pdfnative 1.2.0 → 1.4.0

package/dist/index.d.cts

@@ -33,6 +33,122 @@ interface FontData {
         readonly mark1Anchors: Record<number, Record<number, [number, number]>>;
         readonly mark2Classes: Record<number, [number, number, number]>;
     } | null;
+    /**
+     * Colour glyph table (COLR/CPAL), keyed by base glyph id. Present only
+     * for colour fonts such as Noto Color Emoji (opt-in via the
+     * `'emoji-color'` lang). Each entry is an ordered list of paint layers
+     * resolved against the font's CPAL palette (painter's algorithm).
+     * `undefined`/`null` for ordinary monochrome fonts. (v1.3.0)
+     */
+    readonly colorGlyphs?: Record<number, ColorGlyph> | null;
+}
+/** An sRGB colour with alpha, each channel 0–255. Resolved from CPAL. */
+type CpalColor = readonly [number, number, number, number];
+/** A gradient colour stop: `offset` in [0,1] with a resolved colour. */
+interface ColorStop {
+    readonly offset: number;
+    readonly color: CpalColor;
+}
+/** How a gradient extends beyond its [0,1] range (COLR Extend / PDF Extend). */
+type GradientExtend = 'pad' | 'repeat' | 'reflect';
+/** A flat colour fill (COLR PaintSolid / COLRv0 layer). */
+interface SolidPaint {
+    readonly kind: 'solid';
+    readonly color: CpalColor;
+}
+/** A linear (axial) gradient fill (COLR PaintLinearGradient → PDF Shading 2). */
+interface LinearGradientPaint {
+    readonly kind: 'linear';
+    readonly p0: readonly [number, number];
+    readonly p1: readonly [number, number];
+    readonly stops: readonly ColorStop[];
+    readonly extend: GradientExtend;
+}
+/** A radial gradient fill (COLR PaintRadialGradient → PDF Shading 3). */
+interface RadialGradientPaint {
+    readonly kind: 'radial';
+    readonly c0: readonly [number, number];
+    readonly r0: number;
+    readonly c1: readonly [number, number];
+    readonly r1: number;
+    readonly stops: readonly ColorStop[];
+    readonly extend: GradientExtend;
+}
+/**
+ * A sweep (conic/angular) gradient fill (COLR PaintSweepGradient).
+ *
+ * PDF has no native conic shading, so the renderer approximates it as a fan
+ * of flat-colour triangular wedges clipped to the glyph outline — pure path
+ * operators, no shading resource. Angles are in counter-clockwise degrees
+ * from the positive x-axis.
+ *
+ * @since 1.4.0
+ */
+interface SweepGradientPaint {
+    readonly kind: 'sweep';
+    readonly center: readonly [number, number];
+    readonly startAngle: number;
+    readonly endAngle: number;
+    readonly stops: readonly ColorStop[];
+    readonly extend: GradientExtend;
+}
+/** A paint used to fill a colour-glyph layer. */
+type ColorPaint = SolidPaint | LinearGradientPaint | RadialGradientPaint | SweepGradientPaint;
+/** A single colour-glyph layer: a base outline filled by a paint. */
+interface ColorLayer {
+    /** Glyph id of the base outline (in the font's `glyf` table). */
+    readonly glyphId: number;
+    /** The fill applied to the outline. */
+    readonly paint: ColorPaint;
+    /**
+     * Optional affine transform `[a b c d e f]` (font-unit space) applied to
+     * both the outline and the paint geometry of this layer — flattened from
+     * COLRv1 `PaintTransform`/`PaintTranslate`/`PaintScale`. Identity when
+     * absent.
+     */
+    readonly transform?: readonly [number, number, number, number, number, number];
+    /**
+     * Optional PDF blend mode name (`/BM`) for this layer, flattened from a
+     * COLRv1 `PaintComposite` whose composite mode maps to a separable or
+     * non-separable PDF blend mode (e.g. `Multiply`, `Screen`, `Overlay`,
+     * `Darken`, `Lighten`, `Difference`, `Hue`, `Luminosity`). Absent =
+     * `Normal`. Porter-Duff structural modes (Clear/Src/Dest/Xor) are not
+     * mapped — those glyphs fall back to the monochrome font instead.
+     *
+     * @since 1.4.0
+     */
+    readonly blendMode?: string;
+}
+/** A resolved colour glyph: ordered layers painted back-to-front. */
+interface ColorGlyph {
+    readonly layers: readonly ColorLayer[];
+}
+/** A colour-emoji Form XObject collected during content building. */
+interface ColorEmojiForm {
+    /** Resource name (without leading `/`), e.g. `CEm0`. */
+    readonly name: string;
+    /** Form XObject content stream (font-unit space). */
+    readonly content: string;
+    /** Inline `/Resources` body (shadings + ExtGStates), may be empty. */
+    readonly resources: string;
+    /** Form BBox `[x0 y0 x1 y1]` in font units. */
+    readonly bbox: readonly [number, number, number, number];
+}
+/**
+ * Collects unique colour-emoji glyphs encountered while building a document's
+ * content streams, de-duplicating them into a shared set of Form XObjects.
+ * Present on the {@link EncodingContext} only when an `'emoji-color'` font
+ * (a {@link FontData} carrying `colorGlyphs`) is registered. (v1.3.0)
+ */
+interface ColorEmojiCollector {
+    /**
+     * Register use of a colour glyph and return its Form resource name, or
+     * `null` when `gid` is not a colour glyph (caller falls back to normal
+     * text rendering).
+     */
+    useGlyph(fontData: FontData, gid: number): string | null;
+    /** The de-duplicated colour-emoji forms, in first-use order. */
+    readonly forms: ColorEmojiForm[];
 }
 /** A font entry binding FontData to a PDF font reference. */
 interface FontEntry {
@@ -67,6 +183,12 @@ interface EncodingContext {
     readonly f2: string;
     readonly fontData?: FontData;
     readonly getUsedGids?: () => Map<string, Set<number>>;
+    /**
+     * Colour-emoji collector — present only when an `'emoji-color'` font
+     * (carrying `colorGlyphs`) is registered. Used by the text emitter to
+     * draw colour-emoji Form XObjects inline. (v1.3.0)
+     */
+    readonly colorEmoji?: ColorEmojiCollector;
 }
 /** A single row in the PDF table. */
 interface PdfRow {
@@ -172,6 +294,14 @@ interface ColumnDef {
      * @since 1.2.0
      */
     readonly kind?: 'amount';
+    /**
+     * Vertical alignment of this column's cell content within the row band
+     * (`'top'` | `'middle'` | `'bottom'`). Overrides the table-level
+     * `TableBlock.cellVAlign`. When omitted, the historic baseline placement is
+     * preserved (byte-identical to pre-1.4.0).
+     * @since 1.4.0
+     */
+    readonly vAlign?: 'top' | 'middle' | 'bottom';
 }
 /**
  * Options for generating a PDF in a Web Worker via `generatePDFInWorker()`.
@@ -301,6 +431,112 @@ interface PdfLayoutOptions {
      * Default: undefined (no attachments).
      */
     readonly attachments?: readonly PdfAttachment[];
+    /**
+     * Maximum number of document blocks `buildDocumentPDF` / `buildDocumentPDFBytes`
+     * (and the streaming variants) will accept before throwing. This is a
+     * safety rail against accidental unbounded input, not a hard engine limit —
+     * raise it for very large generated reports (e.g. multi-thousand-page
+     * medical or financial documents).
+     *
+     * Default: `DEFAULT_MAX_BLOCKS` (100 000), matching the table builder's
+     * 100 000-row ceiling. Has no effect on the table builder (`buildPDF`).
+     *
+     * @since 1.3.0
+     */
+    readonly maxBlocks?: number;
+    /**
+     * Apply Unicode normalization to all rendered text before shaping and
+     * encoding. Uses the native `String.prototype.normalize` (zero dependency).
+     *
+     * Useful when input text may contain decomposed combining sequences (e.g.
+     * Vietnamese, some Indic input, or text copied from macOS which favours
+     * NFD) so that base + combining marks compose to the precomposed code
+     * points a font's cmap is most likely to cover, maximising glyph coverage.
+     *
+     * - `'NFC'` (recommended): canonical composition
+     * - `'NFD'`: canonical decomposition
+     * - `'NFKC'` / `'NFKD'`: compatibility (de)composition
+     * - `false` / omitted: no normalization (default — output is byte-identical)
+     *
+     * Default: `false` (backward compatible, byte-stable).
+     *
+     * @since 1.3.0
+     */
+    readonly normalize?: 'NFC' | 'NFD' | 'NFKC' | 'NFKD' | false;
+    /**
+     * Override the PDF creation date embedded in `/Info /CreationDate` and
+     * XMP metadata. Accepts any `Date` object.
+     *
+     * When omitted, defaults to `new Date()` at build time. Pinning this
+     * value makes output byte-identical across repeated calls — useful for
+     * deterministic tests and content-addressable storage.
+     *
+     * Default: `undefined` (current wall-clock time).
+     *
+     * @since 1.3.0
+     */
+    readonly creationDate?: Date;
+    /**
+     * How a conforming viewer should present the document when it is first
+     * opened: initial page layout, page mode (bookmark/thumbnail panel, full
+     * screen…), window fit/centering, UI-chrome visibility, and whether the
+     * window title shows the document title. Maps to catalog `/PageLayout`,
+     * `/PageMode`, and the `/ViewerPreferences` dictionary (ISO 32000-1 §12.2).
+     *
+     * Purely presentational, PDF/A-safe, and fully optional. When the document
+     * also has an outline, an explicit `pageMode` here overrides the outline's
+     * default `/UseOutlines`.
+     *
+     * Default: `undefined` (viewer default presentation).
+     *
+     * @since 1.4.0
+     */
+    readonly viewerPreferences?: ViewerPreferences;
+}
+/**
+ * Viewer presentation preferences (ISO 32000-1 §12.2, Table 150 + §7.7.2).
+ * Every field is optional; omitted fields leave the viewer's default behaviour
+ * unchanged. Purely presentational and PDF/A-safe.
+ *
+ * @since 1.4.0
+ */
+interface ViewerPreferences {
+    /**
+     * Initial page layout (catalog `/PageLayout`):
+     * - `'singlePage'`: one page at a time
+     * - `'oneColumn'`: continuous single column
+     * - `'twoColumnLeft'` / `'twoColumnRight'`: continuous two columns, odd pages on the left/right
+     * - `'twoPageLeft'` / `'twoPageRight'`: two pages at a time, odd pages on the left/right
+     */
+    readonly pageLayout?: 'singlePage' | 'oneColumn' | 'twoColumnLeft' | 'twoColumnRight' | 'twoPageLeft' | 'twoPageRight';
+    /**
+     * Initial page mode (catalog `/PageMode`):
+     * - `'useNone'`: neither bookmarks nor thumbnails visible
+     * - `'useOutlines'`: bookmark panel open
+     * - `'useThumbs'`: thumbnail panel open
+     * - `'fullScreen'`: full-screen, no menu/panel
+     * - `'useOC'`: optional-content (layers) panel
+     * - `'useAttachments'`: attachments panel
+     */
+    readonly pageMode?: 'useNone' | 'useOutlines' | 'useThumbs' | 'fullScreen' | 'useOC' | 'useAttachments';
+    /** Hide the viewer's tool bars. */
+    readonly hideToolbar?: boolean;
+    /** Hide the viewer's menu bar. */
+    readonly hideMenubar?: boolean;
+    /** Hide UI elements (scrollbars, navigation controls), leaving only the page. */
+    readonly hideWindowUI?: boolean;
+    /** Resize the document window to fit the first displayed page. */
+    readonly fitWindow?: boolean;
+    /** Centre the document window on the screen. */
+    readonly centerWindow?: boolean;
+    /** Show the document title (from `/Info /Title`) in the window title bar. */
+    readonly displayDocTitle?: boolean;
+    /** Page mode to use when exiting full-screen (`/NonFullScreenPageMode`). */
+    readonly nonFullScreenPageMode?: 'useNone' | 'useOutlines' | 'useThumbs' | 'useOC';
+    /** Predominant reading order: left-to-right (default) or right-to-left. */
+    readonly direction?: 'l2r' | 'r2l';
+    /** Page-scaling default for the Print dialog (`/PrintScaling`). */
+    readonly printScaling?: 'none' | 'appDefault';
 }
 /**
  * Relationship of an embedded file to the PDF document (ISO 19005-3 §6.8).
@@ -754,6 +990,31 @@ declare function buildAppearanceStreamDict(w: number, h: number, streamLength: n
  */
 declare function buildRadioGroupParent(name: string, selectedValue: string, childObjNums: readonly number[], readOnly: boolean, required: boolean): string;
 
+/**
+ * pdfnative — Page Labels (ISO 32000-1 §12.4.2)
+ * ==============================================
+ * Builds the `/PageLabels` number tree placed in the document catalog.
+ * Page labels control the page numbering shown in a viewer's page-number
+ * box and thumbnails (e.g. roman-numeral front matter `i, ii, iii`,
+ * decimal body `1, 2, 3`, prefixed appendices `A-1, A-2`).
+ *
+ * The builder is **pure** and emits an inline dictionary string — page
+ * labels require no indirect objects. Output is PDF/A-safe.
+ */
+/** Page-numbering style for a {@link PageLabelRange}. */
+type PageLabelStyle = 'decimal' | 'roman' | 'Roman' | 'alpha' | 'Alpha' | 'none';
+/** A contiguous run of pages sharing a numbering scheme. */
+interface PageLabelRange {
+    /** 0-based index of the first page in this range. */
+    readonly startPage: number;
+    /** Numbering style. Omit or use `'none'` for prefix-only labels. */
+    readonly style?: PageLabelStyle;
+    /** Optional label prefix (e.g. `'A-'`). */
+    readonly prefix?: string;
+    /** First numeric value in the range (default `1`). */
+    readonly start?: number;
+}
+
 /**
  * pdfnative — Document Content Model Types
  * ==========================================
@@ -869,14 +1130,77 @@ interface TableBlock {
      * @since 1.2.0
      */
     readonly cellPadding?: number;
+    /**
+     * Draw borders around each header/data cell. When omitted, no cell borders
+     * are drawn (byte-identical to pre-1.4.0 — the table keeps only its header
+     * underline and row separators). See {@link CellBorders}.
+     *
+     * @since 1.4.0
+     */
+    readonly cellBorders?: CellBorders;
+    /**
+     * Vertical alignment of cell content within the row band: `'top'`,
+     * `'middle'`, or `'bottom'`. A per-column {@link ColumnDef.vAlign} overrides
+     * this. When omitted, the historic baseline placement is preserved exactly
+     * (byte-identical to pre-1.4.0).
+     *
+     * @since 1.4.0
+     */
+    readonly cellVAlign?: 'top' | 'middle' | 'bottom';
+}
+/**
+ * Per-cell border configuration for a {@link TableBlock}. All sides are off by
+ * default; enable individual sides or use `all: true`. Pure vector strokes
+ * (`re`/`l`/`S`), so output stays PDF/A-safe.
+ *
+ * @since 1.4.0
+ */
+interface CellBorders {
+    /** Draw the top edge of each cell. */
+    readonly top?: boolean;
+    /** Draw the right edge of each cell. */
+    readonly right?: boolean;
+    /** Draw the bottom edge of each cell. */
+    readonly bottom?: boolean;
+    /** Draw the left edge of each cell. */
+    readonly left?: boolean;
+    /** Draw all four edges (shorthand; overrides the individual side flags). */
+    readonly all?: boolean;
+    /** Stroke colour. Default: `'0.8 0.8 0.8'` (light grey). */
+    readonly color?: PdfColor;
+    /** Stroke width in points. Default: `0.5`. */
+    readonly width?: number;
+    /** Stroke style. Default: `'solid'`. */
+    readonly style?: 'solid' | 'dashed' | 'dotted';
 }
 /** List block — bullet or numbered items. */
 interface ListBlock {
     readonly type: 'list';
-    readonly items: readonly string[];
+    /**
+     * List entries. Each entry is either a plain string (leaf item) or a
+     * {@link ListItem} object that can carry its own nested sub-list, enabling
+     * hierarchical (multi-level) bullet/numbered lists. Plain strings and
+     * nested objects may be freely mixed. Passing only strings is byte-identical
+     * to the pre-1.4.0 flat-list behaviour.
+     */
+    readonly items: readonly (string | ListItem)[];
     readonly style: 'bullet' | 'numbered';
     readonly fontSize?: number;
 }
+/**
+ * A single hierarchical list entry: text plus an optional nested sub-list.
+ * Used by {@link ListBlock} to build multi-level outlines (bullets within
+ * bullets, numbered sub-items, …). Sub-items inherit the parent list's
+ * `style`; numbered sub-lists restart their numbering at 1.
+ *
+ * @since 1.4.0
+ */
+interface ListItem {
+    /** The item's text content. */
+    readonly text: string;
+    /** Optional nested child entries (recursive). */
+    readonly items?: readonly (string | ListItem)[];
+}
 /** Spacer block — vertical whitespace. */
 interface SpacerBlock {
     readonly type: 'spacer';
@@ -993,6 +1317,38 @@ interface DocumentMetadata {
     readonly subject?: string;
     readonly keywords?: string;
 }
+/**
+ * A document outline (bookmark) entry — ISO 32000-1 §12.3.3.
+ *
+ * Outline items form a navigable tree shown in a viewer's bookmarks
+ * panel. Each item points at a 0-based page index and may nest children.
+ * Bookmarks are purely navigational and PDF/A-safe.
+ *
+ * @since 1.4.0
+ */
+interface OutlineItem {
+    /** Bookmark label (UTF-16BE encoded automatically). */
+    readonly title: string;
+    /** 0-based destination page index. */
+    readonly pageIndex: number;
+    /** Destination Y coordinate in points (default: top of page). */
+    readonly y?: number;
+    /** Render the label bold (`/F` flag bit 2). */
+    readonly bold?: boolean;
+    /** Render the label italic (`/F` flag bit 1). */
+    readonly italic?: boolean;
+    /** Label colour (`/C`). Accepts hex, RGB tuple, or PDF operator string. */
+    readonly color?: PdfColor;
+    /**
+     * Initial expansion state. `true` (default) renders the bookmark expanded
+     * (positive `/Count`); `false` renders it collapsed (negative `/Count`),
+     * hiding its children until the reader expands it. Only meaningful when the
+     * item has `children`.
+     */
+    readonly open?: boolean;
+    /** Nested child bookmarks. */
+    readonly children?: readonly OutlineItem[];
+}
 /**
  * Parameters for the free-form document PDF builder.
  *
@@ -1016,6 +1372,26 @@ interface DocumentParams {
     readonly fontEntries?: readonly FontEntry[];
     readonly metadata?: DocumentMetadata;
     readonly layout?: Partial<PdfLayoutOptions>;
+    /**
+     * Document outline / bookmarks (ISO 32000-1 §12.3.3).
+     *
+     * - An array of {@link OutlineItem}s builds an explicit bookmark tree.
+     * - The literal `'auto'` derives a flat outline from every `heading`
+     *   block in document order, using each heading's page and position.
+     *
+     * Adds `/Outlines` + `/PageMode /UseOutlines` to the catalog. PDF/A-safe.
+     *
+     * @since 1.4.0
+     */
+    readonly outline?: readonly OutlineItem[] | 'auto';
+    /**
+     * Page labels (ISO 32000-1 §12.4.2) — controls the page numbering shown
+     * in a viewer's page box and thumbnails (e.g. roman front matter then
+     * decimal body). Emitted as an inline `/PageLabels` number tree. PDF/A-safe.
+     *
+     * @since 1.4.0
+     */
+    readonly pageLabels?: readonly PageLabelRange[];
 }
 
 /**
@@ -1670,6 +2046,83 @@ declare function verifyCertSignature(cert: X509Certificate, issuerCert: X509Cert
  */
 declare function isSelfSigned(cert: X509Certificate): boolean;
 
+/**
+ * pdfnative — Pluggable Signature Crypto Provider
+ * ================================================
+ * pdfnative ships its own pure-TypeScript RSA (PKCS#1 v1.5) and ECDSA (P-256)
+ * implementations so that signing works in any runtime with **zero
+ * dependencies**. Those pure-JS primitives are built on JavaScript `BigInt`
+ * arithmetic, which V8/SpiderMonkey do **not** execute in constant time — see
+ * the timing-side-channel caveat in `SECURITY.md`.
+ *
+ * For high-security, high-frequency server pipelines (a backend signing many
+ * PDFs/s with one key under adversarial timing observation), this module lets
+ * you inject a hardware-backed, **constant-time** signer — Node.js
+ * `node:crypto` or a Web Crypto wrapper — without giving up the zero-dependency
+ * default. The pure-JS path remains the fallback when no provider is set.
+ *
+ * The provider produces the raw CMS signature value over the **DER-encoded
+ * signed attributes** (`tbs`, "to be signed"), matching the requested
+ * algorithm:
+ *  - `'rsa-sha256'`  → RSASSA-PKCS1-v1_5 signature over `SHA-256(tbs)`.
+ *  - `'ecdsa-sha256'`→ a **DER-encoded** ECDSA (P-256) signature over
+ *    `SHA-256(tbs)` (i.e. `SEQUENCE { r INTEGER, s INTEGER }`).
+ *
+ * @example Node.js `node:crypto` (constant-time, hardware-backed)
+ * ```ts
+ * import { setCryptoProvider } from 'pdfnative';
+ * import { createSign, createPrivateKey } from 'node:crypto';
+ *
+ * const key = createPrivateKey(pemPrivateKey);
+ * setCryptoProvider({
+ *   sign(tbs, algorithm) {
+ *     // node:crypto hashes `tbs` internally and returns a DER ECDSA sig.
+ *     return new Uint8Array(createSign('sha256').update(tbs).sign(key));
+ *   },
+ * });
+ * ```
+ *
+ * @since 1.4.0
+ */
+
+/**
+ * A pluggable signer that replaces pdfnative's pure-JS RSA/ECDSA math with a
+ * native, constant-time implementation.
+ */
+interface CryptoProvider {
+    /**
+     * Sign the DER-encoded CMS SignedAttributes (`tbs`) and return the raw
+     * signature value to embed in the CMS `SignerInfo`.
+     *
+     * The implementation MUST hash `tbs` with SHA-256 internally (native
+     * `crypto.sign('sha256', …)` does this for you) and produce a signature
+     * matching `algorithm`:
+     *  - `'rsa-sha256'`   → RSASSA-PKCS1-v1_5 over `SHA-256(tbs)`.
+     *  - `'ecdsa-sha256'` → DER-encoded ECDSA-P256 over `SHA-256(tbs)`.
+     */
+    readonly sign: (tbs: Uint8Array, algorithm: SignatureAlgorithm) => Uint8Array;
+}
+/**
+ * Install (or clear) a global signature {@link CryptoProvider}. When set, every
+ * `signPdfBytes()` call that does not pass an explicit per-call provider routes
+ * its signature math through `provider` instead of pdfnative's pure-JS RSA/ECDSA
+ * primitives. Pass `null` to restore the zero-dependency default.
+ *
+ * A per-call `PdfSignOptions.provider` always takes precedence over the global
+ * one set here.
+ *
+ * @param provider The native signer, or `null` to revert to pure-JS.
+ * @since 1.4.0
+ */
+declare function setCryptoProvider(provider: CryptoProvider | null): void;
+/**
+ * The currently-installed global {@link CryptoProvider}, or `null` if none.
+ * Primarily for internal dispatch and testing.
+ *
+ * @since 1.4.0
+ */
+declare function getCryptoProvider(): CryptoProvider | null;
+
 /**
  * pdfnative — CMS SignedData Builder (RFC 5652)
  * ==============================================
@@ -1694,6 +2147,14 @@ interface CmsSignOptions {
     readonly signingTime?: Date;
     /** Signature algorithm. */
     readonly algorithm: SignatureAlgorithm;
+    /**
+     * Optional native signer. When supplied (or when a global provider is set
+     * via {@link setCryptoProvider}), the signature value is produced by the
+     * provider instead of the pure-JS RSA/ECDSA primitives, and `rsaKey` /
+     * `ecKey` are not required.
+     * @since 1.4.0
+     */
+    readonly provider?: CryptoProvider;
 }
 /**
  * Build a CMS SignedData structure for a PDF detached signature.
@@ -1757,6 +2218,15 @@ interface PdfSignOptions extends SigDictMetadata {
     readonly ecKey?: EcPrivateKey;
     /** Algorithm to use. Default: 'rsa-sha256'. */
     readonly algorithm?: SignatureAlgorithm;
+    /**
+     * Optional native signature provider (e.g. `node:crypto` / Web Crypto). When
+     * set — or when a global provider is installed via {@link setCryptoProvider}
+     * — the constant-time native signer replaces pdfnative's pure-JS RSA/ECDSA
+     * math, and `rsaKey` / `ecKey` become optional. A per-call provider takes
+     * precedence over the global one.
+     * @since 1.4.0
+     */
+    readonly provider?: CryptoProvider;
 }
 /**
  * Build a /Sig signature dictionary string for embedding in a PDF.
@@ -1997,6 +2467,36 @@ declare function buildPDFStreamPageByPage(params: PdfParams, layoutOptions?: Par
  * ```
  */
 declare function buildPDFStream(params: PdfParams, layoutOptions?: Partial<PdfLayoutOptions>, streamOptions?: StreamOptions): AsyncGenerator<Uint8Array>;
+/**
+ * Build a free-form PDF document with **true constant-memory streaming**.
+ *
+ * Unlike {@link buildDocumentPDFStream} (which assembles the full binary
+ * then chunks it), this variant assembles the PDF into its raw parts and
+ * yields them progressively, freeing each part as it is emitted. The
+ * fully-joined PDF binary never exists in memory at once. Byte output is
+ * identical to {@link buildDocumentPDFBytes}.
+ *
+ * Constraints (same as `buildDocumentPDFStream`):
+ * - TOC blocks are not allowed (require multi-pass pagination)
+ * - `{pages}` placeholder is not allowed in header/footer templates
+ *
+ * @param params - Document content (title, blocks, footer, fonts)
+ * @param layoutOptions - Optional layout customization
+ * @param streamOptions - Chunk size configuration
+ * @yields Uint8Array chunks of the PDF
+ */
+declare function buildDocumentPDFStreamTrue(params: DocumentParams, layoutOptions?: Partial<PdfLayoutOptions>, streamOptions?: StreamOptions): AsyncGenerator<Uint8Array>;
+/**
+ * Build a table-centric PDF with **true constant-memory streaming**.
+ * See {@link buildDocumentPDFStreamTrue} for the full contract. Byte
+ * output is identical to {@link buildPDFBytes}.
+ *
+ * @param params - PDF content (title, rows, headers, etc.)
+ * @param layoutOptions - Optional layout customization
+ * @param streamOptions - Chunk size configuration
+ * @yields Uint8Array chunks of the PDF
+ */
+declare function buildPDFStreamTrue(params: PdfParams, layoutOptions?: Partial<PdfLayoutOptions>, streamOptions?: StreamOptions): AsyncGenerator<Uint8Array>;
 /**
  * Concatenate an array of Uint8Array chunks into a single Uint8Array.
  *
@@ -2011,6 +2511,37 @@ declare function concatChunks(chunks: readonly Uint8Array[]): Uint8Array;
  * @returns Total byte count
  */
 declare function streamByteLength(stream: AsyncGenerator<Uint8Array>): Promise<number>;
+/** Result of {@link streamToFile}. */
+interface StreamToFileResult {
+    /** Total number of bytes written to the file. */
+    readonly bytesWritten: number;
+    /** The path the stream was written to. */
+    readonly path: string;
+}
+/**
+ * Write a streaming PDF (any of the `streamPdf`/`buildPDFStream*` generators)
+ * directly to a file on disk in **constant memory**, honouring write
+ * back-pressure. Node.js-only convenience wrapper.
+ *
+ * The dependency on `node:fs` is loaded **dynamically** so this module stays
+ * tree-shakeable and bundler-safe for the browser; calling `streamToFile` in
+ * a non-Node environment throws a descriptive error.
+ *
+ * @example
+ * ```ts
+ * await streamToFile(streamDocumentPdf({ blocks }), './out.pdf');
+ * ```
+ *
+ * @param stream   An async generator of PDF byte chunks.
+ * @param filePath Destination path. The caller is responsible for validating
+ *                 untrusted paths (path traversal, allowed directories).
+ * @param opts     Optional `AbortSignal` to cancel mid-write.
+ * @returns Bytes written and the destination path.
+ * @since 1.4.0
+ */
+declare function streamToFile(stream: AsyncGenerator<Uint8Array>, filePath: string, opts?: {
+    readonly signal?: AbortSignal;
+}): Promise<StreamToFileResult>;
 
 /**
  * pdfnative — SHA-384, SHA-512, HMAC-SHA256
@@ -2079,6 +2610,12 @@ declare const DEFAULT_MARGINS: {
     l: number;
 };
 declare const DEFAULT_CW: number;
+/**
+ * Default ceiling for `buildDocumentPDF` block count, overridable per call via
+ * `PdfLayoutOptions.maxBlocks`. Matches the table builder's 100 000-row cap.
+ * @since 1.3.0
+ */
+declare const DEFAULT_MAX_BLOCKS = 100000;
 declare const ROW_H = 12;
 declare const TH_H = 15;
 declare const INFO_LN = 13;
@@ -2264,7 +2801,7 @@ declare function helveticaBoldWidth(str: string, sz: number): number;
  *   Latin mode is used as before — strict PDF/A conformance requires the caller
  *   to register a Latin font (e.g. Noto Sans VF).
  */
-declare function createEncodingContext(fontEntries: FontEntry[], pdfA?: boolean): EncodingContext;
+declare function createEncodingContext(fontEntries: FontEntry[], pdfA?: boolean, normalize?: 'NFC' | 'NFD' | 'NFKC' | 'NFKD' | false): EncodingContext;
 
 /**
  * pdfnative — Font Loader
@@ -2324,6 +2861,47 @@ declare function clearFontCache(): void;
  */
 declare function resetFontRegistry(): void;
 
+/**
+ * pdfnative — Font Data Validator
+ * ================================
+ * `validateFontData()` performs a read-only structural sanity check on a
+ * {@link FontData} module before it is used for rendering. The bundled font
+ * modules under `pdfnative/fonts/*` are already trusted; this validator exists
+ * for consumers who **build their own** font data (via `tools/build-font-data.cjs`
+ * or by hand) from an untrusted or unfamiliar TTF/OTF.
+ *
+ * It catches the common failure modes — a corrupt/empty base64 payload, a
+ * non-SFNT binary, an empty `cmap`, glyph ids that point outside the metrics,
+ * a malformed `pdfWidthArray`, or non-finite metrics — and reports them as
+ * descriptive errors instead of letting a cryptic `.notdef`/`NaN` failure
+ * surface deep inside the encoding/subsetting pipeline.
+ *
+ * The check is **opt-in and standalone**: it is NOT invoked automatically by
+ * `registerFont()` (that would add cost to every load and risks false-rejecting
+ * edge-valid fonts). Call it yourself when ingesting third-party font data.
+ *
+ * @since 1.4.0
+ */
+/** Result of {@link validateFontData}. */
+interface FontValidationResult {
+    /** True when no blocking errors were found. */
+    readonly valid: boolean;
+    /** Blocking structural problems that would break rendering. */
+    readonly errors: readonly string[];
+    /** Non-blocking concerns (suspicious but not necessarily fatal). */
+    readonly warnings: readonly string[];
+}
+/**
+ * Structurally validate a {@link FontData} module. Returns `{ valid, errors,
+ * warnings }`; `valid` is `false` when any blocking problem is found. Does not
+ * throw on malformed input — it reports.
+ *
+ * @param data The font data to validate (typically the default export of a
+ *             generated `*-data.js` module).
+ * @since 1.4.0
+ */
+declare function validateFontData(data: unknown): FontValidationResult;
+
 /**
  * pdfnative — Thai Mini-Shaper
  * =============================
@@ -2360,6 +2938,18 @@ declare function isArmenianCodepoint(cp: number): boolean;
 declare function isBengaliCodepoint(cp: number): boolean;
 /** Check if a codepoint falls in the Tamil Unicode block. */
 declare function isTamilCodepoint(cp: number): boolean;
+/** Check if a codepoint falls in the Telugu Unicode block. */
+declare function isTeluguCodepoint(cp: number): boolean;
+/** Check if a codepoint falls in any Ethiopic Unicode block. */
+declare function isEthiopicCodepoint(cp: number): boolean;
+/** Check if a codepoint falls in the Sinhala Unicode block. */
+declare function isSinhalaCodepoint(cp: number): boolean;
+/** Check if a codepoint falls in the Tibetan Unicode block. */
+declare function isTibetanCodepoint(cp: number): boolean;
+/** Check if a codepoint falls in any Khmer Unicode block. */
+declare function isKhmerCodepoint(cp: number): boolean;
+/** Check if a codepoint falls in any Myanmar Unicode block. */
+declare function isMyanmarCodepoint(cp: number): boolean;
 /** Check if a codepoint falls in any Devanagari Unicode block. */
 declare function isDevanagariCodepoint(cp: number): boolean;
 /** Check if text contains Arabic characters requiring shaping. */
@@ -2372,6 +2962,18 @@ declare function containsThai(str: string): boolean;
 declare function containsBengali(str: string): boolean;
 /** Check whether a string contains any Tamil characters. */
 declare function containsTamil(str: string): boolean;
+/** Check whether a string contains any Telugu characters. */
+declare function containsTelugu(str: string): boolean;
+/** Check whether a string contains any Ethiopic characters. */
+declare function containsEthiopic(str: string): boolean;
+/** Check whether a string contains any Sinhala characters. */
+declare function containsSinhala(str: string): boolean;
+/** Check whether a string contains any Tibetan characters. */
+declare function containsTibetan(str: string): boolean;
+/** Check whether a string contains any Khmer characters. */
+declare function containsKhmer(str: string): boolean;
+/** Check whether a string contains any Myanmar characters. */
+declare function containsMyanmar(str: string): boolean;
 /** Check whether a string contains any Devanagari characters. */
 declare function containsDevanagari(str: string): boolean;
 
@@ -2437,6 +3039,191 @@ declare function shapeBengaliText(str: string, fontData: FontData): ShapedGlyph[
  */
 declare function shapeTamilText(str: string, fontData: FontData): ShapedGlyph[];
 
+/**
+ * pdfnative — Telugu Mini-Shaper
+ * ================================
+ * Pure JS OpenType GSUB + GPOS shaping for Telugu script.
+ * Zero external dependency.
+ *
+ * Handles:
+ *   - Syllable cluster building (base + virama-mediated conjuncts / subjoined
+ *     consonants — Telugu stacks the dependent consonant below the base)
+ *   - GSUB LigatureSubst: conjunct / subjoined-consonant formation
+ *     (C + Virama + C → ligature glyph)
+ *   - GSUB SingleSubst: contextual glyph substitution
+ *   - GPOS MarkToBase: combining-mark positioning (above/below vowel signs,
+ *     anusvara, candrabindu, length marks)
+ *
+ * Telugu is structurally close to Devanagari but:
+ *   - has **no reph** (Ra forms a subjoined glyph, not a top mark),
+ *   - has **no pre-base matra reordering** — every Telugu vowel sign attaches
+ *     to the right of, or above/below, the base (nothing renders to its left),
+ *   - has **no nukta**.
+ *
+ * References:
+ *   - Unicode Standard §12.8 Telugu
+ *   - OpenType spec: Script-specific shaping for Telugu (tel2 / Indic2)
+ *   - ISO 15924 script code: Telu
+ */
+
+/**
+ * Shape a string of Telugu text into an array of positioned glyphs.
+ *
+ * @param str - Raw Telugu string
+ * @param fontData - Font data with cmap, ligatures, markAnchors, metrics, widths
+ * @returns Array of positioned glyphs
+ */
+declare function shapeTeluguText(str: string, fontData: FontData): ShapedGlyph[];
+
+/**
+ * pdfnative — Sinhala Mini-Shaper
+ * ================================
+ * Pure JS OpenType GSUB + GPOS shaping for the Sinhala script (Sri Lanka).
+ * Zero external dependency.
+ *
+ * Handles:
+ *   - Syllable cluster building (base + al-lakuna-mediated conjuncts)
+ *   - GSUB LigatureSubst: conjunct / touching-form ligatures
+ *     (C + Al-lakuna + ZWJ + Ya/Ra → yansaya / rakaaransaya, C+C conjuncts)
+ *   - Pre-base (left-side) vowel reordering — the kombuva family
+ *     (U+0DD9 / U+0DDB and the left half of the two-part vowels U+0DDA,
+ *     U+0DDC, U+0DDD, U+0DDE) renders to the LEFT of its base consonant, so
+ *     the shaper emits that glyph BEFORE the base in visual order.
+ *   - Two-part dependent vowels are decomposed into their left + right halves.
+ *   - GPOS MarkToBase: above / below pilla positioning.
+ *
+ * Known limitations (documented):
+ *   - Complex multi-consonant stacks beyond the font's pre-baked ligature
+ *     table fall back to sequential base + al-lakuna rendering.
+ *   - GSUB MultipleSubst (LookupType 2) is not consumed; two-part vowels are
+ *     instead decomposed by this shaper's own table.
+ *
+ * References:
+ *   - Unicode Standard §13.2 Sinhala
+ *   - OpenType spec: Script-specific shaping for Sinhala (sinh)
+ *   - ISO 15924 script code: Sinh
+ */
+
+/**
+ * Shape a string of Sinhala text into an array of positioned glyphs.
+ *
+ * @param str - Raw Sinhala string
+ * @param fontData - Font data with cmap, ligatures, markAnchors, metrics, widths
+ * @returns Array of positioned glyphs
+ */
+declare function shapeSinhalaText(str: string, fontData: FontData): ShapedGlyph[];
+
+/**
+ * pdfnative — Tibetan Mini-Shaper
+ * ================================
+ * Pure JS OpenType GSUB + GPOS shaping for the Tibetan script.
+ * Zero external dependency.
+ *
+ * Tibetan builds vertical stacks: a head consonant with zero or more
+ * *subjoined* consonants (U+0F90–U+0FBC) stacked beneath it, plus vowel
+ * signs above / below and spacing marks to the right.
+ *
+ * Handles:
+ *   - Stack building (head consonant + subjoined consonants + vowels + marks)
+ *   - GSUB LigatureSubst: pre-baked stacked-consonant ligatures when the font
+ *     provides them (head + subjoined → single stack glyph)
+ *   - GPOS MarkToBase: subjoined consonants and above/below vowel signs are
+ *     anchored on the base when no ligature exists
+ *
+ * Known limitations (documented):
+ *   - Deep stacks beyond the font's ligature coverage fall back to GPOS
+ *     below-base anchoring of each subjoined consonant, which approximates but
+ *     may not perfectly match a native stacking engine.
+ *   - GSUB contextual substitution (LookupType 5/6) is not consumed.
+ *
+ * References:
+ *   - Unicode Standard §13.4 Tibetan
+ *   - OpenType spec: Script-specific shaping for Tibetan (tibt)
+ *   - ISO 15924 script code: Tibt
+ */
+
+/**
+ * Shape a string of Tibetan text into an array of positioned glyphs.
+ *
+ * @param str - Raw Tibetan string
+ * @param fontData - Font data with cmap, ligatures, markAnchors, metrics, widths
+ * @returns Array of positioned glyphs
+ */
+declare function shapeTibetanText(str: string, fontData: FontData): ShapedGlyph[];
+
+/**
+ * pdfnative — Khmer Mini-Shaper
+ * ==============================
+ * Pure JS OpenType GSUB + GPOS shaping for the Khmer script (Cambodia).
+ * Zero external dependency.
+ *
+ * Khmer is a USE-class (Universal Shaping Engine) script. This is a pragmatic
+ * USE-lite implementation that covers the common cases:
+ *   - Coeng (U+17D2) + consonant → subscript consonant (stacked below / behind)
+ *   - Pre-base (left-side) vowel reordering — U+17C1 (e), U+17C2 (ae),
+ *     U+17C3 (ai) render to the LEFT of their base, so they are emitted first.
+ *   - Two-part vowels (U+17BE, U+17BF, U+17C0, U+17C4, U+17C5) are decomposed
+ *     into their pre-base + post-base halves.
+ *   - GSUB LigatureSubst: coeng-form subscript ligatures when the font provides
+ *     them; GPOS MarkToBase for above / below vowel signs and diacritics.
+ *
+ * Known limitations (documented):
+ *   - This is not a full USE implementation. Robat (U+17CC), complex
+ *     multi-coeng stacks beyond the font's ligature coverage, and contextual
+ *     GSUB (LookupType 5/6) are approximated, not fully reordered.
+ *
+ * References:
+ *   - Unicode Standard §16.4 Khmer
+ *   - OpenType spec: Universal Shaping Engine; Khmer (khmr)
+ *   - ISO 15924 script code: Khmr
+ */
+
+/**
+ * Shape a string of Khmer text into an array of positioned glyphs.
+ *
+ * @param str - Raw Khmer string
+ * @param fontData - Font data with cmap, ligatures, markAnchors, metrics, widths
+ * @returns Array of positioned glyphs
+ */
+declare function shapeKhmerText(str: string, fontData: FontData): ShapedGlyph[];
+
+/**
+ * pdfnative — Myanmar Mini-Shaper
+ * ================================
+ * Pure JS OpenType GSUB + GPOS shaping for the Myanmar (Burmese) script.
+ * Zero external dependency.
+ *
+ * Myanmar is a USE-class (Universal Shaping Engine) script. This is a pragmatic
+ * USE-lite implementation covering the common cases:
+ *   - Medial consonants: medial ya (U+103B), ra (U+103C), wa (U+103D),
+ *     ha (U+103E). Medial **ra** renders to the LEFT of its base (pre-base)
+ *     and is therefore emitted first.
+ *   - Virama / stacker (U+1039): C + U+1039 + C → stacked subscript consonant.
+ *   - Asat (U+103A, visible killer) is preserved.
+ *   - GSUB LigatureSubst for medial / stacked forms when the font provides
+ *     them; GPOS MarkToBase for above / below vowel signs and tone marks.
+ *
+ * Known limitations (documented):
+ *   - This is not a full USE implementation. Kinzi (U+1004 U+103A U+1039),
+ *     deep stacks beyond the font's ligature coverage, and contextual GSUB
+ *     (LookupType 5/6) are approximated, not fully reordered. Kinzi is rendered
+ *     via its stacking sequence rather than a dedicated reordering pass.
+ *
+ * References:
+ *   - Unicode Standard §16.3 Myanmar
+ *   - OpenType spec: Universal Shaping Engine; Myanmar (mymr)
+ *   - ISO 15924 script code: Mymr
+ */
+
+/**
+ * Shape a string of Myanmar text into an array of positioned glyphs.
+ *
+ * @param str - Raw Myanmar string
+ * @param fontData - Font data with cmap, ligatures, markAnchors, metrics, widths
+ * @returns Array of positioned glyphs
+ */
+declare function shapeMyanmarText(str: string, fontData: FontData): ShapedGlyph[];
+
 /**
  * pdfnative — Devanagari Mini-Shaper
  * ====================================
@@ -2524,29 +3311,30 @@ interface BidiRun {
     readonly start: number;
 }
 /**
- * UAX #9 explicit embedding/override normalization (v1.2.0).
+ * UAX #9 explicit embedding normalization (v1.2.0, refined v1.3.0).
  *
- * Maps the legacy explicit directional formatting characters into their
- * sealed-isolate equivalents so the rest of the pipeline can process
- * them via the existing isolate machinery:
+ * Maps the legacy explicit *embedding* characters into their sealed-isolate
+ * equivalents so the rest of the pipeline can process them via the existing
+ * isolate machinery:
  *
  * - LRE (U+202A) → LRI (U+2066)
  * - RLE (U+202B) → RLI (U+2067)
- * - LRO (U+202D) → LRI (U+2066) — base direction L (character-level
- *   override staged for v1.3)
- * - RLO (U+202E) → RLI (U+2067) — base direction R (character-level
- *   override staged for v1.3)
- * - PDF (U+202C) → PDI (U+2069), but only when popping a matched
- *   LRE/RLE/LRO/RLO from the stack (otherwise dropped)
- *
- * This is a pragmatic simplification: full UAX #9 embeddings allow
- * neutral resolution to leak across the embedding boundary, while
- * isolates are sealed. In real-world inputs the two are
- * interchangeable for ≥ 95 % of cases. Strict UAX #9 conformance with
- * embedding leakage and character-level override is staged for v1.3.
+ * - PDF (U+202C) → PDI (U+2069), but only when popping a matched LRE/RLE
+ *   from the stack (otherwise preserved or dropped, see below)
+ *
+ * The explicit *override* characters LRO (U+202D) / RLO (U+202E) and the
+ * PDF (U+202C) that closes them are **preserved verbatim** — they carry
+ * character-level type-override semantics (UAX #9 X4/X5) that the isolate
+ * machinery cannot express. They are resolved separately by
+ * {@link resolveBidiRuns} via the override pre-pass, which forces every
+ * inner code point to L (LRO) or R (RLO). A PDF that would pop an override
+ * frame is therefore left in place for that pre-pass to consume.
+ *
+ * This split keeps the ≥ 95 % common embedding cases on the fast isolate
+ * path while giving LRO/RLO faithful character-level override behaviour.
  *
  * @param text - Raw input text in logical order
- * @returns Normalized text with embeddings mapped to isolates.
+ * @returns Text with embeddings mapped to isolates; overrides preserved.
  */
 declare function normalizeBidiEmbeddings(text: string): string;
 /**
@@ -2564,10 +3352,13 @@ declare function normalizeBidiEmbeddings(text: string): string;
  */
 declare function resolveBidiRuns(text: string): BidiRun[];
 /**
- * Check if text contains any RTL characters (Arabic or Hebrew).
+ * Check if text contains any RTL characters (Arabic or Hebrew) or an explicit
+ * directional override (LRO U+202D / RLO U+202E). The override markers are
+ * included so a direct caller that has not yet stripped controls still routes
+ * through the bidi resolver, where the X4/X5 override pass applies.
  *
  * @param text - Input text string
- * @returns True if text contains R or AL bidi types
+ * @returns True if text contains R/AL bidi types or an LRO/RLO override
  */
 declare function containsRTL(text: string): boolean;
 /**
@@ -2602,19 +3393,20 @@ declare function stripBidiControls(text: string): string;
  * Based on the Universal Shaping Engine specification:
  *   https://learn.microsoft.com/en-us/typography/script-development/use
  *
- * Scope (v1.2.0):
+ * Scope (v1.3.0):
  *   - Public API for cluster classification: callers can run their own
  *     reordering / GSUB pipelines on top of the cluster categories.
  *   - 11 cluster categories sufficient for the four scripts pdfnative
  *     ships shaping for (Devanagari, Bengali, Tamil) plus a generic
  *     fallback that classifies any USE-eligible code point.
- *
- * Not in scope (deferred to v1.3):
- *   - Rewiring the bundled Devanagari/Bengali/Tamil shapers to drive
- *     their reordering from this module. The shapers currently use
- *     hand-tuned per-script logic that the existing 1700+ vitest
- *     cases pin in place; switching them over is a separate refactor
- *     gated on the v1.3 shaping benchmark harness.
+ *   - Marathi eyelash-ra (Ra + virama + ZWJ) is recognised as a distinct
+ *     reph variant (`UseCluster.eyelash`).
+ *   - The bundled Devanagari/Bengali/Tamil shapers consume
+ *     `classifyUseCategory` as the single source of truth for joiner
+ *     (ZWJ/ZWNJ) and half-form/eyelash decisions; their hand-tuned
+ *     happy-path reordering (pinned by the vitest suite) is preserved.
+ *
+ * Not in scope (deferred):
  *   - State-table classification for Khmer/Myanmar/Tibetan/Sinhala/
  *     other USE-required scripts not currently bundled.
  */
@@ -2656,6 +3448,12 @@ interface UseCluster {
     readonly post: UseClassifiedCp[];
     /** Halant + consonant chains attached after the base (conjunct tail). */
     readonly tail: UseClassifiedCp[];
+    /**
+     * True when the cluster head is a Marathi eyelash-ra — `Ra + virama + ZWJ`
+     * — which renders as the eyelash (rakar) form rather than a reph. The
+     * leading `Ra` is still recorded in {@link prebase} with category `'R'`.
+     */
+    readonly eyelash?: boolean;
 }
 /**
  * Classify a single Unicode code point into a USE-lite category.
@@ -2729,6 +3527,154 @@ declare function classifyClusters(codePoints: readonly number[]): UseCluster[];
  */
 declare function shapeArabicText(str: string, fontData: FontData): ShapedGlyph[];
 
+/**
+ * pdfnative — TrueType `glyf` Outline Extractor
+ * ==============================================
+ * Pure-JS reader that turns a TrueType glyph outline into ordered contours
+ * of quadratic on/off-curve points. Zero external dependency.
+ *
+ * Used by the colour-glyph renderer (COLR/CPAL) to fill a base glyph's
+ * outline as a native PDF path. Handles both simple and composite glyphs
+ * (the latter via recursive 2×2 + translate component transforms).
+ *
+ * References:
+ *   - ISO/IEC 14496-22 (OpenType) §5.3.3 `glyf`
+ *   - Apple TrueType Reference Manual — Glyph data format
+ */
+/** A single outline point in font units. */
+interface OutlinePoint {
+    readonly x: number;
+    readonly y: number;
+    /** True for on-curve points; false for quadratic control (off-curve). */
+    readonly onCurve: boolean;
+}
+/** A closed contour: an ordered ring of on/off-curve points. */
+type Contour = OutlinePoint[];
+/** A parsed TrueType font exposing just enough to read glyph outlines. */
+interface GlyfFont {
+    readonly view: DataView;
+    readonly glyfOffset: number;
+    readonly locaOffsets: number[];
+    readonly unitsPerEm: number;
+}
+/**
+ * Parse the table directory, `head`, `maxp` and `loca` so that subsequent
+ * {@link extractGlyphContours} calls are O(1) lookups.
+ *
+ * @param bytes - Raw TrueType/OpenType (glyf-flavoured) font bytes.
+ * @returns A {@link GlyfFont}, or `null` if the font has no `glyf` outlines
+ *          (e.g. a CFF font) or is structurally invalid.
+ */
+declare function parseGlyfFont(bytes: Uint8Array): GlyfFont | null;
+/**
+ * Extract the contours of a single glyph in font units. Composite glyphs are
+ * flattened by recursively transforming their components.
+ *
+ * @param font  - Parsed {@link GlyfFont}.
+ * @param gid   - Glyph id.
+ * @param depth - Internal recursion guard for composite glyphs.
+ * @returns Array of contours (empty for whitespace / empty glyphs).
+ */
+declare function extractGlyphContours(font: GlyfFont, gid: number, depth?: number): Contour[];
+
+/**
+ * pdfnative — COLR / CPAL Colour-Font Parser
+ * ===========================================
+ * Pure-JS reader for the OpenType COLR (colour layers) and CPAL (colour
+ * palette) tables. Resolves each base colour glyph into a flat list of
+ * {@link ColorLayer}s (base outline + paint), painted back-to-front.
+ *
+ * Supported:
+ *   - COLR v0 — layered solid fills.
+ *   - COLR v1 — PaintColrLayers, PaintGlyph, PaintColrGlyph, PaintSolid,
+ *     PaintLinearGradient, PaintRadialGradient, PaintSweepGradient,
+ *     PaintTransform, PaintTranslate, PaintScale (+ around-center),
+ *     PaintComposite (blend-mode-mappable composite modes).
+ *
+ * Unsupported paints (variable paints, Porter-Duff structural composite
+ * modes Clear/Src/Dest/Xor/…) cause the affected glyph to be skipped so the
+ * caller can fall back to the monochrome emoji font. This keeps output
+ * correct (never garbled) while covering the overwhelming majority of
+ * Noto Color Emoji glyphs.
+ *
+ * Zero external dependency.
+ *
+ * References:
+ *   - ISO/IEC 14496-22 (OpenType) §5.7.11 COLR, §5.7.12 CPAL
+ *   - https://learn.microsoft.com/typography/opentype/spec/colr
+ */
+
+/**
+ * Parse the CPAL table's first palette into an array of {@link CpalColor}s
+ * (sRGB + alpha, each channel 0–255), indexed by palette entry.
+ */
+declare function parseCpal(bytes: Uint8Array): CpalColor[] | null;
+/**
+ * Parse the COLR + CPAL tables of a font into a colour-glyph map keyed by
+ * base glyph id. Returns `null` when the font has no COLR table.
+ *
+ * @param bytes - Raw OpenType font bytes.
+ */
+declare function parseColrCpal(bytes: Uint8Array): Record<number, ColorGlyph> | null;
+
+/**
+ * pdfnative — Colour Glyph Renderer (COLR/CPAL → native PDF)
+ * ==========================================================
+ * Renders a resolved {@link ColorGlyph} as a native PDF Form XObject: each
+ * layer's base-glyph outline is emitted as a vector path and filled with a
+ * flat colour or a `/Shading` gradient. No rasterisation, zero dependency.
+ *
+ *   - Solid layers → `r g b rg … f` (with `/ca` ExtGState for alpha < 1).
+ *   - Linear gradients → `/Shading` Type 2 (axial) painted via `sh`,
+ *     clipped to the glyph outline.
+ *   - Radial gradients → `/Shading` Type 3, likewise.
+ *   - Sweep (conic) gradients → a fan of flat-colour triangular wedges
+ *     clipped to the outline (PDF has no native conic shading). (v1.4.0)
+ *   - Per-layer blend modes (`/BM`, from COLRv1 `PaintComposite`) via an
+ *     ExtGState applied around the layer's fill. (v1.4.0)
+ *
+ * The Form XObject's user space is font units; the caller scales it onto the
+ * page with a `cm` and draws it with `Do`.
+ *
+ * References:
+ *   - ISO 32000-1 §8.7.4.5 (Shadings), §7.10.2 (Type 2 functions),
+ *     §8.10 (Form XObjects)
+ */
+
+/** A rendered colour glyph ready to be assembled into a Form XObject. */
+interface ColorGlyphForm {
+    /** Form XObject content stream (font-unit user space). */
+    readonly content: string;
+    /** Form BBox `[x0 y0 x1 y1]` in font units. */
+    readonly bbox: readonly [number, number, number, number];
+    /** Named `/Shading` resources referenced by the content stream. */
+    readonly shadings: ReadonlyArray<{
+        readonly name: string;
+        readonly dict: string;
+    }>;
+    /** Named `/ExtGState` resources (constant alpha) referenced by content. */
+    readonly extGStates: ReadonlyArray<{
+        readonly name: string;
+        readonly dict: string;
+    }>;
+}
+/** Provider of glyph outlines (decoupled from the font parser for testing). */
+type OutlineProvider = (glyphId: number) => Contour[];
+type Mat = readonly [number, number, number, number, number, number];
+/**
+ * Convert a set of TrueType quadratic contours into PDF path operators
+ * (cubic Béziers), applying matrix `m`. Each contour is closed (`h`).
+ */
+declare function contoursToPath(contours: Contour[], m?: Mat): string;
+/**
+ * Render a colour glyph into a {@link ColorGlyphForm}.
+ *
+ * @param glyph    - Resolved colour glyph (ordered layers).
+ * @param outlines - Provides the contours for a given base glyph id.
+ * @param unitsPerEm - Font units per em (defines the BBox).
+ */
+declare function renderColorGlyph(glyph: ColorGlyph, outlines: OutlineProvider, unitsPerEm: number): ColorGlyphForm;
+
 /**
  * pdfnative — PDF Token Scanner
  * ===============================
@@ -3029,6 +3975,137 @@ interface PdfModifier {
  */
 declare function createModifier(reader: PdfReader): PdfModifier;
 
+/**
+ * pdfnative — Page-Tree Manipulation API (ISO 32000-1 §7.7.3)
+ * ============================================================
+ * Safe, **faithful** page-level document assembly: merge, split, and
+ * extract pages across PDF documents.
+ *
+ * Unlike the incremental modifier (`createModifier`), these operations
+ * **rebuild** a brand-new document from scratch: every kept page and its
+ * transitive object graph (`/Contents`, `/Resources`, fonts, XObjects,
+ * ExtGState, …) is deep-copied into a fresh, contiguous object-number
+ * space, then wired into a new flat `/Pages` tree, `/Catalog`, xref, and
+ * trailer. This avoids production-unsafe in-place surgery (relocating
+ * `/Kids`, rewriting `/Parent` chains, merging resource pools).
+ *
+ * Safety guarantees (documented behaviour):
+ *  - **Encrypted sources are rejected** (no Standard Security Handler
+ *    writer yet) — throws.
+ *  - **Signatures are always removed** — any page-tree edit invalidates a
+ *    document signature's `/ByteRange`, so signature/Widget annotations and
+ *    the `/AcroForm` are dropped. The `dropSignatures` flag is accepted for
+ *    API clarity but the behaviour is unconditional.
+ *  - **Annotations** default to URI-`/Link`-only (self-contained). Cross-page
+ *    GoTo links and form widgets are dropped to guarantee no dangling
+ *    references. `dropAnnotations: true` removes all annotations.
+ *  - Output is **not** claimed to be PDF/A — merged OutputIntents / XMP
+ *    cannot be reconciled safely.
+ *
+ * @since 1.4.0
+ */
+/** A contiguous, inclusive page range (0-based). */
+interface PageRange {
+    /** First page index (0-based, inclusive). */
+    readonly start: number;
+    /** Last page index (0-based, inclusive). Defaults to `start`. */
+    readonly end?: number;
+}
+/**
+ * Options for the page-tree manipulation API ({@link mergePdfs},
+ * {@link splitPdf}, {@link extractPages}).
+ */
+interface MergeOptions {
+    /**
+     * Drop signature fields/widgets. Accepted for clarity; merging always
+     * removes signatures because the operation invalidates `/ByteRange`.
+     */
+    readonly dropSignatures?: boolean;
+    /** Drop **all** annotations (default keeps self-contained URI links). */
+    readonly dropAnnotations?: boolean;
+    /**
+     * Maximum size, in bytes, of the assembled output document. The operation
+     * throws as soon as the copied object graph would exceed this limit — even
+     * mid-copy, before a multi-gigabyte stream is materialised — so a malicious
+     * or accidentally huge source cannot exhaust process memory.
+     *
+     * Defaults to `268435456` (256 MiB). Pass `Infinity` to disable the guard
+     * (not recommended for untrusted input).
+     *
+     * @defaultValue 268435456 (256 MiB)
+     */
+    readonly maxOutputSize?: number;
+}
+/**
+ * Concatenate multiple PDF documents into one, preserving page order.
+ *
+ * @param sources 1–50 PDF byte arrays.
+ * @param opts    See {@link MergeOptions}.
+ * @returns A new, self-contained PDF.
+ * @throws If `sources` is empty/too large, or any source is encrypted.
+ */
+declare function mergePdfs(sources: readonly Uint8Array[], opts?: MergeOptions): Uint8Array;
+/**
+ * Extract a subset of pages from a single document into a new PDF.
+ * Indices may repeat and need not be ordered — output follows the given order.
+ *
+ * @param src         Source PDF bytes.
+ * @param pageIndices 0-based page indices to keep.
+ * @param opts        See {@link MergeOptions} (e.g. `maxOutputSize`,
+ *                    `dropAnnotations`).
+ * @throws If `src` is encrypted, indices is empty, or an index is out of range.
+ */
+declare function extractPages(src: Uint8Array, pageIndices: readonly number[], opts?: MergeOptions): Uint8Array;
+/**
+ * Split a document into multiple PDFs, one per page range.
+ *
+ * @param src    Source PDF bytes.
+ * @param ranges Inclusive 0-based page ranges.
+ * @param opts   See {@link MergeOptions} (e.g. `maxOutputSize`,
+ *               `dropAnnotations`); applied to every emitted document.
+ * @returns One PDF per range, in order.
+ * @throws If `src` is encrypted, ranges is empty, or a range is invalid.
+ */
+declare function splitPdf(src: Uint8Array, ranges: readonly PageRange[], opts?: MergeOptions): Uint8Array[];
+
+/**
+ * pdfnative — PDF/UA structural validator (ISO 14289-1)
+ * ======================================================
+ * A lightweight, read-only conformance checker for tagged-PDF (PDF/UA)
+ * structural prerequisites. It does **not** render or rasterise; it parses the
+ * document with the native reader and inspects the catalog, structure tree and
+ * per-page marked-content.
+ *
+ * Scope (what this validator can verify from structure alone):
+ *   - Catalog `/MarkInfo << /Marked true >>`            (ISO 14289-1 §7.1)
+ *   - Catalog `/StructTreeRoot`                          (ISO 14289-1 §7.1)
+ *   - Catalog `/Metadata` (XMP) and `/Lang`              (ISO 14289-1 §7.2, §7.3)
+ *   - `/StructTreeRoot /ParentTree`                      (ISO 32000-1 §14.7.4.4)
+ *   - MCID uniqueness within each page's content stream  (ISO 32000-1 §14.7.4.3)
+ *
+ * It is intended as a fast developer-time gate, not a substitute for a full
+ * reference validator (e.g. veraPDF) which also checks fonts, colour and
+ * rendering. A `valid` result here means the structural prerequisites hold.
+ *
+ * @since 1.3.0
+ */
+/** Result of a PDF/UA structural validation. */
+interface PdfUAValidationResult {
+    /** True when no blocking errors were found. */
+    readonly valid: boolean;
+    /** Blocking conformance violations. */
+    readonly errors: readonly string[];
+    /** Non-blocking recommendations (PDF/UA best practices). */
+    readonly warnings: readonly string[];
+}
+/**
+ * Validate the PDF/UA (ISO 14289-1) structural prerequisites of a tagged PDF.
+ *
+ * @param bytes - Complete PDF file bytes (e.g. from `buildDocumentPDFBytes`).
+ * @returns A structured result with `valid`, `errors` and `warnings`.
+ */
+declare function validatePdfUA(bytes: Uint8Array): PdfUAValidationResult;
+
 /**
  * pdfnative — DEFLATE Decompressor (FlateDecode reader)
  * ======================================================
@@ -3176,4 +4253,4 @@ declare function createPDF(pdfParams: PdfParams, options?: {
     layoutOptions?: Partial<PdfLayoutOptions>;
 }): Promise<Uint8Array>;
 
-export { type AddSignaturePlaceholderOptions, type Annotation, type Asn1Node, BAL_H, type BarcodeBlock, type BarcodeFormat, type BidiRun, type CmsSignOptions, type ColumnDef, DEFAULT_COLORS, DEFAULT_COLUMNS, DEFAULT_CW, DEFAULT_FONT_SIZES, DEFAULT_MARGINS, DEFAULT_MAX_INFLATE_OUTPUT, type DocumentBlock, type DocumentMetadata, type DocumentParams, type EcPrivateKey, type EcPublicKey, type EmbeddedFilesResult, type EncodingContext, type EncryptionOptions, FT_H, type FontData, type FontEntry, type FontLoader, type FontMetrics, type FontRun, type FormField, type FormFieldBlock, type FormFieldType, type FormWidgetResult, HEADER_H, type HeadingBlock, INFO_LN, type ImageBlock, type InternalLink, KNOWN_DECODE_FILTERS, type LinkAnnotation, type LinkBlock, type ListBlock, MAX_PARSE_DEPTH, MAX_XREF_CHAIN, PAGE_SIZES, PDF_A_CONFORMANCE_TARGETS, PG_H, PG_W, type PageBreakBlock, type PageTemplate, type ParagraphBlock, type PdfArray as ParsedArray, type PdfDict as ParsedDict, type ParsedImage, type PdfAConfig, type PdfAConformanceTarget, type PdfAttachment, type PdfAttachmentRelationship, type PdfColor, type PdfColors, type PdfIndirectObject, type PdfInfoItem, type PdfLayoutOptions, type PdfModifier, type PdfName, type PdfParams, type PdfReader, type PdfRef, type PdfRgbString, type PdfRgbTuple, type PdfRow, type PdfSignOptions, type PdfStream, type PdfToken, type PdfTokenizer, type PdfValue, type QRErrorLevel, ROW_H, type RadioGroupContext, type RsaPrivateKey, type RsaPublicKey, type ShapedGlyph, type SigDictMetadata, type SignatureAlgorithm, type SpacerBlock, type StreamOptions, type SvgBlock, type SvgRenderOptions, type SvgSegment, TH_H, TITLE_LN, type TableBlock, type TextRun, type TocBlock, type TokenType, type UseCategory, type UseClassifiedCp, type UseCluster, WORKER_THRESHOLD, WORKER_TIMEOUT_MS, type WatermarkImage, type WatermarkOptions, type WatermarkState, type WatermarkText, type WorkerGenerationOptions, type WorkerInputMessage, type WorkerOutputMessage, type X509Certificate, type X509Name, type XrefEntry, type XrefTable, addSignaturePlaceholder, applyDecodeFilter, buildAcroFormDict, buildAppearanceStreamDict, buildCmsSignedData, buildDocumentPDF, buildDocumentPDFBytes, buildDocumentPDFStream, buildDocumentPDFStreamPageByPage, buildEmbeddedFiles, buildFormWidget, buildImageOperators, buildImageXObject, buildInternalLinkAnnotation, buildLinkAnnotation, buildPDF, buildPDFBytes, buildPDFStream, buildPDFStreamPageByPage, buildRadioGroupParent, buildSMaskXObject, buildSigDict, buildWatermarkState, chunkBinaryString, classifyClusters, classifyUseCategory, clearFontCache, computeColumnPositions, concatChunks, containsArabic, containsBengali, containsDevanagari, containsHebrew, containsRTL, containsTamil, containsThai, createEncodingContext, createModifier, createPDF, createTokenizer, decodeASCII85, decodeASCIIHex, decodeEcPublicKey, decodeLZW, decodeRunLength, defaultFieldHeight, derBitString, derDecode, derInteger, derOctetString, derOid, derSequence, detectCharLang, detectFallbackLangs, detectImageFormat, dictGet, dictGetArray, dictGetDict, dictGetName, dictGetNum, dictGetRef, downloadBlob, ean13CheckDigit, ecPublicKeyFromPrivate, ecdsaSign, ecdsaVerify, encodeCode128, encodeEcPublicKey, encodePDF417, encodePdfTextString, estimateCmsSize, estimateContentsSize, findStartxref, generateDataMatrix, generatePDFInWorker, generatePDFMainThread, generateQR, getMaxInflateOutputSize, getRegisteredLangs, getTrailerRef, getTrailerValue, hasFontLoader, helveticaBoldWidth, helveticaWidth, hmacSha256, inflateSync, initCrypto, initNodeCompression, initNodeDecompression as initNodeDecompression_parser, isArmenianCodepoint, isArray, isBengaliCodepoint, isCyrillicCodepoint, isDevanagariCodepoint, isDict, isGeorgianCodepoint, isLinkAnnotation, isName, isRef, isSelfSigned, isStream, isTamilCodepoint, isValidPdfRgb, loadFontData, nameValue, needsUnicodeFont, normalizeBidiEmbeddings, normalizeColors, openPdf, parseCertificate, parseColor, parseImage, parseIndirectObject, parseJPEG, parsePNG, parseRsaPrivateKey, parseRsaPublicKey, parseSvgPath, parseValue, parseXrefTable, pdfString, registerFont, registerFonts, renderBarcode, renderCode128, renderDataMatrix, renderEAN13, renderPDF417, renderQR, renderSvg, resetFontRegistry, resolveBidiRuns, resolveLayout, resolvePdfAConfig, resolveTemplate, rsaSign, rsaSignHash, rsaVerify, rsaVerifyHash, setDeflateImpl, setInflateImpl, setMaxInflateOutputSize, sha384, sha512, shapeArabicText, shapeBengaliText, shapeDevanagariText, shapeTamilText, shapeThaiText, signPdfBytes, slugify, splitTextByFont, streamByteLength, stripBidiControls, toBytes, toWinAnsi, truncate, truncateToWidth, validateAttachments, validateDocumentStreamable, validateTableStreamable, validateURL, validateWatermark, verifyCertSignature, wrapText };
+export { type AddSignaturePlaceholderOptions, type Annotation, type Asn1Node, BAL_H, type BarcodeBlock, type BarcodeFormat, type BidiRun, type CellBorders, type CmsSignOptions, type ColorGlyph, type ColorGlyphForm, type ColorLayer, type ColorPaint, type ColorStop, type ColumnDef, type Contour, type CpalColor, type CryptoProvider, DEFAULT_COLORS, DEFAULT_COLUMNS, DEFAULT_CW, DEFAULT_FONT_SIZES, DEFAULT_MARGINS, DEFAULT_MAX_BLOCKS, DEFAULT_MAX_INFLATE_OUTPUT, type DocumentBlock, type DocumentMetadata, type DocumentParams, type EcPrivateKey, type EcPublicKey, type EmbeddedFilesResult, type EncodingContext, type EncryptionOptions, FT_H, type FontData, type FontEntry, type FontLoader, type FontMetrics, type FontRun, type FontValidationResult, type FormField, type FormFieldBlock, type FormFieldType, type FormWidgetResult, type GlyfFont, type GradientExtend, HEADER_H, type HeadingBlock, INFO_LN, type ImageBlock, type InternalLink, KNOWN_DECODE_FILTERS, type LinearGradientPaint, type LinkAnnotation, type LinkBlock, type ListBlock, type ListItem, MAX_PARSE_DEPTH, MAX_XREF_CHAIN, type MergeOptions, type OutlineItem, type OutlinePoint, type OutlineProvider, PAGE_SIZES, PDF_A_CONFORMANCE_TARGETS, PG_H, PG_W, type PageBreakBlock, type PageLabelRange, type PageLabelStyle, type PageRange, type PageTemplate, type ParagraphBlock, type PdfArray as ParsedArray, type PdfDict as ParsedDict, type ParsedImage, type PdfAConfig, type PdfAConformanceTarget, type PdfAttachment, type PdfAttachmentRelationship, type PdfColor, type PdfColors, type PdfIndirectObject, type PdfInfoItem, type PdfLayoutOptions, type PdfModifier, type PdfName, type PdfParams, type PdfReader, type PdfRef, type PdfRgbString, type PdfRgbTuple, type PdfRow, type PdfSignOptions, type PdfStream, type PdfToken, type PdfTokenizer, type PdfUAValidationResult, type PdfValue, type QRErrorLevel, ROW_H, type RadialGradientPaint, type RadioGroupContext, type RsaPrivateKey, type RsaPublicKey, type ShapedGlyph, type SigDictMetadata, type SignatureAlgorithm, type SolidPaint, type SpacerBlock, type StreamOptions, type StreamToFileResult, type SvgBlock, type SvgRenderOptions, type SvgSegment, TH_H, TITLE_LN, type TableBlock, type TextRun, type TocBlock, type TokenType, type UseCategory, type UseClassifiedCp, type UseCluster, type ViewerPreferences, WORKER_THRESHOLD, WORKER_TIMEOUT_MS, type WatermarkImage, type WatermarkOptions, type WatermarkState, type WatermarkText, type WorkerGenerationOptions, type WorkerInputMessage, type WorkerOutputMessage, type X509Certificate, type X509Name, type XrefEntry, type XrefTable, addSignaturePlaceholder, applyDecodeFilter, buildAcroFormDict, buildAppearanceStreamDict, buildCmsSignedData, buildDocumentPDF, buildDocumentPDFBytes, buildDocumentPDFStream, buildDocumentPDFStreamPageByPage, buildDocumentPDFStreamTrue, buildEmbeddedFiles, buildFormWidget, buildImageOperators, buildImageXObject, buildInternalLinkAnnotation, buildLinkAnnotation, buildPDF, buildPDFBytes, buildPDFStream, buildPDFStreamPageByPage, buildPDFStreamTrue, buildRadioGroupParent, buildSMaskXObject, buildSigDict, buildWatermarkState, chunkBinaryString, classifyClusters, classifyUseCategory, clearFontCache, computeColumnPositions, concatChunks, containsArabic, containsBengali, containsDevanagari, containsEthiopic, containsHebrew, containsKhmer, containsMyanmar, containsRTL, containsSinhala, containsTamil, containsTelugu, containsThai, containsTibetan, contoursToPath, createEncodingContext, createModifier, createPDF, createTokenizer, decodeASCII85, decodeASCIIHex, decodeEcPublicKey, decodeLZW, decodeRunLength, defaultFieldHeight, derBitString, derDecode, derInteger, derOctetString, derOid, derSequence, detectCharLang, detectFallbackLangs, detectImageFormat, dictGet, dictGetArray, dictGetDict, dictGetName, dictGetNum, dictGetRef, downloadBlob, ean13CheckDigit, ecPublicKeyFromPrivate, ecdsaSign, ecdsaVerify, encodeCode128, encodeEcPublicKey, encodePDF417, encodePdfTextString, estimateCmsSize, estimateContentsSize, extractGlyphContours, extractPages, findStartxref, generateDataMatrix, generatePDFInWorker, generatePDFMainThread, generateQR, getCryptoProvider, getMaxInflateOutputSize, getRegisteredLangs, getTrailerRef, getTrailerValue, hasFontLoader, helveticaBoldWidth, helveticaWidth, hmacSha256, inflateSync, initCrypto, initNodeCompression, initNodeDecompression as initNodeDecompression_parser, isArmenianCodepoint, isArray, isBengaliCodepoint, isCyrillicCodepoint, isDevanagariCodepoint, isDict, isEthiopicCodepoint, isGeorgianCodepoint, isKhmerCodepoint, isLinkAnnotation, isMyanmarCodepoint, isName, isRef, isSelfSigned, isSinhalaCodepoint, isStream, isTamilCodepoint, isTeluguCodepoint, isTibetanCodepoint, isValidPdfRgb, loadFontData, mergePdfs, nameValue, needsUnicodeFont, normalizeBidiEmbeddings, normalizeColors, openPdf, parseCertificate, parseColor, parseColrCpal, parseCpal, parseGlyfFont, parseImage, parseIndirectObject, parseJPEG, parsePNG, parseRsaPrivateKey, parseRsaPublicKey, parseSvgPath, parseValue, parseXrefTable, pdfString, registerFont, registerFonts, renderBarcode, renderCode128, renderColorGlyph, renderDataMatrix, renderEAN13, renderPDF417, renderQR, renderSvg, resetFontRegistry, resolveBidiRuns, resolveLayout, resolvePdfAConfig, resolveTemplate, rsaSign, rsaSignHash, rsaVerify, rsaVerifyHash, setCryptoProvider, setDeflateImpl, setInflateImpl, setMaxInflateOutputSize, sha384, sha512, shapeArabicText, shapeBengaliText, shapeDevanagariText, shapeKhmerText, shapeMyanmarText, shapeSinhalaText, shapeTamilText, shapeTeluguText, shapeThaiText, shapeTibetanText, signPdfBytes, slugify, splitPdf, splitTextByFont, streamByteLength, streamToFile, stripBidiControls, toBytes, toWinAnsi, truncate, truncateToWidth, validateAttachments, validateDocumentStreamable, validateFontData, validatePdfUA, validateTableStreamable, validateURL, validateWatermark, verifyCertSignature, wrapText };