@embedpdf/engine-core 3.0.0-next.12 → 3.0.0-next.14

package/dist/{AnnotationListSnapshot-x6tKulNV.d.cts → AnnotationListSnapshot-D9R5n2Kf.d.cts}

@@ -684,7 +684,7 @@ interface AnnotationDraftBase {
  * expands these capabilities. PDF bits are NEVER consulted unless
  * `pdf.permissions` is in scope.
  */
-type DocCapability = 'doc.open' | 'doc.render' | 'doc.text.select' | 'doc.text.copy' | 'doc.text.search' | 'doc.content.copy' | 'doc.download' | 'doc.download.flattened' | 'doc.print' | 'doc.print.high' | 'doc.pages.modify' | 'doc.pages.assemble' | 'doc.forms.read' | 'doc.forms.fill' | 'doc.forms.modify' | 'doc.forms.submit' | 'doc.annotate.read' | 'doc.annotate.modify' | 'doc.metadata.modify' | 'doc.attachments.modify' | 'doc.redact';
+type DocCapability = 'doc.open' | 'doc.render' | 'doc.text.select' | 'doc.text.copy' | 'doc.text.search' | 'doc.content.copy' | 'doc.download' | 'doc.download.flattened' | 'doc.print' | 'doc.print.high' | 'doc.pages.modify' | 'doc.pages.assemble' | 'doc.forms.read' | 'doc.forms.fill' | 'doc.forms.modify' | 'doc.forms.submit' | 'doc.annotate.read' | 'doc.annotate.modify' | 'doc.metadata.modify' | 'doc.attachments.modify' | 'doc.redact' | 'doc.sign' | 'doc.sign.certify';
 /**
  * Single-entity collaboration vocabulary. Only annotations are
  * collab-scoped today; future entities slot into the same grammar.
@@ -869,6 +869,419 @@ declare class MissingIdentity extends Error {
   constructor(scope: string);
 }
 //#endregion
+//#region src/identity/FormFieldRef.d.ts
+/**
+ * How callers address a logical form field.
+ *
+ * - `objectNumber` — the indirect object number of the field dictionary.
+ *   ISO 32000 guarantees every real AcroForm field dictionary is an
+ *   indirect object, and the layer runtime never renumbers (frozen base +
+ *   incremental deltas), so this is the durable identity for the lifetime
+ *   of a document. Preferred for all engine calls.
+ * - `fqn` — the fully qualified field name ("billing.name"). The portable,
+ *   semantic identity used by interchange formats (FDF/XFDF) and analytics;
+ *   survives document rewrites but is only as unique as the producer made
+ *   it. The engine resolves it against the reconciled field tree.
+ */
+type FormFieldRef = {
+  kind: 'objectNumber';
+  fieldObjectNumber: number;
+} | {
+  kind: 'fqn';
+  name: string;
+};
+/**
+ * URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
+ * the `:fieldKey` route parameter. Decoded by the server back into a
+ * `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
+ * `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
+ * read the same on the wire:
+ *
+ *   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
+ *   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
+ *
+ * The caller is responsible for `encodeURIComponent`-ing the result before
+ * splicing it into a URL path; the `wirePaths.layerFormField*` builders
+ * already do that. FQNs are opaque strings and may contain anything; the
+ * `fqn:` prefix keeps them unambiguous from numeric ids.
+ */
+declare function encodeFieldRefKey(ref: FormFieldRef): string;
+/**
+ * Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
+ * server can answer 400 InvalidArg with a useful message instead of
+ * throwing. The input is the already-`decodeURIComponent`-ed segment from
+ * the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
+ * valid identity.
+ */
+declare function decodeFieldRefKey(key: string): FormFieldRef | null;
+/** A widget annotation of a field, as the forms subsystem sees it. */
+interface FormWidgetRef {
+  /**
+   * Indirect object number of the widget annotation — the join key to the
+   * annotation subsystem's `objectNumber` refs. `0` when the widget is
+   * stored as a direct object (spec-violating; cannot be addressed).
+   */
+  annotObjectNumber: number;
+  /**
+   * Object number of the page whose /Annots array references the widget.
+   * `0` when the widget is not reachable from any page ("unplaced").
+   */
+  pageObjectNumber: PageObjectNumber;
+}
+//#endregion
+//#region src/dto/CachePins.d.ts
+/**
+ * Per-page cache-busting integers embedded in immutable cloud/CDN leaf URLs.
+ *
+ * These are not page state. They are read coordinates for cacheable endpoints:
+ * `/text` uses `contentVersion`; `/annotations` uses `annotationVersion`.
+ */
+interface CachePins {
+  contentVersion: number;
+  annotationVersion: number;
+}
+//#endregion
+//#region src/revision/WeakAnnotationState.d.ts
+/**
+ * Tri-state knowledge about weak annotation identities on a page.
+ *
+ * `known(false)` is a stronger claim than "we have not looked yet": it means
+ * the page's annotations were scanned and every annotation had a durable
+ * identity. Cloud/CDN manifests must only publish boolean weak flags from a
+ * known state.
+ */
+type WeakAnnotationState = {
+  kind: 'unknown';
+} | {
+  kind: 'known';
+  hasAnyWeakAnnotations: boolean;
+};
+declare const UNKNOWN_WEAK_ANNOTATION_STATE: WeakAnnotationState;
+declare function knownWeakAnnotationState(hasAnyWeakAnnotations: boolean): WeakAnnotationState;
+//#endregion
+//#region src/revision/PageState.d.ts
+/**
+ * Per-page liveness envelope returned with annotation reads and mutation
+ * metadata. Deliberately scoped to annotation liveness: page identity,
+ * weak-ref revision state, and explicit knowledge about weak annotations.
+ *
+ * Geometry/display order is NOT here — it lives in `PageLayout` (returned by
+ * `pages.list()`), joined to this by `pageObjectNumber`. The two change on
+ * different cadences (annotation edits vs. structural ops), so they are kept
+ * orthogonal and never merged into one struct.
+ */
+interface PageState {
+  pageObjectNumber: PageObjectNumber;
+  revision: RevisionToken;
+  /**
+   * Explicit knowledge state for the weak-annotation scan. `unknown` means the
+   * page has not been scanned yet; it must not be published as a CDN/cache
+   * boolean.
+   */
+  weakAnnotationState: WeakAnnotationState;
+}
+//#endregion
+//#region src/mutation/MutationMeta.d.ts
+/**
+ * Cache pin patch returned by cloud mutations after the durable DB transaction
+ * commits.
+ *
+ * `previousDocVersion` makes partial page deltas safe: clients may apply the
+ * patch only when their cached manifest is exactly at that version. Otherwise
+ * they must refresh instead of manufacturing a mixed-version manifest.
+ *
+ * Deliberately does NOT carry plane scopes: scopes only ever move
+ * base → layer, and each mutation kind knows exactly which planes it owns, so
+ * the client flips them locally when absorbing this delta (the monotone-flip
+ * rule); the manifest is the authoritative source and the 404 → refresh rail
+ * the backstop.
+ */
+interface CacheDelta {
+  previousDocVersion: number;
+  docVersion: number;
+  /**
+   * New doc-level bulk annotations pin, present when this mutation bumped
+   * it (annotation CRUD, page insert/delete, redaction, flatten, form
+   * structure — see `DocumentManifest.annotationsVersion`). Absorbing it
+   * keeps the client's cached manifest addressing the fresh bulk leaf
+   * without a 404-refresh round trip.
+   */
+  annotationsVersion?: number;
+  /**
+   * The layer's write serial after this mutation and whether an artifact
+   * now exists (cloud only). Absorbing them keeps the client's cached
+   * manifest an honest `DocumentVersionRef` source between refreshes.
+   */
+  layerVersion?: number;
+  working?: boolean;
+  pages: Array<{
+    pageObjectNumber: PageObjectNumber;
+    cache: CachePins;
+  }>;
+}
+/**
+ * Base envelope for every layer-mutating operation.
+ *
+ * `affectedPages` is the state delta. `cacheDelta` is the cloud/CDN URL pin
+ * delta and is `null` for local engines.
+ */
+interface MutationMeta {
+  affectedPages: PageState[];
+  cacheDelta: CacheDelta | null;
+}
+//#endregion
+//#region src/signature/types.d.ts
+/**
+ * Digital signatures, read side.
+ *
+ * Three facts, kept apart on purpose (see the signing plan): a signature
+ * is a *bytes* fact (a `/ByteRange` + `/Contents` that seal a byte prefix
+ * of the file), cryptography and trust live in `@embedpdf/core-signature`,
+ * and what changed after a signature is judged per revision. Everything
+ * here is read from the bytes the document was loaded from — for a layer
+ * document, the base followed by the delta it was opened with — never
+ * from unsaved in-memory edits.
+ */
+/**
+ * Whether the engine enforces what a document's signatures forbid
+ * (`protect`, the default: document-derived capabilities are subtracted
+ * and locked fields refuse writes) or leaves every edit to the caller
+ * (`permit`: for tools whose job is to produce or test invalid files).
+ * Analysis never depends on it.
+ */
+type SignedDocumentPolicy = 'protect' | 'permit';
+/** Hash algorithms the engine can compute over a byte range. SHA-1 is read-only: legacy signatures verify with it, new ones never use it. */
+type DigestAlgorithm = 'sha1' | 'sha256' | 'sha384' | 'sha512';
+/** The two `/SubFilter` values the engine can author. Read-side `subFilter` is the raw name and may be anything. */
+type SignatureSubFilter = 'adbe.pkcs7.detached' | 'ETSI.CAdES.detached';
+type SignatureKind = 'signature' | 'timestamp';
+/**
+ * How the signature's `/ByteRange` relates to the file:
+ *   - `whole-revision`: `[0,a) ∪ [b,c)` is exactly one chained revision
+ *     and the hole is this signature's own `/Contents`.
+ *   - `partial`: well-formed ranges that do not seal a revision.
+ *   - `malformed`: unusable ranges or a `/Contents` that is not one DER
+ *     object with zero padding.
+ */
+type SignatureCoverage = 'whole-revision' | 'partial' | 'malformed';
+/** DocMDP / `/Lock /P` permission values (ISO 32000-2 Table 257). */
+type DocMdpPermission = 1 | 2 | 3;
+/**
+ * The modification level a signed document allows, as a product policy:
+ *   - `none`: no byte change at all (not a DocMDP value)
+ *   - `lta`: DSS and document timestamps only (P = 1)
+ *   - `fill`: + form fill, signatures, new signature fields (P = 2, and how a
+ *     validator reads an approval signature)
+ *   - `annotate`: + annotations (P = 3)
+ */
+type ModificationLevel = 'none' | 'lta' | 'fill' | 'annotate';
+type FieldLockAction = 'all' | 'include' | 'exclude';
+/** A FieldMDP transform or a field `/Lock`: which fields it freezes, and an optional `/P` tightening. */
+interface FieldLockSpec {
+  action: FieldLockAction;
+  /** Fully qualified names; a name covers its descendants (`group` covers `group.total`). Empty for `all`. */
+  fields: string[];
+  permission?: DocMdpPermission;
+}
+/**
+ * One saved revision of the file: a byte prefix `[0, end)` closed by a
+ * cross-reference section reachable from the final `startxref`.
+ */
+interface PdfRevision {
+  /** 0 = the original document. */
+  index: number;
+  /** File offset just past the `%%EOF` line ending. */
+  end: number;
+  /** File offset of the cross-reference section the revision's startxref names. */
+  xrefOffset: number;
+  /** The signature that seals exactly this revision, when one does. */
+  signatureIndex: number | null;
+}
+/** What the signer claimed in the signature dictionary. None of it is verified here; `/M` in particular is a claim. */
+interface SignatureSigner {
+  name: string | null;
+  reason: string | null;
+  location: string | null;
+  contactInfo: string | null;
+  /** `/M` as written (PDF date string). */
+  claimedTime: string | null;
+}
+/** The field's `/SV` seed value: what a signature on this field must satisfy. */
+interface SignatureSeedValue {
+  /** `/Ff` bits: which of the entries below are requirements rather than suggestions. */
+  requiredFlags: number;
+  /** Which entries are present at all (same bit layout, plus Cert/MDP/TimeStamp). */
+  presentFlags: number;
+  /** `/V`: the seed-value parser capability the signer needs (1 = PDF 1.5, 2 = PDF 1.7). */
+  version: number | null;
+  /** `/MDP /P` when present: 0 = approval signature only. */
+  mdp: 0 | 1 | 2 | 3 | null;
+  filter: string | null;
+  subFilters: string[];
+  digestMethods: string[];
+  reasons: string[];
+  /** A required entry this engine does not implement — signing this field is refused. */
+  unsupportedRequired: boolean;
+}
+interface SignatureDTO {
+  /** Position in `SignatureSnapshot.signatures` (field order). */
+  index: number;
+  /** Always an `objectNumber` ref: the durable identity. */
+  field: FormFieldRef;
+  fieldName: string;
+  widget: FormWidgetRef | null;
+  signed: boolean;
+  kind: SignatureKind;
+  /** Raw `/Filter` and `/SubFilter` names. */
+  filter: string | null;
+  subFilter: string | null;
+  byteRange: [number, number, number, number] | null;
+  /** DER length of `/Contents` as its TLV declares (0 when unsigned or malformed). */
+  contentsSize: number;
+  /** `null` when unsigned. */
+  coverage: SignatureCoverage | null;
+  /** Which revision the signature seals; `null` unless coverage is `whole-revision`. */
+  revisionIndex: number | null;
+  signer: SignatureSigner;
+  /** The DocMDP permission the signature carries (its `/Reference`), whether or not the catalog points at it. */
+  docMdp: DocMdpPermission | null;
+  /** `/Root /Perms /DocMDP` names this signature: it is THE certification. */
+  catalogCertification: boolean;
+  /** The FieldMDP transform this signature carries. */
+  fieldMdp: FieldLockSpec | null;
+  /** The field's own `/Lock`. */
+  lock: FieldLockSpec | null;
+  seedValue: SignatureSeedValue | null;
+}
+/** A lock an earlier signature established on the current bytes. */
+interface DocumentFieldLock {
+  signatureIndex: number;
+  source: 'fieldmdp' | 'lock';
+  spec: FieldLockSpec;
+}
+/**
+ * What the signatures already in a document mean for what comes after, in
+ * two separate answers:
+ *
+ *   - `enforced`: what a signer DECLARED — a certification's /P, a signed
+ *     field's /Lock /P. The engine refuses what it forbids (mapped onto
+ *     capabilities like encryption permission bits). A plain approval
+ *     signature declares nothing: `null`.
+ *   - `judged`: what a validator holds later changes to — the declared level,
+ *     or the approval baseline (`fill`: form fill-in and signing keep the
+ *     signature valid, anything else does not; Acrobat's reading, ISO 32000
+ *     is silent) when only approval signatures exist. Never refused, only
+ *     judged: an annotation after an approval signature is allowed and then
+ *     reads as invalidating, exactly as in Acrobat.
+ */
+interface DocumentProtection {
+  /** Declared and enforced; `null` when nothing declared (unsigned, or approval signatures only). */
+  enforced: ModificationLevel | null;
+  /** Judged; `null` when nothing is signed. */
+  judged: ModificationLevel | null;
+  certification: {
+    signatureIndex: number;
+    permission: DocMdpPermission;
+  } | null;
+  fieldLocks: DocumentFieldLock[];
+  /** The versioned product policy that derived this. */
+  policyVersion: number;
+}
+interface SignatureSnapshot {
+  /** `false` when the cross-reference chain is broken or was rebuilt: every byte fact is then indeterminate. */
+  chainValid: boolean;
+  /** Oldest first. Empty when `chainValid` is false. */
+  revisions: PdfRevision[];
+  signatures: SignatureDTO[];
+  protection: DocumentProtection;
+}
+/**
+ * The saved bytes a session is on. Locally the hash of the loaded bytes
+ * (for a layer session: of its base); on the cloud the document's base
+ * version. A completed signature always produces a new one.
+ */
+interface BaseVersionInfo {
+  sha256: string;
+  byteLength: number;
+}
+/**
+ * What a signing candidate was built on. Both publish fences are named:
+ * the base the candidate extends and how many edits over it it includes
+ * (the layer's write serial on the cloud, the session's mutation sequence
+ * locally). `complete` must present the same pair.
+ */
+interface DocumentVersionRef {
+  baseSha256: string;
+  editsVersion: number;
+}
+/**
+ * Widget artwork for the signature, as a page of a PDF (the same path
+ * stamps take: the page is drawn into the widget's appearance stream).
+ */
+interface SignatureAppearanceInput {
+  /** A PDF whose page carries the artwork. */
+  pdf: Uint8Array;
+  /** Which page; default 0. */
+  pageIndex?: number;
+}
+interface SignaturePrepareInput {
+  field: FormFieldRef;
+  kind?: SignatureKind;
+  subFilter?: SignatureSubFilter;
+  digest?: Exclude<DigestAlgorithm, 'sha1'>;
+  /** Room reserved for the CMS, in bytes (256 .. 4 MiB). Default 8192. */
+  contentsSize?: number;
+  /** What the signature dictionary says about the signer: `/Name`, `/Reason`, `/Location`, `/ContactInfo`. */
+  attribution?: {
+    name?: string;
+    reason?: string;
+    location?: string;
+    contactInfo?: string;
+  };
+  /** PDF date string for `/M`; default: now. */
+  signingTime?: string;
+  /** Make this the certification signature (`/Root /Perms /DocMDP`). Only ever the first signature. */
+  certify?: {
+    permission: DocMdpPermission;
+  };
+  /** FieldMDP for this signature plus a mirroring `/Lock` on the field. */
+  lock?: FieldLockSpec;
+  appearance?: SignatureAppearanceInput;
+}
+interface SignaturePrepared {
+  signingId: string;
+  digest: Uint8Array;
+  algorithm: Exclude<DigestAlgorithm, 'sha1'>;
+  byteRange: [number, number, number, number];
+  contentsSize: number;
+  subFilter: SignatureSubFilter | 'ETSI.RFC3161';
+  expectedVersion: DocumentVersionRef;
+  /** ISO timestamp after which the candidate is discarded. */
+  expiresAt: string | null;
+}
+interface SignatureCompleteInput {
+  signingId: string;
+  /** The detached CMS (PKCS#7 / CAdES SignedData) over the prepared digest. */
+  cms: Uint8Array;
+  expectedVersion: DocumentVersionRef;
+}
+interface SignatureCompleteResult {
+  /** `already-completed` on an idempotent replay with the same CMS. */
+  status: 'completed' | 'already-completed';
+  signature: SignatureDTO;
+  /** The version the sealed bytes became. */
+  version: BaseVersionInfo;
+  /** What it was built on. */
+  previous: DocumentVersionRef;
+  /** What the document's signatures forbid from now on. */
+  protection: DocumentProtection;
+  /** Every page is re-pinned: the session moved to new bytes. */
+  meta: MutationMeta;
+}
+interface SignatureAbortResult {
+  status: 'aborted' | 'already-completed' | 'unknown';
+}
+//#endregion
 //#region src/auth/scope/resolver.d.ts
 /**
  * Resolved collab subject — the per-record identity bits used to test
@@ -886,13 +1299,13 @@ interface CollabTarget {
  * Wildcard `*` short-circuits to true. Anything not explicitly granted
  * (or expanded from `pdf.permissions`) is denied.
  */
-declare function checkCapability(capability: DocCapability, rawScope: ReadonlyArray<string>, pdfBits: PdfBits): boolean;
+declare function checkCapability(capability: DocCapability, rawScope: ReadonlyArray<string>, pdfBits: PdfBits, protection?: DocumentProtection | null): boolean;
 /**
  * True iff the scope grants AT LEAST ONE of `capabilities`. Convenience
  * for routes like `/text` (`doc.text.copy` OR `doc.text.search`) and
  * `/geometry` (`doc.text.select` OR `doc.text.search`).
  */
-declare function checkAnyCapability(capabilities: ReadonlyArray<DocCapability>, rawScope: ReadonlyArray<string>, pdfBits: PdfBits): boolean;
+declare function checkAnyCapability(capabilities: ReadonlyArray<DocCapability>, rawScope: ReadonlyArray<string>, pdfBits: PdfBits, protection?: DocumentProtection | null): boolean;
 /**
  * True iff the scope grants the collab action against the target record.
  *
@@ -933,13 +1346,13 @@ declare function checkCollab(action: CollabAction, target: CollabTarget, rawScop
  * before calling this. Returning the expanded set is useful for the
  * `/access` response's `effectiveScope` and for advisory UI surfacing.
  */
-declare function expandedCapabilities(parsed: ReadonlyArray<ParsedScope>, pdfBits: PdfBits): Set<DocCapability>;
+declare function expandedCapabilities(parsed: ReadonlyArray<ParsedScope>, pdfBits: PdfBits, protection?: DocumentProtection | null): Set<DocCapability>;
 /**
  * Convenience wrapper: takes the raw scope array, parses each entry,
  * returns the expanded capability set. Exposed for the `/access`
  * endpoint and for the SDK helper that surfaces `effectiveScope`.
  */
-declare function expandRawScope(rawScope: ReadonlyArray<string>, pdfBits: PdfBits): Set<DocCapability>;
+declare function expandRawScope(rawScope: ReadonlyArray<string>, pdfBits: PdfBits, protection?: DocumentProtection | null): Set<DocCapability>;
 /**
  * Test a single collab filter against a target record + the caller's
  * identity. Pure function — no side effects, no implicit rules.
@@ -1229,7 +1642,37 @@ interface OpenInputShare {
   sharePassword?: string;
   password?: string | null;
 }
-type OpenInput = OpenInputBytes | OpenInputLayerBytes | OpenInputById | OpenInputToken | OpenInputShare;
+type OpenInputLayerFileSource = {
+  kind: 'fresh';
+} | {
+  kind: 'artifact';
+  bytes: Uint8Array | ArrayBuffer;
+} | {
+  kind: 'artifact-file';
+  path: string;
+};
+/**
+ * Local-engine layer open over a base FILE (Node runtimes only): the base
+ * is range-read from disk by PDFium and never loaded into JS, and a
+ * signing candidate for such a session is written beside it rather than
+ * held in memory. What a server does for every document; useful locally
+ * for large files.
+ *
+ * Rejected by `@cloudpdf/engine` and by the wasm runtime.
+ */
+interface OpenInputLayerFile {
+  kind: 'layerFile';
+  /** Caller-supplied stable id for this layer document handle. */
+  id: string;
+  /** Optional sharing key for the loaded base. Defaults to the path. */
+  baseKey?: string;
+  basePath: string;
+  /** A verified SHA-256 (hex) of the base file, when the caller has one. */
+  baseSha256?: string;
+  layer?: OpenInputLayerFileSource;
+  password?: string | null;
+}
+type OpenInput = OpenInputBytes | OpenInputLayerBytes | OpenInputLayerFile | OpenInputById | OpenInputToken | OpenInputShare;
 interface OpenOptions {
   password?: string | null;
   /**
@@ -1818,46 +2261,6 @@ interface PageImageBlobSource {
 }
 declare function createPageImageHandle(result: PageImageResult, blobSource: PageImageBlobSource): PageImageHandle;
 //#endregion
-//#region src/revision/WeakAnnotationState.d.ts
-/**
- * Tri-state knowledge about weak annotation identities on a page.
- *
- * `known(false)` is a stronger claim than "we have not looked yet": it means
- * the page's annotations were scanned and every annotation had a durable
- * identity. Cloud/CDN manifests must only publish boolean weak flags from a
- * known state.
- */
-type WeakAnnotationState = {
-  kind: 'unknown';
-} | {
-  kind: 'known';
-  hasAnyWeakAnnotations: boolean;
-};
-declare const UNKNOWN_WEAK_ANNOTATION_STATE: WeakAnnotationState;
-declare function knownWeakAnnotationState(hasAnyWeakAnnotations: boolean): WeakAnnotationState;
-//#endregion
-//#region src/revision/PageState.d.ts
-/**
- * Per-page liveness envelope returned with annotation reads and mutation
- * metadata. Deliberately scoped to annotation liveness: page identity,
- * weak-ref revision state, and explicit knowledge about weak annotations.
- *
- * Geometry/display order is NOT here — it lives in `PageLayout` (returned by
- * `pages.list()`), joined to this by `pageObjectNumber`. The two change on
- * different cadences (annotation edits vs. structural ops), so they are kept
- * orthogonal and never merged into one struct.
- */
-interface PageState {
-  pageObjectNumber: PageObjectNumber;
-  revision: RevisionToken;
-  /**
-   * Explicit knowledge state for the weak-annotation scan. `unknown` means the
-   * page has not been scanned yet; it must not be published as a CDN/cache
-   * boolean.
-   */
-  weakAnnotationState: WeakAnnotationState;
-}
-//#endregion
 //#region src/dto/AnnotationRender.d.ts
 /**
  * Which `/AP` sub-dictionary to render. PDFium exposes Normal (`/N`),
@@ -1998,22 +2401,29 @@ interface AnnotationAppearanceManifest {
   appearances: AnnotationAppearanceManifestEntry[];
 }
 //#endregion
-//#region src/dto/CachePins.d.ts
-/**
- * Per-page cache-busting integers embedded in immutable cloud/CDN leaf URLs.
- *
- * These are not page state. They are read coordinates for cacheable endpoints:
- * `/text` uses `contentVersion`; `/annotations` uses `annotationVersion`.
- */
-interface CachePins {
-  contentVersion: number;
-  annotationVersion: number;
-}
-//#endregion
 //#region src/dto/PdfSaveMode.d.ts
 type PdfSaveMode = 'incremental' | 'rewrite';
 declare const DEFAULT_PDF_SAVE_MODE: PdfSaveMode;
 //#endregion
+//#region src/dto/SessionKind.d.ts
+/**
+ * The shape a document session takes inside the engine.
+ *
+ * - `layer` (the default): the bytes become an immutable base with a layer of
+ *   edits on top. Reads fall through to the base; a write promotes only the
+ *   object it touches. A save appends exactly what changed, `download()` on an
+ *   unchanged document returns the loaded bytes verbatim, `downloadLayer()`
+ *   exports the edits alone, and a signature keeps its validity across later
+ *   edits because the signature dictionary is never rewritten.
+ * - `plain`: one in-memory PDFium document, the classic shape. A save rewrites
+ *   every loaded object. Kept for comparison and for the rare embedder that
+ *   depends on that shape; a document that already carries a signature opens
+ *   as `layer` regardless, because a plain save would void it.
+ *
+ * The handle looks the same either way.
+ */
+type SessionKind = 'layer' | 'plain';
+//#endregion
 //#region src/dto/FontSpec.d.ts
 /**
  * Runtime font registration DTOs.
@@ -2064,15 +2474,123 @@ interface FontSpec {
   /** Font file bytes (TTF/OTF). */
   data: Uint8Array | ArrayBuffer;
 }
-/** A successfully registered font. Returned by {@link FontService.register}. */
-interface FontHandle {
-  readonly key: FontKey;
-  /** Resolved base font name (the inferred name when `familyName` was empty). */
+/**
+ * The OS/2 `fsType` embedding permission of a registered font. Registration
+ * refuses restricted and bitmap-only fonts outright. A preview-and-print font
+ * renders existing text and may be embedded, but may not author NEW text
+ * (a FreeText naming it fails, and missing-glyph fallback skips it) until
+ * the application asserts a licence with {@link FontService.authorizeEditing}.
+ */
+type FontEmbeddingPermission = 'installable' | 'editable' | 'preview-and-print';
+/**
+ * What the runtime resolved at registration. This is the persistent
+ * identity of the face: a saved document names it by family, weight and
+ * italic (the font descriptor's `/FontFamily`, `/FontWeight`,
+ * `/ItalicAngle`), and a rich text body reads back with the same values, so
+ * a host can map them back to its own `key`.
+ */
+interface FontIdentityInfo {
+  /** The family as registered, else the font's own family name. */
   readonly familyName: string;
-  /** Resolved style weight (the inferred weight when `0`/omitted was passed). */
+  /** 100..900. */
   readonly weight: number;
   readonly italic: boolean;
+  readonly embeddingPermission: FontEmbeddingPermission;
+  /** Whether new text may be authored with the font (see the permission). */
+  readonly editingAuthorized: boolean;
+  /** True when the registered program is a static instance made from a
+   *  variable font at registration (axes pinned, `wght` to the weight). */
+  readonly instanced: boolean;
+}
+/** A successfully registered font. Returned by {@link FontService.register}. */
+interface FontHandle extends FontIdentityInfo {
+  readonly key: FontKey;
+}
+//#endregion
+//#region src/dto/RichText.d.ts
+/**
+ * Rich text of a FreeText annotation (`/RC` + `/DS`), the model the engine
+ * lays out and writes. Runs carry only the style they override (deltas
+ * against the body), exactly as the XHTML spans do, so changing the body
+ * style moves every run that did not override that property.
+ *
+ * Families name faces the way a PDF does: a standard-14 family
+ * (`"Helvetica"`), a font registered through `engine.fonts` (its family, or
+ * its `key` — the engine resolves either), or a family already embedded in
+ * the document. A family that resolves nowhere substitutes Helvetica; the
+ * appearance still renders and the box still edits.
+ */
+type RichTextDecoration = 'underline' | 'line-through' | 'word';
+type RichTextScript = 'normal' | 'sub' | 'super';
+type RichTextAlign = TextAlignment | 'justify';
+type RichTextDirection = 'ltr' | 'rtl';
+interface RichTextRunStyle {
+  family: string;
+  /** 100..900. */
+  weight: number;
+  italic: boolean;
+  /** Points. */
+  size: number;
+  /** `#RRGGBB`. */
+  color: string;
+  decoration: RichTextDecoration[];
+  script: RichTextScript;
+  /** Points, added after every glyph. */
+  letterSpacing: number;
+  /** 1 = normal (`xfa-font-horizontal-scale` / 100). */
+  horizontalScale: number;
+  /** CSS declarations the engine does not model, kept verbatim. */
+  unknown?: string;
+}
+interface RichTextMargins {
+  top: number;
+  bottom: number;
+  left: number;
+  right: number;
 }
+interface RichTextParagraphProps {
+  align: RichTextAlign;
+  dir: RichTextDirection;
+  /** Points; absent = the normal line box. */
+  lineHeight?: number;
+  margins?: RichTextMargins;
+  textIndent?: number;
+  unknown?: string;
+}
+interface RichTextRun {
+  /** May contain `\r`: a hard line break inside the paragraph. */
+  text: string;
+  /** The properties this run overrides. Absent = the body style. */
+  style?: Partial<RichTextRunStyle>;
+}
+/** A paragraph: its own alignment/direction when they differ from the body's. */
+interface RichTextParagraph extends Partial<RichTextParagraphProps> {
+  runs: RichTextRun[];
+}
+type RichTextBody = RichTextRunStyle & RichTextParagraphProps;
+/** What an annotation reads back: a complete body, every paragraph resolved. */
+interface RichTextDocument {
+  body: RichTextBody;
+  paragraphs: RichTextParagraph[];
+}
+/**
+ * What a draft or patch writes. `body` may be omitted (the annotation's
+ * current body style stays — the "plain text replacement" of the patch
+ * table) or partial (missing properties take the engine's defaults:
+ * Helvetica 12 pt black, left-aligned, ltr).
+ */
+interface RichTextDocumentInput {
+  body?: Partial<RichTextBody>;
+  paragraphs: RichTextParagraph[];
+}
+/** The plain-text projection of a rich document: paragraphs joined by `\r`,
+ *  runs concatenated — what the engine writes to `/Contents`. */
+declare function richTextPlainText(doc: {
+  paragraphs: readonly RichTextParagraph[];
+}): string;
+/** Plain text as rich paragraphs: one per line break, one run each, no
+ *  overrides (the engine's own `/Contents` fallback shape). */
+declare function richTextParagraphsFromPlainText(text: string): RichTextParagraph[];
 //#endregion
 //#region src/errors/EngineErrorCode.d.ts
 declare const EngineErrorCode: {
@@ -2147,6 +2665,41 @@ declare const EngineErrorCode: {
    * doesn't exist).
    */
   readonly MalformedPdf: "MalformedPdf";
+  /**
+   * A signing candidate is parked on this session: every mutation is
+   * refused until `signatures.complete` or `signatures.abort`.
+   */
+  readonly SigningPending: "SigningPending";
+  /** The candidate's TTL elapsed; prepare again. */
+  readonly SigningExpired: "SigningExpired";
+  /**
+   * `complete` presented a version the candidate was not built on (the
+   * document or the layer moved since `prepare`). The CMS cannot be
+   * reused: it signs a digest of bytes that will never be the head.
+   * Prepare again on the current version.
+   */
+  readonly SigningVersionMismatch: "SigningVersionMismatch";
+  /**
+   * The engine refused to author the signature: the field is signed,
+   * read-only, or locked by an earlier signature; a certification is
+   * requested after a signature exists; the seed value requires what the
+   * engine does not implement; the request is inconsistent. The message
+   * names the reason.
+   */
+  readonly SignatureRefused: "SignatureRefused";
+  /**
+   * A signature already in the document forbids this change (a
+   * certification's permission, a FieldMDP or `/Lock`, or the approval
+   * baseline). The message names the signature and the restriction. The
+   * engine option `signedDocumentPolicy: 'permit'` disables the guard.
+   */
+  readonly ProtectedDocument: "ProtectedDocument";
+  /**
+   * The layer is built on a base version that is no longer the
+   * document's head (another signing completed); it can be read and
+   * edited but not signed from.
+   */
+  readonly StaleBase: "StaleBase";
 };
 type EngineErrorCode = (typeof EngineErrorCode)[keyof typeof EngineErrorCode];
 //#endregion
@@ -3052,6 +3605,20 @@ interface DocumentManifest {
    */
   auditHead: number;
   baseSha: string;
+  /**
+   * The layer's write serial (`layers.current_version`; 0 for the base view
+   * and for a never-written layer) — the `editsVersion` half of the
+   * `DocumentVersionRef` a signing pins at `prepare` and checks at `complete`.
+   */
+  layerVersion: number;
+  /**
+   * An artifact exists: the layer holds edits not yet sealed into a base
+   * version. After a signature publishes a version the layer is clean again
+   * while `layerVersion` keeps counting, so this is the only honest signal.
+   */
+  working: boolean;
+  /** Byte length of `baseSha`'s file — with the sha, the `BaseVersionInfo` a client signs. */
+  baseByteLength: number;
   /**
    * Plane scopes (layer manifests only; absent on base manifests and
    * on pre-plane servers = all-`'layer'`). Whole-layer by design — edge
@@ -3120,48 +3687,6 @@ type PdfLinkTargetWritable = Extract<PdfLinkTarget, {
   kind: 'goto' | 'uri';
 }>;
 //#endregion
-//#region src/mutation/MutationMeta.d.ts
-/**
- * Cache pin patch returned by cloud mutations after the durable DB transaction
- * commits.
- *
- * `previousDocVersion` makes partial page deltas safe: clients may apply the
- * patch only when their cached manifest is exactly at that version. Otherwise
- * they must refresh instead of manufacturing a mixed-version manifest.
- *
- * Deliberately does NOT carry plane scopes: scopes only ever move
- * base → layer, and each mutation kind knows exactly which planes it owns, so
- * the client flips them locally when absorbing this delta (the monotone-flip
- * rule); the manifest is the authoritative source and the 404 → refresh rail
- * the backstop.
- */
-interface CacheDelta {
-  previousDocVersion: number;
-  docVersion: number;
-  /**
-   * New doc-level bulk annotations pin, present when this mutation bumped
-   * it (annotation CRUD, page insert/delete, redaction, flatten, form
-   * structure — see `DocumentManifest.annotationsVersion`). Absorbing it
-   * keeps the client's cached manifest addressing the fresh bulk leaf
-   * without a 404-refresh round trip.
-   */
-  annotationsVersion?: number;
-  pages: Array<{
-    pageObjectNumber: PageObjectNumber;
-    cache: CachePins;
-  }>;
-}
-/**
- * Base envelope for every layer-mutating operation.
- *
- * `affectedPages` is the state delta. `cacheDelta` is the cloud/CDN URL pin
- * delta and is `null` for local engines.
- */
-interface MutationMeta {
-  affectedPages: PageState[];
-  cacheDelta: CacheDelta | null;
-}
-//#endregion
 //#region src/mutation/RefetchReason.d.ts
 /**
  * Why a mutation invalidates the previously returned snapshot. Surfaced on
@@ -3360,66 +3885,6 @@ interface AnnotationMoveResult {
   meta: AnnotationListMutationMeta;
 }
 //#endregion
-//#region src/identity/FormFieldRef.d.ts
-/**
- * How callers address a logical form field.
- *
- * - `objectNumber` — the indirect object number of the field dictionary.
- *   ISO 32000 guarantees every real AcroForm field dictionary is an
- *   indirect object, and the layer runtime never renumbers (frozen base +
- *   incremental deltas), so this is the durable identity for the lifetime
- *   of a document. Preferred for all engine calls.
- * - `fqn` — the fully qualified field name ("billing.name"). The portable,
- *   semantic identity used by interchange formats (FDF/XFDF) and analytics;
- *   survives document rewrites but is only as unique as the producer made
- *   it. The engine resolves it against the reconciled field tree.
- */
-type FormFieldRef = {
-  kind: 'objectNumber';
-  fieldObjectNumber: number;
-} | {
-  kind: 'fqn';
-  name: string;
-};
-/**
- * URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
- * the `:fieldKey` route parameter. Decoded by the server back into a
- * `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
- * `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
- * read the same on the wire:
- *
- *   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
- *   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
- *
- * The caller is responsible for `encodeURIComponent`-ing the result before
- * splicing it into a URL path; the `wirePaths.layerFormField*` builders
- * already do that. FQNs are opaque strings and may contain anything; the
- * `fqn:` prefix keeps them unambiguous from numeric ids.
- */
-declare function encodeFieldRefKey(ref: FormFieldRef): string;
-/**
- * Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
- * server can answer 400 InvalidArg with a useful message instead of
- * throwing. The input is the already-`decodeURIComponent`-ed segment from
- * the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
- * valid identity.
- */
-declare function decodeFieldRefKey(key: string): FormFieldRef | null;
-/** A widget annotation of a field, as the forms subsystem sees it. */
-interface FormWidgetRef {
-  /**
-   * Indirect object number of the widget annotation — the join key to the
-   * annotation subsystem's `objectNumber` refs. `0` when the widget is
-   * stored as a direct object (spec-violating; cannot be addressed).
-   */
-  annotObjectNumber: number;
-  /**
-   * Object number of the page whose /Annots array references the widget.
-   * `0` when the widget is not reachable from any page ("unplaced").
-   */
-  pageObjectNumber: PageObjectNumber;
-}
-//#endregion
 //#region src/forms/value-entry.d.ts
 /** Lossless shape of a field's effective PDF `/V` or `/DV` object. */
 type FormValueEntry = {
@@ -3769,11 +4234,20 @@ interface ListBoxFieldDraft extends FormFieldDraftBase {
   options?: FormFieldOptionInput[];
   widget?: WidgetPlacement;
 }
+/**
+ * A signature field: identity and (usually) one widget. Created unsigned;
+ * signing it is `doc.signatures`' job, drawing a mark into it without
+ * signing is `doc.forms.setSignatureAppearance`.
+ */
+interface SignatureFieldDraft extends FormFieldDraftBase {
+  family: 'signature';
+  widget?: WidgetPlacement;
+}
 /**
  * What `doc.forms.createField` takes: per-family, mirroring the DTO union.
- * Push buttons and signatures are not authorable.
+ * Push buttons are not authorable.
  */
-type FormFieldDraft = TextFieldDraft | CheckboxFieldDraft | RadioFieldDraft | ComboBoxFieldDraft | ListBoxFieldDraft;
+type FormFieldDraft = TextFieldDraft | CheckboxFieldDraft | RadioFieldDraft | ComboBoxFieldDraft | ListBoxFieldDraft | SignatureFieldDraft;
 //#endregion
 //#region src/forms/patch.d.ts
 /**
@@ -3952,6 +4426,488 @@ interface FormEffectsResult {
   meta: MutationMeta | null;
 }
 //#endregion
+//#region src/signature/analysis/types.d.ts
+/**
+ * The shallow serialisation of a PDF object as the fork's revision diff
+ * emits it, parsed. A stream carries its length and SHA-256 rather than
+ * its data; every nested value is direct (references stay references).
+ */
+type PdfValue = {
+  t: 'dict';
+  entries: Record<string, PdfValue>;
+} | {
+  t: 'array';
+  items: PdfValue[];
+} | {
+  t: 'ref';
+  num: number;
+} | {
+  t: 'name';
+  v: string;
+} | {
+  t: 'string';
+  v: string;
+} | {
+  t: 'number';
+  v: number;
+} | {
+  t: 'bool';
+  v: boolean;
+} | {
+  t: 'null';
+} | {
+  t: 'stream';
+  length: number;
+  sha256: string;
+  dict: Record<string, PdfValue>;
+};
+/**
+ * One inbound reference: the referring object (0 = the trailer) and the
+ * label leading to the reference inside it. Edges are *anchored*: a
+ * reference from an unchanged, non-structural object is resolved through
+ * that object to the nearest changed or structural ancestor, and `via`
+ * lists the objects it was resolved through, from the anchor's side down
+ * to the object. A widget's appearance stream reached through an unchanged
+ * indirect `/AP` dictionary is therefore
+ * `{ parent: widget, label: 'AP/N', via: [apDict] }`.
+ */
+interface ObjectReferrer {
+  parent: number;
+  /** Escaped dictionary keys and `[n]` indexes joined by `/`, e.g. `AcroForm/Fields/[0]`, `AP/N`. */
+  label: string;
+  via?: number[];
+}
+type ObjectChangeType = 'added' | 'modified' | 'freed';
+/**
+ * What reading the object from one revision's bytes came to. `failed` is a
+ * live mapping whose bytes do not parse (or a stream whose data cannot be
+ * read): the side is present and its value is NOT evidence - two failed
+ * reads are never "the same value".
+ */
+type ObjectReadStatus = 'ok' | 'failed' | 'absent';
+/**
+ * Facts about one revision as a whole that decide whether later changes to
+ * it can be judged at all. Acrobat treats a document with a sparse
+ * cross-reference table (object numbers below /Size with no entry of any
+ * kind) or a reachable bare-reference object (an indirect object whose
+ * whole body is a reference) as corrupted the moment any revision follows
+ * the signed one; a verdict on such a base would disagree with it.
+ */
+interface RevisionHealth {
+  sparseXref: boolean;
+  bareReferences: number;
+  /** False when the reachability walk hit its budget: usage on that side is a lower bound. */
+  referrersComplete: boolean;
+}
+type ObjectChangeKind = 'dictionary' | 'stream' | 'array' | 'scalar' | 'xref' | 'objstm' | 'trailer';
+/**
+ * One object whose cross-reference mapping differs between two revisions,
+ * with its value in both and every object that references it in both.
+ * The trailer is object number 0. Objects that serialise identically are
+ * still listed (their mapping changed): the identical-rewrite rule judges them.
+ */
+interface ObjectChange {
+  objectNumber: number;
+  change: ObjectChangeType;
+  kind: ObjectChangeKind;
+  /**
+   * Whether the object exists on each side. Derived from `change` by the
+   * transport (`added` → no old side, `freed` → no new side); the trailer
+   * exists on both sides and carries no generation numbers.
+   */
+  present: {
+    old: boolean;
+    new: boolean;
+  };
+  generation: {
+    old: number | null;
+    new: number | null;
+  };
+  /**
+   * The values, or null where the side is absent. A present side with a
+   * null value is *missing evidence*: the evaluator treats it as truncated.
+   */
+  value: {
+    old: PdfValue | null;
+    new: PdfValue | null;
+    truncated: boolean;
+  };
+  /** The serialisation as emitted, for exact comparison. */
+  raw: {
+    old: string | null;
+    new: string | null;
+  };
+  /** Per-side read status; absent on older transports (then `ok` for present sides). */
+  read?: {
+    old: ObjectReadStatus;
+    new: ObjectReadStatus;
+  };
+  streamDataChanged: boolean;
+  /** Anchored inbound edges per side (see `ObjectReferrer`). */
+  usage: {
+    old: ObjectReferrer[];
+    new: ObjectReferrer[];
+  };
+  /**
+   * Set when the transport could not resolve every edge within its budget
+   * (depth, fan-out, total reads). Treated like a truncated value: the step
+   * is indeterminate, never permitted.
+   */
+  usageIncomplete?: boolean;
+}
+interface RevisionField {
+  objectNumber: number;
+  /** Fully qualified name. */
+  name: string;
+  family: FormFieldFamily;
+  /** Widget annotation object numbers (a merged field-widget lists its own number). */
+  widgets: number[];
+  /**
+   * The effective `/Ff` (inherited through the field tree), as the form
+   * model sees it. A lock landing on a field writes `effective | ReadOnly`
+   * into the terminal dictionary, so judging that write needs the effective
+   * flags, not the terminal's own (possibly absent) entry.
+   */
+  flags?: number;
+}
+/**
+ * What one revision looks like structurally: enough to give every object
+ * a role (the catalog, a page, a field, a widget, a signature value)
+ * without walking paths from the root.
+ */
+interface RevisionStructure {
+  root: number;
+  acroForm: number;
+  pagesRoot: number;
+  pages: number[];
+  fields: RevisionField[];
+  signatures: SignatureDTO[];
+}
+interface ChangeFinding {
+  rule: string;
+  verdict: 'permitted' | 'forbidden' | 'incomplete';
+  objectNumber: number;
+  /** The specific edge (`parent:label`) this finding vouches for or condemns, when it is about one. */
+  edge?: string;
+  detail?: string;
+}
+type StepVerdict = 'unchanged' | 'permitted' | 'forbidden' | 'indeterminate';
+interface RevisionAnalysis {
+  older: number;
+  newer: number;
+  /** The level in force after the restrictions established up to `older`. */
+  levelInForce: ModificationLevel;
+  /** Locks in force for this step (from the signatures in `older`). */
+  locks: DocumentFieldLock[];
+  verdict: StepVerdict;
+  findings: ChangeFinding[];
+  changes: ObjectChange[];
+}
+/**
+ * A restriction in force for the judged window: a DocMDP certification or a
+ * FieldMDP/lock, and whose it is. A FieldMDP lock is a promise the locking
+ * signature makes about its own window and binds no other signature's
+ * verdict (corpus v3/85); a certification's level is inherited by every
+ * later window as well (conservative until observed otherwise).
+ */
+interface RestrictionAnchor {
+  signatureIndex: number;
+  revisionIndex: number;
+  source: 'docmdp' | 'fieldmdp' | 'lock';
+  /** Declared by the signature being judged, as opposed to inherited. */
+  own: boolean;
+  permission?: DocMdpPermission;
+  fields?: FieldLockSpec;
+}
+/** One judgement with its evidence status; `complete: false` never coexists with a passing verdict. */
+interface Assessment {
+  verdict: StepVerdict;
+  complete: boolean;
+  /** The finding that decided a forbidden or indeterminate verdict, or the most notable permitted one. */
+  primary?: ChangeFinding;
+  findings: ChangeFinding[];
+}
+interface AnalyzeInput {
+  /** Start from the revision a signature seals, or from any revision. */
+  since: {
+    signatureIndex: number;
+  } | {
+    revisionIndex: number;
+  };
+  /**
+   * `persisted` (default): the loaded bytes. `working-copy`: the session's
+   * unsaved state, snapshotted the way a save would write it, as one more
+   * revision. A revision index compares against history only.
+   */
+  until?: 'persisted' | 'working-copy' | {
+    revisionIndex: number;
+  };
+  /**
+   * Exploratory only: evaluate as if this level were in force. The result
+   * is tagged `mode: 'exploratory'` and never becomes a verdict.
+   */
+  exploratoryLevel?: ModificationLevel;
+  /**
+   * `summary` (default): the verdict and its findings. `full`: also every
+   * pairwise step between `since` and `until`, with each step's changes
+   * (large; for diagnostics and tooling).
+   */
+  detail?: 'summary' | 'full';
+}
+/**
+ * How the judged revision stands against the revision the signature
+ * sealed. The verdict is the NET state - `until` compared with `since`
+ * directly - the way Acrobat judges an approval signature (a page changed
+ * and byte-restored later is unchanged; corpus v2/15, 42, 44, v3/81, 85).
+ * A certification window replays every intervening revision as well
+ * (v3/82-83), and any step's violation joins the verdict.
+ */
+interface ChangeAnalysis {
+  mode: 'authoritative' | 'exploratory';
+  policyVersion: number;
+  basis: {
+    version: BaseVersionInfo;
+    editsVersion: number;
+    source: 'persisted' | 'working-copy';
+  };
+  since: {
+    revisionIndex: number;
+    signatureIndex: number | null;
+  };
+  until: {
+    revisionIndex: number;
+  };
+  /** The restrictions this window was judged under (see `RestrictionAnchor`). */
+  restrictions: RestrictionAnchor[];
+  /** THE verdict, with the findings behind it. */
+  current: Assessment & {
+    method: 'net-state' | 'net-state+replay';
+  };
+  /** Facts about the revisions between `since` and `until`; never a verdict. */
+  later: {
+    revisionCount: number;
+    /** Objects rewritten after `since` that hold the sealed value again in `until`. */
+    undoneObjectNumbers: number[];
+  };
+  /** Equals `current.verdict`: one field for every consumer that only needs the answer. */
+  verdict: StepVerdict;
+  /**
+   * The pairwise steps: the single step when one revision follows `since`,
+   * every step of a certification replay, or every step with
+   * `detail: 'full'`. Empty otherwise (a multi-revision approval window in
+   * summary mode is judged on its net state alone).
+   */
+  steps: RevisionAnalysis[];
+}
+/** Everything one pairwise step needs; JSON in, JSON out. */
+interface StepInput {
+  older: number;
+  newer: number;
+  changes: ObjectChange[];
+  before: RevisionStructure;
+  after: RevisionStructure;
+  /** What the transport learned about each revision as a whole (see `RevisionHealth`). */
+  health?: {
+    old: RevisionHealth;
+    new: RevisionHealth;
+  };
+  /**
+   * The restrictions to judge under. Absent: derived from every signature
+   * in `before` (a revision-anchored analysis). Present: the judged
+   * signature's own locks and the inherited certification level.
+   */
+  restrictions?: {
+    level: ModificationLevel;
+    locks: DocumentFieldLock[];
+  };
+  /** Overrides the level derived from `before` (exploratory mode only). */
+  levelOverride?: ModificationLevel;
+}
+//#endregion
+//#region src/signature/analysis/pdf-value.d.ts
+/**
+ * Parse the fork's canonical shallow serialisation:
+ *   dict     <</Key value/Key2 value>>        (keys sorted, `#xx`-escaped)
+ *   array    [item item]
+ *   ref      n 0 R
+ *   stream   stream(length,sha256hex)<<dict>>
+ *   name     /Name (with #xx escapes)
+ *   string   (literal with backslash escapes) or <hex>
+ *   number   -12.5   bool  true|false   null
+ */
+declare function parsePdfValue(text: string): PdfValue;
+/** Structural equality of two parsed values. */
+declare function pdfValueEquals(a: PdfValue | null, b: PdfValue | null): boolean;
+declare function stableStringify(value: PdfValue | null): string;
+declare function dictEntries(value: PdfValue | null): Record<string, PdfValue> | null;
+/** Keys whose value differs (added, removed, or changed) between two dictionaries. */
+declare function changedKeys(a: PdfValue | null, b: PdfValue | null): Set<string>;
+declare function refsOf(value: PdfValue | null | undefined): number[];
+//#endregion
+//#region src/signature/analysis/evaluate.d.ts
+/** The level a step runs at, and the locks it enforces: what the OLDER revision's signatures established. */
+declare function restrictionsOf(before: RevisionStructure): {
+  level: ModificationLevel;
+  locks: DocumentFieldLock[];
+};
+/**
+ * Judge one pairwise step. Every reference to a changed object, in the
+ * older AND the newer revision, must be claimed by a rule that inspected
+ * that use; an unclaimed reference is `unexplained` and forbidden. A
+ * truncated value is `incomplete`, never permitted. Pure: JSON in, JSON
+ * out, the same code in the browser worker, on the server and in tests.
+ */
+declare function evaluateStep(input: StepInput): RevisionAnalysis;
+/**
+ * Same effective value on both sides: same canonical serialisation (keys
+ * sorted, whitespace normalised - Acrobat compares dictionaries by value,
+ * corpus v3/61-62), same stream data (by bytes, v2/45), and both sides
+ * actually read. A failed read serialises as "null" and would match another
+ * failed read - evidence of nothing.
+ */
+declare function sameEffectiveValue(c: ObjectChange): boolean;
+//#endregion
+//#region src/signature/analysis/restrictions.d.ts
+/**
+ * The restrictions a window is judged under, read from the SEALED
+ * revision's structure (what that revision declared, not what the final
+ * file says).
+ *
+ *   - `judged` given (a signature-anchored analysis): its own FieldMDP and
+ *     /Lock bind the window; other signatures' locks do not (corpus v3/85:
+ *     a second signature is valid with a fill of a field the first locked).
+ *     Every certification's level, own or earlier, applies (inherited:
+ *     conservative until observed otherwise), as does a /Lock's /P.
+ *   - no `judged` (a revision-anchored analysis): every signed signature's
+ *     locks and levels, as before.
+ */
+declare function restrictionsFor(before: RevisionStructure, judged: SignatureDTO | null): {
+  anchors: RestrictionAnchor[];
+  level: ModificationLevel;
+  locks: DocumentFieldLock[];
+};
+//#endregion
+//#region src/signature/analysis/resolve.d.ts
+/**
+ * Limits on edge resolution. Exceeding any of them makes the object's usage
+ * `incomplete`, which the evaluator turns into an indeterminate step: an
+ * adversary can make evidence expensive, never make it disappear.
+ */
+interface EdgeResolverBudget {
+  /** Longest chain of unchanged objects an edge may be resolved through. */
+  maxDepth: number;
+  /** Most anchored edges one object may end up with. */
+  maxEdgesPerObject: number;
+  /** Most referrer reads per resolver (one per side per step). */
+  maxReads: number;
+}
+declare const DEFAULT_EDGE_RESOLVER_BUDGET: EdgeResolverBudget;
+declare const USAGE_INCOMPLETE = "incomplete";
+type ResolvedUsage = ObjectReferrer[] | typeof USAGE_INCOMPLETE;
+/**
+ * Resolves the raw inbound edges of an object (from the fork's referrer
+ * index, which covers every reachable object of a revision) into edges
+ * from *anchors*: the changed objects and the structural objects of the
+ * revision (trailer, catalog, AcroForm, page tree root, pages, fields,
+ * widgets). An edge from an unchanged, non-structural parent is replaced by
+ * that parent's own anchored edges with the labels joined, so an
+ * appearance stream under an unchanged indirect `/AP` dictionary reads
+ * `widget:AP/N` rather than `apDict:N`.
+ *
+ * A graph traversal, not a path enumeration: results are memoised per
+ * object, so a lattice of shared unchanged objects costs its size, not the
+ * number of paths through it. Cycle edges contribute no anchors and are
+ * skipped; a result computed while skipping one is not memoised.
+ */
+declare class EdgeResolver {
+  private readonly read;
+  private readonly anchors;
+  private readonly budget;
+  private readonly memo;
+  private reads;
+  private exhausted;
+  constructor(read: (objectNumber: number) => ObjectReferrer[], anchors: ReadonlySet<number>, budget?: EdgeResolverBudget);
+  /** Anchored edges of `objectNumber`, or `incomplete` when a budget was exceeded. */
+  resolve(objectNumber: number): ResolvedUsage;
+  private resolveInner;
+}
+//#endregion
+//#region src/signature/analysis/verdict.d.ts
+/** The worst of several verdicts (a certification replay's steps). */
+declare function worstVerdict(steps: ReadonlyArray<{
+  verdict: StepVerdict;
+}>): StepVerdict;
+/**
+ * One aggregation rule everywhere: a proven violation decides, whatever
+ * else could not be established; missing evidence never becomes a pass.
+ */
+declare function conclude(findings: ReadonlyArray<ChangeFinding>, hasEffectiveChanges: boolean): StepVerdict;
+/** The finding that explains a verdict: the violation, else the gap, else the most notable allowance. */
+declare function primaryFinding(findings: ReadonlyArray<ChangeFinding>): ChangeFinding | undefined;
+declare function assessmentOf(step: RevisionAnalysis): Assessment;
+/**
+ * A certification window: the net verdict and every replayed step, under
+ * the same rule. A step's violation is a violation of the certification
+ * even when the final state no longer shows it (corpus v3/83).
+ */
+declare function combine(net: RevisionAnalysis, steps: ReadonlyArray<RevisionAnalysis>): Assessment;
+//#endregion
+//#region src/signature/protection.d.ts
+/**
+ * Bumped whenever the derivation below (or a judgement rule) changes meaning.
+ * Rides every protection and every analysis, and keys the cloud's immutable
+ * analysis URLs. v4 (the `signature-compat` corpus, 91 Acrobat observations):
+ * each signature is judged on the net state of the document against the
+ * revision it sealed; an object written again with the sealed value is not
+ * a modification; an approval signature permits commenting; field
+ * properties are judged per level; a lock binds only the signature that
+ * declares it; a changed shared resource must be allowed by every use.
+ */
+declare const SIGNATURE_POLICY_VERSION = 4;
+/** DocMDP `/P` → the modification level it permits. */
+declare function levelFromPermission(permission: DocMdpPermission): ModificationLevel;
+declare function minLevel(a: ModificationLevel, b: ModificationLevel): ModificationLevel;
+/** Whether `level` (null = unsigned, everything allowed) permits changes of kind `needed`. */
+declare function levelAllows(level: ModificationLevel | null, needed: ModificationLevel): boolean;
+/** Hierarchical name match: `group` covers `group.total`. */
+declare function lockNameCovers(lockedName: string, fieldName: string): boolean;
+declare function lockCovers(spec: FieldLockSpec, fieldName: string): boolean;
+/**
+ * Derive what the signatures already in a document mean for what comes
+ * after. Pure and versioned (`SIGNATURE_POLICY_VERSION`); the same function
+ * runs in the browser worker, on the native server, and in the conformance
+ * suite.
+ *
+ *   enforced = min(certification P, every signed field's /Lock /P), or null
+ *              when nothing was declared. What the engine refuses.
+ *   judged   = enforced, or the approval baseline when signatures exist
+ *              without a declaration, or null when nothing is signed. What
+ *              the revision analysis judges later changes against. A
+ *              declaration governs the judgement too: a P=3 certifier really
+ *              did allow annotations.
+ *   fieldLocks = every signed signature's FieldMDP and the /Lock of every
+ *              signed field. Unsigned fields' /Lock entries describe a
+ *              FUTURE signature and lock nothing yet.
+ */
+declare function deriveProtection(signatures: ReadonlyArray<SignatureDTO>): DocumentProtection;
+/** The lock that freezes `fieldName`, if any. */
+declare function fieldLockFor(protection: DocumentProtection, fieldName: string): DocumentFieldLock | null;
+/**
+ * The capabilities a protection removes from every caller, admin scope
+ * included — document-derived authority, exactly like encryption bits.
+ *
+ * Only what was DECLARED is refused: a refusal is a promise a signer made,
+ * never a guess about a validator. A certification (or a lock with /P)
+ * declares what may follow, and everything outside that — page edits,
+ * redaction, field authoring, attachments, and below P=3 annotations, below
+ * P=2 form fill — is refused. A plain approval signature declares nothing:
+ * the same edits stay possible and are then JUDGED, the verdict saying the
+ * signature no longer holds, exactly as Acrobat does. The one exception is a
+ * rewrite: it does not invalidate signatures, it erases them, so any signed
+ * document refuses it. Per-field locks are enforced by the form mutator.
+ */
+declare function protectedCapabilities(protection: DocumentProtection | null): Set<DocCapability>;
+//#endregion
 //#region src/mutation/FormMutationResults.d.ts
 /**
  * Result of a value write (`setValue` / `reset`).
@@ -4123,11 +5079,13 @@ declare function textSegmentsForRange(layout: PageTextLayout, charStart: number,
  * | `matchCase`       | fold case        | `i` flag                       |
  * | `wholeWord`       | boundary check   | pattern is `\b(?:…)\b`-wrapped |
  * | `matchDiacritics` | mark fold        | REJECTED (`InvalidArg`)        |
+ * | `ignoreWhitespace`| whitespace drop  | REJECTED (`InvalidArg`)        |
  *
  * Literal queries match over FOLDED text; regex queries run the portable
- * dialect against the RAW page text — which is why `matchDiacritics`
- * cannot apply to them (diacritic folding is a property of the folded
- * text plane). Validate with `validateSearchQuery` for early UI feedback;
+ * dialect against the RAW page text — which is why `matchDiacritics` and
+ * `ignoreWhitespace` cannot apply to them (diacritic folding and whitespace
+ * dropping are properties of the folded text plane; a pattern spells its
+ * own `\s*`). Validate with `validateSearchQuery` for early UI feedback;
  * engines re-validate and reject with `EngineErrorCode.InvalidArg`.
  */
 interface SearchQuery {
@@ -4150,6 +5108,17 @@ interface SearchQuery {
    * LITERAL ONLY: combined with `regex` the query is rejected.
    */
   matchDiacritics?: boolean;
+  /**
+   * Drop whitespace on both sides instead of collapsing it, so "invoice"
+   * finds the letter-spaced "i n v o i c e" that OCR and tracked-out headings
+   * produce, and "total amount" finds "totalamount". Default false — the default
+   * fold collapses whitespace runs to one space, so a needle still has to
+   * carry a space wherever the page does. A hit spans the original text
+   * including the dropped whitespace; with `wholeWord` the boundaries are
+   * checked on the ORIGINAL text (the folded plane has no word gaps left).
+   * LITERAL ONLY: combined with `regex` the query is rejected.
+   */
+  ignoreWhitespace?: boolean;
 }
 /**
  * How much of a match leaves the engine — the permission story:
@@ -4265,7 +5234,8 @@ interface SearchSlice {
  *
  * Fold version 1:
  *   - whitespace runs collapse to a single space (any `\s`, including the
- *     spaces some compatibility decompositions emit),
+ *     spaces some compatibility decompositions emit) — or are dropped
+ *     entirely with `dropWhitespace` (ignoreWhitespace),
  *   - each code point is NFKD-decomposed (ligatures split: "fi" → "fi",
  *     "²" → "2"),
  *   - combining marks are stripped unless `keepMarks`,
@@ -4288,6 +5258,8 @@ interface FoldOptions {
   keepCase?: boolean;
   /** Preserve combining marks (matchDiacritics). */
   keepMarks?: boolean;
+  /** Drop whitespace instead of collapsing it to one space (ignoreWhitespace). */
+  dropWhitespace?: boolean;
 }
 interface FoldedText {
   folded: string;
@@ -4360,7 +5332,7 @@ declare function validateSearchRegex(pattern: string): SearchRegexValidation;
  * reject with `InvalidArg`. Literal queries are always valid (an empty
  * literal simply finds nothing).
  */
-type SearchQueryIssue = SearchRegexIssue | 'diacritics-with-regex';
+type SearchQueryIssue = SearchRegexIssue | 'diacritics-with-regex' | 'ignore-whitespace-with-regex';
 type SearchQueryValidation = {
   ok: true;
 } | {
@@ -4790,6 +5762,190 @@ interface MetadataUpdateResult {
   cache: MetadataCache | null;
 }
 //#endregion
+//#region src/dto/Measure.d.ts
+type MeasureFraction = 'decimal' | 'fraction' | 'round' | 'truncate';
+/** ISO number format. Missing required fields in imported PDFs stay unavailable. */
+interface PdfNumberFormat {
+  /** Literal unit label, including any intentional whitespace. */
+  unit: string;
+  /** Conversion from the preceding format's units (or the input units for the
+   * first format). Absent when imported /C is missing or malformed; never defaults to 1. */
+  conversion?: number;
+  /** Last component's numeric representation; default decimal. */
+  fraction?: MeasureFraction;
+  /** Decimal denominator (1, 10, 100, …) or fractional denominator (e.g. 16). */
+  precision?: number;
+  /** Retain decimal zeros or the unreduced fraction denominator. */
+  fixed?: boolean;
+  /** Grouping separator; default comma, empty string disables grouping. */
+  thousands?: string;
+  /** Decimal separator; omitted or empty means dot. */
+  decimal?: string;
+  /** Spacing immediately before the unit label. */
+  prefixSpacing?: string;
+  /** Spacing immediately after the unit label. */
+  suffixSpacing?: string;
+  labelPosition?: 'suffix' | 'prefix';
+}
+/** Rectilinear /Measure. Empty arrays faithfully represent missing formats on import. */
+interface PdfMeasure {
+  subtype: 'RL';
+  ratio?: string;
+  /** X-axis conversion from PDF user-space units. */
+  x: PdfNumberFormat[];
+  /** When present, requires cyx to express Y distances in X-axis units. */
+  y?: PdfNumberFormat[];
+  /** Distance display formats, starting from the first X format's unit. */
+  distance: PdfNumberFormat[];
+  /** Area display formats, starting from the square of the first X format's unit. */
+  area: PdfNumberFormat[];
+  angle?: PdfNumberFormat[];
+  slope?: PdfNumberFormat[];
+  origin?: PdfPoint;
+  /** Conversion from the first Y format's units into the first X format's units. */
+  cyx?: number;
+}
+/** Read-only presence marker. Foreign dictionaries are preserved in the PDF. */
+interface PdfForeignMeasure {
+  subtype: 'GEO' | 'unknown';
+}
+type PdfMeasurement = PdfMeasure | PdfForeignMeasure;
+interface PdfViewport {
+  bbox: PdfRect;
+  name?: string;
+  measure?: PdfMeasurement;
+}
+interface PageMeasurementViewport extends PdfViewport {
+  owned: boolean;
+}
+type LineIntent = 'LineArrow' | 'LineDimension';
+type PolygonIntent = 'PolygonCloud' | 'PolygonDimension';
+type PolylineIntent = 'PolyLineDimension';
+interface LineDimensionCaption {
+  enabled: boolean;
+  position?: 'inline' | 'top';
+  /** Displacement in directed line axes, in PDF units; not a page point. */
+  offset?: {
+    along: number;
+    perpendicular: number;
+  };
+}
+interface ShapeDimensionCaption {
+  enabled: boolean;
+  /** Absolute PDF user-space center. Absent = automatic; (0,0) is valid. */
+  center?: PdfPoint;
+}
+interface LineLeader {
+  length: number;
+  extension?: number;
+  offset?: number;
+}
+interface LineCaptionPatch {
+  enabled?: boolean;
+  position?: 'inline' | 'top' | null;
+  offset?: LineDimensionCaption['offset'] | null;
+}
+interface ShapeCaptionPatch {
+  enabled?: boolean;
+  center?: PdfPoint | null;
+}
+//#endregion
+//#region src/measure/units.d.ts
+declare const METRES: {
+  readonly pt: number;
+  readonly mm: 0.001;
+  readonly cm: 0.01;
+  readonly m: 1;
+  readonly km: 1000;
+  readonly in: 0.0254;
+  readonly ft: 0.3048;
+  readonly yd: 0.9144;
+  readonly mi: 1609.344;
+};
+type LengthUnit = keyof typeof METRES;
+type AreaUnit = `${LengthUnit}2` | 'ha' | 'acre';
+declare const squareOf: (unit: LengthUnit) => AreaUnit;
+declare function squareMetres(unit: AreaUnit): number;
+declare const areaUnitLabel: (unit: AreaUnit) => string;
+//#endregion
+//#region src/measure/calibrate.d.ts
+interface MeasurementFormatOptions {
+  /** Decimal precision denominator: 1, 10, 100, ... */
+  precision: number;
+  fixed?: boolean;
+  areaUnit?: AreaUnit;
+  imperialFeetInches?: boolean;
+  /** Inch fraction denominator when imperialFeetInches is true. Default 16. */
+  fractionalPrecision?: number;
+}
+declare function measureFromKnownLength(userSpaceLength: number, real: {
+  value: number;
+  unit: LengthUnit;
+}, format?: MeasurementFormatOptions): PdfMeasure;
+declare function measureFromRatio(paper: number, real: number, unit: LengthUnit, userUnit?: number, format?: MeasurementFormatOptions): PdfMeasure;
+//#endregion
+//#region src/measure/compute.d.ts
+interface MeasuredScale {
+  sx: number;
+  sy: number;
+}
+declare function scaleOf(measure: PdfMeasure): MeasuredScale | null;
+declare const measurementPoint: (p: PdfPoint) => PdfPoint;
+declare function pathLength(points: readonly PdfPoint[], closed: boolean, scale: MeasuredScale): number;
+declare function polygonArea(points: readonly PdfPoint[], scale: MeasuredScale): number;
+/** A measured area must have one simple, nonzero boundary. Repeated closing
+ *  vertices are allowed in imported PDFs; crossings and overlapping edges are not. */
+declare function validAreaBoundary(points: readonly PdfPoint[]): boolean;
+//#endregion
+//#region src/measure/derive.d.ts
+interface DimensionInput {
+  subtype: string;
+  intent?: string | null;
+  measure?: PdfMeasurement | null;
+  linePoints?: LinePoints;
+  vertices?: PdfPoint[];
+  contents?: string | null;
+}
+interface MeasurementReadout {
+  kind: 'distance' | 'perimeter' | 'area';
+  label: string;
+  /** Value in the first display format's unit. */
+  value: number;
+  perimeter?: string;
+}
+interface MeasurementUnavailable {
+  unavailable: 'not-dimension' | 'no-measure' | 'foreign-measure' | 'no-scale' | 'no-distance-format' | 'no-area-format' | 'invalid-format' | 'invalid-geometry';
+}
+declare function isDimension(dto: {
+  subtype: string;
+  intent?: string | null;
+}): boolean;
+declare const isReadout: (r: MeasurementReadout | MeasurementUnavailable) => r is MeasurementReadout;
+declare function measurementReadout(dto: DimensionInput): MeasurementReadout | MeasurementUnavailable;
+declare function deriveMeasurementLabel<T extends DimensionInput>(dto: T): T;
+//#endregion
+//#region src/measure/format.d.ts
+declare function validNumberFormat(nf: PdfNumberFormat): boolean;
+/** ISO 32000-2 §12.9.2 cascade. PDF float conversions are normalized before use.
+ * Unit text and explicit spacing are preserved, including trailing unit spaces. */
+declare function formatMeasurement(value: number, formats: readonly PdfNumberFormat[]): string;
+//#endregion
+//#region src/measure/viewport.d.ts
+/** Last containing viewport wins. A foreign measure still wins; never guess a fallback. */
+declare function viewportForPoint<T extends PdfViewport>(viewports: readonly T[], point: PdfPoint): T | undefined;
+//#endregion
+//#region src/measure/validate.d.ts
+/** Shared preflight for HTTP, workers and calibration helpers. Does not write. */
+declare function assertWritableMeasure(value: PdfMeasure): void;
+declare function assertPdfFloat(n: number): void;
+//#endregion
+//#region src/mutation/PageScaleResult.d.ts
+/** A calibration changes document state, with no page pixels or annotation indices changed. */
+interface PageScaleResult {
+  pageObjectNumber: PageObjectNumber;
+  meta: MutationMeta;
+}
+//#endregion
 //#region src/annotation/kinds/text-markup.shared.d.ts
 /**
  * Text-markup family-specific fields. The four text-markup subtypes
@@ -5031,18 +6187,27 @@ type VertexDTO<S extends string> = AnnotationBase & {
 //#endregion
 //#region src/annotation/kinds/polygon/draft.d.ts
 interface PolygonDraft extends AnnotationDraftBase, VertexDraftFields {
+  intent?: PolygonIntent | null;
+  measure?: PdfMeasure | null;
+  caption?: ShapeDimensionCaption | null;
   subtype: 'polygon';
   cloudyIntensity?: number | null;
 }
 //#endregion
 //#region src/annotation/kinds/polygon/dto.d.ts
 type PolygonAnnotationDTO = VertexDTO<'polygon'> & {
+  intent?: PolygonIntent;
+  measure?: PdfMeasurement;
+  caption?: ShapeDimensionCaption;
   /** `/BE` cloudy border intensity; `null` when the border carries no effect. */
   cloudyIntensity: number | null;
 };
 //#endregion
 //#region src/annotation/kinds/polygon/patch.d.ts
 interface PolygonPatch extends AnnotationPatchBase, VertexPatchFields {
+  intent?: PolygonIntent | null;
+  measure?: PdfMeasure | null;
+  caption?: ShapeCaptionPatch | null;
   subtype: 'polygon';
   /** Tri-state (as `interiorColor`): omitted preserves, a value sets, `null` removes `/BE`. */
   cloudyIntensity?: number | null;
@@ -5055,17 +6220,26 @@ declare const PolygonPatchSchema: z.ZodType<PolygonPatch>;
 //#endregion
 //#region src/annotation/kinds/polyline/draft.d.ts
 interface PolylineDraft extends AnnotationDraftBase, VertexDraftFields {
+  intent?: PolylineIntent | null;
+  measure?: PdfMeasure | null;
+  caption?: ShapeDimensionCaption | null;
   subtype: 'polyline';
   lineEndings?: LineEndings;
 }
 //#endregion
 //#region src/annotation/kinds/polyline/dto.d.ts
 type PolylineAnnotationDTO = VertexDTO<'polyline'> & {
+  intent?: PolylineIntent;
+  measure?: PdfMeasurement;
+  caption?: ShapeDimensionCaption;
   lineEndings: LineEndings;
 };
 //#endregion
 //#region src/annotation/kinds/polyline/patch.d.ts
 interface PolylinePatch extends AnnotationPatchBase, VertexPatchFields {
+  intent?: PolylineIntent | null;
+  measure?: PdfMeasure | null;
+  caption?: ShapeCaptionPatch | null;
   subtype: 'polyline';
   lineEndings?: LineEndings;
 }
@@ -5077,6 +6251,10 @@ declare const PolylinePatchSchema: z.ZodType<PolylinePatch>;
 //#endregion
 //#region src/annotation/kinds/line/draft.d.ts
 interface LineDraft extends AnnotationDraftBase, FilledStyleDraftFields {
+  intent?: LineIntent | null;
+  measure?: PdfMeasure | null;
+  caption?: LineDimensionCaption | null;
+  leader?: LineLeader | null;
   subtype: 'line';
   /** `/L` the two endpoints — required. */
   linePoints: LinePoints;
@@ -5089,6 +6267,10 @@ interface LineDraft extends AnnotationDraftBase, FilledStyleDraftFields {
 //#endregion
 //#region src/annotation/kinds/line/dto.d.ts
 type LineAnnotationDTO = AnnotationBase & {
+  intent?: LineIntent;
+  measure?: PdfMeasurement;
+  caption?: LineDimensionCaption;
+  leader?: LineLeader;
   subtype: 'line';
   /** `/L` the two endpoints of the line. */
   linePoints: LinePoints;
@@ -5101,6 +6283,10 @@ type LineAnnotationDTO = AnnotationBase & {
 //#endregion
 //#region src/annotation/kinds/line/patch.d.ts
 interface LinePatch extends AnnotationPatchBase, FilledStylePatchFields {
+  intent?: LineIntent | null;
+  measure?: PdfMeasure | null;
+  caption?: LineCaptionPatch | null;
+  leader?: LineLeader | null;
   subtype: 'line';
   linePoints?: LinePoints;
   rect?: PdfRect;
@@ -5231,6 +6417,12 @@ interface FreeTextDraft extends AnnotationDraftBase {
   fontFamily: FreeTextFont;
   fontSize: number;
   textAlign: TextAlignment;
+  /**
+   * Rich text (`/RC`). When given, its body is the annotation's body style
+   * (the `/DA` font and size follow it) and its paragraphs are the text;
+   * `contents`, if also given, must equal its plain projection.
+   */
+  richText?: RichTextDocumentInput;
   /** `/Rect` bounding box — required (computed by the caller/plugin). */
   rect: PdfRect;
   /** `/DA` colour (border + default text). */
@@ -5265,12 +6457,24 @@ type FreeTextAnnotationDTO = AnnotationBase & {
   subtype: 'free-text';
   /** `/IT` intent. */
   intent: FreeTextIntent;
-  /** `/DA` font. */
-  fontFamily: StandardFont;
+  /**
+   * The body face: a standard font name, the `key` of a registered font
+   * whose family/weight/italic match the body, or — for a face the
+   * document embeds but this session did not register — its family name.
+   */
+  fontFamily: FreeTextFont;
   /** `/DA` font size, in points. */
   fontSize: number;
   /** `/Q` horizontal text alignment. */
   textAlign: TextAlignment;
+  /**
+   * The text, as a rich document — always. The annotation's `/RC` when it has
+   * one, else the same shape synthesised from `/Contents`, `/DA` and `/Q`
+   * (one paragraph per line, no run deltas). `contents` is its plain
+   * projection. Every write goes back through the rich path, so a box has
+   * no "plain mode" to fall out of.
+   */
+  richText: RichTextDocument;
   /** `/DA` colour: the border colour and the default text colour. */
   color: Color;
   /** Text colour override (`TextColor`). Absent when the text follows `color`. */
@@ -5305,6 +6509,16 @@ interface FreeTextPatch extends AnnotationPatchBase {
   fontFamily?: FreeTextFont;
   fontSize?: number;
   textAlign?: TextAlignment;
+  /**
+   * Rich replacement: `/RC`, `/DS`, `/DA`, `/Contents` and the appearance
+   * are all regenerated. A patch that also carries `contents` must agree
+   * with the rich text's plain projection (`InvalidArg` otherwise). A
+   * `contents`-only patch on an annotation with `/RC` rewrites the rich
+   * text as body-style paragraphs: run formatting is lost by design.
+   * `fontFamily` / `fontSize` / `fontColor` on such an annotation change the
+   * body style; runs are deltas, so every run that did not override follows.
+   */
+  richText?: RichTextDocumentInput;
   rect?: PdfRect;
   color?: Color;
   fontColor?: Color;
@@ -5883,5 +7097,5 @@ interface AnnotationListPageSnapshot {
   annotations: AnnotationDTO[];
 }
 //#endregion
-export { CaretDraftSchema as $, FilledStyleFields as $a, Color as $c, FormFieldRef as $i, PageNameResult as $n, AnnotationAppearanceRaster as $o, FormImportResult as $r, PageLayout as $s, CircleDraftSchema as $t, FileAttachmentWireDraftSchema as A, buildCommentThreads as Aa, PDF_BITS as Ac, FormKind as Ai, PdfActionWarning as Al, HighlightDraft as An, AnnotationBase as Ao, toOriginalRange as Ar, glyphLooseQuad as As, LineDraft as At, StampAnnotationDTO as B, PatchOfKind as Ba, ParsedScope as Bc, FormFieldDTO as Bi, DocumentMetadata as Bl, PageDeleteResult as Bn, EngineErrorCode as Bo, TextLayoutFrame as Br, PdfOriginSize as Bs, PolygonPatch as Bt, RedactDraft as C, ManifestPage as Ca, expandedCapabilities as Cc, ComboBoxFieldDraft as Ci, ActionReadBudget as Cl, UnderlineAnnotationDTO as Cn, ANNOTATION_SUBTYPES as Co, wordAt as Cr, PageGeometryGlyph as Cs, LinkAnnotationDTO as Ct, FileAttachmentDTOSchema as D, CommentThread as Da, PermissionDenied as Dc, RadioFieldDraft as Di, PdfActionTargetRef as Dl, HighlightPatchSchema as Dn, PdfAnnotationSubtypeCode as Do, SEARCH_FOLD_VERSION as Dr, RotatedGeometryRun as Ds, LinePatchSchema as Dt, WidgetDraft as E, BuildCommentThreadsOptions as Ea, MissingIdentity as Ec, ListBoxFieldDraft as Ei, PdfActionNode as El, HighlightDraftSchema as En, PDF_SUBTYPE_TO_CODE as Eo, FoldedText as Er, RotatedGeometryGlyph as Es, LineDraftSchema as Et, StampDTOSchema as F, classifyRelation as Fa, CollabFilter as Fc, WidgetStyleFields as Fi, SubmitFormPayload as Fl, RedactionApplyScope as Fn, EngineError as Fo, SearchSlice as Fr, boundaryTextOffset as Fs, PolylineAnnotationDTO as Ft, TextDTOSchema as G, FileAttachmentDraft as Ga, AnnotationRef as Gc, ListBoxFieldDTO as Gi, AnnotationFlattenInput as Gn, PdfSaveMode as Go, expandTextRangeToWord as Gr, pdfQuadFromCorners as Gs, VertexPatchFields as Gt, StampFit as H, AttachmentDeleteResult as Ha, ParsedWildcard as Hc, FormFieldFlags as Hi, PageRotateResult as Hn, FontKey as Ho, TextLayoutRun as Hr, normalizePdfRect as Hs, PolygonDraft as Ht, StampWireDraftSchema as I, refKey as Ia, DocCapability as Ic, WidgetStylePatchFields as Ii, decodeSubmitFormFlags as Il, RedactionApplyStatus as In, EngineErrorOptions as Io, SearchSliceBudget as Ir, charBoundaryAtTextOffset as Is, PolylineDraft as It, TextPatch as J, WireAttachmentFile as Ja, AnnotationBorderStyle as Jc, SignatureFieldDTO as Ji, PageFlattenInput as Jn, AnnotationAppearanceImageOptions as Jo, textSegmentsForRange as Jr, pdfRectSize as Js, SquarePatchSchema as Jt, TextDraftSchema as K, FileAttachmentIcon as Ka, RevisionToken as Kc, PushButtonFieldDTO as Ki, AnnotationFlattenItemResult as Kn, CachePins as Ko, textGlyphAt as Kr, pdfRectFromOriginSize as Ks, SquareDTOSchema as Kt, StampWirePatchSchema as L, AnnotationKindModule as La, IdentityClaims as Lc, CheckboxFieldDTO as Li, PdfDestination as Ll, PAGE_INSERT_BLANK_MAX_COUNT as Ln, SerializedEngineError as Lo, SearchSnippet as Lr, charMapViolation as Ls, PolygonDTOSchema as Lt, FileAttachmentPatch as M, AnnotationRelationKind as Ma, AnnotationActor as Mc, WidgetAppearance as Mi, PdfFieldActions as Ml, MetadataUpdateResult as Mn, AnnotationStableId as Mo, SearchMode as Mr, PageTextSnapshot as Ms, PolylineDraftSchema as Mt, FileAttachmentAnnotationDTO as N, AnnotationThread as Na, CollabAction as Nc, WidgetAppearanceSchema as Ni, PdfPageActions as Nl, RedactionApplyItemResult as Nn, decodeStableIdKey as No, SearchQuery as Nr, CharBoundaryBias as Ns, PolylinePatchSchema as Nt, FileAttachmentIconSchema as O, CommentThreadReview as Oa, parseScope as Oc, TextFieldDraft as Oi, PdfActionTree as Ol, HighlightPatch as On, subtypeFromCode as Oo, SearchMatchRange as Or, UprightGeometryRun as Os, LinePatch as Ot, ResourceRefSchema as P, buildThreads as Pa, CollabEntity as Pc, WidgetStyleDraftFields as Pi, SubmitFormFlags as Pl, RedactionApplyResult as Pn, encodeStableIdKey as Po, SearchRequest as Pr, CharMapAnchor as Ps, PolylinePatch as Pt, CaretDTOSchema as Q, FilledStyleDraftFields as Qa, CaretIntent as Qc, FormValueEntry as Qi, PageFlattenUsage as Qn, AnnotationAppearanceMode as Qo, FormFieldUpdateResult as Qr, PageBoxes as Qs, CircleDTOSchema as Qt, StampPatch as R, DTOOfKind as Ra, ParsedCapability as Rc, ComboBoxFieldDTO as Ri, PageObjectNumber as Rl, PageInsertBlankSpec as Rn, deserializeError as Ro, PageTextLayout as Rr, charRangeForTextOffsets as Rs, PolygonDraftSchema as Rt, RedactAnnotationDTO as S, DocumentManifest as Sa, expandRawScope as Sc, CheckboxFieldDraft as Si, PdfSize as Sl, UnderlinePatch as Sn, resolveBinarySource as So, matchLiteral as Sr, createPageImageHandle as Ss, LinkPatch as St, WidgetAnnotationDTO as T, LayerScopes as Ta, InvalidScope as Tc, FormFieldOptionInput as Ti, NamedJavaScriptAction as Tl, HighlightDTOSchema as Tn, PDF_CODE_TO_SUBTYPE as To, FoldOptions as Tr, PageGeometrySnapshot as Ts, LineDTOSchema as Tt, StampWireDraft as U, AttachmentsCache as Ua, PdfBits as Uc, FormFieldOption as Ui, PageRotateInput as Un, FontSpec as Uo, buildPageTextLayout as Ur, pdfQuadBounds as Us, VertexAnnotationFields as Ut, StampDraft as V, AttachmentCreateResult as Va, ParsedVirtual as Vc, FormFieldFamily as Vi, DocumentMetadataTrapped as Vl, PageDeleteInput as Vn, FontHandle as Vo, TextLayoutGlyph as Vr, PdfQuadCorners as Vs, PolygonAnnotationDTO as Vt, NoteIconSchema as W, normalizeAttachmentFileSource as Wa, AnnotationDraftBase as Wc, FormFieldOrigin as Wi, AnnotationAppearanceExportInput as Wn, DEFAULT_PDF_SAVE_MODE as Wo, expandTextRangeToLine as Wr, pdfQuadCorners as Ws, VertexDraftFields as Wt, NoteIcon as X, ColorStyleFields as Xa, AnnotationReplyType as Xc, ToggleFieldWidget as Xi, PageFlattenResult as Xn, AnnotationAppearanceManifest as Xo, FormFieldCreateResult as Xr, pdfRectWidth as Xs, SquareAnnotationDTO as Xt, TextAnnotationDTO as Y, ColorStyleDraftFields as Ya, AnnotationFlags as Yc, TextFieldDTO as Yi, PageFlattenItemResult as Yn, AnnotationAppearanceImagesResult as Yo, FormDataExport as Yr, pdfRectToOriginSize as Ys, SquarePatch as Yt, TextDraft as Z, ColorStylePatchFields as Za, BlendMode as Zc, UnknownFieldDTO as Zi, PageFlattenStatus as Zn, AnnotationAppearanceManifestEntry as Zo, FormFieldDeleteResult as Zr, PageListSnapshot as Zs, SquareDraft as Zt, UnsupportedPatchSchema as _, RefetchReason as _a, CollabTarget as _c, ComboBoxFieldPatch as _i, LinePoints as _l, SquigglyAnnotationDTO as _n, BinaryPayload as _o, SearchRegexValidation as _r, PageRenderFormat as _s, LinkDraftSchema as _t, AnnotationDTOSchema as a, AnnotationMoveResult as aa, OpenInputById as ac, FormEffectStatus as ai, NO_ANNOTATION_FLAGS as al, ShapeDraftFields as an, AttachmentFileBase as ao, PageMoveInput as ar, WeakAnnotationState as as, FreeTextDraftSchema as at, UnsupportedAnnotationDTO as b, PdfLinkTarget as ba, checkCollab as bc, RadioFieldPatch as bi, PdfRect as bl, UnderlineDraftSchema as bn, WireResource as bo, validateSearchRegex as br, PageRenderTarget as bs, PdfLinkTargetWritableSchema as bt, AnnotationKind as c, AppearanceImpact as ca, OpenInputLayerSource as cc, FormSubmissionEntry as ci, Rect as cl, StrikeoutDraftSchema as cn, EmbeddedFileItem as co, searchRectsForRange as cr, PageImageHandle as cs, FreeTextAnnotationDTO as ct, AnnotationSubtypeOfKind as d, semanticEqual as da, OpenOptions as dc, FormSubmissionReceiptSchema as di, StandardFont as dl, StrikeoutAnnotationDTO as dn, NormalizedPatch as do, buildSnippet as dr, PageImageResult as ds, InkDraftSchema as dt, FormWidgetRef as ea, PageRotation as ec, FormRepairResult as ei, FreeTextFont as el, CirclePatchSchema as en, FilledStylePatchFields as eo, PageNameInput as er, AnnotationAppearanceRenderOptions as es, CaretPatchSchema as et, KIND_BY_SUBTYPE as f, AnnotationMutationKind as fa, TokenSource as fc, FormSubmissionRequest as fi, StrikeoutIntent as fl, StrikeoutDraft as fn, normalizeAnnotationDraft as fo, matchPageText as fr, PageImageSource as fs, InkPatchSchema as ft, UnsupportedDraftSchema as g, AnnotationListMutationMeta as ga, pdfPermissions as gc, CheckboxFieldPatch as gi, InkStroke as gl, SquigglyPatch as gn, sniffBinaryMetadata as go, SearchRegexIssue as gr, PageRenderEncodedFormat as gs, LinkDTOSchema as gt, UnsupportedDTOSchema as h, shiftsExistingAnnotationIndices as ha, materializePdfPermissions as hc, FormFieldValue as hi, InkList as hl, SquigglyPatchSchema as hn, BinaryMimeType as ho, SearchQueryValidation as hr, PageRenderBackground as hs, InkDraft as ht, AnnotationDTO as i, AnnotationDeleteResult as ia, OpenInput as ic, FormEffectResult as ii, LineEndings as il, ShapeAnnotationFields as in, AttachmentContent as io, PageStructureCache as ir, UNKNOWN_WEAK_ANNOTATION_STATE as is, FreeTextDTOSchema as it, WireAttachmentFileSchema as j, isStateAnnotation as ja, decodePdfBits as jc, FormSnapshot as ji, PdfAnnotationActions as jl, MetadataCache as jn, AnnotationIdentityQuality as jo, SearchMatch as jr, isRotatedGeometryRun as js, PolylineDTOSchema as jt, FileAttachmentPatchSchema as k, ReviewStatus as ka, validateScopeArray as kc, WidgetPlacement as ki, PdfActionType as kl, HighlightAnnotationDTO as kn, AnnotationPatchBase as ko, foldText as kr, glyphLooseBounds as ks, LineAnnotationDTO as kt, AnnotationPatch as l, AppearanceOutcome as la, OpenInputShare as lc, FormSubmissionEntrySchema as li, Rotation as ll, StrikeoutPatchSchema as ln, EmbeddedFileRef as lo, searchSegmentsForRange as lr, PageImageObjectUrl as ls, FreeTextDraft as lt, WireAnnotationPatch as m, invalidatesWeakIndexRefs as ma, collab as mc, FormDataFormat as mi, CalloutLine as ml, SquigglyDraftSchema as mn, BinaryMetadata as mo, SearchQueryIssue as mr, PageRaster as ms, InkAnnotationDTO as mt, AnnotationListSnapshotAllPages as n, encodeFieldRefKey as na, NamedPageTarget as nc, FormWidgetLinkResult as ni, InkIntent as nl, CircleAnnotationDTO as nn, GeometryStyleFields as no, PageMoveCache as nr, AnnotationAppearancesResult as ns, CaretAnnotationDTO as nt, AnnotationDraft as o, AnnotationUpdateResult as oa, OpenInputBytes as oc, FormEffectsResult as oi, PdfRectDifferences as ol, ShapePatchFields as on, AttachmentFileInfo as oo, canonicalSearchQuery as or, knownWeakAnnotationState as os, FreeTextPatchSchema as ot, WireAnnotationDraft as p, changesAnnotationList as pa, caps as pc, FormSubmissionRequestSchema as pi, TextAlignment as pl, SquigglyDTOSchema as pn, normalizeAnnotationPatch as po, SEARCH_REGEX_MAX_LENGTH as pr, PageNetworkRenderFormat as ps, InkPatch as pt, TextPatchSchema as q, FileAttachmentWireDraft as qa, revisionTokensEqual as qc, RadioFieldDTO as qi, AnnotationFlattenResult as qn, AnnotationAppearanceImage as qo, textGlyphQuad as qr, pdfRectHeight as qs, SquareDraftSchema as qt, ANNOTATION_KINDS as r, AnnotationCreateResult as ra, MetadataPatch as rc, FormEffect as ri, LineEnding as rl, CircleDraft as rn, GeometryStylePatchFields as ro, PageMoveResult as rr, PageState as rs, CaretDraft as rt, AnnotationDraftSchema as s, AppearanceAction as sa, OpenInputLayerBytes as sc, FormFieldDisplay as si, Point as sl, StrikeoutDTOSchema as sn, AttachmentFileSource as so, searchContentEpoch as sr, PageImageBlobSource as ss, FreeTextPatch as st, AnnotationListPageSnapshot as t, decodeFieldRefKey as ta, NamedPageEntry as tc, FormSetValueResult as ti, FreeTextIntent as tl, CirclePatch as tn, GeometryStyleDraftFields as to, PageRemoveNameInput as tr, AnnotationAppearancesQuery as ts, CaretPatch as tt, AnnotationPatchSchema as u, appearanceImpactOf as ua, OpenInputToken as uc, FormSubmissionReceipt as ui, Size as ul, StrikeoutPatch as un, NormalizedDraft as uo, SEARCH_SNIPPET_CONTEXT as ur, PageImageOptions as us, InkDTOSchema as ut, UnsupportedPatch as v, CacheDelta as va, checkAnyCapability as vc, FormFieldPatch as vi, PdfPoint as vl, SquigglyDraft as vn, BinarySource as vo, matchRegex as vr, PageRenderOptions as vs, LinkPatchSchema as vt, WidgetPatch as w, LayerScopePlane as wa, filterMatches as wc, FormFieldDraft as wi, DocumentActionsSnapshot as wl, UnderlineDraft as wn, AnnotationSubtype as wo, wordBefore as wr, PageGeometryRun as ws, LinkDraft as wt, RedactPatch as x, PdfLinkTargetWritable as xa, checkSetGroup as xc, TextFieldPatch as xi, PdfRotation as xl, UnderlinePatchSchema as xn, WireResourceMap as xo, foldOptionsFor as xr, PageRenderViewport as xs, PdfDestinationSchema as xt, UnsupportedDraft as y, MutationMeta as ya, checkCapability as yc, ListBoxFieldPatch as yi, PdfQuad as yl, UnderlineDTOSchema as yn, ResourceRef as yo, validateSearchQuery as yr, PageRenderQuery as ys, PdfLinkTargetSchema as yt, StampWirePatch as z, DraftOfKind as za, ParsedCollab as zc, FormFieldBase as zi, isValidPageObjectNumber as zl, PageInsertResult as zn, serializeError as zo, PdfTextSegment as zr, sliceTextByChars as zs, PolygonPatchSchema as zt };
-//# sourceMappingURL=AnnotationListSnapshot-x6tKulNV.d.cts.map
+export { CaretDraftSchema as $, FormFieldPatch as $a, PageImageSource as $c, PdfAnnotationActions as $d, minLevel as $i, TokenSource as $l, AreaUnit as $n, LayerScopePlane as $o, SEARCH_SNIPPET_CONTEXT as $r, AnnotationSubtype as $s, CircleDraftSchema as $t, decodePdfBits as $u, FileAttachmentWireDraftSchema as A, PdfValue as Aa, FontEmbeddingPermission as Ac, Rect as Ad, TextLayoutGlyph as Ai, pdfQuadBounds as Al, HighlightDraft as An, TextFieldDTO as Ao, PageDeleteInput as Ar, GeometryStyleDraftFields as As, LineDraft as At, SignaturePrepared as Au, StampAnnotationDTO as B, FormEffectStatus as Ba, AnnotationAppearanceImagesResult as Bc, PdfPoint as Bd, FormFieldDeleteResult as Bi, PageLayout as Bl, deriveMeasurementLabel as Bn, AppearanceOutcome as Bo, PageFlattenStatus as Br, NormalizedPatch as Bs, PolygonPatch as Bt, WeakAnnotationState as Bu, RedactDraft as C, ChangeAnalysis as Ca, RichTextParagraph as Cc, FreeTextIntent as Cd, SearchRequest as Ci, charBoundaryAtTextOffset as Cl, UnderlineAnnotationDTO as Cn, FormFieldFlags as Co, RedactionApplyResult as Cr, WireAttachmentFile as Cs, LinkAnnotationDTO as Ct, SignatureAppearanceInput as Cu, FileAttachmentDTOSchema as D, ObjectChangeType as Da, RichTextScript as Dc, NO_ANNOTATION_FLAGS as Dd, PageTextLayout as Di, PdfOriginSize as Dl, HighlightPatchSchema as Dn, PushButtonFieldDTO as Do, PageInsertBlankSpec as Dr, FilledStyleDraftFields as Ds, LinePatchSchema as Dt, SignatureDTO as Du, WidgetDraft as E, ObjectChangeKind as Ea, RichTextRunStyle as Ec, LineEndings as Ed, SearchSnippet as Ei, sliceTextByChars as El, HighlightDraftSchema as En, ListBoxFieldDTO as Eo, PAGE_INSERT_BLANK_MAX_COUNT as Er, ColorStylePatchFields as Es, LineDraftSchema as Et, SignatureCoverage as Eu, StampDTOSchema as F, RevisionStructure as Fa, SessionKind as Fc, TextAlignment as Fd, textGlyphAt as Fi, pdfRectSize as Fl, formatMeasurement as Fn, AnnotationDeleteResult as Fo, AnnotationFlattenItemResult as Fr, AttachmentFileInfo as Fs, PolylineAnnotationDTO as Ft, SignedDocumentPolicy as Fu, TextDTOSchema as G, FormSubmissionReceipt as Ga, AnnotationAppearanceRenderOptions as Gc, ActionReadBudget as Gd, FormWidgetLinkResult as Gi, OpenInput as Gl, measurementPoint as Gn, invalidatesWeakIndexRefs as Go, PageMoveCache as Gr, sniffBinaryMetadata as Gs, VertexPatchFields as Gt, decodeFieldRefKey as Gu, StampFit as H, FormFieldDisplay as Ha, AnnotationAppearanceManifestEntry as Hc, PdfRect as Hd, FormImportResult as Hi, NamedPageEntry as Hl, isReadout as Hn, semanticEqual as Ho, PageNameResult as Hr, normalizeAnnotationPatch as Hs, PolygonDraft as Ht, CachePins as Hu, StampWireDraftSchema as I, StepInput as Ia, DEFAULT_PDF_SAVE_MODE as Ic, CalloutLine as Id, textGlyphQuad as Ii, pdfRectToOriginSize as Il, validNumberFormat as In, AnnotationMoveResult as Io, AnnotationFlattenResult as Ir, AttachmentFileSource as Is, PolylineDraft as It, CacheDelta as Iu, TextPatch as J, FormSubmissionRequestSchema as Ja, PageImageBlobSource as Jc, PdfActionNode as Jd, fieldLockFor as Ji, OpenInputLayerBytes as Jl, scaleOf as Jn, RefetchReason as Jo, PageMoveInput as Jr, ResourceRef as Js, SquarePatchSchema as Jt, MissingIdentity as Ju, TextDraftSchema as K, FormSubmissionReceiptSchema as Ka, AnnotationAppearancesQuery as Kc, DocumentActionsSnapshot as Kd, SIGNATURE_POLICY_VERSION as Ki, OpenInputById as Kl, pathLength as Kn, shiftsExistingAnnotationIndices as Ko, PageMoveResult as Kr, BinaryPayload as Ks, SquareDTOSchema as Kt, encodeFieldRefKey as Ku, StampWirePatchSchema as L, StepVerdict as La, PdfSaveMode as Lc, InkList as Ld, textSegmentsForRange as Li, pdfRectWidth as Ll, DimensionInput as Ln, AnnotationUpdateResult as Lo, PageFlattenInput as Lr, EmbeddedFileItem as Ls, PolygonDTOSchema as Lt, MutationMeta as Lu, FileAttachmentPatch as M, RevisionAnalysis as Ma, FontIdentityInfo as Mc, Size as Md, buildPageTextLayout as Mi, pdfQuadFromCorners as Ml, assertPdfFloat as Mn, UnknownFieldDTO as Mo, PageRotateInput as Mr, GeometryStylePatchFields as Ms, PolylineDraftSchema as Mt, SignatureSigner as Mu, FileAttachmentAnnotationDTO as N, RevisionField as Na, FontKey as Nc, StandardFont as Nd, expandTextRangeToLine as Ni, pdfRectFromOriginSize as Nl, assertWritableMeasure as Nn, FormValueEntry as No, AnnotationAppearanceExportInput as Nr, AttachmentContent as Ns, PolylinePatchSchema as Nt, SignatureSnapshot as Nu, FileAttachmentIconSchema as O, ObjectReadStatus as Oa, richTextParagraphsFromPlainText as Oc, PdfRectDifferences as Od, PdfTextSegment as Oi, PdfQuadCorners as Ol, HighlightPatch as On, RadioFieldDTO as Oo, PageInsertResult as Or, FilledStyleFields as Os, LinePatch as Ot, SignatureKind as Ou, ResourceRefSchema as P, RevisionHealth as Pa, FontSpec as Pc, StrikeoutIntent as Pd, expandTextRangeToWord as Pi, pdfRectHeight as Pl, viewportForPoint as Pn, AnnotationCreateResult as Po, AnnotationFlattenInput as Pr, AttachmentFileBase as Ps, PolylinePatch as Pt, SignatureSubFilter as Pu, CaretDTOSchema as Q, ComboBoxFieldPatch as Qa, PageImageResult as Qc, PdfActionWarning as Qd, lockNameCovers as Qi, OpenOptions as Ql, measureFromRatio as Qn, ManifestPage as Qo, searchSegmentsForRange as Qr, ANNOTATION_SUBTYPES as Qs, CircleDTOSchema as Qt, PDF_BITS as Qu, StampPatch as R, FormEffect as Ra, AnnotationAppearanceImage as Rc, InkStroke as Rd, FormDataExport as Ri, PageListSnapshot as Rl, MeasurementReadout as Rn, AppearanceAction as Ro, PageFlattenItemResult as Rr, EmbeddedFileRef as Rs, PolygonDraftSchema as Rt, PageState as Ru, RedactAnnotationDTO as S, Assessment as Sa, RichTextMargins as Sc, FreeTextFont as Sd, SearchQuery as Si, boundaryTextOffset as Sl, UnderlinePatch as Sn, FormFieldFamily as So, RedactionApplyItemResult as Sr, FileAttachmentWireDraft as Ss, LinkPatch as St, SignatureAbortResult as Su, WidgetAnnotationDTO as T, ObjectChange as Ta, RichTextRun as Tc, LineEnding as Td, SearchSliceBudget as Ti, charRangeForTextOffsets as Tl, HighlightDTOSchema as Tn, FormFieldOrigin as To, RedactionApplyStatus as Tr, ColorStyleFields as Ts, LineDTOSchema as Tt, SignatureCompleteResult as Tu, StampWireDraft as U, FormSubmissionEntry as Ua, AnnotationAppearanceMode as Uc, PdfRotation as Ud, FormRepairResult as Ui, NamedPageTarget as Ul, measurementReadout as Un, AnnotationMutationKind as Uo, PageNameInput as Ur, BinaryMetadata as Us, VertexAnnotationFields as Ut, FormFieldRef as Uu, StampDraft as V, FormEffectsResult as Va, AnnotationAppearanceManifest as Vc, PdfQuad as Vd, FormFieldUpdateResult as Vi, PageRotation as Vl, isDimension as Vn, appearanceImpactOf as Vo, PageFlattenUsage as Vr, normalizeAnnotationDraft as Vs, PolygonAnnotationDTO as Vt, knownWeakAnnotationState as Vu, NoteIconSchema as W, FormSubmissionEntrySchema as Wa, AnnotationAppearanceRaster as Wc, PdfSize as Wd, FormSetValueResult as Wi, MetadataPatch as Wl, MeasuredScale as Wn, changesAnnotationList as Wo, PageRemoveNameInput as Wr, BinaryMimeType as Ws, VertexDraftFields as Wt, FormWidgetRef as Wu, NoteIcon as X, FormFieldValue as Xa, PageImageObjectUrl as Xc, PdfActionTree as Xd, levelFromPermission as Xi, OpenInputShare as Xl, MeasurementFormatOptions as Xn, PdfLinkTargetWritable as Xo, searchContentEpoch as Xr, WireResourceMap as Xs, SquareAnnotationDTO as Xt, parseScope as Xu, TextAnnotationDTO as Y, FormDataFormat as Ya, PageImageHandle as Yc, PdfActionTargetRef as Yd, levelAllows as Yi, OpenInputLayerSource as Yl, validAreaBoundary as Yn, PdfLinkTarget as Yo, canonicalSearchQuery as Yr, WireResource as Ys, SquarePatch as Yt, PermissionDenied as Yu, TextDraft as Z, CheckboxFieldPatch as Za, PageImageOptions as Zc, PdfActionType as Zd, lockCovers as Zi, OpenInputToken as Zl, measureFromKnownLength as Zn, DocumentManifest as Zo, searchRectsForRange as Zr, resolveBinarySource as Zs, SquareDraft as Zt, validateScopeArray as Zu, UnsupportedPatchSchema as _, parsePdfValue as _a, RichTextBody as _c, AnnotationFlags as _d, SearchMatchRange as _i, glyphLooseQuad as _l, SquigglyAnnotationDTO as _n, WidgetStylePatchFields as _o, PolylineIntent as _r, AttachmentDeleteResult as _s, LinkDraftSchema as _t, DocumentVersionRef as _u, AnnotationDTOSchema as a, worstVerdict as aa, AnnotationBase as ac, IdentityClaims as ad, PdfDestination as af, SearchRegexIssue as ai, PageRenderOptions as al, ShapeDraftFields as an, FormFieldDraft as ao, LineCaptionPatch as ar, buildCommentThreads as as, FreeTextDraftSchema as at, checkAnyCapability as au, UnsupportedAnnotationDTO as b, stableStringify as ba, RichTextDocument as bc, CaretIntent as bd, SearchMatch as bi, CharBoundaryBias as bl, UnderlineDraftSchema as bn, FormFieldBase as bo, MetadataCache as br, FileAttachmentDraft as bs, PdfLinkTargetWritableSchema as bt, ModificationLevel as bu, AnnotationKind as c, EdgeResolverBudget as ca, decodeStableIdKey as cc, ParsedScope as cd, DocumentMetadata as cf, validateSearchQuery as ci, PageRenderViewport as cl, StrikeoutDraftSchema as cn, RadioFieldDraft as co, LineLeader as cr, AnnotationThread as cs, FreeTextAnnotationDTO as ct, checkSetGroup as cu, AnnotationSubtypeOfKind as d, restrictionsFor as da, EngineErrorOptions as dc, PdfBits as dd, matchLiteral as di, PageGeometryRun as dl, StrikeoutAnnotationDTO as dn, FormKind as do, PdfForeignMeasure as dr, refKey as ds, InkDraftSchema as dt, filterMatches as du, protectedCapabilities as ea, PDF_CODE_TO_SUBTYPE as ec, AnnotationActor as ed, PdfFieldActions as ef, buildSnippet as ei, PageNetworkRenderFormat as el, CirclePatchSchema as en, ListBoxFieldPatch as eo, LengthUnit as er, LayerScopes as es, CaretPatchSchema as et, caps as eu, KIND_BY_SUBTYPE as f, evaluateStep as fa, SerializedEngineError as fc, AnnotationDraftBase as fd, wordAt as fi, PageGeometrySnapshot as fl, StrikeoutDraft as fn, FormSnapshot as fo, PdfMeasure as fr, AnnotationKindModule as fs, InkPatchSchema as ft, BaseVersionInfo as fu, UnsupportedDraftSchema as g, dictEntries as ga, RichTextAlign as gc, AnnotationBorderStyle as gd, SEARCH_FOLD_VERSION as gi, glyphLooseBounds as gl, SquigglyPatch as gn, WidgetStyleFields as go, PolygonIntent as gr, AttachmentCreateResult as gs, LinkDTOSchema as gt, DocumentProtection as gu, UnsupportedDTOSchema as h, changedKeys as ha, EngineErrorCode as hc, revisionTokensEqual as hd, FoldedText as hi, UprightGeometryRun as hl, SquigglyPatchSchema as hn, WidgetStyleDraftFields as ho, PdfViewport as hr, PatchOfKind as hs, InkDraft as ht, DocumentFieldLock as hu, AnnotationDTO as i, primaryFinding as ia, AnnotationPatchBase as ic, DocCapability as id, decodeSubmitFormFlags as if, SearchQueryValidation as ii, PageRenderFormat as il, ShapeAnnotationFields as in, ComboBoxFieldDraft as io, squareOf as ir, ReviewStatus as is, FreeTextDTOSchema as it, CollabTarget as iu, WireAttachmentFileSchema as j, RestrictionAnchor as ja, FontHandle as jc, Rotation as jd, TextLayoutRun as ji, pdfQuadCorners as jl, PageScaleResult as jn, ToggleFieldWidget as jo, PageRotateResult as jr, GeometryStyleFields as js, PolylineDTOSchema as jt, SignatureSeedValue as ju, FileAttachmentPatchSchema as k, ObjectReferrer as ka, richTextPlainText as kc, Point as kd, TextLayoutFrame as ki, normalizePdfRect as kl, HighlightAnnotationDTO as kn, SignatureFieldDTO as ko, PageDeleteResult as kr, FilledStylePatchFields as ks, LineAnnotationDTO as kt, SignaturePrepareInput as ku, AnnotationPatch as l, ResolvedUsage as la, encodeStableIdKey as lc, ParsedVirtual as ld, DocumentMetadataTrapped as lf, validateSearchRegex as li, createPageImageHandle as ll, StrikeoutPatchSchema as ln, TextFieldDraft as lo, MeasureFraction as lr, buildThreads as ls, FreeTextDraft as lt, expandRawScope as lu, WireAnnotationPatch as m, sameEffectiveValue as ma, serializeError as mc, RevisionToken as md, FoldOptions as mi, RotatedGeometryRun as ml, SquigglyDraftSchema as mn, WidgetAppearanceSchema as mo, PdfNumberFormat as mr, DraftOfKind as ms, InkAnnotationDTO as mt, DocMdpPermission as mu, AnnotationListSnapshotAllPages as n, combine as na, PdfAnnotationSubtypeCode as nc, CollabEntity as nd, SubmitFormFlags as nf, SEARCH_REGEX_MAX_LENGTH as ni, PageRenderBackground as nl, CircleAnnotationDTO as nn, TextFieldPatch as no, areaUnitLabel as nr, CommentThread as ns, CaretAnnotationDTO as nt, materializePdfPermissions as nu, AnnotationDraft as o, DEFAULT_EDGE_RESOLVER_BUDGET as oa, AnnotationIdentityQuality as oc, ParsedCapability as od, PageObjectNumber as of, SearchRegexValidation as oi, PageRenderQuery as ol, ShapePatchFields as on, FormFieldOptionInput as oo, LineDimensionCaption as or, isStateAnnotation as os, FreeTextPatchSchema as ot, checkCapability as ou, WireAnnotationDraft as p, restrictionsOf as pa, deserializeError as pc, AnnotationRef as pd, wordBefore as pi, RotatedGeometryGlyph as pl, SquigglyDTOSchema as pn, WidgetAppearance as po, PdfMeasurement as pr, DTOOfKind as ps, InkPatch as pt, DigestAlgorithm as pu, TextPatchSchema as q, FormSubmissionRequest as qa, AnnotationAppearancesResult as qc, NamedJavaScriptAction as qd, deriveProtection as qi, OpenInputBytes as ql, polygonArea as qn, AnnotationListMutationMeta as qo, PageStructureCache as qr, BinarySource as qs, SquareDraftSchema as qt, InvalidScope as qu, ANNOTATION_KINDS as r, conclude as ra, subtypeFromCode as rc, CollabFilter as rd, SubmitFormPayload as rf, SearchQueryIssue as ri, PageRenderEncodedFormat as rl, CircleDraft as rn, CheckboxFieldDraft as ro, squareMetres as rr, CommentThreadReview as rs, CaretDraft as rt, pdfPermissions as ru, AnnotationDraftSchema as s, EdgeResolver as sa, AnnotationStableId as sc, ParsedCollab as sd, isValidPageObjectNumber as sf, matchRegex as si, PageRenderTarget as sl, StrikeoutDTOSchema as sn, ListBoxFieldDraft as so, LineIntent as sr, AnnotationRelationKind as ss, FreeTextPatch as st, checkCollab as su, AnnotationListPageSnapshot as t, assessmentOf as ta, PDF_SUBTYPE_TO_CODE as tc, CollabAction as td, PdfPageActions as tf, matchPageText as ti, PageRaster as tl, CirclePatch as tn, RadioFieldPatch as to, METRES as tr, BuildCommentThreadsOptions as ts, CaretPatch as tt, collab as tu, AnnotationPatchSchema as u, USAGE_INCOMPLETE as ua, EngineError as uc, ParsedWildcard as ud, foldOptionsFor as ui, PageGeometryGlyph as ul, StrikeoutPatch as un, WidgetPlacement as uo, PageMeasurementViewport as ur, classifyRelation as us, InkDTOSchema as ut, expandedCapabilities as uu, UnsupportedPatch as v, pdfValueEquals as va, RichTextDecoration as vc, AnnotationReplyType as vd, foldText as vi, isRotatedGeometryRun as vl, SquigglyDraft as vn, CheckboxFieldDTO as vo, ShapeCaptionPatch as vr, AttachmentsCache as vs, LinkPatchSchema as vt, FieldLockAction as vu, WidgetPatch as w, ChangeFinding as wa, RichTextParagraphProps as wc, InkIntent as wd, SearchSlice as wi, charMapViolation as wl, UnderlineDraft as wn, FormFieldOption as wo, RedactionApplyScope as wr, ColorStyleDraftFields as ws, LinkDraft as wt, SignatureCompleteInput as wu, RedactPatch as x, AnalyzeInput as xa, RichTextDocumentInput as xc, Color as xd, SearchMode as xi, CharMapAnchor as xl, UnderlinePatchSchema as xn, FormFieldDTO as xo, MetadataUpdateResult as xr, FileAttachmentIcon as xs, PdfDestinationSchema as xt, PdfRevision as xu, UnsupportedDraft as y, refsOf as ya, RichTextDirection as yc, BlendMode as yd, toOriginalRange as yi, PageTextSnapshot as yl, UnderlineDTOSchema as yn, ComboBoxFieldDTO as yo, ShapeDimensionCaption as yr, normalizeAttachmentFileSource as ys, PdfLinkTargetSchema as yt, FieldLockSpec as yu, StampWirePatch as z, FormEffectResult as za, AnnotationAppearanceImageOptions as zc, LinePoints as zd, FormFieldCreateResult as zi, PageBoxes as zl, MeasurementUnavailable as zn, AppearanceImpact as zo, PageFlattenResult as zr, NormalizedDraft as zs, PolygonPatchSchema as zt, UNKNOWN_WEAK_ANNOTATION_STATE as zu };
+//# sourceMappingURL=AnnotationListSnapshot-D9R5n2Kf.d.cts.map