@embedpdf/engine-core 3.0.0-next.13 → 3.0.0-next.15

package/dist/conformance.d.ts

@@ -1,5 +1,5 @@
-import { $u as PdfRect, An as HighlightDraft, Ju as InkList, Mc as CharMapAnchor, Xu as LinePoints, Zu as PdfPoint, n as AnnotationListSnapshotAllPages, t as AnnotationListPageSnapshot, yd as DocumentMetadata } from "./AnnotationListSnapshot-D3mFut1e.js";
-import { t as Engine } from "./Engine-DxtpCYcP.js";
+import { E_ as Identity, Ep as CharMapAnchor, Jg as PdfRect, Nd as AnnotationResources, Ng as PageBox, Pg as PagePoint, Wm as PageTabOrder, Yg as PdfRotation, _t as LineDraft, _v as DocumentMetadata, bs as AnnotationDraft, dn as HighlightDraft, nt as InkDraft, t as AnnotationList } from "./AnnotationList-CkijRHet.js";
+import { _ as Engine, t as LocalEngine, y as DocumentHandle } from "./LocalEngine-DPriFujS.js";
 //#region src/conformance/runMetadataConformance.d.ts
 interface ConformanceTestRunner {
   describe(name: string, fn: () => void): void;
@@ -54,6 +54,10 @@ interface ConformanceOptions {
  */
 declare function runMetadataConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
 //#endregion
+//#region src/conformance/runMeasurementConformance.d.ts
+/** Shared numerical, persistence and calibration contract for local and HTTP engines. */
+declare function runMeasurementConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
+//#endregion
 //#region src/conformance/runAnnotationReadConformance.d.ts
 /**
  * Expected per-fixture annotation knowledge. The harness asserts against
@@ -86,10 +90,10 @@ interface AnnotationReadConformanceFixture extends ConformanceFixture {
   /** At least this many `'caret'` annotations on the page. Defaults to 0. */
   minCaretCount?: number;
   /**
-   * `true` if the fixture has at least one weak annotation (no /NM, direct
-   * object). Drives the weak-ref + revision tests.
+   * `true` if the fixture page has at least one annotation born inline (a
+   * dictionary in `/Annots`, no object number). Drives the `baseIndex` tests.
    */
-  expectsWeakAnnotation: boolean;
+  expectsInlineAnnotation: boolean;
 }
 interface AnnotationConformanceOptions extends Omit<ConformanceOptions, 'fixture'> {
   fixture: AnnotationReadConformanceFixture;
@@ -103,7 +107,7 @@ interface ActionsConformanceFixtures {
   annotation: ConformanceFixture;
   field: ConformanceFixture;
   /** `action_payloads.pdf` — every executable payload shape on one page of
-   *  /NM-keyed links. REQUIRED on both flavours: payload parity is a gate. */
+   *  /NM-keyed links. Required on both flavours: payload parity is a gate. */
   payloads: ConformanceFixture;
   /** `open_action_dest.pdf` — a destination-form catalog `/OpenAction`. */
   openDestination: ConformanceFixture;
@@ -131,46 +135,37 @@ declare function runActionsConformance(runner: ConformanceTestRunner, opts: Acti
 interface AnnotationMutationConformanceFixture extends ConformanceFixture {
   /** PDF object number of the page used by the mutation tests. */
   pageObjectNumber: number;
-  /** Page already has at least one weak annotation (no /NM, direct object). */
-  expectsWeakAnnotation: boolean;
+  /** The page has at least one annotation born inline (a dictionary in `/Annots`, no object number). */
+  expectsInlineAnnotation: boolean;
   /**
-   * QuadPoints to use for the create() smoke test. Coordinates are in
-   * PDF user space; pick a small rectangle that fits anywhere on the
-   * fixture page so we don't flake on different page sizes.
+   * QuadPoints to use for the create() smoke test, in page space; pick a
+   * small rectangle that fits anywhere on the fixture page so we don't
+   * flake on different page sizes.
    */
   createQuad?: HighlightDraft['quadPoints'];
   /**
-   * `/Rect` to use for the shape (circle/square) create tests. PDF user
+   * The box to use for the shape (circle/square) create tests, in page
    * space; pick a small box that fits anywhere on the fixture page.
    */
-  createShapeRect?: PdfRect;
+  createShapeRect?: PageBox;
   /**
-   * `/Vertices` to use for the polygon/polyline create tests. PDF user
-   * space; must fit inside `createShapeRect` (the rect the engine bakes
-   * the appearance into). Defaults to a small triangle.
+   * `/Vertices` to use for the polygon/polyline create tests, in page
+   * space; must fit inside `createShapeRect`. Defaults to a small triangle.
    */
-  createVertices?: PdfPoint[];
+  createVertices?: PagePoint[];
   /**
-   * `/L` endpoints to use for the line create test. PDF user space; must
-   * fit inside `createShapeRect`. Defaults to the rect's diagonal.
+   * `/L` endpoints to use for the line create test, in page space; must fit
+   * inside `createShapeRect`. Defaults to the rect's diagonal.
    */
-  createLinePoints?: LinePoints;
+  createLinePoints?: LineDraft['linePoints'];
   /**
-   * `/InkList` strokes to use for the ink create test. PDF user space; must
+   * `/InkList` strokes to use for the ink create test, in page space; must
    * fit inside `createShapeRect`. Defaults to a single short stroke.
    */
-  createInkList?: InkList;
+  createInkList?: InkDraft['inkList'];
 }
 interface AnnotationMutationConformanceOptions extends Omit<ConformanceOptions, 'fixture'> {
   fixture: AnnotationMutationConformanceFixture;
-  /**
-   * `true` for engines that expose the raw RGBA appearance rasters
-   * (`renderAppearances`). When set, the shape-create test additionally
-   * asserts that creating a shape produces a baked `/AP` the appearance
-   * reader can rasterize. The cloud engine ships encoded images instead
-   * and leaves this `false`.
-   */
-  supportsAppearanceRasters?: boolean;
 }
 /**
  * Mutation conformance suite. Mirrors the read suite: tests are written
@@ -179,22 +174,220 @@ interface AnnotationMutationConformanceOptions extends Omit<ConformanceOptions,
  * @cloudpdf/server) implementations must pass identically.
  *
  * The locked rules being verified here:
- *   - `create` is append-only: PDFium drops the new annotation at
- *     `index = previousCount`, so no existing index shifts. Treated
- *     as non-invalidating — revisions do NOT bump and weak refs
- *     captured before the create remain valid.
- *   - `update` is non-structural; revisions do NOT bump.
- *   - Opportunistic /NM stamp upgrades a weak annotation's ref to
- *     `kind: 'nm'` on update; an already-durable annotation's /NM is
- *     NEVER touched.
- *   - `delete` and `move` are the only index-shifting ops. They bump
- *     the per-page revision and, on a page that had weak refs before
- *     the mutation, surface `shouldRefetch: 'weakRefsInvalidated'`.
+ *   - `create` is append-only: the new annotation paints on top of the
+ *     page's others, and none of them moves.
+ *   - Every annotation keeps its name through every write: an object
+ *     number, or the `baseIndex` of one born inline in the file. No write
+ *     stamps an /NM to name one.
  *   - Abort propagates as `AbortError` even before the worker
  *     responds.
  */
 declare function runAnnotationMutationConformance(runner: ConformanceTestRunner, opts: AnnotationMutationConformanceOptions): void;
 //#endregion
+//#region src/conformance/runAnnotationAttributionConformance.d.ts
+/** Who a session is and what it may do: open-time options locally, token claims on the cloud. */
+interface AttributionSession {
+  readonly scope: ReadonlyArray<string>;
+  readonly identity: Identity;
+}
+interface AnnotationAttributionConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /**
+   * Open the authoring document, a document with annotations another tool
+   * wrote, as `session`. With `from`, the new session continues that open
+   * session's document and sees what it wrote (locally its downloaded bytes,
+   * on the cloud the same layer); the suite closes `from` afterwards.
+   */
+  openAs: (engine: Engine, session: AttributionSession, from?: DocumentHandle) => Promise<DocumentHandle>;
+}
+/**
+ * Attribution on both engines with the same identities:
+ * `create` stamps it from the session and ignores what the data says,
+ * `update` stamps only `modifiedAt` and `modifiedBy`, and a `groupId` other than
+ * the session's own passes the set-group check or is refused. The session's
+ * whole identity reaches `doc.security.identity`; only the name and the ids
+ * reach the annotation.
+ */
+declare function runAnnotationAttributionConformance(runner: ConformanceTestRunner, opts: AnnotationAttributionConformanceOptions): void;
+//#endregion
+//#region src/conformance/runAnnotationResourceConformance.d.ts
+/**
+ * The documents the suite opens, each a fresh copy:
+ *
+ * - `authoring`: any document; stamps are created on its first page.
+ * - `acrobat-stamps`: `stamp-opacity-acrobat.pdf`
+ *   (`packages/engine/main/test/fixtures`): two stamps Acrobat saved at about
+ *   30% opacity, each appearance `/R0 gs /MWFOForm Do` with /R0 repeating the
+ *   stamp's /CA.
+ * - `acrobat-rewrapped`: `stamp-rewrapped-acrobat.pdf`, stamps as EmbedPDF
+ *   writes them after other tools edited them: `rewrapped-a`, turned 30
+ *   degrees and set to 60% in Acrobat, under Acrobat's layer and four forms
+ *   that only draw our wrapper; `rewrapped-b`, set to 100% in Acrobat, under
+ *   one such form; `rewrapped-c`, our 35% layer with /CA dropped, 300 x 120.
+ *   Each draws a 200 x 100 drawing, opaque where it paints.
+ * - `acrobat-roundtrip-60`, `acrobat-roundtrip-100`:
+ *   `stamp-roundtrip-acrobat-{60,100}.pdf`, an "Approved" stamp made in the
+ *   viewer, turned and set to 40%, then set to 60% and to 100% in Acrobat
+ *   26.2. Acrobat moves the form around our wrapper by 0.0008 pt, its box a
+ *   fraction off the origin in its own arithmetic.
+ */
+type AnnotationResourceFixture = 'authoring' | 'acrobat-stamps' | 'acrobat-rewrapped' | 'acrobat-roundtrip-60' | 'acrobat-roundtrip-100';
+interface AnnotationResourceConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh copy of a fixture, with `doc.download` among its scopes. */
+  open: (engine: Engine, fixture: AnnotationResourceFixture) => Promise<DocumentHandle>;
+  /** Open a fresh copy of a fixture with `scope` only: the import's rights tests run with it. */
+  openScoped?: (engine: Engine, fixture: AnnotationResourceFixture, scope: readonly string[]) => Promise<DocumentHandle>;
+}
+/**
+ * Resources beside an annotation's data, on both engines: `downloadResource`
+ * returns what `create(data, resources)` needs to make the same annotation
+ * again. A stamp's appearance is its drawing without the fit, rotation and
+ * opacity its data describes; a stamp another tool made is drawn as shown,
+ * in its own box, without a layer that only repeats its /CA. Stamps with
+ * the same artwork place one drawing. The opacity is painted once:
+ * in a copy, after a resize, and after a change.
+ */
+declare function runAnnotationResourceConformance(runner: ConformanceTestRunner, opts: AnnotationResourceConformanceOptions): void;
+//#endregion
+//#region src/conformance/runAnnotationExportConformance.d.ts
+/**
+ * `doc.annotations.export` on both engines: the annotations as a raw read
+ * returns them, each resource once under its hash, the same bytes
+ * `downloadResource` returns, and a selection with what it points at and, by
+ * default, its threads.
+ */
+declare function runAnnotationExportConformance(runner: ConformanceTestRunner, opts: AnnotationResourceConformanceOptions): void;
+//#endregion
+//#region src/conformance/runAnnotationImportConformance.d.ts
+/**
+ * `doc.annotations.import` on both engines, in `stamp` mode: a bundle comes
+ * back as the export had it, one fact per annotation as one transaction,
+ * what can't be carried left out and reported, pages mapped, and a refusal
+ * before anything is written. An import is a change: undone and redone with
+ * `doc.apply({ undoOf })`, answered again on a retry, and a restoring
+ * import's undo takes the import's rights.
+ */
+declare function runAnnotationImportConformance(runner: ConformanceTestRunner, opts: AnnotationResourceConformanceOptions): void;
+//#endregion
+//#region src/conformance/runAnnotationTransferConformance.d.ts
+interface AnnotationTransferConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /**
+   * The documents to round-trip. `'authoring'` is a document without
+   * annotations, which the suite fills with one annotation of every kind a
+   * create makes, two stamps sharing a drawing, a named comment with its
+   * popup and a reply, and a link.
+   */
+  fixtures: readonly string[];
+  /** Open a fresh copy of a fixture, with every scope, `doc.annotate.import` included. */
+  open: (engine: Engine, fixture: string) => Promise<DocumentHandle>;
+}
+/**
+ * Check annotation transfer over every fixture on both engines. The source
+ * bundle is imported into a copy without annotations, then exported again:
+ *
+ * - The normalized exports agree after unsupported fields are dropped, and
+ *   every resource has the same bytes under the same id. A copy is drawn from
+ *   its data, as Acrobat's FDF and XFDF carry it: only a stamp carries its
+ *   drawing. So where the data is points, the box is the frame of our
+ *   drawing, which holds the points, and an icon's box is our icon at the
+ *   same anchor;
+ * - Restored attribution is the source's, while stamped attribution is
+ *   the session's;
+ * - Every page keeps the source bundle's annotation order;
+ * - Replies, popups, their parents and link destinations point at the copies;
+ * - A stamp draws as its source, and in our own file every kind does,
+ *   an edge moved by a fraction of a pixel aside (Acrobat moves a stamp's
+ *   form by a fraction of a point, which the drawing leaves out);
+ * - A second import names nothing twice and adds no drawing already present.
+ * Export golden files and forced-failure tests cover the remaining cases.
+ */
+declare function runAnnotationTransferConformance(runner: ConformanceTestRunner, opts: AnnotationTransferConformanceOptions): void;
+//#endregion
+//#region src/conformance/creatables.d.ts
+/** A create's two arguments. */
+interface Creatable {
+  data: AnnotationDraft;
+  resources?: AnnotationResources;
+}
+/** A note's or a file's icon at its usual 20 × 20, by its top-left corner. */
+declare function iconRect(x: number, y: number): PageBox;
+/** One create for every kind the engine can create, inside a box near the page's top-left. */
+declare function creatables(): Creatable[];
+//#endregion
+//#region src/conformance/runDateConformance.d.ts
+interface DateConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /**
+   * Open a fresh copy of `dates.pdf` (`packages/engine/main/test/fixtures`):
+   * one page (object 3) whose squares carry known `/CreationDate` and `/M`
+   * values, a file attachment annotation and an embedded file whose
+   * `/Params` carry dates, and an Info dictionary with dates.
+   */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+}
+/**
+ * Dates on both engines: a PDF date reads as ISO 8601 with the offset it was
+ * written with, a read written back is the same moment in the same zone, a
+ * write takes the string or a `Date`, and a date that isn't one reads `null`.
+ */
+declare function runDateConformance(runner: ConformanceTestRunner, opts: DateConformanceOptions): void;
+//#endregion
+//#region src/conformance/runAnnotationDeclarationConformance.d.ts
+interface AnnotationDeclarationFixture {
+  /** Stable id used for the local engine; cloud uses its own id. */
+  id: string;
+  /** Bytes for the local engine. */
+  bytes: () => Uint8Array | Promise<Uint8Array>;
+  /** Override the cloud-side id. Defaults to `id`. */
+  cloudId?: string;
+}
+interface AnnotationDeclarationConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Engine 'kind' for opening: 'bytes' for local, 'id' for cloud. */
+  openKind: 'bytes' | 'id';
+  /**
+   * A document without inline annotations. One annotation of every kind the
+   * engine can create is added to its first page, then read back.
+   */
+  authoring: AnnotationDeclarationFixture;
+  /** Documents whose annotations are read as they are. */
+  documents: readonly AnnotationDeclarationFixture[];
+  /** A document with a link whose target a write can't make (a script, a viewer command). */
+  readOnlyLink: AnnotationDeclarationFixture;
+}
+/**
+ * Every annotation both engines read, from real documents and freshly created
+ * ones, is checked against its kind declaration.
+ */
+declare function runAnnotationDeclarationConformance(runner: ConformanceTestRunner, opts: AnnotationDeclarationConformanceOptions): void;
+//#endregion
+//#region src/conformance/annotationReadDrift.d.ts
+/**
+ * Compares annotation reads with their kind declarations. Each difference is
+ * one line, `<field>: <problem> (<kinds>)`:
+ *
+ * - `missing`: the declaration has the field, the read doesn't;
+ * - `invalid`: the read has a value the declaration doesn't accept;
+ * - `undeclared`: the read has a field the declaration doesn't know.
+ *
+ * `<kinds>` is `every kind` when the difference holds for every kind read,
+ * otherwise the affected subtypes. Lines are sorted, so two engines reading
+ * the same documents produce the same list.
+ */
+declare function annotationReadDriftOf(reads: readonly unknown[]): string[];
+//#endregion
 //#region src/conformance/runFormConformance.d.ts
 /**
  * The three fixtures the forms suite needs. Shapes (names, object numbers,
@@ -206,7 +399,7 @@ declare function runAnnotationMutationConformance(runner: ConformanceTestRunner,
  *   `opt_check` (/Opt "Alpha", on-state "On"), hierarchical text field
  *   `billing.name`.
  * - `orphanWidgets` — orphan_widgets.pdf: `linked_text` in /AcroForm
- *   /Fields plus RECOVERED `orphan_check` and `orphan_radio`.
+ *   /Fields plus recovered `orphan_check` and `orphan_radio`.
  * - `choiceFields` — listbox_form.pdf: `Listbox_MultiSelect` (options
  *   Apple..), `Listbox_SingleSelect`.
  */
@@ -224,6 +417,12 @@ interface FormConformanceFixtures {
    * same bytes under a suffixed id the way the bytes transport does.
    */
   importTarget?: ConformanceFixture;
+  /**
+   * Another independent copy of `toggleFields`, whose merged field/widgets
+   * the delete test removes. Required for `openKind: 'id'` (cloud): the
+   * deletes are durable server state the other tests must not see.
+   */
+  deleteTarget?: ConformanceFixture;
 }
 interface FormConformanceOptions extends Omit<ConformanceOptions, 'fixture'> {
   fixtures: FormConformanceFixtures;
@@ -235,7 +434,7 @@ declare function runFormConformance(runner: ConformanceTestRunner, opts: FormCon
  * Per-fixture knowledge for the annotation appearance conformance suite. The
  * harness asserts thresholds (not exact wire content) so the same suite runs
  * unchanged against the local and cloud engines and proves they emit the same
- * set of appearances — including weak (index-only) annotations.
+ * set of appearances, including those of annotations born inline in the file.
  */
 interface AnnotationAppearanceConformanceFixture extends ConformanceFixture {
   /** PDF object number of the page whose appearances are rendered. */
@@ -243,21 +442,14 @@ interface AnnotationAppearanceConformanceFixture extends ConformanceFixture {
   /** At least this many `/AP` appearances are expected on that page. */
   minAppearanceCount: number;
   /**
-   * `true` when the page has at least one weak (index-only) annotation that
-   * carries an appearance stream. The whole point of this suite: that weak
-   * appearance must still be emitted (it used to be dropped on the wire).
+   * `true` when the page has at least one annotation born inline in the
+   * file (named by `baseIndex`) that carries an appearance stream: it must
+   * be emitted too, under that name.
    */
-  expectsWeakAppearance: boolean;
+  expectsInlineAppearance: boolean;
 }
 interface AnnotationAppearanceConformanceOptions extends Omit<ConformanceOptions, 'fixture'> {
   fixture: AnnotationAppearanceConformanceFixture;
-  /**
-   * `true` for engines that expose the raw RGBA rasters (`renderAppearances`).
-   * The local engine's encoder needs a browser Canvas, so under node it can
-   * only be exercised via the raw rasters; the cloud engine ships encoded
-   * images (`renderAppearanceImages`) and leaves this `false`.
-   */
-  supportsRawRasters?: boolean;
 }
 declare function runAnnotationAppearanceConformance(runner: ConformanceTestRunner, opts: AnnotationAppearanceConformanceOptions): void;
 //#endregion
@@ -269,43 +461,32 @@ declare function runAnnotationAppearanceConformance(runner: ConformanceTestRunne
  * harness can exercise reorder permutations meaningfully.
  */
 interface PageReorderConformanceFixture extends ConformanceFixture {
-  /** Stable, durable PONs of (at least) three distinct pages. Order
+  /** Stable, durable page object numbers of (at least) three distinct pages. Order
    *  here is the *intended caller-visible* order, not the on-disk
    *  order; the suite reads `pages.list()` first and works in document
    *  order. */
-  ponsForReorderTest?: number[];
-  /**
-   * Page used for the weak-ref-survival assertion. Defaults to the
-   * first PON in `ponsForReorderTest`. The fixture page must already
-   * have at least one weak annotation (no /NM, direct object) so the
-   * harness can capture an `index`-kind ref before the page move and
-   * re-use it after.
-   */
-  weakRefHostPon?: number;
-  /** Quad to use for the `create()` step that produces a stable ref
-   *  the suite uses. */
-  createQuad?: HighlightDraft['quadPoints'];
+  pageObjectNumbersForReorderTest?: number[];
 }
 interface PageReorderConformanceOptions extends Omit<ConformanceOptions, 'fixture'> {
   fixture: PageReorderConformanceFixture;
 }
 /**
  * Page reorder conformance suite. Verifies the architectural invariants
- * locked with the user, do NOT loosen these without re-reading
- * `PageMoveResult` and `DocumentPagesMutator`:
+ * locked with the user, do not loosen these without re-reading
+ * `PageReorderResult` and `DocumentPagesMutator`:
  *
  *   1. `pages.list()` returns every page in display order, addressed
  *      by indirect `pageObjectNumber`.
- *   2. `pages.move()` returns the full new order + geometry via
+ *   2. `pages.reorder()` puts the pages next to a neighbour (or at the start
+ *      or end) and returns the full new order + geometry via
  *      `result.layout` (the same shape `pages.list()` returns). There is
  *      no document-level revision; the wire never asks the caller for one.
- *   3. Index-based annotation refs survive a page reorder. This is the
- *      whole reason per-page revisions stay put across a move: a user
- *      shuffling pages mid-edit must not lose a pending highlight. (The
- *      "move never bumps a RevisionToken" invariant is asserted directly
- *      in the annotation mutation suite, where revision liveness lives.)
- *   4. Invalid inputs (duplicate PONs, unknown PONs, out-of-range
- *      `destIndex`) reject with `InvalidArg`.
+ *   3. Annotation names survive a page reorder: a user shuffling pages
+ *      mid-edit must not lose a pending highlight, so a `baseIndex` ref
+ *      captured before the reorder works after it.
+ *   4. A page named twice, or a neighbour that is one of the moved pages,
+ *      rejects with `InvalidArg`; an unknown page or neighbour with
+ *      `NotFound`.
  *   5. Abort propagates as `AbortError`.
  *
  * Both local (worker host + WASM) and cloud (HTTP + @cloudpdf/server)
@@ -316,17 +497,17 @@ declare function runPageReorderConformance(runner: ConformanceTestRunner, opts:
 //#region src/conformance/runPageRotateConformance.d.ts
 /**
  * Page rotate conformance suite. Verifies the architectural invariants —
- * do NOT loosen these without re-reading `PageRotateResult`:
+ * do not loosen these without re-reading `PageRotateResult`:
  *
- *   1. Rotation is ABSOLUTE and idempotent: `rotate(pons, 90)` twice is
+ *   1. Rotation is absolute and idempotent: `rotate(pons, 90)` twice is
  *      `rotate(pons, 90)` once. The wire never speaks "turn by".
- *   2. Rotation is presentation metadata over NORMALIZED content: the
+ *   2. Rotation is presentation metadata over normalized content: the
  *      layout's `width`/`height` stay un-rotated, order and identity are
- *      untouched, and per-page `RevisionToken`s survive (an index-based
- *      annotation ref captured before the rotate works after it).
+ *      untouched, and annotation names survive (a `baseIndex` ref captured
+ *      before the rotate works after it).
  *   3. The result returns the full new `layout`; a subsequent `list()`
  *      agrees with it.
- *   4. Invalid inputs (bad rotation value, duplicate PONs, unknown PONs)
+ *   4. Invalid inputs (bad rotation value, duplicate page object numbers, unknown page object numbers)
  *      reject with `InvalidArg` / `NotFound`.
  *   5. Abort propagates as `AbortError`.
  *
@@ -335,20 +516,248 @@ declare function runPageReorderConformance(runner: ConformanceTestRunner, opts:
  */
 declare function runPageRotateConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
 //#endregion
+//#region src/conformance/runAnnotationRotationConformance.d.ts
+type AnnotationRotationFixture =
+/** A one-page document without annotations. */
+'authoring' |
+/** A stamp Acrobat turned 36° clockwise: `/Rotate -36`, the turn in its appearance. */
+'acrobat-stamp-rotated' |
+/** A text box Acrobat added on a turned page (`/Rotate 90`), and one upright. */
+'acrobat-freetext-rotated';
+interface AnnotationRotationConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh copy of a fixture. */
+  open: (engine: Engine, fixture: AnnotationRotationFixture) => Promise<DocumentHandle>;
+}
+/**
+ * An annotation's `rotation` is degrees clockwise, as every rotation in the
+ * API, on both engines. What's drawn decides it: a turn another app made
+ * (Acrobat's `/Rotate` stamps and quarter-turned text boxes) reads as ours
+ * does, with the `box` the drawing turns, and a write keeps it. A turned
+ * box's `rect` is the upright box around all it draws, which the engine
+ * works out.
+ */
+declare function runAnnotationRotationConformance(runner: ConformanceTestRunner, opts: AnnotationRotationConformanceOptions): void;
+//#endregion
+//#region src/conformance/runPageRenderConformance.d.ts
+/**
+ * A 600 × 800 page cropped to [100 200 500 600], so its visible area does
+ * not start at 0,0, with a black square at 200..300 × 300..400 in file
+ * coordinates (the coordinates annotation rects use).
+ */
+declare const CROP_OFFSET_PDF: Uint8Array<ArrayBufferLike>;
+interface PageRenderConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh copy of {@link CROP_OFFSET_PDF}. */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+}
+/**
+ * Page images on both engines: an image reports the size of its pixels and
+ * where they are on the page (its transform, the one `pageTransform` gives
+ * without rendering), a target rect is in page space like every other place
+ * (so a page whose crop box doesn't start at 0,0 renders the area asked
+ * for), `blob()` is the image's bytes, and quality goes from 0 to 1.
+ */
+declare function runPageRenderConformance(runner: ConformanceTestRunner, opts: PageRenderConformanceOptions): void;
+//#endregion
+//#region src/conformance/pageSpaceFixtures.d.ts
+/**
+ * Small PDFs whose page boxes are odd in every way ISO 32000 allows, and in
+ * the ways broken files are odd, each with its answer written out by hand:
+ * the visible page box, the five boxes, the turn and the unit size. The
+ * answers come from the standard, never from our code, so a check against
+ * them is a check of our code:
+ *   - ISO 32000-1 Table 30 and §7.7.3.4: which boxes a page inherits;
+ *   - ISO 32000-1 §7.9.5: a box's corners in any order;
+ *   - ISO 32000-1 §14.11.2: the defaults, and every box inside the media box.
+ * For broken files the standard has no answer; those carry our rule and say
+ * so.
+ *
+ * Each page draws black squares (`marks`) and words at known places in file
+ * coordinates, so a render shows where the page's corner really is.
+ */
+/** A word drawn in Helvetica, its baseline starting at `x, y` (file coordinates). */
+interface PageSpaceWord {
+  text: string;
+  x: number;
+  y: number;
+  size: number;
+}
+/** A destination: a spot on a page of the same file, as the file writes it, with its answer. */
+interface PageSpaceGoTo {
+  /** The index of the page it goes to. */
+  toPage: number;
+  /** The destination array after the page reference, as the file writes it. */
+  view: string;
+  /**
+   * The destination measured from the top-left of the target page's visible
+   * box (x from its left edge, y from its top edge); `null` keeps the current
+   * value.
+   */
+  expected: {
+    kind: 'xyz' | 'fitH' | 'fitV' | 'fitR';
+    x?: number | null;
+    y?: number | null;
+    width?: number;
+    height?: number;
+  };
+}
+/** A link on a page to a spot on another page of the same file. */
+interface PageSpaceLink extends PageSpaceGoTo {
+  /** Where the link sits, in file coordinates. */
+  rect: PdfRect;
+}
+interface PageSpaceBoxes {
+  media: PdfRect;
+  crop: PdfRect;
+  bleed: PdfRect;
+  trim: PdfRect;
+  art: PdfRect;
+}
+interface PageSpaceFixturePage {
+  /** The page dictionary's own entries: boxes, `/Rotate`, `/UserUnit`. */
+  entries: string;
+  marks: PdfRect[];
+  words: PageSpaceWord[];
+  links?: PageSpaceLink[];
+  /** The page's open action (`/AA /O`): a go-to. */
+  openAction?: PageSpaceGoTo;
+  expected: {
+    /** The visible page box: what the page shows, in file coordinates. */
+    visible: PdfRect;
+    /** The five boxes as ISO defines them: defaults applied, reduced to the media box. */
+    boxes: PageSpaceBoxes;
+    rotation: PdfRotation;
+    userUnit: number;
+    /** The order its annotations take focus in (`/Tabs`); none when the page sets none. */
+    tabOrder?: PageTabOrder;
+  };
+}
+interface PageSpaceFixture {
+  name: string;
+  /** The rule the fixture checks. */
+  about: string;
+  /**
+   * `iso`: the answers are the standard's. `recovery`: the file is broken and
+   * the answers are our rule, which is what Acrobat shows.
+   */
+  source: 'iso' | 'recovery';
+  /** Entries of the page tree node, inherited by pages that don't set them. */
+  treeEntries?: string;
+  /** The catalog's `/OpenAction` as a destination: where the document opens. */
+  openDestination?: PageSpaceGoTo;
+  /** A text field on the first page whose calculate script goes on (`/Next`) to a destination. */
+  fieldAction?: PageSpaceGoTo;
+  pages: PageSpaceFixturePage[];
+  bytes: Uint8Array;
+}
+declare const PAGE_SPACE_FIXTURES: readonly PageSpaceFixture[];
+//#endregion
+//#region src/conformance/runPageSpaceConformance.d.ts
+interface PageSpaceConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh copy of `fixture`. */
+  open: (engine: Engine, fixture: PageSpaceFixture) => Promise<DocumentHandle>;
+  /** Only these fixtures (by name); all when left out. */
+  only?: readonly string[];
+}
+/**
+ * Where things really are on a page, checked against what the renderer
+ * draws. An unturned render starts at the top-left of the visible page, so a
+ * position measured from there, times the scale, is a pixel. The fixtures
+ * write their answers out by hand from ISO 32000; this suite converts the
+ * engine's values with those answers, never with engine code, so it checks
+ * the engine's boxes, the renderer and every position the API returns.
+ */
+declare function runPageSpaceConformance(runner: ConformanceTestRunner, opts: PageSpaceConformanceOptions): void;
+//#endregion
+//#region src/conformance/runColorConformance.d.ts
+/**
+ * One page with a square whose border color the file stores as gray
+ * (`/C [0.5]`) and whose fill it stores as CMYK (`/IC [0 0 0 1]`).
+ */
+declare const COLOR_FIXTURE_PDF: Uint8Array<ArrayBufferLike>;
+interface ColorConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open {@link COLOR_FIXTURE_PDF}, fresh for each call. */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+}
+/**
+ * Colors are `'#rrggbb'`: lowercase when the engine gives one, either case
+ * when it takes one. A gray or CMYK color reads as its sRGB equivalent and,
+ * sent back unchanged, stays as the file stores it.
+ */
+declare function runColorConformance(runner: ConformanceTestRunner, opts: ColorConformanceOptions): void;
+//#endregion
+//#region src/conformance/runAppearanceStatesConformance.d.ts
+/**
+ * One 200 × 200 page with a check box that is off and stores every mode:
+ * normal Yes red and Off green, down Yes blue and Off yellow, rollover Yes
+ * black. Beside it, a square whose normal appearance is one stream (cyan).
+ * Each appearance fills its box, so a picture's middle names its state.
+ */
+declare const APPEARANCE_STATES_FIXTURE_PDF: Uint8Array<ArrayBufferLike>;
+interface AppearanceStatesConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open {@link APPEARANCE_STATES_FIXTURE_PDF}, fresh for each call. */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+}
+/**
+ * Appearance states and modes, and form fields in page renders, the same on
+ * every engine. A page's appearance batch holds every appearance an
+ * annotation stores: each mode it has, and every state of each mode, each
+ * image labelled with both, whatever `/AS` says. The annotation's
+ * `appearanceState` says which state it shows. Each family has its own
+ * batch: `page.annotations` the square's, `page.forms` the check box's, and
+ * neither holds the other's. A page picture draws what its two options ask
+ * for, the annotations and the form fields, each without the other.
+ */
+declare function runAppearanceStatesConformance(runner: ConformanceTestRunner, opts: AppearanceStatesConformanceOptions): void;
+//#endregion
+//#region src/conformance/runDrawingDetailsConformance.d.ts
+/**
+ * One 300 × 300 page with what other apps write and the engine only reads:
+ * a typewriter box (`/IT /FreeTextTypeWriter`) and a square with a beveled
+ * border.
+ */
+declare const DRAWING_FIXTURE_PDF: Uint8Array<ArrayBufferLike>;
+/** The fixtures the suite opens: its own, and Acrobat's text boxes (`freetext-rotated-acrobat.pdf`). */
+type DrawingDetailsFixture = 'drawing' | 'acrobat-freetext';
+interface DrawingDetailsConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** A fresh copy of `fixture` for each call: the tests write to their documents. */
+  open: (engine: Engine, fixture: DrawingDetailsFixture) => Promise<DocumentHandle>;
+}
+/**
+ * How annotations draw and what a write takes: free text colors and
+ * defaults, dashes, the points a shape needs, printing, a note's `open` and
+ * its popup, and links.
+ */
+declare function runDrawingDetailsConformance(runner: ConformanceTestRunner, opts: DrawingDetailsConformanceOptions): void;
+//#endregion
 //#region src/conformance/runPageDeleteConformance.d.ts
 /**
  * Page delete conformance suite. Verifies the architectural invariants —
- * do NOT loosen these without re-reading `PageDeleteResult`:
+ * do not loosen these without re-reading `PageDeleteResult`:
  *
  *   1. `pages.delete()` removes exactly the listed pages and returns the
  *      full surviving layout; a subsequent `list()` agrees.
- *   2. Deleted PONs are RETIRED: addressing a deleted page afterwards is a
+ *   2. Deleted page object numbers are retired: addressing a deleted page afterwards is a
  *      clean `NotFound` (an API-level error, never native-memory danger).
- *   3. SURVIVING pages keep identity and `RevisionToken`s — an index-based
- *      annotation ref on an unrelated page survives a neighbour's deletion.
+ *   3. Surviving pages keep identity, and their annotations keep their
+ *      names — a `baseIndex` ref survives a neighbour's deletion.
  *   4. Deleting every page is rejected (`InvalidArg`) — a document keeps at
  *      least one page.
- *   5. Duplicate / unknown PONs reject with `InvalidArg` / `NotFound`;
+ *   5. Duplicate / unknown page object numbers reject with `InvalidArg` / `NotFound`;
  *      abort propagates as `AbortError`.
  *
  * Both local (worker host + WASM) and cloud (HTTP + @cloudpdf/server)
@@ -358,7 +767,7 @@ declare function runPageDeleteConformance(runner: ConformanceTestRunner, opts: C
 //#endregion
 //#region src/conformance/runNamedPagesConformance.d.ts
 /**
- * Named-pages conformance: the catalog's `/Names /Pages` registry as LAYOUT
+ * Named-pages conformance: the catalog's `/Names /Pages` registry as layout
  * data. Locks the invariants both engines must share — do not loosen
  * without re-reading `NamedPageEntry` and `PageNameResult`:
  *
@@ -366,7 +775,7 @@ declare function runPageDeleteConformance(runner: ConformanceTestRunner, opts: C
  *      registration resolves to a page in `pages`, a template, or is
  *      reported dangling — never silently dropped.
  *   2. `pages.setName()` creates or replaces by decoded key (idempotent),
- *      `replace` renames in one job, and the result IS the new layout.
+ *      `replace` renames in one job, and the result is the new layout.
  *   3. `pages.removeName()` drops the registration and nothing else.
  *   4. Deleting a page removes every registration pointing at it — inside
  *      the delete, with no plugin in the loop.
@@ -393,7 +802,7 @@ declare function runAnnotationFlattenConformance(runner: ConformanceTestRunner,
 //#region src/conformance/runAnnotationAppearanceExportConformance.d.ts
 /**
  * `page(pon).annotations.exportAppearance(refs)`: the chosen annotations'
- * appearances as ONE single-page PDF sized to their union /Rect. Locks:
+ * appearances as one single-page PDF sized to their union /Rect. Locks:
  *   1. bytes are a PDF; the source page is untouched (no mutation, no
  *      revision bump);
  *   2. re-opened (local engines), the page is exactly the union size and the
@@ -408,30 +817,39 @@ declare function runAnnotationAppearanceExportConformance(runner: ConformanceTes
 declare function runPageFlattenConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
 //#endregion
 //#region src/conformance/runRedactionApplyConformance.d.ts
+/**
+ * One 300-point page with neither /Contents nor /Resources, as some
+ * generators write a blank page.
+ */
+declare const BARE_PAGE_FIXTURE_PDF: Uint8Array<ArrayBufferLike>;
+interface RedactionApplyConformanceOptions extends ConformanceOptions {
+  /** Open {@link BARE_PAGE_FIXTURE_PDF}, fresh for each call, with write access. */
+  openBarePage: (engine: Engine) => Promise<DocumentHandle>;
+}
 /**
  * Transport-neutral coverage for the destructive redaction-apply rail.
- * Runs against a fixture page with NO pre-existing annotations so the
+ * Runs against a fixture page with no pre-existing annotations so the
  * collateral counts are exact. Content-removal fidelity itself is pinned by
  * the native embeddertests; this suite pins the transport contract: scopes,
- * statuses, counts, revision bumps, events, and preflight rejection.
+ * statuses, counts, affected pages, events, and preflight rejection.
  */
-declare function runRedactionApplyConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
+declare function runRedactionApplyConformance(runner: ConformanceTestRunner, opts: RedactionApplyConformanceOptions): void;
 //#endregion
 //#region src/conformance/runPageExtractConformance.d.ts
 /**
- * Page extract conformance suite. `pages.extract?` is OPTIONAL on the
+ * Page extract conformance suite. `pages.extract?` is optional on the
  * contract (the `downloadLayer?` pattern) — the suite runs only when the
  * implementation provides it, so a cloud engine that has not shipped the
  * server endpoint yet skips cleanly instead of failing.
  *
  * Invariants:
  *   1. `pages.extract([pon])` returns standalone PDF bytes (magic header).
- *   2. The SOURCE document is untouched: identical layout before/after,
+ *   2. The source document is untouched: identical layout before/after,
  *      and page revisions do not bump (extract is a read).
  *   3. Caller order is preserved and page geometry survives the copy
  *      (asserted by re-opening the extracted bytes — bytes-open engines
  *      only, since a cloud engine cannot re-open loose bytes).
- *   4. Empty / duplicate PONs reject `InvalidArg`; unknown PONs reject
+ *   4. Empty / duplicate page object numbers reject `InvalidArg`; unknown page object numbers reject
  *      `NotFound` (or `InvalidArg`); abort propagates as `AbortError`.
  */
 declare function runPageExtractConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
@@ -439,12 +857,12 @@ declare function runPageExtractConformance(runner: ConformanceTestRunner, opts:
 //#region src/conformance/runAttachmentConformance.d.ts
 /**
  * Attachment conformance suite. Fixture requirement: a document whose
- * `/EmbeddedFiles` name tree contains AT LEAST ONE embedded file.
+ * `/EmbeddedFiles` name tree contains at least one embedded file.
  *
- * Both attachment surfaces are OPTIONAL on the contract (the
+ * Both attachment surfaces are optional on the contract (the
  * `downloadLayer?` pattern), probed independently and skipped cleanly:
  *   - `doc.attachments?` — document-level EmbeddedFiles (list/download)
- *   - `page.annotations.downloadFile?` — annotation-level file bytes
+ *   - `page.annotations.downloadResource(ref, 'file')` — annotation-level file bytes
  *
  * Invariants:
  *   1. `list()` reflects the name tree: positional indices, non-empty
@@ -454,83 +872,335 @@ declare function runPageExtractConformance(runner: ConformanceTestRunner, opts:
  *   3. Unknown indices reject with an `EngineError`.
  *   4. A created file-attachment annotation round-trips its file:
  *      metadata inline on the DTO (never bytes), bytes byte-identical
- *      through `downloadFile(ref)`.
+ *      as its `file` resource.
  *   5. A created text (sticky-note) annotation round-trips icon + color.
  */
 declare function runAttachmentConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
 //#endregion
 //#region src/conformance/runPageInsertConformance.d.ts
-/**
- * Page insert conformance. `pages.insert` is a REQUIRED member — this suite
- * runs unconditionally on every engine, so an implementation that loses the
- * verb fails loudly instead of being skipped past.
- *
- * Invariants:
- *   1. Every page of the source bytes is COPIED in at `destIndex` (omitted →
- *      append), in source order; the result lists the fresh PONs in
- *      insertion order and they agree with the returned layout.
- *   2. Pre-existing pages keep their identity: same PONs before and after,
- *      in the expected positions (an insert never invalidates neighbours).
- *   3. The mutation persists through save → re-open (bytes engines only).
- *   4. Empty bytes / malformed bytes / out-of-range destIndex reject with
- *      InvalidArg / MalformedPdf, leaving the document untouched.
- */
 declare function runPageInsertConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
 //#endregion
 //#region src/conformance/runPageInsertBlankConformance.d.ts
 /**
- * Blank-page insert conformance. `pages.insertBlank` is a REQUIRED member —
+ * Blank-page insert conformance. `pages.insertBlank` is a required member —
  * the suite runs unconditionally on every engine (no fixture bytes are
  * needed at all, which is the point of the verb), so an implementation that
  * loses the verb fails loudly instead of being skipped past.
  *
  * Invariants:
- *   1. `count` blank pages of exactly `size` appear at `destIndex` (omitted
- *      → append), rotation 0; the result lists their fresh PONs in insertion
+ *   1. `count` blank pages of exactly `size` appear at `toIndex` (omitted
+ *      → append), rotation 0; the result lists their fresh page object numbers in insertion
  *      order and they agree with the returned layout.
- *   2. Pre-existing pages keep their identity: same PONs before and after,
+ *   2. Pre-existing pages keep their identity: same page object numbers before and after,
  *      in the expected positions (an insert never invalidates neighbours).
  *   3. The mutation persists through save → re-open (bytes engines only).
  *   4. Non-positive size / count outside [1, PAGE_INSERT_BLANK_MAX_COUNT] /
- *      out-of-range destIndex reject with InvalidArg, leaving the document
+ *      out-of-range toIndex reject with InvalidArg, leaving the document
  *      untouched.
  */
 declare function runPageInsertBlankConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
 //#endregion
+//#region src/conformance/runObjectNumberConformance.d.ts
+/**
+ * Two pages and a form. The first page holds a merged text field and widget
+ * (object 5, `merged`), the second nothing.
+ */
+declare const OBJECT_NUMBER_FIXTURE_PDF: Uint8Array<ArrayBufferLike>;
+interface ObjectNumberConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open {@link OBJECT_NUMBER_FIXTURE_PDF}, fresh for each call, with write access. */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+}
+/**
+ * Names at birth, and the order and ids of writes:
+ *
+ * - A create that names an object number from the document's pool makes its
+ *   object at exactly that number, so its ref is known before the engine
+ *   answers; what the engine makes for itself lands elsewhere.
+ * - A number the session doesn't hold is refused `not-held`; one a call uses
+ *   twice is `taken`. A refused call changes nothing.
+ * - Writes made without waiting apply in the order they were made: a page
+ *   named at birth takes an annotation at once.
+ * - Every event of a write carries its `opId` as `origin.tx`.
+ */
+declare function runObjectNumberConformance(runner: ConformanceTestRunner, opts: ObjectNumberConformanceOptions): void;
+//#endregion
+//#region src/conformance/runChangeConformance.d.ts
+/**
+ * Two pages and a form. The first page holds, from the file: a blue square
+ * by Ann (object 5); Ann's note (6) with its popup (7) and Bea's reply to it
+ * (8); and a merged text field and widget `name` with the value `Ann` (9).
+ * The second page is empty. Both share an empty content stream (10).
+ */
+declare const CHANGE_FIXTURE_PDF: Uint8Array<ArrayBufferLike>;
+interface ChangeConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open {@link CHANGE_FIXTURE_PDF}, fresh for each call, with write access. */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+  /**
+   * Open the document `doc` is on as another user, with write access. A local
+   * session has one user, so without it the test of who may undo is skipped.
+   */
+  openAsAnotherUser?: (engine: Engine, doc: DocumentHandle) => Promise<DocumentHandle>;
+}
+/**
+ * `doc.apply`, one user action as one change:
+ *
+ * - The ops apply in order, all or none, as one write: one `opId`, one burst
+ *   of events sharing it. Later ops name what earlier ones create, by the
+ *   numbers the creates were given.
+ * - `{ undoOf }` reverses a change as the engine recorded it, op by op in
+ *   reverse order, where the document still shows what the change set; what
+ *   it leaves alone is reported as `skipped`. Every op type round-trips:
+ *   undo gives exactly the state before, the undo's undo the state after.
+ * - A deleted annotation comes back as the same objects, with the layer's
+ *   edits, its popup and its replies.
+ * - `expect` refuses a change whose assumption doesn't hold.
+ * - Every answer is kept under its `opId`, refusals included: asking again
+ *   answers the same, and a different change under it is refused.
+ * - A redaction apply ends undo for the changes before it.
+ */
+declare function runChangeConformance(runner: ConformanceTestRunner, opts: ChangeConformanceOptions): void;
+//#endregion
+//#region src/conformance/pdfOf.d.ts
+/** A PDF file of `objects`, numbered from 1, with its cross-reference table. */
+declare function pdfOf(objects: readonly string[]): Uint8Array;
+//#endregion
+//#region src/conformance/runPermissionConformance.d.ts
+/**
+ * The two read families, through three tokens: one that may do everything,
+ * one that may only fill the form, one that may only comment. Each token
+ * reads, sees and writes its own family, and is refused the other one, on
+ * every surface: the lists, the appearance images, the page pictures, the
+ * writes, and (on an engine where sessions share a document) the events of
+ * another session's writes. A widget is the form's: the annotation verbs
+ * refuse one as the wrong family (`InvalidArg`), whatever the token.
+ *
+ * It runs on {@link CHANGE_FIXTURE_PDF}: a square (5), a note (6) with its
+ * popup (7) and a reply (8), and the text field `name`, merged with its
+ * widget (9), all on the first page.
+ */
+declare const PERMISSION_TOKENS: {
+  readonly everything: readonly ["*"];
+  readonly fill: readonly ["doc.open", "doc.render", "doc.forms.fill"];
+  readonly comment: readonly ["doc.open", "doc.render", "doc.annotate.modify"];
+};
+type PermissionToken = keyof typeof PERMISSION_TOKENS;
+interface PermissionConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh copy of {@link CHANGE_FIXTURE_PDF} with `scope`. */
+  open: (engine: Engine, scope: readonly string[]) => Promise<DocumentHandle>;
+  /**
+   * Open the document `doc` is on again, on `engine`, with `scope`: another
+   * user's session. Every open is its own session, even on the same engine.
+   * A local document is its own open's alone, so without it the events test
+   * is skipped.
+   */
+  openSameDocument?: (engine: Engine, doc: DocumentHandle, scope: readonly string[]) => Promise<DocumentHandle>;
+}
+declare function runPermissionConformance(runner: ConformanceTestRunner, opts: PermissionConformanceOptions): void;
+//#endregion
+//#region src/conformance/runFormScriptConformance.d.ts
+/**
+ * A field's scripts, written through `create` and `update`, and the form's
+ * calculation order, which follows the calculate scripts and moves by
+ * neighbour; a widget's actions, written through its placement and
+ * `updateWidget`. Undo puts them back. A field event takes JavaScript only;
+ * writing a script, a submit or a link takes `doc.forms.script`, while the
+ * actions that only change the view (go to, reset, show and hide) need
+ * `doc.forms.modify` alone.
+ *
+ * It runs on {@link CHANGE_FIXTURE_PDF}: the text field `name`, merged with
+ * its widget (9) on the first page, and no calculation order.
+ */
+interface FormScriptConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh copy of {@link CHANGE_FIXTURE_PDF} with `scope`. */
+  open: (engine: Engine, scope: readonly string[]) => Promise<DocumentHandle>;
+}
+declare function runFormScriptConformance(runner: ConformanceTestRunner, opts: FormScriptConformanceOptions): void;
+//#endregion
+//#region src/conformance/runFormAttributionConformance.d.ts
+/**
+ * Who made a field and who filled it in, on both engines with the same
+ * identities. The engine stamps it from the session: `create` names the
+ * creator, a write that changes a value names its filler (a script's value
+ * counts as filled by the user whose fill ran it), a reset and an anonymous
+ * fill name nobody, and an undo puts the previous filler back. A widget row
+ * reports no attribution: the field holds it.
+ *
+ * It runs on {@link CHANGE_FIXTURE_PDF}: the text field `name`, merged with
+ * its widget (9), holding `Ann`.
+ */
+interface FormAttributionConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /**
+   * Open a fresh copy of {@link CHANGE_FIXTURE_PDF} as `session`. With
+   * `from`, the new session continues that open session's document and sees
+   * what it wrote (locally its downloaded bytes, on the cloud the same
+   * layer); the suite closes `from` afterwards.
+   */
+  openAs: (engine: Engine, session: AttributionSession, from?: DocumentHandle) => Promise<DocumentHandle>;
+}
+declare function runFormAttributionConformance(runner: ConformanceTestRunner, opts: FormAttributionConformanceOptions): void;
+//#endregion
+//#region src/conformance/runFormTransferConformance.d.ts
+/**
+ * `doc.forms.export`, `doc.forms.import` and `doc.forms.importValues` on
+ * both engines. A design import copies whole fields, with their widgets,
+ * values, scripts, actions and calculation order, so the copy exports as
+ * its source, apart from refs, object numbers and the attribution its mode
+ * writes. A values import fills fields of the same name and reports what it
+ * leaves out. Both are one change each: undone and redone with
+ * `doc.apply({ undoOf })`, answered again on a retry, refused before
+ * anything is written.
+ *
+ * It runs on {@link TWO_PAGES_PDF}: two empty pages (3 and 4) and no form.
+ */
+interface FormTransferConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh document of `bytes` as `session`. */
+  openAs: (engine: Engine, session: AttributionSession, bytes: Uint8Array) => Promise<DocumentHandle>;
+}
+/** Two empty 300 × 300 pages (3 and 4), and no form. */
+declare const TWO_PAGES_PDF: Uint8Array<ArrayBufferLike>;
+declare function runFormTransferConformance(runner: ConformanceTestRunner, opts: FormTransferConformanceOptions): void;
+//#endregion
+//#region src/conformance/runWidgetRotationConformance.d.ts
+/**
+ * A widget turns as a box kind does: `box` is the frame its contents are
+ * laid out in, `rotation` a quarter turn, clockwise (`/MK /R`, which the
+ * file holds counterclockwise), and `rect` where it stands on the page, the
+ * box turned. On both engines: Acrobat's turned fields read so, a placement
+ * turns a new field, an update turns, moves and resizes one, undo puts it
+ * back, and a form bundle carries the turn.
+ *
+ * It runs on {@link TURNED_FIELDS_PDF}.
+ */
+interface WidgetRotationConformanceOptions {
+  label: string;
+  /** Build a fresh engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh document of `bytes` with every scope. */
+  open: (engine: Engine, bytes: Uint8Array) => Promise<DocumentHandle>;
+}
+/**
+ * Two 300 × 300 pages: the first upright (3), the second shown turned 90°
+ * (`/Rotate 90`, page 4). Text fields with `/MK /R` as Acrobat writes it,
+ * counterclockwise: `upright` (none), `r90` (90, the text runs up the page),
+ * `r180`, `r270`, `odd` (45, which no viewer draws turned), `negative`
+ * (-90, the same turn as 270), and `on-turned` on the turned page (90: an
+ * upright field there, as Acrobat adds one).
+ */
+declare const TURNED_FIELDS_PDF: Uint8Array<ArrayBufferLike>;
+declare function runWidgetRotationConformance(runner: ConformanceTestRunner, opts: WidgetRotationConformanceOptions): void;
+//#endregion
+//#region src/conformance/runWidgetFindingConformance.d.ts
+interface WidgetFindingCase {
+  /** What the file does. */
+  readonly does: string;
+  readonly pdf: Uint8Array;
+  /** The page whose `/Annots` holds the widget, or `null` when no page shows it. */
+  readonly page: number | null;
+  /** The name of the field the form reads the widget into, or `null` for a widget in no field. */
+  readonly field: string | null;
+}
+/** The cases, by name. Object 3 is the first page in each. */
+declare const WIDGET_FINDING_CASES: {
+  readonly 'annots-only': {
+    readonly does: "a merged field/widget in a page's /Annots that the field tree doesn't list";
+    readonly pdf: Uint8Array<ArrayBufferLike>;
+    readonly page: 3;
+    readonly field: "orphan";
+  };
+  readonly inline: {
+    readonly does: "a widget written straight into a page's /Annots, as no object of its own";
+    readonly pdf: Uint8Array<ArrayBufferLike>;
+    readonly page: 3;
+    readonly field: null;
+  };
+  readonly 'no-acroform': {
+    readonly does: "a field widget in a file that has no /AcroForm at all";
+    readonly pdf: Uint8Array<ArrayBufferLike>;
+    readonly page: 3;
+    readonly field: "lonely";
+  };
+  readonly 'stale-p': {
+    readonly does: "a widget in the second page's /Annots whose /P names the first page";
+    readonly pdf: Uint8Array<ArrayBufferLike>;
+    readonly page: 4;
+    readonly field: "moved";
+  };
+  readonly 'deleted-page': {
+    readonly does: "a field whose widget was on a page the document no longer has";
+    readonly pdf: Uint8Array<ArrayBufferLike>;
+    readonly page: null;
+    readonly field: "gone";
+  };
+  readonly 'no-field-type': {
+    readonly does: "a widget with no field type anywhere on its /Parent chain";
+    readonly pdf: Uint8Array<ArrayBufferLike>;
+    readonly page: 3;
+    readonly field: null;
+  };
+};
+type WidgetFindingCaseName = keyof typeof WIDGET_FINDING_CASES;
+interface WidgetFindingConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open `pdf` with every right, as a document of its own. */
+  open: (engine: Engine, pdf: Uint8Array, name: WidgetFindingCaseName) => Promise<DocumentHandle>;
+}
+declare function runWidgetFindingConformance(runner: ConformanceTestRunner, opts: WidgetFindingConformanceOptions): void;
+//#endregion
 //#region src/conformance/runPieceInfoConformance.d.ts
+interface PieceInfoConformanceOptions {
+  label: string;
+  /** Build a fresh local engine for this suite. The suite tears it down at the end. */
+  makeEngine: () => Promise<LocalEngine> | LocalEngine;
+  fixture: ConformanceFixture;
+}
 /**
- * `/PieceInfo` conformance (doc + page level). The service is OPTIONAL on
- * the contract (`downloadLayer?` pattern) — the suite runs only where the
- * implementation provides it, so an engine that has not shipped it yet
- * skips cleanly.
+ * `/PieceInfo` conformance (doc + page level), on the local engine: the
+ * only one with `/PieceInfo`.
  *
  * Invariants:
  *   1. The full value vocabulary round-trips at both levels: string,
  *      number, boolean, name, string-array — read back with the same tags.
- *   2. Writes PERSIST: download() → re-open → identical read (bytes-open
- *      engines only, since cloud cannot re-open loose bytes).
+ *   2. Writes persist: download() → re-open → identical read.
  *   3. `null` deletes a key; sibling keys and sibling applications
  *      survive both key deletes and whole-entry clears.
  *   4. An absent application reads as `null`; `applications()` enumerates
- *      what is present; every write refreshes `lastModified`.
+ *      what is present; every write refreshes `modifiedAt`.
  */
-declare function runPieceInfoConformance(runner: ConformanceTestRunner, opts: ConformanceOptions): void;
+declare function runPieceInfoConformance(runner: ConformanceTestRunner, opts: PieceInfoConformanceOptions): void;
 //#endregion
 //#region src/conformance/runDocumentEventsConformance.d.ts
 /**
  * Document event stream conformance suite. Verifies the invariants the
- * collaboration design rests on — do NOT loosen these without re-reading
+ * collaboration design rests on — do not loosen these without re-reading
  * `DocumentEvent`:
  *
- *   1. EXACTLY ONCE: every confirmed mutation produces exactly one event,
+ *   1. Exactly once: every confirmed mutation produces exactly one event,
  *      in mutation order, regardless of engine (local worker or cloud HTTP).
- *   2. GROUND TRUTH: a failed mutation publishes nothing; events fire only
+ *   2. Ground truth: a failed mutation publishes nothing; events fire only
  *      after confirmation.
- *   3. RESULTS RIDE VERBATIM: each event embeds the result the caller
+ *   3. Results ride verbatim: each event embeds the result the caller
  *      received, deep-equal field for field.
- *   4. PROVENANCE: own mutations are `origin.kind: 'local'` with a stable
- *      per-engine-instance `sessionId`.
- *   5. Unsubscribe stops delivery.
+ *   4. Provenance: own mutations are `origin.kind: 'local'` with the
+ *      handle's one `sessionId`.
+ *   5. Unsubscribe stops delivery; `on(type)` hears only its type.
+ *   6. Published before settlement: the event for a session's own mutation
+ *      reaches subscribers before the mutation's promise settles, so a
+ *      caller that awaits the mutation already sees state derived from it.
  *
  * Both local (worker host + WASM) and cloud (HTTP + @cloudpdf/server)
  * implementations must pass identically.
@@ -564,11 +1234,11 @@ declare function runPageTextConformance(runner: ConformanceTestRunner, opts: Pag
 //#endregion
 //#region src/conformance/runTextDivergenceConformance.d.ts
 /**
- * Index-space divergence conformance: the cases where a page's CHARACTER
+ * Index-space divergence conformance: the cases where a page's character
  * space (what geometry tiles and selection/search ranges address) and its
- * extracted TEXT differ — and the `charMap` contract that bridges them.
+ * extracted text differ — and the `charMap` contract that bridges them.
  *
- * Fixtures pin EXACT values (text, charCount, anchors) verified against the
+ * Fixtures pin exact values (text, charCount, anchors) verified against the
  * wasm runtime, so both engines must produce byte-identical snapshots:
  *
  *   - a non-printing character occupying a character slot with no text unit
@@ -577,17 +1247,17 @@ declare function runPageTextConformance(runner: ConformanceTestRunner, opts: Pag
  *     characters in lockstep with the text, identity map, real segments);
  *   - supplementary-plane text via a ToUnicode surrogate pair
  *     (`embedpdf_astral_tounicode.pdf` — two lockstep surrogate entries,
- *     identity map, astral content SURVIVES extraction).
+ *     identity map, astral content survives extraction).
  *
- * The search probe closes the loop: a hit's `charStart`/`charCount` must be
- * CHARACTER-space (segments join geometry), and slicing the snapshot by the
+ * The search probe closes the loop: a hit's `start`/`count` must be
+ * character-space (segments join geometry), and slicing the snapshot by the
  * hit's range must reproduce the matched text exactly — the law that makes
  * select-this-match and copy compose.
  */
 interface TextDivergenceConformanceFixture extends ConformanceFixture {
   /** PDF indirect object number of the probed page. */
   pageObjectNumber: number;
-  /** The EXACT extracted text (UTF-16 faithful). */
+  /** The exact extracted text (UTF-16 faithful). */
   exactText: string;
   /** The character-space size (may differ from `exactText.length`). */
   expectedCharCount: number;
@@ -595,15 +1265,15 @@ interface TextDivergenceConformanceFixture extends ConformanceFixture {
   expectedCharMap: ReadonlyArray<CharMapAnchor> | null;
   /** Char-space slice expectations (half-open). */
   slices?: ReadonlyArray<{
-    from: number;
-    to: number;
+    start: number;
+    count: number;
     text: string;
   }>;
-  /** Literal search probe with expected CHARACTER-space hit range. */
+  /** Literal search probe with expected character-space hit range. */
   search?: {
     query: string;
-    charStart: number;
-    charCount: number;
+    start: number;
+    count: number;
     matchedText: string;
   };
 }
@@ -617,7 +1287,7 @@ type TextDivergenceCase = Omit<TextDivergenceConformanceFixture, 'id' | 'bytes'
   resource: string;
 };
 /**
- * THE pinned divergence cases — one table, consumed by both engines' suites
+ * The pinned divergence cases — one table, consumed by both engines' suites
  * so expected values cannot drift. Values verified against the wasm runtime
  * (see each case). All fixtures are single-page; the page's indirect object
  * number is 3 in each.
@@ -641,7 +1311,7 @@ interface PageGeometryOrientationFixture extends ConformanceFixture {
     kind: 'empty-only';
   } | {
     kind: 'rotated';
-    /** Baseline angles (radians, CCW, PDF y-up) rotated runs may carry. */
+    /** Turns (degrees clockwise) rotated runs may carry. */
     rotations: number[];
     ascentFlip: boolean;
     /**
@@ -681,21 +1351,16 @@ interface SearchConformanceOptions extends Omit<ConformanceOptions, 'fixture'> {
 }
 declare function runSearchConformance(runner: ConformanceTestRunner, opts: SearchConformanceOptions): void;
 //#endregion
-//#region src/conformance/diffAnnotationListSnapshot.d.ts
+//#region src/conformance/diffAnnotationList.d.ts
 /**
  * Returns a list of human-readable difference strings between two
- * snapshots. Empty array means parity. Used by `engine-node.ts` to assert
- * that local and cloud emit identical annotations for the same fixture.
- *
- * `RevisionToken.docSessionId` is intentionally NOT compared — sessions
- * are disjoint. We do compare `pageObjectNumber` and `generation` (which
- * should be 0 for fresh reads on both sides). Page order is no longer part
- * of `PageState`; it lives in `PageLayout.index` (see `pages.list()`).
- * `auditHead` is likewise not compared: it is a cloud-only reconciliation
- * cursor, absent on local snapshots by design.
+ * `annotations.list()` results, page by page. Empty array means parity.
+ * Used by `engine-node.ts` to assert that local and cloud emit identical
+ * annotations for the same fixture: the same pages, and on each the same
+ * annotations under the same names. `auditHead` is not compared: it is a
+ * cloud-only reconciliation cursor, absent on local lists by design.
  */
-declare function diffAnnotationListSnapshot(a: AnnotationListPageSnapshot, b: AnnotationListPageSnapshot): string[];
-declare function diffAnnotationListSnapshotAll(a: AnnotationListSnapshotAllPages, b: AnnotationListSnapshotAllPages): string[];
+declare function diffAnnotationList(a: AnnotationList, b: AnnotationList): string[];
 //#endregion
 //#region src/conformance/runSignatureConformance.d.ts
 interface SignatureConformanceFixtures {
@@ -744,12 +1409,12 @@ interface SignatureConformanceOptions {
   fixtures: SignatureConformanceFixtures;
 }
 /**
- * Digital signatures, read side. The service is OPTIONAL on the contract
+ * Digital signatures, read side. The service is optional on the contract
  * (`downloadLayer?` pattern) — the suite runs only where the engine
  * provides it.
  *
  * Invariants:
- *   1. Byte facts describe the LOADED bytes: a revision is a byte prefix,
+ *   1. Byte facts describe the loaded bytes: a revision is a byte prefix,
  *      a whole-revision signature seals exactly one, the digest over its
  *      `/ByteRange` is what the file's bytes hash to, and an unsaved edit
  *      changes none of it.
@@ -764,5 +1429,103 @@ interface SignatureConformanceOptions {
  */
 declare function runSignatureConformance(runner: ConformanceTestRunner, opts: SignatureConformanceOptions): void;
 //#endregion
-export { type ActionsConformanceFixtures, type ActionsConformanceOptions, type AnnotationAppearanceConformanceFixture, type AnnotationAppearanceConformanceOptions, type AnnotationConformanceOptions, type AnnotationMutationConformanceFixture, type AnnotationMutationConformanceOptions, type AnnotationReadConformanceFixture, type ConformanceExpect, type ConformanceFixture, type ConformanceOptions, type ConformanceTestRunner, type FormConformanceFixtures, type FormConformanceOptions, type PageGeometryOrientationFixture, type PageGeometryOrientationOptions, type PageReorderConformanceFixture, type PageReorderConformanceOptions, type PageTextConformanceFixture, type PageTextConformanceOptions, type SearchConformanceFixture, type SearchConformanceOptions, type SignatureConformanceFixtures, type SignatureConformanceOptions, TEXT_DIVERGENCE_CASES, type TextDivergenceCase, type TextDivergenceConformanceFixture, type TextDivergenceConformanceOptions, diffAnnotationListSnapshot, diffAnnotationListSnapshotAll, runActionsConformance, runAnnotationAppearanceConformance, runAnnotationAppearanceExportConformance, runAnnotationFlattenConformance, runAnnotationMutationConformance, runAnnotationReadConformance, runAttachmentConformance, runDocumentEventsConformance, runFormConformance, runMetadataConformance, runNamedPagesConformance, runPageDeleteConformance, runPageExtractConformance, runPageFlattenConformance, runPageGeometryOrientationConformance, runPageInsertBlankConformance, runPageInsertConformance, runPageReorderConformance, runPageRotateConformance, runPageTextConformance, runPieceInfoConformance, runRedactionApplyConformance, runSearchConformance, runSignatureConformance, runTextDivergenceConformance };
+//#region src/conformance/runAnnotationPredictionConformance.d.ts
+/** One blank US Letter page. */
+declare const PREDICTION_FIXTURE_PDF: Uint8Array<ArrayBufferLike>;
+interface AnnotationPredictionConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open {@link PREDICTION_FIXTURE_PDF}. Called once; every case adds its own annotation. */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+}
+/**
+ * What a write does, predicted: `applyAnnotationPatch(read, patch)` equals the
+ * annotation the engine reads back after `update(ref, patch)`, and
+ * `annotationOfDraft(draft, context)` the one it reads back after
+ * `create(draft)`, on every field but the ones the engine works out from its
+ * drawing or stamps on each write.
+ * A viewer shows a pending change this way, so the prediction is what the
+ * user sees until the engine answers.
+ */
+declare function runAnnotationPredictionConformance(runner: ConformanceTestRunner, opts: AnnotationPredictionConformanceOptions): void;
+//#endregion
+//#region src/conformance/runFormPredictionConformance.d.ts
+interface FormPredictionConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open `PREDICTION_FIXTURE_PDF` (one blank page). Called once; every case adds its own field. */
+  open: (engine: Engine) => Promise<DocumentHandle>;
+}
+/**
+ * What a form op leaves, predicted (`forms/predict.ts`): each op of every
+ * family run against a fresh field, and the field and its widgets' rows the
+ * engine reads back compared with the prediction, field by field. What the
+ * engine stamps on a write (dates, who filled it in), its fonts from the
+ * document's default appearance and the names it mints are left out.
+ */
+declare function runFormPredictionConformance(runner: ConformanceTestRunner, opts: FormPredictionConformanceOptions): void;
+//#endregion
+//#region src/conformance/runFieldGroupsConformance.d.ts
+/**
+ * Field groups: who fills in and signs which fields. On a buyer and seller
+ * contract, the same on every engine:
+ *   - each signer fills in and signs only their own group's fields;
+ *   - a field a script calculates moves with a fill of the signer's own;
+ *   - a designer puts fields in their own group, or one they may set;
+ *   - a values import leaves out the fields the token may not fill;
+ *   - signing a grouped signature field locks the rest of its group.
+ *
+ * It runs on {@link FIELD_GROUPS_PDF}.
+ */
+/**
+ * One page with a buyer's and a seller's fields, each field's group in its
+ * `/EMBD_Metadata /GroupID`: `buyer_name` and `buyer_price` (buyer),
+ * `seller_name` (seller), `total` (no group; a calculate script, in the
+ * calculation order), and the signature fields `buyer_sig` (buyer) and
+ * `seller_sig` (seller).
+ */
+declare const FIELD_GROUPS_PDF: Uint8Array<ArrayBufferLike>;
+/** The tokens of the contract's parties. */
+declare const FIELD_GROUP_TOKENS: {
+  /** The buyer: fills in and signs the buyer's fields. */
+  readonly buyer: {
+    readonly scope: readonly ["doc.open", "doc.render", "fields:fill:group=buyer", "fields:sign:group=buyer"];
+    readonly identity: {
+      readonly userId: "alice";
+      readonly displayName: "Alice";
+    };
+  };
+  /** The seller, as a share link would grant it: everything on the seller's fields. */
+  readonly seller: {
+    readonly scope: readonly ["doc.open", "doc.render", "fields:*:group=seller"];
+    readonly identity: {};
+  };
+  /** The designer: her fields go in legal; she may put fields in the buyer's group too. */
+  readonly designer: {
+    readonly scope: readonly ["doc.open", "doc.render", "doc.forms.modify", "fields:set-group:group=buyer"];
+    readonly identity: {
+      readonly userId: "lisa";
+      readonly groupId: "legal";
+    };
+  };
+  readonly everything: {
+    readonly scope: readonly ["*"];
+    readonly identity: {};
+  };
+};
+type FieldGroupToken = keyof typeof FIELD_GROUP_TOKENS;
+interface FieldGroupsConformanceOptions {
+  label: string;
+  makeEngine: () => Promise<Engine> | Engine;
+  /** Open a fresh copy of `bytes` (default {@link FIELD_GROUPS_PDF}) with `scope`, acting for `identity`. */
+  open: (engine: Engine, scope: readonly string[], identity: Identity, bytes?: Uint8Array) => Promise<DocumentHandle>;
+  /**
+   * Whether a signing completes on this engine with a placeholder CMS, so
+   * the lock it installs can be read back. Default `true`.
+   */
+  completesSignings?: boolean;
+}
+declare function runFieldGroupsConformance(runner: ConformanceTestRunner, opts: FieldGroupsConformanceOptions): void;
+//#endregion
+export { APPEARANCE_STATES_FIXTURE_PDF, type ActionsConformanceFixtures, type ActionsConformanceOptions, type AnnotationAppearanceConformanceFixture, type AnnotationAppearanceConformanceOptions, type AnnotationAttributionConformanceOptions, type AnnotationConformanceOptions, type AnnotationDeclarationConformanceOptions, type AnnotationDeclarationFixture, type AnnotationMutationConformanceFixture, type AnnotationMutationConformanceOptions, type AnnotationPredictionConformanceOptions, type AnnotationReadConformanceFixture, type AnnotationResourceConformanceOptions, type AnnotationResourceFixture, type AnnotationRotationConformanceOptions, type AnnotationRotationFixture, type AnnotationTransferConformanceOptions, type AppearanceStatesConformanceOptions, type AttributionSession, BARE_PAGE_FIXTURE_PDF, CHANGE_FIXTURE_PDF, COLOR_FIXTURE_PDF, CROP_OFFSET_PDF, type ChangeConformanceOptions, type ColorConformanceOptions, type ConformanceExpect, type ConformanceFixture, type ConformanceOptions, type ConformanceTestRunner, type Creatable, DRAWING_FIXTURE_PDF, type DateConformanceOptions, type DrawingDetailsConformanceOptions, type DrawingDetailsFixture, FIELD_GROUPS_PDF, FIELD_GROUP_TOKENS, type FieldGroupToken, type FieldGroupsConformanceOptions, type FormAttributionConformanceOptions, type FormConformanceFixtures, type FormConformanceOptions, type FormPredictionConformanceOptions, type FormScriptConformanceOptions, type FormTransferConformanceOptions, OBJECT_NUMBER_FIXTURE_PDF, type ObjectNumberConformanceOptions, PAGE_SPACE_FIXTURES, PERMISSION_TOKENS, PREDICTION_FIXTURE_PDF, type PageGeometryOrientationFixture, type PageGeometryOrientationOptions, type PageRenderConformanceOptions, type PageReorderConformanceFixture, type PageReorderConformanceOptions, type PageSpaceConformanceOptions, type PageSpaceFixture, type PageSpaceFixturePage, type PageTextConformanceFixture, type PageTextConformanceOptions, type PermissionConformanceOptions, type PermissionToken, type PieceInfoConformanceOptions, type RedactionApplyConformanceOptions, type SearchConformanceFixture, type SearchConformanceOptions, type SignatureConformanceFixtures, type SignatureConformanceOptions, TEXT_DIVERGENCE_CASES, TURNED_FIELDS_PDF, TWO_PAGES_PDF, type TextDivergenceCase, type TextDivergenceConformanceFixture, type TextDivergenceConformanceOptions, WIDGET_FINDING_CASES, type WidgetFindingCase, type WidgetFindingCaseName, type WidgetFindingConformanceOptions, type WidgetRotationConformanceOptions, annotationReadDriftOf, creatables, diffAnnotationList, iconRect, pdfOf, runActionsConformance, runAnnotationAppearanceConformance, runAnnotationAppearanceExportConformance, runAnnotationAttributionConformance, runAnnotationDeclarationConformance, runAnnotationExportConformance, runAnnotationFlattenConformance, runAnnotationImportConformance, runAnnotationMutationConformance, runAnnotationPredictionConformance, runAnnotationReadConformance, runAnnotationResourceConformance, runAnnotationRotationConformance, runAnnotationTransferConformance, runAppearanceStatesConformance, runAttachmentConformance, runChangeConformance, runColorConformance, runDateConformance, runDocumentEventsConformance, runDrawingDetailsConformance, runFieldGroupsConformance, runFormAttributionConformance, runFormConformance, runFormPredictionConformance, runFormScriptConformance, runFormTransferConformance, runMeasurementConformance, runMetadataConformance, runNamedPagesConformance, runObjectNumberConformance, runPageDeleteConformance, runPageExtractConformance, runPageFlattenConformance, runPageGeometryOrientationConformance, runPageInsertBlankConformance, runPageInsertConformance, runPageRenderConformance, runPageReorderConformance, runPageRotateConformance, runPageSpaceConformance, runPageTextConformance, runPermissionConformance, runPieceInfoConformance, runRedactionApplyConformance, runSearchConformance, runSignatureConformance, runTextDivergenceConformance, runWidgetFindingConformance, runWidgetRotationConformance };
 //# sourceMappingURL=conformance.d.ts.map