@embedpdf/engine-core 3.0.0-next.14 → 3.0.0-next.16

package/dist/runtime-BaDKjxiu.d.ts

@@ -0,0 +1,1959 @@
+import { $l as AnnotationImportResult, $u as AttachmentRef, Ap as PageGeometrySnapshot, Ba as FormFieldValue, Bg as SignatureCompleteResult, Bl as WidgetPatch, Bo as WidgetPlacement, Ca as AnnotationPosition, Cd as PdfMeasure, Cp as PageExtractFlatten, Cu as AnnotationExportSelection, Cv as DocumentActionsSnapshot, Dg as BaseVersionInfo, Du as WireAnnotationBundle, Fs as AnnotationDraft, Gg as SignaturePrepared, Gi as Change, Gn as RedactionApplyResult, Hg as SignatureDTO, Is as AnnotationPatch, Kn as RedactionApplyScope, Lp as PageTextSnapshot, Ma as CustomMetadataUpdateResult, Mm as PageFlattenResult, No as FormFieldDraft, Og as DigestAlgorithm, Pl as WireFormBundle, Pm as PageFlattenUsage, Pu as BundleLimits, Q_ as SerializedEngineError, Qc as FormImportResult, Qi as RecordedChange, R_ as FormFieldRef, Rg as SignatureCancelResult, Ru as BundleImportPages, Sa as MetadataUpdateResult, Th as DocumentOutline, Tl as FormExportSelection, Ud as WireAnnotationResources, Wa as FormFieldPatch, Wg as SignaturePrepareInput, X_ as EngineError, Xi as ChangeResult, Yg as SignatureSnapshot, Zg as SignedDocumentPolicy, Zv as PageRef, __ as Coordinates, _l as FormWidgetLinkResult, _p as AnnotationAppearanceRenderOptions, b_ as PageBox, bd as PageMeasurementViewport, bh as CustomMetadata, bl as FormWidgetUpdateResult, cl as FormCalculationsReorderResult, cm as PageNetworkRenderFormat, cp as PdfSaveMode, dl as FormFieldUpdateResult, du as AnnotationReorderResult, fg as AnnotationAuthority, fu as AnnotationUpdateResult, gl as FormWidgetDeleteResult, gm as PageRenderOptions, hl as FormSetValueResult, hn as PageScaleResult, hp as AnnotationAppearanceMode, iy as DocumentMetadata, jg as DocumentProtection, kl as FormSnapshot, lf as ObjectNumberRange, li as ChangeAnalysis, ll as FormFieldCreateResult, lu as AnnotationCreateResult, ml as FormResetResult, nr as PageNameResult, ns as SearchRequest, ov as AnnotationActor, pg as ChangeAuthority, ph as PageListSnapshot, pl as FormRepairResult, q_ as AnnotationRef, qu as Attachment, rl as FormValuesImportResult, rp as FontIdentityInfo, rs as SearchSlice, si as AnalyzeInput, su as WriteOptions, t as AnnotationList, tr as AnnotationFlattenResult, ud as AnnotationFamily, ul as FormFieldDeleteResult, um as PageRaster, uu as AnnotationDeleteResult, v_ as PageCoordinates, wa as FieldPosition, xh as MetadataPatch, xl as FormWidgetsReorderResult, xv as AbortablePromise, yh as CustomMetadataPatch, yp as AnnotationAppearancesResult, yv as PdfBits, zg as SignatureCompleteInput } from "./AnnotationList-DcyhF2kU.js";
+import { C as DocumentEventStream, D as DocumentEventOf, E as DocumentEventInit, O as DocumentEventType, Q as DocumentOutlineService, S as WorkingSetPage, T as DocumentEvent, Z as DocumentPagesService, d as PieceInfoPatch, l as PieceInfoUpdateResult, nt as DocumentAttachmentsService, p as PieceInfoSnapshot, s as PieceInfoDeleteResult, x as CallPriority } from "./LocalEngine-DBt2-GWF.js";
+import { f as PdfPermissionAdvisory, l as DocumentSecurityState, p as PdfPermissionInfo } from "./DocumentSecurityService-YJV9df8P.js";
+//#region src/promise/AbortError.d.ts
+/**
+ * What a cancelled call rejects with: an `EngineError` with code `Aborted`,
+ * named `AbortError` like the DOM's, so both `EngineError.is(err,
+ * EngineErrorCode.Aborted)` and `err.name === 'AbortError'` recognise it.
+ */
+declare class AbortError extends EngineError {
+  readonly name: string;
+  readonly reason: unknown;
+  constructor(reason?: unknown);
+}
+declare function isAbortError(value: unknown): value is AbortError;
+//#endregion
+//#region src/engine/localEngineBrand.d.ts
+/**
+ * Marks what the local engine makes (its engine, documents and pages), so
+ * `isLocalEngine()` and `isLocalDocument()` can tell them apart from another
+ * engine's. `Symbol.for`, so two copies of this package agree.
+ */
+declare const LOCAL_ENGINE_BRAND: unique symbol;
+//#endregion
+//#region src/events/EventHub.d.ts
+/**
+ * The in-process implementation of `DocumentEventStream`, shared by both
+ * engine shells (one hub per open `DocumentHandle`). The engine that
+ * performs a mutation publishes here at confirmation time; the cloud
+ * engine's remote channel will also publish here for other sessions'
+ * mutations — listeners never learn which transport delivered an event.
+ *
+ * Delivery contract:
+ *   - synchronous fan-out in subscription order;
+ *   - error isolation: a throwing listener is re-thrown on a microtask
+ *     (so it surfaces to the host's unhandled-error reporting) without
+ *     blocking other listeners or failing the mutation path;
+ *   - `lastServerId` tracks the highest remote cursor seen, for the
+ *     remote channel's reconnect/backfill.
+ */
+declare class EventHub implements DocumentEventStream {
+  /** Where a throwing listener's error goes. Defaults to an async
+   *  rethrow so it reaches the host's unhandled-error reporting. */
+  private readonly onListenerError;
+  private readonly listeners;
+  private serverId;
+  constructor(
+  /** Where a throwing listener's error goes. Defaults to an async
+   *  rethrow so it reaches the host's unhandled-error reporting. */
+  onListenerError?: (err: unknown) => void);
+  subscribe(listener: (event: DocumentEvent) => void): () => void;
+  on<T extends DocumentEventType>(type: T, listener: (event: DocumentEventOf<T>) => void): () => void;
+  publish(event: DocumentEvent): void;
+  lastServerId(): number | null;
+  /** Drop every listener (handle close). Idempotent. */
+  clear(): void;
+}
+/**
+ * Stamps provenance onto events a mutation path produces. One per open
+ * handle: the engine shell constructs it with the instance's `sessionId`
+ * (and, on cloud, the authenticated `sub` when known) and hands it to the
+ * mutation services — they publish results, never build origins.
+ */
+declare class SessionEventPublisher {
+  private readonly hub;
+  private readonly sessionId;
+  private readonly sub;
+  constructor(hub: EventHub, sessionId: string, sub?: string | null);
+  /**
+   * Publish what one write of this session just committed: one
+   * event per fact, in order, all carrying the write's `opId` as
+   * `origin.tx`.
+   */
+  publishWrite(opId: string, ...events: DocumentEventInit[]): void;
+  /**
+   * Publish what one change committed: its events as {@link publishWrite}
+   * does, and for an undo, the `opId` of the change it undid.
+   */
+  publishChange(opId: string, events: readonly DocumentEventInit[], undoOf?: string): void;
+}
+//#endregion
+//#region src/events/changeEvents.d.ts
+/**
+ * The events a change publishes: each op's events as its single verb
+ * publishes them, in op order. An op an undo left alone entirely publishes
+ * nothing. The publisher stamps them all with the change's `opId`.
+ */
+declare function changeEvents(result: ChangeResult): DocumentEventInit[];
+//#endregion
+//#region src/wire/worker-protocol.d.ts
+/**
+ * Wire protocol used between an Engine-side queue and any Worker host
+ * (browser Web Worker, Node worker_thread, inline). Cloud HTTP traffic
+ * uses a different envelope; this is purely the worker boundary.
+ *
+ * Identical between @embedpdf/engine and @cloudpdf/server because
+ * the WorkerHost dispatch logic is the same on both sides — only the
+ * underlying PdfRuntimeModule (WASM vs native) differs.
+ */
+type WorkerJobId = number;
+/**
+ * What a job does to its document: part of every job request's definition,
+ * so the one fact has one home. The worker queue keeps each document's jobs
+ * in the order this asks for, and the worker closes parsed pages a write may
+ * have changed.
+ *
+ * - `read`: changes nothing. It sees every write asked before it, and may see
+ *   one asked after it.
+ * - `snapshot`: reads the document as of its call, so writes asked after it
+ *   wait for it (saving, exporting, preparing a signing).
+ * - `session`: changes the session, not the document, so writes asked after it
+ *   wait for it (font settings, cancelling a signing). Reads don't.
+ * - `write`: changes the document, but no page's content (annotations, forms,
+ *   metadata, attachments, names).
+ * - `contentWrite`: may change what pages show (page edits, flattening,
+ *   redaction, a completed signing).
+ * - `runtimeWrite`: changes the runtime, for every document (fonts).
+ * - `open`: opens the document, or unlocks it; everything after it waits.
+ * - `close`: closes the document, or one layer of it, after everything before it.
+ */
+type RequestEffect = 'read' | 'snapshot' | 'session' | 'write' | 'contentWrite' | 'runtimeWrite' | 'open' | 'close';
+/** What every document write request may carry besides its own fields. */
+interface WriteJobFields {
+  /**
+   * The write's id (`WriteOptions.opId`, or the one minted for it). The
+   * worker answers a second job with the same id from the first one's
+   * outcome, and keys what undoing the write needs under it.
+   */
+  opId: string;
+  /**
+   * The first object number the objects the write makes for itself may take
+   * (appearance streams, fonts). The worker raises the layer's last object
+   * number to just below it before the write runs. A caller that hands
+   * object numbers to editing sessions keeps them all below it, so the
+   * write's own objects never land on one.
+   */
+  objectNumberFloor?: number;
+}
+interface OpenFatMemoryWorkerRequest {
+  kind: 'open.fatMem';
+  effect: 'open';
+  jobId: WorkerJobId;
+  docId: string;
+  bytes: ArrayBuffer;
+  password: string | null;
+  /** Default `protect`. */
+  signedDocumentPolicy?: SignedDocumentPolicy;
+  /**
+   * Who decides which object numbers a create may name. `'session'` (the
+   * default) hands numbers out itself (`objectNumbers.reserve`, and
+   * `reserveObjectNumbers` here) and refuses a create naming one it doesn't
+   * hold. `'caller'` trusts the caller, which checked every number before
+   * sending the job (a server that hands numbers to editing sessions).
+   */
+  objectNumbers?: 'session' | 'caller';
+  /** Object numbers to hand this session as it opens (`'session'` only); the result has them. */
+  reserveObjectNumbers?: number;
+}
+type LayerOpenSource = {
+  kind: 'fresh';
+} | {
+  kind: 'raw-delta';
+  bytes: ArrayBuffer;
+} | {
+  kind: 'artifact';
+  bytes: ArrayBuffer;
+} | {
+  kind: 'artifact-file';
+  path: string;
+};
+interface OpenLayerMemoryBaseWorkerRequest {
+  kind: 'open.layerMemBase';
+  effect: 'open';
+  jobId: WorkerJobId;
+  docId: string;
+  /**
+   * Omit for a handle whose docId already uniquely identifies the layer
+   * session. Cloud layer sessions supply a real layer name when multiple
+   * layer views must live under one docId.
+   */
+  layerName?: string;
+  baseKey: string;
+  baseBytes: ArrayBuffer;
+  layer: LayerOpenSource;
+  password: string | null;
+  signedDocumentPolicy?: SignedDocumentPolicy;
+  /**
+   * SHA-256 (hex) of the base bytes, when the caller already holds a
+   * verified one. Saves the runtime a full pass over the file; an identity
+   * claim only (a wrong value breaks the caller's own layer artifacts).
+   */
+  baseSha256?: string;
+  /**
+   * Who decides which object numbers a create may name. `'session'` (the
+   * default) hands numbers out itself (`objectNumbers.reserve`, and
+   * `reserveObjectNumbers` here) and refuses a create naming one it doesn't
+   * hold. `'caller'` trusts the caller, which checked every number before
+   * sending the job (a server that hands numbers to editing sessions).
+   */
+  objectNumbers?: 'session' | 'caller';
+  /** Object numbers to hand this session as it opens (`'session'` only); the result has them. */
+  reserveObjectNumbers?: number;
+}
+interface OpenLayerFileBaseWorkerRequest {
+  kind: 'open.layerFileBase';
+  effect: 'open';
+  jobId: WorkerJobId;
+  docId: string;
+  /**
+   * Omit for the base-view session. Supplying a name opens a separate
+   * layer session under the same docId.
+   */
+  layerName?: string;
+  baseKey: string;
+  basePath: string;
+  layer: LayerOpenSource;
+  password: string | null;
+  signedDocumentPolicy?: SignedDocumentPolicy;
+  /** See `OpenLayerMemoryBaseWorkerRequest.baseSha256`. */
+  baseSha256?: string;
+  /**
+   * Who decides which object numbers a create may name. `'session'` (the
+   * default) hands numbers out itself (`objectNumbers.reserve`, and
+   * `reserveObjectNumbers` here) and refuses a create naming one it doesn't
+   * hold. `'caller'` trusts the caller, which checked every number before
+   * sending the job (a server that hands numbers to editing sessions).
+   */
+  objectNumbers?: 'session' | 'caller';
+  /** Object numbers to hand this session as it opens (`'session'` only); the result has them. */
+  reserveObjectNumbers?: number;
+}
+type OpenWorkerRequest = OpenFatMemoryWorkerRequest | OpenLayerMemoryBaseWorkerRequest | OpenLayerFileBaseWorkerRequest;
+interface SignaturesListWorkerRequest {
+  kind: 'signatures.list';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  /**
+   * Read the session's working copy (its unsaved state as one more revision
+   * over the loaded bytes) instead of the loaded bytes. The cloud server
+   * sets it: its layer sessions keep every committed edit in memory, so the
+   * layer's durable state is the working copy. No-op without unsaved edits.
+   */
+  workingCopy?: boolean;
+}
+interface SignaturesContentsWorkerRequest {
+  kind: 'signatures.contents';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+}
+interface SignaturesDigestWorkerRequest {
+  kind: 'signatures.digest';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+  algorithm: DigestAlgorithm;
+}
+interface SignaturesRevisionBytesWorkerRequest {
+  kind: 'signatures.revisionBytes';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  revisionIndex: number;
+}
+interface DocumentVersionWorkerRequest {
+  kind: 'document.version';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+interface SignaturesPrepareWorkerRequest {
+  kind: 'signatures.prepare';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  input: SignaturePrepareInput;
+  /** Who signs and their grants: the field must be theirs to sign. */
+  authority: ChangeAuthority;
+}
+interface SignaturesCompleteWorkerRequest extends WriteJobFields {
+  kind: 'signatures.complete';
+  effect: 'contentWrite';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  input: SignatureCompleteInput;
+  artifactPath?: string;
+  /** Who signs and their grants: the field must still be theirs to sign. */
+  authority: ChangeAuthority;
+}
+interface SignaturesCancelWorkerRequest {
+  kind: 'signatures.cancel';
+  effect: 'session';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  signingId: string;
+}
+interface SignaturesAnalyzeWorkerRequest {
+  kind: 'signatures.analyze';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  input: AnalyzeInput;
+}
+/**
+ * Session-less: install a CMS into a signing candidate file and verify the
+ * result. The server rebuilds the candidate (base ⊕ durable tail) on
+ * whichever replica completes the signing, so this never addresses a
+ * session: the file is patched in place, opened into a transient session
+ * for the checks, and closed. The caller keeps the sealed file.
+ */
+interface SignaturesFinalizeCandidateWorkerRequest {
+  kind: 'signatures.finalizeCandidate';
+  effect: 'read';
+  jobId: WorkerJobId;
+  /** The candidate on the worker's filesystem; its /Contents hole is patched in place. */
+  path: string;
+  /** The /ByteRange the prepare reported — the fence every check is made against. */
+  byteRange: [number, number, number, number];
+  /** The reserved /Contents size the prepare reported (the hole holds twice as many hex digits). */
+  contentsSize: number;
+  fieldObjectNumber: number;
+  /** The detached CMS over the prepared digest. */
+  cms: ArrayBuffer;
+  password?: string | null;
+}
+interface MetadataReadWorkerRequest {
+  kind: 'metadata.read';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+interface MetadataUpdateWorkerRequest extends WriteJobFields {
+  kind: 'metadata.update';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  patch: MetadataPatch;
+  artifactPath?: string;
+}
+interface MetadataReadCustomWorkerRequest {
+  kind: 'metadata.readCustom';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+interface MetadataUpdateCustomWorkerRequest extends WriteJobFields {
+  kind: 'metadata.updateCustom';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  patch: CustomMetadataPatch;
+  artifactPath?: string;
+}
+interface ActionsReadWorkerRequest {
+  kind: 'actions.read';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+/** The document's outline: every item, depth first (no page is loaded). */
+interface OutlineReadWorkerRequest {
+  kind: 'outline.read';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+/**
+ * The annotations of the given pages, or of every page: a raw read off the
+ * document (no page is loaded), one snapshot per page.
+ */
+interface AnnotationsListWorkerRequest {
+  kind: 'annotations.list';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  /** In the order to list them; every page when omitted. */
+  pages?: PageRef[];
+}
+/**
+ * Batch-render every appearance stream of one family on a page. Acquires a
+ * `pagePtr`, iterates `/Annots`, and renders each annotation's `/AP` via
+ * `EPDF_RenderAnnotBitmap` into its own raster. Read-only.
+ */
+interface AnnotationsRenderAppearancesWorkerRequest {
+  kind: 'annotations.renderAppearances';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  /** The page's annotations except widgets, or its widgets (`page.forms`). */
+  family: AnnotationFamily;
+  options?: AnnotationAppearanceRenderOptions;
+}
+interface AnnotationsCreateWorkerRequest<C extends Coordinates = PageCoordinates> extends WriteJobFields {
+  kind: 'annotations.create';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  draft: AnnotationDraft<C>;
+  /** The object number the annotation gets; the next free one when absent. */
+  objectNumber?: number;
+  /**
+   * The bytes beside the draft, by role. The producer puts each buffer on
+   * the wirePack transfer list (zero-copy, same convention as `PageRaster`).
+   */
+  resources?: WireAnnotationResources;
+  artifactPath?: string;
+  /**
+   * Identity to stamp on the newly created annotation:
+   *   - `displayName` → /T (PDF author field)
+   *   - `userId` / `groupId` → /EMBD_Metadata/{UserID,GroupID,CreatedBy,UpdatedBy}
+   * Optional — when absent (engine-local with no identity, anonymous tests),
+   * the worker still stamps the standard /M (modification date) but skips
+   * EMBD_Metadata.
+   */
+  actor?: AnnotationActor;
+}
+interface AnnotationsUpdateWorkerRequest<C extends Coordinates = PageCoordinates> extends WriteJobFields {
+  kind: 'annotations.update';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: AnnotationRef;
+  patch: AnnotationPatch<C>;
+  /** The bytes beside the patch, by role — see the create request. */
+  resources?: WireAnnotationResources;
+  artifactPath?: string;
+  /**
+   * Who the update acts for and what they may do, checked against the
+   * annotation inside the write. Its identity refreshes
+   * /EMBD_Metadata/UpdatedBy; UserID, GroupID and CreatedBy stay unless the
+   * patch reassigns the group.
+   */
+  authority: AnnotationAuthority;
+}
+/**
+ * One change (`doc.apply`): its ops in order, as one transaction, or the
+ * reverse of an earlier write (`{ undoOf }`). Each op is checked as its
+ * single verb's job checks it, inside the write.
+ *
+ * A change stays in page space across the worker, both ways: each op's places
+ * turn into the file's coordinates right before it runs, and its answer's
+ * back right after, against the document as it is then. An earlier op of the
+ * same change can add, remove or put back a page a later one names.
+ */
+interface DocumentApplyWorkerRequest extends WriteJobFields {
+  kind: 'document.apply';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  /** The ops, with their bytes by role on the transfer list, as the single verbs send them. */
+  change: Change<PageCoordinates, WireAnnotationResources>;
+  /**
+   * Who the change acts for, what they may do and what the document's
+   * signatures forbid, checked inside the write against each op (the ops of
+   * an undo included) and each annotation an op creates, changes or removes.
+   * Creates stamp its identity, in the group the draft names; an undo needs
+   * its user to be the one who made the change.
+   */
+  authority: ChangeAuthority;
+  artifactPath?: string;
+}
+/**
+ * What the engine kept of a change so it can undo it, as it crosses the
+ * worker boundary: who made it and the steps that reverse it. Its steps are
+ * the engine's own; a caller stores them and hands them back, never reads
+ * them.
+ */
+interface ChangeRecordPayload {
+  readonly userId: string | null;
+  readonly steps: readonly unknown[];
+}
+/** One change of a server request (see `DocumentApplyChangesWorkerRequest`). */
+interface ServerChange {
+  opId: string;
+  /** Its ops (a single-verb route's one op, an import's among them), or an undo. */
+  change: RecordedChange<PageCoordinates, WireAnnotationResources>;
+  /** Who the change acts for (see `DocumentApplyWorkerRequest.authority`). */
+  authority: ChangeAuthority;
+  /**
+   * For an undo of a change outside this request: the record that change
+   * left, or null when it left none (it was refused, or wrote nothing). The
+   * caller checked who may undo it and that nothing ended undo since. An undo
+   * of an earlier change of the same request leaves it out: the job keeps
+   * the records of its own changes.
+   */
+  record?: ChangeRecordPayload | null;
+}
+/**
+ * A server request's changes, as one job: each runs in its own layer
+ * transaction, committed or rolled back on its own, in order. A refusal is
+ * that change's answer; anything else fails the job. The job saves one
+ * artifact for the changes that applied. Page space both ways, each op
+ * converted as it runs (see `DocumentApplyWorkerRequest`).
+ */
+interface DocumentApplyChangesWorkerRequest {
+  kind: 'document.applyChanges';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  changes: ServerChange[];
+  /** See `WriteJobFields.objectNumberFloor`. */
+  objectNumberFloor?: number;
+  artifactPath?: string;
+}
+/** What one change of a server request answered. */
+type ServerChangeOutcome = {
+  opId: string;
+  status: 'applied';
+  result: ChangeResult;
+  /** What undoes it, for the caller to keep; null when nothing can. */
+  record: ChangeRecordPayload | null;
+} | {
+  opId: string;
+  status: 'refused';
+  error: SerializedEngineError;
+};
+interface AnnotationsDeleteWorkerRequest extends WriteJobFields {
+  kind: 'annotations.delete';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: AnnotationRef;
+  /**
+   * Who the delete acts for and what they may do, checked inside the write
+   * against the annotation and everything deleted with it (`deletedWith`).
+   */
+  authority: AnnotationAuthority;
+  artifactPath?: string;
+}
+/** Flatten a chosen set of one page's annotations into its content — see
+ *  `AnnotationFlattenInput`. A content + annotation mutation of that page. */
+interface AnnotationsFlattenWorkerRequest extends WriteJobFields {
+  kind: 'annotations.flatten';
+  effect: 'contentWrite';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  refs: AnnotationRef[];
+  usage: PageFlattenUsage;
+  artifactPath?: string;
+}
+/** Flatten a chosen set of one page's annotation appearances into a new
+ *  single-page PDF (bytes). A read: no artifact, no revision. */
+interface AnnotationsExportAppearanceWorkerRequest {
+  kind: 'annotations.exportAppearance';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  refs: AnnotationRef[];
+}
+/** Annotations and their resources as one bundle (`doc.annotations.export`). A read. */
+interface AnnotationsExportWorkerRequest {
+  kind: 'annotations.export';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  selection: AnnotationExportSelection;
+  /** The limits the bundle must stay within; the defaults otherwise. */
+  limits?: BundleLimits;
+}
+/**
+ * A bundle's annotations, created as one change (`doc.annotations.import`).
+ * The producer puts each resource's buffer on the transfer list. The bundle
+ * stays in page space on its way in: the import measures each item on the
+ * page it goes to, which only the import works out.
+ */
+interface AnnotationsImportWorkerRequest extends WriteJobFields {
+  kind: 'annotations.import';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  bundle: WireAnnotationBundle;
+  pages?: BundleImportPages;
+  attribution: 'restore' | 'stamp';
+  /**
+   * The session: who `'stamp'` attributes each annotation to, as on create,
+   * and whose user `'restore'` records as `importedBy`.
+   */
+  actor?: AnnotationActor;
+  /** The limits the bundle must stay within; the defaults otherwise. */
+  limits?: BundleLimits;
+  artifactPath?: string;
+}
+/** An annotation's `appearance` resource: its drawing, as a one-page PDF (bytes). A read. */
+interface AnnotationsReadAppearanceWorkerRequest {
+  kind: 'annotations.readAppearance';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  ref: AnnotationRef;
+}
+/** A page's annotations' stacking order: `refs` go together to `position`. */
+interface AnnotationsReorderWorkerRequest extends WriteJobFields {
+  kind: 'annotations.reorder';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  refs: AnnotationRef[];
+  position: AnnotationPosition;
+  /** Who the reorder acts for and what they may do: checked against each annotation, inside the write. */
+  authority: AnnotationAuthority;
+  artifactPath?: string;
+}
+/**
+ * Complete reconciled form snapshot. Cheap between mutations: the worker
+ * caches the underlying EPDFForm model keyed on the session's mutation
+ * counter and rebuilds only after a write.
+ */
+interface FormsListWorkerRequest {
+  kind: 'forms.list';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+interface FormsSetValueWorkerRequest extends WriteJobFields {
+  kind: 'forms.setValue';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+  value: FormFieldValue;
+  artifactPath?: string;
+  /**
+   * Who the write acts for (stamped as its filler or creator) and their
+   * grants, checked field by field inside the write.
+   */
+  authority: ChangeAuthority;
+}
+interface FormsResetWorkerRequest extends WriteJobFields {
+  kind: 'forms.reset';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  /** The fields to reset; absent resets the whole form. */
+  refs?: FormFieldRef[];
+  artifactPath?: string;
+  /**
+   * Who the write acts for (stamped as its filler or creator) and their
+   * grants, checked field by field inside the write.
+   */
+  authority: ChangeAuthority;
+}
+/** `doc.forms.export`: the fields a selection takes, as a bundle. A snapshot read. */
+interface FormsExportWorkerRequest {
+  kind: 'forms.export';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  selection: FormExportSelection;
+  /** The limits the bundle must stay within; the defaults otherwise. */
+  limits?: BundleLimits;
+}
+/** `doc.forms.import`: a bundle's design, as one change (see `FormImportOp`). */
+interface FormsImportWorkerRequest extends WriteJobFields {
+  kind: 'forms.import';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  /** Page space; each resource on the transfer list. */
+  bundle: WireFormBundle;
+  pages?: BundleImportPages;
+  attribution: 'restore' | 'stamp';
+  values: boolean;
+  /**
+   * Who imports and their grants: whom `'stamp'` makes the creator and
+   * filler, whose user `'restore'` records as `importedBy`, and who may put
+   * the fields in which groups.
+   */
+  authority: ChangeAuthority;
+  limits?: BundleLimits;
+  /** Whether the caller holds `doc.forms.script`: without it, scripts, submits and links are left out. */
+  mayScript: boolean;
+  artifactPath?: string;
+}
+/** `doc.forms.importValues`: a bundle's values, as one change (see `FormImportOp`). */
+interface FormsImportValuesWorkerRequest extends WriteJobFields {
+  kind: 'forms.importValues';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  bundle: WireFormBundle;
+  attribution: 'restore' | 'stamp';
+  /**
+   * Who imports and their grants: whom `'stamp'` makes the filler, whose
+   * user `'restore'` records as `importedBy`, and which fields they may fill.
+   */
+  authority: ChangeAuthority;
+  limits?: BundleLimits;
+  artifactPath?: string;
+}
+interface FormsRepairWorkerRequest extends WriteJobFields {
+  kind: 'forms.repair';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  bakeAppearances?: boolean;
+  artifactPath?: string;
+}
+interface FormsCreateFieldWorkerRequest<C extends Coordinates = PageCoordinates> extends WriteJobFields {
+  kind: 'forms.createField';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  draft: FormFieldDraft<C>;
+  /** The field's object number; the next free one when absent. */
+  objectNumber?: number;
+  /** Its widgets' object numbers, in `draft.widgets` order; the next free ones when absent. */
+  widgetObjectNumbers?: number[];
+  artifactPath?: string;
+  /**
+   * Who creates the field (stamped as its creator, and whose group it goes
+   * in by default) and their grants: which groups they may put it in.
+   */
+  authority: ChangeAuthority;
+}
+interface FormsUpdateFieldWorkerRequest extends WriteJobFields {
+  kind: 'forms.updateField';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+  patch: FormFieldPatch;
+  artifactPath?: string;
+  /** Who changes the field and their grants: which group they may move it to. */
+  authority: ChangeAuthority;
+}
+/** Draw a PDF page into every widget of an unsigned signature field (the visual fill). */
+interface FormsSetSignatureAppearanceWorkerRequest extends WriteJobFields {
+  kind: 'forms.setSignatureAppearance';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+  pdf: ArrayBuffer;
+  artifactPath?: string;
+  /** Who draws the look and their grants: the field must be theirs to sign. */
+  authority: ChangeAuthority;
+}
+interface FormsDeleteFieldWorkerRequest extends WriteJobFields {
+  kind: 'forms.deleteField';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+  artifactPath?: string;
+}
+interface FormsAddWidgetWorkerRequest<C extends Coordinates = PageCoordinates> extends WriteJobFields {
+  kind: 'forms.addWidget';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+  placement: WidgetPlacement<C>;
+  /** The new widget's object number; the next free one when absent. */
+  objectNumber?: number;
+  /** Where a merged field's widget moves when it splits; the next free one when absent. */
+  splitObjectNumber?: number;
+  artifactPath?: string;
+}
+interface FormsDetachWidgetWorkerRequest extends WriteJobFields {
+  kind: 'forms.detachWidget';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: FormFieldRef;
+  widget: AnnotationRef;
+  artifactPath?: string;
+}
+/** A widget leaves its page, and its field when it has one. */
+interface FormsDeleteWidgetWorkerRequest extends WriteJobFields {
+  kind: 'forms.deleteWidget';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  widget: AnnotationRef;
+  artifactPath?: string;
+}
+/** The form's calculation order: `fields` go together to `position`. */
+interface FormsReorderCalculationsWorkerRequest extends WriteJobFields {
+  kind: 'forms.reorderCalculations';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  fields: FormFieldRef[];
+  position: FieldPosition;
+  artifactPath?: string;
+}
+/** A page's widgets' stacking order: `widgets` go together to `position`. */
+interface FormsReorderWidgetsWorkerRequest extends WriteJobFields {
+  kind: 'forms.reorderWidgets';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  widgets: AnnotationRef[];
+  position: AnnotationPosition;
+  artifactPath?: string;
+}
+interface FormsUpdateWidgetWorkerRequest<C extends Coordinates = PageCoordinates> extends WriteJobFields {
+  kind: 'forms.updateWidget';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  widget: AnnotationRef;
+  patch: WidgetPatch<C>;
+  artifactPath?: string;
+}
+interface PagesListWorkerRequest {
+  kind: 'pages.list';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+/**
+ * Per-page plain-text extraction. Acquires a pagePtr and runs PDFium's
+ * `FPDFText_LoadPage` → `FPDFText_GetText` chain: a slow-path per-page
+ * read keyed by indirect object number.
+ */
+interface PagesTextWorkerRequest {
+  kind: 'pages.text';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+}
+interface PagesGeometryWorkerRequest {
+  kind: 'pages.geometry';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+}
+/**
+ * A search request as the worker runs it: the request plus `skip`, a trusted
+ * absolute resume position (scan-order pages already searched). For callers
+ * that pin content versions themselves — the cloud wire pins the search
+ * content epoch in the URL, so its routes resume by position alone.
+ * Everyone else uses `cursor`, which also guards against changes between
+ * batches; `cursor` takes precedence when both are set.
+ */
+interface SearchScanRequest extends SearchRequest {
+  skip?: number;
+}
+/**
+ * One budgeted search batch (see `DocumentSearchService`). Read-only: the
+ * worker's per-page corpus cache is version-keyed on the session mutation
+ * counter, so repeated batches between mutations reuse extracted text.
+ */
+interface SearchQueryWorkerRequest {
+  kind: 'search.query';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  request: SearchScanRequest;
+}
+interface PagesRenderWorkerRequest<C extends Coordinates = PageCoordinates> {
+  kind: 'pages.render';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  options?: PageRenderOptions<C>;
+}
+/**
+ * One-shot file render — open the base document from a file path, render
+ * one page by display index, close. No session is bound (the ingestion
+ * `runAdHoc` pattern, like `document.probeSecurityFile`): this is the
+ * derived-artifact warmer's producer, used when no live document session
+ * exists yet. The payload reports the page's durable object number so the
+ * caller can key the artifact it persists.
+ */
+interface DocumentRenderPageFileWorkerRequest {
+  kind: 'document.renderPageFile';
+  effect: 'read';
+  jobId: WorkerJobId;
+  path: string;
+  password: string | null;
+  /** Display index (0-based) — ingest knows "first page", not object numbers. */
+  pageIndex: number;
+  options?: PageRenderOptions;
+}
+/**
+ * Encode instruction for the `*.renderEncoded` request family. Cloud-server
+ * surface (like the file-path ops): the server worker injects an image
+ * encoder into its `WorkerHost`, so the raster is encoded where IT is
+ * produced and only the compressed image crosses the engine boundary —
+ * kilobytes over the host IPC pipe instead of a megabytes-scale rgba
+ * copy. Engines without an injected encoder (browser/local workers, which
+ * encode via canvas instead) reject these kinds with `NotImplemented`.
+ * Policy stays caller-side: format and quality always arrive in the
+ * request; the engine plane holds no image-policy defaults.
+ */
+interface RenderEncode {
+  format: PageNetworkRenderFormat;
+  quality?: number;
+}
+/** An encoded render result. `width`/`height` are the source raster's output
+ *  dimensions (they feed the advisory image-dimension headers). `bytes` must
+ *  own its buffer — it rides the transfer manifest zero-copy, so a pooled
+ *  view (e.g. a Node `Buffer` slab slice) would detach unrelated data. */
+interface EncodedImageWire {
+  contentType: string;
+  width: number;
+  height: number;
+  bytes: Uint8Array;
+}
+interface PagesRenderEncodedWorkerRequest<C extends Coordinates = PageCoordinates> {
+  kind: 'pages.renderEncoded';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  options?: PageRenderOptions<C>;
+  encode: RenderEncode;
+}
+/** `document.renderPageFile` + in-worker encode — same one-shot transient
+ *  session semantics; see that request's docs. */
+interface DocumentRenderPageFileEncodedWorkerRequest {
+  kind: 'document.renderPageFileEncoded';
+  effect: 'read';
+  jobId: WorkerJobId;
+  path: string;
+  password: string | null;
+  /** Display index (0-based) — ingest knows "first page", not object numbers. */
+  pageIndex: number;
+  options?: PageRenderOptions;
+  encode: RenderEncode;
+}
+interface AnnotationsRenderAppearancesEncodedWorkerRequest {
+  kind: 'annotations.renderAppearancesEncoded';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  /** The page's annotations except widgets, or its widgets (`page.forms`). */
+  family: AnnotationFamily;
+  options?: AnnotationAppearanceRenderOptions;
+  encode: RenderEncode;
+}
+/** Encoded counterpart of `AnnotationAppearanceRaster`: same identity and
+ *  placement metadata, image instead of raster. */
+interface EncodedAppearanceWire<C extends Coordinates = PageCoordinates> {
+  ref: AnnotationRef;
+  mode: AnnotationAppearanceMode;
+  state: string | null;
+  rect: C['box'];
+  image: EncodedImageWire;
+}
+interface AnnotationAppearancesEncodedResultWire<C extends Coordinates = PageCoordinates> {
+  page: PageRef;
+  appearances: EncodedAppearanceWire<C>[];
+}
+/** Register/rename a `/Names /Pages` entry — see `PageNameInput`. */
+interface PagesSetNameWorkerRequest extends WriteJobFields {
+  kind: 'pages.setName';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  name: string;
+  page: PageRef;
+  replace?: string;
+  artifactPath?: string;
+}
+/** Remove a `/Names /Pages` entry — see `PageRemoveNameInput`. */
+interface PagesRemoveNameWorkerRequest extends WriteJobFields {
+  kind: 'pages.removeName';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  name: string;
+  artifactPath?: string;
+}
+interface PagesFlattenWorkerRequest extends WriteJobFields {
+  kind: 'pages.flatten';
+  effect: 'contentWrite';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  pages: PageRef[];
+  usage: PageFlattenUsage;
+  artifactPath?: string;
+}
+interface RedactionApplyWorkerRequest extends WriteJobFields {
+  kind: 'redaction.apply';
+  effect: 'contentWrite';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  scope: RedactionApplyScope;
+  artifactPath?: string;
+}
+/** Export the given pages as a standalone PDF (a read — the source
+ *  session is untouched, so no layer artifact rides the result). */
+interface PagesExtractWorkerRequest {
+  kind: 'pages.extract';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  pages: PageRef[];
+  /** A flattened copy: what it paints, already checked against the caller's
+   *  rights (`resolvePageExtract`). Absent for a plain copy. */
+  flatten?: PageExtractFlatten;
+}
+/** List the document catalog's `/EmbeddedFiles` name tree (a read). */
+interface AttachmentsListWorkerRequest {
+  kind: 'attachments.list';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+/**
+ * Decode one document-level embedded file (a read — no revision bump, no
+ * layer artifact). Two delivery modes, the `artifactPath?` pattern:
+ * `path` absent → browser mode, decoded bytes ride the transfer list;
+ * `path` present → server mode, the worker streams the decoded file to
+ * that path (`EPDFAttachment_ExtractFile` + `FPDF_FILEWRITE`) so the
+ * payload never crosses the thread boundary and HTTP can stream it from
+ * disk with backpressure.
+ */
+interface AttachmentsReadFileWorkerRequest {
+  kind: 'attachments.readFile';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  ref: AttachmentRef;
+  path?: string;
+  /** Decompression-bomb cap forwarded to the runtime. Absent/0 = unlimited. */
+  maxDecodedBytes?: number;
+}
+/** Decode the file embedded in a FileAttachment annotation's `/FS`.
+ *  Same read semantics and delivery modes as `attachments.readFile`. */
+interface AnnotationsReadFileWorkerRequest {
+  kind: 'annotations.readFile';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  ref: AnnotationRef;
+  path?: string;
+  /** Decompression-bomb cap forwarded to the runtime. Absent/0 = unlimited. */
+  maxDecodedBytes?: number;
+}
+/**
+ * `/PieceInfo` private application data (ISO 32000 §14.5). One job family
+ * serves both levels: `pageObjectNumber` present → the page's `/PieceInfo`,
+ * absent → the document catalog's — mirroring the native API symmetry.
+ * `update`/`clear` are mutations (a layer session persists an artifact);
+ * `read`/`applications` are plain reads.
+ */
+interface MeasureViewportsWorkerRequest {
+  kind: 'measure.viewports';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+}
+interface MeasureSetScaleWorkerRequest extends WriteJobFields {
+  kind: 'measure.setScale';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page: PageRef;
+  measure: PdfMeasure | null;
+  artifactPath?: string;
+}
+interface PieceInfoReadWorkerRequest {
+  kind: 'pieceInfo.read';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page?: PageRef;
+  application: string;
+}
+interface PieceInfoUpdateWorkerRequest extends WriteJobFields {
+  kind: 'pieceInfo.update';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page?: PageRef;
+  application: string;
+  patch: PieceInfoPatch;
+  artifactPath?: string;
+}
+interface PieceInfoApplicationsWorkerRequest {
+  kind: 'pieceInfo.applications';
+  effect: 'read';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page?: PageRef;
+}
+interface PieceInfoDeleteWorkerRequest extends WriteJobFields {
+  kind: 'pieceInfo.delete';
+  effect: 'write';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  page?: PageRef;
+  application: string;
+  artifactPath?: string;
+}
+interface DocumentSaveBufferWorkerRequest {
+  kind: 'document.saveBuffer';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  mode: PdfSaveMode;
+}
+interface DocumentSaveFileWorkerRequest {
+  kind: 'document.saveFile';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  mode: PdfSaveMode;
+  path: string;
+}
+/** Export just the layer artifact (the overlay diff) to a transferable buffer.
+ *  Layer sessions only; the host rejects a base-only session. */
+interface DocumentSaveLayerBufferWorkerRequest {
+  kind: 'document.saveLayerBuffer';
+  effect: 'snapshot';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+}
+interface DocumentSecurityProbeInfo {
+  encryptionState: 'unknown' | 'none' | 'encrypted' | 'unsupported';
+  encryptionRequiresPassword: boolean | null;
+  securityHandlerRevision: number | null;
+  pdfPermissionsBits: number | null;
+  pdfPermissionsAllAllowed: boolean | null;
+  pdfOpenedAs: 'none' | 'user' | 'owner' | null;
+  securityProbedAt: number | null;
+}
+interface DocumentProbeSecurityFileWorkerRequest {
+  kind: 'document.probeSecurityFile';
+  effect: 'read';
+  jobId: WorkerJobId;
+  path: string;
+  password: string | null;
+}
+interface DocumentCheckPasswordPermissionsWorkerRequest {
+  kind: 'document.checkPasswordPermissions';
+  effect: 'open';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  password: string;
+  mode?: 'any' | 'owner';
+}
+/**
+ * Register a runtime font on the host's PDFium thread. Carries the font bytes
+ * as a transferable `ArrayBuffer` (declared in the producer's transfer
+ * manifest, like `open.fatMem`). Runtime-global: not tied to any docId. The
+ * host keeps the volatile native `FontId` keyed by `fontKey`; the wire only
+ * ever references the stable `fontKey`.
+ */
+interface FontsRegisterWorkerRequest {
+  kind: 'fonts.register';
+  effect: 'runtimeWrite';
+  jobId: WorkerJobId;
+  fontKey: string;
+  /** `""` → infer the base font name from the file. */
+  familyName: string;
+  /** `0` → infer the weight from the file. */
+  weight: number;
+  /** `-1` → infer / `0` non-italic / `1` italic. */
+  italic: number;
+  data: ArrayBuffer;
+}
+interface FontsAddFallbackWorkerRequest {
+  kind: 'fonts.addFallback';
+  effect: 'runtimeWrite';
+  jobId: WorkerJobId;
+  fontKey: string;
+}
+interface FontsClearFallbacksWorkerRequest {
+  kind: 'fonts.clearFallbacks';
+  effect: 'runtimeWrite';
+  jobId: WorkerJobId;
+}
+/**
+ * Hand the session `count` more object numbers: the layer's last object
+ * number moves up by `count`, and the numbers passed become the session's to
+ * name objects with. Only a session that hands numbers out itself
+ * (`objectNumbers: 'session'`) takes it. Refused with `LayerFull` past
+ * `OBJECT_NUMBER_ISSUE_LIMIT`.
+ */
+interface ObjectNumbersReserveWorkerRequest {
+  kind: 'objectNumbers.reserve';
+  effect: 'session';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  count: number;
+}
+interface FontsClearWorkerRequest {
+  kind: 'fonts.clear';
+  effect: 'runtimeWrite';
+  jobId: WorkerJobId;
+}
+/** The application asserts a licence permitting editing with a font. */
+interface FontsAuthorizeEditingWorkerRequest {
+  kind: 'fonts.authorizeEditing';
+  effect: 'runtimeWrite';
+  jobId: WorkerJobId;
+  fontKey: string;
+}
+/**
+ * Per-document font and text-layout settings (session state on the host's
+ * document, never written to the file). Every member is optional: only the
+ * ones given change.
+ */
+interface DocumentSetFontSettingsWorkerRequest {
+  kind: 'document.setFontSettings';
+  effect: 'session';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  embeddingPolicy?: 'default' | 'subset' | 'full';
+  typographicFeatures?: boolean;
+}
+interface CloseWorkerRequest {
+  kind: 'close';
+  effect: 'close';
+  jobId: WorkerJobId;
+  docId: string;
+}
+/**
+ * Close exactly one layer session, leaving the base document, sibling
+ * layer sessions, and the caller's doc↔worker binding intact. Idempotent:
+ * closing an absent session is a no-op ack.
+ *
+ * This is the reload seam for layer-session freshness (the server closes
+ * a stale layer session and re-opens it from the current durable
+ * artifact) — `close` is the whole-document teardown, this is the
+ * layer-scoped sibling.
+ */
+interface LayerCloseWorkerRequest {
+  kind: 'layer.close';
+  effect: 'close';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName: string;
+}
+interface AbortWorkerRequest {
+  kind: 'abort';
+  jobId: WorkerJobId;
+}
+/**
+ * What a view shows of a document (`DocumentHandle.setWorkingSet`): the order
+ * its parsed pages close in. The worker takes it on arrival, even while a
+ * render runs, and never answers: `jobId` only names the message.
+ */
+interface PagesWorkingSetWorkerRequest {
+  kind: 'pages.workingSet';
+  jobId: WorkerJobId;
+  docId: string;
+  layerName?: string;
+  view: string;
+  pages: WorkingSetPage[];
+}
+interface ShutdownWorkerRequest {
+  kind: 'shutdown';
+  jobId: WorkerJobId;
+}
+interface LayerArtifactWorkerPayload {
+  bytes: ArrayBuffer;
+  size: number;
+  /** The layer's last object number as saved: every object it has is at or below it. */
+  lastObjectNumber: number;
+}
+/**
+ * Result of an attachment file read (`attachments.readFile` /
+ * `annotations.readFile`): the decoded file's metadata plus exactly one
+ * delivery mode, mirroring the request's `path?` — `bytes` on the
+ * transfer list (browser), or the `path` the worker wrote (server).
+ */
+interface AttachmentFileWorkerPayload {
+  name: string;
+  mimeType?: string;
+  size: number;
+  bytes?: ArrayBuffer;
+  path?: string;
+}
+interface LayerArtifactFileWorkerPayload {
+  path: string;
+  /** The layer's last object number as saved: every object it has is at or below it. */
+  lastObjectNumber: number;
+}
+/**
+ * Every request a worker takes. `C` is where a request's places are: page
+ * space as callers send them, the file's coordinates once the worker has
+ * converted them for its handlers.
+ */
+type WorkerRequest<C extends Coordinates = PageCoordinates> = OpenWorkerRequest | MetadataReadWorkerRequest | MetadataUpdateWorkerRequest | MetadataReadCustomWorkerRequest | MetadataUpdateCustomWorkerRequest | ActionsReadWorkerRequest | OutlineReadWorkerRequest | AnnotationsListWorkerRequest | AnnotationsRenderAppearancesWorkerRequest | AnnotationsRenderAppearancesEncodedWorkerRequest | AnnotationsCreateWorkerRequest<C> | AnnotationsUpdateWorkerRequest<C> | AnnotationsDeleteWorkerRequest | AnnotationsReorderWorkerRequest | DocumentApplyWorkerRequest | DocumentApplyChangesWorkerRequest | FormsListWorkerRequest | FormsSetValueWorkerRequest | FormsResetWorkerRequest | FormsExportWorkerRequest | FormsImportWorkerRequest | FormsImportValuesWorkerRequest | FormsRepairWorkerRequest | FormsCreateFieldWorkerRequest<C> | FormsUpdateFieldWorkerRequest | FormsSetSignatureAppearanceWorkerRequest | FormsDeleteFieldWorkerRequest | FormsAddWidgetWorkerRequest<C> | FormsDetachWidgetWorkerRequest | FormsDeleteWidgetWorkerRequest | FormsReorderWidgetsWorkerRequest | FormsReorderCalculationsWorkerRequest | FormsUpdateWidgetWorkerRequest<C> | PagesListWorkerRequest | AnnotationsFlattenWorkerRequest | AnnotationsExportAppearanceWorkerRequest | PagesSetNameWorkerRequest | PagesRemoveNameWorkerRequest | PagesFlattenWorkerRequest | RedactionApplyWorkerRequest | PagesExtractWorkerRequest | AttachmentsListWorkerRequest | AttachmentsReadFileWorkerRequest | AnnotationsReadFileWorkerRequest | AnnotationsReadAppearanceWorkerRequest | AnnotationsExportWorkerRequest | AnnotationsImportWorkerRequest | MeasureViewportsWorkerRequest | MeasureSetScaleWorkerRequest | PieceInfoReadWorkerRequest | PieceInfoUpdateWorkerRequest | PieceInfoApplicationsWorkerRequest | PieceInfoDeleteWorkerRequest | PagesTextWorkerRequest | PagesGeometryWorkerRequest | PagesRenderWorkerRequest<C> | PagesRenderEncodedWorkerRequest<C> | SearchQueryWorkerRequest | DocumentSaveBufferWorkerRequest | DocumentSaveFileWorkerRequest | DocumentSaveLayerBufferWorkerRequest | DocumentProbeSecurityFileWorkerRequest | DocumentRenderPageFileWorkerRequest | DocumentRenderPageFileEncodedWorkerRequest | DocumentCheckPasswordPermissionsWorkerRequest | SignaturesListWorkerRequest | SignaturesContentsWorkerRequest | SignaturesDigestWorkerRequest | SignaturesRevisionBytesWorkerRequest | DocumentVersionWorkerRequest | SignaturesPrepareWorkerRequest | SignaturesCompleteWorkerRequest | SignaturesCancelWorkerRequest | SignaturesAnalyzeWorkerRequest | SignaturesFinalizeCandidateWorkerRequest | FontsRegisterWorkerRequest | FontsAddFallbackWorkerRequest | FontsClearFallbacksWorkerRequest | FontsClearWorkerRequest | FontsAuthorizeEditingWorkerRequest | ObjectNumbersReserveWorkerRequest | DocumentSetFontSettingsWorkerRequest | CloseWorkerRequest | LayerCloseWorkerRequest | WorkerControlMessage;
+/** The messages that aren't jobs: the worker takes them on arrival and runs nothing for them. */
+type WorkerControlMessage = AbortWorkerRequest | PagesWorkingSetWorkerRequest | ShutdownWorkerRequest;
+/**
+ * A request the worker runs as a job. Every one states its
+ * {@link RequestEffect}: a request type without one fails `StatesItsEffect`,
+ * so it doesn't compile.
+ */
+type WorkerJobRequest<C extends Coordinates = PageCoordinates> = StatesItsEffect<Exclude<WorkerRequest<C>, WorkerControlMessage>>;
+type StatesItsEffect<T extends {
+  effect: RequestEffect;
+}> = T;
+/**
+ * What a job returns. `C` is the space its positions are in: the handlers
+ * work in PDF space, and the worker converts every result to page space
+ * before it leaves (`resultInPageSpace`).
+ */
+type WorkerResultPayload<C extends Coordinates = PageCoordinates> = {
+  tag: 'open';
+  docId: string;
+  security: DocumentSecurityProbeInfo;
+  /** What the document's signatures forbid; `null` when unsigned or not probed (a locked open). */
+  protection?: DocumentProtection | null;
+  /** A locked open whose password was given and wrong. */
+  passwordRejected?: boolean;
+  /** The numbers `reserveObjectNumbers` asked for; absent for a locked open. */
+  objectNumbers?: ObjectNumberRange;
+  /** The layer's last object number as it opened; absent for a locked open. */
+  lastObjectNumber?: number;
+} | {
+  tag: 'objectNumbers.reserve';
+  range: ObjectNumberRange;
+} | {
+  tag: 'signatures.list';
+  snapshot: SignatureSnapshot;
+} | {
+  tag: 'signatures.contents';
+  bytes: ArrayBuffer;
+} | {
+  tag: 'signatures.digest';
+  digest: ArrayBuffer;
+} | {
+  tag: 'signatures.revisionBytes';
+  bytes: ArrayBuffer;
+  size: number;
+} | {
+  tag: 'document.version';
+  version: BaseVersionInfo;
+} | {
+  tag: 'signatures.prepare';
+  result: SignaturePrepared;
+} | {
+  tag: 'signatures.complete';
+  result: SignatureCompleteResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'signatures.cancel';
+  result: SignatureCancelResult;
+} | {
+  tag: 'signatures.analyze';
+  analysis: ChangeAnalysis;
+} | {
+  tag: 'signatures.finalizeCandidate';
+  /**
+   * The installed signature as the sealed file reports it, in page space:
+   * the finalizer measures it while its own session is open.
+   */
+  signature: SignatureDTO;
+  /** The sealed file's last object number: every object it has is at or below it. */
+  lastObjectNumber: number;
+  /** What the sealed file's signatures forbid from now on. */
+  protection: DocumentProtection;
+  /** The version the sealed file is (hash and length of the whole file). */
+  version: BaseVersionInfo;
+} | {
+  tag: 'metadata.read';
+  metadata: DocumentMetadata;
+} | {
+  tag: 'actions.read';
+  snapshot: DocumentActionsSnapshot<C['destination']>;
+} | {
+  tag: 'outline.read';
+  outline: DocumentOutline<C['destination']>;
+} | {
+  tag: 'metadata.update';
+  result: MetadataUpdateResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'metadata.readCustom';
+  custom: CustomMetadata;
+} | {
+  tag: 'metadata.updateCustom';
+  result: CustomMetadataUpdateResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'annotations.list';
+  list: AnnotationList<C>;
+} | {
+  tag: 'annotations.renderAppearances';
+  page: PageRef;
+  result: AnnotationAppearancesResult<C>;
+} | {
+  tag: 'annotations.renderAppearancesEncoded';
+  page: PageRef;
+  result: AnnotationAppearancesEncodedResultWire<C>;
+} | {
+  tag: 'annotations.create';
+  result: AnnotationCreateResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'annotations.update';
+  result: AnnotationUpdateResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'annotations.delete';
+  result: AnnotationDeleteResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'annotations.flatten';
+  result: AnnotationFlattenResult;
+  /** False when nothing was applied: no artifact, event, or version bump. */
+  wrote: boolean;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'annotations.exportAppearance';
+  bytes: ArrayBuffer;
+  size: number;
+} | {
+  tag: 'annotations.readAppearance';
+  bytes: ArrayBuffer;
+  size: number;
+} |
+/** A bundle is page space on both sides: the exporter measures what leaves. */
+{
+  tag: 'annotations.export';
+  bundle: WireAnnotationBundle;
+} | {
+  tag: 'annotations.import';
+  result: AnnotationImportResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'annotations.reorder';
+  result: AnnotationReorderResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'document.applyChanges';
+  /** One per change, in order. */
+  outcomes: ServerChangeOutcome[];
+  /** The artifact, when at least one change applied. */
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'document.apply';
+  result: ChangeResult;
+  /**
+   * True when this answers an `opId` that already had one: nothing ran
+   * again, so nothing is published again.
+   */
+  replayed: boolean;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.list';
+  snapshot: FormSnapshot<C>;
+} | {
+  tag: 'forms.setValue';
+  result: FormSetValueResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.reset';
+  result: FormResetResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.export';
+  bundle: WireFormBundle;
+} | {
+  tag: 'forms.import';
+  result: FormImportResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.importValues';
+  result: FormValuesImportResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.repair';
+  result: FormRepairResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.createField';
+  result: FormFieldCreateResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.updateField';
+  result: FormFieldUpdateResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.setSignatureAppearance';
+  result: FormFieldUpdateResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.deleteField';
+  result: FormFieldDeleteResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.addWidget';
+  result: FormWidgetLinkResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.detachWidget';
+  result: FormWidgetLinkResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.reorderWidgets';
+  result: FormWidgetsReorderResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.reorderCalculations';
+  result: FormCalculationsReorderResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.updateWidget';
+  result: FormWidgetUpdateResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'forms.deleteWidget';
+  result: FormWidgetDeleteResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'pages.list';
+  snapshot: PageListSnapshot<C>;
+} | {
+  tag: 'pages.setName';
+  result: PageNameResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'pages.removeName';
+  result: PageNameResult<C>;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'pages.flatten';
+  result: PageFlattenResult;
+  /** False when nothing was applied: no artifact, event, or version bump. */
+  wrote: boolean;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'redaction.apply';
+  result: RedactionApplyResult;
+  /** False when nothing was applied: no artifact, event, or version bump. */
+  wrote: boolean;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'pages.extract';
+  bytes: ArrayBuffer;
+  size: number;
+} | {
+  tag: 'attachments.list';
+  attachments: Attachment[];
+} | {
+  tag: 'attachments.readFile';
+  content: AttachmentFileWorkerPayload;
+} | {
+  tag: 'annotations.readFile';
+  content: AttachmentFileWorkerPayload;
+} | {
+  tag: 'measure.viewports';
+  page: PageRef;
+  viewports: PageMeasurementViewport<C>[];
+} | {
+  tag: 'measure.setScale';
+  result: PageScaleResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'pieceInfo.read';
+  snapshot: PieceInfoSnapshot | null;
+} | {
+  tag: 'pieceInfo.update';
+  result: PieceInfoUpdateResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'pieceInfo.applications';
+  applications: string[];
+} | {
+  tag: 'pieceInfo.delete';
+  result: PieceInfoDeleteResult;
+  artifact?: LayerArtifactWorkerPayload;
+  artifactFile?: LayerArtifactFileWorkerPayload;
+} | {
+  tag: 'pages.text';
+  snapshot: PageTextSnapshot;
+} | {
+  tag: 'pages.geometry';
+  page: PageRef;
+  snapshot: PageGeometrySnapshot<C>;
+} | {
+  tag: 'pages.render';
+  page: PageRef;
+  /** The area of the page the pixels show. */
+  area: C['box'];
+  raster: PageRaster;
+} | {
+  tag: 'pages.renderEncoded';
+  image: EncodedImageWire;
+} | {
+  tag: 'search.query';
+  slice: SearchSlice<C>;
+} | {
+  tag: 'document.saveBuffer';
+  bytes: ArrayBuffer;
+  size: number;
+} | {
+  tag: 'document.saveLayerBuffer';
+  bytes: ArrayBuffer;
+  size: number;
+} | {
+  tag: 'document.saveFile';
+  path: string;
+} | {
+  tag: 'document.probeSecurityFile';
+  security: DocumentSecurityProbeInfo;
+} | {
+  tag: 'document.renderPageFile';
+  /** Durable page identity of the rendered index — the artifact key's page. */
+  page: PageRef;
+  pageCount: number;
+  raster: PageRaster;
+} | {
+  tag: 'document.renderPageFileEncoded';
+  /** Durable page identity of the rendered index — the artifact key's page. */
+  page: PageRef;
+  pageCount: number;
+  image: EncodedImageWire;
+} | {
+  tag: 'document.checkPasswordPermissions';
+  security: DocumentSecurityProbeInfo;
+  protection?: DocumentProtection | null;
+} | {
+  tag: 'fonts.register';
+  fontKey: string;
+  identity: FontIdentityInfo;
+} | {
+  tag: 'fonts.addFallback';
+} | {
+  tag: 'fonts.clearFallbacks';
+} | {
+  tag: 'fonts.clear';
+} | {
+  tag: 'fonts.authorizeEditing';
+  identity: FontIdentityInfo;
+} | {
+  tag: 'document.setFontSettings';
+} | {
+  tag: 'close';
+} | {
+  tag: 'shutdown';
+};
+type WorkerResponse = {
+  kind: 'resolve';
+  jobId: WorkerJobId;
+  result: WorkerResultPayload;
+} | {
+  kind: 'reject';
+  jobId: WorkerJobId;
+  error: SerializedEngineError;
+};
+type WorkerLifecycleMessage = {
+  kind: 'ready';
+} | {
+  kind: 'init-error';
+  error: string;
+};
+//#endregion
+//#region src/engine/document-security-state.d.ts
+interface DocumentHeadLike {
+  encryption: {
+    state: DocumentSecurityState['encryption']['state'];
+    requiresPassword: boolean | null;
+  };
+  permissions: DocumentSecurityState['permissions'];
+  access: DocumentSecurityState['access'];
+}
+declare function securityStateFromHead(head: DocumentHeadLike): DocumentSecurityState;
+declare function permissionInfoFromProbe(info: DocumentSecurityProbeInfo): PdfPermissionInfo | null;
+/**
+ * Same as {@link permissionInfoFromProbe} but additionally populates
+ * `flags` (typed PdfBits view) and `advisory` (capability-shaped
+ * booleans for UI badges). Used by routes that have a decoded `PdfBits`
+ * in hand — notably `/access`, which always does.
+ *
+ * Returns `null` for the same reason as the base function — when the
+ * PDF hasn't been probed yet so bits are unknown.
+ */
+declare function permissionInfoWithAdvisory(info: DocumentSecurityProbeInfo, pdfBits: PdfBits): PdfPermissionInfo | null;
+/**
+ * Translate a {@link PdfBits} view into the capability-shaped
+ * {@link PdfPermissionAdvisory}: what `pdf.permissions` grants on a file
+ * with these bits.
+ */
+declare function advisoryFromPdfBits(b: PdfBits): PdfPermissionAdvisory;
+declare function securityStateFromProbe(info: DocumentSecurityProbeInfo, opts?: {
+  accessEndpoint?: string;
+  cdnRequired?: boolean;
+}): DocumentSecurityState;
+//#endregion
+//#region src/scheduling/place.d.ts
+/** Where a job's page is: on screen, placed just off it, or in no view. */
+type Place = 'visible' | 'near' | 'elsewhere';
+/** A job's place, and the device pixels of its page on screen there. */
+interface Placed {
+  readonly place: Place;
+  readonly pixels: number;
+}
+/** What a job is about, for its place: its page, the part of it, and the view it serves. */
+interface JobTarget {
+  /** Absent: the job is about the whole document. */
+  readonly page?: PageRef;
+  /** The part of the page, in page space (a tile). Absent: the whole page. */
+  readonly region?: PageBox;
+  readonly view?: string;
+}
+/** One document's working sets: per view, the pages it shows by object number. */
+type ViewSets = ReadonlyMap<string, ReadonlyMap<number, WorkingSetPage>>;
+/** What {@link rank} needs to know about a job besides its place. */
+interface RankedJob {
+  readonly priority: CallPriority;
+  /** Present for a job about part of a page (a tile). */
+  readonly region?: PageBox;
+}
+/** Whether `a` is the better place: on screen before near before elsewhere, then more pixels. */
+declare function placedBefore(a: Placed, b: Placed): boolean;
+/**
+ * A job's place in one view: its page's role there, except that a part of a
+ * visible page that's off screen (a tile of the ring around what shows) is
+ * `near`.
+ */
+declare function placeIn(entry: WorkingSetPage | undefined, job: JobTarget): Placed;
+/**
+ * A job's place among a document's views: in the view it serves, or, when it
+ * serves none (or one that said nothing), the best place its page has in any
+ * view. A job about the whole document serves what's shown, so it counts as
+ * on screen. While no view says anything, every job is on screen alike, and
+ * jobs run in the order they were asked.
+ */
+declare function placeFor(job: JobTarget, views: ViewSets): Placed;
+/**
+ * How soon a job runs among those that may run: higher first. It compares, in
+ * turn:
+ * 1. background last: a `low` call is about nothing the views show;
+ * 2. where its page is: on screen, then just off it, then elsewhere;
+ * 3. its priority: `high` (the picture of the page itself) before `auto`;
+ * 4. a whole page before a part of one: a tile is only of use once its page
+ *    is there;
+ * 5. the device pixels its page shows.
+ * Equal ranks run in the order they were asked, so a caller sequences its own work.
+ */
+declare function rank(job: RankedJob, placed: Placed): number;
+/**
+ * Whether rank `a` beats rank `b` on more than pixels (any of the first four
+ * steps of {@link rank}). A running job gives way only to a job that clearly
+ * outranks it, so two pages on screen never stop each other's work, and jobs
+ * don't flip back and forth while the camera moves.
+ */
+declare function clearlyOutranks(a: number, b: number): boolean;
+//#endregion
+//#region src/engine/attachmentVerbs.d.ts
+/** The verbs of `doc.attachments` that change the document: each one op of a change. */
+type AttachmentWriteVerb = 'create' | 'delete';
+/**
+ * `doc.attachments` on any engine: the reads `rest` holds (`list`,
+ * `download`), and each write as a one-op change through `apply`, so a verb
+ * has its op's checks, events and undo (its `opId` undoes it) and answers as
+ * its single verb did.
+ */
+declare function attachmentVerbs(rest: Omit<DocumentAttachmentsService, AttachmentWriteVerb>, apply: (change: Change, options?: WriteOptions) => AbortablePromise<ChangeResult>): DocumentAttachmentsService;
+//#endregion
+//#region src/engine/outlineVerbs.d.ts
+/**
+ * `doc.outline` on any engine: its read, and each verb as a one-op change
+ * through `apply`, so a verb has its op's checks, events and undo (its
+ * `opId` undoes it) and answers with the op's item.
+ */
+declare function outlineVerbs(get: () => AbortablePromise<DocumentOutline>, apply: (change: Change, options?: WriteOptions) => AbortablePromise<ChangeResult>): DocumentOutlineService;
+//#endregion
+//#region src/engine/pageVerbs.d.ts
+/** The verbs of `doc.pages` that change the page structure: each one op of a change. */
+type PageStructureVerb = 'reorder' | 'rotate' | 'delete' | 'insert' | 'insertBlank';
+/**
+ * `doc.pages` on any engine: what `rest` holds (the reads, extract, flatten
+ * and the page names), and each structure verb as a one-op change through
+ * `apply`, so a verb has its op's checks, events and undo (its `opId` undoes
+ * it) and answers as its single verb did.
+ */
+declare function pageVerbs(rest: Omit<DocumentPagesService, PageStructureVerb>, apply: (change: Change, options?: WriteOptions) => AbortablePromise<ChangeResult>): DocumentPagesService;
+//#endregion
+//#region src/wire/WirePack.d.ts
+/**
+ * Wire-level packaging for messages crossing a Web Worker / Node
+ * `worker_thread` boundary.
+ *
+ * `WirePack<P>` is the typed pair every producer hands to a transport:
+ * the structured payload (validated against the wire schema) and an
+ * explicit, ordered list of `Transferable` objects that the producer
+ * intends to move (zero-copy) to the receiver.
+ *
+ * Why this is a first-class type and not a transport-side argument:
+ *
+ *   - **Producer is the only one who knows.** Whether a particular
+ *     `ArrayBuffer` should be moved (zero-copy, sender's reference
+ *     detached) or copied (structured-cloned, both sides retain
+ *     access) is a semantic decision belonging to the code that
+ *     produced the buffer. Inferring it later — by walking the
+ *     payload looking for `ArrayBuffer` instances and assuming they
+ *     should all be transferred — detaches buffers the producer
+ *     meant to keep.
+ *
+ *   - **Type-checked at the boundary.** A handler returning
+ *     `WirePack<RenderResult>` cannot forget to declare its
+ *     transfer list; the producer literally writes
+ *     `wirePack({ ..., pixels }, [pixels.buffer])` in a single
+ *     return statement. Forgetting yields a structurally identical
+ *     copy (slow but correct), never a silent leak.
+ *
+ *   - **Symmetric across the boundary.** Same `WirePack<P>` on the
+ *     request path (main → worker) and the response path (worker →
+ *     main). Inline transports treat `transfer` as a no-op since
+ *     there's no thread boundary to cross.
+ *
+ *   - **Schema-orthogonal.** Zod schemas validate `payload` and
+ *     nothing else. `transfer` is not data; it's a memory-ownership
+ *     manifest, and the design keeps those concerns separate.
+ *
+ * The receiver of a `postMessage(payload, { transfer })` call gets
+ * the payload back **with the listed buffers already moved into it**
+ * — there's no second argument on the receiving end. So `WirePack`
+ * only ever travels the producer-to-transport leg of the trip; the
+ * consumer side just sees the unwrapped `payload`.
+ */
+interface WirePack<P> {
+  readonly payload: P;
+  readonly transfer: readonly Transferable[];
+}
+/**
+ * Singleton empty transfer list. Frozen so accidental in-place
+ * mutation throws in strict mode rather than silently mutating the
+ * default for future calls.
+ */
+declare const EMPTY_TRANSFER: readonly Transferable[];
+/**
+ * Producer-side helper: pair a typed payload with its transfer list.
+ *
+ * The `transfer` argument is optional; omitting it (or passing `[]`)
+ * is the explicit, type-checked way to say "I declare this message
+ * carries no transferables." The declaration is made at construction
+ * time, in the producer's own code, where the knowledge actually lives.
+ *
+ *   wirePack({ kind: 'metadata.read', jobId, docId })
+ *   wirePack({ kind: 'open.fatMem', jobId, docId, bytes }, [bytes])
+ *   wirePack({ tag: 'page.render', pixels }, [pixels.buffer])
+ */
+declare function wirePack<P>(payload: P, transfer?: readonly Transferable[]): WirePack<P>;
+//#endregion
+export { DocumentSaveLayerBufferWorkerRequest as $, PieceInfoDeleteWorkerRequest as $t, AnnotationsExportWorkerRequest as A, AbortError as An, LayerOpenSource as At, AttachmentFileWorkerPayload as B, OpenWorkerRequest as Bt, securityStateFromProbe as C, WorkerRequest as Cn, FormsSetSignatureAppearanceWorkerRequest as Ct, AnnotationsCreateWorkerRequest as D, EventHub as Dn, LayerArtifactFileWorkerPayload as Dt, AnnotationAppearancesEncodedResultWire as E, changeEvents as En, FormsUpdateWidgetWorkerRequest as Et, AnnotationsReadFileWorkerRequest as F, MetadataUpdateCustomWorkerRequest as Ft, DocumentApplyChangesWorkerRequest as G, PagesListWorkerRequest as Gt, AttachmentsReadFileWorkerRequest as H, PagesExtractWorkerRequest as Ht, AnnotationsRenderAppearancesEncodedWorkerRequest as I, MetadataUpdateWorkerRequest as It, DocumentProbeSecurityFileWorkerRequest as J, PagesRenderWorkerRequest as Jt, DocumentApplyWorkerRequest as K, PagesRemoveNameWorkerRequest as Kt, AnnotationsRenderAppearancesWorkerRequest as L, OpenFatMemoryWorkerRequest as Lt, AnnotationsImportWorkerRequest as M, MeasureViewportsWorkerRequest as Mt, AnnotationsListWorkerRequest as N, MetadataReadCustomWorkerRequest as Nt, AnnotationsDeleteWorkerRequest as O, SessionEventPublisher as On, LayerArtifactWorkerPayload as Ot, AnnotationsReadAppearanceWorkerRequest as P, MetadataReadWorkerRequest as Pt, DocumentSaveFileWorkerRequest as Q, PieceInfoApplicationsWorkerRequest as Qt, AnnotationsReorderWorkerRequest as R, OpenLayerFileBaseWorkerRequest as Rt, securityStateFromHead as S, WorkerLifecycleMessage as Sn, FormsResetWorkerRequest as St, ActionsReadWorkerRequest as T, WorkerResultPayload as Tn, FormsUpdateFieldWorkerRequest as Tt, ChangeRecordPayload as U, PagesFlattenWorkerRequest as Ut, AttachmentsListWorkerRequest as V, OutlineReadWorkerRequest as Vt, CloseWorkerRequest as W, PagesGeometryWorkerRequest as Wt, DocumentRenderPageFileWorkerRequest as X, PagesTextWorkerRequest as Xt, DocumentRenderPageFileEncodedWorkerRequest as Y, PagesSetNameWorkerRequest as Yt, DocumentSaveBufferWorkerRequest as Z, PagesWorkingSetWorkerRequest as Zt, placedBefore as _, SignaturesPrepareWorkerRequest as _n, FormsImportWorkerRequest as _t, pageVerbs as a, SearchQueryWorkerRequest as an, FontsAddFallbackWorkerRequest as at, permissionInfoFromProbe as b, WorkerJobId as bn, FormsReorderWidgetsWorkerRequest as bt, attachmentVerbs as c, ServerChangeOutcome as cn, FontsClearWorkerRequest as ct, Placed as d, SignaturesCancelWorkerRequest as dn, FormsCreateFieldWorkerRequest as dt, PieceInfoReadWorkerRequest as en, DocumentSecurityProbeInfo as et, RankedJob as f, SignaturesCompleteWorkerRequest as fn, FormsDeleteFieldWorkerRequest as ft, placeIn as g, SignaturesListWorkerRequest as gn, FormsImportValuesWorkerRequest as gt, placeFor as h, SignaturesFinalizeCandidateWorkerRequest as hn, FormsExportWorkerRequest as ht, PageStructureVerb as i, RequestEffect as in, EncodedImageWire as it, AnnotationsFlattenWorkerRequest as j, isAbortError as jn, MeasureSetScaleWorkerRequest as jt, AnnotationsExportAppearanceWorkerRequest as k, LOCAL_ENGINE_BRAND as kn, LayerCloseWorkerRequest as kt, JobTarget as l, ShutdownWorkerRequest as ln, FontsRegisterWorkerRequest as lt, clearlyOutranks as m, SignaturesDigestWorkerRequest as mn, FormsDetachWidgetWorkerRequest as mt, WirePack as n, RedactionApplyWorkerRequest as nn, DocumentVersionWorkerRequest as nt, outlineVerbs as o, SearchScanRequest as on, FontsAuthorizeEditingWorkerRequest as ot, ViewSets as p, SignaturesContentsWorkerRequest as pn, FormsDeleteWidgetWorkerRequest as pt, DocumentCheckPasswordPermissionsWorkerRequest as q, PagesRenderEncodedWorkerRequest as qt, wirePack as r, RenderEncode as rn, EncodedAppearanceWire as rt, AttachmentWriteVerb as s, ServerChange as sn, FontsClearFallbacksWorkerRequest as st, EMPTY_TRANSFER as t, PieceInfoUpdateWorkerRequest as tn, DocumentSetFontSettingsWorkerRequest as tt, Place as u, SignaturesAnalyzeWorkerRequest as un, FormsAddWidgetWorkerRequest as ut, rank as v, SignaturesRevisionBytesWorkerRequest as vn, FormsListWorkerRequest as vt, AbortWorkerRequest as w, WorkerResponse as wn, FormsSetValueWorkerRequest as wt, permissionInfoWithAdvisory as x, WorkerJobRequest as xn, FormsRepairWorkerRequest as xt, advisoryFromPdfBits as y, WorkerControlMessage as yn, FormsReorderCalculationsWorkerRequest as yt, AnnotationsUpdateWorkerRequest as z, OpenLayerMemoryBaseWorkerRequest as zt };
+//# sourceMappingURL=runtime-BaDKjxiu.d.ts.map