@embedpdf/engine-services 3.0.0-next.15 → 3.0.0-next.16

package/dist/index.cjs

@@ -1264,7 +1264,7 @@ var DocumentSession = class {
 	* Nothing else creates objects at held numbers, so a held number is free
 	* otherwise; the fork checks that again as it creates.
 	*/
-	useObjectNumber(objectNumber) {
+	claimObjectNumber(objectNumber) {
 		if (!Number.isInteger(objectNumber) || objectNumber < 1) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, `${objectNumber} is not an object number`, { details: { field: "objectNumber" } });
 		if (this.objectNumberAuthority === "session" && !this.heldObjectNumbers.has(objectNumber)) throw objectNumberUnavailable(objectNumber, "not-held");
 		if (this.objectNumbersInUse.includes(objectNumber)) throw objectNumberUnavailable(objectNumber, "taken");
@@ -2420,6 +2420,10 @@ function readBoxes(fn, mem, docPtr, index, rectPtr) {
 		art: read(BOX_ART)
 	});
 }
+/** The turn of the page at `index` as it reads: its own `/Rotate`, or the one it inherits. */
+function rotationAt(runtime, docPtr, index) {
+	return withScratch(runtime.mem, 4, (intPtr) => readRotation(runtime.fn, runtime.mem, docPtr, index, intPtr));
+}
 /** The page's turn: its `/Rotate` as written, read by the rules of `pageRotationOf`. */
 function readRotation(fn, mem, docPtr, index, intPtr) {
 	if (!fn.EPDF_GetPageRotateByIndex(docPtr, index, intPtr)) return 0;
@@ -2698,12 +2702,18 @@ var PagesMutator = class {
 //#endregion
 //#region src/features/pages/PagesExtractor.ts
 const FPDF_NO_INCREMENTAL$3 = 2;
+const FLAT_NORMALDISPLAY = 0;
+const FLAT_PRINT = 1;
+const EXPORT_FLATTENED_ANNOTATIONS = 1;
+const EXPORT_FLATTENED_FORM_FIELDS = 2;
 /**
 * Export a subset of pages as a standalone PDF. A read over the session:
-* `FPDF_ImportPagesByIndex` copies pages into a scratch document, so the
-* source is untouched — no registry refresh, no layer
-* artifact. Lives next to `PagesReader`/`PagesMutator` (one file per page
-* verb family) so both worker hosts share the code path.
+* the pages are copied into a scratch document, so the source is untouched —
+* no registry refresh, no layer artifact. A plain copy is
+* `FPDF_ImportPagesByIndex`; a flattened one `EPDFDoc_ExportPagesFlattened`,
+* which copies the pages as they draw. Either keeps the document's title.
+* Lives next to `PagesReader`/`PagesMutator` (one file per page verb family)
+* so both worker hosts share the code path.
 */
 var PagesExtractor = class {
 	constructor(runtime, session) {
@@ -2712,11 +2722,13 @@ var PagesExtractor = class {
 	}
 	/**
 	* Copy the given pages, in the supplied caller order, into a new
-	* document and serialize it. Validation up front: non-empty, no
-	* duplicates, every page object number resolvable (`NotFound` from the session on a
-	* bad one). The scratch document is always closed, success or throw.
+	* document and serialize it: as they are, or, with `flatten`, as they draw
+	* (checked against the caller's rights before it gets here). Validation up
+	* front: non-empty, no duplicates, every page object number resolvable
+	* (`NotFound` from the session on a bad one). The scratch document is
+	* always closed, success or throw.
 	*/
-	extract(pages, signal) {
+	extract(pages, flatten, signal) {
 		throwIfAborted(signal);
 		if (pages.length === 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "pages.extract requires at least one page");
 		const pageObjectNumbers = this.session.resolvePageRefs(pages);
@@ -2728,14 +2740,20 @@ var PagesExtractor = class {
 		const indices = pageObjectNumbers.map((pageObjectNumber) => this.session.recordByObjectNumber(pageObjectNumber).pageIndex);
 		const { fn, mem } = this.runtime;
 		const srcPtr = this.session.requireDocPtr();
-		const destPtr = fn.FPDF_CreateNewDocument();
-		if (!destPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "FPDF_CreateNewDocument failed");
 		const idxPtr = mem.alloc(4 * indices.length);
+		for (let i = 0; i < indices.length; i++) mem.poke(idxPtr, "i32", indices[i], 4 * i);
+		let destPtr;
+		try {
+			destPtr = flatten ? this.copyFlattened(srcPtr, idxPtr, indices, flatten) : this.copyPlain(srcPtr, idxPtr, indices);
+		} catch (error) {
+			mem.free(idxPtr);
+			throw error;
+		}
 		const sizePtr = mem.alloc(8);
 		let pdfPtr = null;
 		try {
-			for (let i = 0; i < indices.length; i++) mem.poke(idxPtr, "i32", indices[i], 4 * i);
-			if (!fn.FPDF_ImportPagesByIndex(destPtr, srcPtr, idxPtr, indices.length, 0)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `FPDF_ImportPagesByIndex rejected the request (indices=[${indices.join(",")}])`);
+			const title = readMetaText(fn, mem, srcPtr, "Title");
+			if (title !== null) writeMetaText(fn, mem, destPtr, "Title", title);
 			pokeU64(mem, sizePtr, 0);
 			pdfPtr = fn.EPDF_SaveDocumentToOwnedBuffer(destPtr, FPDF_NO_INCREMENTAL$3, sizePtr);
 			const size = Number(mem.peek(sizePtr, "i32"));
@@ -2754,6 +2772,28 @@ var PagesExtractor = class {
 			fn.FPDF_CloseDocument(destPtr);
 		}
 	}
+	/** A new document with copies of the pages at `indices`, as they are. */
+	copyPlain(srcPtr, idxPtr, indices) {
+		const { fn } = this.runtime;
+		const destPtr = fn.FPDF_CreateNewDocument();
+		if (!destPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "FPDF_CreateNewDocument failed");
+		if (!fn.FPDF_ImportPagesByIndex(destPtr, srcPtr, idxPtr, indices.length, 0)) {
+			fn.FPDF_CloseDocument(destPtr);
+			throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `FPDF_ImportPagesByIndex rejected the request (indices=[${indices.join(",")}])`);
+		}
+		return destPtr;
+	}
+	/**
+	* A new document with the pages at `indices` as they draw for
+	* `flatten.usage`: what `flatten` includes painted in, nothing interactive
+	* left, layers in their state for the usage.
+	*/
+	copyFlattened(srcPtr, idxPtr, indices, flatten) {
+		const flags = (flatten.includeAnnotations ? EXPORT_FLATTENED_ANNOTATIONS : 0) | (flatten.includeFormFields ? EXPORT_FLATTENED_FORM_FIELDS : 0);
+		const destPtr = this.runtime.fn.EPDFDoc_ExportPagesFlattened(srcPtr, idxPtr, indices.length, flatten.usage === "print" ? FLAT_PRINT : FLAT_NORMALDISPLAY, flags);
+		if (!destPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `EPDFDoc_ExportPagesFlattened rejected the request (indices=[${indices.join(",")}])`);
+		return destPtr;
+	}
 };
 //#endregion
 //#region src/features/annotations/internal/write/promoteInlineAnnotations.ts
@@ -2852,7 +2892,7 @@ var PagesInserter = class {
 		const destPtr = this.session.requireDocPtr();
 		const at = pageIndexAt(this.session, position, fn.FPDF_GetPageCount(destPtr));
 		if (objectNumbers && objectNumbers.length !== count) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, `pages.insertBlank needs one object number per page: ${objectNumbers.length} for ${count}`, { details: { field: "objectNumbers" } });
-		for (const objectNumber of objectNumbers ?? []) this.session.useObjectNumber(objectNumber);
+		for (const objectNumber of objectNumbers ?? []) this.session.claimObjectNumber(objectNumber);
 		for (let i = 0; i < count; i++) {
 			const objectNumber = objectNumbers?.[i];
 			if (!fn.EPDFPage_InsertBlankRaw(destPtr, at + i, size.width, size.height, objectNumber ?? 0)) {
@@ -3874,6 +3914,11 @@ function toExactArrayBuffer(bytes) {
 const FPDF_RENDER_ANNOT = 1;
 /** `EPDF_RENDER_WIDGETS`: the form fields' widgets. */
 const EPDF_RENDER_WIDGETS = 32768;
+/**
+* `FPDF_PRINTING`: the print rules. Layers take their print state, and
+* annotations and widgets draw by their `print` flag (no-view ones too).
+*/
+const FPDF_PRINTING = 2048;
 const FPDF_RENDER_TOBECONTINUED = 1;
 const FPDF_RENDER_DONE = 2;
 var PageRenderReader = class {
@@ -3893,6 +3938,8 @@ var PageRenderReader = class {
 		const pagePtr = await pool.acquireInSlices(pageObjectNumber, signal, slices);
 		try {
 			throwIfAborted(signal);
+			(0, _embedpdf_engine_core_runtime.checkRenderUsage)(options, null);
+			const print = options.usage === "print";
 			const page = readPageBox(this.runtime, pagePtr);
 			const target = resolveTarget(options.target, page);
 			const rotation = options.rotation ?? 0;
@@ -3907,6 +3954,7 @@ var PageRenderReader = class {
 			let flags = 16;
 			if (layers.includeAnnotations) flags |= FPDF_RENDER_ANNOT;
 			if (layers.includeFormFields) flags |= EPDF_RENDER_WIDGETS;
+			if (print) flags |= FPDF_PRINTING;
 			const raster = await rasterizeAsync(this.runtime, {
 				rect: target,
 				page,
@@ -4790,7 +4838,7 @@ function extractAttachmentToBuffer(runtime, attachmentPtr, maxDecodedBytes) {
 		mem.poke(bufPtrSlot, "ptr", 0);
 		mem.poke(sizePtr, "i32", 0);
 		mem.poke(statusPtr, "i32", -1);
-		if (!fn.EPDFAttachment_ExtractFileToOwnedBuffer(attachmentPtr, BigInt(maxDecodedBytes ?? 0), bufPtrSlot, sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")));
+		if (!fn.EPDFAttachment_ExtractFileToOwnedBuffer(attachmentPtr, BigInt(maxDecodedBytes ?? 0), bufPtrSlot, sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")), maxDecodedBytes);
 		const size = Number(mem.peek(sizePtr, "i32")) >>> 0;
 		dataPtr = mem.peek(bufPtrSlot, "ptr");
 		if (size === 0 || !dataPtr) return {
@@ -4826,7 +4874,7 @@ function extractAttachmentToFile(runtime, attachmentPtr, path, maxDecodedBytes)
 	try {
 		mem.poke(sizePtr, "i32", 0);
 		mem.poke(statusPtr, "i32", -1);
-		if (!fn.EPDFAttachment_ExtractFile(attachmentPtr, writer.ptr, BigInt(maxDecodedBytes ?? 0), sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")));
+		if (!fn.EPDFAttachment_ExtractFile(attachmentPtr, writer.ptr, BigInt(maxDecodedBytes ?? 0), sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")), maxDecodedBytes);
 		return { size: Number(mem.peek(sizePtr, "i32")) >>> 0 };
 	} finally {
 		writer.close();
@@ -4835,11 +4883,11 @@ function extractAttachmentToFile(runtime, attachmentPtr, path, maxDecodedBytes)
 	}
 }
 /** `EPDFAttachmentExtractStatus` (public/fpdf_attachment.h) → EngineError. */
-function extractStatusError(status) {
+function extractStatusError(status, maxDecodedBytes) {
 	switch (status) {
 		case 1: return new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "attachment has no embedded file stream (missing /EF)");
 		case 2: return new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.MalformedPdf, "embedded file stream failed to decode");
-		case 3: return new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.PayloadTooLarge, "embedded file exceeds the configured decoded-size limit");
+		case 3: return new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.PayloadTooLarge, `the embedded file decodes to more than ${maxDecodedBytes} bytes, the limit`, { details: { limit: maxDecodedBytes } });
 		case 4: return new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "writing the extracted attachment failed");
 		default: return new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `attachment extraction failed (status ${status})`);
 	}
@@ -5662,34 +5710,50 @@ function readLine(fn, mem, annotPtr, base) {
 	};
 }
 //#endregion
-//#region src/features/annotations/internal/read/readLinkAnnotation.ts
+//#region src/features/destinations/createDestination.ts
 /**
-* Link reader: rect/flags/relationship ride the base (a link grouped to an
-* annotation is plain `inReplyTo` + `replyType: 'group'`); this module only
-* materialises the normalized target.
-*
-* One truth, one projection: the target is a pure function of the same
-* payload-carrying action tree the scripting plane reads
-* (`base.actions.activate`) — no second native read exists any more, so the
-* two action-shaped surfaces cannot drift by construction.
-*
-* `/A` precedence, pinned: an activate action that exists but cannot be
-* executed (an `incomplete` tree, a degraded/unreadable root) projects
-* `unsupported` — a broken action is a dead link, never an invitation to
-* guess. The direct `/Dest` (which is data, not an action) is consulted
-* only when no `/A` exists at all.
+* Build an indirect explicit-destination array for `dest`. The target page
+* is named by its object number and never loaded: a destination only refers
+* to the page's dictionary.
 */
-function readLink(fn, mem, annotPtr, base, _rawSubtypeCode, ctx) {
-	return {
-		...base,
-		subtype: "link",
-		target: readLinkTarget(fn, mem, annotPtr, base, ctx)
-	};
+function createDestination(fn, mem, docPtr, dest) {
+	const page = dest.page.objectNumber;
+	const destPtr = dest.kind === "xyz" ? fn.EPDFDest_CreateXYZByObjectNumber(docPtr, page, dest.left != null, dest.left ?? 0, dest.top != null, dest.top ?? 0, dest.zoom != null, dest.zoom ?? 0) : createViewDestination(fn, mem, docPtr, page, dest);
+	if (!destPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `destination page not found: pageObjectNumber=${page}`);
+	return destPtr;
+}
+function createViewDestination(fn, mem, docPtr, page, dest) {
+	const params = (() => {
+		switch (dest.kind) {
+			case "fitH":
+			case "fitBH": return dest.top != null ? [dest.top] : [];
+			case "fitV":
+			case "fitBV": return dest.left != null ? [dest.left] : [];
+			case "fitR": return [
+				dest.left,
+				dest.bottom,
+				dest.right,
+				dest.top
+			];
+			default: return [];
+		}
+	})();
+	const view = VIEW_CODE_BY_KIND[dest.kind];
+	if (!params.length) return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, _embedpdf_engine_runtime.NULL_PTR, 0);
+	return withScratch(mem, params.length * 4, (buf) => {
+		for (let i = 0; i < params.length; i++) mem.poke(buf, "f32", params[i], i * 4);
+		return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, buf, params.length);
+	});
 }
+//#endregion
+//#region src/features/destinations/linkTarget.ts
 /**
-* Project the navigation view from a payload-carrying activate tree. Pure —
-* shared with any consumer that wants the root-level navigation reading of a
-* tree (the link plugin's no-actions-plugin fallback uses the same law).
+* A link target read the way every reader reads one (links, outline items):
+* the navigation view of a payload-carrying activate tree. Pure.
+*
+* The law, enforced at the projection too: never execute — not even
+* navigate the root of — a tree marked incomplete. A broken action is a
+* dead target, never an invitation to guess.
 */
 function linkTargetFromActionTree(tree) {
 	if (tree.incomplete) return { kind: "unsupported" };
@@ -5720,6 +5784,41 @@ function linkTargetFromActionTree(tree) {
 		default: return { kind: "unsupported" };
 	}
 }
+/**
+* A new indirect action of the document for a writable target: a GoTo to a
+* new destination, a URI, or a standard named verb. Links and outline items
+* write their targets with it, so both read back the same way.
+*/
+function createLinkTargetAction(fn, mem, docPtr, target) {
+	const actionPtr = target.kind === "uri" ? fn.EPDFAction_CreateURI(docPtr, target.uri) : target.kind === "named" ? fn.EPDFAction_CreateNamed(docPtr, target.name) : fn.EPDFAction_CreateGoTo(docPtr, createDestination(fn, mem, docPtr, target.destination));
+	if (!actionPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `failed to create '${target.kind}' action`);
+	return actionPtr;
+}
+//#endregion
+//#region src/features/annotations/internal/read/readLinkAnnotation.ts
+/**
+* Link reader: rect/flags/relationship ride the base (a link grouped to an
+* annotation is plain `inReplyTo` + `replyType: 'group'`); this module only
+* materialises the normalized target.
+*
+* One truth, one projection: the target is a pure function of the same
+* payload-carrying action tree the scripting plane reads
+* (`base.actions.activate`) — no second native read exists any more, so the
+* two action-shaped surfaces cannot drift by construction.
+*
+* `/A` precedence, pinned: an activate action that exists but cannot be
+* executed (an `incomplete` tree, a degraded/unreadable root) projects
+* `unsupported` — a broken action is a dead link, never an invitation to
+* guess. The direct `/Dest` (which is data, not an action) is consulted
+* only when no `/A` exists at all.
+*/
+function readLink(fn, mem, annotPtr, base, _rawSubtypeCode, ctx) {
+	return {
+		...base,
+		subtype: "link",
+		target: readLinkTarget(fn, mem, annotPtr, base, ctx)
+	};
+}
 function readLinkTarget(fn, mem, annotPtr, base, ctx) {
 	const activate = base.actions?.activate;
 	if (activate) return linkTargetFromActionTree(activate);
@@ -8525,42 +8624,6 @@ function isLineSubtype(subtype) {
 	return subtype === "line";
 }
 //#endregion
-//#region src/features/destinations/createDestination.ts
-/**
-* Build an indirect explicit-destination array for `dest`. The target page
-* is named by its object number and never loaded: a destination only refers
-* to the page's dictionary.
-*/
-function createDestination(fn, mem, docPtr, dest) {
-	const page = dest.page.objectNumber;
-	const destPtr = dest.kind === "xyz" ? fn.EPDFDest_CreateXYZByObjectNumber(docPtr, page, dest.left != null, dest.left ?? 0, dest.top != null, dest.top ?? 0, dest.zoom != null, dest.zoom ?? 0) : createViewDestination(fn, mem, docPtr, page, dest);
-	if (!destPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `destination page not found: pageObjectNumber=${page}`);
-	return destPtr;
-}
-function createViewDestination(fn, mem, docPtr, page, dest) {
-	const params = (() => {
-		switch (dest.kind) {
-			case "fitH":
-			case "fitBH": return dest.top != null ? [dest.top] : [];
-			case "fitV":
-			case "fitBV": return dest.left != null ? [dest.left] : [];
-			case "fitR": return [
-				dest.left,
-				dest.bottom,
-				dest.right,
-				dest.top
-			];
-			default: return [];
-		}
-	})();
-	const view = VIEW_CODE_BY_KIND[dest.kind];
-	if (!params.length) return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, _embedpdf_engine_runtime.NULL_PTR, 0);
-	return withScratch(mem, params.length * 4, (buf) => {
-		for (let i = 0; i < params.length; i++) mem.poke(buf, "f32", params[i], i * 4);
-		return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, buf, params.length);
-	});
-}
-//#endregion
 //#region src/features/annotations/internal/write/writeLinkAnnotation.ts
 /**
 * Link writer: rect + the `/A` action. `goto`, `uri` and the standard
@@ -8603,8 +8666,7 @@ function isLinkSubtype(subtype) {
 function applyLinkTarget(fn, mem, annotPtr, target, ctx) {
 	const docPtr = ctx?.docPtr;
 	if (!docPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "writing a link target requires a document pointer on the write context");
-	const actionPtr = target.kind === "uri" ? fn.EPDFAction_CreateURI(docPtr, target.uri) : target.kind === "named" ? fn.EPDFAction_CreateNamed(docPtr, target.name) : fn.EPDFAction_CreateGoTo(docPtr, createDestination(fn, mem, docPtr, target.destination));
-	if (!actionPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `failed to create '${target.kind}' action`);
+	const actionPtr = createLinkTargetAction(fn, mem, docPtr, target);
 	if (!fn.EPDFAnnot_SetAction(annotPtr, actionPtr)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "EPDFAnnot_SetAction failed for link");
 }
 //#endregion
@@ -9800,7 +9862,7 @@ var AnnotationBatchApplier = class {
 				...given,
 				nm: (0, _embedpdf_engine_core_runtime.generateUuidV7)()
 			};
-			if (create.objectNumber !== void 0) labelled(create.label, () => this.session.useObjectNumber(create.objectNumber));
+			if (create.objectNumber !== void 0) labelled(create.label, () => this.session.claimObjectNumber(create.objectNumber));
 			const replyTo = create.replyTo && {
 				type: create.replyTo.type,
 				to: labelled(create.label, () => this.linkTarget(create.replyTo.to, create.page, creates.length, "reply"))
@@ -9818,7 +9880,7 @@ var AnnotationBatchApplier = class {
 		throwIfAborted(signal);
 		if (prepared.length === 0) return {
 			created: [],
-			meta: metaOf(this.session.writeStamp(), [], [])
+			meta: metaOf$1(this.session.writeStamp(), [], [])
 		};
 		const placed = prepared.map(({ create, record, ctx, draft }) => {
 			throwIfAborted(signal);
@@ -9864,7 +9926,7 @@ var AnnotationBatchApplier = class {
 		joinWidgetFieldNumbers(this.runtime, this.session, created);
 		return {
 			created,
-			meta: metaOf(this.session.writeStamp(), placed, linked)
+			meta: metaOf$1(this.session.writeStamp(), placed, linked)
 		};
 	}
 	/**
@@ -9935,7 +9997,7 @@ var AnnotationBatchApplier = class {
 * and each it linked a popup to. Creates only append, so no other annotation
 * moves.
 */
-function metaOf(stamp, placed, linked) {
+function metaOf$1(stamp, placed, linked) {
 	return {
 		affectedPages: [...new Set(placed.map((at) => at.pageObjectNumber))].map((page) => (0, _embedpdf_engine_core_runtime.toPageRef)(page)),
 		cacheDelta: null,
@@ -10783,6 +10845,16 @@ function importAnnots(runtime, docPtr, pageIndex, capture) {
 function exportDict(runtime, docPtr, objectNumber, deepKeys) {
 	return takeOwned(runtime, `object ${objectNumber}`, (sizePtr) => runtime.fn.EPDFDoc_ExportDictRawToOwnedBuffer(docPtr, objectNumber, deepKeys.join(" "), sizePtr));
 }
+/**
+* The dictionary `objectNumber` as bytes a guard compares: without
+* `skipKeys`, and under `deepKeys` the objects the layer holds, each stream
+* as it reads. They stay the same while it reads the same, also after a save
+* encoded its streams again or the layer learned its file's hash; never
+* imported.
+*/
+function canonicalDict(runtime, docPtr, objectNumber, deepKeys, skipKeys = []) {
+	return takeOwned(runtime, `object ${objectNumber}`, (sizePtr) => runtime.fn.EPDFDoc_ExportDictCanonicalToOwnedBuffer(docPtr, objectNumber, deepKeys.join(" "), skipKeys.join(" "), sizePtr));
+}
 /** Puts the dictionary of `capture` back as it was: exactly its keys. */
 function importDict(runtime, docPtr, capture) {
 	withBytes(runtime, capture, (ptr) => {
@@ -10799,6 +10871,49 @@ function importField(runtime, docPtr, capture) {
 		if (!runtime.fn.EPDFForm_ImportFieldRaw(docPtr, ptr, capture.byteLength)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "EPDFForm_ImportFieldRaw refused a capture");
 	});
 }
+/** An outline item as its delete removes it: the item, the items under it, its place. */
+function exportOutlineItem(runtime, docPtr, objectNumber) {
+	return takeOwned(runtime, `outline item ${objectNumber}`, (sizePtr) => runtime.fn.EPDFOutline_ExportItemRawToOwnedBuffer(docPtr, objectNumber, sizePtr));
+}
+/** Puts the outline item of `capture` back, with the items under it, at its place. */
+function importOutlineItem(runtime, docPtr, capture) {
+	withBytes(runtime, capture, (ptr) => {
+		if (!runtime.fn.EPDFOutline_ImportItemRaw(docPtr, ptr, capture.byteLength)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "EPDFOutline_ImportItemRaw refused a capture");
+	});
+}
+/** A page as its delete removes it: the page, what it reaches, its names, its place. */
+function exportPage(runtime, docPtr, pageObjectNumber) {
+	return takeOwned(runtime, `page ${pageObjectNumber}`, (sizePtr) => runtime.fn.EPDFPage_ExportRawToOwnedBuffer(docPtr, pageObjectNumber, sizePtr));
+}
+/** Puts the page of `capture` back into the page tree, at its place, with its names. */
+function importPage(runtime, docPtr, capture) {
+	withBytes(runtime, capture, (ptr) => {
+		if (!runtime.fn.EPDFPage_ImportRaw(docPtr, ptr, capture.byteLength)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "EPDFPage_ImportRaw refused a capture");
+	});
+}
+/** The embedded file under `key` as its delete removes it: its key, its file specification, its streams. */
+function exportAttachment(runtime, docPtr, key) {
+	return takeOwned(runtime, `attachment '${key}'`, (sizePtr) => withUtf16String(runtime.mem, key, (keyPtr) => runtime.fn.EPDFAttachment_ExportRawToOwnedBuffer(docPtr, keyPtr, sizePtr)));
+}
+/**
+* The embedded file under `key` as bytes a guard compares: the same while it
+* is the same file, as it was (its number included); null when no file has
+* the key. Never imported.
+*/
+function canonicalAttachment(runtime, docPtr, key) {
+	try {
+		return takeOwned(runtime, `attachment '${key}'`, (sizePtr) => withUtf16String(runtime.mem, key, (keyPtr) => runtime.fn.EPDFAttachment_ExportCanonicalToOwnedBuffer(docPtr, keyPtr, sizePtr)));
+	} catch (error) {
+		if (_embedpdf_engine_core_runtime.EngineError.is(error)) return null;
+		throw error;
+	}
+}
+/** Puts the embedded file of `capture` back under its key. */
+function importAttachment(runtime, docPtr, capture) {
+	withBytes(runtime, capture, (ptr) => {
+		if (!runtime.fn.EPDFAttachment_ImportRaw(docPtr, ptr, capture.byteLength)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "EPDFAttachment_ImportRaw refused a capture");
+	});
+}
 /** The bytes of a buffer an export returned, which is then released. */
 function takeOwned(runtime, what, call) {
 	const { fn, mem } = runtime;
@@ -10877,6 +10992,14 @@ function assertExpected(opIndex, current, expected) {
 	} });
 }
 //#endregion
+//#region src/shared/bytesEqual.ts
+/** Whether two byte arrays hold the same bytes. */
+function bytesEqual(a, b) {
+	if (a.byteLength !== b.byteLength) return false;
+	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+//#endregion
 //#region src/features/changes/internal/objectCaptures.ts
 /**
 * Captures each dictionary before an op writes it: every key, and under
@@ -10895,18 +11018,21 @@ function captureBefore(runtime, session, objects) {
 	}
 	return [...captured.values()];
 }
-/** Completes captures once the op has written: each dictionary as the op left it, the guard. */
+/**
+* Completes captures once the op has written: each dictionary as the op left
+* it, the guard, in canonical bytes (`canonicalDict`).
+*/
 function captureAfter(runtime, session, pending) {
 	return pending.map((object) => ({
 		...object,
-		after: exportDict(runtime, session.requireDocPtr(), object.objectNumber, [])
+		after: canonicalDict(runtime, session.requireDocPtr(), object.objectNumber, [])
 	}));
 }
 /** Whether every dictionary still reads exactly as the op left it. */
 function unchangedSince(runtime, session, objects) {
 	return objects.every((object) => {
-		const now = tryExportDict(runtime, session, object.objectNumber, []);
-		return now !== null && sameBytes(now, object.after);
+		const now = tryCanonicalDict(runtime, session, object.objectNumber);
+		return now !== null && bytesEqual(now, object.after);
 	});
 }
 /**
@@ -10921,6 +11047,15 @@ function revertObjects(runtime, session, objects) {
 	session.invalidateDerived();
 	return captureAfter(runtime, session, redo);
 }
+/** A dictionary's canonical bytes, or null when there is none at that number. */
+function tryCanonicalDict(runtime, session, objectNumber) {
+	try {
+		return canonicalDict(runtime, session.requireDocPtr(), objectNumber, []);
+	} catch (error) {
+		if (_embedpdf_engine_core_runtime.EngineError.is(error)) return null;
+		throw error;
+	}
+}
 /** The capture of a dictionary, or null when there is none at that number. */
 function tryExportDict(runtime, session, objectNumber, deep) {
 	try {
@@ -10930,11 +11065,6 @@ function tryExportDict(runtime, session, objectNumber, deep) {
 		throw error;
 	}
 }
-function sameBytes(a, b) {
-	if (a.byteLength !== b.byteLength) return false;
-	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
-	return true;
-}
 //#endregion
 //#region src/features/annotations/internal/stackingOrder.ts
 /**
@@ -11177,7 +11307,7 @@ function updateAnnotation(ctx, op, opIndex) {
 	if (current.subtype === "widget") throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "a widget is the form's: change its place and look with doc.forms.updateWidget");
 	(0, _embedpdf_engine_core_runtime.authorizeUnprotected)(ctx.authority, (0, _embedpdf_engine_core_runtime.annotationWriteCapability)(current.subtype));
 	assertExpected(opIndex, current, op.expect);
-	return writeUpdate$1(ctx, op.ref, op.patch, "annotations.update", op.resources);
+	return writeUpdate$2(ctx, op.ref, op.patch, "annotations.update", op.resources);
 }
 /** `annotations.delete`; its reverse brings back everything it removed. */
 function deleteAnnotation(ctx, op, opIndex) {
@@ -11185,7 +11315,7 @@ function deleteAnnotation(ctx, op, opIndex) {
 	if (current.subtype === "widget") throw widgetDeleteRefused(current);
 	(0, _embedpdf_engine_core_runtime.authorizeUnprotected)(ctx.authority, (0, _embedpdf_engine_core_runtime.annotationWriteCapability)(current.subtype));
 	assertExpected(opIndex, current, op.expect);
-	return writeDelete$1(ctx, op.ref);
+	return writeDelete$4(ctx, op.ref);
 }
 /** Why a widget isn't deleted as an annotation, naming the form op that removes it. */
 function widgetDeleteRefused(widget) {
@@ -11252,7 +11382,7 @@ function revertAnnotation(ctx, step) {
 	const kept = keys.filter((key) => valuesEqual(now[key], left[key]));
 	if (kept.length === 0) return leftAlone(ctx, reports);
 	const writable = (key, value) => key === "actions" && current.subtype === "widget" ? (0, _embedpdf_engine_core_runtime.widgetActionsOf)(value) : value;
-	const done = writeUpdate$1(ctx, ref, Object.fromEntries(kept.map((key) => [key, writable(key, restore[key])])), reports);
+	const done = writeUpdate$2(ctx, ref, Object.fromEntries(kept.map((key) => [key, writable(key, restore[key])])), reports);
 	const skipped = keys.filter((key) => !kept.includes(key));
 	const item = done.item;
 	if (skipped.length === 0 || (0, _embedpdf_engine_core_runtime.isSkippedItem)(item) || item.type !== reports) return done;
@@ -11276,7 +11406,7 @@ function removeAnnotation(ctx, step) {
 	}))) return leftAlone(ctx, "annotations.delete");
 	for (const capability of (0, _embedpdf_engine_core_runtime.annotationWriteCapabilities)(members)) (0, _embedpdf_engine_core_runtime.authorizeUnprotected)(ctx.authority, capability);
 	if (step.rights) authorizeImportRights(ctx.authority);
-	return writeDelete$1(ctx, step.ref, step.rights);
+	return writeDelete$4(ctx, step.ref, step.rights);
 }
 /**
 * Brings back what a delete removed, at the same numbers and positions. Skipped
@@ -11397,7 +11527,7 @@ function reorderItem(ctx, family, page, order, moved) {
 * An update of `ref` with `patch`, recording the dictionaries it writes, and
 * reported as `reports`: an annotation's update, or a widget's form op.
 */
-function writeUpdate$1(ctx, ref, patch, reports, resources) {
+function writeUpdate$2(ctx, ref, patch, reports, resources) {
 	promoteInlineAnnotations(ctx.runtime, ctx.session, ref.page.objectNumber);
 	const before = readAnnotation(ctx, ref);
 	const written = before.subtype === "widget" ? (0, _embedpdf_engine_core_runtime.fitWidgetToFamily)(before.fieldFamily, patch) : patch;
@@ -11445,7 +11575,7 @@ function updatedItem(ctx, reports, ref, result) {
 }
 /** A delete of `ref` and what goes with it, capturing them first. */
 /** Deletes `ref` and what goes with it; `rights` is what a step under an import's rights checked. */
-function writeDelete$1(ctx, ref, rights) {
+function writeDelete$4(ctx, ref, rights) {
 	const page = ref.page.objectNumber;
 	promoteInlineAnnotations(ctx.runtime, ctx.session, page);
 	const members = (0, _embedpdf_engine_core_runtime.deletedWith)(listPage(ctx, page), ref);
@@ -11562,66 +11692,314 @@ function objectNumberOf$1(ctx, ref) {
 	}
 }
 //#endregion
-//#region src/features/forms/internal/authorWidget.ts
-const WIDGET_SUBTYPE_CODE = 20;
+//#region src/features/attachments/AttachmentReader.ts
 /**
-* Birth a widget through the annotation plane (EPDFPage_CreateAnnotRaw -
-* indirect, durable object number, no page load), place it and turn it
-* (`/MK /R`), style it with the placement's style fields through the
-* widget-plane writer (`applyWidgetStyle` - the same code the widget
-* annotation kind uses for create/patch), and give it the placement's
-* actions. Like every annotation the engine makes, it gets a fresh UUIDv7
-* `/NM`. Returns the widget's object number (`objectNumber`, which the
-* session checked, or the next free one), ready for EPDFForm_AttachWidget
-* adoption, which draws its appearance turned.
+* Read-only access to embedded files, at both of their homes: the
+* document catalog's `/EmbeddedFiles` name tree (list / readFile by
+* index) and a FileAttachment annotation's `/FS` (readAnnotationFile by
+* ref). Pure reads over the session — no layer artifacts (the
+* `PagesExtractor` shape).
+*
+* Byte delivery mirrors the request's `path?`: absent → a standalone
+* buffer for the transfer list (browser); present → the decoded file is
+* streamed to `path` via `FPDF_FILEWRITE` (server), and only metadata
+* rides the response.
 */
-function createUnattachedWidget(runtime, docPtr, pageIndex, placement, objectNumber) {
-	const { fn, mem } = runtime;
-	const annotPtr = fn.EPDFPage_CreateAnnotRaw(docPtr, pageIndex, WIDGET_SUBTYPE_CODE, objectNumber ?? 0);
-	if (annotPtr === _embedpdf_engine_runtime.NULL_PTR && objectNumber !== void 0) throw objectNumberUnavailable(objectNumber, "taken");
-	if (annotPtr === _embedpdf_engine_runtime.NULL_PTR) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "failed to create widget annotation");
-	try {
-		writeAnnotString(fn, mem, annotPtr, "NM", (0, _embedpdf_engine_core_runtime.generateUuidV7)());
-		const { page: _page, rect, rotation, exportValue: _exportValue, actions, ...style } = placement;
-		setAnnotRect(fn, mem, annotPtr, rect);
-		if (rotation) setWidgetTurn(fn, annotPtr, rotation);
-		if (Object.keys(style).length > 0) applyWidgetStyle(fn, mem, annotPtr, style);
-		if (actions) writeWidgetActions(runtime, docPtr, annotPtr, actions);
-		const widgetObjectNumber = fn.EPDFAnnot_GetObjectNumber(annotPtr);
-		if (widgetObjectNumber <= 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "widget annotation has no object number");
-		return widgetObjectNumber;
-	} finally {
-		fn.FPDFPage_CloseAnnot(annotPtr);
+var AttachmentReader = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
 	}
-}
-//#endregion
-//#region src/features/forms/internal/fieldFlagBits.ts
-/**
-* /Ff bits writable through drafts and patches (1-based spec bit numbers).
-* Family-defining bits (Radio 1<<15, Pushbutton 1<<16, Combo 1<<17) are set
-* once by EPDFForm_CreateField and immutable afterwards - the native
-* setter rejects them.
-*/
-const FIELD_FLAG_BITS = {
-	readOnly: 1,
-	required: 2,
-	noExport: 4,
-	multiline: 4096,
-	password: 8192,
-	noToggleToOff: 16384,
-	edit: 1 << 18,
-	multiSelect: 1 << 21,
-	comb: 1 << 24,
-	radiosInUnison: 1 << 25
-};
-/**
-* Fold optional booleans into set/clear masks: `true` sets the bit,
-* `false` clears it, `undefined` leaves it alone.
-*/
-function flagMasks(flags) {
-	let setBits = 0;
-	let clearBits = 0;
-	for (const [name, bit] of Object.entries(FIELD_FLAG_BITS)) {
+	/** Snapshot of the `/EmbeddedFiles` name tree, in tree (key-sorted) order. */
+	list(signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const count = fn.FPDFDoc_GetAttachmentCount(docPtr);
+		const items = [];
+		for (let index = 0; index < count; index++) {
+			const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
+			if (!attachmentPtr) continue;
+			const key = readAttachmentKey(fn, mem, docPtr, index) ?? "";
+			items.push({
+				...readAttachmentFileInfo(fn, mem, attachmentPtr),
+				ref: (0, _embedpdf_engine_core_runtime.toAttachmentRef)(key),
+				index
+			});
+		}
+		return items;
+	}
+	/** Decode one document-level embedded file, addressed by key. */
+	readFile(ref, path, maxDecodedBytes, signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
+		if (index < 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
+		const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
+		if (!attachmentPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `embedded file with key '${ref.key}' resolved to index ${index} but could not be opened`);
+		const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
+		return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
+	}
+	/** Decode the file embedded in a FileAttachment annotation's `/FS`. */
+	/** A file attachment annotation's file; a page not parsed yet loads in slices. */
+	async readAnnotationFile(pageObjectNumber, ref, path, maxDecodedBytes, signal, slices) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const pool = this.session.pagePool();
+		const pagePtr = await pool.acquireInSlices(pageObjectNumber, signal, slices);
+		let annotPtr = null;
+		try {
+			annotPtr = resolveAnnotPtr(this.runtime, this.session, pagePtr, ref);
+			const attachmentPtr = fn.FPDFAnnot_GetFileAttachment(annotPtr);
+			if (!attachmentPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "annotation is not a file attachment or carries no embedded file (/FS)");
+			const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
+			return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
+		} finally {
+			if (annotPtr !== null) fn.FPDFPage_CloseAnnot(annotPtr);
+			pool.release(pageObjectNumber);
+		}
+	}
+	extract(attachmentPtr, name, mimeType, path, maxDecodedBytes) {
+		if (path !== void 0) {
+			const { size } = extractAttachmentToFile(this.runtime, attachmentPtr, path, maxDecodedBytes);
+			return {
+				name,
+				...mimeType ? { mimeType } : {},
+				size,
+				path
+			};
+		}
+		const { bytes, size } = extractAttachmentToBuffer(this.runtime, attachmentPtr, maxDecodedBytes);
+		return {
+			name,
+			...mimeType ? { mimeType } : {},
+			size,
+			bytes
+		};
+	}
+};
+//#endregion
+//#region src/features/attachments/AttachmentMutator.ts
+/**
+* Create/delete writes over the document catalog's `/EmbeddedFiles` name
+* tree, sharing the write path (`writeAttachmentFilePayload`) with the
+* file-attachment annotation writer. The change ops run them
+* (`attachmentChanges.ts`), which decide what an undo needs.
+*
+* Identity is the name-tree key (unique by construction). Note the
+* tree is key-sorted: both writes shift other entries' indices; keys
+* never move.
+*/
+var AttachmentMutator = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
+	}
+	/**
+	* Create an embedded file from `bytes`. `file.name` becomes the tree key
+	* (PDFium writes key = /UF = /F); a duplicate key rejects with
+	* `InvalidArg`. The result carries the read-back entry,
+	* `checksum`/`size`/dates included.
+	*/
+	create(file, bytes, signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		if (!bytes) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "an attachments.create op needs its bytes as its file resource", { details: { field: "resources.file" } });
+		if (file.name.length === 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "attachment file requires a name");
+		if (resolveAttachmentIndex(fn, mem, docPtr, {
+			kind: "key",
+			key: file.name
+		}) !== -1) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, `an embedded file with key '${file.name}' already exists — keys are unique; rename and retry`);
+		throwIfAborted(signal);
+		const namePtr = mem.writeU16String(file.name);
+		let attachmentPtr;
+		try {
+			attachmentPtr = fn.FPDFDoc_AddAttachment(docPtr, namePtr);
+		} finally {
+			mem.free(namePtr);
+		}
+		if (!attachmentPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "FPDFDoc_AddAttachment returned NULL");
+		writeAttachmentFilePayload(fn, mem, attachmentPtr, docPtr, file, {
+			bytes,
+			...file.mimeType !== void 0 ? { mimeType: file.mimeType } : {},
+			name: file.name
+		});
+		const ref = (0, _embedpdf_engine_core_runtime.toAttachmentRef)(file.name);
+		const attachment = this.find(ref);
+		if (!attachment) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "created attachment did not resolve by key after the write");
+		return {
+			attachment,
+			meta: this.meta(ref)
+		};
+	}
+	/** The entry under `ref`'s key as it reads now; `null` when no file has the key. */
+	find(ref) {
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
+		const attachmentPtr = index < 0 ? null : fn.FPDFDoc_GetAttachment(docPtr, index);
+		if (!attachmentPtr) return null;
+		return {
+			...readAttachmentFileInfo(fn, mem, attachmentPtr),
+			ref,
+			index
+		};
+	}
+	/** A write's meta, naming the file it changed. Cloud coherence pins are a server concern. */
+	meta(ref) {
+		return {
+			affectedPages: [],
+			cacheDelta: null,
+			...this.session.writeStamp(),
+			changed: [ref]
+		};
+	}
+	/** Delete an embedded file by key. Unlinks the tree entry only. */
+	delete(ref, signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
+		if (index < 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
+		if (!fn.FPDFDoc_DeleteAttachment(docPtr, index)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "FPDFDoc_DeleteAttachment returned false");
+		return { meta: this.meta(ref) };
+	}
+};
+//#endregion
+//#region src/features/changes/internal/attachmentChanges.ts
+const mutatorOf$2 = (ctx) => new AttachmentMutator(ctx.runtime, ctx.session);
+const authorize$2 = (ctx) => (0, _embedpdf_engine_core_runtime.authorizeCapability)(ctx.authority, "doc.attachments.modify");
+/** `attachments.create`; its reverse deletes the file while it is still the file this made. */
+function createAttachment(ctx, op) {
+	authorize$2(ctx);
+	const result = mutatorOf$2(ctx).create(op.file, op.resources.file, ctx.signal);
+	return {
+		item: {
+			type: "attachments.create",
+			...result
+		},
+		reverse: [removeStepOf$1(ctx, result.attachment.ref)]
+	};
+}
+/** `attachments.delete`, captured in its transaction so an undo brings back the same file. */
+function deleteAttachment(ctx, op) {
+	authorize$2(ctx);
+	return writeDelete$3(ctx, op.ref);
+}
+/** Deletes a file a create or a restore brought, while it reads as the change left it. */
+function removeAttachment(ctx, step) {
+	const now = canonicalAttachment(ctx.runtime, ctx.session.requireDocPtr(), step.ref.key);
+	if (!now || !bytesEqual(now, step.left)) return leftAlone(ctx, "attachments.delete");
+	authorize$2(ctx);
+	return writeDelete$3(ctx, step.ref);
+}
+/** Brings back a file a delete removed, while no file has its key. */
+function restoreAttachment(ctx, step) {
+	const mutator = mutatorOf$2(ctx);
+	if (mutator.find(step.ref)) return leftAlone(ctx, "attachments.restore");
+	authorize$2(ctx);
+	importAttachment(ctx.runtime, ctx.session.requireDocPtr(), step.capture);
+	const attachment = mutator.find(step.ref);
+	if (!attachment) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `attachment '${step.ref.key}' did not come back`);
+	return {
+		item: {
+			type: "attachments.restore",
+			attachment,
+			meta: mutator.meta(step.ref)
+		},
+		reverse: [removeStepOf$1(ctx, step.ref)]
+	};
+}
+/** Deletes the file under `ref`, captured first so its restore brings it back. */
+function writeDelete$3(ctx, ref) {
+	const mutator = mutatorOf$2(ctx);
+	if (!mutator.find(ref)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`, { details: { field: "ref" } });
+	const capture = exportAttachment(ctx.runtime, ctx.session.requireDocPtr(), ref.key);
+	return {
+		item: {
+			type: "attachments.delete",
+			...mutator.delete(ref, ctx.signal)
+		},
+		reverse: [{
+			kind: "attachments.restore",
+			ref,
+			capture
+		}]
+	};
+}
+/** The step that deletes the file under `ref` again while it reads as it does now. */
+function removeStepOf$1(ctx, ref) {
+	const left = canonicalAttachment(ctx.runtime, ctx.session.requireDocPtr(), ref.key);
+	if (!left) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `attachment '${ref.key}' is not there to guard`);
+	return {
+		kind: "attachments.remove",
+		ref,
+		left
+	};
+}
+//#endregion
+//#region src/features/forms/internal/authorWidget.ts
+const WIDGET_SUBTYPE_CODE = 20;
+/**
+* Birth a widget through the annotation plane (EPDFPage_CreateAnnotRaw -
+* indirect, durable object number, no page load), place it and turn it
+* (`/MK /R`), style it with the placement's style fields through the
+* widget-plane writer (`applyWidgetStyle` - the same code the widget
+* annotation kind uses for create/patch), and give it the placement's
+* actions. Like every annotation the engine makes, it gets a fresh UUIDv7
+* `/NM`. Returns the widget's object number (`objectNumber`, which the
+* session checked, or the next free one), ready for EPDFForm_AttachWidget
+* adoption, which draws its appearance turned.
+*/
+function createUnattachedWidget(runtime, docPtr, pageIndex, placement, objectNumber) {
+	const { fn, mem } = runtime;
+	const annotPtr = fn.EPDFPage_CreateAnnotRaw(docPtr, pageIndex, WIDGET_SUBTYPE_CODE, objectNumber ?? 0);
+	if (annotPtr === _embedpdf_engine_runtime.NULL_PTR && objectNumber !== void 0) throw objectNumberUnavailable(objectNumber, "taken");
+	if (annotPtr === _embedpdf_engine_runtime.NULL_PTR) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "failed to create widget annotation");
+	try {
+		writeAnnotString(fn, mem, annotPtr, "NM", (0, _embedpdf_engine_core_runtime.generateUuidV7)());
+		const { page: _page, rect, rotation, exportValue: _exportValue, actions, ...style } = placement;
+		setAnnotRect(fn, mem, annotPtr, rect);
+		if (rotation) setWidgetTurn(fn, annotPtr, rotation);
+		if (Object.keys(style).length > 0) applyWidgetStyle(fn, mem, annotPtr, style);
+		if (actions) writeWidgetActions(runtime, docPtr, annotPtr, actions);
+		const widgetObjectNumber = fn.EPDFAnnot_GetObjectNumber(annotPtr);
+		if (widgetObjectNumber <= 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "widget annotation has no object number");
+		return widgetObjectNumber;
+	} finally {
+		fn.FPDFPage_CloseAnnot(annotPtr);
+	}
+}
+//#endregion
+//#region src/features/forms/internal/fieldFlagBits.ts
+/**
+* /Ff bits writable through drafts and patches (1-based spec bit numbers).
+* Family-defining bits (Radio 1<<15, Pushbutton 1<<16, Combo 1<<17) are set
+* once by EPDFForm_CreateField and immutable afterwards - the native
+* setter rejects them.
+*/
+const FIELD_FLAG_BITS = {
+	readOnly: 1,
+	required: 2,
+	noExport: 4,
+	multiline: 4096,
+	password: 8192,
+	noToggleToOff: 16384,
+	edit: 1 << 18,
+	multiSelect: 1 << 21,
+	comb: 1 << 24,
+	radiosInUnison: 1 << 25
+};
+/**
+* Fold optional booleans into set/clear masks: `true` sets the bit,
+* `false` clears it, `undefined` leaves it alone.
+*/
+function flagMasks(flags) {
+	let setBits = 0;
+	let clearBits = 0;
+	for (const [name, bit] of Object.entries(FIELD_FLAG_BITS)) {
 		const value = flags[name];
 		if (value === true) setBits |= bit;
 		else if (value === false) clearBits |= bit;
@@ -12527,8 +12905,8 @@ var FormMutator = class {
 		}
 		const { objectNumber, widgetObjectNumbers } = numbers;
 		if (widgetObjectNumbers && widgetObjectNumbers.length !== placements.length) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, `forms.create needs one widget object number per widget: ${widgetObjectNumbers.length} for ${placements.length}`, { details: { field: "widgetObjectNumbers" } });
-		if (objectNumber !== void 0) this.session.useObjectNumber(objectNumber);
-		for (const number of widgetObjectNumbers ?? []) this.session.useObjectNumber(number);
+		if (objectNumber !== void 0) this.session.claimObjectNumber(objectNumber);
+		for (const number of widgetObjectNumbers ?? []) this.session.claimObjectNumber(number);
 		throwIfAborted(signal);
 		const fieldObjectNumber = this.createFieldNode(draft, objectNumber);
 		this.configureNewField(draft, fieldObjectNumber);
@@ -12748,9 +13126,9 @@ var FormMutator = class {
 		const pageIndex = this.preflightPlacement(fitted);
 		const onState = onStateOf(before.family, fitted);
 		const mergedPage = before.widgets.find((w) => w.objectNumber === resolved.fieldObjectNumber)?.page ?? null;
-		if (numbers.objectNumber !== void 0) this.session.useObjectNumber(numbers.objectNumber);
+		if (numbers.objectNumber !== void 0) this.session.claimObjectNumber(numbers.objectNumber);
 		const splitObjectNumber = mergedPage ? numbers.splitObjectNumber : void 0;
-		if (splitObjectNumber !== void 0) this.session.useObjectNumber(splitObjectNumber);
+		if (splitObjectNumber !== void 0) this.session.claimObjectNumber(splitObjectNumber);
 		throwIfAborted(signal);
 		if (mergedPage) promoteInlineAnnotations(this.runtime, this.session, mergedPage.objectNumber);
 		const widgetObjectNumber = createUnattachedWidget(this.runtime, docPtr, pageIndex, fitted, numbers.objectNumber);
@@ -13315,14 +13693,14 @@ function updateField(ctx, op, opIndex) {
 	const before = readField(ctx, op.field);
 	if (op.patch.groupId !== void 0 && op.patch.groupId !== before.field.groupId) (0, _embedpdf_engine_core_runtime.authorizeFieldGroup)(ctx.authority, op.patch.groupId);
 	assertExpected(opIndex, propertiesOf(before.field), op.expect);
-	return writeUpdate(ctx, before, op.patch);
+	return writeUpdate$1(ctx, before, op.patch);
 }
 /** `forms.delete`; its reverse brings back the field, its widgets and the parents it pruned. */
 function deleteField(ctx, op, opIndex) {
 	(0, _embedpdf_engine_core_runtime.authorizeCapability)(ctx.authority, "doc.forms.modify");
 	const before = readField(ctx, op.field);
 	assertExpected(opIndex, before.field, op.expect);
-	return writeDelete(ctx, before);
+	return writeDelete$2(ctx, before);
 }
 /**
 * `forms.addWidget`. Its reverse puts back the field and the pages the widget
@@ -13451,7 +13829,7 @@ function updateWidget(ctx, op, opIndex) {
 	const current = readAnnotation(ctx, op.widget);
 	if (current.subtype !== "widget") throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, `${current.subtype} is not a widget: change it with doc.annotations.update`, { details: { field: "widget" } });
 	assertExpected(opIndex, current, op.expect);
-	return writeUpdate$1(ctx, op.widget, {
+	return writeUpdate$2(ctx, op.widget, {
 		...op.patch,
 		subtype: "widget"
 	}, "forms.updateWidget");
@@ -13727,7 +14105,7 @@ function revertProperties(ctx, fallback) {
 	const keys = Object.keys(left);
 	const kept = keys.filter((key) => valuesEqual(now[key], left[key]) && (key !== "name" || nameIsFree(ctx, current.field.name, String(restore.name))));
 	if (kept.length === 0) return leftAlone(ctx, "forms.update");
-	const done = writeUpdate(ctx, current, pick$1(restore, kept));
+	const done = writeUpdate$1(ctx, current, pick$1(restore, kept));
 	const skipped = keys.filter((key) => !kept.includes(key));
 	const item = done.item;
 	if (skipped.length === 0 || (0, _embedpdf_engine_core_runtime.isSkippedItem)(item) || item.type !== "forms.update") return done;
@@ -13752,7 +14130,7 @@ function removeField(ctx, step) {
 	if (step.rights) (0, _embedpdf_engine_core_runtime.authorizeCapability)(ctx.authority, "doc.forms.import");
 	const current = tryReadFieldByNumber(ctx, step.objectNumber);
 	if (!current || !valuesEqual(current.field, step.left)) return leftAlone(ctx, "forms.delete");
-	return writeDelete(ctx, current, step.rights);
+	return writeDelete$2(ctx, current, step.rights);
 }
 /**
 * Brings back a field a delete removed. Left alone when another field took its
@@ -13887,7 +14265,7 @@ function writeEffect(ctx, type, write, before) {
 * An update of the field `before` reads, recording the dictionaries it writes
 * and the properties it changes: their old values, and the values it left.
 */
-function writeUpdate(ctx, before, patch) {
+function writeUpdate$1(ctx, before, patch) {
 	const ref = {
 		kind: "objectNumber",
 		objectNumber: before.objectNumber
@@ -13962,7 +14340,7 @@ function recordRevert(ctx, before, type, write, fallbackOf) {
 * A delete of the field `before` reads, capturing it first. Its restore
 * takes `rights` too.
 */
-function writeDelete(ctx, before, rights) {
+function writeDelete$2(ctx, before, rights) {
 	const capture = exportField(ctx.runtime, ctx.session.requireDocPtr(), before.objectNumber);
 	const ref = {
 		kind: "objectNumber",
@@ -14295,57 +14673,1153 @@ function entryOf(values, key) {
 function pick(values, keys) {
 	return Object.fromEntries(keys.map((key) => [key, entryOf(values, key)]));
 }
-//#endregion
-//#region src/features/changes/ChangeApplier.ts
 /**
-* Runs changes inside the job's layer transaction, which its caller opens and
-* ends, so a failure anywhere leaves the document as it was: a change's ops in
-* order (`apply`), or the steps of a recorded reverse (`undo`). Each op and
-* step is checked against the change's authority as it runs, as its single
-* verb's job checks it.
-*
-* Every op records the steps that reverse it as it runs, from what it found
-* and wrote; the record lists them in reverse op order, so each step meets the
-* document as the op after it left it.
-*/
-var ChangeApplier = class {
-	constructor(runtime, session, fonts) {
-		this.runtime = runtime;
-		this.session = session;
-		this.fonts = fonts;
+* The outline's shape as the document links it now, by object number: each
+* item's parent ({@link TOP} for a top-level item) and each parent's
+* children in order. Only what a write needs: no titles, no targets. An item
+* that isn't an indirect object is left out with the items under it, a loop
+* ends its list, and items deeper than a read goes aren't in it, as every
+* read of the outline does.
+*/
+var OutlineTree = class {
+	constructor(fn, docPtr) {
+		_defineProperty(this, "childrenByParent", /* @__PURE__ */ new Map());
+		_defineProperty(this, "parentByItem", /* @__PURE__ */ new Map());
+		const visit = (parentHandle, parent, depth) => {
+			if (depth >= _embedpdf_engine_core_runtime.OUTLINE_READ_LIMITS.depth) return;
+			const children = [];
+			this.childrenByParent.set(parent, children);
+			for (let handle = fn.FPDFBookmark_GetFirstChild(docPtr, parentHandle); handle; handle = fn.FPDFBookmark_GetNextSibling(docPtr, handle)) {
+				const item = fn.EPDFOutline_GetObjectNumber(handle);
+				if (!item) continue;
+				if (this.parentByItem.has(item)) break;
+				this.parentByItem.set(item, parent);
+				children.push(item);
+				visit(handle, item, depth + 1);
+			}
+		};
+		visit(_embedpdf_engine_runtime.NULL_PTR, 0, 0);
 	}
-	apply(ops, authority, signal) {
-		const ctx = this.context(authority, signal, (self) => opsFillOwnField(self, ops));
-		return collect(authority, ops.map((op, at) => () => runOp(ctx, op, at)), signal);
+	has(item) {
+		return this.parentByItem.has(item);
 	}
-	undo(record, authority, signal) {
-		const ctx = this.context(authority, signal, (self) => stepsFillOwnField(self, record.steps));
-		return collect(authority, record.steps.map((step) => () => runStep(ctx, step)), signal);
+	/** The item's parent ({@link TOP} at the top level); `undefined` when it isn't in the outline. */
+	parentOf(item) {
+		return this.parentByItem.get(item);
 	}
-	context(authority, signal, ownFill) {
-		let answer;
-		const ctx = {
-			runtime: this.runtime,
-			session: this.session,
-			...this.fonts ? { fonts: this.fonts } : {},
-			authority,
-			signal,
-			fillsOwnField: () => answer ?? (answer = ownFill(ctx))
-		};
-		return ctx;
+	/** A parent's children in order: none for a leaf, or an item the outline doesn't have. */
+	childrenOf(parent) {
+		return this.childrenByParent.get(parent) ?? [];
 	}
-};
-/** Runs each in order; the record reverses them in the opposite order. */
-function collect(authority, runs, signal) {
-	const items = [];
-	const reverses = [];
-	for (const run of runs) {
-		throwIfAborted(signal);
-		const done = run();
-		items.push(done.item);
-		reverses.push(done.reverse);
+	/** The item and the items under it, depth first: the item first. */
+	subtreeOf(item) {
+		const items = [item];
+		for (const child of this.childrenOf(item)) items.push(...this.subtreeOf(child));
+		return items;
 	}
-	return {
+	/** How deep the item sits: 0 at the top level; `undefined` when it isn't in the outline. */
+	levelOf(item) {
+		let level = -1;
+		for (let current = item; current; current = this.parentOf(current)) level += 1;
+		return this.has(item) ? level : void 0;
+	}
+	/** Whether `node` is `item` or one of the items under it. */
+	isAtOrUnder(node, item) {
+		for (let current = node; current; current = this.parentOf(current)) if (current === item) return true;
+		return false;
+	}
+	/** Every item, depth first: what an order of the whole outline is. */
+	items() {
+		return this.childrenOf(0).flatMap((item) => this.subtreeOf(item));
+	}
+};
+//#endregion
+//#region src/features/outline/internal/readOutlineItem.ts
+/**
+* What one read of an outline may spend on its items' actions: one action
+* model per item at most, and room for a URI or a script on each. Past it,
+* an item's action reads as missing and the outline as incomplete.
+*/
+const OUTLINE_ACTION_READ_BUDGET = {
+	maxModels: 5e4,
+	maxNodes: 2e5,
+	maxScriptCodeUnits: 16e6,
+	maxTargetEntries: 65536,
+	maxPayloadCodeUnits: 16e6
+};
+/** `/F` bit 1. */
+const ITALIC$1 = 1;
+/** `/F` bit 2. */
+const BOLD$1 = 2;
+/** A budget for one read of the outline's actions. */
+function outlineActionBudget() {
+	return new ActionReadBudgetTracker(OUTLINE_ACTION_READ_BUDGET);
+}
+/**
+* The item `handle` reads, at `objectNumber` under `parent` ({@link TOP} for
+* the top level). Its target is read the way a link's is: the `/A` tree's
+* navigation view, else the `/Dest`; an action that can't be read makes the
+* target `unsupported`.
+*/
+function readOutlineItem(runtime, docPtr, handle, objectNumber, parent, budget) {
+	const { fn, mem } = runtime;
+	const title = readUtf16String(mem, (buf, capacity) => fn.FPDFBookmark_GetTitle(handle, buf, capacity)) ?? "";
+	const hasChildren = fn.FPDFBookmark_GetFirstChild(docPtr, handle) !== _embedpdf_engine_runtime.NULL_PTR;
+	const style = fn.FPDFBookmark_GetStyle(handle);
+	const { action, target, complete } = readTarget(runtime, docPtr, handle, budget);
+	return {
+		item: {
+			ref: (0, _embedpdf_engine_core_runtime.toOutlineItemRef)(objectNumber),
+			parent: parent === 0 ? null : (0, _embedpdf_engine_core_runtime.toOutlineItemRef)(parent),
+			title,
+			target,
+			action,
+			open: hasChildren && fn.FPDFBookmark_GetCount(handle) > 0,
+			color: readColor(runtime, handle),
+			bold: (style & BOLD$1) !== 0,
+			italic: (style & ITALIC$1) !== 0
+		},
+		complete
+	};
+}
+function readTarget(runtime, docPtr, handle, budget) {
+	const { fn, mem } = runtime;
+	const actionPtr = fn.FPDFBookmark_GetAction(handle);
+	if (actionPtr) try {
+		const action = readActionModel(fn, mem, docPtr, fn.EPDFAction_LoadModel(actionPtr), budget);
+		return {
+			action,
+			target: action ? linkTargetFromActionTree(action) : { kind: "unsupported" },
+			complete: action !== null && !action.incomplete
+		};
+	} catch (error) {
+		if (!_embedpdf_engine_core_runtime.EngineError.is(error)) throw error;
+		return {
+			action: null,
+			target: { kind: "unsupported" },
+			complete: false
+		};
+	}
+	const destPtr = fn.FPDFBookmark_GetDest(docPtr, handle);
+	if (!destPtr) return {
+		action: null,
+		target: null,
+		complete: true
+	};
+	const destination = readDestination(fn, mem, docPtr, destPtr);
+	return {
+		action: null,
+		target: destination ? {
+			kind: "goto",
+			destination
+		} : { kind: "unsupported" },
+		complete: true
+	};
+}
+/** `/C` as `#rrggbb`, or `null` when the item has none. */
+function readColor(runtime, handle) {
+	const { fn, mem } = runtime;
+	return withScratchN(mem, [
+		4,
+		4,
+		4
+	], ([r, g, b]) => {
+		if (!fn.FPDFBookmark_GetColor(handle, r, g, b)) return null;
+		const channel = (ptr) => Math.min(255, Math.max(0, Math.round(readF32(mem, ptr) * 255)));
+		return (0, _embedpdf_engine_core_runtime.colorOf)(channel(r), channel(g), channel(b));
+	});
+}
+//#endregion
+//#region src/features/outline/OutlineReader.ts
+/**
+* Synchronous read of the document's outline, shared by the local worker and
+* the server. Dictionary reads only: no page is loaded. It never throws for
+* a bad outline: what it can't read (a loop, an item that isn't an indirect
+* object, a broken action, past `OUTLINE_READ_LIMITS`) it leaves out or
+* marks, and says `incomplete`.
+*/
+var OutlineReader = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
+	}
+	read(signal) {
+		const { fn } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const budget = outlineActionBudget();
+		const items = [];
+		const seen = /* @__PURE__ */ new Set();
+		let incomplete = false;
+		const visit = (parentHandle, parent, depth) => {
+			for (let handle = fn.FPDFBookmark_GetFirstChild(docPtr, parentHandle); handle; handle = fn.FPDFBookmark_GetNextSibling(docPtr, handle)) {
+				throwIfAborted(signal);
+				const objectNumber = fn.EPDFOutline_GetObjectNumber(handle);
+				if (!objectNumber) {
+					incomplete = true;
+					continue;
+				}
+				if (seen.has(objectNumber)) {
+					incomplete = true;
+					break;
+				}
+				if (items.length >= _embedpdf_engine_core_runtime.OUTLINE_READ_LIMITS.items) {
+					incomplete = true;
+					return false;
+				}
+				seen.add(objectNumber);
+				const read = readOutlineItem(this.runtime, docPtr, handle, objectNumber, parent, budget);
+				items.push(read.item);
+				if (!read.complete) incomplete = true;
+				if (fn.FPDFBookmark_GetFirstChild(docPtr, handle) === _embedpdf_engine_runtime.NULL_PTR) continue;
+				if (depth + 1 >= _embedpdf_engine_core_runtime.OUTLINE_READ_LIMITS.depth) {
+					incomplete = true;
+					continue;
+				}
+				if (!visit(handle, objectNumber, depth + 1)) return false;
+			}
+			return true;
+		};
+		visit(_embedpdf_engine_runtime.NULL_PTR, 0, 0);
+		return {
+			items,
+			incomplete
+		};
+	}
+	/** The item `objectNumber`, under `parent` ({@link TOP} for the top level), as it reads now. */
+	readItem(objectNumber, parent) {
+		const docPtr = this.session.requireDocPtr();
+		const handle = this.runtime.fn.EPDFOutline_GetItem(docPtr, objectNumber);
+		if (!handle) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no outline item ${objectNumber}`, { details: { field: "ref" } });
+		return readOutlineItem(this.runtime, docPtr, handle, objectNumber, parent, outlineActionBudget()).item;
+	}
+};
+//#endregion
+//#region src/features/outline/internal/writeOutlineFields.ts
+/** `/F` bit 1. */
+const ITALIC = 1;
+/** `/F` bit 2. */
+const BOLD = 2;
+/** The most a PDF text string holds in every PDF app (ISO 32000-2 Annex C). */
+const MAX_TITLE_LENGTH = 32767;
+const HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+/**
+* Refuses, before anything is written, fields no write can take: a title
+* too long, a colour that isn't `#rrggbb`, a target a write can't make.
+*/
+function assertWritableFields(fields) {
+	const refuse = (field, message) => {
+		throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, message, { details: { field } });
+	};
+	if (fields.title !== void 0) {
+		if (typeof fields.title !== "string") refuse("title", "a title is a string");
+		if (fields.title.length > MAX_TITLE_LENGTH) refuse("title", `a title holds at most ${MAX_TITLE_LENGTH} characters`);
+	}
+	if (fields.color != null && !HEX_COLOR.test(fields.color)) refuse("color", "expected a color as '#rrggbb'");
+	const target = fields.target;
+	if (target != null) {
+		if (!(target.kind === "goto" || target.kind === "uri" || target.kind === "named" && [
+			"NextPage",
+			"PrevPage",
+			"FirstPage",
+			"LastPage"
+		].includes(target.name ?? ""))) refuse("target", `a '${target.kind}' target can't be written`);
+	}
+}
+/**
+* Writes the fields `fields` names on the item `objectNumber`; the others
+* stay as they are. A target is always written as `/A`, as a link's is.
+*/
+function writeOutlineFields(runtime, docPtr, objectNumber, fields) {
+	const { fn, mem } = runtime;
+	const check = (ok, what) => {
+		if (!ok) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `the ${what} of outline item ${objectNumber} could not be written`);
+	};
+	if (fields.title !== void 0) {
+		const title = fields.title;
+		check(withUtf16String(mem, title, (ptr) => fn.EPDFOutline_SetTitle(docPtr, objectNumber, ptr)), "title");
+	}
+	if (fields.target !== void 0) {
+		const action = fields.target === null ? _embedpdf_engine_runtime.NULL_PTR : createLinkTargetAction(fn, mem, docPtr, fields.target);
+		check(fn.EPDFOutline_SetAction(docPtr, objectNumber, action), "target");
+	}
+	if (fields.color !== void 0) if (fields.color === null) check(fn.EPDFOutline_SetColor(docPtr, objectNumber, false, 0, 0, 0), "colour");
+	else {
+		const { r, g, b } = (0, _embedpdf_engine_core_runtime.rgbOf)(fields.color);
+		check(fn.EPDFOutline_SetColor(docPtr, objectNumber, true, r / 255, g / 255, b / 255), "colour");
+	}
+	if (fields.bold !== void 0 || fields.italic !== void 0) {
+		let flags = fn.FPDFBookmark_GetStyle(fn.EPDFOutline_GetItem(docPtr, objectNumber));
+		if (fields.bold !== void 0) flags = fields.bold ? flags | BOLD : flags & -3;
+		if (fields.italic !== void 0) flags = fields.italic ? flags | ITALIC : flags & -2;
+		check(fn.EPDFOutline_SetStyle(docPtr, objectNumber, flags), "style");
+	}
+	if (fields.open !== void 0) check(fn.EPDFOutline_SetOpen(docPtr, objectNumber, fields.open), "open state");
+}
+//#endregion
+//#region src/features/outline/OutlineMutator.ts
+/**
+* Synchronous outline writes, shared by the local worker and the server.
+* Each checks everything it can before the first native write, and answers
+* with what it wrote, re-read. The fork keeps the links and `/Count` right
+* (public/epdf_outline.h); what goes where is decided here.
+*/
+var OutlineMutator = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
+		_defineProperty(this, "reader", void 0);
+		this.reader = new OutlineReader(runtime, session);
+	}
+	/** The outline's shape as it is now. */
+	tree() {
+		return new OutlineTree(this.runtime.fn, this.session.requireDocPtr());
+	}
+	create(parent, position, data, objectNumber) {
+		assertWritableFields(data);
+		const tree = this.tree();
+		const parentNumber = this.parentNumberOf(tree, parent);
+		const children = tree.childrenOf(parentNumber);
+		const at = (0, _embedpdf_engine_core_runtime.positionIndex)(children.map(_embedpdf_engine_core_runtime.toOutlineItemRef), position, keyOf);
+		const after = at === 0 ? 0 : children[at - 1];
+		if (objectNumber !== void 0) this.session.claimObjectNumber(objectNumber);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const created = withUtf16String(mem, data.title, (title) => fn.EPDFOutline_CreateItem(docPtr, objectNumber ?? 0, parentNumber, after, title));
+		if (!created) throw outlineRefused("create the item");
+		const { title: _title, ...fields } = data;
+		writeOutlineFields(this.runtime, docPtr, created, fields);
+		const item = this.reader.readItem(created, parentNumber);
+		return {
+			item,
+			order: this.orderOf(this.tree(), parentNumber),
+			meta: this.meta([item.ref])
+		};
+	}
+	update(ref, patch) {
+		assertWritableFields(patch);
+		const tree = this.tree();
+		const parent = this.requireItem(tree, ref, "ref");
+		writeOutlineFields(this.runtime, this.session.requireDocPtr(), ref.objectNumber, patch);
+		return {
+			item: this.reader.readItem(ref.objectNumber, parent),
+			meta: this.meta([ref])
+		};
+	}
+	/**
+	* The items go together, in the order given, under `parent` at `position`
+	* among its children; the rules of a reorder (`reorderedList`) hold.
+	*/
+	move(refs, parent, position) {
+		const tree = this.tree();
+		const items = refs.map((ref) => {
+			this.requireItem(tree, ref, "refs");
+			return ref.objectNumber;
+		});
+		const moving = new Set(items);
+		if (moving.size !== items.length) invalid("refs", "an item is named twice");
+		for (const item of items) if (items.some((other) => other !== item && tree.isAtOrUnder(item, other))) invalid("refs", `item ${item} is under another item that moves`);
+		const parentNumber = this.parentNumberOf(tree, parent);
+		if (items.some((item) => tree.isAtOrUnder(parentNumber, item))) invalid("parent", "an item would go under itself");
+		const staying = tree.childrenOf(parentNumber).filter((child) => !moving.has(child));
+		const anchor = position === "start" || position === "end" ? null : "before" in position ? position.before : position.after;
+		if (anchor && moving.has(anchor.objectNumber)) invalid("position", `the neighbour ${anchor.objectNumber} is one of the items that move`);
+		const at = (0, _embedpdf_engine_core_runtime.positionIndex)(staying.map(_embedpdf_engine_core_runtime.toOutlineItemRef), position, keyOf);
+		let after = at === 0 ? 0 : staying[at - 1];
+		return this.place(items.map((item) => {
+			const placement = {
+				item,
+				parent: parentNumber,
+				after
+			};
+			after = item;
+			return placement;
+		}), tree);
+	}
+	/**
+	* Puts items where `placements` say, in order: each right after its
+	* `after` while that is a child of its parent, else first. What an undo of
+	* a move does; the caller has checked that each item and parent is there.
+	*/
+	place(placements, before = this.tree()) {
+		const { fn } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const parents = /* @__PURE__ */ new Set();
+		for (const { item, parent, after } of placements) {
+			parents.add(before.parentOf(item) ?? 0);
+			parents.add(parent);
+			const now = this.tree();
+			const anchor = after && now.parentOf(after) === parent ? after : 0;
+			if (!fn.EPDFOutline_MoveItem(docPtr, item, parent, anchor)) throw outlineRefused(`move item ${item}`);
+		}
+		const after = this.tree();
+		return {
+			orders: [...parents].map((parent) => this.orderOf(after, parent)),
+			meta: this.meta(placements.map(({ item }) => (0, _embedpdf_engine_core_runtime.toOutlineItemRef)(item)))
+		};
+	}
+	/** Where `items` are now, in document order: an anchor always comes before what follows it. */
+	placementsOf(items, tree = this.tree()) {
+		const wanted = new Set(items);
+		return tree.items().filter((item) => wanted.has(item)).map((item) => {
+			const parent = tree.parentOf(item);
+			const siblings = tree.childrenOf(parent);
+			const index = siblings.indexOf(item);
+			return {
+				item,
+				parent,
+				after: index > 0 ? siblings[index - 1] : 0
+			};
+		});
+	}
+	/** The item goes, with the items under it. */
+	delete(ref) {
+		const tree = this.tree();
+		this.requireItem(tree, ref, "ref");
+		const going = tree.subtreeOf(ref.objectNumber);
+		if (!this.runtime.fn.EPDFOutline_DeleteItem(this.session.requireDocPtr(), ref.objectNumber)) throw outlineRefused(`delete item ${ref.objectNumber}`);
+		return { meta: this.meta(going.map(_embedpdf_engine_core_runtime.toOutlineItemRef)) };
+	}
+	/**
+	* The items a capture brought back (`importOutlineItem`, run by the
+	* caller): the item first, then the items under it, and its parent's
+	* children.
+	*/
+	restored(objectNumber) {
+		const tree = this.tree();
+		const parent = tree.parentOf(objectNumber);
+		if (parent === void 0) throw outlineRefused(`restore item ${objectNumber}`);
+		const items = this.subtree(objectNumber, tree);
+		return {
+			items,
+			order: this.orderOf(tree, parent),
+			meta: this.meta(items.map((item) => item.ref))
+		};
+	}
+	/** The item as it reads now; `null` when the outline has no such item. */
+	find(ref, tree = this.tree()) {
+		const parent = tree.parentOf(ref.objectNumber);
+		return parent === void 0 ? null : this.reader.readItem(ref.objectNumber, parent);
+	}
+	/** The item and the items under it, depth first, as they read now. */
+	subtree(objectNumber, tree = this.tree()) {
+		return tree.subtreeOf(objectNumber).map((item) => this.reader.readItem(item, tree.parentOf(item)));
+	}
+	/** An update's answer for an item written some other way: a revert put it back. */
+	updated(ref) {
+		const item = this.find(ref);
+		if (!item) throw outlineRefused(`read item ${ref.objectNumber}`);
+		return {
+			item,
+			meta: this.meta([ref])
+		};
+	}
+	/**
+	* Counts the items above `ref` again from the tree, as every outline write
+	* does: a revert puts back the item's own dictionary, its `/Count` with
+	* it, and nothing above it. Setting the open state it reads changes
+	* nothing else.
+	*/
+	countAgain(ref) {
+		const item = this.find(ref);
+		if (!item) return;
+		writeOutlineFields(this.runtime, this.session.requireDocPtr(), ref.objectNumber, { open: item.open });
+	}
+	/**
+	* The number a parent ref names: {@link TOP} for `null`; `NotFound` when it
+	* isn't an item; `InvalidArg` for an item at the deepest level a read goes
+	* to, whose children no read shows.
+	*/
+	parentNumberOf(tree, parent) {
+		if (parent === null) return 0;
+		this.requireItem(tree, parent, "parent");
+		if ((tree.levelOf(parent.objectNumber) ?? 0) >= _embedpdf_engine_core_runtime.OUTLINE_READ_LIMITS.depth - 1) invalid("parent", `an item under ${parent.objectNumber} would be deeper than reads go`);
+		return parent.objectNumber;
+	}
+	/** The item's parent; `NotFound` when the outline has no such item. */
+	requireItem(tree, ref, field) {
+		const parent = tree.parentOf(ref.objectNumber);
+		if (parent === void 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no outline item ${ref.objectNumber}`, { details: { field } });
+		return parent;
+	}
+	orderOf(tree, parent) {
+		return {
+			parent: parent === 0 ? null : (0, _embedpdf_engine_core_runtime.toOutlineItemRef)(parent),
+			children: tree.childrenOf(parent).map(_embedpdf_engine_core_runtime.toOutlineItemRef)
+		};
+	}
+	meta(changed) {
+		return {
+			affectedPages: [],
+			cacheDelta: null,
+			...this.session.writeStamp(),
+			changed
+		};
+	}
+};
+const keyOf = (ref) => String(ref.objectNumber);
+function invalid(field, message) {
+	throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, message, { details: { field } });
+}
+/**
+* The fork refused a write the checks above let through: a list it would
+* change holds an item that isn't an indirect object, or `/Root /Outlines`
+* is a direct dictionary.
+*/
+function outlineRefused(what) {
+	return new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.MalformedPdf, `could not ${what}: the outline holds an item that isn't an indirect object`);
+}
+//#endregion
+//#region src/features/changes/internal/outlineChanges.ts
+/** The fields an update can change, each with a value a revert can put back. */
+const FIELDS = [
+	"title",
+	"target",
+	"color",
+	"bold",
+	"italic",
+	"open"
+];
+/** What a capture of an item follows: its action, and its destination. */
+const TARGET_KEYS = ["A", "Dest"];
+const mutatorOf$1 = (ctx) => new OutlineMutator(ctx.runtime, ctx.session);
+const authorize$1 = (ctx) => (0, _embedpdf_engine_core_runtime.authorizeCapability)(ctx.authority, "doc.outline.modify");
+/** `outline.create`; its reverse deletes the item while nobody changed it since. */
+function createOutlineItem(ctx, op) {
+	authorize$1(ctx);
+	const result = mutatorOf$1(ctx).create(op.parent, op.position ?? "end", op.data, op.objectNumber);
+	return {
+		item: {
+			type: "outline.create",
+			...result
+		},
+		reverse: [{
+			kind: "outline.remove",
+			ref: result.item.ref,
+			left: guardOf(ctx, [result.item.ref])
+		}]
+	};
+}
+/**
+* `outline.update`; its reverse puts the item's dictionary back as it was,
+* or, when someone changed it since, the fields still holding what it set.
+*/
+function updateOutlineItem(ctx, op, opIndex) {
+	authorize$1(ctx);
+	const before = requireItem(ctx, op.ref);
+	assertExpected(opIndex, before, op.expect);
+	return writeUpdate(ctx, op.ref, op.patch, before);
+}
+/**
+* `outline.move`; its reverse puts each item back beside the sibling it
+* followed, and opens again a parent it emptied that was open.
+*/
+function moveOutlineItems(ctx, op) {
+	authorize$1(ctx);
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const items = op.refs.map((ref) => ref.objectNumber);
+	const back = mutator.placementsOf(items, tree);
+	const reopens = reopensOf(ctx, tree, items);
+	const result = mutator.move(op.refs, op.parent, op.position);
+	const parent = op.parent?.objectNumber ?? 0;
+	return {
+		item: {
+			type: "outline.move",
+			...result
+		},
+		reverse: [{
+			kind: "outline.move",
+			placements: back,
+			left: items.map((item) => ({
+				item,
+				parent
+			}))
+		}, ...reopens]
+	};
+}
+/** `outline.delete`; its reverse brings the item and the items under it back. */
+function deleteOutlineItem(ctx, op, opIndex) {
+	authorize$1(ctx);
+	assertExpected(opIndex, requireItem(ctx, op.ref), op.expect);
+	return writeDelete$1(ctx, op.ref);
+}
+/** Puts an item's dictionary back, or the fields that still show the update (see `updateOutlineItem`). */
+function revertOutlineItem(ctx, step) {
+	const ref = step.subject.outlineItem;
+	const mutator = mutatorOf$1(ctx);
+	const current = mutator.find(ref);
+	if (!current) return leftAlone(ctx, "outline.update");
+	authorize$1(ctx);
+	if (unchangedSince(ctx.runtime, ctx.session, step.objects)) {
+		const reverted = revertObjects(ctx.runtime, ctx.session, step.objects);
+		mutator.countAgain(ref);
+		const redo = captureAfter(ctx.runtime, ctx.session, reverted);
+		return {
+			item: {
+				type: "outline.update",
+				...mutator.updated(ref)
+			},
+			reverse: [{
+				...step,
+				objects: redo,
+				...swapped(step.fallback)
+			}]
+		};
+	}
+	const fallback = step.fallback;
+	if (fallback?.kind !== "outline") return leftAlone(ctx, "outline.update");
+	const now = current;
+	const left = fallback.left;
+	const restore = fallback.restore;
+	const keys = Object.keys(left);
+	const kept = keys.filter((key) => valuesEqual(now[key], left[key]) && writable(ctx, key, restore[key]));
+	if (kept.length === 0) return leftAlone(ctx, "outline.update");
+	const done = writeUpdate(ctx, ref, Object.fromEntries(kept.map((key) => [key, restore[key]])), current);
+	const skipped = keys.filter((key) => !kept.includes(key));
+	if (skipped.length === 0 || done.item.type !== "outline.update") return done;
+	return {
+		...done,
+		item: {
+			...done.item,
+			skipped
+		}
+	};
+}
+/**
+* Deletes what a create or a restore brought back, while the item and the
+* items under it are the same ones and read exactly as the change left them.
+*/
+function removeOutlineItem(ctx, step) {
+	const tree = mutatorOf$1(ctx).tree();
+	if (!tree.has(step.ref.objectNumber)) return leftAlone(ctx, "outline.delete");
+	authorize$1(ctx);
+	if (!valuesEqual(tree.subtreeOf(step.ref.objectNumber), step.left.map((object) => object.objectNumber)) || !unchangedSince(ctx.runtime, ctx.session, step.left)) return leftAlone(ctx, "outline.delete");
+	return writeDelete$1(ctx, step.ref);
+}
+/** Brings back what a delete removed, while its parent is there and it isn't back already. */
+function restoreOutlineItem(ctx, step) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	if (tree.has(step.ref.objectNumber)) return leftAlone(ctx, "outline.restore");
+	if (step.parent && !tree.has(step.parent.objectNumber)) return leftAlone(ctx, "outline.restore");
+	authorize$1(ctx);
+	importOutlineItem(ctx.runtime, ctx.session.requireDocPtr(), step.capture);
+	const result = mutator.restored(step.ref.objectNumber);
+	return {
+		item: {
+			type: "outline.restore",
+			...result
+		},
+		reverse: [{
+			kind: "outline.remove",
+			ref: step.ref,
+			left: guardOf(ctx, result.items.map((item) => item.ref))
+		}]
+	};
+}
+/**
+* Puts items back where a move found them: each still under the parent the
+* move left it under, its old parent still there, and not under itself.
+*/
+function moveOutlineItemsBack(ctx, step) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const leftUnder = new Map(step.left.map(({ item, parent }) => [item, parent]));
+	const placements = step.placements.filter(({ item, parent }) => tree.parentOf(item) === leftUnder.get(item) && (parent === 0 || tree.has(parent)) && !tree.isAtOrUnder(parent, item));
+	if (placements.length === 0) return leftAlone(ctx, "outline.move");
+	authorize$1(ctx);
+	const items = placements.map(({ item }) => item);
+	const back = mutator.placementsOf(items, tree);
+	const reopens = reopensOf(ctx, tree, items);
+	return {
+		item: {
+			type: "outline.move",
+			...mutator.place(placements, tree)
+		},
+		reverse: [{
+			kind: "outline.move",
+			placements: back,
+			left: placements.map(({ item, parent }) => ({
+				item,
+				parent
+			}))
+		}, ...reopens]
+	};
+}
+/** Opens a parent again, as its step says (see `OutlineReopenStep`). */
+function reopenOutlineItem(ctx, step) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const item = mutator.find(step.ref, tree);
+	const children = tree.childrenOf(step.ref.objectNumber);
+	const same = children.length === step.children.length && children.every((child) => step.children.includes(child));
+	if (!item || item.open || !same) return leftAlone(ctx, "outline.update");
+	authorize$1(ctx);
+	return {
+		item: {
+			type: "outline.update",
+			...mutator.update(step.ref, { open: true })
+		},
+		reverse: []
+	};
+}
+/** An update, captured so it can be put back exactly. */
+function writeUpdate(ctx, ref, patch, before) {
+	const pending = captureBefore(ctx.runtime, ctx.session, [{
+		objectNumber: ref.objectNumber,
+		deep: TARGET_KEYS
+	}]);
+	const result = mutatorOf$1(ctx).update(ref, patch);
+	const objects = captureAfter(ctx.runtime, ctx.session, pending);
+	return {
+		item: {
+			type: "outline.update",
+			...result
+		},
+		reverse: [{
+			kind: "objects.revert",
+			reports: "outline.update",
+			objects,
+			subject: { outlineItem: ref },
+			fallback: fallbackOf(before, result.item, patch)
+		}]
+	};
+}
+/**
+* A delete, captured in its transaction so an undo brings back the same
+* objects, and opens again the parent it emptied when it was open.
+*/
+function writeDelete$1(ctx, ref) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const parent = tree.parentOf(ref.objectNumber);
+	const reopens = reopensOf(ctx, tree, [ref.objectNumber]);
+	const capture = exportOutlineItem(ctx.runtime, ctx.session.requireDocPtr(), ref.objectNumber);
+	return {
+		item: {
+			type: "outline.delete",
+			...mutator.delete(ref)
+		},
+		reverse: [{
+			kind: "outline.restore",
+			ref,
+			parent: parent === void 0 || parent === 0 ? null : (0, _embedpdf_engine_core_runtime.toOutlineItemRef)(parent),
+			capture
+		}, ...reopens]
+	};
+}
+/**
+* The parents that lose every child when `items` leave them, and are open:
+* each comes back closed with its children, so the undo opens it again.
+*/
+function reopensOf(ctx, tree, items) {
+	const leaving = new Set(items);
+	const parents = new Set(items.map((item) => tree.parentOf(item) ?? 0));
+	parents.delete(0);
+	return [...parents].flatMap((parent) => {
+		const children = tree.childrenOf(parent);
+		if (!children.every((child) => leaving.has(child))) return [];
+		if (!mutatorOf$1(ctx).find((0, _embedpdf_engine_core_runtime.toOutlineItemRef)(parent), tree)?.open) return [];
+		return [{
+			kind: "outline.reopen",
+			ref: (0, _embedpdf_engine_core_runtime.toOutlineItemRef)(parent),
+			children
+		}];
+	});
+}
+/** The guard of items a change leaves: each dictionary as it reads now. */
+function guardOf(ctx, refs) {
+	return captureAfter(ctx.runtime, ctx.session, refs.map((ref) => ({
+		objectNumber: ref.objectNumber,
+		deep: [],
+		before: null
+	})));
+}
+function requireItem(ctx, ref) {
+	const item = mutatorOf$1(ctx).find(ref);
+	if (!item) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no outline item ${ref.objectNumber}`, { details: { field: "ref" } });
+	return item;
+}
+/** The fields an update changed: their values before, and the values it left. */
+function fallbackOf(before, after, patch) {
+	const changed = FIELDS.filter((field) => patch[field] !== void 0 && !valuesEqual(before[field], after[field]));
+	return {
+		kind: "outline",
+		restore: Object.fromEntries(changed.map((field) => [field, before[field]])),
+		left: Object.fromEntries(changed.map((field) => [field, after[field]]))
+	};
+}
+/**
+* Whether a value read back can be written again: a target another app made
+* may not be, nor one that goes to a page the document no longer has.
+*/
+function writable(ctx, field, value) {
+	if (field !== "target" || value === null) return true;
+	const target = value;
+	if (target.kind === "goto") {
+		const page = target.destination?.page.objectNumber;
+		return ctx.session.allRecords().some((record) => record.pageObjectNumber === page);
+	}
+	if (target.kind === "uri") return true;
+	return target.kind === "named" && [
+		"NextPage",
+		"PrevPage",
+		"FirstPage",
+		"LastPage"
+	].includes(target.name ?? "");
+}
+function swapped(fallback) {
+	if (fallback?.kind !== "outline") return fallback ? { fallback } : {};
+	return { fallback: {
+		kind: "outline",
+		restore: fallback.left,
+		left: fallback.restore
+	} };
+}
+//#endregion
+//#region src/features/changes/internal/pageChanges.ts
+/** What a page's guard digests: the page, and what the layer holds of these. */
+const PAGE_DEEP_KEYS = [
+	"Annots",
+	"Contents",
+	"Resources"
+];
+/**
+* What it leaves out of the page's bytes: its place (/Parent), so moving
+* pages around it changes nothing, and its /Rotate, which counts by value
+* instead: turning a page and turning it back reads the same.
+*/
+const PAGE_SKIPPED_KEYS = ["Parent", "Rotate"];
+/**
+* Runs a page op or step. It changes the page tree in place, so the
+* document's idle parsed pages close before and after it, as a
+* `contentWrite` job's do: no page that went, or came back, stays parsed.
+*/
+function changingPageTree(ctx, write) {
+	const pool = ctx.session.pagePool();
+	pool.closeIdle();
+	try {
+		return write();
+	} finally {
+		pool.closeIdle();
+	}
+}
+const mutatorOf = (ctx) => new PagesMutator(ctx.runtime, ctx.session);
+const inserterOf = (ctx) => new PagesInserter(ctx.runtime, ctx.session);
+const authorize = (ctx) => (0, _embedpdf_engine_core_runtime.authorizeCapability)(ctx.authority, "doc.pages.assemble");
+/** `pages.rotate`; its reverse turns each page back while it still has this rotation. */
+function rotatePages(ctx, op) {
+	authorize(ctx);
+	const before = rotationsOf(layoutOf(ctx));
+	const result = mutatorOf(ctx).rotate([...op.pages], op.rotation, ctx.signal);
+	const pages = op.pages.map((page) => page.objectNumber);
+	return {
+		item: {
+			type: "pages.rotate",
+			pages: [...op.pages],
+			rotation: op.rotation,
+			...result
+		},
+		reverse: rotateSteps(pages, before, op.rotation)
+	};
+}
+/** Turns pages to a step's rotation, those that still have the rotation it left. */
+function rotatePagesBack(ctx, step) {
+	const now = rotationsOf(layoutOf(ctx));
+	const pages = step.pages.filter((page) => now.get(page) === step.left);
+	if (pages.length === 0) return leftAlone(ctx, "pages.rotate");
+	authorize(ctx);
+	const refs = pages.map(_embedpdf_engine_core_runtime.toPageRef);
+	const result = mutatorOf(ctx).rotate(refs, step.rotation, ctx.signal);
+	return {
+		item: {
+			type: "pages.rotate",
+			pages: refs,
+			rotation: step.rotation,
+			...result
+		},
+		reverse: [{
+			kind: "pages.rotate",
+			pages,
+			rotation: step.left,
+			left: step.rotation
+		}]
+	};
+}
+/** `pages.reorder`; its reverse puts each page back after the page it followed. */
+function reorderPages(ctx, op) {
+	authorize(ctx);
+	const pages = op.pages.map((page) => page.objectNumber);
+	const back = placementsOf(orderOf(ctx), pages);
+	return {
+		item: {
+			type: "pages.reorder",
+			...mutatorOf(ctx).reorder([...op.pages], op.position, ctx.signal)
+		},
+		reverse: [{
+			kind: "pages.reorder",
+			placements: back,
+			left: placementsOf(orderOf(ctx), pages)
+		}]
+	};
+}
+/**
+* Puts pages back where a move found them: each still after the page the move
+* left it after, the page it goes after still there.
+*/
+function reorderPagesBack(ctx, step) {
+	const order = orderOf(ctx);
+	const leftAfter = new Map(step.left.map(({ page, after }) => [page, after]));
+	const placements = step.placements.filter(({ page, after }) => {
+		const at = order.indexOf(page);
+		return at >= 0 && (order[at - 1] ?? 0) === leftAfter.get(page) && (after === 0 || order.includes(after));
+	});
+	if (placements.length === 0) return leftAlone(ctx, "pages.reorder");
+	authorize(ctx);
+	const pages = placements.map(({ page }) => page);
+	const back = placementsOf(order, pages);
+	const mutator = mutatorOf(ctx);
+	let layout = null;
+	for (const { page, after } of placements) {
+		const position = after === 0 ? "start" : { after: (0, _embedpdf_engine_core_runtime.toPageRef)(after) };
+		({layout} = mutator.reorder([(0, _embedpdf_engine_core_runtime.toPageRef)(page)], position, ctx.signal));
+	}
+	return {
+		item: {
+			type: "pages.reorder",
+			pages: pages.map(_embedpdf_engine_core_runtime.toPageRef),
+			layout,
+			meta: metaOf(ctx)
+		},
+		reverse: [{
+			kind: "pages.reorder",
+			placements: back,
+			left: placementsOf(orderOf(ctx), pages)
+		}]
+	};
+}
+/** `pages.delete`, captured in its transaction so an undo brings back the same pages. */
+function deletePages(ctx, op) {
+	authorize(ctx);
+	return writeDelete(ctx, inDisplayOrder(orderOf(ctx), ctx.session.resolvePageRefs(op.pages)));
+}
+/** Brings back pages a delete removed, those that aren't back already. */
+function restorePages(ctx, step) {
+	const order = orderOf(ctx);
+	const gone = step.pages.filter(({ page }) => !order.includes(page));
+	if (gone.length === 0) return leftAlone(ctx, "pages.restore");
+	authorize(ctx);
+	const docPtr = ctx.session.requireDocPtr();
+	for (const { capture } of gone) importPage(ctx.runtime, docPtr, capture);
+	ctx.session.refreshPageRegistry();
+	ctx.session.invalidateDerived();
+	const pages = inDisplayOrder(orderOf(ctx), gone.map(({ page }) => page));
+	return {
+		item: {
+			type: "pages.restore",
+			pages: pages.map(_embedpdf_engine_core_runtime.toPageRef),
+			layout: layoutOf(ctx),
+			meta: metaOf(ctx)
+		},
+		reverse: [removeStepOf(ctx, pages)]
+	};
+}
+/**
+* Deletes pages an insert or a restore brought, those that read as the change
+* left them; never every page of the document.
+*/
+function removePages(ctx, step) {
+	const order = orderOf(ctx);
+	const pages = step.pages.filter(({ page, left }) => order.includes(page) && digestOf(ctx, page) === left).map(({ page }) => page);
+	if (pages.length === 0 || pages.length >= order.length) return leftAlone(ctx, "pages.delete");
+	authorize(ctx);
+	return writeDelete(ctx, inDisplayOrder(order, pages));
+}
+/** `pages.insertBlank`; its reverse deletes the new pages while nobody changed them. */
+function insertBlankPages(ctx, op) {
+	authorize(ctx);
+	const result = inserterOf(ctx).insertBlank(op.spec, op.position ?? "end", ctx.signal, op.objectNumbers);
+	const pages = result.insertedPages.map((page) => page.objectNumber);
+	return {
+		item: {
+			type: "pages.insertBlank",
+			...result
+		},
+		reverse: [removeStepOf(ctx, pages)]
+	};
+}
+/** `pages.insert`; its reverse deletes the pages it copied in while nobody changed them. */
+function insertPages(ctx, op) {
+	authorize(ctx);
+	const result = inserterOf(ctx).insert(bufferOf(op.source), op.position ?? "end", ctx.signal);
+	ctx.session.invalidateDerived();
+	const pages = result.insertedPages.map((page) => page.objectNumber);
+	return {
+		item: {
+			type: "pages.insert",
+			...result
+		},
+		reverse: [removeStepOf(ctx, pages)]
+	};
+}
+/** Deletes `pages`, in display order, each captured first so its restore brings it back. */
+function writeDelete(ctx, pages) {
+	const docPtr = ctx.session.requireDocPtr();
+	const captures = pages.map((page) => ({
+		page,
+		capture: exportPage(ctx.runtime, docPtr, page)
+	}));
+	const refs = pages.map(_embedpdf_engine_core_runtime.toPageRef);
+	const result = mutatorOf(ctx).delete(refs, ctx.signal);
+	ctx.session.invalidateDerived();
+	return {
+		item: {
+			type: "pages.delete",
+			pages: refs,
+			...result
+		},
+		reverse: [{
+			kind: "pages.restore",
+			pages: captures
+		}]
+	};
+}
+/** The step that deletes `pages` again while each reads as it does now. */
+function removeStepOf(ctx, pages) {
+	return {
+		kind: "pages.remove",
+		pages: pages.map((page) => ({
+			page,
+			left: digestOf(ctx, page)
+		}))
+	};
+}
+/**
+* How a page reads now: the digest of its dictionary and of what the layer
+* holds of its annotations, contents and resources, as they read (canonical
+* bytes: a save that only encodes a stream again changes nothing), without
+* its place, and with its turn as a value.
+*/
+function digestOf(ctx, page) {
+	const { fn, mem } = ctx.runtime;
+	const docPtr = ctx.session.requireDocPtr();
+	const bytes = canonicalDict(ctx.runtime, docPtr, page, PAGE_DEEP_KEYS, PAGE_SKIPPED_KEYS);
+	const index = ctx.session.allRecords().find((record) => record.pageObjectNumber === page);
+	const turn = index ? rotationAt(ctx.runtime, docPtr, index.pageIndex) : 0;
+	const turned = new TextEncoder().encode(`\nturn ${turn}`);
+	const digested = new Uint8Array(bytes.byteLength + turned.byteLength);
+	digested.set(bytes);
+	digested.set(turned, bytes.byteLength);
+	return sha256HexOf(fn, mem, digested);
+}
+/** The steps that turn each page back, one for each rotation the pages had. */
+function rotateSteps(pages, before, left) {
+	const byRotation = /* @__PURE__ */ new Map();
+	for (const page of pages) {
+		const rotation = before.get(page);
+		byRotation.set(rotation, [...byRotation.get(rotation) ?? [], page]);
+	}
+	return [...byRotation].map(([rotation, group]) => ({
+		kind: "pages.rotate",
+		pages: group,
+		rotation,
+		left
+	}));
+}
+/** Where each of `pages` is in `order`: the page it follows (0: first), in display order. */
+function placementsOf(order, pages) {
+	return inDisplayOrder(order, pages).map((page) => ({
+		page,
+		after: order[order.indexOf(page) - 1] ?? 0
+	}));
+}
+/** `pages` sorted as `order` has them. */
+function inDisplayOrder(order, pages) {
+	return [...pages].sort((left, right) => order.indexOf(left) - order.indexOf(right));
+}
+/** The document's pages by object number, in display order. */
+function orderOf(ctx) {
+	return ctx.session.allRecords().map((record) => record.pageObjectNumber);
+}
+function layoutOf(ctx) {
+	return new PagesReader(ctx.runtime, ctx.session).read(ctx.signal);
+}
+function rotationsOf(layout) {
+	return new Map(layout.pages.map((page) => [page.ref.objectNumber, page.rotation]));
+}
+function metaOf(ctx) {
+	return {
+		affectedPages: [],
+		cacheDelta: null,
+		...ctx.session.writeStamp()
+	};
+}
+/** The bytes of `source` as an ArrayBuffer of their own. */
+function bufferOf(source) {
+	return source.byteOffset === 0 && source.byteLength === source.buffer.byteLength ? source.buffer : source.slice().buffer;
+}
+//#endregion
+//#region src/features/changes/ChangeApplier.ts
+/**
+* The file's own coordinates, in and out: for a single verb's one-op change,
+* whose job converts at the worker's boundary.
+*/
+const FILE_SPACE = {
+	opInFileSpace: (op) => op,
+	itemOut: (item) => item
+};
+/**
+* Runs changes inside the job's layer transaction, which its caller opens and
+* ends, so a failure anywhere leaves the document as it was: a change's ops in
+* order (`apply`), or the steps of a recorded reverse (`undo`). Each op and
+* step is checked against the change's authority as it runs, as its single
+* verb's job checks it.
+*
+* Every op records the steps that reverse it as it runs, from what it found
+* and wrote; the record lists them in reverse op order, so each step meets the
+* document as the op after it left it.
+*/
+var ChangeApplier = class {
+	constructor(runtime, session, fonts) {
+		this.runtime = runtime;
+		this.session = session;
+		this.fonts = fonts;
+	}
+	apply(ops, authority, signal, space) {
+		const ctx = this.context(authority, signal, (self) => opsFillOwnField(self, ops));
+		return collect(authority, ops.map((op, at) => () => runOp(ctx, space.opInFileSpace(op), at)), space, signal);
+	}
+	undo(record, authority, signal, space) {
+		const ctx = this.context(authority, signal, (self) => stepsFillOwnField(self, record.steps));
+		return collect(authority, record.steps.map((step) => () => runStep(ctx, step)), space, signal);
+	}
+	context(authority, signal, ownFill) {
+		let answer;
+		const ctx = {
+			runtime: this.runtime,
+			session: this.session,
+			...this.fonts ? { fonts: this.fonts } : {},
+			authority,
+			signal,
+			fillsOwnField: () => answer ?? (answer = ownFill(ctx))
+		};
+		return ctx;
+	}
+};
+/**
+* Runs each in order, its item measured as soon as it ran; the record
+* reverses them in the opposite order.
+*/
+function collect(authority, runs, space, signal) {
+	const items = [];
+	const reverses = [];
+	for (const run of runs) {
+		throwIfAborted(signal);
+		const done = run();
+		items.push(space.itemOut(done.item));
+		reverses.push(done.reverse);
+	}
+	return {
 		items,
 		record: {
 			userId: authority.identity.userId ?? null,
@@ -14378,17 +15852,34 @@ function runOp(ctx, op, at) {
 		case "forms.importValues": return importFormValues(ctx, op);
 		case "metadata.update": return updateMetadata(ctx, op, at);
 		case "metadata.updateCustom": return updateCustomMetadata(ctx, op);
+		case "outline.create": return createOutlineItem(ctx, op);
+		case "outline.update": return updateOutlineItem(ctx, op, at);
+		case "outline.move": return moveOutlineItems(ctx, op);
+		case "outline.delete": return deleteOutlineItem(ctx, op, at);
+		case "pages.rotate": return changingPageTree(ctx, () => rotatePages(ctx, op));
+		case "pages.reorder": return changingPageTree(ctx, () => reorderPages(ctx, op));
+		case "pages.delete": return changingPageTree(ctx, () => deletePages(ctx, op));
+		case "pages.insertBlank": return changingPageTree(ctx, () => insertBlankPages(ctx, op));
+		case "pages.insert": return changingPageTree(ctx, () => insertPages(ctx, op));
+		case "attachments.create": return createAttachment(ctx, op);
+		case "attachments.delete": return deleteAttachment(ctx, op);
 	}
 }
 function runStep(ctx, step) {
 	switch (step.kind) {
-		case "objects.revert": return "annotation" in step.subject ? revertAnnotation(ctx, {
-			...step,
-			subject: step.subject
-		}) : revertForm(ctx, {
-			...step,
-			subject: step.subject
-		});
+		case "objects.revert":
+			if ("annotation" in step.subject) return revertAnnotation(ctx, {
+				...step,
+				subject: step.subject
+			});
+			if ("outlineItem" in step.subject) return revertOutlineItem(ctx, {
+				...step,
+				subject: step.subject
+			});
+			return revertForm(ctx, {
+				...step,
+				subject: step.subject
+			});
 		case "annotation.remove": return removeAnnotation(ctx, step);
 		case "annotation.restore": return restoreAnnotations(ctx, step);
 		case "annotation.reorder": return reorderBack(ctx, step);
@@ -14398,6 +15889,16 @@ function runStep(ctx, step) {
 		case "widget.delete": return deleteRestoredWidget(ctx, step);
 		case "calculations.restore": return restoreCalculationOrder(ctx, step);
 		case "metadata.revert": return revertMetadata(ctx, step);
+		case "outline.remove": return removeOutlineItem(ctx, step);
+		case "outline.restore": return restoreOutlineItem(ctx, step);
+		case "outline.move": return moveOutlineItemsBack(ctx, step);
+		case "outline.reopen": return reopenOutlineItem(ctx, step);
+		case "pages.rotate": return changingPageTree(ctx, () => rotatePagesBack(ctx, step));
+		case "pages.reorder": return changingPageTree(ctx, () => reorderPagesBack(ctx, step));
+		case "pages.restore": return changingPageTree(ctx, () => restorePages(ctx, step));
+		case "pages.remove": return changingPageTree(ctx, () => removePages(ctx, step));
+		case "attachments.remove": return removeAttachment(ctx, step);
+		case "attachments.restore": return restoreAttachment(ctx, step);
 	}
 }
 //#endregion
@@ -14417,6 +15918,19 @@ function recordBytes(record) {
 			objects(step.unlinked);
 			break;
 		case "field.restore":
+		case "outline.restore":
+			bytes += step.capture.byteLength;
+			break;
+		case "outline.remove":
+			objects(step.left);
+			break;
+		case "pages.restore":
+			for (const { capture } of step.pages) bytes += capture.byteLength;
+			break;
+		case "attachments.remove":
+			bytes += step.left.byteLength;
+			break;
+		case "attachments.restore":
 			bytes += step.capture.byteLength;
 			break;
 		default: break;
@@ -14562,172 +16076,6 @@ function unpackChangeRecord(reverse, capture) {
 	});
 }
 //#endregion
-//#region src/features/attachments/AttachmentReader.ts
-/**
-* Read-only access to embedded files, at both of their homes: the
-* document catalog's `/EmbeddedFiles` name tree (list / readFile by
-* index) and a FileAttachment annotation's `/FS` (readAnnotationFile by
-* ref). Pure reads over the session — no layer artifacts (the
-* `PagesExtractor` shape).
-*
-* Byte delivery mirrors the request's `path?`: absent → a standalone
-* buffer for the transfer list (browser); present → the decoded file is
-* streamed to `path` via `FPDF_FILEWRITE` (server), and only metadata
-* rides the response.
-*/
-var AttachmentReader = class {
-	constructor(runtime, session) {
-		this.runtime = runtime;
-		this.session = session;
-	}
-	/** Snapshot of the `/EmbeddedFiles` name tree, in tree (key-sorted) order. */
-	list(signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const count = fn.FPDFDoc_GetAttachmentCount(docPtr);
-		const items = [];
-		for (let index = 0; index < count; index++) {
-			const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
-			if (!attachmentPtr) continue;
-			const key = readAttachmentKey(fn, mem, docPtr, index) ?? "";
-			items.push({
-				...readAttachmentFileInfo(fn, mem, attachmentPtr),
-				ref: (0, _embedpdf_engine_core_runtime.toAttachmentRef)(key),
-				index
-			});
-		}
-		return items;
-	}
-	/** Decode one document-level embedded file, addressed by key. */
-	readFile(ref, path, maxDecodedBytes, signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
-		if (index < 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
-		const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
-		if (!attachmentPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `embedded file with key '${ref.key}' resolved to index ${index} but could not be opened`);
-		const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
-		return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
-	}
-	/** Decode the file embedded in a FileAttachment annotation's `/FS`. */
-	/** A file attachment annotation's file; a page not parsed yet loads in slices. */
-	async readAnnotationFile(pageObjectNumber, ref, path, maxDecodedBytes, signal, slices) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const pool = this.session.pagePool();
-		const pagePtr = await pool.acquireInSlices(pageObjectNumber, signal, slices);
-		let annotPtr = null;
-		try {
-			annotPtr = resolveAnnotPtr(this.runtime, this.session, pagePtr, ref);
-			const attachmentPtr = fn.FPDFAnnot_GetFileAttachment(annotPtr);
-			if (!attachmentPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "annotation is not a file attachment or carries no embedded file (/FS)");
-			const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
-			return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
-		} finally {
-			if (annotPtr !== null) fn.FPDFPage_CloseAnnot(annotPtr);
-			pool.release(pageObjectNumber);
-		}
-	}
-	extract(attachmentPtr, name, mimeType, path, maxDecodedBytes) {
-		if (path !== void 0) {
-			const { size } = extractAttachmentToFile(this.runtime, attachmentPtr, path, maxDecodedBytes);
-			return {
-				name,
-				...mimeType ? { mimeType } : {},
-				size,
-				path
-			};
-		}
-		const { bytes, size } = extractAttachmentToBuffer(this.runtime, attachmentPtr, maxDecodedBytes);
-		return {
-			name,
-			...mimeType ? { mimeType } : {},
-			size,
-			bytes
-		};
-	}
-};
-//#endregion
-//#region src/features/attachments/AttachmentMutator.ts
-/**
-* Create/delete mutations over the document catalog's `/EmbeddedFiles`
-* name tree — the doc-level sibling of `AnnotationMutator`, sharing the
-* write path (`writeAttachmentFilePayload`) with the file-attachment
-* annotation writer.
-*
-* Identity is the name-tree key (unique by construction). Note the
-* tree is key-sorted: both mutations shift other entries' indices; keys
-* never move. Layer persistence (`finishMutation`) and event publication
-* happen in the callers, exactly like every other mutation family.
-*/
-var AttachmentMutator = class {
-	constructor(runtime, session) {
-		this.runtime = runtime;
-		this.session = session;
-	}
-	/**
-	* Create an embedded file. `file.name` becomes the tree key (PDFium
-	* writes key = /UF = /F); a duplicate key rejects with `InvalidArg`.
-	* The result carries the read-back entry, `checksum`/`size`/dates
-	* included.
-	*/
-	create(file, resources, signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const resource = resources?.[file.resources.file];
-		if (!resource) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, `attachment file references resource '${file.resources.file}' but no such binary payload accompanied the mutation`);
-		if (file.name.length === 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, "attachment file requires a name");
-		if (resolveAttachmentIndex(fn, mem, docPtr, {
-			kind: "key",
-			key: file.name
-		}) !== -1) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.InvalidArg, `an embedded file with key '${file.name}' already exists — keys are unique; rename and retry`);
-		throwIfAborted(signal);
-		const namePtr = mem.writeU16String(file.name);
-		let attachmentPtr;
-		try {
-			attachmentPtr = fn.FPDFDoc_AddAttachment(docPtr, namePtr);
-		} finally {
-			mem.free(namePtr);
-		}
-		if (!attachmentPtr) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "FPDFDoc_AddAttachment returned NULL");
-		writeAttachmentFilePayload(fn, mem, attachmentPtr, docPtr, file, resource);
-		const ref = (0, _embedpdf_engine_core_runtime.toAttachmentRef)(file.name);
-		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
-		if (index < 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "created attachment did not resolve by key after the write");
-		return {
-			attachment: {
-				...readAttachmentFileInfo(fn, mem, attachmentPtr),
-				ref,
-				index
-			},
-			meta: {
-				affectedPages: [],
-				cacheDelta: null,
-				...this.session.writeStamp(),
-				changed: [ref]
-			}
-		};
-	}
-	/** Delete an embedded file by key. Unlinks the tree entry only. */
-	delete(ref, signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
-		if (index < 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
-		if (!fn.FPDFDoc_DeleteAttachment(docPtr, index)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, "FPDFDoc_DeleteAttachment returned false");
-		return { meta: {
-			affectedPages: [],
-			cacheDelta: null,
-			...this.session.writeStamp(),
-			changed: [ref]
-		} };
-	}
-};
-//#endregion
 //#region src/features/security/internal/buildSecurityInfo.ts
 /**
 * Single constructor for the "successfully inspected" shape of
@@ -15562,11 +16910,6 @@ function assertSealedSignature(runtime, docPtr, model, expected) {
 function sameRange(a, b) {
 	return a[0] === b[0] && a[1] === b[1] && a[2] === b[2] && a[3] === b[3];
 }
-function bytesEqual(a, b) {
-	if (a.byteLength !== b.byteLength) return false;
-	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
-	return true;
-}
 //#endregion
 //#region src/features/forms/internal/fieldGroups.ts
 /** The group of the field `fieldObjectNumber`; `null` in none, or when the form has no such field. */
@@ -17096,13 +18439,8 @@ function resultInPageSpace(payload, boxOf) {
 			...payload,
 			snapshot: (0, _embedpdf_engine_core_runtime.pageListOf)(payload.snapshot)
 		};
-		case "pages.reorder":
-		case "pages.rotate":
-		case "pages.delete":
 		case "pages.setName":
-		case "pages.removeName":
-		case "pages.insert":
-		case "pages.insertBlank": return {
+		case "pages.removeName": return {
 			...payload,
 			result: {
 				...payload.result,
@@ -17145,6 +18483,10 @@ function resultInPageSpace(payload, boxOf) {
 			...payload,
 			snapshot: (0, _embedpdf_engine_core_runtime.mapDocumentActions)(payload.snapshot, toPage)
 		};
+		case "outline.read": return {
+			...payload,
+			outline: (0, _embedpdf_engine_core_runtime.pageOutlineOf)(payload.outline, boxOf)
+		};
 		case "annotations.list": return {
 			...payload,
 			list: {
@@ -17166,17 +18508,8 @@ function resultInPageSpace(payload, boxOf) {
 				annotation: annotation(payload.result.annotation)
 			}
 		};
-		case "document.apply": return {
-			...payload,
-			result: changeResultInPageSpace(payload.result, boxOf)
-		};
-		case "document.applyChanges": return {
-			...payload,
-			outcomes: payload.outcomes.map((outcome) => outcome.status === "applied" ? {
-				...outcome,
-				result: changeResultInPageSpace(outcome.result, boxOf)
-			} : outcome)
-		};
+		case "document.apply":
+		case "document.applyChanges": return payload;
 		case "annotations.import": return {
 			...payload,
 			result: {
@@ -17271,17 +18604,8 @@ function requestInFileSpace(job, boxOf) {
 			...job,
 			draft: (0, _embedpdf_engine_core_runtime.pdfFormFieldDraftOf)(job.draft, boxOf)
 		};
-		case "document.apply": return {
-			...job,
-			change: changeInFileSpace(job.change, boxOf)
-		};
-		case "document.applyChanges": return {
-			...job,
-			changes: job.changes.map((entry) => ({
-				...entry,
-				change: changeInFileSpace(entry.change, boxOf)
-			}))
-		};
+		case "document.apply":
+		case "document.applyChanges": return job;
 		case "forms.addWidget": return {
 			...job,
 			placement: (0, _embedpdf_engine_core_runtime.pdfWidgetPlacementOf)(job.placement, boxOf)
@@ -17314,10 +18638,7 @@ function renderOptionsInFileSpace(options, visible) {
 		target: target.kind === "rect" ? (0, _embedpdf_engine_core_runtime.pdfRenderTargetOf)(target, visible()) : target
 	};
 }
-function changeInFileSpace(change, boxOf) {
-	if ("undoOf" in change) return change;
-	return { ops: change.ops.map((op) => opInFileSpace(op, boxOf)) };
-}
+/** An op's places in the file's coordinates, as its single verb's job's are. */
 function opInFileSpace(op, boxOf) {
 	switch (op.type) {
 		case "annotations.import":
@@ -17367,16 +18688,29 @@ function opInFileSpace(op, boxOf) {
 				expect: pdfWidgetPatchOf(expect, boxOf(op.widget.page), boxOf)
 			} : rest;
 		}
+		case "outline.create": return {
+			...op,
+			data: (0, _embedpdf_engine_core_runtime.pdfOutlineDraftOf)(op.data, boxOf)
+		};
+		case "outline.update": {
+			const { expect, ...rest } = op;
+			return {
+				...rest,
+				patch: (0, _embedpdf_engine_core_runtime.pdfOutlinePatchOf)(op.patch, boxOf),
+				...expect ? { expect: (0, _embedpdf_engine_core_runtime.pdfOutlinePatchOf)(expect, boxOf) } : {}
+			};
+		}
+		case "outline.delete": {
+			const { expect, ...rest } = op;
+			return expect ? {
+				...rest,
+				expect: (0, _embedpdf_engine_core_runtime.pdfOutlinePatchOf)(expect, boxOf)
+			} : rest;
+		}
 		default: return op;
 	}
 }
-/** What a change did, each place in page space, as its single verbs' results are. */
-function changeResultInPageSpace(result, boxOf) {
-	return {
-		...result,
-		items: result.items.map((item) => itemInPageSpace(item, boxOf))
-	};
-}
+/** What an op did, each place in page space, as its single verb's result is. */
 function itemInPageSpace(item, boxOf) {
 	if ((0, _embedpdf_engine_core_runtime.isSkippedItem)(item)) return item;
 	const annotation = (read) => (0, _embedpdf_engine_core_runtime.pageAnnotationOf)(read, boxOf(read.page), boxOf);
@@ -17428,6 +18762,24 @@ function itemInPageSpace(item, boxOf) {
 			field: item.field && (0, _embedpdf_engine_core_runtime.pageFormFieldOf)(item.field, boxOf),
 			widgets: widgets(item.widgets)
 		};
+		case "outline.create":
+		case "outline.update": return {
+			...item,
+			item: (0, _embedpdf_engine_core_runtime.pageOutlineItemOf)(item.item, boxOf)
+		};
+		case "outline.restore": return {
+			...item,
+			items: item.items.map((read) => (0, _embedpdf_engine_core_runtime.pageOutlineItemOf)(read, boxOf))
+		};
+		case "pages.rotate":
+		case "pages.reorder":
+		case "pages.delete":
+		case "pages.insertBlank":
+		case "pages.insert":
+		case "pages.restore": return {
+			...item,
+			layout: (0, _embedpdf_engine_core_runtime.pageListOf)(item.layout)
+		};
 		default: return item;
 	}
 }
@@ -17965,6 +19317,9 @@ var WorkerHost = class {
 				case "actions.read":
 					resultPack = this.handleActionsRead(msg, ctrl.signal);
 					break;
+				case "outline.read":
+					resultPack = this.handleOutlineRead(msg, ctrl.signal);
+					break;
 				case "annotations.list":
 					resultPack = this.handleAnnotationsList(msg, ctrl.signal);
 					break;
@@ -18070,15 +19425,6 @@ var WorkerHost = class {
 				case "pages.list":
 					resultPack = this.handlePagesList(msg, ctrl.signal);
 					break;
-				case "pages.reorder":
-					resultPack = this.handlePagesReorder(msg, ctrl.signal);
-					break;
-				case "pages.rotate":
-					resultPack = this.handlePagesRotate(msg, ctrl.signal);
-					break;
-				case "pages.delete":
-					resultPack = this.handlePagesDelete(msg, ctrl.signal);
-					break;
 				case "pages.setName":
 					resultPack = this.handlePagesSetName(msg, ctrl.signal);
 					break;
@@ -18109,24 +19455,12 @@ var WorkerHost = class {
 				case "pages.extract":
 					resultPack = this.handlePagesExtract(msg, ctrl.signal);
 					break;
-				case "pages.insert":
-					resultPack = this.handlePagesInsert(msg, ctrl.signal);
-					break;
-				case "pages.insertBlank":
-					resultPack = this.handlePagesInsertBlank(msg, ctrl.signal);
-					break;
 				case "attachments.list":
 					resultPack = this.handleAttachmentsList(msg, ctrl.signal);
 					break;
 				case "attachments.readFile":
 					resultPack = this.handleAttachmentsReadFile(msg, ctrl.signal);
 					break;
-				case "attachments.create":
-					resultPack = this.handleAttachmentsCreate(msg, ctrl.signal);
-					break;
-				case "attachments.delete":
-					resultPack = this.handleAttachmentsDelete(msg, ctrl.signal);
-					break;
 				case "measure.setScale":
 					resultPack = this.handleMeasureSetScale(msg, ctrl.signal);
 					break;
@@ -18484,6 +19818,13 @@ var WorkerHost = class {
 			snapshot: new DocumentActionsReader(this.runtime, session).read(signal)
 		});
 	}
+	handleOutlineRead(req, signal) {
+		const session = this.requireSession(req);
+		return (0, _embedpdf_engine_core_runtime.wirePack)({
+			tag: "outline.read",
+			outline: new OutlineReader(this.runtime, session).read(signal)
+		});
+	}
 	handleAnnotationsList(req, signal) {
 		const session = this.requireSession(req);
 		const pages = req.pages?.map((page) => session.resolvePageRef(page).pageObjectNumber);
@@ -18669,12 +20010,15 @@ var WorkerHost = class {
 		const prior = ledger.outcome(opId);
 		let result;
 		if (prior) result = this.replayed(prior, fingerprint, opId);
-		else result = this.recorded(session, opId, fingerprint, () => new ChangeApplier(this.runtime, session, this.fonts).apply(change.ops, authority, signal));
+		else result = this.recorded(session, opId, fingerprint, () => new ChangeApplier(this.runtime, session, this.fonts).apply(change.ops, authority, signal, FILE_SPACE));
 		const item = result.items[0];
 		if (!item || (0, _embedpdf_engine_core_runtime.isSkippedItem)(item)) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.Unknown, `${op.type} wrote nothing`);
 		return item;
 	}
-	/** A change's answer the first time, kept under its `opId`; a retry's checks. */
+	/**
+	* A change's answer the first time, kept under its `opId`; a retry's
+	* checks. The answer is in the space its job answered in (`ChangeOutcome`).
+	*/
 	replayed(prior, fingerprint, opId) {
 		if (prior.fingerprint !== fingerprint) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.IdempotencyKeyReused, `opId ${opId} already answered a different change`);
 		if (prior.kind === "refused") throw (0, _embedpdf_engine_core_runtime.deserializeError)(prior.error);
@@ -18707,12 +20051,13 @@ var WorkerHost = class {
 		session.assertUsable();
 		if (req.objectNumberFloor !== void 0) session.raiseLastObjectNumber(req.objectNumberFloor - 1);
 		const applier = new ChangeApplier(this.runtime, session, this.fonts);
+		const space = this.pageSpaceOf(session);
 		const records = /* @__PURE__ */ new Map();
 		const outcomes = [];
 		for (const entry of req.changes) {
 			session.beginTransaction(entry.opId);
 			try {
-				const applied = runServerChange(applier, entry, records, signal);
+				const applied = runServerChange(applier, entry, records, signal, space);
 				const result = resultOf(session, applied);
 				session.commitTransaction();
 				const record = result.meta.undoable ? applied.record : null;
@@ -18741,11 +20086,23 @@ var WorkerHost = class {
 		if (!outcomes.some((outcome) => outcome.status === "applied" && outcome.result.items.some(_embedpdf_engine_core_runtime.itemWrote))) return (0, _embedpdf_engine_core_runtime.wirePack)(payload);
 		return this.finishMutation(session, payload, req.artifactPath);
 	}
+	/**
+	* Page space for a change, measured as each op runs: the page boxes are read
+	* anew each time, as an op can add, remove or put back the page a later
+	* one names.
+	*/
+	pageSpaceOf(session) {
+		return {
+			opInFileSpace: (op) => opInFileSpace(op, visibleBoxReader(this.runtime, session)),
+			itemOut: (item) => itemInPageSpace(item, visibleBoxReader(this.runtime, session))
+		};
+	}
 	/** A change's ops, or the steps of the record an undo names. */
 	runChange(session, req, signal) {
 		const applier = new ChangeApplier(this.runtime, session, this.fonts);
+		const space = this.pageSpaceOf(session);
 		const userId = req.authority.identity.userId ?? null;
-		if (!(0, _embedpdf_engine_core_runtime.isUndoChange)(req.change)) return applier.apply(req.change.ops, req.authority, signal);
+		if (!(0, _embedpdf_engine_core_runtime.isUndoChange)(req.change)) return applier.apply(req.change.ops, req.authority, signal, space);
 		const kept = changeLedgerOf(session).record(req.change.undoOf);
 		if (!kept || "unavailable" in kept) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.UndoUnavailable, `change ${req.change.undoOf} can no longer be undone`, { details: { reason: kept ? kept.unavailable : "expired" } });
 		if (!kept.record) return {
@@ -18756,7 +20113,7 @@ var WorkerHost = class {
 			}
 		};
 		if (kept.record.userId !== null && kept.record.userId !== userId) throw new _embedpdf_engine_core_runtime.PermissionDenied("changes:undo", "target");
-		return applier.undo(kept.record, req.authority, signal);
+		return applier.undo(kept.record, req.authority, signal, space);
 	}
 	handlePagesList(req, signal) {
 		const session = this.requireSession(req);
@@ -18765,30 +20122,6 @@ var WorkerHost = class {
 			snapshot: new PagesReader(this.runtime, session).read(signal)
 		});
 	}
-	handlePagesReorder(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesMutator(this.runtime, session).reorder(req.pages, req.position, signal);
-		return this.finishMutation(session, {
-			tag: "pages.reorder",
-			result
-		}, req.artifactPath);
-	}
-	handlePagesRotate(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesMutator(this.runtime, session).rotate(req.pages, req.rotation, signal);
-		return this.finishMutation(session, {
-			tag: "pages.rotate",
-			result
-		}, req.artifactPath);
-	}
-	handlePagesDelete(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesMutator(this.runtime, session).delete(req.pages, signal);
-		return this.finishMutation(session, {
-			tag: "pages.delete",
-			result
-		}, req.artifactPath);
-	}
 	handlePagesSetName(req, signal) {
 		const session = this.requireSession(req);
 		const result = new PagesMutator(this.runtime, session).setName({
@@ -18841,32 +20174,13 @@ var WorkerHost = class {
 	}
 	handlePagesExtract(req, signal) {
 		const session = this.requireSession(req);
-		const extracted = new PagesExtractor(this.runtime, session).extract(req.pages, signal);
+		const extracted = new PagesExtractor(this.runtime, session).extract(req.pages, req.flatten, signal);
 		return (0, _embedpdf_engine_core_runtime.wirePack)({
 			tag: "pages.extract",
 			bytes: extracted.bytes,
 			size: extracted.size
 		}, [extracted.bytes]);
 	}
-	handlePagesInsert(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesInserter(this.runtime, session).insert(req.bytes, req.position ?? "end", signal);
-		return this.finishMutation(session, {
-			tag: "pages.insert",
-			result
-		}, req.artifactPath);
-	}
-	handlePagesInsertBlank(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesInserter(this.runtime, session).insertBlank({
-			size: req.size,
-			count: req.count
-		}, req.position ?? "end", signal, req.objectNumbers);
-		return this.finishMutation(session, {
-			tag: "pages.insertBlank",
-			result
-		}, req.artifactPath);
-	}
 	handleAttachmentsList(req, signal) {
 		const session = this.requireSession(req);
 		return (0, _embedpdf_engine_core_runtime.wirePack)({
@@ -18882,22 +20196,6 @@ var WorkerHost = class {
 			content
 		}, content.bytes !== void 0 ? [content.bytes] : []);
 	}
-	handleAttachmentsCreate(req, signal) {
-		const session = this.requireSession(req);
-		const result = new AttachmentMutator(this.runtime, session).create(req.file, req.resources, signal);
-		return this.finishMutation(session, {
-			tag: "attachments.create",
-			result
-		}, req.artifactPath);
-	}
-	handleAttachmentsDelete(req, signal) {
-		const session = this.requireSession(req);
-		const result = new AttachmentMutator(this.runtime, session).delete(req.ref, signal);
-		return this.finishMutation(session, {
-			tag: "attachments.delete",
-			result
-		}, req.artifactPath);
-	}
 	async handleAnnotationsReadFile(req, signal) {
 		const session = this.requireSession(req);
 		const content = await new AttachmentReader(this.runtime, session).readAnnotationFile(session.resolvePageRef(req.page).pageObjectNumber, req.ref, req.path, req.maxDecodedBytes, signal, this.slices);
@@ -19662,9 +20960,9 @@ function resultOf(session, applied) {
 * this job kept for an earlier change of the request, or the one the server
 * sent. A change that left no record leaves nothing to undo.
 */
-function runServerChange(applier, entry, records, signal) {
+function runServerChange(applier, entry, records, signal, space) {
 	const { change, authority } = entry;
-	if (!(0, _embedpdf_engine_core_runtime.isUndoChange)(change)) return applier.apply(change.ops, authority, signal);
+	if (!(0, _embedpdf_engine_core_runtime.isUndoChange)(change)) return applier.apply(change.ops, authority, signal, space);
 	const userId = authority.identity.userId ?? null;
 	const record = records.has(change.undoOf) ? records.get(change.undoOf) : entry.record;
 	if (record === void 0) throw new _embedpdf_engine_core_runtime.EngineError(_embedpdf_engine_core_runtime.EngineErrorCode.UndoUnavailable, `change ${change.undoOf} can no longer be undone`, { details: { reason: "expired" } });
@@ -19675,7 +20973,7 @@ function runServerChange(applier, entry, records, signal) {
 			steps: []
 		}
 	};
-	return applier.undo(record, authority, signal);
+	return applier.undo(record, authority, signal, space);
 }
 /** Every page a change's items touched, once each, in order. */
 function pagesOf(items) {
@@ -19769,6 +21067,7 @@ exports.DocumentPagesMutator = PagesMutator;
 exports.DocumentSaver = DocumentSaver;
 exports.DocumentSession = DocumentSession;
 exports.EPDF_CHAR_GEOMETRY_LAYOUT = EPDF_CHAR_GEOMETRY_LAYOUT;
+exports.FILE_SPACE = FILE_SPACE;
 exports.FontRegistrar = FontRegistrar;
 exports.FormExporter = FormExporter;
 exports.FormImporter = FormImporter;
@@ -19821,6 +21120,7 @@ exports.readAttachmentFileInfo = readAttachmentFileInfo;
 exports.readRevisions = readRevisions;
 exports.readSignaturesFromModel = readSignaturesFromModel;
 exports.readStructure = readStructure;
+exports.rotationAt = rotationAt;
 exports.throwIfAborted = throwIfAborted;
 exports.unpackChangeRecord = unpackChangeRecord;
 exports.visibleBoxReader = visibleBoxReader;