#827 by @bobsingor – Expose page measurement calibration and viewport reads in the cloud engine, and deliver viewport change events with document version coherence.

#800 by @LazyCompiler – Cloud-backed search honours the ignoreWhitespace query flag, which travels inside the search token, and search cursors are pinned to it: replaying a cursor minted with the flag against a query without it (or vice versa) is rejected with InvalidArg, matching the local engine.

#827 by @bobsingor – Persist page measurement calibration in layer artifacts with authorization and audit events. Calibration advances the document version while retaining existing page cache versions and annotation scales.

#800 by @LazyCompiler – The layer search routes (/v1/docs/:docId/layers/:layerName/search/{rects,full}/data) accept ignoreWhitespace=true alongside the other query flags and forward it to the engine, so a cloud search for invoice finds a letter-spaced i n v o i c e. Combining it with regex=true is rejected with InvalidArg, and the flag is carried by the search tokens that page through results.

#827 by @bobsingor – Add distance drawing with separate endpoint and leader placement, four geometry handles, and directly draggable captions. Keep previews, hit testing, and selection bounds aligned, including short dimensions with outside arrows and displaced-label connectors. Measurement labels use the engine's PDF-coordinate rounding rules.

Rotate measurements around the center of their complete oriented selection frame, including leaders and displaced captions. Use the same frame for pointer rotation, quarter turns, reset, selection, and hit testing, keeping the center stable after a saved appearance is reloaded. Attach the rotation handle to the selection border without extra measurement-specific spacing.

Add perimeter and area creation through the existing polyline and polygon gestures, live labels, direct caption dragging, and complete selection bounds. Carry manual PDF-space caption centers through whole-shape transforms while vertex edits leave them fixed. Reject invalid area creation and vertex edits.

#827 by @bobsingor – Add measurement DTOs, page calibration contracts, and shared distance, perimeter, area, and number-format helpers. Caption positions use PDF coordinates and support partial updates and explicit resets.

Report invalid geometry for crossing, overlapping, or degenerate area boundaries while accepting either winding and an explicit closing vertex.

#800 by @LazyCompiler – Add the ignoreWhitespace flag to SearchQuery. A literal query folded with it drops whitespace on both sides instead of collapsing it, so invoice finds the letter-spaced i n v o i c e that OCR'd scans and tracked-out headings produce, and total amount finds totalamount. Hits still span the original text including the dropped whitespace, and wholeWord boundaries are checked on the original text. The flag is literal-only — validateSearchQuery rejects it together with regex (ignore-whitespace-with-regex) — and it round-trips through search tokens. foldText gains the matching dropWhitespace option, and the shared search conformance suite covers the flag.

#827 by @bobsingor – Read and write PDF measurement dictionaries and viewports, derive labels on geometry or scale edits, and preserve imported labels on style edits. Move manual shape captions with rigid geometry transforms and validate measurement input before native writes.

Avoid an additional full-document buffer copy when exporting a saved PDF.

#800 by @LazyCompiler – Local engines honour the ignoreWhitespace search flag: a query carrying it re-folds the cached page text with whitespace dropped, so invoice finds a letter-spaced i n v o i c e, and search cursors key on the flag so a resumed search never mixes hits from the two folds. Combining the flag with regex is rejected with InvalidArg.

#827 by @bobsingor – Add distance and calibration presets, point-based viewport scale selection, and per-annotation recalculation reports. Persist leader and caption edits in native PDF fields, preserve the measured endpoints during offset edits, and keep derived measurement values read-only in comments.

Use the standard selection spacing for measurement annotations.

Keep locally created and edited measurements vector-rendered after the engine saves their appearance, matching the existing annotation lifecycle and avoiding repeated switches to raster rendering.

Add area and perimeter presets with scale snapshots captured at the first vertex. Persist shape captions and derived values through ordinary annotation edits, retaining vector rendering after engine responses.

#827 by @bobsingor – Introduce page calibration, scale presets, units, precision, measurement readouts, and optional recalculation of existing annotations. Report partial results across pages and support session-only calibration on older engines.

Expose area unit choices and independent area-unit updates that preserve distance formatting.

#827 by @bobsingor – Add a Measure toolbar with distance drawing, a scale sidebar, and known-length calibration controls. Support Escape to cancel an unfinished drawing, with English and Spanish labels.

Use distinct calibration and scale-setting icons that inherit the viewer's theme and active-state colors.

Add Perimeter and Area tools, dynamic stroke-colored measurement icons across toolbar and cursor, separate area-unit controls, selected area/perimeter readouts, and a reset-label-position action.

#822 by @bobsingor – Fix text redaction when multiple regions intersect the same text object. Later regions no longer leave targeted text searchable or copyable in saved PDFs or remove neighboring text. Preserve the positions of remaining text, including vertical text, and leave text outside the redaction regions unchanged.

Remove stale ActualText, Alt, and E replacement text from affected marked content and structure ancestors, including unused inherited property resources. Keep unredacted uses of shared forms and properties intact, and correctly locate redactions inside transformed nested forms.

Backports the critical redaction fixes for #801 to the v2 WASM build.

#817 by @bobsingor – Expose structured FreeText rich text in OpenAPI annotation responses, including paragraph and run styles and custom font family names.

Update signature and version analysis response schemas with applicable restrictions, current-state findings, and information about later revisions and reverted objects.

#812 by @bobsingor – Add API contracts and OpenAPI schemas for preparing, completing, aborting, listing, and analyzing digital signatures. Add document version history, immutable version downloads, signed revision downloads, and signature contents and digest endpoints, with signing permissions and version conflict responses.

#812 by @bobsingor – Add doc.signatures for cloud-backed signature inspection, revision analysis, and two-phase signing. Read signed bytes from immutable document versions and refresh the manifest after preparing or completing a signature.

Support visual appearances on unsigned signature fields and publish their form update events.

#817 by @bobsingor – Add generated annotation response types for FreeText rich-text bodies, paragraphs, and styled runs, and allow custom font family names.

Expose restrictions, current-state findings, and later-revision details in the generated signature and version analysis response types.

#812 by @bobsingor – Add generated doc.signatures and doc.versions clients, request and response types, and package subpath exports. Support preparing, completing, and aborting signatures; reading signature facts and modification analysis; and downloading document versions, signed revisions, signature contents, and digests.

#812 by @bobsingor – Add durable two-phase digital signing with prepare, complete, abort, and expiry handling. Persist candidate data so completion can run on another replica, verify the supplied CMS, and reject completion when the document or layer has changed.

Publish each completed signature as an immutable document version while retaining the document ID and version history. Consume the signing layer's edits into the new base and refresh document state across replicas.

Add signature inspection and analysis routes, immutable version and revision downloads, and visual signature-field appearances. Use files and streaming storage transfers for signing candidates, with configurable temporary storage and signing expiry.

#817 by @bobsingor – Add pure helpers for normalizing rich-text runs, mapping text offsets, and reading or applying styles to a text range. Support rich-text updates and bold, italic, and underline properties in the annotation model while keeping plain contents synchronized.

Align FreeText and callout text insets, borders, and backgrounds with their PDF appearances.

#812 by @bobsingor – Introduce cryptographic signing and validation helpers for PDF digital signatures. Build, parse, and verify detached CMS signatures, validate certificate chains against application-provided trust anchors, and check a signer's response before completing a signature.

Provide WebCrypto and remote signer adapters, persistent personal signing identities, and signature verdicts that distinguish byte integrity, cryptographic validity, trust, and later document changes.

#812 by @bobsingor – Add digital signature and document version types, signing permissions, events, wire schemas, and the optional DocumentSignaturesService API. Support signature-field authoring and appearances, file-backed layer inputs, file downloads, and configurable session and signed-document policies.

Add revision change analysis and protection helpers that distinguish declared editing restrictions from the rules used to judge later modifications.

Prevent excessive processing time when decoding malformed base64 containing long runs of padding characters.

#817 by @bobsingor – Add rich-text document types and schemas for FreeText annotation reads, drafts, and patches, including paragraph settings and per-run style overrides. FreeText reads now include a rich-text representation even for plain text, and custom font keys are accepted in response schemas.

Add optional document font settings for embedding policy and typographic features, font identity and embedding-permission metadata, and explicit editing authorization for registered fonts.

#817 by @bobsingor – Support reading and authoring rich-text FreeText annotations through the local engine. Expose document-level font embedding and typographic settings through doc.fonts.

Return resolved font identities and embedding permissions from registration, and add engine.fonts.authorizeEditing() for applications authorized to edit with preview-and-print fonts.

#812 by @bobsingor – Add doc.signatures for signature inspection, revision analysis, and two-phase signing with externally supplied CMS data. Support signature-field creation and visual appearances, expose the saved document version, and update the same document handle after signing.

Open documents as immutable bases with editable layers by default, with sessionKind: 'plain' available for unsigned documents. Preserve the loaded bytes on unchanged incremental downloads and add Node file-backed layer opens and downloadToFile().

Enforce declared signature restrictions by default, distinguish them from modification verdicts, and expose signedDocumentPolicy for applications that need to permit invalidating edits.

#817 by @bobsingor – Add native and WASM APIs to read FreeText rich text as JSON, author it from JSON or XHTML, and generate appearances with multiple fonts, run styles, and text decorations.

Support CFF font resources, document-level embedding and typographic policies, variable-font instancing, and font embedding-permission enforcement. Preserve registered font identities in saved annotation resources and expose identity and editing-authorization APIs.

#812 by @bobsingor – Add native and WASM APIs for signature inspection, revision comparison, byte-range digests, incremental signing, and signature-field appearances.

Make incremental layer saves omit unchanged objects and detect reverted edits, including after reopening a layer. Add file-backed layer and overlay reads, share immutable stream data, and compare stream contents in chunks to reduce copying and memory use.

Fix signature appearance placement, make newly authored form widgets printable, and resolve named pages through the current layer view.

#820 by @bobsingor – Fix native and WASM text redaction when multiple regions intersect the same text object. Later regions no longer leave targeted text searchable or copyable in saved PDFs or remove neighboring text. Preserve the positions of remaining text, including vertical text.

Remove stale replacement and alternate text associated with redacted content, correct redaction inside transformed nested forms, and preserve unredacted uses of shared images and forms.

Fixes #801.

#817 by @bobsingor – Read and write FreeText rich-text documents through the shared annotation services, preserve registered font keys on readback, and reject mismatched plain and rich text before applying a mutation. Default-style changes preserve explicit run overrides, while plain-text replacement resets run formatting.

Carry font identity, editing authorization, and document font settings through the worker protocol.

#812 by @bobsingor – Add signature readers, revision and working-copy analysis, two-phase signing, and session-independent candidate finalization. Support signature-field creation and visual appearances, enforce declared document and field restrictions, and install completed signatures as new immutable bases.

Preserve loaded bytes for unchanged or reverted edits. Use file-backed candidates, layer artifacts, overlays, and streamed downloads for native file sessions to reduce memory use, while retaining buffer-based support for WASM sessions.

#812 by @bobsingor – Add the @embedpdf/react/signature entry point with hooks for signing, signature snapshots, validation verdicts, protection, target fields, events, and saved signature libraries.

Make signature widgets selectable for signing or inspection, and allow useStampLibraries() to filter libraries by kind. Use the stamp capability contract in signature hooks to preserve plugin dependency boundaries.

#817 by @bobsingor – Add a framework-independent rich-text editor binding with styled paragraph rendering, DOM serialization, selection mapping, formatting commands, and plain-text paste handling.

Export mountWebFont() to load font bytes for live editors and release shared font faces only after their last consumer unmounts.

#817 by @bobsingor – Add selection-aware rich-text editing for FreeText annotations. Font, size, color, bold, italic, and underline changes apply to selected text while editing, or to the annotation's default style otherwise.

Expose text-format commands and selection state, preserve styled runs through debounced writes, and map registered font families to the live editor's mounted fonts.

#812 by @bobsingor – Refresh widget appearances after visual signature fills and signing, and reload annotations when a new document version is published. Add box styling for signature widgets and expose annotation interaction priorities and the armed-stamp tool ID for cooperating plugins.

#812 by @bobsingor – Introduce a headless signature plugin with digital signing, visual-only filling, and application-controlled confirmation modes. Place marks into signature fields or as free stamps, support certification and field locks, and configure external signers and trust anchors.

Expose signature snapshots, validation verdicts, document protection, signed revision downloads, and events for signing, inspection, and edits that would invalidate a signature. Reuse stamp libraries for signature and initials artwork.

#817 by @bobsingor – Add bold, italic, and underline controls to the FreeText style panel while preserving the active text selection.

Support annotations.fonts for additional font choices. Fonts are fetched, registered with the engine, and mounted for the live editor before appearing in the picker, so editing and PDF output use the same font bytes.

#812 by @bobsingor – Add signature and initials libraries with drawn, typed, and imported artwork, plus signature-field authoring, signing dialogs, and visual-only filling. Configure signers, trust anchors, certification options, and signing modes.

Add signature inspection with validation details, signed revision downloads, and notices when pending edits would invalidate a signature. Support filtering the stamps sidebar by library kind and showing quick-access stamps in the toolbar.

#817 by @bobsingor – Expose AnnotationFontSpec and AnnotationsCustomization through the viewer entry points so applications can configure additional FreeText fonts with annotations.fonts.

#812 by @bobsingor – Expose SignatureToken, signer adapters, personal key stores, and signature customization types through the viewer's core entry point so applications can configure and control signing from the viewer package.

#803 by @bobsingor – The default stamp libraries are now self-describing, Acrobat-compatible PDFs. Each <locale>/stamps.pdf carries its name as /Title, registers every page in /Names /Pages as identifier=label (Approved=Goedgekeurd), and records the library id (embedpdf-standard), the locale, and each stamp's kind in /PieceInfo. Import one with importLibraryPdf from @embedpdf/plugin-stamp and the title, identifiers, and labels come from the file; drop the same file into Acrobat's Stamps folder and it appears there. The artwork is unchanged from the previous release (every page renders pixel-identical). Locales: en, de, nl, fr, es, zh-CN, sv, ja. A new @embedpdf/default-stamps/library entry delivers each locale through the module graph: loadDefaultLibrary(locale) resolves to the library's bytes from a generated, lazily imported module, so the library ships as a chunk of your own build with nothing to copy and no CDN. LOCALES lists the shipped codes.

The legacy <locale>/manifest.json files remain available for existing v2 viewers that load this package from an unversioned CDN URL. They preserve v2's library and stamp ids, categories, labels, and page indexes, and point to the same adjacent stamps.pdf files. V3 reads the PDF metadata directly and does not load these manifests.

#803 by @bobsingor – Add doc.annotations.flatten and doc.annotations.exportAppearance to the public contract.

Add doc.pages.setName and doc.pages.removeName for registering, renaming, and removing named pages (/Names /Pages entries) on a layer.

#803 by @bobsingor – The cloud engine implements page(pon).annotations.flatten over POST …/annotations/pages/{pon}/items/flatten (content and annotation planes patched in place, annotations.flattened published) and page(pon).annotations.exportAppearance over POST …/items/appearance (PDF bytes; a read).

It also implements pages.setName and pages.removeName over POST …/pages/names and POST …/pages/names/delete. Both advance only docVersion and layoutVersion, so the cached manifest is patched in place, per-page render/text/annotation leaves stay valid, and the result carries the fresh layout including namedPages.

#803 by @bobsingor – Add POST /v1/docs/{docId}/layers/{layerName}/annotations/pages/{pon}/items/flatten (flatten a chosen set of the page's annotations; gated like page flatten and persisted the same way — one page's content and annotation versions advance) and POST …/items/appearance (the chosen annotations' appearances as one single-page PDF; gated by doc.download, no-store).

Add POST /v1/docs/{docId}/layers/{layerName}/pages/names and POST …/pages/names/delete to register, rename, or remove a /Names /Pages entry on a layer. Both are page-structure mutations gated by doc.pages.assemble: the worker writes a new layer artifact and the doc and layout versions advance, exactly like a page move, with no new resource, version, or cache scope. /layout responses now include namedPages.

#803 by @bobsingor – Selective annotation flatten and appearance export. page(pon).annotations.flatten(refs, usage?) is pages.flatten for a chosen set: painted annotations are removed from the page, ineligible ones (hidden for the usage, popups, no appearance) stay and report skipped, and the result (AnnotationFlattenResult) carries that page's new pins plus an annotations.flattened event. page(pon).annotations.exportAppearance(refs) returns the chosen annotations' normal appearances as one single-page PDF sized to their union rect — vector, positions preserved, the source untouched; all-or-nothing. Both are optional service members; runAnnotationFlattenConformance and runAnnotationAppearanceExportConformance lock the shared behavior.

Named pages join the page list. PageListSnapshot.namedPages carries the catalog's /Names /Pages and /Names /Templates registrations in tree order — NamedPageEntry is the decoded key plus a target classified as page (a page in pages), template (a hidden /Type /Template page that is never listed or rendered), or dangling. Because a registration only means something against the page set that contains its target, it is layout data like label and shares the layout version rather than a plane of its own.

DocumentPagesService gains two optional page-structure mutations: setName({ name, pageObjectNumber, replace? }) registers a key, replaces what an existing key points at, or renames in one job; removeName({ name }) drops a registration and keeps the page. Both return the fresh layout as PageNameResult (layout plus the docVersion/layoutVersion pins) and publish a pages.named event. Deleting a page removes every registration pointing at it. runNamedPagesConformance locks these invariants for every engine. The engine never interprets key text.

Stamp /Name accepts any non-empty name — a standard stamp name or a custom identifier such as an Acrobat library's #… key — and a stamp patch may clear it with name: null.

#803 by @bobsingor – The local engine implements page(pon).annotations.flatten (gated like pages.flatten, publishes annotations.flattened) and page(pon).annotations.exportAppearance (gated by doc.download like pages.extract).

It also implements pages.setName and pages.removeName: register, rename, or remove a /Names /Pages entry as a page-structure mutation gated by doc.pages.assemble, with the fresh layout returned and a pages.named event published. pages.list() includes namedPages.

The local engine never contacts a CDN. The zero-config default is the embedpdf.wasm your bundler emits beside your code (@embedpdf/engine-runtime-wasm32/wasm-url, which webpack, Vite, Rspack, Parcel, and Turbopack all resolve), and it is now streamed and compiled by the worker as it downloads — the previous fetch-then-fallback path had given up streaming. When a toolchain cannot carry that asset (Angular's application builder, plain esbuild), boot fails with the fix named instead of silently fetching a possibly mismatched binary from jsDelivr: DEFAULT_WASM_URL and the fetch-failure fallback are gone.

New @embedpdf/engine/portable: the same localEngine() with the wasm delivered through the module graph — a lazy chunk of your own build, gzipped and inflated in the browser — so it works with every bundler at the same cost over the wire, with no asset to copy. wasmLoader joins wasmUrl, assetsUrl, and wasmBinary as an explicit source (bytes produced on demand at boot). Explicit sources never fall back.

Angular needs neither: the package's export map routes the es2020 condition Angular's application builder resolves with to the portable build, so the plain @embedpdf/engine import is zero-config under Angular too. Other bundlers do not declare that condition and keep the streamed asset.

#803 by @bobsingor – EPDFPage_FlattenAnnotations flattens a chosen set of a page's annotations with a per-entry status (applied, skipped, not-on-page), replacing the single-annotation EPDFAnnot_Flatten. EPDFPage_ExportAnnotationsAsDocument flattens a set's appearances into a new single-page document sized to their union rect, replacing EPDFAnnot_ExportAppearanceAsDocument and EPDFAnnot_ExportMultipleAppearancesAsDocument, which mishandled rotated appearances and the rect fit. Whole-page flatten, selective flatten, and export now share one candidate plan and one placement writer (ISO 32000-2 12.5.5 fit, /Matrix honored, no content re-parsing); resources shared between exported appearances are cloned once.

New named-page functions: EPDFDoc_GetNamedPageCount, EPDFDoc_GetNamedPageAt (key as UTF-16 plus the value's object number and kind: page, template, or dangling), EPDFDoc_SetNamedPage (create or replace, pages in the page tree only), EPDFDoc_RemoveNamedPage, and EPDFDoc_RemoveNamedPagesForPage. EPDFDoc_DeletePageByObjectNumber now removes the /Names /Pages registrations of the page it deletes. The name-tree index search reports a pair whose value is a missing object (with a null value) instead of hiding it and desynchronizing later indices.

Annotation /Name is text: EPDFAnnot_SetName takes any name, writes a name object (escaping applied by the serializer), and never touches /AP; EPDFAnnot_GetName fills a text buffer. The FPDF_ANNOT_NAME enum, its subtype validation, and the sentinel that removed /Name together with /AP are removed — remove /Name with EPDFAnnot_RemoveKey(annot, "Name").

#803 by @bobsingor – New annotations.flatten and annotations.exportAppearance worker jobs over the runtime's set-based flatten: resolve refs on the page, hand the set to one candidate plan, and either paint in place (bumping that page's revision and weak-annotation state like a page flatten) or into a scratch document returned as PDF bytes.

Every page list now includes the catalog's named-page registrations (namedPages), read from the runtime with each value classified as page, template, or dangling. New pages.setName and pages.removeName worker jobs register, rename, or remove /Names /Pages entries and return the fresh layout; page deletion drops the registrations that pointed at the page.

Annotation /Name is written and read as text: note and file-attachment icons map their ids to PDF names, stamps accept any non-empty name (standard or custom) and report custom names verbatim instead of collapsing them, and a stamp patch with name: null removes the entry without touching the appearance.

#803 by @bobsingor – Stamps can be placed without the pointer and ghosted at any zoom. placeStamp(input, placement) creates a stamp annotation by code — the same validation, fit, page clamp, /Name, and /Subj a click after armStamp produces — and resolves to the new annotation's ref; StampPlacement names the page, the anchor point, an optional width, and rotation. StampToolInput gains name (the placed /Name) and subject (the placed /Subj), and its preview now also accepts a StampPreviewProvider: a function the hover ghost asks for a render at the device pixel width it is displayed at. Requests are bucketed to powers of two (previewBucket) and cached per bucket for the arm's lifetime, so a zoom gesture never renders per frame. The host capability's armedStampPreview(devicePixelWidth?) is now asynchronous and takes that width.

armStamp no longer clears the payload it just set when activating the built-in stamp tool from another active tool. Armed stamps now place correctly instead of falling through to the tool's source callback, while the legacy annotation-stamp tool tag remains supported.

#803 by @bobsingor – The Insert tab's Stamp action now opens the stamps sidebar instead of a click-then-pick file dialog; the Image action handles arbitrary PNG and JPEG insertion. The sidebar is now the classic picker over real libraries. Its built-in library comes from @embedpdf/default-stamps — the standard rubber stamps as one Acrobat-compatible PDF per locale — loaded on the panel's first open (never at boot), in the locale negotiated from the viewer's language and the browser's, and swapped when the viewer's locale changes; the canvas-drawn placeholder set is gone. The panel gets a library dropdown ("All stamps" plus one entry per library, shown once there are two), a two-column thumbnail grid with the label as tooltip, a hover × that removes a stamp from a user library, and per-library export as PDF and remove. Custom libraries persist in IndexedDB across reloads.

"Make stamp" joins the annotation selection strip: with one or more annotations selected on a page, it turns their appearances into a vector stamp in a "My stamps" library and opens the panel on it. Widgets and pending redaction marks are excluded.

New stamps option on the viewer customization: stamps: { defaultLibrary: false } ships no built-in library and makes no request (air-gapped); stamps: { defaultLibrary: 'https://your.cdn/{locale}/stamps.pdf' } self-hosts a copy of @embedpdf/default-stamps. The default is the copy that ships with the viewer, loaded as a lazy chunk of your own build; nothing is ever fetched from a third party. English and Spanish strings updated.

#803 by @bobsingor – The built-in stamp library ships inside the viewer instead of being fetched from a CDN. The npm entry keeps @embedpdf/default-stamps/library external, so its locale modules become lazy chunks of your own build; the CDN snippet carries them as sibling chunks in its folder. @embedpdf/default-stamps is now a dependency. Previously a library build could inline the eight PDFs into the JS chunk as base64, a form webpack rejects.

The viewer registers stampPlugin(), exposes StampToken through its drive door, and routes the Insert tab's Stamp action to the stamps sidebar. Arbitrary PNG and JPEG insertion remains available through the Insert tab's Image action.

The CDN snippet (dist/embedpdf.js) once again finds embedpdf.wasm when loaded from another origin: the wasm is now an asset Vite emits into the dist folder and references by a URL relative to whichever chunk needs it, instead of a path guessed against the entry file — which had resolved to chunks/embedpdf.wasm and failed. A cross-origin test (pnpm test in the viewer package, Playwright against the built artifact) now guards it: the snippet must render with every sibling fetched from its own folder and no request to any other origin.

#793 by @bobsingor – Introduces the PDF action engine: one policy-gated dispatcher for the payload-carrying /A action trees (execute/canExecute, dispatch/canDispatch by annotation ref). Domain plugins register executors and sinks through the /contract/host lens (stage: goto/named; form: javascript/reset-form; annotation: the session-visibility sink), the framework installs a URI/Print UI adapter via setUiAdapter, and onAction/onDiagnostic event hooks report every dispatch. Chains walk in PDF /Next order with document-lifetime work first and navigation/external effects deferred until it succeeds; launch/goto-remote/media stay never-executable and incomplete trees are refused whole.

Phase 2 adds annotation /AA events, ordered page lifecycle events, and the document-open sequence. Dispatch now submits synchronously into the serial queue, returns per-step trigger results, derives origin centrally, and never rejects. The lifecycle coordinator buffers initial page state behind the open barrier and caps programmatic cascades; /A shadows /AA U. The shared hover pump coalesces Exit→Enter pairs, and configuration can gate triggers and the open sequence.

The package now publishes bundle-safe /contract and /contract/host entries. They expose the public and sibling-host protocols over the same token without pulling in dispatcher or plugin wiring; the package root remains the explicit implementation opt-in.

#793 by @bobsingor – Document lifecycle events + the submit sink chain (Phase 4). The five catalog /AA verbs (ISO 32000-2 Table 200 — WC/WS/DS/WP/DP) dispatch through the trigger spine ({scope:'document', event:'will-save'|…}), with the open-ordering law: catalog OpenAction can never run AFTER a lifecycle verb. NEW runDocumentVerb('save'|'print', operation) — before-event → operation → after-event as ONE serialized queue op (two saves can never interleave; a before-event failure never cancels the verb; an operation throw skips the after-event and rethrows) — and prepareClose() (the cooperative WC door; scripts never run in teardown). The Print door fires WP → adapter EXACTLY once → DP under one latch: a nested print request (a WillPrint script calling doc.print()) is suppressed with a reentrant-print diagnostic, never a second dialog; an adapter throw skips DP. SubmitForm graduates from hard-blocked to the SINK CHAIN — embedder setSubmitHandler (consent = installation; detached-promise contract: executed means handed to the embedder) → the document's home (doc.forms.submit, engine-asserted, awaited) → blocked with no-submit-sink; the form plugin registers the ONE dataset resolver (registerSubmitResolver), both action nodes and script doc.submitForm() effects normalize to one SubmitIntent, and policy gains a 'submit-form' row (user-origin only by default). The catalog read is memoized per document with rejection eviction. Ships submitEntriesToUrlEncoded for handlers. The plugin still never touches a network.

#793 by @bobsingor – THE JavaScript switch lives here now: actionsPlugin({ javascript }) owns the per-document ScriptHost realm, registers the real javascript executor (page-scoped world prefetch → boot → run → owner-sink commits → surface, ALL inside the host transaction — the commit-inside-the-boundary law), and exposes the transaction port + surfaceScriptResult on contract/host. Owner commit sinks replace direct engine writes (registerFormCommitSink / registerAnnotCommitSink — each plugin commits AND reconciles its own model, so the PDF and the pixels can never diverge). Trigger provenance reaches executors (ActionContext.event + eventOf), and — full ISO — the Hide action routes by OWNING plane: field names and widget object numbers become form setDisplay effects, plain annotations become document flag patches; the session-visibility sink (SessionEffectSink/registerSessionSink) is REMOVED. ActionUiAdapter gains alert/gotoPage (+ print context) as the ONE UI port for every script effect, with the doc.print authority gate upstream and onScriptDiagnostic/onScriptError hooks. A deterministic per-dispatch JS node cap (maxScriptNodesPerDispatch) bounds /Next chains.

#793 by @bobsingor – Complete the Acrobat AF forms support library in the scripting prelude: AFNumber_Keystroke, AFPercent_Keystroke, AFDate_Format/AFDate_Keystroke(Ex), AFTime_Format(Ex)/AFTime_Keystroke, AFSpecial_Format/AFSpecial_Keystroke, AFRange_Validate, AFMergeChange, AFMakeNumber, and AFExtractNums, with Acrobat-compatible rejection alerts, a lenient scand-style date parser, and new h/hh/tt 12-hour tokens in util.printd. Forms built with Acrobat's standard number/date/time/special formats (for example the Apryse demo form) now validate, format, and auto-calculate instead of failing on missing globals.

javaScriptSourcesFromActionTree now narrows on the payload-carrying action-node union and collects only javascript arms; rendition /JS remains represented but is deliberately not executed. A new ui-effect-suppressed diagnostic also makes permission-withheld script UI effects observable.

#793 by @bobsingor – doc.submitForm(...) emits a submit INTENT (Phase 4): both Acrobat forms — positional (cURL, bFDF, bEmpty, aFields) and the argument object (cURL/aFields/bEmpty/cSubmitAs/bGet) — become a {kind:'submitForm'} UI effect (include-mode field names; cSubmitAs beats bFDF; nothing in the VM ever touches a network — resolution and the sink chain live outside). Doc-typed events now carry event.target = the Doc object (Acrobat's WillSave boilerplate does event.target.getField(...)). The v1-frozen posture constants are honest again: submitForm: 'sink-chain', catalogLifecycleActions: 'execute-on-verb', page/annotation events execute-* — the actions plugin's policy is the live authority these document.

#793 by @bobsingor – The ScriptHost and the annots plane. createScriptHost owns the ONE realm per document (its own serialized transaction port; lazy name-tree boot delivered exactly once to the first transaction; resource faults poison and lazily rebuild the realm; per-run and caller-sliced budgets). The script world grows the curated annotation plane: this.getAnnots({nPage}) / getAnnot(nPage, name) over a caller-prefetched, page-scoped input (null when nothing matches — Acrobat parity; unfetched pages are a NAMED compatibility deviation), Annot wrappers with a per-subtype validity matrix (ANNOT_WRITABLE_KEYS, drift-guarded against the kind registry; no dictionary access — the Acrobat model), setProps/getProps, and diff-derived canonical annotEffects beside formEffects (declared cross-plane commit order: form first, then annot). Ships the standard color object (constants + convert/equal with the documented G/RGB/CMYK vectors), Acrobat {type, name} event overrides, and — cycle fix — the ScriptSandbox/ScriptSandboxFactory structural contract now lives HERE (core-js-sandbox implements and re-exports it).

#793 by @bobsingor – Session-visibility overlay: Model.sessionHidden with setSessionHidden/forgetSessionHidden/clearSessionHidden messages, composed through the new effFlags/effBearer lenses so Hide actions and scripts flip presentation-only visibility (paint, hit-testing, selectability, handles) without ever touching the document /F flags — and a session-SHOWN annotation is live, not painted-but-dead. The overlay survives page reloads and is forgotten only on true deletes.

#793 by @bobsingor – sessionHidden, effFlags/effBearer, and the session-visibility messages are REMOVED — visibility is document truth again (/F flags, mutated through the normal write path), and every paint/hit/selection gate reads the annotation's own flags.

#793 by @bobsingor – The SubmitForm intent and the document's-home submit contract (Phase 4). The submit-form node grows an ATOMIC optional payload (url + fields + decoded SubmitFormFlags + charSet?; absent = older-runtime extraction, the node stays recognized-inert — partial states are unrepresentable). decodeSubmitFormFlags is the ONE ISO Table-240 decode (exclude derived from bit 1, never duplicated; bit 12 is ExclFKey, bit 13 reserved, EmbedForm is bit 14; bit 9 SubmitPDF dominates format with GetMethod kept alive). NEW: doc.forms.submit?(request) — the optional delivery-to-the-document's-HOME capability (present only where a home exists; the local engine truthfully lacks it), gated by the NEW grant-minted doc.forms.submit scope (no PDF permission bit exists for submission, so pdf.permissions never expands it); FormSubmissionRequest/Receipt DTOs + wire schemas fix the record shape (dataset entries + declared intent as METADATA — the home derives WHO submitted from its own verified session, and never fetches the PDF's URL). Conformance pins the payload extraction (/UF precedence, flag decode, both degrade shapes) in both flavors.

#793 by @bobsingor – PdfActionNode is now a discriminated union carrying full interpreter payloads — a goto without its destination or a uri without its URI is unrepresentable. Executable arms: javascript (script), goto (destination), uri (+ isMap), named, hide (targets + /H), reset-form (fields: PdfActionTargetRef[] | null — null means /Fields was absent and every field resets — plus the exclude flag), the file-spec arms, and rendition with its optional /JS. Unreadable payloads degrade that node to unknown with the new payload-dropped tree warning. DocumentActionsSnapshot gains openDestination (the destination-form /OpenAction, schema-defaulted and mutually exclusive with openAction), ActionReadBudget gains target-entry and payload-text limits, and PdfDestinationSchema moved to a neutral dto/ module (re-exported from its old home). The wire entry now also exposes PdfActionWireComponents, the stable named-schema registry used by API generators. This is a breaking source-level contract for code that constructed or narrowed action nodes, recorded as minor only because the 3.0.0-next train is prerelease.

#793 by @bobsingor – SubmitForm payload getters (Phase 4). EPDFAction_GetNodeSubmitForm (has-fields + the raw ISO Table-240 flag word; returns true only when the REQUIRED /F resolved to a URL — a << /FS /URL >> file specification with /UF preferred over /F per 7.11.2, or a bare string /F accepted as a producer-compat extension), EPDFAction_GetNodeSubmitFormURL, and EPDFAction_GetNodeSubmitFormCharSet (PDF 2.0 /CharSet, extracted not encoded). /Fields entries ride the existing shared target storage (GetNodeTargetCount/TargetName/TargetObjectNumber now also answer for submit-form nodes) and the aggregate payload/target budgets. An unresolvable required component withholds the WHOLE payload — the reader degrades the node; never a half payload.

#793 by @bobsingor – Add action-payload getters to the fork's detached action model: unified Hide /T / ResetForm /Fields target accessors (EPDFAction_GetNodeTargetCount/Name/ObjectNumber, with -1 marking a target list that could not be fully represented — a partial list must never execute), EPDFAction_GetNodeHideFlag (/H, spec default hide), EPDFAction_GetNodeResetForm (/Fields presence + /Flags exclude bit — absent and empty are different states), EPDFAction_GetNodeURIIsMap, and EPDFDoc_GetOpenActionDest for the destination-form catalog /OpenAction. Payload capture stays inside the build-time snapshot (nothing lazy, nothing stateful), guarded by new cumulative per-model budgets for target entries and payload bytes plus a destination-array element cap.

#793 by @bobsingor – The action model reader extracts the SubmitForm payload atomically (feature-detecting the Phase-4 runtime getters: an older runtime payload yields the bare recognized-inert node — the pin-lag skew case, unit-pinned; a NEW runtime withholding an unresolvable /F degrades the whole node to unknown + payload-dropped). /Fields targets and the URL/CharSet strings charge the existing aggregate budgets.

#793 by @bobsingor – The action-model walker now materialises interpreter payloads (destinations, URIs + /IsMap, named-action names, Hide targets + /H, ResetForm three-state fields + exclude, file specs) with reserve-before-allocate budgeting — payload lengths are charged against the aggregate read budget before any scratch buffer is allocated, and name-tree script names ride the same budget. readActionModel and the annotation/form field readers take the owning document pointer; readDestination moved to a shared features/destinations/ home. The link target is now a pure projection of the payload-carrying activate tree (linkTargetFromActionTree) — the duplicate native root-read is gone, an incomplete tree projects unsupported, and a malformed /A no longer silently falls back to /Dest.

#793 by @bobsingor – New @embedpdf/react/actions entry with useActionsUiAdapter (browser-default URI open through sanitizeExternalUri + print dialog, overridable per handler), a useCapabilityEvent hook for capability event subscriptions, and link-layer delegation: chain-bearing URI links drop the native href fast path so the dispatcher runs the whole chain (the 'dispatched' outcome opens nothing itself — the adapter owns it).

Widget fill controls become always-active /AA event surfaces, link anchors feed link hover events, and scripting-provider defaults use the dispatch origin when deciding whether to suppress lifecycle/boot UI effects.

Route sibling feature dependencies through plugin contract/helper entries. Annotation selection hooks and anchor equality helpers are split into leaf modules so form and annotation-menu entries no longer import the full annotation feature implementation.

Render PDF list boxes as visible native scrolling controls in both form surfaces, with stable optimistic selection and wheel isolation so row hit-testing, selection, and scrolling stay synchronized while engine writes complete. Combo boxes retain their baked resting appearance and native popup behavior.

Keep keyboard focus indicators above baked PDF appearances so checkboxes and choice controls display the same clear blue focus ring as text fields and radio buttons.

#793 by @bobsingor – useActionsUiAdapter is the ONE script UI port: it gains alert and gotoPage defaults with the origin×phase visibility matrix (lifecycle/boot alerts and non-user print suppressed unless the embedder passes handlers — which receive everything, context attached). useFormScriptingProvider and FormScriptingUiHandlers are DELETED.

#793 by @bobsingor – useActionsUiAdapter is now glue over @embedpdf/web's createDefaultActionsUiAdapter — behavior-identical (the corpus alert matrix pins it); the default policy lives in ONE place for every binding.

#793 by @bobsingor – Widget activation is a WIDGET behavior, not a push-button behavior: clicking ANY form widget now dispatches its /A through form.activateWidget — text, toggle, and choice widgets (both the annotation-backed renderers and the standalone fill layer) join the button path. This makes real-world "fake buttons" work: producers ship Reset/Next/Hide controls as READ-ONLY text fields carrying a widget /A (ISO puts the activate action on the annotation dictionary, any field type), which previously died in the viewer because only push buttons routed clicks to activation while the pointer feed's mouseUp was — correctly — shadowed by /A precedence. Disabled controls become pointer-transparent so their clicks reach the activation surface (a disabled form control suppresses click events entirely); toggles keep Acrobat's order (the value change first, THEN the /A); push buttons keep their gated door (disabled still blocks activation there). Proven end-to-end by a real-DOM regression test (rendered FormLayer over a real engine — the gap every prior activateWidget()-direct test masked) and a read-only fake-button fixture in the plugin e2e.

#793 by @bobsingor – Registers the action engine's session-visibility sink (applySessionVisibility on the host lens) when @embedpdf/plugin-actions is present, and carries the full activate action tree + annotation ref on LinkNavItem so the nav layer can delegate chains to the dispatcher.

The pointer-driven hover diff feeds annotation /AA cursorEnter/cursorExit through the shared hover pump while reducer-side clears, widgets, links, and tree-less items stay inert. LinkNavItem also carries hover-event presence flags for the link plane.

Publish bundle-safe /contract and /contract/host entries over the same annotation token, plus the focused /authoring helper entry. /internal keeps its implementation-helper meaning and no longer serves as the sibling bundle boundary.

#793 by @bobsingor – The session-visibility overlay is RETIRED — applySessionVisibility is replaced by commitScriptEffects, the annotation DOCUMENT-commit sink: script/Hide effects become engine annotations.update patches (colors crossing the Acrobat-array → engine boundary, /AP regenerated engine-side), authority-enforced, stop-on-failure, with the owner reconciling its own model per touched page.

#793 by @bobsingor – Widget activation joins the action engine: with @embedpdf/plugin-actions installed, activateWidget delegates the full /A tree to the dispatcher (return type is now WidgetActivationResult, discriminating the two worlds), so Hide/ResetForm push buttons work with scripting disabled. The host lens exposes the interim executors' doors: runActivationScript (one JS node as a widget transaction) and resetFormAction (three-state target resolution, one batch reset skipping non-resettable families, recalculate after). Executor-driven form mutations ride the same serial mutation queue as user commits — strictly actions-queue → form-queue, never the reverse.

The widget DOM-event door dispatches widget /AA trees, including coalesced hover events. Activation now submits synchronously through the dispatcher, and script UI effects carry their dispatch origin; print requests without document permission are withheld with an observable diagnostic.

Form scripting is fault-tolerant per event: Keystroke, Validate, Calculate, and Format exceptions degrade to diagnostics while explicit event.rc = false remains a rejection and resource-budget faults still fail the transaction. Keystroke actions now run Acrobat's typing and commit passes so standard AF validators and custom transforms see the expected event shape.

Publish bundle-safe /contract and /contract/host entries over the same form token, plus a focused /scripting helper entry. /internal remains an implementation visibility surface rather than the sibling bundle boundary.

#793 by @bobsingor – The submit dataset resolver + the reset() symmetry fix (Phase 4). resolveSubmitDataset (registered as THE actions submit resolver) does a FRESH engine read and applies the ISO Table-239/240 semantics through the new shared field-selection module: include-mode NAMES select descendants by FQN dot-prefix (fixing the ResetForm exact-match conformance bug too — Tables 241/242 want subtrees), the NoExport veto is unconditional (diagnosed when explicitly listed), explicitly listed push-buttons/signatures and unsupported /V shapes are DIAGNOSED (submit-entry-unsupported), never silently dropped, and IncludeNoValueFields yields name-only entries. resetFormAction gains an origin parameter threaded from the executor's ActionContext — a lifecycle/hover ResetForm can no longer launder its recalculation alerts into user origin — and the public form.reset(key) now rides the SAME shared reset core (one effects batch → refresh → V/C/F recalculation), so a dependent calculated field can no longer go stale through the API door.

#793 by @bobsingor – The K/V/C/F pipeline rides the shared realm: FormScriptingController keeps its ordering, event.rc semantics, two-pass keystroke, overlay, and fault ladder UNCHANGED, but acquires the realm through a transaction port — the actions plugin's per-document host in viewers, or a self-owned standalone host (createFormScriptingHost / the { config } constructor arm) for stamp and tests. The snapshot moves INSIDE the transaction boundary (commit(ref, value) / activate(ref, action) / recalculate() — no snapshot parameters). formPlugin({ scripting }) is DELETED (the switch is actionsPlugin({ javascript })); the interim runActivationScript executor and the form-side UI-effect provider (setUiEffectProvider/FormUiEffectProvider) are gone — every script surface flows through the actions port with origin/phase attached, and the new commitScriptFormEffects sink commits script form effects with engine write + snapshot AND annotation-plane reconciliation in one place.

#793 by @bobsingor – activate() accepts an optional LinkActivateContext; when the actions plugin is installed and the item carries its /A tree, activation delegates to the dispatcher and returns the new { outcome: 'dispatched', dispatch } arm — named verbs execute and mixed /Next chains behind links finally run. Without the actions plugin the classic root-projection path is unchanged.

Link /AA hover presence flags now ride LinkNavItem from the standalone source so the navigation layer can deliver cursorEnter/cursorExit without waking the annotation behavior plane.

Publish a bundle-safe /contract entry so navigation consumers can depend on the link protocol without pulling in source/effect/plugin wiring.

#793 by @bobsingor – The main stage lens registers goto and named action executors with the action engine when present: GoTo destinations reveal through the camera, NextPage/PrevPage/FirstPage/LastPage execute, unknown named verbs report inert.

The stage lens also reports placed/current/visible page state and user-versus-programmatic motion causes to the action lifecycle coordinator.

Publish a bundle-safe /contract entry and a focused /destination helper entry so camera consumers do not pull in stage reducer/effect/plugin wiring.

#793 by @bobsingor – The viewer wires the action engine in: actionsPlugin() joins the plugin set and the Shell installs the default URI/Print UI adapter.

#793 by @bobsingor – The chrome save/print commands become the Phase-4 verb owners: document:download runs WS → serialize → DS as ONE queued operation (the WillSave mutations are IN the downloaded bytes; two rapid saves can never interleave) and document:print runs WP → window.print() → DP under the reentrancy latch — both degrading to today's behavior when the actions plugin is absent.

#793 by @bobsingor – Scripting migrates to actionsPlugin({ javascript: { enabled: true } }) with a bare formPlugin(); the Shell's form scripting provider hook is gone — useActionsUiAdapter carries everything.

#787 by @bobsingor – Reusing an explicit docId on documents.init or documents.import now answers a clean 409 Conflict explaining how to proceed (retry with the same idempotencyKey to resume, delete the document to replace it, or use a different/omitted docId) instead of surfacing the raw database unique-constraint error as a 500 — including the case where a retry mints a fresh idempotency key per attempt. A docId already owned by another tenant answers 403, mirroring the existing delete semantics.

#785 by @bobsingor – Fix AWS S3-backed streaming uploads by buffering small source chunks before the SDK applies checksum framing, preventing InvalidChunkSizeError during document imports and other streamed writes. Handled 5xx responses now also emit structured error logs with the request ID and HTTP status.

#783 by @bobsingor – Add a production Helm chart with validated SQLite and Postgres profiles, safety gates, smoke and crash drills, and OCI publishing tied to the server package version. Add Prometheus metrics, drain-aware bounded shutdown and readiness, serialized Postgres migrations, and fail-fast worker supervision.

Add opt-in supervised engine-host process isolation with generation-fenced recovery, crash journaling, document quarantine enforcement, engine health reporting, and audited quarantine CLI commands. Repeated engine crashers can be observed or rejected with DocumentQuarantined, while native host crashes restart the engine without terminating the API server.

Encode page renders, annotation appearances, and warm thumbnails inside engine workers by default so compressed images cross the engine boundary, with a temporary API-side encoding fallback. Add bounded interactive and background scheduling, per-host memory telemetry, controlled engine recycling, and deterministic engine sharding with per-shard readiness and metrics.

Add POST /v1/docs/:docId/access as the document-scoped access endpoint while retaining POST /v1/access as a transitional alias. Head responses advertise the scoped endpoint, and path/body document ID mismatches are rejected. Allow the optional X-CloudPDF-Doc affinity header through CORS and expose retry and image metadata response headers to browser clients.

#783 by @bobsingor – Add the *.renderEncoded wire kinds (pages.renderEncoded, document.renderPageFileEncoded, annotations.renderAppearancesEncoded) plus their RenderEncode / EncodedImageWire shapes — cloud-server surface (types only): the raster is encoded where it is produced and only the compressed image crosses the engine boundary.

Make document access endpoints document-scoped by changing wirePaths.access to a wirePaths.access(docId) builder. Keep wirePaths.accessLegacy for transitional clients and allow the scoped endpoint to omit docId from the request body.

#776 by @bobsingor – Refactor SelectionHandles to use the shared selection and web primitives so handles align correctly with rotated text and rotated pages.

#777 by @bobsingor – Give every Stage lens and standalone PageView a stable view identity and use its scoped tile handle. Thumbnail and secondary views can no longer clear the main view's high-resolution tiles.

#775 by @bobsingor – Add shared browser Stage surface and touch gesture controllers with lens-scoped input, pan, pinch, fling, double-tap, long-press, and wheel handling. Export vibration and native-shell feedback providers.

#776 by @bobsingor – Add a shared native DOM binding for selection-handle drags that shields Stage gestures and handles pointer capture and client-delta tracking.

• An empty JSON body now parses as no body rather than FST_ERR_CTP_EMPTY_JSON_BODY — the shape the generated PHP, Go, and Ruby SDKs (and clients with default JSON headers) send for bodyless calls such as document delete. Non-empty bodies still go through Fastify's default parser, keeping its prototype-poisoning protection, and routes that require a body still reject its absence with a 400.
• The error handler now honors Fastify's statusCode on framework errors, so parser and payload rejections (empty or malformed JSON, body limits) surface as the 4xx client errors they are instead of being logged and returned as "unhandled error" 500s.

#766 by @bobsingor – Extend documents.importFrom with mode: "async". Async requests accept operator-registered connection sources and return 202 with tag: "accepted" and a pending document that callers can poll with GET /documents/:id; presigned URL sources remain synchronous.

#766 by @bobsingor – Add the provider-neutral connection source to documents.importFrom. Requests identify an operator-registered connection and object key, plus an optional opaque provider-specific revision, without exposing storage-provider configuration or credentials in the public wire contract.

#766 by @bobsingor – Add the documents.importFrom operation for importing a PDF from a caller-supplied URL. The request supports optional size and SHA-256 integrity pins, metadata, deduplication, and idempotency fields, while responses distinguish completed imports from validation, authorization, conflict, and upstream transport failures.

#766 by @bobsingor – Rename the contract operation from documents.import to documents.importFrom so generated Java, Python, and Ruby SDKs expose a consistent method name. The HTTP path remains POST /v1/tenants/{tenantId}/documents/import. The OpenAPI emitter now rejects group or method segments that collide with reserved words in those target languages.

#766 by @bobsingor – Add durable asynchronous document imports backed by the document_imports job table and an in-process worker with one claim loop per replica. Document and job creation is atomic, lease-token-fenced transitions prevent stale workers from overwriting replacements, reconcile-on-claim avoids duplicate transfers after crashes, and exhausted retries fail the document and clean destination bytes. Retries stay pinned to one content identity, filesystem sources require expected.sha256, and queued or running imports are protected from the stale-pending sweeper. Migration 027 stores the re-drivable source descriptor in source_json.

#766 by @bobsingor – Add operator-registered import connections through CLOUDPDF_IMPORT_CONNECTIONS for S3 and S3-compatible stores, GCS, Azure Blob, and filesystem roots. Connections enforce credential classes, tenant allowlists, scoped prefixes or tenant-bound key templates, provider-specific revision pinning, and fail-closed authorization. Canonical backend fingerprints reject self-imports, and each import records sanitized source provenance and outcome in the new document_imports table from migration 026. A shared conformance suite keeps URL and connection adapters aligned on source-opening behavior.

#766 by @bobsingor – Implement server-side PDF imports from caller-supplied URLs through the existing document lifecycle. Deployment policy controls size, timeout, concurrency, HTTPS, and public-network requirements; URL handling blocks private and metadata addresses with DNS pinning, rejects redirects, and requires Content-Length. Imports enforce optional size and SHA-256 pins, sanitize failures so URL secrets do not leak, leave documents pending after retryable transport failures, and add the pull upload kind in migration 025.

#766 by @bobsingor – Mount the document import handler under the renamed documents.importFrom contract operation and align the server's import policy and lifecycle terminology. The HTTP route and runtime behavior remain unchanged.

#766 by @bobsingor – Cloud ObjectStore adapters (S3, GCS, Azure Blob) now truly stream put bodies: a Readable is hashed and length-enforced as it flows (constant memory) instead of being buffered whole. Under- or over-delivery aborts before a visible object can appear, any prior object at the key survives a failed attempt, and the SHA-256 metadata is attached post-stream (S3 via a same-key server-side copy). FsObjectStore now cleans up its .partial file when the source stream errors mid-put.

#768 by @bobsingor – Consolidate base-page and deep-zoom tile painting into RenderLayer, with a tiles option for lenses that explicitly disable tiling. The separate TileLayer surface is removed because tile engagement is now render-policy arithmetic owned by RenderLayer.

Tiles are positioned directly in view-pixel space and use the shared painted-image lifecycle, keeping retained coverage until replacements have a presentation opportunity and avoiding deep-zoom rounding drift, incomplete-image outlines, and transient seams.

#768 by @bobsingor – Add a configurable render strategy for exact and lattice-backed deployments, with separate full-page and tile-plane budgets, format conformance, settled level selection, and public paint settings.

Deep-zoom tiling now uses bled overlap, presentation-aware generation retention, bounded fetch backpressure and raster residency, stage-less demand limits, stronger raster identities, failure isolation, and optional diagnostics. These changes keep tile memory bounded while preventing stale reuse, visible seams, and quality regressions during zoom and pan transitions.