#783 by @bobsingor – Add a production Helm chart with validated SQLite and Postgres profiles, safety gates, smoke and crash drills, and OCI publishing tied to the server package version. Add Prometheus metrics, drain-aware bounded shutdown and readiness, serialized Postgres migrations, and fail-fast worker supervision.

Add opt-in supervised engine-host process isolation with generation-fenced recovery, crash journaling, document quarantine enforcement, engine health reporting, and audited quarantine CLI commands. Repeated engine crashers can be observed or rejected with DocumentQuarantined, while native host crashes restart the engine without terminating the API server.

Encode page renders, annotation appearances, and warm thumbnails inside engine workers by default so compressed images cross the engine boundary, with a temporary API-side encoding fallback. Add bounded interactive and background scheduling, per-host memory telemetry, controlled engine recycling, and deterministic engine sharding with per-shard readiness and metrics.

Add POST /v1/docs/:docId/access as the document-scoped access endpoint while retaining POST /v1/access as a transitional alias. Head responses advertise the scoped endpoint, and path/body document ID mismatches are rejected. Allow the optional X-CloudPDF-Doc affinity header through CORS and expose retry and image metadata response headers to browser clients.

#783 by @bobsingor – Add the *.renderEncoded wire kinds (pages.renderEncoded, document.renderPageFileEncoded, annotations.renderAppearancesEncoded) plus their RenderEncode / EncodedImageWire shapes — cloud-server surface (types only): the raster is encoded where it is produced and only the compressed image crosses the engine boundary.

Make document access endpoints document-scoped by changing wirePaths.access to a wirePaths.access(docId) builder. Keep wirePaths.accessLegacy for transitional clients and allow the scoped endpoint to omit docId from the request body.

#776 by @bobsingor – Refactor SelectionHandles to use the shared selection and web primitives so handles align correctly with rotated text and rotated pages.

#777 by @bobsingor – Give every Stage lens and standalone PageView a stable view identity and use its scoped tile handle. Thumbnail and secondary views can no longer clear the main view's high-resolution tiles.

#775 by @bobsingor – Add shared browser Stage surface and touch gesture controllers with lens-scoped input, pan, pinch, fling, double-tap, long-press, and wheel handling. Export vibration and native-shell feedback providers.

#776 by @bobsingor – Add a shared native DOM binding for selection-handle drags that shields Stage gestures and handles pointer capture and client-delta tracking.

• An empty JSON body now parses as no body rather than FST_ERR_CTP_EMPTY_JSON_BODY — the shape the generated PHP, Go, and Ruby SDKs (and clients with default JSON headers) send for bodyless calls such as document delete. Non-empty bodies still go through Fastify's default parser, keeping its prototype-poisoning protection, and routes that require a body still reject its absence with a 400.
• The error handler now honors Fastify's statusCode on framework errors, so parser and payload rejections (empty or malformed JSON, body limits) surface as the 4xx client errors they are instead of being logged and returned as "unhandled error" 500s.

#766 by @bobsingor – Extend documents.importFrom with mode: "async". Async requests accept operator-registered connection sources and return 202 with tag: "accepted" and a pending document that callers can poll with GET /documents/:id; presigned URL sources remain synchronous.

#766 by @bobsingor – Add the provider-neutral connection source to documents.importFrom. Requests identify an operator-registered connection and object key, plus an optional opaque provider-specific revision, without exposing storage-provider configuration or credentials in the public wire contract.

#766 by @bobsingor – Add the documents.importFrom operation for importing a PDF from a caller-supplied URL. The request supports optional size and SHA-256 integrity pins, metadata, deduplication, and idempotency fields, while responses distinguish completed imports from validation, authorization, conflict, and upstream transport failures.

#766 by @bobsingor – Rename the contract operation from documents.import to documents.importFrom so generated Java, Python, and Ruby SDKs expose a consistent method name. The HTTP path remains POST /v1/tenants/{tenantId}/documents/import. The OpenAPI emitter now rejects group or method segments that collide with reserved words in those target languages.

#766 by @bobsingor – Add durable asynchronous document imports backed by the document_imports job table and an in-process worker with one claim loop per replica. Document and job creation is atomic, lease-token-fenced transitions prevent stale workers from overwriting replacements, reconcile-on-claim avoids duplicate transfers after crashes, and exhausted retries fail the document and clean destination bytes. Retries stay pinned to one content identity, filesystem sources require expected.sha256, and queued or running imports are protected from the stale-pending sweeper. Migration 027 stores the re-drivable source descriptor in source_json.

#766 by @bobsingor – Add operator-registered import connections through CLOUDPDF_IMPORT_CONNECTIONS for S3 and S3-compatible stores, GCS, Azure Blob, and filesystem roots. Connections enforce credential classes, tenant allowlists, scoped prefixes or tenant-bound key templates, provider-specific revision pinning, and fail-closed authorization. Canonical backend fingerprints reject self-imports, and each import records sanitized source provenance and outcome in the new document_imports table from migration 026. A shared conformance suite keeps URL and connection adapters aligned on source-opening behavior.

#766 by @bobsingor – Implement server-side PDF imports from caller-supplied URLs through the existing document lifecycle. Deployment policy controls size, timeout, concurrency, HTTPS, and public-network requirements; URL handling blocks private and metadata addresses with DNS pinning, rejects redirects, and requires Content-Length. Imports enforce optional size and SHA-256 pins, sanitize failures so URL secrets do not leak, leave documents pending after retryable transport failures, and add the pull upload kind in migration 025.

#766 by @bobsingor – Mount the document import handler under the renamed documents.importFrom contract operation and align the server's import policy and lifecycle terminology. The HTTP route and runtime behavior remain unchanged.

#766 by @bobsingor – Cloud ObjectStore adapters (S3, GCS, Azure Blob) now truly stream put bodies: a Readable is hashed and length-enforced as it flows (constant memory) instead of being buffered whole. Under- or over-delivery aborts before a visible object can appear, any prior object at the key survives a failed attempt, and the SHA-256 metadata is attached post-stream (S3 via a same-key server-side copy). FsObjectStore now cleans up its .partial file when the source stream errors mid-put.

#768 by @bobsingor – Consolidate base-page and deep-zoom tile painting into RenderLayer, with a tiles option for lenses that explicitly disable tiling. The separate TileLayer surface is removed because tile engagement is now render-policy arithmetic owned by RenderLayer.

Tiles are positioned directly in view-pixel space and use the shared painted-image lifecycle, keeping retained coverage until replacements have a presentation opportunity and avoiding deep-zoom rounding drift, incomplete-image outlines, and transient seams.

#768 by @bobsingor – Add a configurable render strategy for exact and lattice-backed deployments, with separate full-page and tile-plane budgets, format conformance, settled level selection, and public paint settings.

Deep-zoom tiling now uses bled overlap, presentation-aware generation retention, bounded fetch backpressure and raster residency, stage-less demand limits, stronger raster identities, failure isolation, and optional diagnostics. These changes keep tile memory bounded while preventing stale reuse, visible seams, and quality regressions during zoom and pan transitions.

• The share arm exchanges shr_… for a session JWT on the engine's own transport (baseUrl + configured fetch) and delegates to the token arm, so the handle binds to a self-renewing source — revoking or editing the share retargets the open at the next renewal. Works on an engine constructed with no engine-level token at all.
• Exchange failures surface as EngineErrors — on open() and on every later renewal (RPCs, SSE reconnects) — never as raw ShareExchangeErrors. Protected grants reject with the new EngineErrorCode.SharePasswordRequired; the wire code and HTTP status ride in details, the original error in cause. The mapping is exported as engineErrorFromShareExchange.
• shareSessionSource now declares its concrete return type (() => Promise<string>) instead of the TokenSource union; HttpClient exposes baseUrl and fetchImpl getters.

• { kind: 'share' } is a standard OpenInput kind now, resolved by engine.open() itself — resolveCloudConfig no longer lowers share entries into token sources, and no longer re-threads baseUrl/fetch into the exchange.
• BREAKING (prerelease line): on share sources the grant passphrase field is sharePassword (was password, which now means the PDF's own encryption password — the same slot every other kind uses). The top-level shareToken/sharePassword shorthands are unchanged.
• CloudShareSource and CloudInitialDocument remain as deprecated aliases of OpenInputShare and InitialDocument.

#755 by @bobsingor – Model carets anchored to rotated text as oriented box geometry.

• Add caretGeomFromAnchor, which places the caret at the trailing glyph edge and derives its authoring rotation from the text baseline while preserving the previous byte-identical upright geometry.
• Carry optional rotation on caret geometry, apply it to local-frame hit testing, and expose an oriented selection outline without enabling caret rotate or resize gestures.

#755 by @bobsingor – Models text-markup annotations with semantic text quads and adds oriented caret anchors, allowing highlight, underline, strikeout, squiggly, caret, and replace-text geometry to follow the selected text frame.

#755 by @bobsingor – Add the canonical affine-aware text layout engine under text/layout: buildPageTextLayout, textGlyphAt, expandTextRangeToWord/Line, textGlyphQuad, and textSegmentsForRange, producing PdfTextSegment { quad, rect, advance }.

Orientation frames are derived from the semantic edges of glyph quads and keyed by baseline direction and ascent handedness. Rotated and mirrored text become upright inside their frame, while shear remains an in-frame variation so mixed roman and italic text stays in one segment. Every run in a cluster uses the same canonical frame, and upright documents retain a byte-identical fast path.

#755 by @bobsingor – Extend the caret annotation contract with box-family rotation metadata.

Caret DTOs, drafts, patches, and schemas now carry optional rotation and unrotatedRect fields with the same tri-state semantics as other box-family annotations. Rotation-stripped appearance documentation now includes carets.

#749 by @bobsingor – Adds share to the OpenInput union and a SharePasswordRequired engine error code.

• OpenInputShare ({ kind: 'share', shareToken, sharePassword?, password? }) is the third cloud reference form, alongside id and token: a public share token from the dashboard's embed snippet, resolved by the cloud engine itself. Rejected by @embedpdf/engine, like the other cloud kinds.
• sharePassword is the grant's passphrase (checked at exchange); password stays the PDF's own encryption password, same slot as every other kind.
• EngineErrorCode.SharePasswordRequired is the prompt-and-retry signal for protected grants — the share sibling of DocPasswordRequired.

#755 by @bobsingor – Extends page geometry snapshots with an upright/rotated run union, oriented glyph cells, rotation and ascent-flip metadata, uniform quad and bounds helpers, wire schemas, and orientation conformance coverage.

#755 by @bobsingor – Generate rotated caret appearances in the EmbedPDF PDFium runtime.

The caret appearance generator now consumes the shared rotation metadata pair, draws in the logical unrotated box, and emits the form transform needed for the baked caret to follow its text baseline.

#755 by @bobsingor – Updates the EmbedPDF PDFium runtime with oriented per-character geometry and orientation-aware text-markup appearance generation for rotated, sheared, and mirrored text, while retaining safe fallbacks for malformed quads.

#755 by @bobsingor – Replace the parallel rects[] and quads[] geometry on SearchMatch with canonical segments: PdfTextSegment[], validated by PdfTextSegmentSchema.

Search tokens now always encode format=segments1, preventing newer clients from consuming stale CDN-cached responses with the old geometry shape; old tokens fail decoding instead.

#755 by @bobsingor – Persist and render caret rotation through the engine annotation services.

• Read and write the caret rotation and unrotatedRect metadata pair during create, patch, and list operations.
• Treat caret subtype 14 as box-family when rendering annotation appearances, returning a rotation-stripped raster placed by the logical box so consumers do not double-rotate it after reload.

#755 by @bobsingor – Reads boxes, oriented cells, flags, and text orientation through the new runtime geometry call, preserving the compact upright wire shape while emitting rotated runs for non-upright glyphs. Native page-redaction failures are now reported instead of being mistaken for pages without redaction annotations.

#755 by @bobsingor – Render search and selection highlights from canonical text segments. Axis-aligned lines retain their classic appearance, while rotated lines render their true oriented cells.

#755 by @bobsingor – Render live caret annotations with their text-baseline rotation.

The React annotation painter now treats caret SVGs as box-family visuals, applying the caret's authoring rotation about its centre while continuing to leave vertex-geometry rotation advisory.

#755 by @bobsingor – Round-trip rotated caret geometry through the annotation repository.

Rotated carets now lower their logical box and content-space tilt into /Rect, rotation, and unrotatedRect, and reconstruct that geometry when engine annotations are ingested. Upright writes explicitly clear stale transform metadata.

#755 by @bobsingor – Creates, previews, imports, and persists text-markup annotations with oriented quads and places caret and replace-text annotations at the selected glyph's trailing edge.

#755 by @bobsingor – Use the engine's canonical text segmentation while keeping selection gestures and state in the plugin coordinate seam.

SelectionSnapshot.pages now carries segments only, with boxes exposed as derived views through segment.rect and rectsForPage(). Public geometry exports are now buildSelectionPageGeometry, contentPointToPdf, toContentSegment, and toContentTextQuad.

#755 by @bobsingor – Builds selections as oriented line segments, exposes their semantic quads and reading direction, and anchors selection endpoints to glyph cells while retaining AABB access for scrolling and conservative regions.

#748 by @bobsingor – Derives the connected usage-reporting credential from the license key, so a connected deployment is configured with CLOUDPDF_LICENSE_KEY alone.

• Computes the reporting credential as cpr_v1_ + base64url(HMAC-SHA256) over a domain-separated message that binds the signed cloudpdfLicenseId license metadata, so the wire credential is one-way (it can never reveal the license key) and never authenticates another license record.
• Retires CLOUDPDF_LICENSE_REPORTING_TOKEN. A deployment that still sets it boots normally; the variable is ignored and the server logs a warning asking for its removal.
• Existing connected deployments upgrade by removing the retired variable. During the coordinated verifier cutover on the CloudPDF side a usage report may answer 401; reports retry every five minutes with cumulative counters, so no usage is lost and license validation is unaffected.
• Air-gapped deployments are unchanged and continue to send no telemetry.
• Pins fixed cross-runtime derivation test vectors shared with the CloudPDF control plane.

#746 by @bobsingor – Fixes presigned-upload materialization and makes commit-time sha verification single-read and constant-memory.

• Fixes the range materializer crashing with EBADF whenever an object carried no SHA metadata — the shape of every presigned browser upload. The failure was silent: commits still reached ready while the security probe recorded unknown and thumbnail warming recorded failed. The hash fallback now closes the write-only handle and streams the finished partial from disk, guards against short positional writes, and rejects a metadata/expected-sha disagreement before paying for the download.
• Replaces the S3 and FS getSha256 fallbacks that buffered whole objects in RAM with streaming hashes — constant memory regardless of document size.
• Commit now verifies uploaded bytes with a single object-store read when a base-file cache is wired (DocumentLifecycleOptions.fileCache): the upload is materialized into the cache, hashed on the way down, and reused by the security probe instead of being downloaded a second time. LocalFileHandle.sourceKey reports which object key materialized a content-addressed entry, so a cross-key cache hit still triggers a direct verification of the committing document's own object.
• Adds a typed ShaMismatchError (exported) thrown by all materializeLocal implementations, letting callers distinguish declared-hash mismatches from retryable transport failures.
• Surfaces previously swallowed failures: DocumentSecurityProbeOptions.onError, DerivedRenderServiceOptions.onWarmError, and base-file-cache materialize-error events are now wired to the server log.

#730 by @bobsingor – Adds the share-grant contract: standing, revocable authorization decisions that let a document be embedded with no backend.

• Defines shares.create, shares.list, shares.get, shares.update, and shares.delete under /v1/tenants/:tenantId/shares, governed by the new shares.manage tenant scope.
• Defines shares.exchange at POST /v1/share-sessions, the contract's only unauthenticated operation: the grant row is the authorization, so a public share token trades for a short-lived document session JWT. The registry test now pins that surface, making any future credential-less operation an explicit decision.
• Adds an optional origins allowlist to document-token issuance, so a minted token can be restricted to named web origins.
• Adds tenants.usage for per-tenant usage facts, plus tenants.suspend and tenants.resume for operator-controlled tenant suspension.
• Reports tenant status on tenant records and regenerates openapi.json, which now carries 44 operations.

#734 by @bobsingor – Adds the integrity-pinned init → transfer → commit document upload protocol, including presigned PUT and policy-controlled multipart proxy transfer modes.

• Adds exchangeShareToken, which trades a public share token for a short-lived document session, and ShareExchangeError, whose code names the outcome (SharePasswordRequired, OriginNotAllowed, ShareExpired, NotFound).
• Adds shareSessionSource, a caching token source that re-exchanges shortly before expiry and shares one in-flight exchange between concurrent callers. Because the transport resolves its token source on every request and on stream reconnect, renewal needs no timers and no listeners.
• Requires no change to open(): an exchanged session is an ordinary document-scoped JWT, so a share source feeds open({ kind: 'token' }) unchanged, and each open keeps its own credential.

#730 by @bobsingor – Implements share grants, origin locking, per-tenant usage, and tenant suspension.

• Stores share grants whose row id is the public share token, carrying document capabilities, an optional origin allowlist, an optional scrypt-hashed passphrase, a session TTL, and an optional expiry. Editing or deleting a grant retargets every embedded copy of its token at the next exchange.
• Serves the public POST /v1/share-sessions exchange, which validates origin, passphrase, expiry, disablement, and tenant suspension before minting a document session JWT. Unknown, revoked, disabled, and suspended grants answer alike so the existence of a grant is never disclosed, and the route carries its own per-IP and per-grant limiters rather than the authentication-failure budget.
• Enforces an optional origins claim on document tokens for every request that arrives with a browser Origin header, covering both share sessions and backend-minted tokens. Requests without the header are governed by the token itself.
• Adds CORS through CLOUDPDF_CORS_ORIGINS (* to reflect, or a comma-separated allowlist), which browser-direct deployments need. Bearer tokens remain the security boundary; per-credential origin locks carry the origin policy a server-wide list cannot express.
• Records per-tenant usage facts for views, uploads, and stored bytes, readable at GET /v1/tenants/:tenantId/usage. A view is a share exchange or an authorized /v1/access grant, counted once across the two. These counters hold no limits and are separate from license metering.
• Adds tenants.suspend and tenants.resume, which fail every tenant JWT, document JWT, and share exchange closed while leaving the root API token free to inspect, resume, or delete the tenant.
• Mounts token revocation from the CLI through CLOUDPDF_ENABLE_REVOCATION.
• Records share and suspension lifecycle events in the security-event trail, and adds matching SQLite and PostgreSQL migrations plus origin, passphrase, and end-to-end share coverage.

#734 by @bobsingor – Adds integrity-pinned uploads with presigned storage transfer preferred and a policy-controlled multipart proxy fallback.

Hardens filesystem-backed storage against path traversal, storage-root deletion, and recursive deletion through symbolic links.

• Adds the shareToken and sharePassword options for opening a single shared document.
• Adds a cloud { kind: 'share' } document source for documents, so a multi-tab viewer can mix share tokens, document tokens, and document ids. Each entry exchanges and renews independently, and revoking one share leaves the others untouched. The source is lowered to an ordinary token source before the engine-agnostic viewer core sees it.
• Re-exports exchangeShareToken, shareSessionSource, and ShareExchangeError so CDN-only consumers can build custom flows, such as prompting for a passphrase before mounting.

• Adds the shareToken and sharePassword props for rendering a shared document without a backend.
• Accepts cloud { kind: 'share' } entries in documents, so a multi-tab viewer can mix share tokens, document tokens, and document ids.

• Replaces the flat document client with cloud.tenant(tenantId), accepting exactly one root apiToken or delegated tenantToken credential.
• Adds tenant lifecycle APIs for creating, listing, iterating, retrieving, and deleting tenants.
• Adds tenant token APIs for issuing document or tenant JWTs and revoking them by jti.
• Adds keyset-paginated document listing, lifecycle-state filtering, and an async document iterator.
• Moves the SDK's shared schemas and route definitions to @cloudpdf/contract.

• Defines a typed operation registry and Zod request/response schemas for tenant administration, document lifecycle, token delegation, deployment status, and backend-callable document-plane operations.
• Exposes tenant-aware route builders and operation metadata shared by the admin SDK and server.
• Adds an OpenAPI 3.1 emitter, a packaged openapi entry point, and the generated openapi.json artifact.
• Validates operation IDs, route coverage, schema references, security declarations, and generated OpenAPI output with contract tests.

• Replaces the legacy flat admin routes with contract-backed /v1/tenants/:tenantId document, tenant, token, and deployment operations.
• Adds constant-time root API-token authentication alongside delegated tenant JWT authorization.
• Adds tenant lifecycle and provenance tracking, keyset pagination and state filtering, and cascade deletion for tenant-owned data.
• Adds document and tenant token issuance, revocation, and durable security-event auditing.
• Allows API tokens on document-plane routes and supports per-request X-Document-Password authorization through HMAC proofs or non-mutating checks against the canonical PDFium session, including credential-safe open singleflight behavior.
• Adds matching SQLite and PostgreSQL migrations plus expanded registry, authorization, password, and end-to-end coverage.

#685 by @simonmysun – Add setSelection(range, documentId?) to the selection capability and document scope for programmatically applying or restoring a text selection.

It accepts the same SelectionRangeX ({ start, end } glyph pointers) shape emitted by onSelectionChange, so a saved selection can be passed straight back in to restore it; passing null clears the selection. Page geometry is loaded on demand, so the returned task resolves only once the highlight rects are computed. The range is normalized (start/end may be given in any order), invalid input (malformed range, non-integer/negative indices, out-of-bounds pages) is rejected, glyph indices are clamped to the available page geometry, and previously highlighted pages are repainted so switching to a disjoint selection no longer leaves stale highlights behind.

#703 by @berkayozdin – Make the precompiled Svelte output work on every Svelte 5 runtime

Svelte 5.56 changed the exclude argument of the private rest_props runtime helper from an array (exclude.includes(key)) to a Set (exclude.has(key)). The */svelte entry points ship precompiled component code, so output built against one side of that change throws on the other: the currently published packages fail with TypeError: exclude.has is not a function on Svelte >= 5.56, which aborts the render of every EmbedPDF Svelte component.

The Svelte build now routes those calls through a wrapper that hands the runtime an exclude value satisfying both contracts, so one published build stays valid across the whole svelte: ">=5 <6" peer range.