+   * exactly as sealed. Absent on engines that cannot reach a filesystem.
+   */
+  downloadToFile?(path: string, opts?: {
+    mode?: PdfSaveMode;
+  }): AbortablePromise<void>;
+  /**
+   * The saved version this session is on: SHA-256 and length of the
+   * loaded bytes (for a layer session, of its base). Changes only when
+   * a signature completes. Optional while engines ship it.
+   */
+  version?(): AbortablePromise<BaseVersionInfo>;
   /**
    * Export JUST this document's LAYER as a self-contained artifact (the small
    * overlay diff over the immutable base) — re-openable later via
-   * `OpenInputLayerBytes` with `{ kind: 'artifact', bytes }`. Optional: only the
-   * local engine, opened WITH a layer (`layerBytes`), supports it; the cloud
-   * engine manages layers server-side and omits it. Rejects if the document was
-   * opened without a layer.
+   * `OpenInputLayerBytes` with `{ kind: 'artifact', bytes }`. Optional: the
+   * local engine supports it for every session it opens as a layer (the
+   * default `sessionKind`, and any `layerBytes` open); the cloud engine
+   * manages layers server-side and omits it. Rejects on a session opened
+   * with `sessionKind: 'plain'`.
    */
   downloadLayer?(): AbortablePromise<Uint8Array>;
   close(): AbortablePromise<void>;
@@ -1038,6 +1186,13 @@ interface FontService {
   clearFallbacks(): AbortablePromise<void>;
   /** Unregister every font and reset the fallback chain. */
   clear(): AbortablePromise<void>;
+  /**
+   * Assert that the application holds a licence permitting editing with a
+   * preview-and-print font, so FreeText authoring and missing-glyph fallback
+   * may use it. Resolves to the updated handle (`editingAuthorized: true`).
+   * Rejects with `InvalidArg` for an unregistered key.
+   */
+  authorizeEditing(font: FontHandle | FontKey): AbortablePromise<FontHandle>;
   /** Currently registered fonts, in registration order. */
   list(): readonly FontHandle[];
 }
@@ -1105,5 +1260,5 @@ interface Engine {
  */
 type EngineFactory = () => Engine;
 //#endregion
-export { DocumentPagesService as A, CONTINUOUS_RENDER_POLICY as C, snapFullPageViewport as D, snapAppearanceScale as E, WeakAnnotationEditSession as F, DocumentActionsService as I, FormRepairOptions as M, DocumentAttachmentsService as N, snapTileScale as O, DocumentAnnotationsService as P, DocumentSearchService as S, EngineRenderPolicy as T, PageTextService as _, DocumentHandle as a, PageAnnotationsService as b, DocumentEventInit as c, PageHandle as d, PieceInfoService as f, PieceInfoSnapshot as g, PieceInfoPatchValue as h, DocumentCapabilities as i, DocumentFormsService as j, DocumentRedactionService as k, DocumentEventType as l, PieceInfoPatch as m, EngineFactory as n, DocumentEventStream as o, PieceInfoEntry as p, FontService as r, DocumentEvent as s, Engine as t, EventOrigin as u, PageRenderService as v, DocumentRenderService as w, MetadataService as x, PageGeometryService as y };
-//# sourceMappingURL=Engine-Ds0ytbl6.d.ts.map
+export { DocumentRedactionService as A, DocumentSearchService as C, snapAppearanceScale as D, EngineRenderPolicy as E, FontEmbeddingPolicy as F, DocumentAttachmentsService as I, DocumentAnnotationsService as L, DocumentFormsService as M, FormRepairOptions as N, snapFullPageViewport as O, DocumentFontSettings as P, WeakAnnotationEditSession as R, DocumentSignaturesService as S, DocumentRenderService as T, PageTextService as _, DocumentHandle as a, PageAnnotationsService as b, DocumentEventInit as c, PageHandle as d, PieceInfoService as f, PieceInfoSnapshot as g, PieceInfoPatchValue as h, DocumentCapabilities as i, DocumentPagesService as j, snapTileScale as k, DocumentEventType as l, PieceInfoPatch as m, EngineFactory as n, DocumentEventStream as o, PieceInfoEntry as p, FontService as r, DocumentEvent as s, Engine as t, EventOrigin as u, PageRenderService as v, CONTINUOUS_RENDER_POLICY as w, MetadataService as x, PageGeometryService as y, DocumentActionsService as z };
+//# sourceMappingURL=Engine-Bx0NOfmd.d.cts.map

package/dist/{Engine--0XF0UAK.d.cts → Engine-DxtpCYcP.d.ts}

@@ -1,5 +1,5 @@
-import { $i as FormFieldRef, $n as PageNameResult, $r as FormImportResult, Bi as FormFieldDTO, Bl as DocumentMetadata, Bn as PageDeleteResult, Fn as RedactionApplyScope, Fr as SearchSlice, Gc as AnnotationRef, Go as PdfSaveMode, Ha as AttachmentDeleteResult, Hn as PageRotateResult, Ho as FontKey, Jo as AnnotationAppearanceImageOptions, Mn as MetadataUpdateResult, Ms as PageTextSnapshot, Pn as RedactionApplyResult, Pr as SearchRequest, Qn as PageFlattenUsage, Qr as FormFieldUpdateResult, Rl as PageObjectNumber, Rn as PageInsertBlankSpec, Ts as PageGeometrySnapshot, Uo as FontSpec, Va as AttachmentCreateResult, Vo as FontHandle, Xn as PageFlattenResult, Xr as FormFieldCreateResult, Yo as AnnotationAppearanceImagesResult, Yr as FormDataExport, Zr as FormFieldDeleteResult, Zs as PageListSnapshot, aa as AnnotationMoveResult, co as EmbeddedFileItem, cs as PageImageHandle, dc as OpenOptions, ea as FormWidgetRef, ei as FormRepairResult, er as PageNameInput, es as AnnotationAppearanceRenderOptions, fi as FormSubmissionRequest, hi as FormFieldValue, ia as AnnotationDeleteResult, ic as OpenInput, io as AttachmentContent, ji as FormSnapshot, l as AnnotationPatch, lo as EmbeddedFileRef, mi as FormDataFormat, ms as PageRaster, n as AnnotationListSnapshotAllPages, ni as FormWidgetLinkResult, ns as AnnotationAppearancesResult, o as AnnotationDraft, oa as AnnotationUpdateResult, oi as FormEffectsResult, qn as AnnotationFlattenResult, ra as AnnotationCreateResult, rc as MetadataPatch, ri as FormEffect, rr as PageMoveResult, so as AttachmentFileSource, t as AnnotationListPageSnapshot, ti as FormSetValueResult, tr as PageRemoveNameInput, ui as FormSubmissionReceipt, us as PageImageOptions, vi as FormFieldPatch, vs as PageRenderOptions, wi as FormFieldDraft, wl as DocumentActionsSnapshot, xl as PdfRotation, xs as PageRenderViewport, zn as PageInsertResult } from "./AnnotationListSnapshot-x6tKulNV.cjs";
-import { g as AbortablePromise, s as DocumentSecurityService } from "./DocumentSecurityService-CK0pejAK.cjs";
+import { $n as PageNameResult, $r as FormImportResult, Ac as PageTextSnapshot, Bl as SignaturePrepareInput, Bn as PageDeleteResult, Ca as FormSnapshot, Cc as PageGeometrySnapshot, Cl as BaseVersionInfo, Do as AttachmentCreateResult, Fl as SignatureCompleteInput, Fn as RedactionApplyScope, Fr as SearchSlice, Ga as AnnotationCreateResult, Gs as FontSpec, Hn as PageRotateResult, Hs as FontHandle, Il as SignatureCompleteResult, Ja as AnnotationUpdateResult, Jo as EmbeddedFileItem, Js as PdfSaveMode, Ka as AnnotationDeleteResult, Ma as FormFieldDTO, Mi as AnalyzeInput, Mn as MetadataUpdateResult, Nl as SignatureAbortResult, Oo as AttachmentDeleteResult, Pi as ChangeAnalysis, Pl as SignatureAppearanceInput, Pn as RedactionApplyResult, Pr as SearchRequest, Qi as FormEffectsResult, Qn as PageFlattenUsage, Qr as FormFieldUpdateResult, Rn as PageInsertBlankSpec, Vl as SignaturePrepared, Wl as SignatureSnapshot, Wo as AttachmentContent, Ws as FontKey, Xn as PageFlattenResult, Xr as FormFieldCreateResult, Xs as AnnotationAppearanceImageOptions, Yc as PageListSnapshot, Yi as FormEffect, Yo as EmbeddedFileRef, Yr as FormDataExport, Zr as FormFieldDeleteResult, Zs as AnnotationAppearanceImagesResult, _d as PageObjectNumber, cc as PageImageOptions, ed as PdfRotation, ei as FormRepairResult, er as PageNameInput, eu as FormFieldRef, fc as PageRaster, ga as FormFieldDraft, gc as PageRenderOptions, ia as FormSubmissionRequest, ic as AnnotationAppearancesResult, l as AnnotationPatch, ll as OpenOptions, n as AnnotationListSnapshotAllPages, na as FormSubmissionReceipt, nc as AnnotationAppearanceRenderOptions, ni as FormWidgetLinkResult, nl as OpenInput, o as AnnotationDraft, oa as FormDataFormat, oc as PageImageHandle, qa as AnnotationMoveResult, qn as AnnotationFlattenResult, qo as AttachmentFileSource, rd as DocumentActionsSnapshot, rr as PageMoveResult, sa as FormFieldValue, t as AnnotationListPageSnapshot, ti as FormSetValueResult, tl as MetadataPatch, tr as PageRemoveNameInput, tu as FormWidgetRef, ua as FormFieldPatch, wl as DigestAlgorithm, wu as AnnotationRef, yc as PageRenderViewport, yd as DocumentMetadata, zn as PageInsertResult } from "./AnnotationListSnapshot-D3mFut1e.js";
+import { g as AbortablePromise, s as DocumentSecurityService } from "./DocumentSecurityService-_JRjqvoI.js";
 //#region src/engine/DocumentActionsService.d.ts
 /** Lazy, catalog-owned PDF action read. This API extracts; it never executes. */
 interface DocumentActionsService {
@@ -83,6 +83,31 @@ interface DocumentAttachmentsService {
   delete?(ref: EmbeddedFileRef): AbortablePromise<AttachmentDeleteResult>;
 }
 //#endregion
+//#region src/engine/DocumentFontSettings.d.ts
+/**
+ * How much of a registered font's program the appearances authored in this
+ * document carry. `default` subsets annotation text (FreeText, redaction
+ * labels) and embeds form-field text whole; `subset` and `full` apply to
+ * both. A font whose licence forbids subsetting is embedded whole under
+ * every policy; programs already in the document are never re-embedded.
+ */
+type FontEmbeddingPolicy = 'default' | 'subset' | 'full';
+/**
+ * Per-document font and text-layout settings: session state of this
+ * document handle, never written to the file, applied to appearances
+ * generated after the call. Local engine only (`doc.fonts` is undefined on
+ * engines that do not lay text out in-process).
+ */
+interface DocumentFontSettings {
+  setEmbeddingPolicy(policy: FontEmbeddingPolicy): AbortablePromise<void>;
+  /**
+   * Latin typographic features (kerning, ligatures) when shaping rich text.
+   * Off by default: Acrobat's appearances show plain advance widths and no
+   * ligatures, and parity with what Acrobat draws wins.
+   */
+  setTypographicFeatures(enabled: boolean): AbortablePromise<void>;
+}
+//#endregion
 //#region src/engine/DocumentFormsService.d.ts
 /** Options for {@link DocumentFormsService.repair}. */
 interface FormRepairOptions {
@@ -181,6 +206,14 @@ interface DocumentFormsService {
    * `form.fieldUpdated`.
    */
   updateField(ref: FormFieldRef, patch: FormFieldPatch): AbortablePromise<FormFieldUpdateResult>;
+  /**
+   * Draw a PDF page into every widget of an UNSIGNED signature field — the
+   * visual "sign" of a viewer that has no signer. The field's value stays
+   * empty and nothing is sealed; a signed field is refused. Gated by
+   * `doc.forms.fill`. Emits `form.fieldUpdated`. Absent on engines that
+   * cannot draw appearances.
+   */
+  setSignatureAppearance?(ref: FormFieldRef, appearance: SignatureAppearanceInput): AbortablePromise<FormFieldUpdateResult>;
   /**
    * Delete a terminal field and cascade: every widget is removed from its
    * page, the field leaves the tree, and empty ancestors are pruned.
@@ -339,9 +372,12 @@ interface DocumentPagesService {
  * rewrites THIS LAYER's bytes only. The immutable base document still
  * contains the original content — byte-perfect original recovery is a
  * feature of the storage model, not a leak. Redacted content becomes truly
- * unrecoverable only in what leaves the system: a layer download/export, or
- * a local document saved after apply. Surfaces that promise "permanent
- * removal" must scope that promise to the exported artifact.
+ * unrecoverable only in a full-rewrite export after apply. Callers MUST select
+ * `download({ mode: 'rewrite' })` (or the corresponding file/cloud save mode)
+ * before sharing the redacted PDF. The default incremental download preserves
+ * the original content in prior revisions; apply does not change that default.
+ * Surfaces that promise "permanent removal" must scope that promise to the
+ * full-rewrite exported artifact.
  *
  * Applying is irreversible within the layer (no undo). Emits a
  * `redaction.applied` document event; content-scope raster invalidation and
@@ -488,6 +524,64 @@ interface DocumentSearchService {
   query(request: SearchRequest): AbortablePromise<SearchSlice>;
 }
 //#endregion
+//#region src/engine/DocumentSignaturesService.d.ts
+/**
+ * Digital signatures on the document: the read side (what is signed, what
+ * it seals, what it forbids) and the two-phase signing protocol. The
+ * engine does the PDF job — candidate file, digest, sealing — and never
+ * holds a key; the CMS comes from the caller (`@embedpdf/core-signature`
+ * builds one from a raw signer, or a signing service returns it).
+ *
+ * Every read here describes the bytes the document was loaded from
+ * (for a layer document: base + the delta it was opened with). Unsaved
+ * edits are not part of any revision until `prepare` snapshots them.
+ *
+ * Reads ride `doc.forms.read`; `revisionBytes` rides `doc.download`;
+ * `prepare`/`complete`/`abort` ride `doc.sign`, a certification
+ * additionally `doc.sign.certify`.
+ */
+interface DocumentSignaturesService {
+  /** Revisions, every signature field with its signed state, and the protection in force. */
+  list(): AbortablePromise<SignatureSnapshot>;
+  /** The DER `/Contents` of a signed field (exactly `contentsSize` bytes, padding stripped). `NotFound` for an unsigned field. */
+  contents(field: FormFieldRef): AbortablePromise<Uint8Array>;
+  /**
+   * Hash the signed field's `/ByteRange` with `algorithm`, straight from
+   * the loaded bytes. What a CMS verifier compares its message digest to.
+   */
+  digest(field: FormFieldRef, algorithm: DigestAlgorithm): AbortablePromise<Uint8Array>;
+  /** The exact bytes of revision `revisionIndex` (`[0, end)`): what a signature over it signed. */
+  revisionBytes(revisionIndex: number): AbortablePromise<Uint8Array>;
+  /**
+   * What changed after a signature (or after any revision), judged
+   * revision by revision against the restrictions in force: every object
+   * whose cross-reference mapping moved, with its value and every
+   * reference to it in both revisions, and the rule that explains each —
+   * or the reference no rule explains. `until: 'working-copy'` snapshots
+   * unsaved edits as one more revision first. A truncated value is never
+   * permitted; a broken chain is `indeterminate`.
+   */
+  analyze(input: AnalyzeInput): AbortablePromise<ChangeAnalysis>;
+  /**
+   * Build the candidate (unsaved edits become their own revision, the
+   * signature lands in a fresh update over it), seal it, and return the
+   * digest to sign. The live document is untouched and read-only until
+   * `complete` or `abort` (`SigningPending`). Refusals are
+   * `SignatureRefused` with the reason in the message.
+   */
+  prepare(input: SignaturePrepareInput): AbortablePromise<SignaturePrepared>;
+  /**
+   * Write the CMS into the candidate and install the sealed bytes as the
+   * document's new version. `expectedVersion` must be what `prepare`
+   * returned (`SigningVersionMismatch` otherwise). Idempotent: a replay
+   * with the same CMS answers `already-completed`. Emits
+   * `signature.completed` and `document.versioned`.
+   */
+  complete(input: SignatureCompleteInput): AbortablePromise<SignatureCompleteResult>;
+  /** Discard a pending candidate. */
+  abort(signingId: string): AbortablePromise<SignatureAbortResult>;
+}
+//#endregion
 //#region src/engine/MetadataService.d.ts
 interface MetadataService {
   read(): AbortablePromise<DocumentMetadata>;
@@ -866,6 +960,30 @@ type DocumentEvent = ({
   type: 'redaction.applied';
   origin: EventOrigin;
 } & RedactionApplyResult) | {
+  /** A signing candidate was parked: the document is read-only until it completes or aborts. */
+  type: 'signature.prepared';
+  signingId: string;
+  field: FormFieldRef;
+  origin: EventOrigin;
+} | ({
+  /** The sealed bytes are installed; `version` is what they became. */
+  type: 'signature.completed';
+  signingId: string;
+  origin: EventOrigin;
+} & SignatureCompleteResult) | {
+  type: 'signature.aborted';
+  signingId: string;
+  origin: EventOrigin;
+} | {
+  /**
+   * The session moved to a new saved version (a completed signature,
+   * here or in another session). Byte-level facts — revisions,
+   * coverage, digests, verdicts — must be re-read.
+   */
+  type: 'document.versioned';
+  version: BaseVersionInfo;
+  origin: EventOrigin;
+} | {
   /**
    * Cloud only: the live event stream fell too far behind to replay
    * (the server's SSE `full-refresh`) — state derived from earlier
@@ -936,6 +1054,13 @@ interface DocumentHandle {
   readonly attachments?: DocumentAttachmentsService;
   /** The document's interactive form (AcroForm): fields, values, interchange. */
   readonly forms: DocumentFormsService;
+  /**
+   * Font embedding and text layout settings of this document (session
+   * state). Optional: the local engine implements it; engines that do not
+   * lay text out in-process omit it — feature-detect with
+   * `doc.fonts !== undefined`.
+   */
+  readonly fonts?: DocumentFontSettings;
   /**
    * CATALOG-level `/PieceInfo` private application data (ISO 32000 §14.5)
    * — e.g. a stamp library's display name. Optional: the local engine
@@ -969,6 +1094,13 @@ interface DocumentHandle {
    * ship it — feature-detect with `doc.redaction !== undefined`.
    */
   readonly redaction?: DocumentRedactionService;
+  /**
+   * Digital signatures: the read side (revisions, signed fields, the
+   * protection they impose) and the two-phase signing protocol. Optional
+   * while engines ship it — feature-detect with
+   * `doc.signatures !== undefined`.
+   */
+  readonly signatures?: DocumentSignaturesService;
   /**
    * The document's event stream — every confirmed mutation, exactly once,
    * identical shape on local and cloud engines (see `DocumentEvent`). The
@@ -984,13 +1116,29 @@ interface DocumentHandle {
   download(opts?: {
     mode?: PdfSaveMode;
   }): AbortablePromise<Uint8Array>;
+  /**
+   * Local Node engines only: write the document to a local file without
+   * moving its bytes through JS. An untouched session (no unsaved edits,
+   * incremental mode) is streamed out verbatim — for a signed document,
+   * exactly as sealed. Absent on engines that cannot reach a filesystem.
+   */
+  downloadToFile?(path: string, opts?: {
+    mode?: PdfSaveMode;
+  }): AbortablePromise<void>;
+  /**
+   * The saved version this session is on: SHA-256 and length of the
+   * loaded bytes (for a layer session, of its base). Changes only when
+   * a signature completes. Optional while engines ship it.
+   */
+  version?(): AbortablePromise<BaseVersionInfo>;
   /**
    * Export JUST this document's LAYER as a self-contained artifact (the small
    * overlay diff over the immutable base) — re-openable later via
-   * `OpenInputLayerBytes` with `{ kind: 'artifact', bytes }`. Optional: only the
-   * local engine, opened WITH a layer (`layerBytes`), supports it; the cloud
-   * engine manages layers server-side and omits it. Rejects if the document was
-   * opened without a layer.
+   * `OpenInputLayerBytes` with `{ kind: 'artifact', bytes }`. Optional: the
+   * local engine supports it for every session it opens as a layer (the
+   * default `sessionKind`, and any `layerBytes` open); the cloud engine
+   * manages layers server-side and omits it. Rejects on a session opened
+   * with `sessionKind: 'plain'`.
    */
   downloadLayer?(): AbortablePromise<Uint8Array>;
   close(): AbortablePromise<void>;
@@ -1038,6 +1186,13 @@ interface FontService {
   clearFallbacks(): AbortablePromise<void>;
   /** Unregister every font and reset the fallback chain. */
   clear(): AbortablePromise<void>;
+  /**
+   * Assert that the application holds a licence permitting editing with a
+   * preview-and-print font, so FreeText authoring and missing-glyph fallback
+   * may use it. Resolves to the updated handle (`editingAuthorized: true`).
+   * Rejects with `InvalidArg` for an unregistered key.
+   */
+  authorizeEditing(font: FontHandle | FontKey): AbortablePromise<FontHandle>;
   /** Currently registered fonts, in registration order. */
   list(): readonly FontHandle[];
 }
@@ -1105,5 +1260,5 @@ interface Engine {
  */
 type EngineFactory = () => Engine;
 //#endregion
-export { DocumentPagesService as A, CONTINUOUS_RENDER_POLICY as C, snapFullPageViewport as D, snapAppearanceScale as E, WeakAnnotationEditSession as F, DocumentActionsService as I, FormRepairOptions as M, DocumentAttachmentsService as N, snapTileScale as O, DocumentAnnotationsService as P, DocumentSearchService as S, EngineRenderPolicy as T, PageTextService as _, DocumentHandle as a, PageAnnotationsService as b, DocumentEventInit as c, PageHandle as d, PieceInfoService as f, PieceInfoSnapshot as g, PieceInfoPatchValue as h, DocumentCapabilities as i, DocumentFormsService as j, DocumentRedactionService as k, DocumentEventType as l, PieceInfoPatch as m, EngineFactory as n, DocumentEventStream as o, PieceInfoEntry as p, FontService as r, DocumentEvent as s, Engine as t, EventOrigin as u, PageRenderService as v, DocumentRenderService as w, MetadataService as x, PageGeometryService as y };
-//# sourceMappingURL=Engine--0XF0UAK.d.cts.map
+export { DocumentRedactionService as A, DocumentSearchService as C, snapAppearanceScale as D, EngineRenderPolicy as E, FontEmbeddingPolicy as F, DocumentAttachmentsService as I, DocumentAnnotationsService as L, DocumentFormsService as M, FormRepairOptions as N, snapFullPageViewport as O, DocumentFontSettings as P, WeakAnnotationEditSession as R, DocumentSignaturesService as S, DocumentRenderService as T, PageTextService as _, DocumentHandle as a, PageAnnotationsService as b, DocumentEventInit as c, PageHandle as d, PieceInfoService as f, PieceInfoSnapshot as g, PieceInfoPatchValue as h, DocumentCapabilities as i, DocumentPagesService as j, snapTileScale as k, DocumentEventType as l, PieceInfoPatch as m, EngineFactory as n, DocumentEventStream as o, PieceInfoEntry as p, FontService as r, DocumentEvent as s, Engine as t, EventOrigin as u, PageRenderService as v, CONTINUOUS_RENDER_POLICY as w, MetadataService as x, PageGeometryService as y, DocumentActionsService as z };
+//# sourceMappingURL=Engine-DxtpCYcP.d.ts.map

package/dist/{PageInsertBlankInput-CzShuSJI.cjs → PageInsertBlankInput-CqXBmFhN.cjs}

@@ -70,7 +70,42 @@ const EngineErrorCode = {
 	* at all) and `NotFound` (a well-formed page/annotation/etc. simply
 	* doesn't exist).
 	*/
-	MalformedPdf: "MalformedPdf"
+	MalformedPdf: "MalformedPdf",
+	/**
+	* A signing candidate is parked on this session: every mutation is
+	* refused until `signatures.complete` or `signatures.abort`.
+	*/
+	SigningPending: "SigningPending",
+	/** The candidate's TTL elapsed; prepare again. */
+	SigningExpired: "SigningExpired",
+	/**
+	* `complete` presented a version the candidate was not built on (the
+	* document or the layer moved since `prepare`). The CMS cannot be
+	* reused: it signs a digest of bytes that will never be the head.
+	* Prepare again on the current version.
+	*/
+	SigningVersionMismatch: "SigningVersionMismatch",
+	/**
+	* The engine refused to author the signature: the field is signed,
+	* read-only, or locked by an earlier signature; a certification is
+	* requested after a signature exists; the seed value requires what the
+	* engine does not implement; the request is inconsistent. The message
+	* names the reason.
+	*/
+	SignatureRefused: "SignatureRefused",
+	/**
+	* A signature already in the document forbids this change (a
+	* certification's permission, a FieldMDP or `/Lock`, or the approval
+	* baseline). The message names the signature and the restriction. The
+	* engine option `signedDocumentPolicy: 'permit'` disables the guard.
+	*/
+	ProtectedDocument: "ProtectedDocument",
+	/**
+	* The layer is built on a base version that is no longer the
+	* document's head (another signing completed); it can be read and
+	* edited but not signed from.
+	*/
+	StaleBase: "StaleBase"
 };
 //#endregion
 //#region src/annotation/subtype.ts
@@ -411,4 +446,4 @@ Object.defineProperty(exports, "subtypeFromCode", {
 	}
 });
 
-//# sourceMappingURL=PageInsertBlankInput-CzShuSJI.cjs.map
+//# sourceMappingURL=PageInsertBlankInput-CqXBmFhN.cjs.map