@embedpdf/engine-core 3.0.0-next.14 → 3.0.0-next.15

package/dist/{viewport-BWeNHZmb.cjs → authority-DLMNR7ff.cjs}

@@ -1,282 +1,189 @@
-const require_derive = require("./derive-BbsDk_Kz.cjs");
-const require_format = require("./format-D_epWlob.cjs");
-const require_resolver = require("./resolver-CYVNV4hn.cjs");
-//#region src/dto/PdfAction.ts
+const require_value = require("./value-BFS1R8ek.cjs");
+const require_resolveAnnotationDraft = require("./resolveAnnotationDraft-7Ke4nV7F.cjs");
+const require_format = require("./format-Bp3QFSH1.cjs");
+const require_calibrate = require("./calibrate-DJBXnhLE.cjs");
+const require_resolver = require("./resolver-D2OCtE8F.cjs");
+const require_viewport = require("./viewport-DlL5Bxbg.cjs");
+//#region src/geometry/pageBoxes.ts
+/** The media box of a page that has none, which the file needs: US Letter. */
+const DEFAULT_MEDIA_BOX = {
+	left: 0,
+	bottom: 0,
+	right: 612,
+	top: 792
+};
+/** A box that shares nothing with the media box: no size, at the origin. */
+const EMPTY_BOX = {
+	left: 0,
+	right: 0,
+	bottom: 0,
+	top: 0
+};
 /**
-* The one Table-240 decode, shared by the reader, the schema's producers,
-* and tests — so bit semantics cannot fork.
+* The page's five boxes as ISO 32000-1 §14.11.2 defines them: the crop box
+* defaults to the media box and the other three to the crop box, and each is
+* reduced to the part it shares with the media box. The crop box is then the
+* visible page, what the page shows.
+*
+* For broken files, which the standard doesn't cover, we do what Acrobat
+* does: a page without a media box is US Letter, and a box that shares
+* nothing with the media box is empty, so a crop box off the page leaves a
+* page with no size.
 */
-const decodeSubmitFormFlags = (raw) => {
-	const bit = (n) => (raw & 1 << n - 1) !== 0;
-	const format = bit(9) ? "pdf" : bit(6) ? "xfdf" : bit(3) ? "html" : "fdf";
+function pageBoxesOf(written) {
+	const media = written.media ?? DEFAULT_MEDIA_BOX;
+	const within = (box) => require_resolveAnnotationDraft.pdfRectIntersection(box, media) ?? EMPTY_BOX;
+	const crop = within(written.crop ?? media);
 	return {
-		raw,
-		exclude: bit(1),
-		includeNoValueFields: bit(2),
-		format,
-		method: bit(4) && (format === "html" || format === "pdf") ? "get" : "post",
-		submitCoordinates: bit(5),
-		includeAppendSaves: bit(7),
-		includeAnnotations: bit(8),
-		canonicalFormat: bit(10),
-		exclNonUserAnnots: bit(11),
-		exclFKey: bit(12),
-		embedForm: bit(14)
+		media,
+		crop,
+		bleed: within(written.bleed ?? crop),
+		trim: within(written.trim ?? crop),
+		art: within(written.art ?? crop)
 	};
-};
-//#endregion
-//#region src/dto/PageRender.ts
-function createPageImageHandle(result, blobSource) {
-	return {
-		...result,
-		async objectUrl(signal) {
-			if (typeof Blob === "undefined" || typeof URL === "undefined" || !URL.createObjectURL) throw new require_derive.EngineError(require_format.EngineErrorCode.RuntimeUnavailable, "Object URLs are not available in this environment");
-			const blob = await blobSource.blob(signal);
-			const url = URL.createObjectURL(blob);
-			return {
-				url,
-				revoke: () => URL.revokeObjectURL(url)
-			};
-		}
-	};
-}
-//#endregion
-//#region src/dto/PdfSaveMode.ts
-const DEFAULT_PDF_SAVE_MODE = "incremental";
-//#endregion
-//#region src/dto/RichText.ts
-/** The plain-text projection of a rich document: paragraphs joined by `\r`,
-*  runs concatenated — what the engine writes to `/Contents`. */
-function richTextPlainText(doc) {
-	return doc.paragraphs.map((p) => p.runs.map((r) => r.text).join("")).join("\r");
 }
-/** Plain text as rich paragraphs: one per line break, one run each, no
-*  overrides (the engine's own `/Contents` fallback shape). */
-function richTextParagraphsFromPlainText(text) {
-	return text.split(/\r\n|\r|\n/).map((line) => ({ runs: [{ text: line }] }));
-}
-//#endregion
-//#region src/identity/PageObjectNumber.ts
 /**
-* Type guard for the rare malformed-PDF case where a page is a direct
-* object. The engine treats `0` as malformed and throws `EngineError(NotFound)`
-* before any page-level operation.
+* A page's turn from its `/Rotate`, degrees clockwise. ISO 32000-1 Table 30
+* allows multiples of 90; a negative one or one past 360 is the same turn.
+* For a value that isn't a multiple of 90, which the file shouldn't hold, we
+* do what Acrobat does: no turn.
 */
-function isValidPageObjectNumber(value) {
-	return typeof value === "number" && Number.isInteger(value) && value > 0;
+function pageRotationOf(written) {
+	if (!Number.isInteger(written) || written % 90 !== 0) return 0;
+	return (written % 360 + 360) % 360;
 }
 //#endregion
-//#region src/identity/AnnotationStableId.ts
+//#region src/dto/PageRender.ts
 /**
-* URL-safe encoding of a stable id, used by the cloud HTTP surface as the
-* `:annotKey` route parameter. Decoded by the server back into an
-* `AnnotationStableId` via `decodeStableIdKey`.
-*
-* Format:
-*   `{ kind: 'objectNumber', value: 42 }` -> `'obj:42'`
-*   `{ kind: 'nm', value: 'foo bar' }`    -> `'nm:foo bar'`
-*
-* The caller is responsible for `encodeURIComponent`-ing the result before
-* splicing it into a URL path; `wirePaths.layerAnnotationByKey` already does
-* that. /NM values are opaque strings and may contain anything; the
-* `nm:` prefix lets the decoder distinguish them from numeric ids
-* unambiguously.
+* What a page picture draws: the options as passed, and for each one left
+* out, what the caller may read. A left-out option never asks for more than
+* the caller may see; `true` for something they may not read is refused
+* (`PermissionDenied`, naming the option).
 */
-function encodeStableIdKey(id) {
-	if (id.kind === "objectNumber") {
-		if (!Number.isInteger(id.value) || id.value <= 0) throw new RangeError(`encodeStableIdKey: objectNumber must be a positive integer, got ${id.value}`);
-		return `obj:${id.value}`;
-	}
-	return `nm:${id.value}`;
+function resolvePageLayers(options, may) {
+	const { includeAnnotations, includeFormFields } = options ?? {};
+	if (includeAnnotations === true && !may.annotations) throw new require_resolver.PermissionDenied("doc.annotate.read", "includeAnnotations");
+	if (includeFormFields === true && !may.formFields) throw new require_resolver.PermissionDenied("doc.forms.read", "includeFormFields");
+	return {
+		includeAnnotations: includeAnnotations ?? may.annotations,
+		includeFormFields: includeFormFields ?? (includeAnnotations === false ? false : may.formFields)
+	};
+}
+/** `InvalidArg` unless `quality` is absent or between 0 and 1. */
+function checkImageQuality(quality) {
+	if (quality === void 0 || quality >= 0 && quality <= 1) return;
+	throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, "quality must be between 0 and 1", { details: { field: "quality" } });
+}
+function createPageImageHandle(result, blobSource) {
+	return {
+		...result,
+		...imageSourceOf(blobSource)
+	};
 }
 /**
-* Inverse of `encodeStableIdKey`. Returns `null` for malformed input so
-* the server can answer 400 InvalidArg with a useful message instead of
-* throwing.
-*
-* The input is the already-`decodeURIComponent`-ed segment from the route
-* path. Empty `/NM` values are rejected: `nm:` with no suffix is not a
-* valid identity.
+* An image whose encoded bytes this device holds (a picture it made, such as
+* a stamp's preview), to paint like one an engine rendered.
 */
-function decodeStableIdKey(key) {
-	if (key.startsWith("obj:")) {
-		const rest = key.slice(4);
-		const n = Number.parseInt(rest, 10);
-		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
-		return {
-			kind: "objectNumber",
-			value: n
-		};
-	}
-	if (key.startsWith("nm:")) {
-		const value = key.slice(3);
-		if (value.length === 0) return null;
-		return {
-			kind: "nm",
-			value
-		};
-	}
-	return null;
-}
-//#endregion
-//#region src/revision/RevisionToken.ts
-function revisionTokensEqual(a, b) {
-	return a.docSessionId === b.docSessionId && a.pageObjectNumber === b.pageObjectNumber && a.generation === b.generation;
+function imageSourceOfBytes(bytes, contentType) {
+	return imageSourceOf({ blob: async () => new Blob([bytes.slice()], { type: contentType }) });
 }
-//#endregion
-//#region src/revision/WeakAnnotationState.ts
-const UNKNOWN_WEAK_ANNOTATION_STATE = { kind: "unknown" };
-function knownWeakAnnotationState(hasAnyWeakAnnotations) {
+/** The image `blobSource` gives, as a blob and as an object URL. */
+function imageSourceOf(blobSource) {
 	return {
-		kind: "known",
-		hasAnyWeakAnnotations
+		blob() {
+			return require_viewport.AbortablePromise.run(async (signal) => {
+				if (typeof Blob === "undefined") throw new require_format.EngineError(require_format.EngineErrorCode.RuntimeUnavailable, "Blob is not available in this environment");
+				const blob = await blobSource.blob(signal);
+				if (signal.aborted) throw signal.reason;
+				return blob;
+			});
+		},
+		objectUrl() {
+			return require_viewport.AbortablePromise.run(async (signal) => {
+				if (typeof Blob === "undefined" || typeof URL === "undefined" || !URL.createObjectURL) throw new require_format.EngineError(require_format.EngineErrorCode.RuntimeUnavailable, "Object URLs are not available in this environment");
+				const blob = await blobSource.blob(signal);
+				const url = URL.createObjectURL(blob);
+				if (signal.aborted) {
+					URL.revokeObjectURL(url);
+					throw signal.reason;
+				}
+				return {
+					url,
+					revoke: () => URL.revokeObjectURL(url)
+				};
+			});
+		}
 	};
 }
 //#endregion
-//#region src/annotation/primitives.ts
-const NO_ANNOTATION_FLAGS = {
-	invisible: false,
-	hidden: false,
-	print: false,
-	noZoom: false,
-	noRotate: false,
-	noView: false,
-	readOnly: false,
-	locked: false,
-	toggleNoView: false,
-	lockedContents: false
-};
+//#region src/dto/PdfSaveMode.ts
+const DEFAULT_PDF_SAVE_MODE = "incremental";
 //#endregion
-//#region src/resource/BinarySource.ts
-function isBlob(value) {
-	return typeof Blob !== "undefined" && value instanceof Blob;
-}
+//#region src/identity/uuid.ts
 /**
-* Copy a Uint8Array view into a fresh, exactly-sized ArrayBuffer the call
-* owns. Always copies — even when the view spans its whole buffer — because
-* the result may be transferred to a worker (detaching it), and the view is
-* the caller's. Returning `view.buffer` here would let one transfer zero
-* the caller's bytes (a stamp library's Uint8Array became single-use).
-* Callers wanting a zero-copy hand-off need an explicit "give" form, as
-* `pages.insert` has for bare ArrayBuffers; `BinarySource` has none.
+* Generate an RFC 4122 v4 UUID using the Web Crypto API surface available in
+* every realm this code runs in: Node 19+, Web Workers, browsers on https,
+* http, intranet and file: pages, and edge runtimes.
+*
+* Why this implementation:
+*   - `crypto.randomUUID()` is limited to secure contexts in some browsers;
+*     `getRandomValues()` has no such restriction.
+*   - `import { randomUUID } from 'crypto'` makes Vite externalize the
+*     `crypto` module for browser builds and fail at runtime.
+*
+* Output is the canonical hex form: `xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx`,
+* where `y` is one of `8/9/a/b` (variant nibble = 10xx).
 */
-function toOwnedArrayBuffer(view) {
-	const copy = new ArrayBuffer(view.byteLength);
-	new Uint8Array(copy).set(view);
-	return copy;
+function generateUuid() {
+	const bytes = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	bytes[6] = bytes[6] & 15 | 64;
+	bytes[8] = bytes[8] & 63 | 128;
+	return formatUuid(bytes);
 }
 /**
-* Resolve any accepted `BinarySource` form into a `WireResource`.
-* Async because Blob bytes can only be read asynchronously.
+* Generate an RFC 9562 v7 UUID: the Unix time in milliseconds in the first
+* 48 bits, then random bits. Names made later sort later, which is what an
+* annotation's `/NM` gets when the data names none.
 */
-async function resolveBinarySource(source) {
-	if (source instanceof Uint8Array) return { bytes: toOwnedArrayBuffer(source) };
-	if (isBlob(source)) {
-		const blobName = blobFileName(source);
-		return {
-			bytes: await source.arrayBuffer(),
-			mimeType: source.type || void 0,
-			...blobName !== void 0 ? { name: blobName } : {}
-		};
+function generateUuidV7(now = Date.now()) {
+	const bytes = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	let time = Math.max(0, Math.floor(now));
+	for (let i = 5; i >= 0; i--) {
+		bytes[i] = time % 256;
+		time = Math.floor(time / 256);
 	}
-	const { data, mimeType, name } = source;
-	const inner = data instanceof Uint8Array ? {
-		bytes: toOwnedArrayBuffer(data),
-		mimeType: void 0,
-		name: void 0
-	} : {
-		bytes: await data.arrayBuffer(),
-		mimeType: data.type || void 0,
-		name: blobFileName(data)
-	};
-	const resolvedName = name ?? inner.name;
-	return {
-		bytes: inner.bytes,
-		...mimeType ?? inner.mimeType ? { mimeType: mimeType ?? inner.mimeType } : {},
-		...resolvedName !== void 0 ? { name: resolvedName } : {}
-	};
+	bytes[6] = bytes[6] & 15 | 112;
+	bytes[8] = bytes[8] & 63 | 128;
+	return formatUuid(bytes);
 }
-/** A browser `File` is a Blob with a `name` — pick it up so attachment
-*  drafts can pass a `File` directly without repeating the file name. */
-function blobFileName(blob) {
-	const name = blob.name;
-	return typeof name === "string" && name.length > 0 ? name : void 0;
+function formatUuid(bytes) {
+	const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 //#endregion
-//#region src/resource/binaryMetadata.ts
-/**
-* Detect format (and intrinsic dimensions for rasters) of a binary buffer.
-*
-* @returns metadata, or `null` for unsupported/corrupt data
-*/
-function sniffBinaryMetadata(buffer) {
-	if (buffer.byteLength < 4) return null;
-	const bytes = new Uint8Array(buffer);
-	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) return parsePng(buffer);
-	if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return parseJpeg(buffer);
-	if (bytes[0] === 37 && bytes[1] === 80 && bytes[2] === 68 && bytes[3] === 70) return { mimeType: "application/pdf" };
-	return null;
-}
-function parsePng(buffer) {
-	if (buffer.byteLength < 24) return null;
-	const view = new DataView(buffer);
-	const width = view.getUint32(16);
-	const height = view.getUint32(20);
-	if (width === 0 || height === 0) return null;
-	return {
-		mimeType: "image/png",
-		width,
-		height
-	};
-}
-function parseJpeg(buffer) {
-	const bytes = new Uint8Array(buffer);
-	let offset = 2;
-	while (offset + 4 < bytes.byteLength) {
-		if (bytes[offset] !== 255) return null;
-		const marker = bytes[offset + 1];
-		if (marker >= 192 && marker <= 195) {
-			if (offset + 9 > bytes.byteLength) return null;
-			const view = new DataView(buffer, offset + 5);
-			const height = view.getUint16(0);
-			const width = view.getUint16(2);
-			if (width === 0 || height === 0) return null;
-			return {
-				mimeType: "image/jpeg",
-				width,
-				height
-			};
-		}
-		if (marker === 216 || marker === 217) offset += 2;
-		else if (marker === 255) offset += 1;
-		else {
-			const segLen = bytes[offset + 2] << 8 | bytes[offset + 3];
-			offset += 2 + segLen;
-		}
-	}
-	return null;
+//#region src/annotation/family.ts
+/** The family an annotation of `subtype` belongs to. */
+function familyOfSubtype(subtype) {
+	return subtype === "widget" ? "widgets" : "annotations";
 }
 //#endregion
-//#region src/annotation/kinds/file-attachment/normalize.ts
+//#region src/dto/normalizeAttachmentFileSource.ts
 /**
 * Resolve an attachment `file` into its wire halves: metadata into the
-* JSON body, bytes into the resource map. Unlike stamps there is NO
+* JSON body, bytes into the resource map. Unlike stamps there is no
 * format allowlist — attaching arbitrary files is the point — so the
-* declared mime type wins (attachment formats cannot be reliably sniffed;
-* the writer falls back to `application/octet-stream` when absent).
-*
-* Shared by the file-attachment annotation draft (below) and the
-* document-level `attachments.create` mutation — one vocabulary, one
-* normalizer for both homes a file can enter a PDF through.
+* declared mime type wins, then the Blob's; attachment formats cannot be
+* reliably sniffed, so without either the file has no type.
+* Used by the document-level `attachments.create`.
 */
 async function normalizeAttachmentFileSource(file, key) {
-	const resolved = await resolveBinarySource(file.data);
+	const resolved = await require_calibrate.resolveBinarySource(file.data instanceof ArrayBuffer ? new Uint8Array(file.data) : file.data);
 	const name = file.name ?? resolved.name;
-	if (!name) throw new require_derive.EngineError(require_format.EngineErrorCode.InvalidArg, "attachment file requires a name — pass { data, name } or a File whose name is set");
+	if (!name) throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, "attachment file requires a name — pass { data, name } or a File whose name is set");
 	const mimeType = file.mimeType ?? resolved.mimeType;
 	return {
 		wireFile: {
-			resource: key,
+			resources: { file: key },
 			name,
 			...mimeType !== void 0 ? { mimeType } : {},
 			...file.description !== void 0 ? { description: file.description } : {}
@@ -288,512 +195,309 @@ async function normalizeAttachmentFileSource(file, key) {
 		}
 	};
 }
-async function normalizeFileAttachmentDraft(draft, allocateKey) {
-	const { file, ...rest } = draft;
-	const key = allocateKey();
-	const { wireFile, resource } = await normalizeAttachmentFileSource(file, key);
-	return {
-		wire: {
-			...rest,
-			file: wireFile
-		},
-		resources: { [key]: resource }
-	};
-}
 //#endregion
-//#region src/annotation/kinds/stamp/normalize.ts
+//#region src/transfer/annotationImport.ts
 /**
-* Resolve + validate a stamp `source`. Sniffing happens here — before any
-* transport — so callers get a fast `InvalidArg` instead of a worker/HTTP
-* round-trip. The sniffed mime type overwrites whatever was declared.
+* The facts an import committed: one `annotations.created` per annotation, in
+* bundle order, each with the envelope of its own page and its own id. The
+* cache pins move once, with the last.
 */
-async function resolveStampSource(source) {
-	const resolved = await resolveBinarySource(source);
-	const meta = sniffBinaryMetadata(resolved.bytes);
-	if (!meta) throw new require_derive.EngineError(require_format.EngineErrorCode.InvalidArg, "stamp source must be PNG, JPEG, or single-page PDF bytes (format is detected from the data, not the declared mime type)");
-	return {
-		...resolved,
-		mimeType: meta.mimeType
-	};
-}
-async function normalizeStampDraft(draft, allocateKey) {
-	const { source, ...rest } = draft;
-	const resolved = await resolveStampSource(source);
-	const key = allocateKey();
-	return {
-		wire: {
-			...rest,
-			source: { resource: key }
-		},
-		resources: { [key]: resolved }
-	};
-}
-async function normalizeStampPatch(patch, allocateKey) {
-	if (patch.source === void 0) {
-		const { source: _source, ...rest } = patch;
+function annotationImportFacts(result) {
+	const last = result.annotations.length - 1;
+	return result.annotations.map((annotation, index) => {
+		const { page } = annotation.ref;
 		return {
-			wire: rest,
-			resources: {}
-		};
-	}
-	const { source, ...rest } = patch;
-	const resolved = await resolveStampSource(source);
-	const key = allocateKey();
-	return {
-		wire: {
-			...rest,
-			source: { resource: key }
-		},
-		resources: { [key]: resolved }
-	};
-}
-//#endregion
-//#region src/annotation/normalize.ts
-function createResourceKeyAllocator() {
-	let next = 0;
-	return () => `r${next++}`;
-}
-async function normalizeAnnotationDraft(draft) {
-	switch (draft.subtype) {
-		case "stamp": return normalizeStampDraft(draft, createResourceKeyAllocator());
-		case "file-attachment": return normalizeFileAttachmentDraft(draft, createResourceKeyAllocator());
-		default: return {
-			wire: draft,
-			resources: {}
-		};
-	}
-}
-async function normalizeAnnotationPatch(patch) {
-	switch (patch.subtype) {
-		case "stamp": return normalizeStampPatch(patch, createResourceKeyAllocator());
-		default: return {
-			wire: patch,
-			resources: {}
+			page,
+			annotation,
+			meta: {
+				affectedPages: result.meta.affectedPages.filter((affected) => affected.objectNumber === page.objectNumber),
+				cacheDelta: index === last ? result.meta.cacheDelta : null,
+				opId: result.meta.opId,
+				undoable: result.meta.undoable,
+				changed: [annotation.ref]
+			}
 		};
-	}
+	});
 }
 //#endregion
-//#region src/annotation/comments.ts
-/** Subtypes that never participate in comment threads. `unsupported`
-*  covers `/Popup` dictionaries (raw code 16) and unreadable foreign
-*  blobs — neither makes a meaningful comment card. */
-const EXCLUDED_SUBTYPES = /* @__PURE__ */ new Set([
-	"widget",
-	"link",
-	"unsupported"
-]);
-const REVIEW_STATES = /* @__PURE__ */ new Set([
-	"accepted",
-	"rejected",
-	"cancelled",
-	"completed",
-	"none"
-]);
-const MARKED_STATES = /* @__PURE__ */ new Set(["marked", "unmarked"]);
-const nonEmpty = (v) => typeof v === "string" && v !== "";
+//#region src/transfer/exportSelection.ts
 /**
-* An ISO 32000 §12.5.6.3 state annotation: a text annotation carrying a
-* non-empty `/State` or `/StateModel`. Classification never relies on
-* flags — producers disagree on how state annotations are flagged.
+* The annotations an export takes, in document order: page order, then each
+* page's annotation order. Besides the selection:
+*
+* - a reply brings its parent, and the parent's, up to the root;
+* - an annotation brings its popup, and a popup brings its parent;
+* - with `include: 'threads'`, the default, every reply below a selected
+*   annotation.
+*
+* A reply is on its parent's page (ISO 32000-2 §12.5.6.2, `/IRT`) and a popup
+* on its parent's, so none of this reaches another page. `readPage` returns a
+* page's annotations in `/Annots` order and is called once for each page
+* the selection is on. `pages` is the document's pages in order. A selected
+* page or annotation the document doesn't have is refused with `NotFound`.
 */
-function isStateAnnotation(a) {
-	return a.subtype === "text" && (nonEmpty(a.state) || nonEmpty(a.stateModel));
-}
-function buildCommentThreads(annotations, opts = {}) {
-	const eligible = annotations.filter((a) => !EXCLUDED_SUBTYPES.has(a.subtype));
+function closeExportSelection(selection, pages, readPage) {
+	const inDocument = new Set(pages.map(require_format.encodePageKey));
+	const read = /* @__PURE__ */ new Map();
 	const byKey = /* @__PURE__ */ new Map();
-	for (const a of eligible) {
-		const key = require_derive.refKey(a.ref);
-		if (!byKey.has(key)) byKey.set(key, a);
-		if (a.nm) {
-			const aliasKey = require_derive.refKey({
-				kind: "nm",
-				pageObjectNumber: a.pageObjectNumber,
-				nm: a.nm
-			});
-			if (!byKey.has(aliasKey)) byKey.set(aliasKey, a);
-		}
-	}
-	const children = /* @__PURE__ */ new Map();
-	for (const a of eligible) {
-		if (!a.inReplyTo) continue;
-		const parent = byKey.get(require_derive.refKey(a.inReplyTo));
-		if (!parent) continue;
-		const parentKey = require_derive.refKey(parent.ref);
-		const list = children.get(parentKey);
-		if (list) list.push(a);
-		else children.set(parentKey, [a]);
-	}
-	const visited = /* @__PURE__ */ new Set();
-	const threads = [];
-	const walk = (root) => {
-		const replies = [];
-		const groupedParts = [];
-		const states = [];
-		visited.add(require_derive.refKey(root.ref));
-		const stack = [...children.get(require_derive.refKey(root.ref)) ?? []];
-		while (stack.length > 0) {
-			const a = stack.pop();
-			const key = require_derive.refKey(a.ref);
-			if (visited.has(key)) continue;
-			visited.add(key);
-			if (isStateAnnotation(a)) states.push(a);
-			else if (require_derive.classifyRelation(a) === "grouped-subordinate") groupedParts.push(a);
-			else replies.push(a);
-			stack.push(...children.get(key) ?? []);
-		}
-		replies.sort(chronological);
-		states.sort(chronological);
-		threads.push({
-			root,
-			pageObjectNumber: root.pageObjectNumber,
-			replies,
-			groupedParts,
-			review: computeReview(states, opts)
-		});
+	const readOnce = (page) => {
+		const pageKey = require_format.encodePageKey(page);
+		if (read.has(pageKey) || !inDocument.has(pageKey)) return;
+		const annotations = readPage(page);
+		read.set(pageKey, annotations);
+		for (const annotation of annotations) byKey.set(require_format.annotationKey(annotation.ref), annotation);
 	};
-	for (const a of eligible) if (!a.inReplyTo && !isStateAnnotation(a)) walk(a);
-	for (const a of eligible) {
-		if (visited.has(require_derive.refKey(a.ref))) continue;
-		if (isStateAnnotation(a)) continue;
-		walk(a);
-	}
-	return threads;
-}
-/** `created ?? modified` ascending; undated last; z-order tiebreak. */
-function chronological(a, b) {
-	const at = a.created ?? a.modified;
-	const bt = b.created ?? b.modified;
-	if (at !== null && bt !== null && at !== bt) return at < bt ? -1 : 1;
-	if (at !== null && bt === null) return -1;
-	if (at === null && bt !== null) return 1;
-	return a.index - b.index;
-}
-function computeReview(states, opts) {
-	const byReviewer = {};
-	const markedLatest = {};
-	let lastChange = null;
-	for (const a of states) {
-		const status = toReviewStatus(a);
-		if (!status) continue;
-		if (status.stateModel === "marked") {
-			if (status.by !== null && isNewer(status, markedLatest[status.by])) markedLatest[status.by] = status;
-			continue;
-		}
-		if (status.by !== null && isNewer(status, byReviewer[status.by])) byReviewer[status.by] = status;
-		if (isNewer(status, lastChange)) lastChange = status;
-	}
-	const markedBy = Object.keys(markedLatest).filter((key) => markedLatest[key].state === "marked").sort();
-	const review = {
-		byReviewer,
-		lastChange,
-		markedBy,
-		statusRefs: states.map((a) => a.ref)
+	const find = (ref) => {
+		readOnce(ref.page);
+		return byKey.get(require_format.annotationKey(ref));
 	};
-	if (opts.currentUserId !== void 0) review.mine = byReviewer[opts.currentUserId] ?? null;
-	return review;
-}
-/**
-* Derive a `ReviewStatus` from one state annotation, or null when nothing
-* classifiable can be derived. ISO defaulting happens HERE, not in the
-* engine reader: a known model with an absent state means `none` /
-* `unmarked`; an absent model infers from a known state; a custom model
-* with no state has no derivable status.
-*/
-function toReviewStatus(a) {
-	if (a.subtype !== "text") return null;
-	const rawState = nonEmpty(a.state) ? a.state : null;
-	let stateModel = nonEmpty(a.stateModel) ? a.stateModel : null;
-	if (stateModel === null && rawState !== null) if (REVIEW_STATES.has(rawState)) stateModel = "review";
-	else if (MARKED_STATES.has(rawState)) stateModel = "marked";
-	else return null;
-	let state = rawState;
-	if (state === null) if (stateModel === "review") state = "none";
-	else if (stateModel === "marked") state = "unmarked";
-	else return null;
-	if (stateModel === null) return null;
-	return {
-		state,
-		stateModel,
-		by: a.userId ?? (nonEmpty(a.author) ? a.author : null),
-		at: a.modified ?? a.created ?? null,
-		ref: a.ref
+	for (const page of selection.pages ?? []) if (!inDocument.has(require_format.encodePageKey(page))) throw new require_format.EngineError(require_format.EngineErrorCode.NotFound, `export: the document has no page ${require_format.encodePageKey(page)}`);
+	const everything = !selection.refs && !selection.pages;
+	const threads = (selection.include ?? "threads") === "threads";
+	for (const page of everything ? pages : selection.pages ?? []) readOnce(page);
+	const taken = /* @__PURE__ */ new Set();
+	const pending = [];
+	const take = (annotation) => {
+		if (!annotation) return;
+		const key = require_format.annotationKey(annotation.ref);
+		if (taken.has(key)) return;
+		taken.add(key);
+		pending.push(annotation);
 	};
-}
-/** `a` newer than (or supersedes) `b`. `at` decides; dated beats undated.
-*  States arrive pre-sorted by `chronological` (date, then z-order), so on
-*  equal or missing dates the later entry wins via `>=` / `true`. */
-function isNewer(a, b) {
-	if (!b) return true;
-	if (a.at !== null && b.at !== null) return a.at >= b.at;
-	if (a.at !== null) return true;
-	if (b.at !== null) return false;
-	return true;
+	if (everything) for (const annotations of read.values()) annotations.forEach(take);
+	else {
+		for (const page of selection.pages ?? []) read.get(require_format.encodePageKey(page))?.forEach(take);
+		for (const ref of selection.refs ?? []) {
+			const annotation = find(ref);
+			if (!annotation) throw new require_format.EngineError(require_format.EngineErrorCode.NotFound, `export: the document has no annotation ${require_format.annotationKey(ref)}`);
+			take(annotation);
+		}
+	}
+	if (threads) {
+		for (const annotation of [...pending]) if (annotation.subtype === "popup" && annotation.parent) take(find(annotation.parent));
+		const replies = /* @__PURE__ */ new Map();
+		for (const annotations of read.values()) for (const annotation of annotations) {
+			const parent = annotation.reply ? find(annotation.reply.to) : void 0;
+			if (!parent) continue;
+			const key = require_format.annotationKey(parent.ref);
+			replies.set(key, [...replies.get(key) ?? [], annotation]);
+		}
+		for (let i = 0; i < pending.length; i++) replies.get(require_format.annotationKey(pending[i].ref))?.forEach(take);
+	}
+	for (let i = 0; i < pending.length; i++) {
+		const annotation = pending[i];
+		if (annotation.reply) take(find(annotation.reply.to));
+		if (annotation.popup) take(find(annotation.popup));
+		if (annotation.subtype === "popup" && annotation.parent) take(find(annotation.parent));
+	}
+	const ordered = [];
+	for (const page of pages) for (const annotation of read.get(require_format.encodePageKey(page)) ?? []) if (taken.has(require_format.annotationKey(annotation.ref))) ordered.push(annotation);
+	return ordered;
 }
 //#endregion
-//#region src/mutation/AnnotationMutationImpactPolicy.ts
-function changesAnnotationList(_kind) {
-	return true;
-}
-function shiftsExistingAnnotationIndices(kind) {
-	return kind === "delete" || kind === "move";
-}
-function invalidatesWeakIndexRefs(kind, weakStateBefore) {
-	if (!shiftsExistingAnnotationIndices(kind)) return false;
-	if (weakStateBefore.kind !== "known") throw new Error(`invalidatesWeakIndexRefs requires a known WeakAnnotationState for ${kind}; got 'unknown'. Caller must scan the page before computing mutation impact.`);
-	return weakStateBefore.hasAnyWeakAnnotations;
+//#region src/annotation/AnnotationList.ts
+/** Lists of different pages as one, in their order. */
+function concatAnnotationLists(lists) {
+	return {
+		annotations: lists.flatMap((list) => list.annotations),
+		pages: lists.flatMap((list) => list.pages)
+	};
 }
 //#endregion
-//#region src/annotation/appearance.ts
+//#region src/mutation/AnnotationMutationResults.ts
 /**
-* Coordinate tolerance in PDF user-space points. PDF numbers round-trip
-* through f32 (~7 significant digits) and client-side space conversions, so
-* exact float equality would misclassify no-op writes; 1e-3 pt is far below
-* anything visible while far above accumulated f32 drift at page magnitudes.
+* What a delete removed, as its `annotations.deleted` event names it for
+* listeners that didn't make the call: the refs in `meta.changed`, the
+* annotation first.
 */
-const EPSILON = .001;
-/**
-* Keys that never affect `/AP` on any kind: the discriminator, behavioral
-* flags, reply relationships, grouping, and the conversation-plane
-* entries (`/Subj` subject line, `/State` + `/StateModel` review status —
-* dictionary-only per ISO 32000 §12.5.6.3, never painted).
-*/
-const INERT_KEYS = /* @__PURE__ */ new Set([
-	"subtype",
-	"flags",
-	"inReplyTo",
-	"replyType",
-	"groupId",
-	"subject",
-	"state",
-	"stateModel"
-]);
-/**
-* Kinds whose `/AP` paints `/Contents`. Everywhere else `contents` is popup
-* note text — editing a comment must never re-bake (or destroy) the shape's
-* appearance.
-*/
-const CONTENTS_PAINTED = /* @__PURE__ */ new Set(["free-text", "redact"]);
-/**
-* The vertex family's `/EMBD_Metadata/Rotation` is an advisory scalar (the
-* vertices are already rotated); it never drives the AP generator, so patches
-* touching it are appearance-inert for these kinds.
-*/
-const ADVISORY_ROTATION = /* @__PURE__ */ new Set([
-	"line",
-	"polyline",
-	"polygon",
-	"ink"
-]);
-/**
-* The box kinds carry the `/EMBD_Metadata` transform pair (`rotation` +
-* `unrotatedRect`), tri-state on writes: omitted fields are PRESERVED, `null`
-* (or `0` for rotation) clears. Translation verification therefore compares
-* the after-state — `patch.rotation ?? current.rotation` — not the patch keys.
-*/
-const BOX_TRANSFORM = /* @__PURE__ */ new Set([
-	"square",
-	"circle",
-	"free-text",
-	"stamp"
-]);
+function deletedAnnotationsOf(result) {
+	return result.meta.changed;
+}
+//#endregion
+//#region src/annotation/resolve/patchBetween.ts
+/** Exact deep equality: the same value, or arrays and objects whose members are. */
+function sameValue(left, right) {
+	if (Object.is(left, right)) return true;
+	if (typeof left !== "object" || typeof right !== "object" || left === null || right === null) return false;
+	if (Array.isArray(left) !== Array.isArray(right)) return false;
+	const leftRecord = left;
+	const rightRecord = right;
+	const names = Object.keys(leftRecord).filter((name) => leftRecord[name] !== void 0);
+	const others = Object.keys(rightRecord).filter((name) => rightRecord[name] !== void 0);
+	return names.length === others.length && names.every((name) => sameValue(leftRecord[name], rightRecord[name]));
+}
 /**
-* Per-kind absolute-geometry fields (PDF user space) that a rigid translation
-* shifts together. A kind absent from this table never takes the translation
-* route. `rect` is required in every entry: a translation always moves `/Rect`.
+* What `after` changed from `before`, as `update` takes it: each data field
+* whose value differs, whole. Fields the engine works out, stamps or keeps as
+* found (a drawn kind's `rect`, the dates and authors, the refs it keeps) are
+* left out. Values are compared exactly, so a value rebuilt with the same
+* content is no change. Works in either space: it only compares values by
+* field name.
 */
-const TRANSLATABLE_GEOMETRY = {
-	square: ["rect", "unrotatedRect"],
-	circle: ["rect", "unrotatedRect"],
-	"free-text": [
-		"rect",
-		"unrotatedRect",
-		"calloutLine"
-	],
-	line: ["rect", "linePoints"],
-	polygon: ["rect", "vertices"],
-	polyline: ["rect", "vertices"],
-	ink: ["rect", "inkList"],
-	highlight: ["rect", "quadPoints"],
-	underline: ["rect", "quadPoints"],
-	squiggly: ["rect", "quadPoints"],
-	strikeout: ["rect", "quadPoints"],
-	redact: ["rect", "quadPoints"],
-	caret: ["rect"],
-	text: ["rect"],
-	stamp: ["rect", "unrotatedRect"],
-	"file-attachment": ["rect"],
-	link: ["rect"]
-};
-const numEq = (a, b) => Math.abs(a - b) <= EPSILON;
-/** Degrees normalized to [0,360); absent reads as 0 (no rotation). */
-const normDeg = (v) => {
-	return typeof v === "number" ? (v % 360 + 360) % 360 : 0;
-};
+function annotationPatchBetween(before, after) {
+	const patch = {};
+	if (before === after) return patch;
+	const owners = require_resolveAnnotationDraft.kindFactsOf(after.subtype)?.owners ?? {};
+	const was = before;
+	const now = after;
+	for (const [name, owner] of Object.entries(owners)) {
+		if (owner !== "data" || sameValue(was[name], now[name])) continue;
+		patch[name] = now[name] === void 0 ? null : now[name];
+	}
+	return patch;
+}
 /**
-* Semantic equality between a patch value and the current DTO value.
-* Numbers compare within {@link EPSILON}; `null` and `undefined` both mean
-* "entry absent" (the tri-state clear of an absent entry is a no-op); arrays
-* and objects compare structurally.
+* `current` with `patch`'s data fields set, each as a read spells it: the
+* patch as given. No field follows from another here; `applyAnnotationPatch`
+* adds what the engine's rules make follow. Works in either space.
 */
-function semanticEqual(a, b) {
-	if (a == null || b == null) return a == null && b == null;
-	if (typeof a === "number" && typeof b === "number") return numEq(a, b);
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => semanticEqual(v, b[i]));
-	}
-	if (typeof a === "object" && typeof b === "object") {
-		const keys = /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)]);
-		for (const k of keys) if (!semanticEqual(a[k], b[k])) return false;
-		return true;
-	}
-	return a === b;
+function mergeAnnotationPatch(current, patch) {
+	return require_calibrate.applyResolvedPatch(current, patch);
 }
+//#endregion
+//#region src/pageSpace/pages.ts
 /**
-* Is `next` exactly `cur` shifted by `(dx, dy)`? Walks the value structurally:
-* numeric leaves under x-axis keys (`left`/`right`/`x`) must shift by `dx`,
-* y-axis keys (`bottom`/`top`/`y`) by `dy`, and any other numeric leaf must be
-* unchanged. Arrays walk elementwise (same length required).
+* A page's five boxes in page space: measured from the top-left of the crop
+* box, the visible page, which is therefore `{ x: 0, y: 0, width, height }`.
 */
-function shiftedBy(cur, next, dx, dy) {
-	if (cur == null || next == null) return cur == null && next == null;
-	if (Array.isArray(cur) || Array.isArray(next)) {
-		if (!Array.isArray(cur) || !Array.isArray(next) || cur.length !== next.length) return false;
-		return cur.every((v, i) => shiftedBy(v, next[i], dx, dy));
-	}
-	if (typeof cur === "object" && typeof next === "object") {
-		const keys = /* @__PURE__ */ new Set([...Object.keys(cur), ...Object.keys(next)]);
-		for (const k of keys) {
-			const c = cur[k];
-			const n = next[k];
-			if (typeof c === "number" && typeof n === "number") {
-				if (!numEq(c + (k === "left" || k === "right" || k === "x" ? dx : k === "bottom" || k === "top" || k === "y" ? dy : 0), n)) return false;
-			} else if (!shiftedBy(c, n, dx, dy)) return false;
-		}
-		return true;
-	}
-	return cur === next;
+function pageSpaceBoxesOf(boxes) {
+	const visible = boxes.crop;
+	return {
+		media: require_calibrate.pageBoxOf(boxes.media, visible),
+		crop: require_calibrate.pageBoxOf(boxes.crop, visible),
+		bleed: require_calibrate.pageBoxOf(boxes.bleed, visible),
+		trim: require_calibrate.pageBoxOf(boxes.trim, visible),
+		art: require_calibrate.pageBoxOf(boxes.art, visible)
+	};
 }
 /**
-* Verify the touched geometry is one rigid translation of the current state.
-* Requires `patch.rect` (a translation always moves `/Rect`) with width and
-* height preserved; every other geometry field present on the annotation must
-* ride along shifted by the same delta — a rect move that leaves `vertices`
-* behind is NOT a translation (the dictionary would desync from the pixels).
-* For box kinds the `/EMBD_Metadata` transform group is checked as an
-* after-state: writes are tri-state (omitted preserves, null/0 clears), so an
-* omitted rotation keeps the current one — but a preserved-yet-unshifted
-* `unrotatedRect` still fails the congruence check via the field loop.
+* A page's layout in page space. Its actions may go to other pages, so each
+* destination is measured with `boxOf`, the box of the page it goes to.
 */
-function isRigidTranslation(cur, pat, subtype, geometryKeys) {
-	const curRect = cur.rect;
-	const patRect = pat.rect;
-	if (!curRect || !patRect) return false;
-	const dx = patRect.left - curRect.left;
-	const dy = patRect.bottom - curRect.bottom;
-	if (!numEq(patRect.right - patRect.left, curRect.right - curRect.left)) return false;
-	if (!numEq(patRect.top - patRect.bottom, curRect.top - curRect.bottom)) return false;
-	if (BOX_TRANSFORM.has(subtype)) {
-		const rotAfter = pat.rotation === void 0 ? cur.rotation : pat.rotation;
-		if (!numEq(normDeg(cur.rotation), normDeg(rotAfter))) return false;
-	}
-	for (const key of geometryKeys) {
-		if (key === "rect") continue;
-		const c = cur[key];
-		const p = pat[key];
-		if (c == null && p == null) continue;
-		if (c == null || p == null) return false;
-		if (!shiftedBy(c, p, dx, dy)) return false;
-	}
-	return true;
+function pageLayoutOf(layout, boxOf) {
+	const { actions, ...rest } = layout;
+	return {
+		...rest,
+		boxes: pageSpaceBoxesOf(layout.boxes),
+		...actions ? { actions: require_calibrate.mapPageActions(actions, (destination) => require_calibrate.pageDestinationOf(destination, boxOf)) } : {}
+	};
+}
+/** Every page's visible box, by page, from the pages' layouts. */
+function visibleBoxesOf(pages) {
+	const boxes = new Map(pages.map((page) => [page.ref.objectNumber, page.boxes.crop]));
+	return (page) => {
+		const box = boxes.get(page.objectNumber);
+		if (!box) throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, `No page ${page.objectNumber} in this document`);
+		return box;
+	};
+}
+/** The document's pages in page space. */
+function pageListOf(snapshot) {
+	const boxOf = visibleBoxesOf(snapshot.pages);
+	return {
+		...snapshot,
+		pages: snapshot.pages.map((page) => pageLayoutOf(page, boxOf))
+	};
+}
+//#endregion
+//#region src/pageSpace/rendering.ts
+/** A page-space render target in the file's coordinates. `visible` is the page's visible box. */
+function pdfRenderTargetOf(target, visible) {
+	return target.kind === "rect" ? {
+		...target,
+		rect: require_calibrate.pdfRectOf(target.rect, visible)
+	} : target;
 }
 /**
-* Classify an update patch against the annotation's current DTO.
-*
-* 1. Value-diff: drop keys whose value semantically equals the current one,
-*    plus the always-inert metadata keys (and per-kind inert keys: `contents`
-*    where it isn't painted, advisory `rotation` on the vertex family).
-*    Nothing left → `'inert'`.
-* 2. If every remaining key is translatable geometry for this kind AND the
-*    values are one rigid translation → `'translation'`.
-* 3. Anything else — style, text, unknown keys, unknown kinds → `'regenerate'`.
+* Where each rendered appearance goes, in page space: raster or encoded, each
+* placed by its `rect`. `visible` is the page's visible box.
 */
-function appearanceImpactOf(current, patch) {
-	if (patch.subtype !== current.subtype) return "regenerate";
-	const cur = current;
-	const pat = patch;
-	const subtype = patch.subtype;
-	const caption = pat.caption === void 0 ? cur.caption : pat.caption;
-	const contentsPainted = CONTENTS_PAINTED.has(subtype) || [
-		"line",
-		"polygon",
-		"polyline"
-	].includes(subtype) && !!caption?.enabled;
-	const touched = [];
-	for (const [key, value] of Object.entries(pat)) {
-		if (value === void 0 || INERT_KEYS.has(key)) continue;
-		if (key === "contents" && !contentsPainted) continue;
-		if (key === "rotation" && ADVISORY_ROTATION.has(subtype)) continue;
-		if (!semanticEqual(value, cur[key])) touched.push(key);
-	}
-	if (touched.length === 0) return "inert";
-	const baseGeometryKeys = TRANSLATABLE_GEOMETRY[subtype];
-	const geometryKeys = baseGeometryKeys && (subtype === "polygon" || subtype === "polyline") && cur.caption?.center ? [...baseGeometryKeys, "caption"] : baseGeometryKeys;
-	if (!geometryKeys) return "regenerate";
-	if (!touched.every((k) => geometryKeys.includes(k))) return "regenerate";
-	return isRigidTranslation(cur, pat, subtype, geometryKeys) ? "translation" : "regenerate";
+function pageAppearancesOf(appearances, visible) {
+	return appearances.map((appearance) => ({
+		...appearance,
+		rect: require_calibrate.pageBoxOf(appearance.rect, visible)
+	}));
 }
 //#endregion
-//#region src/identity/FormFieldRef.ts
+//#region src/pageSpace/forms.ts
+/** A page-space widget placement in the file's coordinates, measured on its page. */
+function pdfWidgetPlacementOf(placement, boxOf) {
+	const { actions, ...rest } = placement;
+	const visible = boxOf(placement.page);
+	return {
+		...rest,
+		...placement.rect ? { rect: require_calibrate.pdfRectOf(placement.rect, visible) } : {},
+		...placement.box ? { box: require_calibrate.pdfRectOf(placement.box, visible) } : {},
+		...actions ? { actions: require_calibrate.mapTriggerActions(actions, (destination) => require_calibrate.pdfDestinationOf(destination, boxOf)) } : {}
+	};
+}
+/** A field draft in the file's coordinates: each widget measured on its own page. */
+function pdfFormFieldDraftOf(draft, boxOf) {
+	if (!draft.widgets) return draft;
+	return {
+		...draft,
+		widgets: draft.widgets.map((widget) => pdfWidgetPlacementOf(widget, boxOf))
+	};
+}
+/** A field's actions in page space, each destination measured on its page. */
+function pageFieldActionsOf(actions, boxOf) {
+	return require_calibrate.mapFieldActions(actions, (destination) => require_calibrate.pageDestinationOf(destination, boxOf));
+}
+/** A form field in page space: each destination of its actions on the page it goes to. */
+function pageFormFieldOf(field, boxOf) {
+	if (!field.actions) return field;
+	return {
+		...field,
+		actions: pageFieldActionsOf(field.actions, boxOf)
+	};
+}
+/** A widget row in page space, measured on its page. */
+function pageWidgetOf(widget, boxOf) {
+	return require_calibrate.pageAnnotationOf(widget, boxOf(widget.page), boxOf);
+}
+/** A form in page space: its fields, and each widget row on its page. */
+function pageFormSnapshotOf(snapshot, boxOf) {
+	return {
+		...snapshot,
+		fields: snapshot.fields.map((field) => pageFormFieldOf(field, boxOf)),
+		widgets: snapshot.widgets.map((widget) => pageWidgetOf(widget, boxOf))
+	};
+}
+//#endregion
+//#region src/forms/draft.ts
 /**
-* URL-safe encoding of a `FormFieldRef`, used by the cloud HTTP surface as
-* the `:fieldKey` route parameter. Decoded by the server back into a
-* `FormFieldRef` via `decodeFieldRefKey`. Mirrors the annotation plane's
-* `encodeStableIdKey` (`obj:42` / `nm:…`) so the two member-key syntaxes
-* read the same on the wire:
-*
-*   `{ kind: 'objectNumber', fieldObjectNumber: 12 }` -> `'obj:12'`
-*   `{ kind: 'fqn', name: 'billing.name' }`           -> `'fqn:billing.name'`
-*
-* The caller is responsible for `encodeURIComponent`-ing the result before
-* splicing it into a URL path; the `wirePaths.layerFormField*` builders
-* already do that. FQNs are opaque strings and may contain anything; the
-* `fqn:` prefix keeps them unambiguous from numeric ids.
+* Whether creating a field from `draft` takes `doc.forms.script`: a script
+* among its actions, or a widget action that holds JavaScript, a submit or a
+* link.
 */
-function encodeFieldRefKey(ref) {
-	if (ref.kind === "objectNumber") {
-		if (!Number.isInteger(ref.fieldObjectNumber) || ref.fieldObjectNumber <= 0) throw new RangeError(`encodeFieldRefKey: fieldObjectNumber must be a positive integer, got ${ref.fieldObjectNumber}`);
-		return `obj:${ref.fieldObjectNumber}`;
-	}
-	return `fqn:${ref.name}`;
+function draftWritesScripts(draft) {
+	return require_value.writesScripts(draft.actions) || (draft.widgets ?? []).some((placement) => require_value.writesScripts(placement.actions));
 }
+//#endregion
+//#region src/forms/placement.ts
 /**
-* Inverse of `encodeFieldRefKey`. Returns `null` for malformed input so the
-* server can answer 400 InvalidArg with a useful message instead of
-* throwing. The input is the already-`decodeURIComponent`-ed segment from
-* the route path. Empty FQNs are rejected: `fqn:` with no suffix is not a
-* valid identity.
+* A placement as the file holds it: `/Rect`, where the widget stands, and
+* its turn. A `box` given is turned into the rect it stands in, as a box
+* kind's create turns it; without one, `rect` is that place.
+*
+* Refused with `InvalidArg`: a placement with neither, and a turn that
+* isn't a quarter turn (a widget's contents turn only so, `/MK /R`).
 */
-function decodeFieldRefKey(key) {
-	if (key.startsWith("obj:")) {
-		const rest = key.slice(4);
-		const n = Number.parseInt(rest, 10);
-		if (!Number.isInteger(n) || n <= 0 || String(n) !== rest) return null;
-		return {
-			kind: "objectNumber",
-			fieldObjectNumber: n
-		};
-	}
-	if (key.startsWith("fqn:")) {
-		const name = key.slice(4);
-		if (name.length === 0) return null;
-		return {
-			kind: "fqn",
-			name
-		};
-	}
-	return null;
+function placedWidgetOf(placement) {
+	const { box, rect, rotation, ...rest } = placement;
+	if (rotation !== void 0 && ![
+		0,
+		90,
+		180,
+		270
+	].includes(rotation)) throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, `a widget turns by a quarter turn (0, 90, 180 or 270), not ${rotation}`, { details: { field: "rotation" } });
+	const place = box ? require_resolveAnnotationDraft.pdfRectTurnedBounds(require_resolveAnnotationDraft.normalizePdfRect(box), rotation ?? 0) : rect;
+	if (!place) throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, "a widget's placement needs its `rect` or its `box`", { details: { field: "rect" } });
+	return {
+		...rest,
+		rect: place,
+		...rotation !== void 0 ? { rotation } : {}
+	};
 }
 //#endregion
 //#region src/signature/analysis/pdf-value.ts
@@ -817,7 +521,7 @@ function parsePdfValue(text) {
 var Parser = class {
 	constructor(text) {
 		this.text = text;
-		require_derive._defineProperty(this, "pos", 0);
+		require_format._defineProperty(this, "pos", 0);
 	}
 	atEnd() {
 		return this.pos >= this.text.length;
@@ -1161,7 +865,7 @@ const ACROFORM_KEYS = /* @__PURE__ */ new Set([
 *   are allowed"): everything but the field's identity and its place in
 *   the tree. v1/08 /V+/AP, 09 /Ff, 10 /Rect, 11 /F, 18 /TU, 21 /DA; 13 /T
 *   forbidden. /AA (v1/12) and /A are accepted by Acrobat and deliberately
-*   NOT listed: an action on a signed form is executable content.
+*   not listed: an action on a signed form is executable content.
 *
 *   fill (a P=2 certification): value and appearance. v1/26 /V+/AP, v3/64
 *   /Ff (ReadOnly added), 65 /DA, 68 /AP stream; v3/66 /TU, 67 /F, v2/50
@@ -1216,7 +920,7 @@ const WIDGET_KEYS_BY_LEVEL = {
 	])
 };
 /**
-* Signing an EXISTING field: its value, appearance and ReadOnly at any
+* Signing an existing field: its value, appearance and ReadOnly at any
 * level; after an approval signature also its tooltip and a /Lock installed
 * with the signature (v1/18, 19: both valid; under P=2 the combination is
 * rejected, v3/69, so neither is allowed at `fill`).
@@ -1249,7 +953,7 @@ function signedFieldKeysFor(level) {
 	return level === "annotate" ? SIGNED_FIELD_KEYS_BY_LEVEL.annotate : SIGNED_FIELD_KEYS_BY_LEVEL.fill;
 }
 /**
-* Rules whose permitted findings do not make a revision a CHANGE of the
+* Rules whose permitted findings do not make a revision a change of the
 * document: an object written again with the sealed value, an object nobody
 * references, a cross-reference container, the trailer's own bookkeeping.
 * A window with nothing else is `unchanged` (Acrobat: "not modified").
@@ -1260,7 +964,7 @@ const NON_EFFECTIVE_RULES = /* @__PURE__ */ new Set([
 	"xref-container",
 	"trailer"
 ]);
-/** The level a step runs at, and the locks it enforces: what the OLDER revision's signatures established. */
+/** The level a step runs at, and the locks it enforces: what the older revision's signatures established. */
 function restrictionsOf(before) {
 	const protection = require_resolver.deriveProtection(before.signatures);
 	return {
@@ -1270,7 +974,7 @@ function restrictionsOf(before) {
 }
 /**
 * Judge one pairwise step. Every reference to a changed object, in the
-* older AND the newer revision, must be claimed by a rule that inspected
+* older and the newer revision, must be claimed by a rule that inspected
 * that use; an unclaimed reference is `unexplained` and forbidden. A
 * truncated value is `incomplete`, never permitted. Pure: JSON in, JSON
 * out, the same code in the browser worker, on the server and in tests.
@@ -1377,7 +1081,7 @@ function indexRoles(s) {
 		for (const w of f.widgets) widgetToField.set(w, f.objectNumber);
 	}
 	const signedFields = /* @__PURE__ */ new Set();
-	for (const sig of s.signatures) if (sig.signed && sig.field.kind === "objectNumber") signedFields.add(sig.field.fieldObjectNumber);
+	for (const sig of s.signatures) if (sig.signed && sig.field.kind === "objectNumber") signedFields.add(sig.field.objectNumber);
 	return {
 		fieldByObj,
 		widgetToField,
@@ -1394,12 +1098,12 @@ var StepContext = class {
 		this.input = input;
 		this.level = level;
 		this.locks = locks;
-		require_derive._defineProperty(this, "findings", []);
-		require_derive._defineProperty(this, "byNum", /* @__PURE__ */ new Map());
-		require_derive._defineProperty(this, "before", void 0);
-		require_derive._defineProperty(this, "after", void 0);
-		require_derive._defineProperty(this, "claims", /* @__PURE__ */ new Map());
-		require_derive._defineProperty(this, "locked", /* @__PURE__ */ new Set());
+		require_format._defineProperty(this, "findings", []);
+		require_format._defineProperty(this, "byNum", /* @__PURE__ */ new Map());
+		require_format._defineProperty(this, "before", void 0);
+		require_format._defineProperty(this, "after", void 0);
+		require_format._defineProperty(this, "claims", /* @__PURE__ */ new Map());
+		require_format._defineProperty(this, "locked", /* @__PURE__ */ new Set());
 		for (const c of input.changes) this.byNum.set(c.objectNumber, c);
 		this.before = indexRoles(input.before);
 		this.after = indexRoles(input.after);
@@ -1498,9 +1202,9 @@ var StepContext = class {
 		const out = [];
 		for (const sig of this.input.after.signatures) {
 			if (!sig.signed || sig.field.kind !== "objectNumber") continue;
-			if (this.before.signedFields.has(sig.field.fieldObjectNumber)) continue;
+			if (this.before.signedFields.has(sig.field.objectNumber)) continue;
 			out.push({
-				fieldObjectNumber: sig.field.fieldObjectNumber,
+				fieldObjectNumber: sig.field.objectNumber,
 				sig
 			});
 		}
@@ -1977,7 +1681,7 @@ function ruleUnexplained(ctx) {
 //#endregion
 //#region src/signature/analysis/restrictions.ts
 /**
-* The restrictions a window is judged under, read from the SEALED
+* The restrictions a window is judged under, read from the sealed
 * revision's structure (what that revision declared, not what the final
 * file says).
 *
@@ -1987,7 +1691,7 @@ function ruleUnexplained(ctx) {
 *     Every certification's level, own or earlier, applies (inherited:
 *     conservative until observed otherwise), as does a /Lock's /P.
 *   - no `judged` (a revision-anchored analysis): every signed signature's
-*     locks and levels, as before.
+*     locks and levels apply.
 */
 function restrictionsFor(before, judged) {
 	const anchors = [];
@@ -2073,9 +1777,9 @@ var EdgeResolver = class {
 		this.read = read;
 		this.anchors = anchors;
 		this.budget = budget;
-		require_derive._defineProperty(this, "memo", /* @__PURE__ */ new Map());
-		require_derive._defineProperty(this, "reads", 0);
-		require_derive._defineProperty(this, "exhausted", false);
+		require_format._defineProperty(this, "memo", /* @__PURE__ */ new Map());
+		require_format._defineProperty(this, "reads", 0);
+		require_format._defineProperty(this, "exhausted", false);
 	}
 	/** Anchored edges of `objectNumber`, or `incomplete` when a budget was exceeded. */
 	resolve(objectNumber) {
@@ -2126,199 +1830,18 @@ var EdgeResolver = class {
 	}
 };
 //#endregion
-//#region src/search/literal.ts
-/**
-* The fold flavor a literal query needs. Haystack and needle MUST be
-* folded with the same options; corpus caches key their pre-folded text
-* on this (the default `{}` fold is the persistable one — non-default
-* queries fold the original page text at query time).
-*/
-function foldOptionsFor(query) {
+//#region src/search/types.ts
+/** The query part of a request (or of any object that carries one): its text and flags, set flags only. */
+function searchQueryOf(query) {
 	return {
-		keepCase: !!query.matchCase,
-		keepMarks: !!query.matchDiacritics,
-		dropWhitespace: !!query.ignoreWhitespace
+		text: query.text,
+		...query.regex ? { regex: true } : {},
+		...query.matchCase ? { matchCase: true } : {},
+		...query.wholeWord ? { wholeWord: true } : {},
+		...query.matchDiacritics ? { matchDiacritics: true } : {},
+		...query.ignoreWhitespace ? { ignoreWhitespace: true } : {}
 	};
 }
-const WORD_UNIT = /[\p{L}\p{N}_]/u;
-const MARK = /\p{M}/u;
-/** Whether the code point ENDING at `index` (exclusive) is a word char. */
-function wordBefore(text, index) {
-	if (index <= 0) return false;
-	const unit = text.charCodeAt(index - 1);
-	const start = unit >= 56320 && unit <= 57343 && index >= 2 ? index - 2 : index - 1;
-	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(start)));
-}
-/** Whether the code point starting at `index` is a word char. */
-function wordAt(text, index) {
-	if (index >= text.length) return false;
-	return WORD_UNIT.test(String.fromCodePoint(text.codePointAt(index)));
-}
-/**
-* Whether the folded hit at `at` sits on word boundaries. Checked on the
-* folded plane, except under `ignoreWhitespace`: dropping whitespace glues
-* neighbouring words together ("i n v o i c e 42" folds to "invoice42"), so there the
-* boundaries are read off the ORIGINAL text around the mapped range.
-*/
-function isWholeWordHit(haystack, at, needleLength, query) {
-	if (!query.ignoreWhitespace) return !wordBefore(haystack.folded, at) && !wordAt(haystack.folded, at + needleLength);
-	const { start, length } = require_derive.toOriginalRange(haystack, at, needleLength);
-	return !wordBefore(haystack.original, start) && !wordAt(haystack.original, start + length);
-}
-/**
-* All non-overlapping literal matches, in original code-unit space.
-* `haystack` must have been folded with `foldOptionsFor(query)`.
-*/
-function matchLiteral(haystack, query) {
-	const needle = require_derive.foldText(query.text, foldOptionsFor(query)).folded;
-	if (needle.trim().length === 0) return [];
-	const out = [];
-	let from = 0;
-	while (from <= haystack.folded.length - needle.length) {
-		const at = haystack.folded.indexOf(needle, from);
-		if (at < 0) break;
-		if (query.wholeWord && !isWholeWordHit(haystack, at, needle.length, query)) {
-			from = at + 1;
-			continue;
-		}
-		if (query.matchDiacritics && at + needle.length < haystack.folded.length) {
-			const after = haystack.folded.codePointAt(at + needle.length);
-			if (MARK.test(String.fromCodePoint(after))) {
-				from = at + 1;
-				continue;
-			}
-		}
-		out.push(require_derive.toOriginalRange(haystack, at, needle.length));
-		from = at + needle.length;
-	}
-	return out;
-}
-//#endregion
-//#region src/search/regex.ts
-/**
-* The portable search-regex dialect: JavaScript `u`-mode syntax MINUS the
-* features RE2 refuses (backreferences, lookaround). The local engine
-* executes patterns with JS `RegExp`; the server executes the SAME
-* pattern with RE2, whose linear-time guarantee is the ReDoS defense.
-* Restricting both sides to the common subset keeps one query string
-* valid — and equally powerful — everywhere.
-*/
-const SEARCH_REGEX_MAX_LENGTH = 512;
-/**
-* Validate a pattern against the dialect. Cheap and dependency-free —
-* viewers call it on keystroke for early feedback; engines re-validate
-* and reject bad patterns with `InvalidArg`.
-*/
-function validateSearchRegex(pattern) {
-	if (pattern.length === 0) return {
-		ok: false,
-		issue: "empty",
-		message: "Pattern is empty."
-	};
-	if (pattern.length > 512) return {
-		ok: false,
-		issue: "too-long",
-		message: `Pattern exceeds 512 characters.`
-	};
-	let inClass = false;
-	for (let i = 0; i < pattern.length; i++) {
-		const ch = pattern[i];
-		if (ch === "\\") {
-			const next = pattern[i + 1] ?? "";
-			if (!inClass && next >= "1" && next <= "9") return {
-				ok: false,
-				issue: "backreference",
-				message: `Backreference \\${next} is not supported.`
-			};
-			if (!inClass && next === "k" && pattern[i + 2] === "<") return {
-				ok: false,
-				issue: "backreference",
-				message: "Named backreferences (\\k<…>) are not supported."
-			};
-			i++;
-			continue;
-		}
-		if (inClass) {
-			if (ch === "]") inClass = false;
-			continue;
-		}
-		if (ch === "[") {
-			inClass = true;
-			continue;
-		}
-		if (ch === "(" && pattern[i + 1] === "?") {
-			const tag = pattern[i + 2] ?? "";
-			if (tag === "=" || tag === "!") return {
-				ok: false,
-				issue: "lookaround",
-				message: "Lookahead ((?=…), (?!…)) is not supported."
-			};
-			if (tag === "<" && (pattern[i + 3] === "=" || pattern[i + 3] === "!")) return {
-				ok: false,
-				issue: "lookaround",
-				message: "Lookbehind ((?<=…), (?<!…)) is not supported."
-			};
-		}
-	}
-	try {
-		new RegExp(pattern, "mu");
-	} catch (error) {
-		return {
-			ok: false,
-			issue: "syntax",
-			message: error.message
-		};
-	}
-	return { ok: true };
-}
-function validateSearchQuery(query) {
-	if (!query.regex) return { ok: true };
-	if (query.matchDiacritics) return {
-		ok: false,
-		issue: "diacritics-with-regex",
-		message: "Diacritic-sensitive matching is not available for regex patterns (regex runs on the raw text plane)."
-	};
-	if (query.ignoreWhitespace) return {
-		ok: false,
-		issue: "ignore-whitespace-with-regex",
-		message: "Whitespace-insensitive matching is not available for regex patterns (regex runs on the raw text plane; use \\s* in the pattern)."
-	};
-	return validateSearchRegex(query.text);
-}
-/**
-* All matches of a dialect-valid pattern over the RAW page text (regex
-* does not run against folded text — case handling is the `i` flag, and
-* diacritic folding never applies). `wholeWord` is a boundary POST-FILTER
-* using the same Unicode word test as the literal path — never `\b`,
-* whose ASCII word set would give the toggle different semantics in regex
-* mode ("caf" whole-word matching inside "café"). Filtering after the
-* match also survives the move to RE2 server-side. Zero-length matches
-* are skipped: search UI cannot highlight nothing, and skipping them is
-* also the infinite-loop guard for patterns like `a*`.
-*/
-function matchRegex(text, query) {
-	const valid = validateSearchQuery({
-		...query,
-		regex: true
-	});
-	if (!valid.ok) throw new Error(`Invalid search query (${valid.issue}): ${valid.message}`);
-	const re = new RegExp(query.text, query.matchCase ? "gmu" : "gimu");
-	const out = [];
-	let m;
-	while ((m = re.exec(text)) !== null) {
-		if (m[0].length === 0) {
-			const unit = text.charCodeAt(re.lastIndex);
-			re.lastIndex += unit >= 55296 && unit <= 56319 ? 2 : 1;
-			continue;
-		}
-		if (query.wholeWord && (wordBefore(text, m.index) || wordAt(text, m.index + m[0].length))) continue;
-		out.push({
-			start: m.index,
-			length: m[0].length
-		});
-	}
-	return out;
-}
 //#endregion
 //#region src/search/matcher.ts
 /**
@@ -2329,8 +1852,8 @@ function matchRegex(text, query) {
 * here.
 */
 function matchPageText(text, query) {
-	if (query.regex) return matchRegex(text, query);
-	return matchLiteral(require_derive.foldText(text, foldOptionsFor(query)), query);
+	if (query.regex) return require_viewport.matchRegex(text, query);
+	return require_viewport.matchLiteral(require_calibrate.foldText(text, require_viewport.foldOptionsFor(query)), query);
 }
 //#endregion
 //#region src/search/snippet.ts
@@ -2343,13 +1866,13 @@ const isLowSurrogate = (text, index) => {
 	return unit >= 56320 && unit <= 57343;
 };
 /**
-* The `'full'`-mode excerpt around one match: up to `context` code units
-* of page text on each side, trimmed to a whitespace boundary when one
+* The excerpt around one match (`snippets: true`): up to `context` code
+* units of page text on each side, trimmed to a whitespace boundary when one
 * exists inside the window (so snippets start and end on whole words),
-* never splitting a surrogate pair, whitespace flattened 1:1.
+* never splitting a surrogate pair, whitespace flattened to spaces.
 */
 function buildSnippet(text, range, context = 48) {
-	const matchEnd = range.start + range.length;
+	const matchEnd = range.start + range.count;
 	let start = Math.max(0, range.start - context);
 	if (start > 0) {
 		for (let i = start; i < range.start; i++) if (WHITESPACE.test(text[i])) {
@@ -2366,484 +1889,31 @@ function buildSnippet(text, range, context = 48) {
 		}
 		if (isLowSurrogate(text, end)) end--;
 	}
+	const flat = (from, to) => text.slice(from, to).replace(WHITESPACE_ALL, " ");
 	return {
-		text: text.slice(start, end).replace(WHITESPACE_ALL, " "),
-		matchStart: range.start - start,
-		matchLength: range.length
+		before: flat(start, range.start),
+		match: flat(range.start, matchEnd),
+		after: flat(matchEnd, end)
 	};
 }
 //#endregion
-//#region src/text/layout.ts
-const FLAG_EMPTY = 2;
-const isBoundary = (flags) => (flags & 3) !== 0;
-const isEmpty = (flags) => (flags & FLAG_EMPTY) !== 0;
-const CHAR_DISTANCE_FACTOR = 2.5;
-const FONT_SIZE_RATIO_THRESHOLD = 1.5;
-const VERTICAL_OVERLAP_THRESHOLD = .8;
-const LINE_OVERLAP_THRESHOLD = .5;
-/** Baseline directions within ~0.5° share a frame. */
-const FRAME_DOT_TOLERANCE = Math.cos(.0087);
-const EDGE_EPSILON = 1e-6;
-const IDENTITY_FRAME = {
-	baseline: {
-		x: 1,
-		y: 0
-	},
-	ascent: {
-		x: 0,
-		y: 1
-	}
-};
-const toFrame = (f, p) => ({
-	x: p.x * f.baseline.x + p.y * f.baseline.y,
-	y: p.x * f.ascent.x + p.y * f.ascent.y
-});
-const fromFrame = (f, p) => ({
-	x: f.baseline.x * p.x + f.ascent.x * p.y,
-	y: f.baseline.y * p.x + f.ascent.y * p.y
-});
-const ZERO_RECT = {
-	left: 0,
-	bottom: 0,
-	right: 0,
-	top: 0
-};
-/** Frame-local AABB of a page-space cell (exact under the frame's rotation;
-*  shear residue is the documented in-frame envelope). */
-function frameBoxOfQuad(f, q) {
-	const pts = [
-		q.p1,
-		q.p2,
-		q.p3,
-		q.p4
-	].map((p) => toFrame(f, p));
-	const xs = pts.map((p) => p.x);
-	const ys = pts.map((p) => p.y);
-	return {
-		left: Math.min(...xs),
-		bottom: Math.min(...ys),
-		right: Math.max(...xs),
-		top: Math.max(...ys)
-	};
-}
-/** Find-or-create the frame for a rotated run, keyed by the baseline
-*  direction + ascent handedness of its first classifiable glyph's edges. */
-function frameForRun(frames, run) {
-	const seed = run.glyphs.find((g) => !isEmpty(g.flags));
-	if (!seed) return 0;
-	const q = seed.looseQuad;
-	const bx = q.p2.x - q.p1.x;
-	const by = q.p2.y - q.p1.y;
-	const len = Math.hypot(bx, by);
-	if (len <= EDGE_EPSILON) return 0;
-	const baseline = {
-		x: bx / len,
-		y: by / len
-	};
-	const ax = q.p1.x - q.p3.x;
-	const ay = q.p1.y - q.p3.y;
-	const sign = baseline.x * ay - baseline.y * ax >= 0 ? 1 : -1;
-	const ascent = {
-		x: -baseline.y * sign,
-		y: baseline.x * sign
-	};
-	for (let i = 0; i < frames.length; i++) {
-		const f = frames[i];
-		const dot = f.baseline.x * baseline.x + f.baseline.y * baseline.y;
-		const sameHandedness = f.ascent.x * ascent.x + f.ascent.y * ascent.y > 0;
-		if (dot >= FRAME_DOT_TOLERANCE && sameHandedness) return i;
-	}
-	frames.push({
-		baseline,
-		ascent
-	});
-	return frames.length - 1;
-}
-/**
-* Flatten a page's geometry snapshot into the canonical layout. Upright runs
-* copy their wire boxes verbatim (frame 0 — byte-identical to the
-* pre-orientation behavior, wire run rects included); rotated runs project
-* their glyph cells into their cluster's frame.
-*/
-function buildPageTextLayout(snapshot) {
-	const glyphs = [];
-	const runs = [];
-	const frames = [IDENTITY_FRAME];
-	for (const run of snapshot.runs) {
-		if (!require_derive.isRotatedGeometryRun(run)) {
-			for (const g of run.glyphs) glyphs.push({
-				loose: g.looseBox,
-				tight: g.tightBox,
-				flags: g.flags
-			});
-			runs.push({
-				charStart: run.charStart,
-				count: run.glyphs.length,
-				rect: run.rect,
-				fontSize: run.fontSize,
-				frame: 0
-			});
-			continue;
-		}
-		const frame = frameForRun(frames, run);
-		const f = frames[frame];
-		let runBox = null;
-		for (const g of run.glyphs) {
-			if (isEmpty(g.flags)) {
-				glyphs.push({
-					loose: ZERO_RECT,
-					flags: g.flags
-				});
-				continue;
-			}
-			const loose = frameBoxOfQuad(f, g.looseQuad);
-			const tight = g.tightQuad ? frameBoxOfQuad(f, g.tightQuad) : void 0;
-			glyphs.push({
-				loose,
-				tight,
-				flags: g.flags
-			});
-			runBox = runBox ? {
-				left: Math.min(runBox.left, loose.left),
-				bottom: Math.min(runBox.bottom, loose.bottom),
-				right: Math.max(runBox.right, loose.right),
-				top: Math.max(runBox.top, loose.top)
-			} : loose;
-		}
-		runs.push({
-			charStart: run.charStart,
-			count: run.glyphs.length,
-			rect: runBox ?? ZERO_RECT,
-			fontSize: run.fontSize,
-			frame
-		});
-	}
-	return {
-		glyphs,
-		runs,
-		frames
-	};
-}
-const inRect = (r, p) => p.x >= r.left && p.x <= r.right && p.y >= r.bottom && p.y <= r.top;
-function avgGlyphHeight(layout) {
-	let total = 0;
-	let count = 0;
-	for (const g of layout.glyphs) {
-		if (isEmpty(g.flags)) continue;
-		total += g.loose.top - g.loose.bottom;
-		count++;
-	}
-	return count === 0 ? 0 : total / count;
-}
-/** The point expressed in every frame (index-aligned with `layout.frames`).
-*  Frame 0 returns the point itself — no float round-trip on the fast path. */
-function pointPerFrame(layout, p) {
-	return layout.frames.map((f, i) => i === 0 ? p : toFrame(f, p));
-}
-/**
-* The glyph (char) index at a page-space point, or null when nothing is near
-* (so callers can show the pointer cursor off-text). PDFium `GetIndexAtPos`:
-* exact tight-box containment first, then a tolerance pass (closest by
-* Manhattan distance within `toleranceFactor × average glyph height`). Each
-* run tests the point in ITS OWN frame, so rotated text hit-tests exactly.
-*/
-function textGlyphAt(layout, point, toleranceFactor = 1.5) {
-	const pts = pointPerFrame(layout, point);
-	for (const run of layout.runs) {
-		const q = pts[run.frame];
-		if (!inRect(run.rect, q)) continue;
-		for (let i = 0; i < run.count; i++) {
-			const g = layout.glyphs[run.charStart + i];
-			if (inRect(g.tight ?? g.loose, q)) return run.charStart + i;
-		}
-	}
-	if (toleranceFactor <= 0) return null;
-	const half = avgGlyphHeight(layout) * toleranceFactor / 2;
-	let best = -1;
-	let bestDist = Infinity;
-	for (const run of layout.runs) {
-		const q = pts[run.frame];
-		const r = run.rect;
-		if (q.x < r.left - half || q.x > r.right + half || q.y < r.bottom - half || q.y > r.top + half) continue;
-		for (let i = 0; i < run.count; i++) {
-			const g = layout.glyphs[run.charStart + i];
-			if (isEmpty(g.flags)) continue;
-			const b = g.tight ?? g.loose;
-			if (q.x < b.left - half || q.x > b.right + half || q.y < b.bottom - half || q.y > b.top + half) continue;
-			const dx = Math.min(Math.abs(q.x - b.left), Math.abs(q.x - b.right));
-			const dy = Math.min(Math.abs(q.y - b.bottom), Math.abs(q.y - b.top));
-			if (dx + dy < bestDist) {
-				bestDist = dx + dy;
-				best = run.charStart + i;
-			}
-		}
-	}
-	return best >= 0 ? best : null;
-}
-/** Double-click: the word around `glyph` (walk to space/empty glyphs both ways). */
-function expandTextRangeToWord(layout, glyph) {
-	const n = layout.glyphs.length;
-	if (glyph < 0 || glyph >= n) return [glyph, glyph];
-	let from = glyph;
-	while (from > 0 && !isBoundary(layout.glyphs[from - 1].flags)) from--;
-	let to = glyph;
-	while (to < n - 1 && !isBoundary(layout.glyphs[to + 1].flags)) to++;
-	return [from, to];
-}
-/** Triple-click: the full visual line — SAME-FRAME runs whose vertical extent
-*  overlaps the anchor run's. A differently-oriented run is a line boundary. */
-function expandTextRangeToLine(layout, glyph) {
-	const ri = layout.runs.findIndex((r) => glyph >= r.charStart && glyph < r.charStart + r.count);
-	if (ri < 0) return [glyph, glyph];
-	const anchor = layout.runs[ri];
-	const bottom = anchor.rect.bottom;
-	const top = anchor.rect.top;
-	let from = anchor.charStart;
-	let to = anchor.charStart + anchor.count - 1;
-	for (let r = ri - 1; r >= 0; r--) {
-		const run = layout.runs[r];
-		if (isZero(run.rect)) continue;
-		if (run.frame !== anchor.frame) break;
-		if (!overlapV(run.rect.bottom, run.rect.top, bottom, top)) break;
-		from = run.charStart;
-	}
-	for (let r = ri + 1; r < layout.runs.length; r++) {
-		const run = layout.runs[r];
-		if (isZero(run.rect)) continue;
-		if (run.frame !== anchor.frame) break;
-		if (!overlapV(run.rect.bottom, run.rect.top, bottom, top)) break;
-		to = run.charStart + run.count - 1;
-	}
-	return [from, to];
-}
-/**
-* A single glyph's oriented cell in page space, or null for degenerate
-* glyphs — the anchor for caret placement at a selection boundary.
-*/
-function textGlyphQuad(layout, glyph) {
-	const g = layout.glyphs[glyph];
-	if (!g || isEmpty(g.flags)) return null;
-	const b = g.loose;
-	if (b.right <= b.left || b.top <= b.bottom) return null;
-	const run = layout.runs.find((r) => glyph >= r.charStart && glyph < r.charStart + r.count);
-	const f = layout.frames[run?.frame ?? 0];
-	return quadOfFrameRect(f, run?.frame ?? 0, b);
-}
-/**
-* Merged visual-line segments for the half-open char range
-* `[charStart, charStart + charCount)` — THE canonical segmentation. Chars
-* outside the layout are ignored.
-*/
-function textSegmentsForRange(layout, charStart, charCount) {
-	if (charCount <= 0 || layout.glyphs.length === 0) return [];
-	const lo = Math.max(0, charStart);
-	const hi = Math.min(layout.glyphs.length - 1, charStart + charCount - 1);
-	if (hi < lo) return [];
-	const subRuns = [];
-	for (const run of layout.runs) {
-		const runEnd = run.charStart + run.count - 1;
-		if (runEnd < lo || run.charStart > hi) continue;
-		const s = Math.max(lo, run.charStart);
-		const e = Math.min(hi, runEnd);
-		let left = Infinity;
-		let right = -Infinity;
-		let bottom = Infinity;
-		let top = -Infinity;
-		let charCountAcc = 0;
-		let widthSum = 0;
-		let prevRight = -Infinity;
-		let firstX = 0;
-		let lastX = 0;
-		const flush = () => {
-			if (charCountAcc > 0 && left !== Infinity) subRuns.push({
-				rect: {
-					left,
-					bottom,
-					right,
-					top
-				},
-				charCount: charCountAcc,
-				fontSize: run.fontSize,
-				frame: run.frame,
-				firstX,
-				lastX
-			});
-			left = Infinity;
-			right = -Infinity;
-			bottom = Infinity;
-			top = -Infinity;
-			charCountAcc = 0;
-			widthSum = 0;
-			prevRight = -Infinity;
-		};
-		for (let ci = s; ci <= e; ci++) {
-			const g = layout.glyphs[ci];
-			if (isEmpty(g.flags)) continue;
-			const b = g.loose;
-			if (charCountAcc > 0 && prevRight > -Infinity) {
-				const avg = widthSum / charCountAcc;
-				if (avg > 0 && Math.abs(b.left - prevRight) > CHAR_DISTANCE_FACTOR * avg) flush();
-			}
-			const centerX = (b.left + b.right) / 2;
-			if (charCountAcc === 0) firstX = centerX;
-			lastX = centerX;
-			left = Math.min(left, b.left);
-			right = Math.max(right, b.right);
-			bottom = Math.min(bottom, b.bottom);
-			top = Math.max(top, b.top);
-			charCountAcc++;
-			widthSum += b.right - b.left;
-			prevRight = b.right;
-		}
-		flush();
-	}
-	return mergeAdjacentSubRuns(subRuns).map((m) => materializeSegment(layout, m));
-}
-function mergeAdjacentSubRuns(runs) {
-	const out = [];
-	let prev = null;
-	let cur = null;
-	for (const run of runs) {
-		if (prev && cur && prev.frame === run.frame && shouldMerge(prev, run)) cur = {
-			rect: {
-				left: Math.min(cur.rect.left, run.rect.left),
-				bottom: Math.min(cur.rect.bottom, run.rect.bottom),
-				right: Math.max(cur.rect.right, run.rect.right),
-				top: Math.max(cur.rect.top, run.rect.top)
-			},
-			frame: cur.frame,
-			firstX: cur.firstX,
-			lastX: run.lastX
-		};
-		else {
-			if (cur) out.push(cur);
-			cur = {
-				rect: run.rect,
-				frame: run.frame,
-				firstX: run.firstX,
-				lastX: run.lastX
-			};
-		}
-		prev = run;
-	}
-	if (cur && cur.rect.right > cur.rect.left && cur.rect.top > cur.rect.bottom) out.push(cur);
-	return out;
-}
-/** Segment quad for a frame-local rect (frame 0: the rect's own corners,
-*  no float round-trip). Slot order US, UE, LS, LE; frame is y-up, so the
-*  upper corners sit at the frame TOP. */
-function quadOfFrameRect(f, frameIndex, r) {
-	if (frameIndex === 0) return {
-		p1: {
-			x: r.left,
-			y: r.top
-		},
-		p2: {
-			x: r.right,
-			y: r.top
-		},
-		p3: {
-			x: r.left,
-			y: r.bottom
-		},
-		p4: {
-			x: r.right,
-			y: r.bottom
-		}
-	};
-	return {
-		p1: fromFrame(f, {
-			x: r.left,
-			y: r.top
-		}),
-		p2: fromFrame(f, {
-			x: r.right,
-			y: r.top
-		}),
-		p3: fromFrame(f, {
-			x: r.left,
-			y: r.bottom
-		}),
-		p4: fromFrame(f, {
-			x: r.right,
-			y: r.bottom
-		})
-	};
-}
-function materializeSegment(layout, m) {
-	const frame = layout.frames[m.frame];
-	const quad = quadOfFrameRect(frame, m.frame, m.rect);
-	return {
-		quad,
-		rect: m.frame === 0 ? m.rect : {
-			left: Math.min(quad.p1.x, quad.p2.x, quad.p3.x, quad.p4.x),
-			bottom: Math.min(quad.p1.y, quad.p2.y, quad.p3.y, quad.p4.y),
-			right: Math.max(quad.p1.x, quad.p2.x, quad.p3.x, quad.p4.x),
-			top: Math.max(quad.p1.y, quad.p2.y, quad.p3.y, quad.p4.y)
-		},
-		advance: m.lastX >= m.firstX ? 1 : -1
-	};
-}
-function shouldMerge(a, b) {
-	if (a.fontSize != null && b.fontSize != null && a.fontSize > 0 && b.fontSize > 0) {
-		if (Math.max(a.fontSize, b.fontSize) / Math.min(a.fontSize, b.fontSize) > FONT_SIZE_RATIO_THRESHOLD) return false;
-	}
-	if (verticalOverlap(a.rect, b.rect) < VERTICAL_OVERLAP_THRESHOLD) return false;
-	const aw = (a.rect.right - a.rect.left) / a.charCount;
-	const bw = (b.rect.right - b.rect.left) / b.charCount;
-	const aL = a.rect.left - aw;
-	const aR = a.rect.right + aw;
-	const bL = b.rect.left - bw;
-	return aL < b.rect.right + bw && aR > bL;
-}
-function verticalOverlap(a, b) {
-	const ah = a.top - a.bottom;
-	const bh = b.top - b.bottom;
-	if (ah <= 0 || bh <= 0) return 0;
-	const u = Math.max(a.top, b.top) - Math.min(a.bottom, b.bottom);
-	if (u === ah || u === bh) return 1;
-	return Math.max(0, Math.min(a.top, b.top) - Math.max(a.bottom, b.bottom)) / u;
-}
-const isZero = (r) => r.right === r.left && r.top === r.bottom;
-function overlapV(bottom1, top1, bottom2, top2) {
-	const u = Math.max(top1, top2) - Math.min(bottom1, bottom2);
-	if (u === 0) return false;
-	return Math.max(0, Math.min(top1, top2) - Math.max(bottom1, bottom2)) / u >= LINE_OVERLAP_THRESHOLD;
-}
-//#endregion
-//#region src/search/rects.ts
-/**
-* Match-range → canonical visual-line segments. Thin wrappers over the ONE
-* text layout (`src/text/layout.ts`) — search owns matching and cursors,
-* never segmentation, so a match highlights exactly like a selection of the
-* same characters. No frame or merge logic lives here.
-*/
-/** Canonical segments for `[charStart, charStart + charCount)`. */
-function searchSegmentsForRange(snapshot, charStart, charCount) {
-	return textSegmentsForRange(buildPageTextLayout(snapshot), charStart, charCount);
-}
-/** The segments' AABBs — for consumers that genuinely want boxes. */
-function searchRectsForRange(snapshot, charStart, charCount) {
-	return searchSegmentsForRange(snapshot, charStart, charCount).map((s) => s.rect);
-}
-//#endregion
 //#region src/search/epoch.ts
 /**
-* The search CONTENT EPOCH: a deterministic fingerprint of everything a
+* The search content epoch: a deterministic fingerprint of everything a
 * search result depends on — page order/structure (`layoutVersion`) and
 * each page's text content (`contentVersion`), nothing else. Annotation
-* and metadata churn deliberately do NOT move it, so cached search
+* and metadata churn deliberately do not move it, so cached search
 * responses in a collaborative document survive comment storms.
 *
 * Both sides compute it from the manifest they already hold: the client
 * to mint versioned search URLs, the server to validate them (mismatch →
 * NotFound, the standard stale-versioned-read signal). FNV-1a 64-bit —
 * dependency-free and stable; not cryptographic, and doesn't need to be:
-* an adversary can only vary his OWN authorized query results.
+* an adversary can only vary his own authorized query results.
 */
 function searchContentEpoch(manifest) {
 	let input = `${manifest.layoutVersion}`;
-	for (const page of manifest.pages) input += `|${page.state.pageObjectNumber}:${page.cache.contentVersion}`;
+	for (const page of manifest.pages) input += `|${page.page.objectNumber}:${page.cache.contentVersion}`;
 	return fnv1a64(input);
 }
 const FNV_OFFSET = 14695981039346656037n;
@@ -2858,20 +1928,108 @@ function fnv1a64(input) {
 	return hash.toString(16).padStart(16, "0");
 }
 /**
-* Canonicalize a query for CACHE KEYING: default-fold literal queries are
+* Canonicalize a query for cache keying: default-fold literal queries are
 * pre-folded ("Café", "café" and "CAFE" are the same search, so they
 * should be the same cache entry). Semantics are unchanged — the fold is
 * idempotent and exactly what the matcher applies to the needle anyway.
 * Case- or diacritic-sensitive literals and regex patterns pass through
-* untouched (their raw form IS the query).
+* untouched (their raw form is the query).
 */
-function canonicalSearchQuery(query) {
+function canonicalSearchQuery(request) {
+	const query = searchQueryOf(request);
 	if (query.regex || query.matchCase || query.matchDiacritics || query.ignoreWhitespace) return query;
-	const canonical = { text: require_derive.foldText(query.text).folded };
+	const canonical = { text: require_calibrate.foldText(query.text).folded };
 	if (query.wholeWord) canonical.wholeWord = true;
 	return canonical;
 }
 //#endregion
+//#region src/mutation/WriteOptions.ts
+/** What an `opId` may be: what an HTTP header carries (`Idempotency-Key`). */
+const OP_ID = /^[\x21-\x7e]{1,255}$/;
+/**
+* The `opId` a write runs under: the caller's, or a fresh one. The caller's
+* must be 1 to 255 visible ASCII characters, on every engine; anything else
+* is refused with `InvalidArg`.
+*/
+function opIdOf(options) {
+	const opId = options?.opId;
+	if (opId === void 0) return generateUuid();
+	if (!OP_ID.test(opId)) throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, "opId must be 1 to 255 visible ASCII characters", { details: { field: "opId" } });
+	return opId;
+}
+//#endregion
+//#region src/mutation/changeOutcome.ts
+/**
+* The refusals a change keeps under its `opId`, like a success: the document
+* or the caller refused it, so asking again gets the same answer, even once
+* the document has changed so that it would apply. Anything else (an abort, a
+* lost race with another writer, an engine failure) applied nothing, is not
+* kept, and may run again.
+*/
+const KEPT_REFUSALS = /* @__PURE__ */ new Set([
+	require_format.EngineErrorCode.InvalidArg,
+	require_format.EngineErrorCode.NotFound,
+	require_format.EngineErrorCode.Forbidden,
+	require_format.EngineErrorCode.ProtectedDocument,
+	require_format.EngineErrorCode.MalformedPdf,
+	require_format.EngineErrorCode.PayloadTooLarge,
+	require_format.EngineErrorCode.ObjectNumberUnavailable,
+	require_format.EngineErrorCode.LayerFull,
+	require_format.EngineErrorCode.ChangeConflict,
+	require_format.EngineErrorCode.UndoUnavailable
+]);
+/** Whether a change refused with `code` keeps that answer (see `KEPT_REFUSALS`). */
+function isKeptRefusal(code) {
+	return KEPT_REFUSALS.has(code);
+}
+/**
+* What a retry under the same `opId` must send: the change's fingerprint. The
+* same ops with the same bytes give the same fingerprint whatever the order
+* of their keys; bytes count by their content.
+*/
+function changeFingerprint(change) {
+	const text = canonicalJson(change);
+	return `${text.length.toString(36)}-${hashText(text)}`;
+}
+/** `value` as JSON with every object's keys sorted, and bytes as their length and hash. */
+function canonicalJson(value) {
+	if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {
+		const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+		return JSON.stringify({ $bytes: `${bytes.byteLength.toString(36)}-${hashBytes(bytes)}` });
+	}
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/** A 53-bit hash (cyrb53) of a string's UTF-16 units, in base 36. */
+function hashText(text) {
+	let h1 = 3735928559;
+	let h2 = 1103547991;
+	for (let i = 0; i < text.length; i++) {
+		const unit = text.charCodeAt(i);
+		h1 = Math.imul(h1 ^ unit, 2654435761);
+		h2 = Math.imul(h2 ^ unit, 1597334677);
+	}
+	return finish(h1, h2);
+}
+/** The same hash over bytes. */
+function hashBytes(bytes) {
+	let h1 = 3735928559;
+	let h2 = 1103547991;
+	for (const byte of bytes) {
+		h1 = Math.imul(h1 ^ byte, 2654435761);
+		h2 = Math.imul(h2 ^ byte, 1597334677);
+	}
+	return finish(h1, h2);
+}
+function finish(h1, h2) {
+	h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
+	h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
+	h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
+	h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
+	return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(36);
+}
+//#endregion
 //#region src/auth/scope/pdf-bits.ts
 /**
 * ISO 32000 user-access permission bit positions, expressed as integer
@@ -2927,144 +2085,153 @@ function decodePdfBits(raw) {
 	};
 }
 //#endregion
-//#region src/auth/scope/builders.ts
+//#region src/auth/scope/authority.ts
 /**
-* Typed capability constants for customer-side JWT minting.
-*
-* The shape mirrors the dotted capability name so it reads naturally:
-*   caps.doc.text.copy()                  // "doc.text.copy"
-*   caps.doc.download()                   // "doc.download"
-*   caps.doc.download.flattened()         // "doc.download.flattened"
-*   caps.doc.print.high()                 // "doc.print.high"
-*
-* Each leaf is a function returning the literal string (as `const`) so
-* TypeScript catches typos at the call site. Wrappers like `download`
-* and `print` are `Object.assign`'d to be callable AND carry child
-* properties for the refinement capabilities.
+* Check that the caller may use `capability`: `ProtectedDocument` when a
+* signature in the document took it away, `PermissionDenied` when the
+* grants never gave it.
 */
-const caps = { doc: {
-	open: () => "doc.open",
-	render: () => "doc.render",
-	text: {
-		select: () => "doc.text.select",
-		copy: () => "doc.text.copy",
-		search: () => "doc.text.search"
-	},
-	content: { copy: () => "doc.content.copy" },
-	download: Object.assign(() => "doc.download", { flattened: () => "doc.download.flattened" }),
-	print: Object.assign(() => "doc.print", { high: () => "doc.print.high" }),
-	pages: {
-		modify: () => "doc.pages.modify",
-		assemble: () => "doc.pages.assemble"
-	},
-	forms: {
-		read: () => "doc.forms.read",
-		fill: () => "doc.forms.fill",
-		modify: () => "doc.forms.modify"
-	},
-	annotate: {
-		read: () => "doc.annotate.read",
-		modify: () => "doc.annotate.modify"
-	},
-	metadata: { modify: () => "doc.metadata.modify" },
-	attachments: { modify: () => "doc.attachments.modify" },
-	redact: () => "doc.redact"
-} };
+function authorizeCapability(authority, capability) {
+	authorizeUnprotected(authority, capability);
+	const { grants, protection } = authority;
+	if (grants && !require_resolver.checkCapability(capability, grants.scope, grants.pdfBits, protection)) throw new require_resolver.PermissionDenied(capability, "target");
+}
+/** Whether the caller may use `capability`: what {@link authorizeCapability} checks, as a yes or no. */
+function allowsCapability(authority, capability) {
+	const { grants, protection } = authority;
+	if (protection && require_resolver.protectedCapabilities(protection).has(capability)) return false;
+	return !grants || require_resolver.checkCapability(capability, grants.scope, grants.pdfBits, protection);
+}
 /**
-* Builder factory for collab scope filters. Each entity:action pair
-* gets a sub-object with the four filter constructors.
-*
-*   collab.annotations.create.self()           → "annotations:create:self"
-*   collab.annotations.create.group("legal")   → "annotations:create:group=legal"
-*   collab.annotations.update.group("4")       → "annotations:update:group=4"
-*   collab.annotations.delete.createdBy("u-7") → "annotations:delete:createdBy=u-7"
-*   collab.annotations.setGroup.group("legal") → "annotations:set-group:group=legal"
-*   collab.annotations.all.all()               → "annotations:*:all"  (action wildcard)
-*
-* On create, the filter is evaluated against the caller's own identity
-* (no impersonation), so `:self` and `:all` trivially pass; `:group=X`
-* is the meaningful filter — it constrains creation to callers whose
-* default group is X.
+* Check only that no signature in the document took `capability` away
+* (`ProtectedDocument`). Annotation creates, updates and deletes take this
+* for `doc.annotate.modify`; their grants are checked per annotation.
 */
-const collab = { annotations: {
-	create: makeFilterBuilder("annotations", "create"),
-	update: makeFilterBuilder("annotations", "update"),
-	delete: makeFilterBuilder("annotations", "delete"),
-	setGroup: makeSetGroupBuilder(),
-	/** Action wildcard — matches create, update, delete, AND set-group with the given filter. */
-	all: makeFilterBuilder("annotations", "*")
-} };
-function makeFilterBuilder(entity, action) {
-	return {
-		all: () => `${entity}:${action}:all`,
-		self: () => `${entity}:${action}:self`,
-		createdBy: (userId) => `${entity}:${action}:createdBy=${userId}`,
-		group: (groupId) => `${entity}:${action}:group=${groupId}`
+function authorizeUnprotected(authority, capability) {
+	const { protection } = authority;
+	if (protection && require_resolver.protectedCapabilities(protection).has(capability)) throw new require_format.EngineError(require_format.EngineErrorCode.ProtectedDocument, require_resolver.describeProtection(capability, protection));
+}
+/**
+* The capability writing an annotation of `subtype` takes. A widget belongs
+* to a form field, so creating, changing, moving or deleting one is
+* designing the form: `doc.forms.modify`. The annotation scopes
+* (`annotations:*`) never apply to it, and it has no group of its own.
+*/
+function annotationWriteCapability(subtype) {
+	return subtype === "widget" ? "doc.forms.modify" : "doc.annotate.modify";
+}
+/** The capabilities writing all of `annotations` takes, each once. */
+function annotationWriteCapabilities(annotations) {
+	return [...new Set(annotations.map((annotation) => annotationWriteCapability(annotation.subtype)))];
+}
+/**
+* Check a widget write (see {@link annotationWriteCapability}): form design,
+* and no group to set. Returns the actor the write stamps: the editor.
+*/
+function authorizeWidgetWrite(authority, groupId) {
+	const { identity, grants } = authority;
+	if (grants && !require_resolver.checkCapability("doc.forms.modify", grants.scope, grants.pdfBits)) throw new require_resolver.PermissionDenied("doc.forms.modify", "target");
+	if (typeof groupId === "string") throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, "a widget has no group of its own: a form field's group is the field's");
+	const actor = {
+		...identity.userId !== void 0 ? { userId: identity.userId } : {},
+		...identity.displayName !== void 0 ? { displayName: identity.displayName } : {}
 	};
+	return actor.userId || actor.displayName ? actor : void 0;
 }
-function makeSetGroupBuilder() {
-	return {
-		all: () => "annotations:set-group:all",
-		group: (groupId) => `annotations:set-group:group=${groupId}`
+/**
+* Check a create of a `subtype` annotation in `groupId` (the identity's own
+* group without one) and return the actor the write stamps: the creator, in
+* that group. A group other than the identity's takes the authority a
+* reassignment takes. A widget takes form design instead, in no group.
+*/
+function authorizeAnnotationCreate(authority, subtype, groupId) {
+	if (subtype === "widget") return authorizeWidgetWrite(authority, groupId);
+	const { identity, grants } = authority;
+	const group = groupId ?? identity.groupId;
+	if (grants) {
+		if (group !== void 0 && !require_resolver.checkSetGroup("annotations", group, identity.groupId, grants.scope)) throw new require_resolver.PermissionDenied(`annotations:set-group:group=${group}`, "target");
+		if (!require_resolver.checkCollab("create", require_resolver.collabTargetOf({
+			userId: identity.userId,
+			groupId: group
+		}), grants.scope, identity, grants.pdfBits)) throw new require_resolver.PermissionDenied("annotations:create", "target");
+	}
+	const actor = {
+		...identity.userId !== void 0 ? { userId: identity.userId } : {},
+		...group !== void 0 ? { groupId: group } : {},
+		...identity.displayName !== void 0 ? { displayName: identity.displayName } : {}
 	};
+	return actor.userId || actor.groupId || actor.displayName ? actor : void 0;
 }
 /**
-* Builder for the `pdf.permissions` virtual scope. Returns the literal
-* string; provided as a helper for parity with caps/collab in JWT
-* construction code.
+* Check an update of the annotation `owner` describes and return the actor
+* the write stamps: the editor, and the group only when the patch reassigns
+* it. An existing group can be reassigned, never removed. A widget takes form
+* design instead, and its patch sets no group.
 */
-const pdfPermissions = () => "pdf.permissions";
+function authorizeAnnotationUpdate(authority, owner, patchGroupId) {
+	if (owner.subtype === "widget") return authorizeWidgetWrite(authority, patchGroupId);
+	const { identity, grants } = authority;
+	const target = require_resolver.collabTargetOf(owner);
+	if (grants && !require_resolver.checkCollab("update", target, grants.scope, identity, grants.pdfBits)) throw new require_resolver.PermissionDenied("annotations:update", "target");
+	if (patchGroupId === null && target.groupId !== void 0) throw new require_format.EngineError(require_format.EngineErrorCode.InvalidArg, "an annotation's group can't be removed");
+	const reassigning = typeof patchGroupId === "string" && patchGroupId !== target.groupId;
+	if (reassigning && grants && !require_resolver.checkSetGroup("annotations", patchGroupId, identity.groupId, grants.scope)) throw new require_resolver.PermissionDenied(`annotations:set-group:group=${patchGroupId}`, "target");
+	const actor = {
+		...identity.userId !== void 0 ? { userId: identity.userId } : {},
+		...identity.displayName !== void 0 ? { displayName: identity.displayName } : {},
+		...reassigning ? { groupId: patchGroupId } : {}
+	};
+	return actor.userId || actor.groupId || actor.displayName ? actor : void 0;
+}
 /**
-* Materialise `pdf.permissions` into the concrete capability list it
-* would expand to under the given PDF bit configuration.
-*
-* Useful when the customer wants to start from PDF defaults and then
-* subtract specific capabilities — easier to build the JWT scope array
-* by filtering an explicit list than by composing virtual + denials.
-*
-*   const defaults = materializePdfPermissions(pdfBits);
-*   const scope = [
-*     ...defaults.filter(s => s !== 'doc.text.copy'),
-*     'doc.download',
-*   ];
-*
-* IMPORTANT: this MUST stay in sync with `addPdfPermissions` inside
-* resolver.ts. A test pins them together.
+* Check a delete of every annotation it removes (an annotation goes with its
+* thread and popups): all or nothing, `PermissionDenied` naming each one
+* refused. A widget takes form design, never the annotation scopes.
 */
-function materializePdfPermissions(b) {
-	const out = /* @__PURE__ */ new Set();
-	out.add("doc.open");
-	out.add("doc.render");
-	out.add("doc.annotate.read");
-	out.add("doc.forms.read");
-	if (b.bit5) {
-		out.add("doc.text.select");
-		out.add("doc.text.copy");
-		out.add("doc.text.search");
-		out.add("doc.content.copy");
-	}
-	if (b.bit3) out.add("doc.print");
-	if (b.bit12 && b.bit3) out.add("doc.print.high");
-	if (b.bit4) {
-		out.add("doc.pages.modify");
-		out.add("doc.redact");
-		out.add("doc.metadata.modify");
-		out.add("doc.attachments.modify");
-	}
-	if (b.bit11) out.add("doc.pages.assemble");
-	if (b.bit6) out.add("doc.annotate.modify");
-	if (b.bit6 || b.bit9) {
-		out.add("doc.forms.fill");
-		out.add("doc.sign");
-	}
-	if (b.bit6 && b.bit4) out.add("doc.forms.modify");
-	return [...out];
+function authorizeAnnotationDelete(authority, members) {
+	const { identity, grants } = authority;
+	if (!grants) return;
+	const mayDesign = require_resolver.checkCapability("doc.forms.modify", grants.scope, grants.pdfBits);
+	const refused = members.filter((member) => member.subtype === "widget" ? !mayDesign : !require_resolver.checkCollab("delete", require_resolver.collabTargetOf(member), grants.scope, identity, grants.pdfBits));
+	if (refused.length > 0) throw new require_resolver.PermissionDenied("annotations:delete", "target", void 0, refused.map((member) => member.ref));
 }
-//#endregion
-//#region src/measure/viewport.ts
-/** Last containing viewport wins. A foreign measure still wins; never guess a fallback. */
-function viewportForPoint(viewports, point) {
-	return [...viewports].reverse().find(({ bbox: b }) => point.x >= b.left && point.x <= b.right && point.y >= b.bottom && point.y <= b.top);
+/**
+* Check that the caller may `action` (fill in, or sign) the field in
+* `groupId`: `ProtectedDocument` when a signature in the document took the
+* capability away, `PermissionDenied` naming the scope it would take when
+* the grants don't reach the field's group.
+*/
+function authorizeFieldWrite(authority, groupId, action) {
+	authorizeUnprotected(authority, fieldCapability(action));
+	if (!allowsFieldWrite(authority, groupId, action)) throw new require_resolver.PermissionDenied(groupId === null ? fieldCapability(action) : `fields:${action}:group=${groupId}`, "target");
+}
+/** Whether the caller may `action` the field in `groupId`: what {@link authorizeFieldWrite} checks. */
+function allowsFieldWrite(authority, groupId, action) {
+	const { grants, protection } = authority;
+	if (protection && require_resolver.protectedCapabilities(protection).has(fieldCapability(action))) return false;
+	return !grants || require_resolver.checkFieldAction(action, groupId, grants.scope, grants.pdfBits, protection);
+}
+/**
+* Whether the caller may `action` some field: what a form verb checks
+* before it knows which fields it writes. Each field is then checked in
+* the write with {@link authorizeFieldWrite}.
+*/
+function allowsSomeFieldWrite(authority, action) {
+	const { grants, protection } = authority;
+	if (protection && require_resolver.protectedCapabilities(protection).has(fieldCapability(action))) return false;
+	return !grants || require_resolver.checkAnyFieldAction(action, grants.scope, grants.pdfBits, protection);
+}
+/**
+* Check that the caller may put a form field in `groupId`: their own
+* default group always, another with `fields:set-group` for it.
+*/
+function authorizeFieldGroup(authority, groupId) {
+	const { identity, grants } = authority;
+	if (grants && !require_resolver.checkSetGroup("fields", groupId, identity.groupId, grants.scope)) throw new require_resolver.PermissionDenied(`fields:set-group:group=${groupId}`, "target");
+}
+/** The broad capability a field action takes without a `fields:` scope. */
+function fieldCapability(action) {
+	return action === "fill" ? "doc.forms.fill" : "doc.sign";
 }
 //#endregion
 Object.defineProperty(exports, "DEFAULT_EDGE_RESOLVER_BUDGET", {
@@ -3073,6 +2240,12 @@ Object.defineProperty(exports, "DEFAULT_EDGE_RESOLVER_BUDGET", {
 		return DEFAULT_EDGE_RESOLVER_BUDGET;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_MEDIA_BOX", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_MEDIA_BOX;
+	}
+});
 Object.defineProperty(exports, "DEFAULT_PDF_SAVE_MODE", {
 	enumerable: true,
 	get: function() {
@@ -3085,244 +2258,244 @@ Object.defineProperty(exports, "EdgeResolver", {
 		return EdgeResolver;
 	}
 });
-Object.defineProperty(exports, "NO_ANNOTATION_FLAGS", {
+Object.defineProperty(exports, "PDF_BITS", {
 	enumerable: true,
 	get: function() {
-		return NO_ANNOTATION_FLAGS;
+		return PDF_BITS;
 	}
 });
-Object.defineProperty(exports, "PDF_BITS", {
+Object.defineProperty(exports, "SEARCH_SNIPPET_CONTEXT", {
 	enumerable: true,
 	get: function() {
-		return PDF_BITS;
+		return SEARCH_SNIPPET_CONTEXT;
 	}
 });
-Object.defineProperty(exports, "SEARCH_REGEX_MAX_LENGTH", {
+Object.defineProperty(exports, "USAGE_INCOMPLETE", {
 	enumerable: true,
 	get: function() {
-		return SEARCH_REGEX_MAX_LENGTH;
+		return USAGE_INCOMPLETE;
 	}
 });
-Object.defineProperty(exports, "SEARCH_SNIPPET_CONTEXT", {
+Object.defineProperty(exports, "allowsCapability", {
 	enumerable: true,
 	get: function() {
-		return SEARCH_SNIPPET_CONTEXT;
+		return allowsCapability;
 	}
 });
-Object.defineProperty(exports, "UNKNOWN_WEAK_ANNOTATION_STATE", {
+Object.defineProperty(exports, "allowsFieldWrite", {
 	enumerable: true,
 	get: function() {
-		return UNKNOWN_WEAK_ANNOTATION_STATE;
+		return allowsFieldWrite;
 	}
 });
-Object.defineProperty(exports, "USAGE_INCOMPLETE", {
+Object.defineProperty(exports, "allowsSomeFieldWrite", {
 	enumerable: true,
 	get: function() {
-		return USAGE_INCOMPLETE;
+		return allowsSomeFieldWrite;
 	}
 });
-Object.defineProperty(exports, "appearanceImpactOf", {
+Object.defineProperty(exports, "annotationImportFacts", {
 	enumerable: true,
 	get: function() {
-		return appearanceImpactOf;
+		return annotationImportFacts;
 	}
 });
-Object.defineProperty(exports, "assessmentOf", {
+Object.defineProperty(exports, "annotationPatchBetween", {
 	enumerable: true,
 	get: function() {
-		return assessmentOf;
+		return annotationPatchBetween;
 	}
 });
-Object.defineProperty(exports, "buildCommentThreads", {
+Object.defineProperty(exports, "annotationWriteCapabilities", {
 	enumerable: true,
 	get: function() {
-		return buildCommentThreads;
+		return annotationWriteCapabilities;
 	}
 });
-Object.defineProperty(exports, "buildPageTextLayout", {
+Object.defineProperty(exports, "annotationWriteCapability", {
 	enumerable: true,
 	get: function() {
-		return buildPageTextLayout;
+		return annotationWriteCapability;
 	}
 });
-Object.defineProperty(exports, "buildSnippet", {
+Object.defineProperty(exports, "assessmentOf", {
 	enumerable: true,
 	get: function() {
-		return buildSnippet;
+		return assessmentOf;
 	}
 });
-Object.defineProperty(exports, "canonicalSearchQuery", {
+Object.defineProperty(exports, "authorizeAnnotationCreate", {
 	enumerable: true,
 	get: function() {
-		return canonicalSearchQuery;
+		return authorizeAnnotationCreate;
 	}
 });
-Object.defineProperty(exports, "caps", {
+Object.defineProperty(exports, "authorizeAnnotationDelete", {
 	enumerable: true,
 	get: function() {
-		return caps;
+		return authorizeAnnotationDelete;
 	}
 });
-Object.defineProperty(exports, "changedKeys", {
+Object.defineProperty(exports, "authorizeAnnotationUpdate", {
 	enumerable: true,
 	get: function() {
-		return changedKeys;
+		return authorizeAnnotationUpdate;
 	}
 });
-Object.defineProperty(exports, "changesAnnotationList", {
+Object.defineProperty(exports, "authorizeCapability", {
 	enumerable: true,
 	get: function() {
-		return changesAnnotationList;
+		return authorizeCapability;
 	}
 });
-Object.defineProperty(exports, "collab", {
+Object.defineProperty(exports, "authorizeFieldGroup", {
 	enumerable: true,
 	get: function() {
-		return collab;
+		return authorizeFieldGroup;
 	}
 });
-Object.defineProperty(exports, "combine", {
+Object.defineProperty(exports, "authorizeFieldWrite", {
 	enumerable: true,
 	get: function() {
-		return combine;
+		return authorizeFieldWrite;
 	}
 });
-Object.defineProperty(exports, "conclude", {
+Object.defineProperty(exports, "authorizeUnprotected", {
 	enumerable: true,
 	get: function() {
-		return conclude;
+		return authorizeUnprotected;
 	}
 });
-Object.defineProperty(exports, "createPageImageHandle", {
+Object.defineProperty(exports, "buildSnippet", {
 	enumerable: true,
 	get: function() {
-		return createPageImageHandle;
+		return buildSnippet;
 	}
 });
-Object.defineProperty(exports, "decodeFieldRefKey", {
+Object.defineProperty(exports, "canonicalSearchQuery", {
 	enumerable: true,
 	get: function() {
-		return decodeFieldRefKey;
+		return canonicalSearchQuery;
 	}
 });
-Object.defineProperty(exports, "decodePdfBits", {
+Object.defineProperty(exports, "changeFingerprint", {
 	enumerable: true,
 	get: function() {
-		return decodePdfBits;
+		return changeFingerprint;
 	}
 });
-Object.defineProperty(exports, "decodeStableIdKey", {
+Object.defineProperty(exports, "changedKeys", {
 	enumerable: true,
 	get: function() {
-		return decodeStableIdKey;
+		return changedKeys;
 	}
 });
-Object.defineProperty(exports, "decodeSubmitFormFlags", {
+Object.defineProperty(exports, "checkImageQuality", {
 	enumerable: true,
 	get: function() {
-		return decodeSubmitFormFlags;
+		return checkImageQuality;
 	}
 });
-Object.defineProperty(exports, "dictEntries", {
+Object.defineProperty(exports, "closeExportSelection", {
 	enumerable: true,
 	get: function() {
-		return dictEntries;
+		return closeExportSelection;
 	}
 });
-Object.defineProperty(exports, "encodeFieldRefKey", {
+Object.defineProperty(exports, "combine", {
 	enumerable: true,
 	get: function() {
-		return encodeFieldRefKey;
+		return combine;
 	}
 });
-Object.defineProperty(exports, "encodeStableIdKey", {
+Object.defineProperty(exports, "concatAnnotationLists", {
 	enumerable: true,
 	get: function() {
-		return encodeStableIdKey;
+		return concatAnnotationLists;
 	}
 });
-Object.defineProperty(exports, "evaluateStep", {
+Object.defineProperty(exports, "conclude", {
 	enumerable: true,
 	get: function() {
-		return evaluateStep;
+		return conclude;
 	}
 });
-Object.defineProperty(exports, "expandTextRangeToLine", {
+Object.defineProperty(exports, "createPageImageHandle", {
 	enumerable: true,
 	get: function() {
-		return expandTextRangeToLine;
+		return createPageImageHandle;
 	}
 });
-Object.defineProperty(exports, "expandTextRangeToWord", {
+Object.defineProperty(exports, "decodePdfBits", {
 	enumerable: true,
 	get: function() {
-		return expandTextRangeToWord;
+		return decodePdfBits;
 	}
 });
-Object.defineProperty(exports, "foldOptionsFor", {
+Object.defineProperty(exports, "deletedAnnotationsOf", {
 	enumerable: true,
 	get: function() {
-		return foldOptionsFor;
+		return deletedAnnotationsOf;
 	}
 });
-Object.defineProperty(exports, "invalidatesWeakIndexRefs", {
+Object.defineProperty(exports, "dictEntries", {
 	enumerable: true,
 	get: function() {
-		return invalidatesWeakIndexRefs;
+		return dictEntries;
 	}
 });
-Object.defineProperty(exports, "isStateAnnotation", {
+Object.defineProperty(exports, "draftWritesScripts", {
 	enumerable: true,
 	get: function() {
-		return isStateAnnotation;
+		return draftWritesScripts;
 	}
 });
-Object.defineProperty(exports, "isValidPageObjectNumber", {
+Object.defineProperty(exports, "evaluateStep", {
 	enumerable: true,
 	get: function() {
-		return isValidPageObjectNumber;
+		return evaluateStep;
 	}
 });
-Object.defineProperty(exports, "knownWeakAnnotationState", {
+Object.defineProperty(exports, "familyOfSubtype", {
 	enumerable: true,
 	get: function() {
-		return knownWeakAnnotationState;
+		return familyOfSubtype;
 	}
 });
-Object.defineProperty(exports, "matchLiteral", {
+Object.defineProperty(exports, "generateUuid", {
 	enumerable: true,
 	get: function() {
-		return matchLiteral;
+		return generateUuid;
 	}
 });
-Object.defineProperty(exports, "matchPageText", {
+Object.defineProperty(exports, "generateUuidV7", {
 	enumerable: true,
 	get: function() {
-		return matchPageText;
+		return generateUuidV7;
 	}
 });
-Object.defineProperty(exports, "matchRegex", {
+Object.defineProperty(exports, "imageSourceOfBytes", {
 	enumerable: true,
 	get: function() {
-		return matchRegex;
+		return imageSourceOfBytes;
 	}
 });
-Object.defineProperty(exports, "materializePdfPermissions", {
+Object.defineProperty(exports, "isKeptRefusal", {
 	enumerable: true,
 	get: function() {
-		return materializePdfPermissions;
+		return isKeptRefusal;
 	}
 });
-Object.defineProperty(exports, "normalizeAnnotationDraft", {
+Object.defineProperty(exports, "matchPageText", {
 	enumerable: true,
 	get: function() {
-		return normalizeAnnotationDraft;
+		return matchPageText;
 	}
 });
-Object.defineProperty(exports, "normalizeAnnotationPatch", {
+Object.defineProperty(exports, "mergeAnnotationPatch", {
 	enumerable: true,
 	get: function() {
-		return normalizeAnnotationPatch;
+		return mergeAnnotationPatch;
 	}
 });
 Object.defineProperty(exports, "normalizeAttachmentFileSource", {
@@ -3331,166 +2504,166 @@ Object.defineProperty(exports, "normalizeAttachmentFileSource", {
 		return normalizeAttachmentFileSource;
 	}
 });
-Object.defineProperty(exports, "parsePdfValue", {
+Object.defineProperty(exports, "opIdOf", {
 	enumerable: true,
 	get: function() {
-		return parsePdfValue;
+		return opIdOf;
 	}
 });
-Object.defineProperty(exports, "pdfPermissions", {
+Object.defineProperty(exports, "pageAppearancesOf", {
 	enumerable: true,
 	get: function() {
-		return pdfPermissions;
+		return pageAppearancesOf;
 	}
 });
-Object.defineProperty(exports, "pdfValueEquals", {
+Object.defineProperty(exports, "pageBoxesOf", {
 	enumerable: true,
 	get: function() {
-		return pdfValueEquals;
+		return pageBoxesOf;
 	}
 });
-Object.defineProperty(exports, "primaryFinding", {
+Object.defineProperty(exports, "pageFieldActionsOf", {
 	enumerable: true,
 	get: function() {
-		return primaryFinding;
+		return pageFieldActionsOf;
 	}
 });
-Object.defineProperty(exports, "refsOf", {
+Object.defineProperty(exports, "pageFormFieldOf", {
 	enumerable: true,
 	get: function() {
-		return refsOf;
+		return pageFormFieldOf;
 	}
 });
-Object.defineProperty(exports, "resolveBinarySource", {
+Object.defineProperty(exports, "pageFormSnapshotOf", {
 	enumerable: true,
 	get: function() {
-		return resolveBinarySource;
+		return pageFormSnapshotOf;
 	}
 });
-Object.defineProperty(exports, "restrictionsFor", {
+Object.defineProperty(exports, "pageLayoutOf", {
 	enumerable: true,
 	get: function() {
-		return restrictionsFor;
+		return pageLayoutOf;
 	}
 });
-Object.defineProperty(exports, "restrictionsOf", {
+Object.defineProperty(exports, "pageListOf", {
 	enumerable: true,
 	get: function() {
-		return restrictionsOf;
+		return pageListOf;
 	}
 });
-Object.defineProperty(exports, "revisionTokensEqual", {
+Object.defineProperty(exports, "pageRotationOf", {
 	enumerable: true,
 	get: function() {
-		return revisionTokensEqual;
+		return pageRotationOf;
 	}
 });
-Object.defineProperty(exports, "richTextParagraphsFromPlainText", {
+Object.defineProperty(exports, "pageSpaceBoxesOf", {
 	enumerable: true,
 	get: function() {
-		return richTextParagraphsFromPlainText;
+		return pageSpaceBoxesOf;
 	}
 });
-Object.defineProperty(exports, "richTextPlainText", {
+Object.defineProperty(exports, "pageWidgetOf", {
 	enumerable: true,
 	get: function() {
-		return richTextPlainText;
+		return pageWidgetOf;
 	}
 });
-Object.defineProperty(exports, "sameEffectiveValue", {
+Object.defineProperty(exports, "parsePdfValue", {
 	enumerable: true,
 	get: function() {
-		return sameEffectiveValue;
+		return parsePdfValue;
 	}
 });
-Object.defineProperty(exports, "searchContentEpoch", {
+Object.defineProperty(exports, "pdfFormFieldDraftOf", {
 	enumerable: true,
 	get: function() {
-		return searchContentEpoch;
+		return pdfFormFieldDraftOf;
 	}
 });
-Object.defineProperty(exports, "searchRectsForRange", {
+Object.defineProperty(exports, "pdfRenderTargetOf", {
 	enumerable: true,
 	get: function() {
-		return searchRectsForRange;
+		return pdfRenderTargetOf;
 	}
 });
-Object.defineProperty(exports, "searchSegmentsForRange", {
+Object.defineProperty(exports, "pdfValueEquals", {
 	enumerable: true,
 	get: function() {
-		return searchSegmentsForRange;
+		return pdfValueEquals;
 	}
 });
-Object.defineProperty(exports, "semanticEqual", {
+Object.defineProperty(exports, "pdfWidgetPlacementOf", {
 	enumerable: true,
 	get: function() {
-		return semanticEqual;
+		return pdfWidgetPlacementOf;
 	}
 });
-Object.defineProperty(exports, "shiftsExistingAnnotationIndices", {
+Object.defineProperty(exports, "placedWidgetOf", {
 	enumerable: true,
 	get: function() {
-		return shiftsExistingAnnotationIndices;
+		return placedWidgetOf;
 	}
 });
-Object.defineProperty(exports, "sniffBinaryMetadata", {
+Object.defineProperty(exports, "primaryFinding", {
 	enumerable: true,
 	get: function() {
-		return sniffBinaryMetadata;
+		return primaryFinding;
 	}
 });
-Object.defineProperty(exports, "stableStringify", {
+Object.defineProperty(exports, "refsOf", {
 	enumerable: true,
 	get: function() {
-		return stableStringify;
+		return refsOf;
 	}
 });
-Object.defineProperty(exports, "textGlyphAt", {
+Object.defineProperty(exports, "resolvePageLayers", {
 	enumerable: true,
 	get: function() {
-		return textGlyphAt;
+		return resolvePageLayers;
 	}
 });
-Object.defineProperty(exports, "textGlyphQuad", {
+Object.defineProperty(exports, "restrictionsFor", {
 	enumerable: true,
 	get: function() {
-		return textGlyphQuad;
+		return restrictionsFor;
 	}
 });
-Object.defineProperty(exports, "textSegmentsForRange", {
+Object.defineProperty(exports, "restrictionsOf", {
 	enumerable: true,
 	get: function() {
-		return textSegmentsForRange;
+		return restrictionsOf;
 	}
 });
-Object.defineProperty(exports, "validateSearchQuery", {
+Object.defineProperty(exports, "sameEffectiveValue", {
 	enumerable: true,
 	get: function() {
-		return validateSearchQuery;
+		return sameEffectiveValue;
 	}
 });
-Object.defineProperty(exports, "validateSearchRegex", {
+Object.defineProperty(exports, "searchContentEpoch", {
 	enumerable: true,
 	get: function() {
-		return validateSearchRegex;
+		return searchContentEpoch;
 	}
 });
-Object.defineProperty(exports, "viewportForPoint", {
+Object.defineProperty(exports, "searchQueryOf", {
 	enumerable: true,
 	get: function() {
-		return viewportForPoint;
+		return searchQueryOf;
 	}
 });
-Object.defineProperty(exports, "wordAt", {
+Object.defineProperty(exports, "stableStringify", {
 	enumerable: true,
 	get: function() {
-		return wordAt;
+		return stableStringify;
 	}
 });
-Object.defineProperty(exports, "wordBefore", {
+Object.defineProperty(exports, "visibleBoxesOf", {
 	enumerable: true,
 	get: function() {
-		return wordBefore;
+		return visibleBoxesOf;
 	}
 });
 Object.defineProperty(exports, "worstVerdict", {
@@ -3500,4 +2673,4 @@ Object.defineProperty(exports, "worstVerdict", {
 	}
 });
 
-//# sourceMappingURL=viewport-BWeNHZmb.cjs.map
+//# sourceMappingURL=authority-DLMNR7ff.cjs.map