@embedpdf/engine-services 3.0.0-next.10 → 3.0.0-next.11

package/dist/index.js

@@ -1,4 +1,4 @@
-import { AbortError, EMPTY_TRANSFER, EngineError, EngineErrorCode, NO_ANNOTATION_FLAGS, PAGE_INSERT_BLANK_MAX_COUNT, PDF_SUBTYPE_TO_CODE, PdfAnnotationSubtypeCode, UNKNOWN_WEAK_ANNOTATION_STATE, appearanceImpactOf, buildPageTextLayout, buildSnippet, charMapViolation, charRangeForTextOffsets, foldOptionsFor, foldText, invalidatesWeakIndexRefs, isValidPageObjectNumber, knownWeakAnnotationState, matchLiteral, matchRegex, normalizePdfRect, pdfQuadBounds, revisionTokensEqual, serializeError, shiftsExistingAnnotationIndices, sniffBinaryMetadata, subtypeFromCode, textSegmentsForRange, validateSearchQuery, wirePack } from "@embedpdf/engine-core/runtime";
+import { AbortError, EMPTY_TRANSFER, EngineError, EngineErrorCode, NO_ANNOTATION_FLAGS, PAGE_INSERT_BLANK_MAX_COUNT, PDF_SUBTYPE_TO_CODE, PdfAnnotationSubtypeCode, UNKNOWN_WEAK_ANNOTATION_STATE, appearanceImpactOf, buildPageTextLayout, buildSnippet, charMapViolation, charRangeForTextOffsets, decodeSubmitFormFlags, foldOptionsFor, foldText, invalidatesWeakIndexRefs, isValidPageObjectNumber, knownWeakAnnotationState, matchLiteral, matchRegex, normalizePdfRect, pdfQuadBounds, revisionTokensEqual, serializeError, shiftsExistingAnnotationIndices, sniffBinaryMetadata, subtypeFromCode, textSegmentsForRange, validateSearchQuery, wirePack } from "@embedpdf/engine-core/runtime";
 import { NULL_PTR } from "@embedpdf/engine-runtime";
 //#region src/runtime/lifecycle/bootstrap.ts
 const initialized = /* @__PURE__ */ new WeakSet();
@@ -1211,11 +1211,143 @@ function readI32(mem, ptr, byteOffset = 0) {
 	return Number(mem.peek(ptr, "i32", byteOffset));
 }
 //#endregion
+//#region src/features/destinations/destinationViewCodes.ts
+/**
+* `PDFDEST_VIEW_*` fit-type codes (public/fpdf_doc.h) — the shared
+* vocabulary of `FPDFDest_GetView` (read) and `EPDFDest_CreateView`
+* (write). XYZ is listed for completeness but never goes through
+* CreateView (it has its own null-aware constructor).
+*/
+const DEST_VIEW = {
+	unknown: 0,
+	xyz: 1,
+	fit: 2,
+	fitH: 3,
+	fitV: 4,
+	fitR: 5,
+	fitB: 6,
+	fitBH: 7,
+	fitBV: 8
+};
+/** Wire destination kind → PDFDEST_VIEW code, for the non-XYZ kinds. */
+const VIEW_CODE_BY_KIND = {
+	fit: DEST_VIEW.fit,
+	fitH: DEST_VIEW.fitH,
+	fitV: DEST_VIEW.fitV,
+	fitR: DEST_VIEW.fitR,
+	fitB: DEST_VIEW.fitB,
+	fitBH: DEST_VIEW.fitBH,
+	fitBV: DEST_VIEW.fitBV
+};
+//#endregion
+//#region src/features/destinations/readDestination.ts
+const MAX_VIEW_PARAMS = 4;
+/**
+* Materialise one explicit `PdfDestination` from a live `destPtr`. PDFium
+* already resolved named destinations before handing us the pointer, so
+* only explicit arrays arrive here (the rule `PdfDestination` documents).
+*
+* Returns `null` when the destination is unreadable: no visible indirect page
+* in the document, or an unknown fit type. Coordinates stay raw PDF user
+* space — no conversion at this layer.
+*
+* Shared by the link reader, `goto` action-node payloads, and the document
+* `openDestination`; the outline/bookmark port reuses it too.
+*/
+function readDestination(fn, mem, docPtr, destPtr) {
+	const pageObjectNumber = fn.EPDFDest_GetPageObjectNumber(docPtr, destPtr);
+	if (pageObjectNumber === 0) return null;
+	const view = withScratchN(mem, [4, MAX_VIEW_PARAMS * 4], ([countPtr, paramsPtr]) => {
+		const code = fn.FPDFDest_GetView(destPtr, countPtr, paramsPtr);
+		const count = Math.min(readI32(mem, countPtr), MAX_VIEW_PARAMS);
+		const params = [];
+		for (let i = 0; i < count; i++) params.push(readF32(mem, paramsPtr, i * 4));
+		return {
+			code,
+			params
+		};
+	});
+	const at = (i) => i < view.params.length ? view.params[i] : null;
+	switch (view.code) {
+		case DEST_VIEW.xyz: return {
+			kind: "xyz",
+			pageObjectNumber,
+			...readXyzLocation(fn, mem, destPtr)
+		};
+		case DEST_VIEW.fit: return {
+			kind: "fit",
+			pageObjectNumber
+		};
+		case DEST_VIEW.fitH: return {
+			kind: "fitH",
+			pageObjectNumber,
+			top: at(0)
+		};
+		case DEST_VIEW.fitV: return {
+			kind: "fitV",
+			pageObjectNumber,
+			left: at(0)
+		};
+		case DEST_VIEW.fitR:
+			if (view.params.length < 4) return {
+				kind: "fit",
+				pageObjectNumber
+			};
+			return {
+				kind: "fitR",
+				pageObjectNumber,
+				left: view.params[0],
+				bottom: view.params[1],
+				right: view.params[2],
+				top: view.params[3]
+			};
+		case DEST_VIEW.fitB: return {
+			kind: "fitB",
+			pageObjectNumber
+		};
+		case DEST_VIEW.fitBH: return {
+			kind: "fitBH",
+			pageObjectNumber,
+			top: at(0)
+		};
+		case DEST_VIEW.fitBV: return {
+			kind: "fitBV",
+			pageObjectNumber,
+			left: at(0)
+		};
+		default: return null;
+	}
+}
+/** `/XYZ` null-aware axes via `FPDFDest_GetLocationInPage` (FPDF_BOOL is 4 bytes). */
+function readXyzLocation(fn, mem, destPtr) {
+	return withScratchN(mem, [
+		4,
+		4,
+		4,
+		4,
+		4,
+		4
+	], ([hasLeft, hasTop, hasZoom, left, top, zoom]) => {
+		if (!fn.FPDFDest_GetLocationInPage(destPtr, hasLeft, hasTop, hasZoom, left, top, zoom)) return {
+			left: null,
+			top: null,
+			zoom: null
+		};
+		return {
+			left: readI32(mem, hasLeft) ? readF32(mem, left) : null,
+			top: readI32(mem, hasTop) ? readF32(mem, top) : null,
+			zoom: readI32(mem, hasZoom) ? readF32(mem, zoom) : null
+		};
+	});
+}
+//#endregion
 //#region src/features/actions/ActionModelReader.ts
 const DEFAULT_ACTION_READ_BUDGET = {
 	maxModels: 512,
 	maxNodes: 16384,
-	maxScriptCodeUnits: 16e6
+	maxScriptCodeUnits: 16e6,
+	maxTargetEntries: 4096,
+	maxPayloadCodeUnits: 262144
 };
 const ACTION_TYPE_BY_CODE = {
 	0: "unknown",
@@ -1243,22 +1375,20 @@ const WARNING_MALFORMED_NEXT = 2;
 const WARNING_INCOMPLETE = 4;
 const INVALID_NODE_U32 = 4294967295;
 /** Decode one `EPDF_ACTION_TYPE_*` code — the shared vocabulary consumers
-*  (the link-target projection) use so the two surfaces cannot drift. */
+*  use so action-shaped surfaces cannot drift. */
 function actionTypeFromCode(code) {
 	return ACTION_TYPE_BY_CODE[code] ?? "unknown";
 }
-/** Is this `EPDFAction_GetRootNode`/`GetNextAt` result a real node id?
-*  (`EPDF_ACTION_NODE_INVALID` may surface as -1 or u32 max via cwrap.) */
-function isValidActionNodeId(raw) {
-	return raw !== -1 && raw >>> 0 !== INVALID_NODE_U32;
-}
-/** Mutable aggregate budget shared by every action model in one read job. */
+/** Mutable aggregate budget shared by every action model in one read job.
+*  Payload budgets are RESERVED before the backing buffer is allocated. */
 var ActionReadBudgetTracker = class {
 	constructor(limits = DEFAULT_ACTION_READ_BUDGET) {
 		this.limits = limits;
 		_defineProperty(this, "models", 0);
 		_defineProperty(this, "nodes", 0);
 		_defineProperty(this, "scriptCodeUnits", 0);
+		_defineProperty(this, "targetEntries", 0);
+		_defineProperty(this, "payloadCodeUnits", 0);
 	}
 	addModel(nodeCount) {
 		this.models += 1;
@@ -1269,11 +1399,23 @@ var ActionReadBudgetTracker = class {
 		this.scriptCodeUnits += script.length;
 		this.assertWithinBudget();
 	}
+	/** Charge target entries BEFORE the target array is walked. */
+	reserveTargets(count) {
+		this.targetEntries += count;
+		this.assertWithinBudget();
+	}
+	/** Charge payload text BEFORE the scratch buffer for it is allocated. */
+	reservePayloadBytes(length) {
+		this.payloadCodeUnits += length;
+		this.assertWithinBudget();
+	}
 	assertWithinBudget() {
-		if (this.models > this.limits.maxModels || this.nodes > this.limits.maxNodes || this.scriptCodeUnits > this.limits.maxScriptCodeUnits) throw new EngineError(EngineErrorCode.MalformedPdf, "aggregate PDF action read budget exceeded", { details: {
+		if (this.models > this.limits.maxModels || this.nodes > this.limits.maxNodes || this.scriptCodeUnits > this.limits.maxScriptCodeUnits || this.targetEntries > this.limits.maxTargetEntries || this.payloadCodeUnits > this.limits.maxPayloadCodeUnits) throw new EngineError(EngineErrorCode.MalformedPdf, "aggregate PDF action read budget exceeded", { details: {
 			models: this.models,
 			nodes: this.nodes,
 			scriptCodeUnits: this.scriptCodeUnits,
+			targetEntries: this.targetEntries,
+			payloadCodeUnits: this.payloadCodeUnits,
 			limits: this.limits
 		} });
 	}
@@ -1281,8 +1423,17 @@ var ActionReadBudgetTracker = class {
 /**
 * Convert and close one detached native action model. This is the only
 * native-model walker used by document, page, field, and annotation reads.
+*
+* `docPtr` resolves `goto` destinations (page identity + named-destination
+* lookup); every caller reads within an open document session.
+*
+* Payload rule: a node whose payload cannot be materialised (a goto without
+* a resolvable destination, a javascript node with no `/JS`, a withheld
+* target list) degrades to `{ type: 'unknown' }` with its original `/S` on
+* `subtype`, and the tree gains the `'payload-dropped'` warning — impossible
+* states stay unrepresentable while malformed documents stay readable.
 */
-function readActionModel(fn, mem, modelPtr, budget) {
+function readActionModel(fn, mem, docPtr, modelPtr, budget) {
 	if (modelPtr === NULL_PTR) return null;
 	try {
 		const nodeCount = fn.EPDFAction_GetNodeCount(modelPtr);
@@ -1292,13 +1443,61 @@ function readActionModel(fn, mem, modelPtr, budget) {
 		const incomplete = !fn.EPDFAction_IsComplete(modelPtr);
 		const rootId = normalizeOptionalNodeId(fn.EPDFAction_GetRootNode(modelPtr), nodeCount);
 		const visiting = /* @__PURE__ */ new Set();
+		let payloadDropped = false;
+		/** Probe the two-call length first and charge the budget BEFORE the
+		*  scratch buffer for the value is allocated. */
+		const readPayloadString = (call) => {
+			const length = call(NULL_PTR, 0);
+			if (length <= 0) return null;
+			budget.reservePayloadBytes(length);
+			return readUtf8String(mem, call);
+		};
+		const readOutBool = (read) => withScratchN(mem, [4], ([outPtr]) => read(outPtr) ? readI32(mem, outPtr) !== 0 : null);
+		const readTargetObjectNumber = (nodeId, index) => withScratchN(mem, [4], ([outPtr]) => {
+			if (!fn.EPDFAction_GetNodeTargetObjectNumber(modelPtr, nodeId, index, outPtr)) return null;
+			const value = readI32(mem, outPtr) >>> 0;
+			return value === 0 ? null : value;
+		});
+		const readTargets = (nodeId, count) => {
+			const targets = [];
+			for (let index = 0; index < count; index++) {
+				const name = readPayloadString((buf, capacity) => fn.EPDFAction_GetNodeTargetName(modelPtr, nodeId, index, buf, capacity));
+				if (name !== null) {
+					targets.push({
+						kind: "name",
+						name
+					});
+					continue;
+				}
+				const objectNumber = readTargetObjectNumber(nodeId, index);
+				if (objectNumber === null) return null;
+				targets.push({
+					kind: "objectNumber",
+					objectNumber
+				});
+			}
+			return targets;
+		};
+		const readResetFormState = (nodeId) => withScratchN(mem, [4, 4], ([hasFieldsPtr, excludePtr]) => {
+			if (!fn.EPDFAction_GetNodeResetForm(modelPtr, nodeId, hasFieldsPtr, excludePtr)) return null;
+			return {
+				hasFields: readI32(mem, hasFieldsPtr) !== 0,
+				exclude: readI32(mem, excludePtr) !== 0
+			};
+		});
+		const readSubmitFormState = (nodeId) => withScratchN(mem, [4, 4], ([hasFieldsPtr, flagsPtr]) => {
+			if (!fn.EPDFAction_GetNodeSubmitForm(modelPtr, nodeId, hasFieldsPtr, flagsPtr)) return null;
+			return {
+				hasFields: readI32(mem, hasFieldsPtr) !== 0,
+				flags: readI32(mem, flagsPtr) >>> 0
+			};
+		});
 		const readNode = (nodeId) => {
 			if (visiting.has(nodeId)) throw malformedActionModel("native action model contains a cycle", { nodeId });
 			visiting.add(nodeId);
 			try {
+				const type = actionTypeFromCode(fn.EPDFAction_GetNodeType(modelPtr, nodeId));
 				const subtype = readUtf8String(mem, (buf, capacity) => fn.EPDFAction_GetNodeSubtype(modelPtr, nodeId, buf, capacity)) ?? "";
-				const script = fn.EPDFAction_NodeHasJavaScript(modelPtr, nodeId) ? readUtf16String(mem, (buf, capacity) => fn.EPDFAction_GetNodeJavaScript(modelPtr, nodeId, buf, capacity)) ?? "" : void 0;
-				if (script !== void 0) budget.addScript(script);
 				const nextCount = fn.EPDFAction_GetNextCount(modelPtr, nodeId);
 				if (!Number.isInteger(nextCount) || nextCount < 0) throw malformedActionModel("invalid action child count", {
 					nodeId,
@@ -1309,21 +1508,157 @@ function readActionModel(fn, mem, modelPtr, budget) {
 					const childId = normalizeNodeId(fn.EPDFAction_GetNextAt(modelPtr, nodeId, index), nodeCount);
 					next.push(readNode(childId));
 				}
-				return {
-					type: ACTION_TYPE_BY_CODE[fn.EPDFAction_GetNodeType(modelPtr, nodeId)] ?? "unknown",
-					subtype,
-					...script !== void 0 ? { script } : {},
-					next
+				const degraded = () => {
+					payloadDropped = true;
+					return {
+						type: "unknown",
+						subtype,
+						next
+					};
 				};
+				switch (type) {
+					case "javascript": {
+						if (!fn.EPDFAction_NodeHasJavaScript(modelPtr, nodeId)) return degraded();
+						const script = readUtf16String(mem, (buf, capacity) => fn.EPDFAction_GetNodeJavaScript(modelPtr, nodeId, buf, capacity)) ?? "";
+						budget.addScript(script);
+						return {
+							type,
+							subtype,
+							script,
+							next
+						};
+					}
+					case "rendition": {
+						if (!fn.EPDFAction_NodeHasJavaScript(modelPtr, nodeId)) return {
+							type,
+							subtype,
+							next
+						};
+						const script = readUtf16String(mem, (buf, capacity) => fn.EPDFAction_GetNodeJavaScript(modelPtr, nodeId, buf, capacity)) ?? "";
+						budget.addScript(script);
+						return {
+							type,
+							subtype,
+							script,
+							next
+						};
+					}
+					case "goto": {
+						const destPtr = fn.EPDFAction_GetNodeDest(docPtr, modelPtr, nodeId);
+						const destination = destPtr !== NULL_PTR ? readDestination(fn, mem, docPtr, destPtr) : null;
+						return destination ? {
+							type,
+							subtype,
+							destination,
+							next
+						} : degraded();
+					}
+					case "uri": {
+						const uri = readPayloadString((buf, capacity) => fn.EPDFAction_GetNodeURI(docPtr, modelPtr, nodeId, buf, capacity));
+						if (uri === null) return degraded();
+						return {
+							type,
+							subtype,
+							uri,
+							isMap: readOutBool((outPtr) => fn.EPDFAction_GetNodeURIIsMap(modelPtr, nodeId, outPtr)) ?? false,
+							next
+						};
+					}
+					case "named": {
+						const name = readPayloadString((buf, capacity) => fn.EPDFAction_GetNodeName(modelPtr, nodeId, buf, capacity));
+						return name === null ? degraded() : {
+							type,
+							subtype,
+							name,
+							next
+						};
+					}
+					case "hide": {
+						const count = fn.EPDFAction_GetNodeTargetCount(modelPtr, nodeId);
+						if (!Number.isInteger(count) || count < 0) return degraded();
+						budget.reserveTargets(count);
+						const targets = readTargets(nodeId, count);
+						if (targets === null) return degraded();
+						return {
+							type,
+							subtype,
+							targets,
+							hide: readOutBool((outPtr) => fn.EPDFAction_GetNodeHideFlag(modelPtr, nodeId, outPtr)) ?? true,
+							next
+						};
+					}
+					case "reset-form": {
+						const state = readResetFormState(nodeId);
+						const count = fn.EPDFAction_GetNodeTargetCount(modelPtr, nodeId);
+						if (state === null || !Number.isInteger(count) || count < 0) return degraded();
+						budget.reserveTargets(count);
+						const fields = state.hasFields ? readTargets(nodeId, count) : null;
+						if (state.hasFields && fields === null) return degraded();
+						return {
+							type,
+							subtype,
+							fields,
+							exclude: state.exclude,
+							next
+						};
+					}
+					case "submit-form": {
+						if (typeof fn.EPDFAction_GetNodeSubmitForm !== "function") return {
+							type,
+							subtype,
+							next
+						};
+						const state = readSubmitFormState(nodeId);
+						if (state === null) return degraded();
+						const url = readPayloadString((buf, capacity) => fn.EPDFAction_GetNodeSubmitFormURL(modelPtr, nodeId, buf, capacity));
+						if (url === null) return degraded();
+						const count = fn.EPDFAction_GetNodeTargetCount(modelPtr, nodeId);
+						if (!Number.isInteger(count) || count < 0) return degraded();
+						budget.reserveTargets(count);
+						const fields = state.hasFields ? readTargets(nodeId, count) : null;
+						if (state.hasFields && fields === null) return degraded();
+						const charSet = readPayloadString((buf, capacity) => fn.EPDFAction_GetNodeSubmitFormCharSet(modelPtr, nodeId, buf, capacity));
+						return {
+							type,
+							subtype,
+							payload: {
+								url,
+								fields,
+								flags: decodeSubmitFormFlags(state.flags),
+								...charSet === null ? {} : { charSet }
+							},
+							next
+						};
+					}
+					case "goto-remote":
+					case "goto-embedded":
+					case "launch": {
+						const filePath = readPayloadString((buf, capacity) => fn.EPDFAction_GetNodeFilePath(modelPtr, nodeId, buf, capacity));
+						return filePath === null ? degraded() : {
+							type,
+							subtype,
+							filePath,
+							next
+						};
+					}
+					default: return {
+						type,
+						subtype,
+						next
+					};
+				}
 			} finally {
 				visiting.delete(nodeId);
 			}
 		};
+		const root = rootId === null ? null : readNode(rootId);
+		const warnings = warningsFromFlags(warningFlags, incomplete);
+		if (payloadDropped) warnings.push("payload-dropped");
 		return {
-			root: rootId === null ? null : readNode(rootId),
+			root,
 			incomplete,
 			warningFlags,
-			warnings: warningsFromFlags(warningFlags, incomplete)
+			warnings
 		};
 	} finally {
 		fn.EPDFAction_CloseModel(modelPtr);
@@ -1403,8 +1738,8 @@ var PagesReader = class {
 };
 function readPageActions(fn, mem, docPtr, pageObjectNumber, budget) {
 	const actions = {};
-	const open = readActionModel(fn, mem, fn.EPDFDoc_GetPageActionModel(docPtr, pageObjectNumber, 0), budget);
-	const close = readActionModel(fn, mem, fn.EPDFDoc_GetPageActionModel(docPtr, pageObjectNumber, 1), budget);
+	const open = readActionModel(fn, mem, docPtr, fn.EPDFDoc_GetPageActionModel(docPtr, pageObjectNumber, 0), budget);
+	const close = readActionModel(fn, mem, docPtr, fn.EPDFDoc_GetPageActionModel(docPtr, pageObjectNumber, 1), budget);
 	if (open) actions.open = open;
 	if (close) actions.close = close;
 	return open || close ? actions : void 0;
@@ -2822,167 +3157,67 @@ function readLine(fn, mem, annotPtr, base) {
 	};
 }
 //#endregion
-//#region src/features/annotations/internal/destinationViewCodes.ts
-/**
-* `PDFDEST_VIEW_*` fit-type codes (public/fpdf_doc.h) — the shared
-* vocabulary of `FPDFDest_GetView` (read) and `EPDFDest_CreateView`
-* (write). XYZ is listed for completeness but never goes through
-* CreateView (it has its own null-aware constructor).
-*/
-const DEST_VIEW = {
-	unknown: 0,
-	xyz: 1,
-	fit: 2,
-	fitH: 3,
-	fitV: 4,
-	fitR: 5,
-	fitB: 6,
-	fitBH: 7,
-	fitBV: 8
-};
-/** Wire destination kind → PDFDEST_VIEW code, for the non-XYZ kinds. */
-const VIEW_CODE_BY_KIND = {
-	fit: DEST_VIEW.fit,
-	fitH: DEST_VIEW.fitH,
-	fitV: DEST_VIEW.fitV,
-	fitR: DEST_VIEW.fitR,
-	fitB: DEST_VIEW.fitB,
-	fitBH: DEST_VIEW.fitBH,
-	fitBV: DEST_VIEW.fitBV
-};
-//#endregion
-//#region src/features/annotations/internal/read/readDestination.ts
-const MAX_VIEW_PARAMS = 4;
-/**
-* Materialise one explicit `PdfDestination` from a live `destPtr`. PDFium
-* already resolved named destinations before handing us the pointer, so
-* only explicit arrays arrive here (the rule `PdfDestination` documents).
-*
-* Returns `null` when the destination is unreadable: no visible indirect page
-* in the document, or an unknown fit type. Coordinates stay raw PDF user
-* space — no conversion at this layer.
-*
-* Shared by the link reader today; the outline/bookmark port reuses it.
-*/
-function readDestination(fn, mem, docPtr, destPtr) {
-	const pageObjectNumber = fn.EPDFDest_GetPageObjectNumber(docPtr, destPtr);
-	if (pageObjectNumber === 0) return null;
-	const view = withScratchN(mem, [4, MAX_VIEW_PARAMS * 4], ([countPtr, paramsPtr]) => {
-		const code = fn.FPDFDest_GetView(destPtr, countPtr, paramsPtr);
-		const count = Math.min(readI32(mem, countPtr), MAX_VIEW_PARAMS);
-		const params = [];
-		for (let i = 0; i < count; i++) params.push(readF32(mem, paramsPtr, i * 4));
-		return {
-			code,
-			params
-		};
-	});
-	const at = (i) => i < view.params.length ? view.params[i] : null;
-	switch (view.code) {
-		case DEST_VIEW.xyz: return {
-			kind: "xyz",
-			pageObjectNumber,
-			...readXyzLocation(fn, mem, destPtr)
-		};
-		case DEST_VIEW.fit: return {
-			kind: "fit",
-			pageObjectNumber
-		};
-		case DEST_VIEW.fitH: return {
-			kind: "fitH",
-			pageObjectNumber,
-			top: at(0)
-		};
-		case DEST_VIEW.fitV: return {
-			kind: "fitV",
-			pageObjectNumber,
-			left: at(0)
-		};
-		case DEST_VIEW.fitR:
-			if (view.params.length < 4) return {
-				kind: "fit",
-				pageObjectNumber
-			};
-			return {
-				kind: "fitR",
-				pageObjectNumber,
-				left: view.params[0],
-				bottom: view.params[1],
-				right: view.params[2],
-				top: view.params[3]
-			};
-		case DEST_VIEW.fitB: return {
-			kind: "fitB",
-			pageObjectNumber
-		};
-		case DEST_VIEW.fitBH: return {
-			kind: "fitBH",
-			pageObjectNumber,
-			top: at(0)
-		};
-		case DEST_VIEW.fitBV: return {
-			kind: "fitBV",
-			pageObjectNumber,
-			left: at(0)
-		};
-		default: return null;
-	}
-}
-/** `/XYZ` null-aware axes via `FPDFDest_GetLocationInPage` (FPDF_BOOL is 4 bytes). */
-function readXyzLocation(fn, mem, destPtr) {
-	return withScratchN(mem, [
-		4,
-		4,
-		4,
-		4,
-		4,
-		4
-	], ([hasLeft, hasTop, hasZoom, left, top, zoom]) => {
-		if (!fn.FPDFDest_GetLocationInPage(destPtr, hasLeft, hasTop, hasZoom, left, top, zoom)) return {
-			left: null,
-			top: null,
-			zoom: null
-		};
-		return {
-			left: readI32(mem, hasLeft) ? readF32(mem, left) : null,
-			top: readI32(mem, hasTop) ? readF32(mem, top) : null,
-			zoom: readI32(mem, hasZoom) ? readF32(mem, zoom) : null
-		};
-	});
-}
-//#endregion
 //#region src/features/annotations/internal/read/readLinkAnnotation.ts
 /**
 * Link reader: rect/flags/relationship ride the base (a link grouped to an
 * annotation is plain `inReplyTo` + `replyType: 'group'`); this module only
 * materialises the normalized target.
 *
-* ONE truth, two views: the target is projected off the SAME fork action
-* model the scripting plane reads (`base.actions`) — root classification
-* via the full `EPDF_ACTION_TYPE_*` vocabulary, payloads via the on-demand
-* node getters. The classic `FPDFAction_*` surface (5 types, JavaScript-
-* and Named-blind) is deliberately not consulted; `FPDFLink_GetDest`
-* remains only for the data-only direct `/Dest`, which is not an action.
+* ONE truth, one projection: the target is a pure function of the SAME
+* payload-carrying action tree the scripting plane reads
+* (`base.actions.activate`) — no second native read exists any more, so the
+* two action-shaped surfaces cannot drift by construction.
 *
-* `/A` wins over `/Dest` — the spec forbids carrying both, and when a
-* malformed file has both, Acrobat gives the action precedence. (Our own
-* writes can't produce that state: `EPDFAnnot_SetAction` strips `/Dest`.)
+* `/A` precedence, pinned: an activate action that exists but cannot be
+* executed (an `incomplete` tree, a degraded/unreadable root) projects
+* `unsupported` — a broken action is a dead link, never an invitation to
+* guess. The direct `/Dest` (which is data, not an action) is consulted
+* ONLY when no `/A` exists at all.
 */
 function readLink(fn, mem, annotPtr, base, _rawSubtypeCode, ctx) {
 	return {
 		...base,
 		subtype: "link",
-		target: readLinkTarget(fn, mem, annotPtr, ctx)
+		target: readLinkTarget(fn, mem, annotPtr, base, ctx)
 	};
 }
-function readLinkTarget(fn, mem, annotPtr, ctx) {
-	const modelPtr = fn.EPDFAnnot_GetActionModel(annotPtr, 0);
-	if (modelPtr !== NULL_PTR) try {
-		const root = fn.EPDFAction_GetRootNode(modelPtr);
-		if (isValidActionNodeId(root)) return readRootTarget(fn, mem, modelPtr, root, ctx);
-	} finally {
-		fn.EPDFAction_CloseModel(modelPtr);
+/**
+* Project the navigation view from a payload-carrying activate tree. Pure —
+* shared with any consumer that wants the root-level navigation reading of a
+* tree (the link plugin's no-actions-plugin fallback uses the same law).
+*/
+function linkTargetFromActionTree(tree) {
+	if (tree.incomplete) return { kind: "unsupported" };
+	const root = tree.root;
+	if (!root) return { kind: "unsupported" };
+	switch (root.type) {
+		case "goto": return {
+			kind: "goto",
+			destination: root.destination
+		};
+		case "uri": return {
+			kind: "uri",
+			uri: root.uri
+		};
+		case "goto-remote": return {
+			kind: "goto-remote",
+			file: root.filePath
+		};
+		case "launch": return {
+			kind: "launch",
+			path: root.filePath
+		};
+		case "javascript": return { kind: "javascript" };
+		case "named": return {
+			kind: "named",
+			name: root.name
+		};
+		default: return { kind: "unsupported" };
 	}
+}
+function readLinkTarget(fn, mem, annotPtr, base, ctx) {
+	const activate = base.actions?.activate;
+	if (activate) return linkTargetFromActionTree(activate);
 	const linkPtr = fn.FPDFAnnot_GetLink(annotPtr);
 	if (!linkPtr) return null;
 	const destPtr = fn.FPDFLink_GetDest(ctx.docPtr, linkPtr);
@@ -2993,43 +3228,6 @@ function readLinkTarget(fn, mem, annotPtr, ctx) {
 		destination
 	} : { kind: "unsupported" };
 }
-/** Classify the root action node and fetch its payload — the projection. */
-function readRootTarget(fn, mem, modelPtr, node, ctx) {
-	switch (actionTypeFromCode(fn.EPDFAction_GetNodeType(modelPtr, node))) {
-		case "goto": {
-			const destPtr = fn.EPDFAction_GetNodeDest(ctx.docPtr, modelPtr, node);
-			const destination = destPtr ? readDestination(fn, mem, ctx.docPtr, destPtr) : null;
-			return destination ? {
-				kind: "goto",
-				destination
-			} : { kind: "unsupported" };
-		}
-		case "uri": {
-			const uri = readUtf8String(mem, (buf, capacity) => fn.EPDFAction_GetNodeURI(ctx.docPtr, modelPtr, node, buf, capacity));
-			return uri == null ? { kind: "unsupported" } : {
-				kind: "uri",
-				uri
-			};
-		}
-		case "goto-remote": return {
-			kind: "goto-remote",
-			file: readUtf8String(mem, (buf, capacity) => fn.EPDFAction_GetNodeFilePath(modelPtr, node, buf, capacity)) ?? ""
-		};
-		case "launch": return {
-			kind: "launch",
-			path: readUtf8String(mem, (buf, capacity) => fn.EPDFAction_GetNodeFilePath(modelPtr, node, buf, capacity)) ?? ""
-		};
-		case "javascript": return { kind: "javascript" };
-		case "named": {
-			const name = readUtf8String(mem, (buf, capacity) => fn.EPDFAction_GetNodeName(modelPtr, node, buf, capacity));
-			return name == null ? { kind: "unsupported" } : {
-				kind: "named",
-				name
-			};
-		}
-		default: return { kind: "unsupported" };
-	}
-}
 //#endregion
 //#region src/features/annotations/internal/read/readRedactAnnotation.ts
 /** Default `/C` marking outline (red) — the redaction marking convention and
@@ -3539,7 +3737,7 @@ function readOptions(runtime, model, fieldIndex) {
 	return options;
 }
 /** Read one field of the native model into its per-family DTO. */
-function readFieldAt(runtime, model, fieldIndex, actionBudget = new ActionReadBudgetTracker()) {
+function readFieldAt(runtime, model, fieldIndex, docPtr, actionBudget = new ActionReadBudgetTracker()) {
 	const { fn } = runtime;
 	const fieldObjectNumber = fn.EPDFForm_GetFieldObjNum(model, fieldIndex);
 	const name = readWide(runtime, (buf, cap) => fn.EPDFForm_GetFieldName(model, fieldIndex, buf, cap));
@@ -3547,7 +3745,7 @@ function readFieldAt(runtime, model, fieldIndex, actionBudget = new ActionReadBu
 	const family = FAMILY_BY_CODE[fn.EPDFForm_GetFieldFamily(model, fieldIndex)] ?? "unknown";
 	const valueEntry = readValueEntry(runtime, model, fieldIndex, false);
 	const defaultValueEntry = readValueEntry(runtime, model, fieldIndex, true);
-	const actions = readFieldActions(runtime, model, fieldIndex, actionBudget);
+	const actions = readFieldActions(runtime, model, fieldIndex, docPtr, actionBudget);
 	const base = {
 		ref: fieldObjectNumber > 0 ? {
 			kind: "objectNumber",
@@ -3646,12 +3844,12 @@ function readFieldAt(runtime, model, fieldIndex, actionBudget = new ActionReadBu
 	}
 }
 /** Read the whole native model into a detached {@link FormSnapshot}. */
-function readFormSnapshot(runtime, model) {
+function readFormSnapshot(runtime, model, docPtr) {
 	const { fn } = runtime;
 	const count = fn.EPDFForm_CountFields(model);
 	const fields = [];
 	const actionBudget = new ActionReadBudgetTracker();
-	for (let i = 0; i < count; i++) fields.push(readFieldAt(runtime, model, i, actionBudget));
+	for (let i = 0; i < count; i++) fields.push(readFieldAt(runtime, model, i, docPtr, actionBudget));
 	const calculationOrder = [];
 	const calculationCount = fn.EPDFForm_CountCalculationOrder(model);
 	for (let index = 0; index < calculationCount; index++) {
@@ -3687,7 +3885,7 @@ function entryScalar(entry) {
 	if (entry.kind === "array") return entry.values[0] ?? "";
 	return "";
 }
-function readFieldActions(runtime, model, fieldIndex, budget) {
+function readFieldActions(runtime, model, fieldIndex, docPtr, budget) {
 	const { fn, mem } = runtime;
 	const entries = [
 		["keystroke", 0],
@@ -3697,7 +3895,7 @@ function readFieldActions(runtime, model, fieldIndex, budget) {
 	];
 	const actions = {};
 	for (const [key, event] of entries) {
-		const action = readActionModel(fn, mem, fn.EPDFForm_GetFieldActionModel(model, fieldIndex, event), budget);
+		const action = readActionModel(fn, mem, docPtr, fn.EPDFForm_GetFieldActionModel(model, fieldIndex, event), budget);
 		if (action) actions[key] = action;
 	}
 	return Object.keys(actions).length > 0 ? actions : void 0;
@@ -3943,7 +4141,7 @@ function blendModeFromCode(code) {
 * per-subtype reader builds its DTO by extending this with its own
 * fields and `subtype: '...'` discriminator.
 */
-function readAnnotationBase(fn, mem, annotPtr, pageObjectNumber, index, revision, actionBudget = new ActionReadBudgetTracker()) {
+function readAnnotationBase(fn, mem, docPtr, annotPtr, pageObjectNumber, index, revision, actionBudget = new ActionReadBudgetTracker()) {
 	const identity = readAnnotationIdentity(fn, mem, annotPtr, pageObjectNumber, index, revision);
 	const rect = readAnnotRect(fn, mem, annotPtr);
 	const flags = readAnnotFlags(fn, annotPtr);
@@ -3955,7 +4153,7 @@ function readAnnotationBase(fn, mem, annotPtr, pageObjectNumber, index, revision
 	const blendMode = blendModeFromCode(fn.EPDFAnnot_GetBlendMode(annotPtr));
 	const embd = readEmbedMetadata(fn, mem, annotPtr);
 	const relationship = readAnnotationRelationship(fn, mem, annotPtr, pageObjectNumber);
-	const actions = readAnnotationActions(fn, mem, annotPtr, actionBudget);
+	const actions = readAnnotationActions(fn, mem, docPtr, annotPtr, actionBudget);
 	return {
 		ref: identity.ref,
 		pageObjectNumber,
@@ -3979,7 +4177,7 @@ function readAnnotationBase(fn, mem, annotPtr, pageObjectNumber, index, revision
 		...actions ? { actions } : {}
 	};
 }
-function readAnnotationActions(fn, mem, annotPtr, budget) {
+function readAnnotationActions(fn, mem, docPtr, annotPtr, budget) {
 	const events = [
 		["activate", 0],
 		["cursorEnter", 1],
@@ -3995,7 +4193,7 @@ function readAnnotationActions(fn, mem, annotPtr, budget) {
 	];
 	const actions = {};
 	for (const [key, event] of events) {
-		const action = readActionModel(fn, mem, fn.EPDFAnnot_GetActionModel(annotPtr, event), budget);
+		const action = readActionModel(fn, mem, docPtr, fn.EPDFAnnot_GetActionModel(annotPtr, event), budget);
 		if (action) actions[key] = action;
 	}
 	return Object.keys(actions).length > 0 ? actions : void 0;
@@ -4026,7 +4224,7 @@ function collectPageAnnotations(input) {
 		const annotPtr = getAnnotPtrAt(i);
 		if (!annotPtr) continue;
 		try {
-			const base = readAnnotationBase(fn, mem, annotPtr, pageObjectNumber, i, revision, actionBudget);
+			const base = readAnnotationBase(fn, mem, readCtx.docPtr, annotPtr, pageObjectNumber, i, revision, actionBudget);
 			const subtypeCode = fn.FPDFAnnot_GetSubtype(annotPtr);
 			const { reader } = pickReader(subtypeCode);
 			const dto = reader(fn, mem, annotPtr, base, subtypeCode, readCtx);
@@ -4964,7 +5162,7 @@ function computeMutationImpact(inputs) {
 *     `AnnotationUpdateResult.updated`.
 */
 function readAnnotationFromPtr(fn, mem, annotPtr, pageObjectNumber, index, revision, ctx) {
-	const base = readAnnotationBase(fn, mem, annotPtr, pageObjectNumber, index, revision);
+	const base = readAnnotationBase(fn, mem, ctx.docPtr, annotPtr, pageObjectNumber, index, revision);
 	const subtypeCode = fn.FPDFAnnot_GetSubtype(annotPtr);
 	const { reader } = pickReader(subtypeCode);
 	return reader(fn, mem, annotPtr, base, subtypeCode, ctx);
@@ -8182,13 +8380,13 @@ var FormReader = class {
 	snapshot(signal) {
 		throwIfAborted(signal);
 		const model = acquireFormModel(this.runtime, this.session);
-		return readFormSnapshot(this.runtime, model);
+		return readFormSnapshot(this.runtime, model, this.session.requireDocPtr());
 	}
 	field(ref, signal) {
 		throwIfAborted(signal);
 		const model = acquireFormModel(this.runtime, this.session);
 		const { fieldIndex } = resolveFieldRef(this.runtime, model, ref);
-		return readFieldAt(this.runtime, model, fieldIndex);
+		return readFieldAt(this.runtime, model, fieldIndex, this.session.requireDocPtr());
 	}
 	/**
 	* Serialize form data. Exports read the reconciled view (recovered
@@ -8344,7 +8542,7 @@ var FormMutator = class {
 		const model = acquireFormModel(this.runtime, this.session);
 		const resolved = resolveFieldRef(this.runtime, model, ref);
 		this.assertWritable(resolved.fieldObjectNumber);
-		const before = readFieldAt(this.runtime, model, resolved.fieldIndex);
+		const before = readFieldAt(this.runtime, model, resolved.fieldIndex, this.session.requireDocPtr());
 		if (!FAMILY_BY_VALUE_TYPE[value.type].includes(before.family)) throw new EngineError(EngineErrorCode.InvalidArg, `value type '${value.type}' does not apply to a '${before.family}' field`);
 		const changed = this.applyWrite(resolved.fieldObjectNumber, value);
 		return this.readBack(resolved.fieldObjectNumber, changed);
@@ -8380,7 +8578,7 @@ var FormMutator = class {
 		const fresh = acquireFormModel(this.runtime, this.session);
 		return {
 			...counters,
-			snapshot: readFormSnapshot(this.runtime, fresh),
+			snapshot: readFormSnapshot(this.runtime, fresh, this.session.requireDocPtr()),
 			meta: EMPTY_META$1
 		};
 	}
@@ -8453,7 +8651,7 @@ var FormMutator = class {
 		const model = acquireFormModel(this.runtime, this.session);
 		const resolved = resolveFieldRef(this.runtime, model, ref);
 		this.assertWritable(resolved.fieldObjectNumber);
-		const before = readFieldAt(this.runtime, model, resolved.fieldIndex);
+		const before = readFieldAt(this.runtime, model, resolved.fieldIndex, this.session.requireDocPtr());
 		if (before.family !== patch.family) throw new EngineError(EngineErrorCode.InvalidArg, `patch family '${patch.family}' does not match field family '${before.family}'`);
 		const fieldObjectNumber = resolved.fieldObjectNumber;
 		if (patch.name !== void 0) this.applyWideSetter(fn.EPDFForm_SetFieldName, fieldObjectNumber, patch.name, `cannot rename to "${patch.name}" (sibling conflict or invalid)`);
@@ -8484,7 +8682,7 @@ var FormMutator = class {
 		const model = acquireFormModel(this.runtime, this.session);
 		const resolved = resolveFieldRef(this.runtime, model, ref);
 		this.assertWritable(resolved.fieldObjectNumber);
-		const before = readFieldAt(this.runtime, model, resolved.fieldIndex);
+		const before = readFieldAt(this.runtime, model, resolved.fieldIndex, this.session.requireDocPtr());
 		if (!withScratchN(mem, [256 * 4, 4], ([buf, countPtr]) => {
 			mem.poke(countPtr, "i32", 0);
 			return fn.EPDFForm_DeleteField(this.session.requireDocPtr(), resolved.fieldObjectNumber, buf, 256, countPtr);
@@ -8504,7 +8702,7 @@ var FormMutator = class {
 		const model = acquireFormModel(this.runtime, this.session);
 		const resolved = resolveFieldRef(this.runtime, model, ref);
 		this.assertWritable(resolved.fieldObjectNumber);
-		const before = readFieldAt(this.runtime, model, resolved.fieldIndex);
+		const before = readFieldAt(this.runtime, model, resolved.fieldIndex, this.session.requireDocPtr());
 		const toggle = before.family === "checkbox" || before.family === "radio";
 		const state = toggle ? onState ?? (before.family === "checkbox" ? "Yes" : "") : "";
 		if (toggle && (!state || state === "Off")) throw new EngineError(EngineErrorCode.InvalidArg, "attaching to a radio group needs a non-\"Off\" onState");
@@ -8550,7 +8748,7 @@ var FormMutator = class {
 		const fresh = acquireFormModel(this.runtime, this.session);
 		const fieldIndex = this.runtime.fn.EPDFForm_GetFieldIndexByObjNum(fresh, fieldObjectNumber);
 		if (fieldIndex < 0) throw new EngineError(EngineErrorCode.Unknown, "form field vanished after write");
-		return readFieldAt(this.runtime, fresh, fieldIndex);
+		return readFieldAt(this.runtime, fresh, fieldIndex, this.session.requireDocPtr());
 	}
 	assertWritable(fieldObjectNumber) {
 		if (fieldObjectNumber === 0) throw new EngineError(EngineErrorCode.InvalidArg, "form field is stored as a direct object and cannot be written");
@@ -8596,7 +8794,7 @@ var FormMutator = class {
 		const fresh = acquireFormModel(this.runtime, this.session);
 		const fieldIndex = this.runtime.fn.EPDFForm_GetFieldIndexByObjNum(fresh, fieldObjectNumber);
 		if (fieldIndex < 0) throw new EngineError(EngineErrorCode.Unknown, "form field vanished after write");
-		const field = readFieldAt(this.runtime, fresh, fieldIndex);
+		const field = readFieldAt(this.runtime, fresh, fieldIndex, this.session.requireDocPtr());
 		const changedSet = new Set(changedObjNums);
 		return {
 			field,
@@ -8742,7 +8940,7 @@ var FormsEffectsApplier = class {
 			if (refs.length === 0) throw new EngineError(EngineErrorCode.InvalidArg, "reset effect requires at least one field");
 			const model = acquireFormModel(this.runtime, this.session);
 			const resolved = refs.map((ref) => this.resolve(model, ref));
-			const fields = resolved.map(({ fieldIndex }) => readFieldAt(this.runtime, model, fieldIndex, actionBudget));
+			const fields = resolved.map(({ fieldIndex }) => readFieldAt(this.runtime, model, fieldIndex, this.session.requireDocPtr(), actionBudget));
 			validateEffect(effect, fields);
 			return {
 				effect,
@@ -8767,7 +8965,7 @@ var FormsEffectsApplier = class {
 		const model = acquireFormModel(this.runtime, this.session);
 		const index = this.runtime.fn.EPDFForm_GetFieldIndexByObjNum(model, fieldObjectNumber);
 		if (index < 0) throw new EngineError(EngineErrorCode.InvalidReference, "form field disappeared");
-		return readFieldAt(this.runtime, model, index, actionBudget);
+		return readFieldAt(this.runtime, model, index, this.session.requireDocPtr(), actionBudget);
 	}
 	readFieldsBestEffort(fieldObjectNumbers, actionBudget) {
 		const fields = [];
@@ -9134,22 +9332,26 @@ var DocumentActionsReader = class {
 			} finally {
 				fn.FPDFDoc_CloseJavaScriptAction(namedPtr);
 			}
-			const action = requireAction(readActionModel(fn, mem, fn.EPDFDoc_GetNamedJavaScriptActionModel(docPtr, index), budget), "name-tree script", index);
+			budget.reservePayloadBytes(name.length);
+			const action = requireAction(readActionModel(fn, mem, docPtr, fn.EPDFDoc_GetNamedJavaScriptActionModel(docPtr, index), budget), "name-tree script", index);
 			nameTreeScripts.push({
 				name,
 				action
 			});
 		}
-		const openAction = readActionModel(fn, mem, fn.EPDFDoc_GetOpenActionModel(docPtr), budget);
+		const openAction = readActionModel(fn, mem, docPtr, fn.EPDFDoc_GetOpenActionModel(docPtr), budget);
+		const openDestPtr = openAction ? NULL_PTR : fn.EPDFDoc_GetOpenActionDest(docPtr);
+		const openDestination = openDestPtr !== NULL_PTR ? readDestination(fn, mem, docPtr, openDestPtr) : null;
 		const additional = {};
 		for (const [key, event] of DOCUMENT_ACTION_EVENTS) {
 			throwIfAborted(signal);
-			const action = readActionModel(fn, mem, fn.EPDFDoc_GetAdditionalActionModel(docPtr, event), budget);
+			const action = readActionModel(fn, mem, docPtr, fn.EPDFDoc_GetAdditionalActionModel(docPtr, event), budget);
 			if (action) additional[key] = action;
 		}
 		return {
 			nameTreeScripts,
 			openAction,
+			openDestination,
 			...additional
 		};
 	}