@embedpdf/engine-services 3.0.0-next.15 → 3.0.0-next.16

package/dist/index.js

@@ -1,4 +1,4 @@
-import { ANNOTATION_DEFAULTS, ANNOTATION_RESOURCE_ROLES, AbortError, DEFAULT_BUNDLE_LIMITS, EMPTY_TRANSFER, EdgeResolver, EngineError, EngineErrorCode, NO_ANNOTATION_FLAGS, OBJECT_NUMBER_CEILING, OBJECT_NUMBER_ISSUE_LIMIT, PAGE_INSERT_BLANK_MAX_COUNT, PDF_SUBTYPE_TO_CODE, PdfAnnotationSubtypeCode, PermissionDenied, SIGNATURE_POLICY_VERSION, USAGE_INCOMPLETE, WIDGET_ACTION_EVENTS, allowsCapability, allowsFieldWrite, allowsSomeFieldWrite, anchorOf, annotationDefaultsOf, annotationKey, annotationWriteCapabilities, annotationWriteCapability, appearanceImpactOf, appearanceModesOf, assertAnnotationBundleManifest, assertAnnotationResources, assertFormBundleManifest, assertWithinLimit, assertWritableMeasure, assessmentOf, authorizeAnnotationCreate, authorizeAnnotationDelete, authorizeAnnotationUpdate, authorizeCapability, authorizeFieldGroup, authorizeFieldWrite, authorizeUnprotected, buildSnippet, changeFingerprint, charMapViolation, charRangeForTextOffsets, closeExportSelection, colorOf, combine, concatAnnotationLists, createPdfTextLayout, decodeSubmitFormFlags, defaultEntryOfDraft, deletedWith, deriveProtection, deserializeError, draftWritesScripts, encodePageKey, evaluateStep, faceForFreeTextFont, familyKey, fieldAfterReset, fieldAfterValue, fieldLockFor, fieldScriptOf, fieldValueOf, fieldValueWriteOf, fitWidgetToFamily, foldOptionsFor, foldText, formExportRowsOf, formFieldAfter, formWidget, freeTextFontForFace, generateUuid, generateUuidV7, isAtDefault, isDimension, isFieldScript, isKeptRefusal, isNoOpWrite, isSamePdfRect, isSkippedItem, isUndoChange, isValidPageObjectNumber, itemWrote, manifestBytesOf, mapDocumentActions, matchLiteral, matchRegex, normalizePdfQuad, normalizePdfRect, pageAnnotationOf, pageAppearancesOf, pageBoxOf, pageBoxesOf, pageDestinationOf, pageFormFieldOf, pageFormSnapshotOf, pageGeometryOf, pageListOf, pageRefsIn, pageRotationOf, pageSearchSliceOf, pageViewportsOf, pageWidgetOf, parsePdfValue, pdfAnnotationDraftOf, pdfAnnotationPatchOf, pdfAppearanceTurnOf, pdfFormFieldDraftOf, pdfMeasureOf, pdfPointTurned, pdfPointUnturned, pdfPointsBounds, pdfQuadBounds, pdfQuarterTurnBox, pdfRectSize, pdfRectTurnedBounds, pdfRenderTargetOf, pdfTurnOfUpright, pdfWidgetPlacementOf, placedBefore, placedWidgetOf, quarterTurnOf, renderMatrix, renderSize, reorderedList, resolvePageLayers, restrictionsFor, rgbOf, sameEffectiveValue, searchQueryOf, semanticEqual, serializeError, sniffBinaryMetadata, subtypeFromCode, toAttachmentRef, toPageRef, topRowOf, touchesCaption, validateSearchQuery, valueEntriesEqual, widgetActionsOf, wirePack, writesScripts } from "@embedpdf/engine-core/runtime";
+import { ANNOTATION_DEFAULTS, ANNOTATION_RESOURCE_ROLES, AbortError, DEFAULT_BUNDLE_LIMITS, EMPTY_TRANSFER, EdgeResolver, EngineError, EngineErrorCode, NO_ANNOTATION_FLAGS, OBJECT_NUMBER_CEILING, OBJECT_NUMBER_ISSUE_LIMIT, OUTLINE_READ_LIMITS, PAGE_INSERT_BLANK_MAX_COUNT, PDF_SUBTYPE_TO_CODE, PdfAnnotationSubtypeCode, PermissionDenied, SIGNATURE_POLICY_VERSION, USAGE_INCOMPLETE, WIDGET_ACTION_EVENTS, allowsCapability, allowsFieldWrite, allowsSomeFieldWrite, anchorOf, annotationDefaultsOf, annotationKey, annotationWriteCapabilities, annotationWriteCapability, appearanceImpactOf, appearanceModesOf, assertAnnotationBundleManifest, assertAnnotationResources, assertFormBundleManifest, assertWithinLimit, assertWritableMeasure, assessmentOf, authorizeAnnotationCreate, authorizeAnnotationDelete, authorizeAnnotationUpdate, authorizeCapability, authorizeFieldGroup, authorizeFieldWrite, authorizeUnprotected, buildSnippet, changeFingerprint, charMapViolation, charRangeForTextOffsets, checkRenderUsage, closeExportSelection, colorOf, combine, concatAnnotationLists, createPdfTextLayout, decodeSubmitFormFlags, defaultEntryOfDraft, deletedWith, deriveProtection, deserializeError, draftWritesScripts, encodePageKey, evaluateStep, faceForFreeTextFont, familyKey, fieldAfterReset, fieldAfterValue, fieldLockFor, fieldScriptOf, fieldValueOf, fieldValueWriteOf, fitWidgetToFamily, foldOptionsFor, foldText, formExportRowsOf, formFieldAfter, formWidget, freeTextFontForFace, generateUuid, generateUuidV7, isAtDefault, isDimension, isFieldScript, isKeptRefusal, isNoOpWrite, isSamePdfRect, isSkippedItem, isUndoChange, isValidPageObjectNumber, itemWrote, manifestBytesOf, mapDocumentActions, matchLiteral, matchRegex, normalizePdfQuad, normalizePdfRect, pageAnnotationOf, pageAppearancesOf, pageBoxOf, pageBoxesOf, pageDestinationOf, pageFormFieldOf, pageFormSnapshotOf, pageGeometryOf, pageListOf, pageOutlineItemOf, pageOutlineOf, pageRefsIn, pageRotationOf, pageSearchSliceOf, pageViewportsOf, pageWidgetOf, parsePdfValue, pdfAnnotationDraftOf, pdfAnnotationPatchOf, pdfAppearanceTurnOf, pdfFormFieldDraftOf, pdfMeasureOf, pdfOutlineDraftOf, pdfOutlinePatchOf, pdfPointTurned, pdfPointUnturned, pdfPointsBounds, pdfQuadBounds, pdfQuarterTurnBox, pdfRectSize, pdfRectTurnedBounds, pdfRenderTargetOf, pdfTurnOfUpright, pdfWidgetPlacementOf, placedBefore, placedWidgetOf, positionIndex, quarterTurnOf, renderMatrix, renderSize, reorderedList, resolvePageLayers, restrictionsFor, rgbOf, sameEffectiveValue, searchQueryOf, semanticEqual, serializeError, sniffBinaryMetadata, subtypeFromCode, toAttachmentRef, toOutlineItemRef, toPageRef, topRowOf, touchesCaption, validateSearchQuery, valueEntriesEqual, widgetActionsOf, wirePack, writesScripts } from "@embedpdf/engine-core/runtime";
 import { NULL_PTR } from "@embedpdf/engine-runtime";
 import { pdfResolveAnnotationDraft, pdfResolveAnnotationPatch, planAnnotationImport, planFormImport, planFormValuesImport } from "@embedpdf/engine-core/validation";
 //#region src/runtime/lifecycle/bootstrap.ts
@@ -1263,7 +1263,7 @@ var DocumentSession = class {
 	* Nothing else creates objects at held numbers, so a held number is free
 	* otherwise; the fork checks that again as it creates.
 	*/
-	useObjectNumber(objectNumber) {
+	claimObjectNumber(objectNumber) {
 		if (!Number.isInteger(objectNumber) || objectNumber < 1) throw new EngineError(EngineErrorCode.InvalidArg, `${objectNumber} is not an object number`, { details: { field: "objectNumber" } });
 		if (this.objectNumberAuthority === "session" && !this.heldObjectNumbers.has(objectNumber)) throw objectNumberUnavailable(objectNumber, "not-held");
 		if (this.objectNumbersInUse.includes(objectNumber)) throw objectNumberUnavailable(objectNumber, "taken");
@@ -2419,6 +2419,10 @@ function readBoxes(fn, mem, docPtr, index, rectPtr) {
 		art: read(BOX_ART)
 	});
 }
+/** The turn of the page at `index` as it reads: its own `/Rotate`, or the one it inherits. */
+function rotationAt(runtime, docPtr, index) {
+	return withScratch(runtime.mem, 4, (intPtr) => readRotation(runtime.fn, runtime.mem, docPtr, index, intPtr));
+}
 /** The page's turn: its `/Rotate` as written, read by the rules of `pageRotationOf`. */
 function readRotation(fn, mem, docPtr, index, intPtr) {
 	if (!fn.EPDF_GetPageRotateByIndex(docPtr, index, intPtr)) return 0;
@@ -2697,12 +2701,18 @@ var PagesMutator = class {
 //#endregion
 //#region src/features/pages/PagesExtractor.ts
 const FPDF_NO_INCREMENTAL$3 = 2;
+const FLAT_NORMALDISPLAY = 0;
+const FLAT_PRINT = 1;
+const EXPORT_FLATTENED_ANNOTATIONS = 1;
+const EXPORT_FLATTENED_FORM_FIELDS = 2;
 /**
 * Export a subset of pages as a standalone PDF. A read over the session:
-* `FPDF_ImportPagesByIndex` copies pages into a scratch document, so the
-* source is untouched — no registry refresh, no layer
-* artifact. Lives next to `PagesReader`/`PagesMutator` (one file per page
-* verb family) so both worker hosts share the code path.
+* the pages are copied into a scratch document, so the source is untouched —
+* no registry refresh, no layer artifact. A plain copy is
+* `FPDF_ImportPagesByIndex`; a flattened one `EPDFDoc_ExportPagesFlattened`,
+* which copies the pages as they draw. Either keeps the document's title.
+* Lives next to `PagesReader`/`PagesMutator` (one file per page verb family)
+* so both worker hosts share the code path.
 */
 var PagesExtractor = class {
 	constructor(runtime, session) {
@@ -2711,11 +2721,13 @@ var PagesExtractor = class {
 	}
 	/**
 	* Copy the given pages, in the supplied caller order, into a new
-	* document and serialize it. Validation up front: non-empty, no
-	* duplicates, every page object number resolvable (`NotFound` from the session on a
-	* bad one). The scratch document is always closed, success or throw.
+	* document and serialize it: as they are, or, with `flatten`, as they draw
+	* (checked against the caller's rights before it gets here). Validation up
+	* front: non-empty, no duplicates, every page object number resolvable
+	* (`NotFound` from the session on a bad one). The scratch document is
+	* always closed, success or throw.
 	*/
-	extract(pages, signal) {
+	extract(pages, flatten, signal) {
 		throwIfAborted(signal);
 		if (pages.length === 0) throw new EngineError(EngineErrorCode.InvalidArg, "pages.extract requires at least one page");
 		const pageObjectNumbers = this.session.resolvePageRefs(pages);
@@ -2727,14 +2739,20 @@ var PagesExtractor = class {
 		const indices = pageObjectNumbers.map((pageObjectNumber) => this.session.recordByObjectNumber(pageObjectNumber).pageIndex);
 		const { fn, mem } = this.runtime;
 		const srcPtr = this.session.requireDocPtr();
-		const destPtr = fn.FPDF_CreateNewDocument();
-		if (!destPtr) throw new EngineError(EngineErrorCode.Unknown, "FPDF_CreateNewDocument failed");
 		const idxPtr = mem.alloc(4 * indices.length);
+		for (let i = 0; i < indices.length; i++) mem.poke(idxPtr, "i32", indices[i], 4 * i);
+		let destPtr;
+		try {
+			destPtr = flatten ? this.copyFlattened(srcPtr, idxPtr, indices, flatten) : this.copyPlain(srcPtr, idxPtr, indices);
+		} catch (error) {
+			mem.free(idxPtr);
+			throw error;
+		}
 		const sizePtr = mem.alloc(8);
 		let pdfPtr = null;
 		try {
-			for (let i = 0; i < indices.length; i++) mem.poke(idxPtr, "i32", indices[i], 4 * i);
-			if (!fn.FPDF_ImportPagesByIndex(destPtr, srcPtr, idxPtr, indices.length, 0)) throw new EngineError(EngineErrorCode.Unknown, `FPDF_ImportPagesByIndex rejected the request (indices=[${indices.join(",")}])`);
+			const title = readMetaText(fn, mem, srcPtr, "Title");
+			if (title !== null) writeMetaText(fn, mem, destPtr, "Title", title);
 			pokeU64(mem, sizePtr, 0);
 			pdfPtr = fn.EPDF_SaveDocumentToOwnedBuffer(destPtr, FPDF_NO_INCREMENTAL$3, sizePtr);
 			const size = Number(mem.peek(sizePtr, "i32"));
@@ -2753,6 +2771,28 @@ var PagesExtractor = class {
 			fn.FPDF_CloseDocument(destPtr);
 		}
 	}
+	/** A new document with copies of the pages at `indices`, as they are. */
+	copyPlain(srcPtr, idxPtr, indices) {
+		const { fn } = this.runtime;
+		const destPtr = fn.FPDF_CreateNewDocument();
+		if (!destPtr) throw new EngineError(EngineErrorCode.Unknown, "FPDF_CreateNewDocument failed");
+		if (!fn.FPDF_ImportPagesByIndex(destPtr, srcPtr, idxPtr, indices.length, 0)) {
+			fn.FPDF_CloseDocument(destPtr);
+			throw new EngineError(EngineErrorCode.Unknown, `FPDF_ImportPagesByIndex rejected the request (indices=[${indices.join(",")}])`);
+		}
+		return destPtr;
+	}
+	/**
+	* A new document with the pages at `indices` as they draw for
+	* `flatten.usage`: what `flatten` includes painted in, nothing interactive
+	* left, layers in their state for the usage.
+	*/
+	copyFlattened(srcPtr, idxPtr, indices, flatten) {
+		const flags = (flatten.includeAnnotations ? EXPORT_FLATTENED_ANNOTATIONS : 0) | (flatten.includeFormFields ? EXPORT_FLATTENED_FORM_FIELDS : 0);
+		const destPtr = this.runtime.fn.EPDFDoc_ExportPagesFlattened(srcPtr, idxPtr, indices.length, flatten.usage === "print" ? FLAT_PRINT : FLAT_NORMALDISPLAY, flags);
+		if (!destPtr) throw new EngineError(EngineErrorCode.Unknown, `EPDFDoc_ExportPagesFlattened rejected the request (indices=[${indices.join(",")}])`);
+		return destPtr;
+	}
 };
 //#endregion
 //#region src/features/annotations/internal/write/promoteInlineAnnotations.ts
@@ -2851,7 +2891,7 @@ var PagesInserter = class {
 		const destPtr = this.session.requireDocPtr();
 		const at = pageIndexAt(this.session, position, fn.FPDF_GetPageCount(destPtr));
 		if (objectNumbers && objectNumbers.length !== count) throw new EngineError(EngineErrorCode.InvalidArg, `pages.insertBlank needs one object number per page: ${objectNumbers.length} for ${count}`, { details: { field: "objectNumbers" } });
-		for (const objectNumber of objectNumbers ?? []) this.session.useObjectNumber(objectNumber);
+		for (const objectNumber of objectNumbers ?? []) this.session.claimObjectNumber(objectNumber);
 		for (let i = 0; i < count; i++) {
 			const objectNumber = objectNumbers?.[i];
 			if (!fn.EPDFPage_InsertBlankRaw(destPtr, at + i, size.width, size.height, objectNumber ?? 0)) {
@@ -3873,6 +3913,11 @@ function toExactArrayBuffer(bytes) {
 const FPDF_RENDER_ANNOT = 1;
 /** `EPDF_RENDER_WIDGETS`: the form fields' widgets. */
 const EPDF_RENDER_WIDGETS = 32768;
+/**
+* `FPDF_PRINTING`: the print rules. Layers take their print state, and
+* annotations and widgets draw by their `print` flag (no-view ones too).
+*/
+const FPDF_PRINTING = 2048;
 const FPDF_RENDER_TOBECONTINUED = 1;
 const FPDF_RENDER_DONE = 2;
 var PageRenderReader = class {
@@ -3892,6 +3937,8 @@ var PageRenderReader = class {
 		const pagePtr = await pool.acquireInSlices(pageObjectNumber, signal, slices);
 		try {
 			throwIfAborted(signal);
+			checkRenderUsage(options, null);
+			const print = options.usage === "print";
 			const page = readPageBox(this.runtime, pagePtr);
 			const target = resolveTarget(options.target, page);
 			const rotation = options.rotation ?? 0;
@@ -3906,6 +3953,7 @@ var PageRenderReader = class {
 			let flags = 16;
 			if (layers.includeAnnotations) flags |= FPDF_RENDER_ANNOT;
 			if (layers.includeFormFields) flags |= EPDF_RENDER_WIDGETS;
+			if (print) flags |= FPDF_PRINTING;
 			const raster = await rasterizeAsync(this.runtime, {
 				rect: target,
 				page,
@@ -4789,7 +4837,7 @@ function extractAttachmentToBuffer(runtime, attachmentPtr, maxDecodedBytes) {
 		mem.poke(bufPtrSlot, "ptr", 0);
 		mem.poke(sizePtr, "i32", 0);
 		mem.poke(statusPtr, "i32", -1);
-		if (!fn.EPDFAttachment_ExtractFileToOwnedBuffer(attachmentPtr, BigInt(maxDecodedBytes ?? 0), bufPtrSlot, sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")));
+		if (!fn.EPDFAttachment_ExtractFileToOwnedBuffer(attachmentPtr, BigInt(maxDecodedBytes ?? 0), bufPtrSlot, sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")), maxDecodedBytes);
 		const size = Number(mem.peek(sizePtr, "i32")) >>> 0;
 		dataPtr = mem.peek(bufPtrSlot, "ptr");
 		if (size === 0 || !dataPtr) return {
@@ -4825,7 +4873,7 @@ function extractAttachmentToFile(runtime, attachmentPtr, path, maxDecodedBytes)
 	try {
 		mem.poke(sizePtr, "i32", 0);
 		mem.poke(statusPtr, "i32", -1);
-		if (!fn.EPDFAttachment_ExtractFile(attachmentPtr, writer.ptr, BigInt(maxDecodedBytes ?? 0), sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")));
+		if (!fn.EPDFAttachment_ExtractFile(attachmentPtr, writer.ptr, BigInt(maxDecodedBytes ?? 0), sizePtr, statusPtr)) throw extractStatusError(Number(mem.peek(statusPtr, "i32")), maxDecodedBytes);
 		return { size: Number(mem.peek(sizePtr, "i32")) >>> 0 };
 	} finally {
 		writer.close();
@@ -4834,11 +4882,11 @@ function extractAttachmentToFile(runtime, attachmentPtr, path, maxDecodedBytes)
 	}
 }
 /** `EPDFAttachmentExtractStatus` (public/fpdf_attachment.h) → EngineError. */
-function extractStatusError(status) {
+function extractStatusError(status, maxDecodedBytes) {
 	switch (status) {
 		case 1: return new EngineError(EngineErrorCode.InvalidArg, "attachment has no embedded file stream (missing /EF)");
 		case 2: return new EngineError(EngineErrorCode.MalformedPdf, "embedded file stream failed to decode");
-		case 3: return new EngineError(EngineErrorCode.PayloadTooLarge, "embedded file exceeds the configured decoded-size limit");
+		case 3: return new EngineError(EngineErrorCode.PayloadTooLarge, `the embedded file decodes to more than ${maxDecodedBytes} bytes, the limit`, { details: { limit: maxDecodedBytes } });
 		case 4: return new EngineError(EngineErrorCode.Unknown, "writing the extracted attachment failed");
 		default: return new EngineError(EngineErrorCode.Unknown, `attachment extraction failed (status ${status})`);
 	}
@@ -5661,34 +5709,50 @@ function readLine(fn, mem, annotPtr, base) {
 	};
 }
 //#endregion
-//#region src/features/annotations/internal/read/readLinkAnnotation.ts
+//#region src/features/destinations/createDestination.ts
 /**
-* Link reader: rect/flags/relationship ride the base (a link grouped to an
-* annotation is plain `inReplyTo` + `replyType: 'group'`); this module only
-* materialises the normalized target.
-*
-* One truth, one projection: the target is a pure function of the same
-* payload-carrying action tree the scripting plane reads
-* (`base.actions.activate`) — no second native read exists any more, so the
-* two action-shaped surfaces cannot drift by construction.
-*
-* `/A` precedence, pinned: an activate action that exists but cannot be
-* executed (an `incomplete` tree, a degraded/unreadable root) projects
-* `unsupported` — a broken action is a dead link, never an invitation to
-* guess. The direct `/Dest` (which is data, not an action) is consulted
-* only when no `/A` exists at all.
+* Build an indirect explicit-destination array for `dest`. The target page
+* is named by its object number and never loaded: a destination only refers
+* to the page's dictionary.
 */
-function readLink(fn, mem, annotPtr, base, _rawSubtypeCode, ctx) {
-	return {
-		...base,
-		subtype: "link",
-		target: readLinkTarget(fn, mem, annotPtr, base, ctx)
-	};
+function createDestination(fn, mem, docPtr, dest) {
+	const page = dest.page.objectNumber;
+	const destPtr = dest.kind === "xyz" ? fn.EPDFDest_CreateXYZByObjectNumber(docPtr, page, dest.left != null, dest.left ?? 0, dest.top != null, dest.top ?? 0, dest.zoom != null, dest.zoom ?? 0) : createViewDestination(fn, mem, docPtr, page, dest);
+	if (!destPtr) throw new EngineError(EngineErrorCode.NotFound, `destination page not found: pageObjectNumber=${page}`);
+	return destPtr;
+}
+function createViewDestination(fn, mem, docPtr, page, dest) {
+	const params = (() => {
+		switch (dest.kind) {
+			case "fitH":
+			case "fitBH": return dest.top != null ? [dest.top] : [];
+			case "fitV":
+			case "fitBV": return dest.left != null ? [dest.left] : [];
+			case "fitR": return [
+				dest.left,
+				dest.bottom,
+				dest.right,
+				dest.top
+			];
+			default: return [];
+		}
+	})();
+	const view = VIEW_CODE_BY_KIND[dest.kind];
+	if (!params.length) return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, NULL_PTR, 0);
+	return withScratch(mem, params.length * 4, (buf) => {
+		for (let i = 0; i < params.length; i++) mem.poke(buf, "f32", params[i], i * 4);
+		return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, buf, params.length);
+	});
 }
+//#endregion
+//#region src/features/destinations/linkTarget.ts
 /**
-* Project the navigation view from a payload-carrying activate tree. Pure —
-* shared with any consumer that wants the root-level navigation reading of a
-* tree (the link plugin's no-actions-plugin fallback uses the same law).
+* A link target read the way every reader reads one (links, outline items):
+* the navigation view of a payload-carrying activate tree. Pure.
+*
+* The law, enforced at the projection too: never execute — not even
+* navigate the root of — a tree marked incomplete. A broken action is a
+* dead target, never an invitation to guess.
 */
 function linkTargetFromActionTree(tree) {
 	if (tree.incomplete) return { kind: "unsupported" };
@@ -5719,6 +5783,41 @@ function linkTargetFromActionTree(tree) {
 		default: return { kind: "unsupported" };
 	}
 }
+/**
+* A new indirect action of the document for a writable target: a GoTo to a
+* new destination, a URI, or a standard named verb. Links and outline items
+* write their targets with it, so both read back the same way.
+*/
+function createLinkTargetAction(fn, mem, docPtr, target) {
+	const actionPtr = target.kind === "uri" ? fn.EPDFAction_CreateURI(docPtr, target.uri) : target.kind === "named" ? fn.EPDFAction_CreateNamed(docPtr, target.name) : fn.EPDFAction_CreateGoTo(docPtr, createDestination(fn, mem, docPtr, target.destination));
+	if (!actionPtr) throw new EngineError(EngineErrorCode.Unknown, `failed to create '${target.kind}' action`);
+	return actionPtr;
+}
+//#endregion
+//#region src/features/annotations/internal/read/readLinkAnnotation.ts
+/**
+* Link reader: rect/flags/relationship ride the base (a link grouped to an
+* annotation is plain `inReplyTo` + `replyType: 'group'`); this module only
+* materialises the normalized target.
+*
+* One truth, one projection: the target is a pure function of the same
+* payload-carrying action tree the scripting plane reads
+* (`base.actions.activate`) — no second native read exists any more, so the
+* two action-shaped surfaces cannot drift by construction.
+*
+* `/A` precedence, pinned: an activate action that exists but cannot be
+* executed (an `incomplete` tree, a degraded/unreadable root) projects
+* `unsupported` — a broken action is a dead link, never an invitation to
+* guess. The direct `/Dest` (which is data, not an action) is consulted
+* only when no `/A` exists at all.
+*/
+function readLink(fn, mem, annotPtr, base, _rawSubtypeCode, ctx) {
+	return {
+		...base,
+		subtype: "link",
+		target: readLinkTarget(fn, mem, annotPtr, base, ctx)
+	};
+}
 function readLinkTarget(fn, mem, annotPtr, base, ctx) {
 	const activate = base.actions?.activate;
 	if (activate) return linkTargetFromActionTree(activate);
@@ -8524,42 +8623,6 @@ function isLineSubtype(subtype) {
 	return subtype === "line";
 }
 //#endregion
-//#region src/features/destinations/createDestination.ts
-/**
-* Build an indirect explicit-destination array for `dest`. The target page
-* is named by its object number and never loaded: a destination only refers
-* to the page's dictionary.
-*/
-function createDestination(fn, mem, docPtr, dest) {
-	const page = dest.page.objectNumber;
-	const destPtr = dest.kind === "xyz" ? fn.EPDFDest_CreateXYZByObjectNumber(docPtr, page, dest.left != null, dest.left ?? 0, dest.top != null, dest.top ?? 0, dest.zoom != null, dest.zoom ?? 0) : createViewDestination(fn, mem, docPtr, page, dest);
-	if (!destPtr) throw new EngineError(EngineErrorCode.NotFound, `destination page not found: pageObjectNumber=${page}`);
-	return destPtr;
-}
-function createViewDestination(fn, mem, docPtr, page, dest) {
-	const params = (() => {
-		switch (dest.kind) {
-			case "fitH":
-			case "fitBH": return dest.top != null ? [dest.top] : [];
-			case "fitV":
-			case "fitBV": return dest.left != null ? [dest.left] : [];
-			case "fitR": return [
-				dest.left,
-				dest.bottom,
-				dest.right,
-				dest.top
-			];
-			default: return [];
-		}
-	})();
-	const view = VIEW_CODE_BY_KIND[dest.kind];
-	if (!params.length) return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, NULL_PTR, 0);
-	return withScratch(mem, params.length * 4, (buf) => {
-		for (let i = 0; i < params.length; i++) mem.poke(buf, "f32", params[i], i * 4);
-		return fn.EPDFDest_CreateViewByObjectNumber(docPtr, page, view, buf, params.length);
-	});
-}
-//#endregion
 //#region src/features/annotations/internal/write/writeLinkAnnotation.ts
 /**
 * Link writer: rect + the `/A` action. `goto`, `uri` and the standard
@@ -8602,8 +8665,7 @@ function isLinkSubtype(subtype) {
 function applyLinkTarget(fn, mem, annotPtr, target, ctx) {
 	const docPtr = ctx?.docPtr;
 	if (!docPtr) throw new EngineError(EngineErrorCode.InvalidArg, "writing a link target requires a document pointer on the write context");
-	const actionPtr = target.kind === "uri" ? fn.EPDFAction_CreateURI(docPtr, target.uri) : target.kind === "named" ? fn.EPDFAction_CreateNamed(docPtr, target.name) : fn.EPDFAction_CreateGoTo(docPtr, createDestination(fn, mem, docPtr, target.destination));
-	if (!actionPtr) throw new EngineError(EngineErrorCode.Unknown, `failed to create '${target.kind}' action`);
+	const actionPtr = createLinkTargetAction(fn, mem, docPtr, target);
 	if (!fn.EPDFAnnot_SetAction(annotPtr, actionPtr)) throw new EngineError(EngineErrorCode.Unknown, "EPDFAnnot_SetAction failed for link");
 }
 //#endregion
@@ -9799,7 +9861,7 @@ var AnnotationBatchApplier = class {
 				...given,
 				nm: generateUuidV7()
 			};
-			if (create.objectNumber !== void 0) labelled(create.label, () => this.session.useObjectNumber(create.objectNumber));
+			if (create.objectNumber !== void 0) labelled(create.label, () => this.session.claimObjectNumber(create.objectNumber));
 			const replyTo = create.replyTo && {
 				type: create.replyTo.type,
 				to: labelled(create.label, () => this.linkTarget(create.replyTo.to, create.page, creates.length, "reply"))
@@ -9817,7 +9879,7 @@ var AnnotationBatchApplier = class {
 		throwIfAborted(signal);
 		if (prepared.length === 0) return {
 			created: [],
-			meta: metaOf(this.session.writeStamp(), [], [])
+			meta: metaOf$1(this.session.writeStamp(), [], [])
 		};
 		const placed = prepared.map(({ create, record, ctx, draft }) => {
 			throwIfAborted(signal);
@@ -9863,7 +9925,7 @@ var AnnotationBatchApplier = class {
 		joinWidgetFieldNumbers(this.runtime, this.session, created);
 		return {
 			created,
-			meta: metaOf(this.session.writeStamp(), placed, linked)
+			meta: metaOf$1(this.session.writeStamp(), placed, linked)
 		};
 	}
 	/**
@@ -9934,7 +9996,7 @@ var AnnotationBatchApplier = class {
 * and each it linked a popup to. Creates only append, so no other annotation
 * moves.
 */
-function metaOf(stamp, placed, linked) {
+function metaOf$1(stamp, placed, linked) {
 	return {
 		affectedPages: [...new Set(placed.map((at) => at.pageObjectNumber))].map((page) => toPageRef(page)),
 		cacheDelta: null,
@@ -10782,6 +10844,16 @@ function importAnnots(runtime, docPtr, pageIndex, capture) {
 function exportDict(runtime, docPtr, objectNumber, deepKeys) {
 	return takeOwned(runtime, `object ${objectNumber}`, (sizePtr) => runtime.fn.EPDFDoc_ExportDictRawToOwnedBuffer(docPtr, objectNumber, deepKeys.join(" "), sizePtr));
 }
+/**
+* The dictionary `objectNumber` as bytes a guard compares: without
+* `skipKeys`, and under `deepKeys` the objects the layer holds, each stream
+* as it reads. They stay the same while it reads the same, also after a save
+* encoded its streams again or the layer learned its file's hash; never
+* imported.
+*/
+function canonicalDict(runtime, docPtr, objectNumber, deepKeys, skipKeys = []) {
+	return takeOwned(runtime, `object ${objectNumber}`, (sizePtr) => runtime.fn.EPDFDoc_ExportDictCanonicalToOwnedBuffer(docPtr, objectNumber, deepKeys.join(" "), skipKeys.join(" "), sizePtr));
+}
 /** Puts the dictionary of `capture` back as it was: exactly its keys. */
 function importDict(runtime, docPtr, capture) {
 	withBytes(runtime, capture, (ptr) => {
@@ -10798,6 +10870,49 @@ function importField(runtime, docPtr, capture) {
 		if (!runtime.fn.EPDFForm_ImportFieldRaw(docPtr, ptr, capture.byteLength)) throw new EngineError(EngineErrorCode.Unknown, "EPDFForm_ImportFieldRaw refused a capture");
 	});
 }
+/** An outline item as its delete removes it: the item, the items under it, its place. */
+function exportOutlineItem(runtime, docPtr, objectNumber) {
+	return takeOwned(runtime, `outline item ${objectNumber}`, (sizePtr) => runtime.fn.EPDFOutline_ExportItemRawToOwnedBuffer(docPtr, objectNumber, sizePtr));
+}
+/** Puts the outline item of `capture` back, with the items under it, at its place. */
+function importOutlineItem(runtime, docPtr, capture) {
+	withBytes(runtime, capture, (ptr) => {
+		if (!runtime.fn.EPDFOutline_ImportItemRaw(docPtr, ptr, capture.byteLength)) throw new EngineError(EngineErrorCode.Unknown, "EPDFOutline_ImportItemRaw refused a capture");
+	});
+}
+/** A page as its delete removes it: the page, what it reaches, its names, its place. */
+function exportPage(runtime, docPtr, pageObjectNumber) {
+	return takeOwned(runtime, `page ${pageObjectNumber}`, (sizePtr) => runtime.fn.EPDFPage_ExportRawToOwnedBuffer(docPtr, pageObjectNumber, sizePtr));
+}
+/** Puts the page of `capture` back into the page tree, at its place, with its names. */
+function importPage(runtime, docPtr, capture) {
+	withBytes(runtime, capture, (ptr) => {
+		if (!runtime.fn.EPDFPage_ImportRaw(docPtr, ptr, capture.byteLength)) throw new EngineError(EngineErrorCode.Unknown, "EPDFPage_ImportRaw refused a capture");
+	});
+}
+/** The embedded file under `key` as its delete removes it: its key, its file specification, its streams. */
+function exportAttachment(runtime, docPtr, key) {
+	return takeOwned(runtime, `attachment '${key}'`, (sizePtr) => withUtf16String(runtime.mem, key, (keyPtr) => runtime.fn.EPDFAttachment_ExportRawToOwnedBuffer(docPtr, keyPtr, sizePtr)));
+}
+/**
+* The embedded file under `key` as bytes a guard compares: the same while it
+* is the same file, as it was (its number included); null when no file has
+* the key. Never imported.
+*/
+function canonicalAttachment(runtime, docPtr, key) {
+	try {
+		return takeOwned(runtime, `attachment '${key}'`, (sizePtr) => withUtf16String(runtime.mem, key, (keyPtr) => runtime.fn.EPDFAttachment_ExportCanonicalToOwnedBuffer(docPtr, keyPtr, sizePtr)));
+	} catch (error) {
+		if (EngineError.is(error)) return null;
+		throw error;
+	}
+}
+/** Puts the embedded file of `capture` back under its key. */
+function importAttachment(runtime, docPtr, capture) {
+	withBytes(runtime, capture, (ptr) => {
+		if (!runtime.fn.EPDFAttachment_ImportRaw(docPtr, ptr, capture.byteLength)) throw new EngineError(EngineErrorCode.Unknown, "EPDFAttachment_ImportRaw refused a capture");
+	});
+}
 /** The bytes of a buffer an export returned, which is then released. */
 function takeOwned(runtime, what, call) {
 	const { fn, mem } = runtime;
@@ -10876,6 +10991,14 @@ function assertExpected(opIndex, current, expected) {
 	} });
 }
 //#endregion
+//#region src/shared/bytesEqual.ts
+/** Whether two byte arrays hold the same bytes. */
+function bytesEqual(a, b) {
+	if (a.byteLength !== b.byteLength) return false;
+	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+//#endregion
 //#region src/features/changes/internal/objectCaptures.ts
 /**
 * Captures each dictionary before an op writes it: every key, and under
@@ -10894,18 +11017,21 @@ function captureBefore(runtime, session, objects) {
 	}
 	return [...captured.values()];
 }
-/** Completes captures once the op has written: each dictionary as the op left it, the guard. */
+/**
+* Completes captures once the op has written: each dictionary as the op left
+* it, the guard, in canonical bytes (`canonicalDict`).
+*/
 function captureAfter(runtime, session, pending) {
 	return pending.map((object) => ({
 		...object,
-		after: exportDict(runtime, session.requireDocPtr(), object.objectNumber, [])
+		after: canonicalDict(runtime, session.requireDocPtr(), object.objectNumber, [])
 	}));
 }
 /** Whether every dictionary still reads exactly as the op left it. */
 function unchangedSince(runtime, session, objects) {
 	return objects.every((object) => {
-		const now = tryExportDict(runtime, session, object.objectNumber, []);
-		return now !== null && sameBytes(now, object.after);
+		const now = tryCanonicalDict(runtime, session, object.objectNumber);
+		return now !== null && bytesEqual(now, object.after);
 	});
 }
 /**
@@ -10920,6 +11046,15 @@ function revertObjects(runtime, session, objects) {
 	session.invalidateDerived();
 	return captureAfter(runtime, session, redo);
 }
+/** A dictionary's canonical bytes, or null when there is none at that number. */
+function tryCanonicalDict(runtime, session, objectNumber) {
+	try {
+		return canonicalDict(runtime, session.requireDocPtr(), objectNumber, []);
+	} catch (error) {
+		if (EngineError.is(error)) return null;
+		throw error;
+	}
+}
 /** The capture of a dictionary, or null when there is none at that number. */
 function tryExportDict(runtime, session, objectNumber, deep) {
 	try {
@@ -10929,11 +11064,6 @@ function tryExportDict(runtime, session, objectNumber, deep) {
 		throw error;
 	}
 }
-function sameBytes(a, b) {
-	if (a.byteLength !== b.byteLength) return false;
-	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
-	return true;
-}
 //#endregion
 //#region src/features/annotations/internal/stackingOrder.ts
 /**
@@ -11176,7 +11306,7 @@ function updateAnnotation(ctx, op, opIndex) {
 	if (current.subtype === "widget") throw new EngineError(EngineErrorCode.InvalidArg, "a widget is the form's: change its place and look with doc.forms.updateWidget");
 	authorizeUnprotected(ctx.authority, annotationWriteCapability(current.subtype));
 	assertExpected(opIndex, current, op.expect);
-	return writeUpdate$1(ctx, op.ref, op.patch, "annotations.update", op.resources);
+	return writeUpdate$2(ctx, op.ref, op.patch, "annotations.update", op.resources);
 }
 /** `annotations.delete`; its reverse brings back everything it removed. */
 function deleteAnnotation(ctx, op, opIndex) {
@@ -11184,7 +11314,7 @@ function deleteAnnotation(ctx, op, opIndex) {
 	if (current.subtype === "widget") throw widgetDeleteRefused(current);
 	authorizeUnprotected(ctx.authority, annotationWriteCapability(current.subtype));
 	assertExpected(opIndex, current, op.expect);
-	return writeDelete$1(ctx, op.ref);
+	return writeDelete$4(ctx, op.ref);
 }
 /** Why a widget isn't deleted as an annotation, naming the form op that removes it. */
 function widgetDeleteRefused(widget) {
@@ -11251,7 +11381,7 @@ function revertAnnotation(ctx, step) {
 	const kept = keys.filter((key) => valuesEqual(now[key], left[key]));
 	if (kept.length === 0) return leftAlone(ctx, reports);
 	const writable = (key, value) => key === "actions" && current.subtype === "widget" ? widgetActionsOf(value) : value;
-	const done = writeUpdate$1(ctx, ref, Object.fromEntries(kept.map((key) => [key, writable(key, restore[key])])), reports);
+	const done = writeUpdate$2(ctx, ref, Object.fromEntries(kept.map((key) => [key, writable(key, restore[key])])), reports);
 	const skipped = keys.filter((key) => !kept.includes(key));
 	const item = done.item;
 	if (skipped.length === 0 || isSkippedItem(item) || item.type !== reports) return done;
@@ -11275,7 +11405,7 @@ function removeAnnotation(ctx, step) {
 	}))) return leftAlone(ctx, "annotations.delete");
 	for (const capability of annotationWriteCapabilities(members)) authorizeUnprotected(ctx.authority, capability);
 	if (step.rights) authorizeImportRights(ctx.authority);
-	return writeDelete$1(ctx, step.ref, step.rights);
+	return writeDelete$4(ctx, step.ref, step.rights);
 }
 /**
 * Brings back what a delete removed, at the same numbers and positions. Skipped
@@ -11396,7 +11526,7 @@ function reorderItem(ctx, family, page, order, moved) {
 * An update of `ref` with `patch`, recording the dictionaries it writes, and
 * reported as `reports`: an annotation's update, or a widget's form op.
 */
-function writeUpdate$1(ctx, ref, patch, reports, resources) {
+function writeUpdate$2(ctx, ref, patch, reports, resources) {
 	promoteInlineAnnotations(ctx.runtime, ctx.session, ref.page.objectNumber);
 	const before = readAnnotation(ctx, ref);
 	const written = before.subtype === "widget" ? fitWidgetToFamily(before.fieldFamily, patch) : patch;
@@ -11444,7 +11574,7 @@ function updatedItem(ctx, reports, ref, result) {
 }
 /** A delete of `ref` and what goes with it, capturing them first. */
 /** Deletes `ref` and what goes with it; `rights` is what a step under an import's rights checked. */
-function writeDelete$1(ctx, ref, rights) {
+function writeDelete$4(ctx, ref, rights) {
 	const page = ref.page.objectNumber;
 	promoteInlineAnnotations(ctx.runtime, ctx.session, page);
 	const members = deletedWith(listPage(ctx, page), ref);
@@ -11561,66 +11691,314 @@ function objectNumberOf$1(ctx, ref) {
 	}
 }
 //#endregion
-//#region src/features/forms/internal/authorWidget.ts
-const WIDGET_SUBTYPE_CODE = 20;
+//#region src/features/attachments/AttachmentReader.ts
 /**
-* Birth a widget through the annotation plane (EPDFPage_CreateAnnotRaw -
-* indirect, durable object number, no page load), place it and turn it
-* (`/MK /R`), style it with the placement's style fields through the
-* widget-plane writer (`applyWidgetStyle` - the same code the widget
-* annotation kind uses for create/patch), and give it the placement's
-* actions. Like every annotation the engine makes, it gets a fresh UUIDv7
-* `/NM`. Returns the widget's object number (`objectNumber`, which the
-* session checked, or the next free one), ready for EPDFForm_AttachWidget
-* adoption, which draws its appearance turned.
+* Read-only access to embedded files, at both of their homes: the
+* document catalog's `/EmbeddedFiles` name tree (list / readFile by
+* index) and a FileAttachment annotation's `/FS` (readAnnotationFile by
+* ref). Pure reads over the session — no layer artifacts (the
+* `PagesExtractor` shape).
+*
+* Byte delivery mirrors the request's `path?`: absent → a standalone
+* buffer for the transfer list (browser); present → the decoded file is
+* streamed to `path` via `FPDF_FILEWRITE` (server), and only metadata
+* rides the response.
 */
-function createUnattachedWidget(runtime, docPtr, pageIndex, placement, objectNumber) {
-	const { fn, mem } = runtime;
-	const annotPtr = fn.EPDFPage_CreateAnnotRaw(docPtr, pageIndex, WIDGET_SUBTYPE_CODE, objectNumber ?? 0);
-	if (annotPtr === NULL_PTR && objectNumber !== void 0) throw objectNumberUnavailable(objectNumber, "taken");
-	if (annotPtr === NULL_PTR) throw new EngineError(EngineErrorCode.Unknown, "failed to create widget annotation");
-	try {
-		writeAnnotString(fn, mem, annotPtr, "NM", generateUuidV7());
-		const { page: _page, rect, rotation, exportValue: _exportValue, actions, ...style } = placement;
-		setAnnotRect(fn, mem, annotPtr, rect);
-		if (rotation) setWidgetTurn(fn, annotPtr, rotation);
-		if (Object.keys(style).length > 0) applyWidgetStyle(fn, mem, annotPtr, style);
-		if (actions) writeWidgetActions(runtime, docPtr, annotPtr, actions);
-		const widgetObjectNumber = fn.EPDFAnnot_GetObjectNumber(annotPtr);
-		if (widgetObjectNumber <= 0) throw new EngineError(EngineErrorCode.Unknown, "widget annotation has no object number");
-		return widgetObjectNumber;
-	} finally {
-		fn.FPDFPage_CloseAnnot(annotPtr);
+var AttachmentReader = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
 	}
-}
-//#endregion
-//#region src/features/forms/internal/fieldFlagBits.ts
-/**
-* /Ff bits writable through drafts and patches (1-based spec bit numbers).
-* Family-defining bits (Radio 1<<15, Pushbutton 1<<16, Combo 1<<17) are set
-* once by EPDFForm_CreateField and immutable afterwards - the native
-* setter rejects them.
-*/
-const FIELD_FLAG_BITS = {
-	readOnly: 1,
-	required: 2,
-	noExport: 4,
-	multiline: 4096,
-	password: 8192,
-	noToggleToOff: 16384,
-	edit: 1 << 18,
-	multiSelect: 1 << 21,
-	comb: 1 << 24,
-	radiosInUnison: 1 << 25
-};
-/**
-* Fold optional booleans into set/clear masks: `true` sets the bit,
-* `false` clears it, `undefined` leaves it alone.
-*/
-function flagMasks(flags) {
-	let setBits = 0;
-	let clearBits = 0;
-	for (const [name, bit] of Object.entries(FIELD_FLAG_BITS)) {
+	/** Snapshot of the `/EmbeddedFiles` name tree, in tree (key-sorted) order. */
+	list(signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const count = fn.FPDFDoc_GetAttachmentCount(docPtr);
+		const items = [];
+		for (let index = 0; index < count; index++) {
+			const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
+			if (!attachmentPtr) continue;
+			const key = readAttachmentKey(fn, mem, docPtr, index) ?? "";
+			items.push({
+				...readAttachmentFileInfo(fn, mem, attachmentPtr),
+				ref: toAttachmentRef(key),
+				index
+			});
+		}
+		return items;
+	}
+	/** Decode one document-level embedded file, addressed by key. */
+	readFile(ref, path, maxDecodedBytes, signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
+		if (index < 0) throw new EngineError(EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
+		const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
+		if (!attachmentPtr) throw new EngineError(EngineErrorCode.Unknown, `embedded file with key '${ref.key}' resolved to index ${index} but could not be opened`);
+		const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
+		return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
+	}
+	/** Decode the file embedded in a FileAttachment annotation's `/FS`. */
+	/** A file attachment annotation's file; a page not parsed yet loads in slices. */
+	async readAnnotationFile(pageObjectNumber, ref, path, maxDecodedBytes, signal, slices) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const pool = this.session.pagePool();
+		const pagePtr = await pool.acquireInSlices(pageObjectNumber, signal, slices);
+		let annotPtr = null;
+		try {
+			annotPtr = resolveAnnotPtr(this.runtime, this.session, pagePtr, ref);
+			const attachmentPtr = fn.FPDFAnnot_GetFileAttachment(annotPtr);
+			if (!attachmentPtr) throw new EngineError(EngineErrorCode.InvalidArg, "annotation is not a file attachment or carries no embedded file (/FS)");
+			const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
+			return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
+		} finally {
+			if (annotPtr !== null) fn.FPDFPage_CloseAnnot(annotPtr);
+			pool.release(pageObjectNumber);
+		}
+	}
+	extract(attachmentPtr, name, mimeType, path, maxDecodedBytes) {
+		if (path !== void 0) {
+			const { size } = extractAttachmentToFile(this.runtime, attachmentPtr, path, maxDecodedBytes);
+			return {
+				name,
+				...mimeType ? { mimeType } : {},
+				size,
+				path
+			};
+		}
+		const { bytes, size } = extractAttachmentToBuffer(this.runtime, attachmentPtr, maxDecodedBytes);
+		return {
+			name,
+			...mimeType ? { mimeType } : {},
+			size,
+			bytes
+		};
+	}
+};
+//#endregion
+//#region src/features/attachments/AttachmentMutator.ts
+/**
+* Create/delete writes over the document catalog's `/EmbeddedFiles` name
+* tree, sharing the write path (`writeAttachmentFilePayload`) with the
+* file-attachment annotation writer. The change ops run them
+* (`attachmentChanges.ts`), which decide what an undo needs.
+*
+* Identity is the name-tree key (unique by construction). Note the
+* tree is key-sorted: both writes shift other entries' indices; keys
+* never move.
+*/
+var AttachmentMutator = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
+	}
+	/**
+	* Create an embedded file from `bytes`. `file.name` becomes the tree key
+	* (PDFium writes key = /UF = /F); a duplicate key rejects with
+	* `InvalidArg`. The result carries the read-back entry,
+	* `checksum`/`size`/dates included.
+	*/
+	create(file, bytes, signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		if (!bytes) throw new EngineError(EngineErrorCode.InvalidArg, "an attachments.create op needs its bytes as its file resource", { details: { field: "resources.file" } });
+		if (file.name.length === 0) throw new EngineError(EngineErrorCode.InvalidArg, "attachment file requires a name");
+		if (resolveAttachmentIndex(fn, mem, docPtr, {
+			kind: "key",
+			key: file.name
+		}) !== -1) throw new EngineError(EngineErrorCode.InvalidArg, `an embedded file with key '${file.name}' already exists — keys are unique; rename and retry`);
+		throwIfAborted(signal);
+		const namePtr = mem.writeU16String(file.name);
+		let attachmentPtr;
+		try {
+			attachmentPtr = fn.FPDFDoc_AddAttachment(docPtr, namePtr);
+		} finally {
+			mem.free(namePtr);
+		}
+		if (!attachmentPtr) throw new EngineError(EngineErrorCode.Unknown, "FPDFDoc_AddAttachment returned NULL");
+		writeAttachmentFilePayload(fn, mem, attachmentPtr, docPtr, file, {
+			bytes,
+			...file.mimeType !== void 0 ? { mimeType: file.mimeType } : {},
+			name: file.name
+		});
+		const ref = toAttachmentRef(file.name);
+		const attachment = this.find(ref);
+		if (!attachment) throw new EngineError(EngineErrorCode.Unknown, "created attachment did not resolve by key after the write");
+		return {
+			attachment,
+			meta: this.meta(ref)
+		};
+	}
+	/** The entry under `ref`'s key as it reads now; `null` when no file has the key. */
+	find(ref) {
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
+		const attachmentPtr = index < 0 ? null : fn.FPDFDoc_GetAttachment(docPtr, index);
+		if (!attachmentPtr) return null;
+		return {
+			...readAttachmentFileInfo(fn, mem, attachmentPtr),
+			ref,
+			index
+		};
+	}
+	/** A write's meta, naming the file it changed. Cloud coherence pins are a server concern. */
+	meta(ref) {
+		return {
+			affectedPages: [],
+			cacheDelta: null,
+			...this.session.writeStamp(),
+			changed: [ref]
+		};
+	}
+	/** Delete an embedded file by key. Unlinks the tree entry only. */
+	delete(ref, signal) {
+		throwIfAborted(signal);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
+		if (index < 0) throw new EngineError(EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
+		if (!fn.FPDFDoc_DeleteAttachment(docPtr, index)) throw new EngineError(EngineErrorCode.Unknown, "FPDFDoc_DeleteAttachment returned false");
+		return { meta: this.meta(ref) };
+	}
+};
+//#endregion
+//#region src/features/changes/internal/attachmentChanges.ts
+const mutatorOf$2 = (ctx) => new AttachmentMutator(ctx.runtime, ctx.session);
+const authorize$2 = (ctx) => authorizeCapability(ctx.authority, "doc.attachments.modify");
+/** `attachments.create`; its reverse deletes the file while it is still the file this made. */
+function createAttachment(ctx, op) {
+	authorize$2(ctx);
+	const result = mutatorOf$2(ctx).create(op.file, op.resources.file, ctx.signal);
+	return {
+		item: {
+			type: "attachments.create",
+			...result
+		},
+		reverse: [removeStepOf$1(ctx, result.attachment.ref)]
+	};
+}
+/** `attachments.delete`, captured in its transaction so an undo brings back the same file. */
+function deleteAttachment(ctx, op) {
+	authorize$2(ctx);
+	return writeDelete$3(ctx, op.ref);
+}
+/** Deletes a file a create or a restore brought, while it reads as the change left it. */
+function removeAttachment(ctx, step) {
+	const now = canonicalAttachment(ctx.runtime, ctx.session.requireDocPtr(), step.ref.key);
+	if (!now || !bytesEqual(now, step.left)) return leftAlone(ctx, "attachments.delete");
+	authorize$2(ctx);
+	return writeDelete$3(ctx, step.ref);
+}
+/** Brings back a file a delete removed, while no file has its key. */
+function restoreAttachment(ctx, step) {
+	const mutator = mutatorOf$2(ctx);
+	if (mutator.find(step.ref)) return leftAlone(ctx, "attachments.restore");
+	authorize$2(ctx);
+	importAttachment(ctx.runtime, ctx.session.requireDocPtr(), step.capture);
+	const attachment = mutator.find(step.ref);
+	if (!attachment) throw new EngineError(EngineErrorCode.Unknown, `attachment '${step.ref.key}' did not come back`);
+	return {
+		item: {
+			type: "attachments.restore",
+			attachment,
+			meta: mutator.meta(step.ref)
+		},
+		reverse: [removeStepOf$1(ctx, step.ref)]
+	};
+}
+/** Deletes the file under `ref`, captured first so its restore brings it back. */
+function writeDelete$3(ctx, ref) {
+	const mutator = mutatorOf$2(ctx);
+	if (!mutator.find(ref)) throw new EngineError(EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`, { details: { field: "ref" } });
+	const capture = exportAttachment(ctx.runtime, ctx.session.requireDocPtr(), ref.key);
+	return {
+		item: {
+			type: "attachments.delete",
+			...mutator.delete(ref, ctx.signal)
+		},
+		reverse: [{
+			kind: "attachments.restore",
+			ref,
+			capture
+		}]
+	};
+}
+/** The step that deletes the file under `ref` again while it reads as it does now. */
+function removeStepOf$1(ctx, ref) {
+	const left = canonicalAttachment(ctx.runtime, ctx.session.requireDocPtr(), ref.key);
+	if (!left) throw new EngineError(EngineErrorCode.Unknown, `attachment '${ref.key}' is not there to guard`);
+	return {
+		kind: "attachments.remove",
+		ref,
+		left
+	};
+}
+//#endregion
+//#region src/features/forms/internal/authorWidget.ts
+const WIDGET_SUBTYPE_CODE = 20;
+/**
+* Birth a widget through the annotation plane (EPDFPage_CreateAnnotRaw -
+* indirect, durable object number, no page load), place it and turn it
+* (`/MK /R`), style it with the placement's style fields through the
+* widget-plane writer (`applyWidgetStyle` - the same code the widget
+* annotation kind uses for create/patch), and give it the placement's
+* actions. Like every annotation the engine makes, it gets a fresh UUIDv7
+* `/NM`. Returns the widget's object number (`objectNumber`, which the
+* session checked, or the next free one), ready for EPDFForm_AttachWidget
+* adoption, which draws its appearance turned.
+*/
+function createUnattachedWidget(runtime, docPtr, pageIndex, placement, objectNumber) {
+	const { fn, mem } = runtime;
+	const annotPtr = fn.EPDFPage_CreateAnnotRaw(docPtr, pageIndex, WIDGET_SUBTYPE_CODE, objectNumber ?? 0);
+	if (annotPtr === NULL_PTR && objectNumber !== void 0) throw objectNumberUnavailable(objectNumber, "taken");
+	if (annotPtr === NULL_PTR) throw new EngineError(EngineErrorCode.Unknown, "failed to create widget annotation");
+	try {
+		writeAnnotString(fn, mem, annotPtr, "NM", generateUuidV7());
+		const { page: _page, rect, rotation, exportValue: _exportValue, actions, ...style } = placement;
+		setAnnotRect(fn, mem, annotPtr, rect);
+		if (rotation) setWidgetTurn(fn, annotPtr, rotation);
+		if (Object.keys(style).length > 0) applyWidgetStyle(fn, mem, annotPtr, style);
+		if (actions) writeWidgetActions(runtime, docPtr, annotPtr, actions);
+		const widgetObjectNumber = fn.EPDFAnnot_GetObjectNumber(annotPtr);
+		if (widgetObjectNumber <= 0) throw new EngineError(EngineErrorCode.Unknown, "widget annotation has no object number");
+		return widgetObjectNumber;
+	} finally {
+		fn.FPDFPage_CloseAnnot(annotPtr);
+	}
+}
+//#endregion
+//#region src/features/forms/internal/fieldFlagBits.ts
+/**
+* /Ff bits writable through drafts and patches (1-based spec bit numbers).
+* Family-defining bits (Radio 1<<15, Pushbutton 1<<16, Combo 1<<17) are set
+* once by EPDFForm_CreateField and immutable afterwards - the native
+* setter rejects them.
+*/
+const FIELD_FLAG_BITS = {
+	readOnly: 1,
+	required: 2,
+	noExport: 4,
+	multiline: 4096,
+	password: 8192,
+	noToggleToOff: 16384,
+	edit: 1 << 18,
+	multiSelect: 1 << 21,
+	comb: 1 << 24,
+	radiosInUnison: 1 << 25
+};
+/**
+* Fold optional booleans into set/clear masks: `true` sets the bit,
+* `false` clears it, `undefined` leaves it alone.
+*/
+function flagMasks(flags) {
+	let setBits = 0;
+	let clearBits = 0;
+	for (const [name, bit] of Object.entries(FIELD_FLAG_BITS)) {
 		const value = flags[name];
 		if (value === true) setBits |= bit;
 		else if (value === false) clearBits |= bit;
@@ -12526,8 +12904,8 @@ var FormMutator = class {
 		}
 		const { objectNumber, widgetObjectNumbers } = numbers;
 		if (widgetObjectNumbers && widgetObjectNumbers.length !== placements.length) throw new EngineError(EngineErrorCode.InvalidArg, `forms.create needs one widget object number per widget: ${widgetObjectNumbers.length} for ${placements.length}`, { details: { field: "widgetObjectNumbers" } });
-		if (objectNumber !== void 0) this.session.useObjectNumber(objectNumber);
-		for (const number of widgetObjectNumbers ?? []) this.session.useObjectNumber(number);
+		if (objectNumber !== void 0) this.session.claimObjectNumber(objectNumber);
+		for (const number of widgetObjectNumbers ?? []) this.session.claimObjectNumber(number);
 		throwIfAborted(signal);
 		const fieldObjectNumber = this.createFieldNode(draft, objectNumber);
 		this.configureNewField(draft, fieldObjectNumber);
@@ -12747,9 +13125,9 @@ var FormMutator = class {
 		const pageIndex = this.preflightPlacement(fitted);
 		const onState = onStateOf(before.family, fitted);
 		const mergedPage = before.widgets.find((w) => w.objectNumber === resolved.fieldObjectNumber)?.page ?? null;
-		if (numbers.objectNumber !== void 0) this.session.useObjectNumber(numbers.objectNumber);
+		if (numbers.objectNumber !== void 0) this.session.claimObjectNumber(numbers.objectNumber);
 		const splitObjectNumber = mergedPage ? numbers.splitObjectNumber : void 0;
-		if (splitObjectNumber !== void 0) this.session.useObjectNumber(splitObjectNumber);
+		if (splitObjectNumber !== void 0) this.session.claimObjectNumber(splitObjectNumber);
 		throwIfAborted(signal);
 		if (mergedPage) promoteInlineAnnotations(this.runtime, this.session, mergedPage.objectNumber);
 		const widgetObjectNumber = createUnattachedWidget(this.runtime, docPtr, pageIndex, fitted, numbers.objectNumber);
@@ -13314,14 +13692,14 @@ function updateField(ctx, op, opIndex) {
 	const before = readField(ctx, op.field);
 	if (op.patch.groupId !== void 0 && op.patch.groupId !== before.field.groupId) authorizeFieldGroup(ctx.authority, op.patch.groupId);
 	assertExpected(opIndex, propertiesOf(before.field), op.expect);
-	return writeUpdate(ctx, before, op.patch);
+	return writeUpdate$1(ctx, before, op.patch);
 }
 /** `forms.delete`; its reverse brings back the field, its widgets and the parents it pruned. */
 function deleteField(ctx, op, opIndex) {
 	authorizeCapability(ctx.authority, "doc.forms.modify");
 	const before = readField(ctx, op.field);
 	assertExpected(opIndex, before.field, op.expect);
-	return writeDelete(ctx, before);
+	return writeDelete$2(ctx, before);
 }
 /**
 * `forms.addWidget`. Its reverse puts back the field and the pages the widget
@@ -13450,7 +13828,7 @@ function updateWidget(ctx, op, opIndex) {
 	const current = readAnnotation(ctx, op.widget);
 	if (current.subtype !== "widget") throw new EngineError(EngineErrorCode.InvalidArg, `${current.subtype} is not a widget: change it with doc.annotations.update`, { details: { field: "widget" } });
 	assertExpected(opIndex, current, op.expect);
-	return writeUpdate$1(ctx, op.widget, {
+	return writeUpdate$2(ctx, op.widget, {
 		...op.patch,
 		subtype: "widget"
 	}, "forms.updateWidget");
@@ -13726,7 +14104,7 @@ function revertProperties(ctx, fallback) {
 	const keys = Object.keys(left);
 	const kept = keys.filter((key) => valuesEqual(now[key], left[key]) && (key !== "name" || nameIsFree(ctx, current.field.name, String(restore.name))));
 	if (kept.length === 0) return leftAlone(ctx, "forms.update");
-	const done = writeUpdate(ctx, current, pick$1(restore, kept));
+	const done = writeUpdate$1(ctx, current, pick$1(restore, kept));
 	const skipped = keys.filter((key) => !kept.includes(key));
 	const item = done.item;
 	if (skipped.length === 0 || isSkippedItem(item) || item.type !== "forms.update") return done;
@@ -13751,7 +14129,7 @@ function removeField(ctx, step) {
 	if (step.rights) authorizeCapability(ctx.authority, "doc.forms.import");
 	const current = tryReadFieldByNumber(ctx, step.objectNumber);
 	if (!current || !valuesEqual(current.field, step.left)) return leftAlone(ctx, "forms.delete");
-	return writeDelete(ctx, current, step.rights);
+	return writeDelete$2(ctx, current, step.rights);
 }
 /**
 * Brings back a field a delete removed. Left alone when another field took its
@@ -13886,7 +14264,7 @@ function writeEffect(ctx, type, write, before) {
 * An update of the field `before` reads, recording the dictionaries it writes
 * and the properties it changes: their old values, and the values it left.
 */
-function writeUpdate(ctx, before, patch) {
+function writeUpdate$1(ctx, before, patch) {
 	const ref = {
 		kind: "objectNumber",
 		objectNumber: before.objectNumber
@@ -13961,7 +14339,7 @@ function recordRevert(ctx, before, type, write, fallbackOf) {
 * A delete of the field `before` reads, capturing it first. Its restore
 * takes `rights` too.
 */
-function writeDelete(ctx, before, rights) {
+function writeDelete$2(ctx, before, rights) {
 	const capture = exportField(ctx.runtime, ctx.session.requireDocPtr(), before.objectNumber);
 	const ref = {
 		kind: "objectNumber",
@@ -14294,57 +14672,1153 @@ function entryOf(values, key) {
 function pick(values, keys) {
 	return Object.fromEntries(keys.map((key) => [key, entryOf(values, key)]));
 }
-//#endregion
-//#region src/features/changes/ChangeApplier.ts
 /**
-* Runs changes inside the job's layer transaction, which its caller opens and
-* ends, so a failure anywhere leaves the document as it was: a change's ops in
-* order (`apply`), or the steps of a recorded reverse (`undo`). Each op and
-* step is checked against the change's authority as it runs, as its single
-* verb's job checks it.
-*
-* Every op records the steps that reverse it as it runs, from what it found
-* and wrote; the record lists them in reverse op order, so each step meets the
-* document as the op after it left it.
-*/
-var ChangeApplier = class {
-	constructor(runtime, session, fonts) {
-		this.runtime = runtime;
-		this.session = session;
-		this.fonts = fonts;
+* The outline's shape as the document links it now, by object number: each
+* item's parent ({@link TOP} for a top-level item) and each parent's
+* children in order. Only what a write needs: no titles, no targets. An item
+* that isn't an indirect object is left out with the items under it, a loop
+* ends its list, and items deeper than a read goes aren't in it, as every
+* read of the outline does.
+*/
+var OutlineTree = class {
+	constructor(fn, docPtr) {
+		_defineProperty(this, "childrenByParent", /* @__PURE__ */ new Map());
+		_defineProperty(this, "parentByItem", /* @__PURE__ */ new Map());
+		const visit = (parentHandle, parent, depth) => {
+			if (depth >= OUTLINE_READ_LIMITS.depth) return;
+			const children = [];
+			this.childrenByParent.set(parent, children);
+			for (let handle = fn.FPDFBookmark_GetFirstChild(docPtr, parentHandle); handle; handle = fn.FPDFBookmark_GetNextSibling(docPtr, handle)) {
+				const item = fn.EPDFOutline_GetObjectNumber(handle);
+				if (!item) continue;
+				if (this.parentByItem.has(item)) break;
+				this.parentByItem.set(item, parent);
+				children.push(item);
+				visit(handle, item, depth + 1);
+			}
+		};
+		visit(NULL_PTR, 0, 0);
 	}
-	apply(ops, authority, signal) {
-		const ctx = this.context(authority, signal, (self) => opsFillOwnField(self, ops));
-		return collect(authority, ops.map((op, at) => () => runOp(ctx, op, at)), signal);
+	has(item) {
+		return this.parentByItem.has(item);
 	}
-	undo(record, authority, signal) {
-		const ctx = this.context(authority, signal, (self) => stepsFillOwnField(self, record.steps));
-		return collect(authority, record.steps.map((step) => () => runStep(ctx, step)), signal);
+	/** The item's parent ({@link TOP} at the top level); `undefined` when it isn't in the outline. */
+	parentOf(item) {
+		return this.parentByItem.get(item);
 	}
-	context(authority, signal, ownFill) {
-		let answer;
-		const ctx = {
-			runtime: this.runtime,
-			session: this.session,
-			...this.fonts ? { fonts: this.fonts } : {},
-			authority,
-			signal,
-			fillsOwnField: () => answer ?? (answer = ownFill(ctx))
-		};
-		return ctx;
+	/** A parent's children in order: none for a leaf, or an item the outline doesn't have. */
+	childrenOf(parent) {
+		return this.childrenByParent.get(parent) ?? [];
 	}
-};
-/** Runs each in order; the record reverses them in the opposite order. */
-function collect(authority, runs, signal) {
-	const items = [];
-	const reverses = [];
-	for (const run of runs) {
-		throwIfAborted(signal);
-		const done = run();
-		items.push(done.item);
-		reverses.push(done.reverse);
+	/** The item and the items under it, depth first: the item first. */
+	subtreeOf(item) {
+		const items = [item];
+		for (const child of this.childrenOf(item)) items.push(...this.subtreeOf(child));
+		return items;
 	}
-	return {
+	/** How deep the item sits: 0 at the top level; `undefined` when it isn't in the outline. */
+	levelOf(item) {
+		let level = -1;
+		for (let current = item; current; current = this.parentOf(current)) level += 1;
+		return this.has(item) ? level : void 0;
+	}
+	/** Whether `node` is `item` or one of the items under it. */
+	isAtOrUnder(node, item) {
+		for (let current = node; current; current = this.parentOf(current)) if (current === item) return true;
+		return false;
+	}
+	/** Every item, depth first: what an order of the whole outline is. */
+	items() {
+		return this.childrenOf(0).flatMap((item) => this.subtreeOf(item));
+	}
+};
+//#endregion
+//#region src/features/outline/internal/readOutlineItem.ts
+/**
+* What one read of an outline may spend on its items' actions: one action
+* model per item at most, and room for a URI or a script on each. Past it,
+* an item's action reads as missing and the outline as incomplete.
+*/
+const OUTLINE_ACTION_READ_BUDGET = {
+	maxModels: 5e4,
+	maxNodes: 2e5,
+	maxScriptCodeUnits: 16e6,
+	maxTargetEntries: 65536,
+	maxPayloadCodeUnits: 16e6
+};
+/** `/F` bit 1. */
+const ITALIC$1 = 1;
+/** `/F` bit 2. */
+const BOLD$1 = 2;
+/** A budget for one read of the outline's actions. */
+function outlineActionBudget() {
+	return new ActionReadBudgetTracker(OUTLINE_ACTION_READ_BUDGET);
+}
+/**
+* The item `handle` reads, at `objectNumber` under `parent` ({@link TOP} for
+* the top level). Its target is read the way a link's is: the `/A` tree's
+* navigation view, else the `/Dest`; an action that can't be read makes the
+* target `unsupported`.
+*/
+function readOutlineItem(runtime, docPtr, handle, objectNumber, parent, budget) {
+	const { fn, mem } = runtime;
+	const title = readUtf16String(mem, (buf, capacity) => fn.FPDFBookmark_GetTitle(handle, buf, capacity)) ?? "";
+	const hasChildren = fn.FPDFBookmark_GetFirstChild(docPtr, handle) !== NULL_PTR;
+	const style = fn.FPDFBookmark_GetStyle(handle);
+	const { action, target, complete } = readTarget(runtime, docPtr, handle, budget);
+	return {
+		item: {
+			ref: toOutlineItemRef(objectNumber),
+			parent: parent === 0 ? null : toOutlineItemRef(parent),
+			title,
+			target,
+			action,
+			open: hasChildren && fn.FPDFBookmark_GetCount(handle) > 0,
+			color: readColor(runtime, handle),
+			bold: (style & BOLD$1) !== 0,
+			italic: (style & ITALIC$1) !== 0
+		},
+		complete
+	};
+}
+function readTarget(runtime, docPtr, handle, budget) {
+	const { fn, mem } = runtime;
+	const actionPtr = fn.FPDFBookmark_GetAction(handle);
+	if (actionPtr) try {
+		const action = readActionModel(fn, mem, docPtr, fn.EPDFAction_LoadModel(actionPtr), budget);
+		return {
+			action,
+			target: action ? linkTargetFromActionTree(action) : { kind: "unsupported" },
+			complete: action !== null && !action.incomplete
+		};
+	} catch (error) {
+		if (!EngineError.is(error)) throw error;
+		return {
+			action: null,
+			target: { kind: "unsupported" },
+			complete: false
+		};
+	}
+	const destPtr = fn.FPDFBookmark_GetDest(docPtr, handle);
+	if (!destPtr) return {
+		action: null,
+		target: null,
+		complete: true
+	};
+	const destination = readDestination(fn, mem, docPtr, destPtr);
+	return {
+		action: null,
+		target: destination ? {
+			kind: "goto",
+			destination
+		} : { kind: "unsupported" },
+		complete: true
+	};
+}
+/** `/C` as `#rrggbb`, or `null` when the item has none. */
+function readColor(runtime, handle) {
+	const { fn, mem } = runtime;
+	return withScratchN(mem, [
+		4,
+		4,
+		4
+	], ([r, g, b]) => {
+		if (!fn.FPDFBookmark_GetColor(handle, r, g, b)) return null;
+		const channel = (ptr) => Math.min(255, Math.max(0, Math.round(readF32(mem, ptr) * 255)));
+		return colorOf(channel(r), channel(g), channel(b));
+	});
+}
+//#endregion
+//#region src/features/outline/OutlineReader.ts
+/**
+* Synchronous read of the document's outline, shared by the local worker and
+* the server. Dictionary reads only: no page is loaded. It never throws for
+* a bad outline: what it can't read (a loop, an item that isn't an indirect
+* object, a broken action, past `OUTLINE_READ_LIMITS`) it leaves out or
+* marks, and says `incomplete`.
+*/
+var OutlineReader = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
+	}
+	read(signal) {
+		const { fn } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const budget = outlineActionBudget();
+		const items = [];
+		const seen = /* @__PURE__ */ new Set();
+		let incomplete = false;
+		const visit = (parentHandle, parent, depth) => {
+			for (let handle = fn.FPDFBookmark_GetFirstChild(docPtr, parentHandle); handle; handle = fn.FPDFBookmark_GetNextSibling(docPtr, handle)) {
+				throwIfAborted(signal);
+				const objectNumber = fn.EPDFOutline_GetObjectNumber(handle);
+				if (!objectNumber) {
+					incomplete = true;
+					continue;
+				}
+				if (seen.has(objectNumber)) {
+					incomplete = true;
+					break;
+				}
+				if (items.length >= OUTLINE_READ_LIMITS.items) {
+					incomplete = true;
+					return false;
+				}
+				seen.add(objectNumber);
+				const read = readOutlineItem(this.runtime, docPtr, handle, objectNumber, parent, budget);
+				items.push(read.item);
+				if (!read.complete) incomplete = true;
+				if (fn.FPDFBookmark_GetFirstChild(docPtr, handle) === NULL_PTR) continue;
+				if (depth + 1 >= OUTLINE_READ_LIMITS.depth) {
+					incomplete = true;
+					continue;
+				}
+				if (!visit(handle, objectNumber, depth + 1)) return false;
+			}
+			return true;
+		};
+		visit(NULL_PTR, 0, 0);
+		return {
+			items,
+			incomplete
+		};
+	}
+	/** The item `objectNumber`, under `parent` ({@link TOP} for the top level), as it reads now. */
+	readItem(objectNumber, parent) {
+		const docPtr = this.session.requireDocPtr();
+		const handle = this.runtime.fn.EPDFOutline_GetItem(docPtr, objectNumber);
+		if (!handle) throw new EngineError(EngineErrorCode.NotFound, `no outline item ${objectNumber}`, { details: { field: "ref" } });
+		return readOutlineItem(this.runtime, docPtr, handle, objectNumber, parent, outlineActionBudget()).item;
+	}
+};
+//#endregion
+//#region src/features/outline/internal/writeOutlineFields.ts
+/** `/F` bit 1. */
+const ITALIC = 1;
+/** `/F` bit 2. */
+const BOLD = 2;
+/** The most a PDF text string holds in every PDF app (ISO 32000-2 Annex C). */
+const MAX_TITLE_LENGTH = 32767;
+const HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+/**
+* Refuses, before anything is written, fields no write can take: a title
+* too long, a colour that isn't `#rrggbb`, a target a write can't make.
+*/
+function assertWritableFields(fields) {
+	const refuse = (field, message) => {
+		throw new EngineError(EngineErrorCode.InvalidArg, message, { details: { field } });
+	};
+	if (fields.title !== void 0) {
+		if (typeof fields.title !== "string") refuse("title", "a title is a string");
+		if (fields.title.length > MAX_TITLE_LENGTH) refuse("title", `a title holds at most ${MAX_TITLE_LENGTH} characters`);
+	}
+	if (fields.color != null && !HEX_COLOR.test(fields.color)) refuse("color", "expected a color as '#rrggbb'");
+	const target = fields.target;
+	if (target != null) {
+		if (!(target.kind === "goto" || target.kind === "uri" || target.kind === "named" && [
+			"NextPage",
+			"PrevPage",
+			"FirstPage",
+			"LastPage"
+		].includes(target.name ?? ""))) refuse("target", `a '${target.kind}' target can't be written`);
+	}
+}
+/**
+* Writes the fields `fields` names on the item `objectNumber`; the others
+* stay as they are. A target is always written as `/A`, as a link's is.
+*/
+function writeOutlineFields(runtime, docPtr, objectNumber, fields) {
+	const { fn, mem } = runtime;
+	const check = (ok, what) => {
+		if (!ok) throw new EngineError(EngineErrorCode.Unknown, `the ${what} of outline item ${objectNumber} could not be written`);
+	};
+	if (fields.title !== void 0) {
+		const title = fields.title;
+		check(withUtf16String(mem, title, (ptr) => fn.EPDFOutline_SetTitle(docPtr, objectNumber, ptr)), "title");
+	}
+	if (fields.target !== void 0) {
+		const action = fields.target === null ? NULL_PTR : createLinkTargetAction(fn, mem, docPtr, fields.target);
+		check(fn.EPDFOutline_SetAction(docPtr, objectNumber, action), "target");
+	}
+	if (fields.color !== void 0) if (fields.color === null) check(fn.EPDFOutline_SetColor(docPtr, objectNumber, false, 0, 0, 0), "colour");
+	else {
+		const { r, g, b } = rgbOf(fields.color);
+		check(fn.EPDFOutline_SetColor(docPtr, objectNumber, true, r / 255, g / 255, b / 255), "colour");
+	}
+	if (fields.bold !== void 0 || fields.italic !== void 0) {
+		let flags = fn.FPDFBookmark_GetStyle(fn.EPDFOutline_GetItem(docPtr, objectNumber));
+		if (fields.bold !== void 0) flags = fields.bold ? flags | BOLD : flags & -3;
+		if (fields.italic !== void 0) flags = fields.italic ? flags | ITALIC : flags & -2;
+		check(fn.EPDFOutline_SetStyle(docPtr, objectNumber, flags), "style");
+	}
+	if (fields.open !== void 0) check(fn.EPDFOutline_SetOpen(docPtr, objectNumber, fields.open), "open state");
+}
+//#endregion
+//#region src/features/outline/OutlineMutator.ts
+/**
+* Synchronous outline writes, shared by the local worker and the server.
+* Each checks everything it can before the first native write, and answers
+* with what it wrote, re-read. The fork keeps the links and `/Count` right
+* (public/epdf_outline.h); what goes where is decided here.
+*/
+var OutlineMutator = class {
+	constructor(runtime, session) {
+		this.runtime = runtime;
+		this.session = session;
+		_defineProperty(this, "reader", void 0);
+		this.reader = new OutlineReader(runtime, session);
+	}
+	/** The outline's shape as it is now. */
+	tree() {
+		return new OutlineTree(this.runtime.fn, this.session.requireDocPtr());
+	}
+	create(parent, position, data, objectNumber) {
+		assertWritableFields(data);
+		const tree = this.tree();
+		const parentNumber = this.parentNumberOf(tree, parent);
+		const children = tree.childrenOf(parentNumber);
+		const at = positionIndex(children.map(toOutlineItemRef), position, keyOf);
+		const after = at === 0 ? 0 : children[at - 1];
+		if (objectNumber !== void 0) this.session.claimObjectNumber(objectNumber);
+		const { fn, mem } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const created = withUtf16String(mem, data.title, (title) => fn.EPDFOutline_CreateItem(docPtr, objectNumber ?? 0, parentNumber, after, title));
+		if (!created) throw outlineRefused("create the item");
+		const { title: _title, ...fields } = data;
+		writeOutlineFields(this.runtime, docPtr, created, fields);
+		const item = this.reader.readItem(created, parentNumber);
+		return {
+			item,
+			order: this.orderOf(this.tree(), parentNumber),
+			meta: this.meta([item.ref])
+		};
+	}
+	update(ref, patch) {
+		assertWritableFields(patch);
+		const tree = this.tree();
+		const parent = this.requireItem(tree, ref, "ref");
+		writeOutlineFields(this.runtime, this.session.requireDocPtr(), ref.objectNumber, patch);
+		return {
+			item: this.reader.readItem(ref.objectNumber, parent),
+			meta: this.meta([ref])
+		};
+	}
+	/**
+	* The items go together, in the order given, under `parent` at `position`
+	* among its children; the rules of a reorder (`reorderedList`) hold.
+	*/
+	move(refs, parent, position) {
+		const tree = this.tree();
+		const items = refs.map((ref) => {
+			this.requireItem(tree, ref, "refs");
+			return ref.objectNumber;
+		});
+		const moving = new Set(items);
+		if (moving.size !== items.length) invalid("refs", "an item is named twice");
+		for (const item of items) if (items.some((other) => other !== item && tree.isAtOrUnder(item, other))) invalid("refs", `item ${item} is under another item that moves`);
+		const parentNumber = this.parentNumberOf(tree, parent);
+		if (items.some((item) => tree.isAtOrUnder(parentNumber, item))) invalid("parent", "an item would go under itself");
+		const staying = tree.childrenOf(parentNumber).filter((child) => !moving.has(child));
+		const anchor = position === "start" || position === "end" ? null : "before" in position ? position.before : position.after;
+		if (anchor && moving.has(anchor.objectNumber)) invalid("position", `the neighbour ${anchor.objectNumber} is one of the items that move`);
+		const at = positionIndex(staying.map(toOutlineItemRef), position, keyOf);
+		let after = at === 0 ? 0 : staying[at - 1];
+		return this.place(items.map((item) => {
+			const placement = {
+				item,
+				parent: parentNumber,
+				after
+			};
+			after = item;
+			return placement;
+		}), tree);
+	}
+	/**
+	* Puts items where `placements` say, in order: each right after its
+	* `after` while that is a child of its parent, else first. What an undo of
+	* a move does; the caller has checked that each item and parent is there.
+	*/
+	place(placements, before = this.tree()) {
+		const { fn } = this.runtime;
+		const docPtr = this.session.requireDocPtr();
+		const parents = /* @__PURE__ */ new Set();
+		for (const { item, parent, after } of placements) {
+			parents.add(before.parentOf(item) ?? 0);
+			parents.add(parent);
+			const now = this.tree();
+			const anchor = after && now.parentOf(after) === parent ? after : 0;
+			if (!fn.EPDFOutline_MoveItem(docPtr, item, parent, anchor)) throw outlineRefused(`move item ${item}`);
+		}
+		const after = this.tree();
+		return {
+			orders: [...parents].map((parent) => this.orderOf(after, parent)),
+			meta: this.meta(placements.map(({ item }) => toOutlineItemRef(item)))
+		};
+	}
+	/** Where `items` are now, in document order: an anchor always comes before what follows it. */
+	placementsOf(items, tree = this.tree()) {
+		const wanted = new Set(items);
+		return tree.items().filter((item) => wanted.has(item)).map((item) => {
+			const parent = tree.parentOf(item);
+			const siblings = tree.childrenOf(parent);
+			const index = siblings.indexOf(item);
+			return {
+				item,
+				parent,
+				after: index > 0 ? siblings[index - 1] : 0
+			};
+		});
+	}
+	/** The item goes, with the items under it. */
+	delete(ref) {
+		const tree = this.tree();
+		this.requireItem(tree, ref, "ref");
+		const going = tree.subtreeOf(ref.objectNumber);
+		if (!this.runtime.fn.EPDFOutline_DeleteItem(this.session.requireDocPtr(), ref.objectNumber)) throw outlineRefused(`delete item ${ref.objectNumber}`);
+		return { meta: this.meta(going.map(toOutlineItemRef)) };
+	}
+	/**
+	* The items a capture brought back (`importOutlineItem`, run by the
+	* caller): the item first, then the items under it, and its parent's
+	* children.
+	*/
+	restored(objectNumber) {
+		const tree = this.tree();
+		const parent = tree.parentOf(objectNumber);
+		if (parent === void 0) throw outlineRefused(`restore item ${objectNumber}`);
+		const items = this.subtree(objectNumber, tree);
+		return {
+			items,
+			order: this.orderOf(tree, parent),
+			meta: this.meta(items.map((item) => item.ref))
+		};
+	}
+	/** The item as it reads now; `null` when the outline has no such item. */
+	find(ref, tree = this.tree()) {
+		const parent = tree.parentOf(ref.objectNumber);
+		return parent === void 0 ? null : this.reader.readItem(ref.objectNumber, parent);
+	}
+	/** The item and the items under it, depth first, as they read now. */
+	subtree(objectNumber, tree = this.tree()) {
+		return tree.subtreeOf(objectNumber).map((item) => this.reader.readItem(item, tree.parentOf(item)));
+	}
+	/** An update's answer for an item written some other way: a revert put it back. */
+	updated(ref) {
+		const item = this.find(ref);
+		if (!item) throw outlineRefused(`read item ${ref.objectNumber}`);
+		return {
+			item,
+			meta: this.meta([ref])
+		};
+	}
+	/**
+	* Counts the items above `ref` again from the tree, as every outline write
+	* does: a revert puts back the item's own dictionary, its `/Count` with
+	* it, and nothing above it. Setting the open state it reads changes
+	* nothing else.
+	*/
+	countAgain(ref) {
+		const item = this.find(ref);
+		if (!item) return;
+		writeOutlineFields(this.runtime, this.session.requireDocPtr(), ref.objectNumber, { open: item.open });
+	}
+	/**
+	* The number a parent ref names: {@link TOP} for `null`; `NotFound` when it
+	* isn't an item; `InvalidArg` for an item at the deepest level a read goes
+	* to, whose children no read shows.
+	*/
+	parentNumberOf(tree, parent) {
+		if (parent === null) return 0;
+		this.requireItem(tree, parent, "parent");
+		if ((tree.levelOf(parent.objectNumber) ?? 0) >= OUTLINE_READ_LIMITS.depth - 1) invalid("parent", `an item under ${parent.objectNumber} would be deeper than reads go`);
+		return parent.objectNumber;
+	}
+	/** The item's parent; `NotFound` when the outline has no such item. */
+	requireItem(tree, ref, field) {
+		const parent = tree.parentOf(ref.objectNumber);
+		if (parent === void 0) throw new EngineError(EngineErrorCode.NotFound, `no outline item ${ref.objectNumber}`, { details: { field } });
+		return parent;
+	}
+	orderOf(tree, parent) {
+		return {
+			parent: parent === 0 ? null : toOutlineItemRef(parent),
+			children: tree.childrenOf(parent).map(toOutlineItemRef)
+		};
+	}
+	meta(changed) {
+		return {
+			affectedPages: [],
+			cacheDelta: null,
+			...this.session.writeStamp(),
+			changed
+		};
+	}
+};
+const keyOf = (ref) => String(ref.objectNumber);
+function invalid(field, message) {
+	throw new EngineError(EngineErrorCode.InvalidArg, message, { details: { field } });
+}
+/**
+* The fork refused a write the checks above let through: a list it would
+* change holds an item that isn't an indirect object, or `/Root /Outlines`
+* is a direct dictionary.
+*/
+function outlineRefused(what) {
+	return new EngineError(EngineErrorCode.MalformedPdf, `could not ${what}: the outline holds an item that isn't an indirect object`);
+}
+//#endregion
+//#region src/features/changes/internal/outlineChanges.ts
+/** The fields an update can change, each with a value a revert can put back. */
+const FIELDS = [
+	"title",
+	"target",
+	"color",
+	"bold",
+	"italic",
+	"open"
+];
+/** What a capture of an item follows: its action, and its destination. */
+const TARGET_KEYS = ["A", "Dest"];
+const mutatorOf$1 = (ctx) => new OutlineMutator(ctx.runtime, ctx.session);
+const authorize$1 = (ctx) => authorizeCapability(ctx.authority, "doc.outline.modify");
+/** `outline.create`; its reverse deletes the item while nobody changed it since. */
+function createOutlineItem(ctx, op) {
+	authorize$1(ctx);
+	const result = mutatorOf$1(ctx).create(op.parent, op.position ?? "end", op.data, op.objectNumber);
+	return {
+		item: {
+			type: "outline.create",
+			...result
+		},
+		reverse: [{
+			kind: "outline.remove",
+			ref: result.item.ref,
+			left: guardOf(ctx, [result.item.ref])
+		}]
+	};
+}
+/**
+* `outline.update`; its reverse puts the item's dictionary back as it was,
+* or, when someone changed it since, the fields still holding what it set.
+*/
+function updateOutlineItem(ctx, op, opIndex) {
+	authorize$1(ctx);
+	const before = requireItem(ctx, op.ref);
+	assertExpected(opIndex, before, op.expect);
+	return writeUpdate(ctx, op.ref, op.patch, before);
+}
+/**
+* `outline.move`; its reverse puts each item back beside the sibling it
+* followed, and opens again a parent it emptied that was open.
+*/
+function moveOutlineItems(ctx, op) {
+	authorize$1(ctx);
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const items = op.refs.map((ref) => ref.objectNumber);
+	const back = mutator.placementsOf(items, tree);
+	const reopens = reopensOf(ctx, tree, items);
+	const result = mutator.move(op.refs, op.parent, op.position);
+	const parent = op.parent?.objectNumber ?? 0;
+	return {
+		item: {
+			type: "outline.move",
+			...result
+		},
+		reverse: [{
+			kind: "outline.move",
+			placements: back,
+			left: items.map((item) => ({
+				item,
+				parent
+			}))
+		}, ...reopens]
+	};
+}
+/** `outline.delete`; its reverse brings the item and the items under it back. */
+function deleteOutlineItem(ctx, op, opIndex) {
+	authorize$1(ctx);
+	assertExpected(opIndex, requireItem(ctx, op.ref), op.expect);
+	return writeDelete$1(ctx, op.ref);
+}
+/** Puts an item's dictionary back, or the fields that still show the update (see `updateOutlineItem`). */
+function revertOutlineItem(ctx, step) {
+	const ref = step.subject.outlineItem;
+	const mutator = mutatorOf$1(ctx);
+	const current = mutator.find(ref);
+	if (!current) return leftAlone(ctx, "outline.update");
+	authorize$1(ctx);
+	if (unchangedSince(ctx.runtime, ctx.session, step.objects)) {
+		const reverted = revertObjects(ctx.runtime, ctx.session, step.objects);
+		mutator.countAgain(ref);
+		const redo = captureAfter(ctx.runtime, ctx.session, reverted);
+		return {
+			item: {
+				type: "outline.update",
+				...mutator.updated(ref)
+			},
+			reverse: [{
+				...step,
+				objects: redo,
+				...swapped(step.fallback)
+			}]
+		};
+	}
+	const fallback = step.fallback;
+	if (fallback?.kind !== "outline") return leftAlone(ctx, "outline.update");
+	const now = current;
+	const left = fallback.left;
+	const restore = fallback.restore;
+	const keys = Object.keys(left);
+	const kept = keys.filter((key) => valuesEqual(now[key], left[key]) && writable(ctx, key, restore[key]));
+	if (kept.length === 0) return leftAlone(ctx, "outline.update");
+	const done = writeUpdate(ctx, ref, Object.fromEntries(kept.map((key) => [key, restore[key]])), current);
+	const skipped = keys.filter((key) => !kept.includes(key));
+	if (skipped.length === 0 || done.item.type !== "outline.update") return done;
+	return {
+		...done,
+		item: {
+			...done.item,
+			skipped
+		}
+	};
+}
+/**
+* Deletes what a create or a restore brought back, while the item and the
+* items under it are the same ones and read exactly as the change left them.
+*/
+function removeOutlineItem(ctx, step) {
+	const tree = mutatorOf$1(ctx).tree();
+	if (!tree.has(step.ref.objectNumber)) return leftAlone(ctx, "outline.delete");
+	authorize$1(ctx);
+	if (!valuesEqual(tree.subtreeOf(step.ref.objectNumber), step.left.map((object) => object.objectNumber)) || !unchangedSince(ctx.runtime, ctx.session, step.left)) return leftAlone(ctx, "outline.delete");
+	return writeDelete$1(ctx, step.ref);
+}
+/** Brings back what a delete removed, while its parent is there and it isn't back already. */
+function restoreOutlineItem(ctx, step) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	if (tree.has(step.ref.objectNumber)) return leftAlone(ctx, "outline.restore");
+	if (step.parent && !tree.has(step.parent.objectNumber)) return leftAlone(ctx, "outline.restore");
+	authorize$1(ctx);
+	importOutlineItem(ctx.runtime, ctx.session.requireDocPtr(), step.capture);
+	const result = mutator.restored(step.ref.objectNumber);
+	return {
+		item: {
+			type: "outline.restore",
+			...result
+		},
+		reverse: [{
+			kind: "outline.remove",
+			ref: step.ref,
+			left: guardOf(ctx, result.items.map((item) => item.ref))
+		}]
+	};
+}
+/**
+* Puts items back where a move found them: each still under the parent the
+* move left it under, its old parent still there, and not under itself.
+*/
+function moveOutlineItemsBack(ctx, step) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const leftUnder = new Map(step.left.map(({ item, parent }) => [item, parent]));
+	const placements = step.placements.filter(({ item, parent }) => tree.parentOf(item) === leftUnder.get(item) && (parent === 0 || tree.has(parent)) && !tree.isAtOrUnder(parent, item));
+	if (placements.length === 0) return leftAlone(ctx, "outline.move");
+	authorize$1(ctx);
+	const items = placements.map(({ item }) => item);
+	const back = mutator.placementsOf(items, tree);
+	const reopens = reopensOf(ctx, tree, items);
+	return {
+		item: {
+			type: "outline.move",
+			...mutator.place(placements, tree)
+		},
+		reverse: [{
+			kind: "outline.move",
+			placements: back,
+			left: placements.map(({ item, parent }) => ({
+				item,
+				parent
+			}))
+		}, ...reopens]
+	};
+}
+/** Opens a parent again, as its step says (see `OutlineReopenStep`). */
+function reopenOutlineItem(ctx, step) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const item = mutator.find(step.ref, tree);
+	const children = tree.childrenOf(step.ref.objectNumber);
+	const same = children.length === step.children.length && children.every((child) => step.children.includes(child));
+	if (!item || item.open || !same) return leftAlone(ctx, "outline.update");
+	authorize$1(ctx);
+	return {
+		item: {
+			type: "outline.update",
+			...mutator.update(step.ref, { open: true })
+		},
+		reverse: []
+	};
+}
+/** An update, captured so it can be put back exactly. */
+function writeUpdate(ctx, ref, patch, before) {
+	const pending = captureBefore(ctx.runtime, ctx.session, [{
+		objectNumber: ref.objectNumber,
+		deep: TARGET_KEYS
+	}]);
+	const result = mutatorOf$1(ctx).update(ref, patch);
+	const objects = captureAfter(ctx.runtime, ctx.session, pending);
+	return {
+		item: {
+			type: "outline.update",
+			...result
+		},
+		reverse: [{
+			kind: "objects.revert",
+			reports: "outline.update",
+			objects,
+			subject: { outlineItem: ref },
+			fallback: fallbackOf(before, result.item, patch)
+		}]
+	};
+}
+/**
+* A delete, captured in its transaction so an undo brings back the same
+* objects, and opens again the parent it emptied when it was open.
+*/
+function writeDelete$1(ctx, ref) {
+	const mutator = mutatorOf$1(ctx);
+	const tree = mutator.tree();
+	const parent = tree.parentOf(ref.objectNumber);
+	const reopens = reopensOf(ctx, tree, [ref.objectNumber]);
+	const capture = exportOutlineItem(ctx.runtime, ctx.session.requireDocPtr(), ref.objectNumber);
+	return {
+		item: {
+			type: "outline.delete",
+			...mutator.delete(ref)
+		},
+		reverse: [{
+			kind: "outline.restore",
+			ref,
+			parent: parent === void 0 || parent === 0 ? null : toOutlineItemRef(parent),
+			capture
+		}, ...reopens]
+	};
+}
+/**
+* The parents that lose every child when `items` leave them, and are open:
+* each comes back closed with its children, so the undo opens it again.
+*/
+function reopensOf(ctx, tree, items) {
+	const leaving = new Set(items);
+	const parents = new Set(items.map((item) => tree.parentOf(item) ?? 0));
+	parents.delete(0);
+	return [...parents].flatMap((parent) => {
+		const children = tree.childrenOf(parent);
+		if (!children.every((child) => leaving.has(child))) return [];
+		if (!mutatorOf$1(ctx).find(toOutlineItemRef(parent), tree)?.open) return [];
+		return [{
+			kind: "outline.reopen",
+			ref: toOutlineItemRef(parent),
+			children
+		}];
+	});
+}
+/** The guard of items a change leaves: each dictionary as it reads now. */
+function guardOf(ctx, refs) {
+	return captureAfter(ctx.runtime, ctx.session, refs.map((ref) => ({
+		objectNumber: ref.objectNumber,
+		deep: [],
+		before: null
+	})));
+}
+function requireItem(ctx, ref) {
+	const item = mutatorOf$1(ctx).find(ref);
+	if (!item) throw new EngineError(EngineErrorCode.NotFound, `no outline item ${ref.objectNumber}`, { details: { field: "ref" } });
+	return item;
+}
+/** The fields an update changed: their values before, and the values it left. */
+function fallbackOf(before, after, patch) {
+	const changed = FIELDS.filter((field) => patch[field] !== void 0 && !valuesEqual(before[field], after[field]));
+	return {
+		kind: "outline",
+		restore: Object.fromEntries(changed.map((field) => [field, before[field]])),
+		left: Object.fromEntries(changed.map((field) => [field, after[field]]))
+	};
+}
+/**
+* Whether a value read back can be written again: a target another app made
+* may not be, nor one that goes to a page the document no longer has.
+*/
+function writable(ctx, field, value) {
+	if (field !== "target" || value === null) return true;
+	const target = value;
+	if (target.kind === "goto") {
+		const page = target.destination?.page.objectNumber;
+		return ctx.session.allRecords().some((record) => record.pageObjectNumber === page);
+	}
+	if (target.kind === "uri") return true;
+	return target.kind === "named" && [
+		"NextPage",
+		"PrevPage",
+		"FirstPage",
+		"LastPage"
+	].includes(target.name ?? "");
+}
+function swapped(fallback) {
+	if (fallback?.kind !== "outline") return fallback ? { fallback } : {};
+	return { fallback: {
+		kind: "outline",
+		restore: fallback.left,
+		left: fallback.restore
+	} };
+}
+//#endregion
+//#region src/features/changes/internal/pageChanges.ts
+/** What a page's guard digests: the page, and what the layer holds of these. */
+const PAGE_DEEP_KEYS = [
+	"Annots",
+	"Contents",
+	"Resources"
+];
+/**
+* What it leaves out of the page's bytes: its place (/Parent), so moving
+* pages around it changes nothing, and its /Rotate, which counts by value
+* instead: turning a page and turning it back reads the same.
+*/
+const PAGE_SKIPPED_KEYS = ["Parent", "Rotate"];
+/**
+* Runs a page op or step. It changes the page tree in place, so the
+* document's idle parsed pages close before and after it, as a
+* `contentWrite` job's do: no page that went, or came back, stays parsed.
+*/
+function changingPageTree(ctx, write) {
+	const pool = ctx.session.pagePool();
+	pool.closeIdle();
+	try {
+		return write();
+	} finally {
+		pool.closeIdle();
+	}
+}
+const mutatorOf = (ctx) => new PagesMutator(ctx.runtime, ctx.session);
+const inserterOf = (ctx) => new PagesInserter(ctx.runtime, ctx.session);
+const authorize = (ctx) => authorizeCapability(ctx.authority, "doc.pages.assemble");
+/** `pages.rotate`; its reverse turns each page back while it still has this rotation. */
+function rotatePages(ctx, op) {
+	authorize(ctx);
+	const before = rotationsOf(layoutOf(ctx));
+	const result = mutatorOf(ctx).rotate([...op.pages], op.rotation, ctx.signal);
+	const pages = op.pages.map((page) => page.objectNumber);
+	return {
+		item: {
+			type: "pages.rotate",
+			pages: [...op.pages],
+			rotation: op.rotation,
+			...result
+		},
+		reverse: rotateSteps(pages, before, op.rotation)
+	};
+}
+/** Turns pages to a step's rotation, those that still have the rotation it left. */
+function rotatePagesBack(ctx, step) {
+	const now = rotationsOf(layoutOf(ctx));
+	const pages = step.pages.filter((page) => now.get(page) === step.left);
+	if (pages.length === 0) return leftAlone(ctx, "pages.rotate");
+	authorize(ctx);
+	const refs = pages.map(toPageRef);
+	const result = mutatorOf(ctx).rotate(refs, step.rotation, ctx.signal);
+	return {
+		item: {
+			type: "pages.rotate",
+			pages: refs,
+			rotation: step.rotation,
+			...result
+		},
+		reverse: [{
+			kind: "pages.rotate",
+			pages,
+			rotation: step.left,
+			left: step.rotation
+		}]
+	};
+}
+/** `pages.reorder`; its reverse puts each page back after the page it followed. */
+function reorderPages(ctx, op) {
+	authorize(ctx);
+	const pages = op.pages.map((page) => page.objectNumber);
+	const back = placementsOf(orderOf(ctx), pages);
+	return {
+		item: {
+			type: "pages.reorder",
+			...mutatorOf(ctx).reorder([...op.pages], op.position, ctx.signal)
+		},
+		reverse: [{
+			kind: "pages.reorder",
+			placements: back,
+			left: placementsOf(orderOf(ctx), pages)
+		}]
+	};
+}
+/**
+* Puts pages back where a move found them: each still after the page the move
+* left it after, the page it goes after still there.
+*/
+function reorderPagesBack(ctx, step) {
+	const order = orderOf(ctx);
+	const leftAfter = new Map(step.left.map(({ page, after }) => [page, after]));
+	const placements = step.placements.filter(({ page, after }) => {
+		const at = order.indexOf(page);
+		return at >= 0 && (order[at - 1] ?? 0) === leftAfter.get(page) && (after === 0 || order.includes(after));
+	});
+	if (placements.length === 0) return leftAlone(ctx, "pages.reorder");
+	authorize(ctx);
+	const pages = placements.map(({ page }) => page);
+	const back = placementsOf(order, pages);
+	const mutator = mutatorOf(ctx);
+	let layout = null;
+	for (const { page, after } of placements) {
+		const position = after === 0 ? "start" : { after: toPageRef(after) };
+		({layout} = mutator.reorder([toPageRef(page)], position, ctx.signal));
+	}
+	return {
+		item: {
+			type: "pages.reorder",
+			pages: pages.map(toPageRef),
+			layout,
+			meta: metaOf(ctx)
+		},
+		reverse: [{
+			kind: "pages.reorder",
+			placements: back,
+			left: placementsOf(orderOf(ctx), pages)
+		}]
+	};
+}
+/** `pages.delete`, captured in its transaction so an undo brings back the same pages. */
+function deletePages(ctx, op) {
+	authorize(ctx);
+	return writeDelete(ctx, inDisplayOrder(orderOf(ctx), ctx.session.resolvePageRefs(op.pages)));
+}
+/** Brings back pages a delete removed, those that aren't back already. */
+function restorePages(ctx, step) {
+	const order = orderOf(ctx);
+	const gone = step.pages.filter(({ page }) => !order.includes(page));
+	if (gone.length === 0) return leftAlone(ctx, "pages.restore");
+	authorize(ctx);
+	const docPtr = ctx.session.requireDocPtr();
+	for (const { capture } of gone) importPage(ctx.runtime, docPtr, capture);
+	ctx.session.refreshPageRegistry();
+	ctx.session.invalidateDerived();
+	const pages = inDisplayOrder(orderOf(ctx), gone.map(({ page }) => page));
+	return {
+		item: {
+			type: "pages.restore",
+			pages: pages.map(toPageRef),
+			layout: layoutOf(ctx),
+			meta: metaOf(ctx)
+		},
+		reverse: [removeStepOf(ctx, pages)]
+	};
+}
+/**
+* Deletes pages an insert or a restore brought, those that read as the change
+* left them; never every page of the document.
+*/
+function removePages(ctx, step) {
+	const order = orderOf(ctx);
+	const pages = step.pages.filter(({ page, left }) => order.includes(page) && digestOf(ctx, page) === left).map(({ page }) => page);
+	if (pages.length === 0 || pages.length >= order.length) return leftAlone(ctx, "pages.delete");
+	authorize(ctx);
+	return writeDelete(ctx, inDisplayOrder(order, pages));
+}
+/** `pages.insertBlank`; its reverse deletes the new pages while nobody changed them. */
+function insertBlankPages(ctx, op) {
+	authorize(ctx);
+	const result = inserterOf(ctx).insertBlank(op.spec, op.position ?? "end", ctx.signal, op.objectNumbers);
+	const pages = result.insertedPages.map((page) => page.objectNumber);
+	return {
+		item: {
+			type: "pages.insertBlank",
+			...result
+		},
+		reverse: [removeStepOf(ctx, pages)]
+	};
+}
+/** `pages.insert`; its reverse deletes the pages it copied in while nobody changed them. */
+function insertPages(ctx, op) {
+	authorize(ctx);
+	const result = inserterOf(ctx).insert(bufferOf(op.source), op.position ?? "end", ctx.signal);
+	ctx.session.invalidateDerived();
+	const pages = result.insertedPages.map((page) => page.objectNumber);
+	return {
+		item: {
+			type: "pages.insert",
+			...result
+		},
+		reverse: [removeStepOf(ctx, pages)]
+	};
+}
+/** Deletes `pages`, in display order, each captured first so its restore brings it back. */
+function writeDelete(ctx, pages) {
+	const docPtr = ctx.session.requireDocPtr();
+	const captures = pages.map((page) => ({
+		page,
+		capture: exportPage(ctx.runtime, docPtr, page)
+	}));
+	const refs = pages.map(toPageRef);
+	const result = mutatorOf(ctx).delete(refs, ctx.signal);
+	ctx.session.invalidateDerived();
+	return {
+		item: {
+			type: "pages.delete",
+			pages: refs,
+			...result
+		},
+		reverse: [{
+			kind: "pages.restore",
+			pages: captures
+		}]
+	};
+}
+/** The step that deletes `pages` again while each reads as it does now. */
+function removeStepOf(ctx, pages) {
+	return {
+		kind: "pages.remove",
+		pages: pages.map((page) => ({
+			page,
+			left: digestOf(ctx, page)
+		}))
+	};
+}
+/**
+* How a page reads now: the digest of its dictionary and of what the layer
+* holds of its annotations, contents and resources, as they read (canonical
+* bytes: a save that only encodes a stream again changes nothing), without
+* its place, and with its turn as a value.
+*/
+function digestOf(ctx, page) {
+	const { fn, mem } = ctx.runtime;
+	const docPtr = ctx.session.requireDocPtr();
+	const bytes = canonicalDict(ctx.runtime, docPtr, page, PAGE_DEEP_KEYS, PAGE_SKIPPED_KEYS);
+	const index = ctx.session.allRecords().find((record) => record.pageObjectNumber === page);
+	const turn = index ? rotationAt(ctx.runtime, docPtr, index.pageIndex) : 0;
+	const turned = new TextEncoder().encode(`\nturn ${turn}`);
+	const digested = new Uint8Array(bytes.byteLength + turned.byteLength);
+	digested.set(bytes);
+	digested.set(turned, bytes.byteLength);
+	return sha256HexOf(fn, mem, digested);
+}
+/** The steps that turn each page back, one for each rotation the pages had. */
+function rotateSteps(pages, before, left) {
+	const byRotation = /* @__PURE__ */ new Map();
+	for (const page of pages) {
+		const rotation = before.get(page);
+		byRotation.set(rotation, [...byRotation.get(rotation) ?? [], page]);
+	}
+	return [...byRotation].map(([rotation, group]) => ({
+		kind: "pages.rotate",
+		pages: group,
+		rotation,
+		left
+	}));
+}
+/** Where each of `pages` is in `order`: the page it follows (0: first), in display order. */
+function placementsOf(order, pages) {
+	return inDisplayOrder(order, pages).map((page) => ({
+		page,
+		after: order[order.indexOf(page) - 1] ?? 0
+	}));
+}
+/** `pages` sorted as `order` has them. */
+function inDisplayOrder(order, pages) {
+	return [...pages].sort((left, right) => order.indexOf(left) - order.indexOf(right));
+}
+/** The document's pages by object number, in display order. */
+function orderOf(ctx) {
+	return ctx.session.allRecords().map((record) => record.pageObjectNumber);
+}
+function layoutOf(ctx) {
+	return new PagesReader(ctx.runtime, ctx.session).read(ctx.signal);
+}
+function rotationsOf(layout) {
+	return new Map(layout.pages.map((page) => [page.ref.objectNumber, page.rotation]));
+}
+function metaOf(ctx) {
+	return {
+		affectedPages: [],
+		cacheDelta: null,
+		...ctx.session.writeStamp()
+	};
+}
+/** The bytes of `source` as an ArrayBuffer of their own. */
+function bufferOf(source) {
+	return source.byteOffset === 0 && source.byteLength === source.buffer.byteLength ? source.buffer : source.slice().buffer;
+}
+//#endregion
+//#region src/features/changes/ChangeApplier.ts
+/**
+* The file's own coordinates, in and out: for a single verb's one-op change,
+* whose job converts at the worker's boundary.
+*/
+const FILE_SPACE = {
+	opInFileSpace: (op) => op,
+	itemOut: (item) => item
+};
+/**
+* Runs changes inside the job's layer transaction, which its caller opens and
+* ends, so a failure anywhere leaves the document as it was: a change's ops in
+* order (`apply`), or the steps of a recorded reverse (`undo`). Each op and
+* step is checked against the change's authority as it runs, as its single
+* verb's job checks it.
+*
+* Every op records the steps that reverse it as it runs, from what it found
+* and wrote; the record lists them in reverse op order, so each step meets the
+* document as the op after it left it.
+*/
+var ChangeApplier = class {
+	constructor(runtime, session, fonts) {
+		this.runtime = runtime;
+		this.session = session;
+		this.fonts = fonts;
+	}
+	apply(ops, authority, signal, space) {
+		const ctx = this.context(authority, signal, (self) => opsFillOwnField(self, ops));
+		return collect(authority, ops.map((op, at) => () => runOp(ctx, space.opInFileSpace(op), at)), space, signal);
+	}
+	undo(record, authority, signal, space) {
+		const ctx = this.context(authority, signal, (self) => stepsFillOwnField(self, record.steps));
+		return collect(authority, record.steps.map((step) => () => runStep(ctx, step)), space, signal);
+	}
+	context(authority, signal, ownFill) {
+		let answer;
+		const ctx = {
+			runtime: this.runtime,
+			session: this.session,
+			...this.fonts ? { fonts: this.fonts } : {},
+			authority,
+			signal,
+			fillsOwnField: () => answer ?? (answer = ownFill(ctx))
+		};
+		return ctx;
+	}
+};
+/**
+* Runs each in order, its item measured as soon as it ran; the record
+* reverses them in the opposite order.
+*/
+function collect(authority, runs, space, signal) {
+	const items = [];
+	const reverses = [];
+	for (const run of runs) {
+		throwIfAborted(signal);
+		const done = run();
+		items.push(space.itemOut(done.item));
+		reverses.push(done.reverse);
+	}
+	return {
 		items,
 		record: {
 			userId: authority.identity.userId ?? null,
@@ -14377,17 +15851,34 @@ function runOp(ctx, op, at) {
 		case "forms.importValues": return importFormValues(ctx, op);
 		case "metadata.update": return updateMetadata(ctx, op, at);
 		case "metadata.updateCustom": return updateCustomMetadata(ctx, op);
+		case "outline.create": return createOutlineItem(ctx, op);
+		case "outline.update": return updateOutlineItem(ctx, op, at);
+		case "outline.move": return moveOutlineItems(ctx, op);
+		case "outline.delete": return deleteOutlineItem(ctx, op, at);
+		case "pages.rotate": return changingPageTree(ctx, () => rotatePages(ctx, op));
+		case "pages.reorder": return changingPageTree(ctx, () => reorderPages(ctx, op));
+		case "pages.delete": return changingPageTree(ctx, () => deletePages(ctx, op));
+		case "pages.insertBlank": return changingPageTree(ctx, () => insertBlankPages(ctx, op));
+		case "pages.insert": return changingPageTree(ctx, () => insertPages(ctx, op));
+		case "attachments.create": return createAttachment(ctx, op);
+		case "attachments.delete": return deleteAttachment(ctx, op);
 	}
 }
 function runStep(ctx, step) {
 	switch (step.kind) {
-		case "objects.revert": return "annotation" in step.subject ? revertAnnotation(ctx, {
-			...step,
-			subject: step.subject
-		}) : revertForm(ctx, {
-			...step,
-			subject: step.subject
-		});
+		case "objects.revert":
+			if ("annotation" in step.subject) return revertAnnotation(ctx, {
+				...step,
+				subject: step.subject
+			});
+			if ("outlineItem" in step.subject) return revertOutlineItem(ctx, {
+				...step,
+				subject: step.subject
+			});
+			return revertForm(ctx, {
+				...step,
+				subject: step.subject
+			});
 		case "annotation.remove": return removeAnnotation(ctx, step);
 		case "annotation.restore": return restoreAnnotations(ctx, step);
 		case "annotation.reorder": return reorderBack(ctx, step);
@@ -14397,6 +15888,16 @@ function runStep(ctx, step) {
 		case "widget.delete": return deleteRestoredWidget(ctx, step);
 		case "calculations.restore": return restoreCalculationOrder(ctx, step);
 		case "metadata.revert": return revertMetadata(ctx, step);
+		case "outline.remove": return removeOutlineItem(ctx, step);
+		case "outline.restore": return restoreOutlineItem(ctx, step);
+		case "outline.move": return moveOutlineItemsBack(ctx, step);
+		case "outline.reopen": return reopenOutlineItem(ctx, step);
+		case "pages.rotate": return changingPageTree(ctx, () => rotatePagesBack(ctx, step));
+		case "pages.reorder": return changingPageTree(ctx, () => reorderPagesBack(ctx, step));
+		case "pages.restore": return changingPageTree(ctx, () => restorePages(ctx, step));
+		case "pages.remove": return changingPageTree(ctx, () => removePages(ctx, step));
+		case "attachments.remove": return removeAttachment(ctx, step);
+		case "attachments.restore": return restoreAttachment(ctx, step);
 	}
 }
 //#endregion
@@ -14416,6 +15917,19 @@ function recordBytes(record) {
 			objects(step.unlinked);
 			break;
 		case "field.restore":
+		case "outline.restore":
+			bytes += step.capture.byteLength;
+			break;
+		case "outline.remove":
+			objects(step.left);
+			break;
+		case "pages.restore":
+			for (const { capture } of step.pages) bytes += capture.byteLength;
+			break;
+		case "attachments.remove":
+			bytes += step.left.byteLength;
+			break;
+		case "attachments.restore":
 			bytes += step.capture.byteLength;
 			break;
 		default: break;
@@ -14561,172 +16075,6 @@ function unpackChangeRecord(reverse, capture) {
 	});
 }
 //#endregion
-//#region src/features/attachments/AttachmentReader.ts
-/**
-* Read-only access to embedded files, at both of their homes: the
-* document catalog's `/EmbeddedFiles` name tree (list / readFile by
-* index) and a FileAttachment annotation's `/FS` (readAnnotationFile by
-* ref). Pure reads over the session — no layer artifacts (the
-* `PagesExtractor` shape).
-*
-* Byte delivery mirrors the request's `path?`: absent → a standalone
-* buffer for the transfer list (browser); present → the decoded file is
-* streamed to `path` via `FPDF_FILEWRITE` (server), and only metadata
-* rides the response.
-*/
-var AttachmentReader = class {
-	constructor(runtime, session) {
-		this.runtime = runtime;
-		this.session = session;
-	}
-	/** Snapshot of the `/EmbeddedFiles` name tree, in tree (key-sorted) order. */
-	list(signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const count = fn.FPDFDoc_GetAttachmentCount(docPtr);
-		const items = [];
-		for (let index = 0; index < count; index++) {
-			const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
-			if (!attachmentPtr) continue;
-			const key = readAttachmentKey(fn, mem, docPtr, index) ?? "";
-			items.push({
-				...readAttachmentFileInfo(fn, mem, attachmentPtr),
-				ref: toAttachmentRef(key),
-				index
-			});
-		}
-		return items;
-	}
-	/** Decode one document-level embedded file, addressed by key. */
-	readFile(ref, path, maxDecodedBytes, signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
-		if (index < 0) throw new EngineError(EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
-		const attachmentPtr = fn.FPDFDoc_GetAttachment(docPtr, index);
-		if (!attachmentPtr) throw new EngineError(EngineErrorCode.Unknown, `embedded file with key '${ref.key}' resolved to index ${index} but could not be opened`);
-		const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
-		return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
-	}
-	/** Decode the file embedded in a FileAttachment annotation's `/FS`. */
-	/** A file attachment annotation's file; a page not parsed yet loads in slices. */
-	async readAnnotationFile(pageObjectNumber, ref, path, maxDecodedBytes, signal, slices) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const pool = this.session.pagePool();
-		const pagePtr = await pool.acquireInSlices(pageObjectNumber, signal, slices);
-		let annotPtr = null;
-		try {
-			annotPtr = resolveAnnotPtr(this.runtime, this.session, pagePtr, ref);
-			const attachmentPtr = fn.FPDFAnnot_GetFileAttachment(annotPtr);
-			if (!attachmentPtr) throw new EngineError(EngineErrorCode.InvalidArg, "annotation is not a file attachment or carries no embedded file (/FS)");
-			const info = readAttachmentFileInfo(fn, mem, attachmentPtr);
-			return this.extract(attachmentPtr, info.name, info.mimeType ?? void 0, path, maxDecodedBytes);
-		} finally {
-			if (annotPtr !== null) fn.FPDFPage_CloseAnnot(annotPtr);
-			pool.release(pageObjectNumber);
-		}
-	}
-	extract(attachmentPtr, name, mimeType, path, maxDecodedBytes) {
-		if (path !== void 0) {
-			const { size } = extractAttachmentToFile(this.runtime, attachmentPtr, path, maxDecodedBytes);
-			return {
-				name,
-				...mimeType ? { mimeType } : {},
-				size,
-				path
-			};
-		}
-		const { bytes, size } = extractAttachmentToBuffer(this.runtime, attachmentPtr, maxDecodedBytes);
-		return {
-			name,
-			...mimeType ? { mimeType } : {},
-			size,
-			bytes
-		};
-	}
-};
-//#endregion
-//#region src/features/attachments/AttachmentMutator.ts
-/**
-* Create/delete mutations over the document catalog's `/EmbeddedFiles`
-* name tree — the doc-level sibling of `AnnotationMutator`, sharing the
-* write path (`writeAttachmentFilePayload`) with the file-attachment
-* annotation writer.
-*
-* Identity is the name-tree key (unique by construction). Note the
-* tree is key-sorted: both mutations shift other entries' indices; keys
-* never move. Layer persistence (`finishMutation`) and event publication
-* happen in the callers, exactly like every other mutation family.
-*/
-var AttachmentMutator = class {
-	constructor(runtime, session) {
-		this.runtime = runtime;
-		this.session = session;
-	}
-	/**
-	* Create an embedded file. `file.name` becomes the tree key (PDFium
-	* writes key = /UF = /F); a duplicate key rejects with `InvalidArg`.
-	* The result carries the read-back entry, `checksum`/`size`/dates
-	* included.
-	*/
-	create(file, resources, signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const resource = resources?.[file.resources.file];
-		if (!resource) throw new EngineError(EngineErrorCode.InvalidArg, `attachment file references resource '${file.resources.file}' but no such binary payload accompanied the mutation`);
-		if (file.name.length === 0) throw new EngineError(EngineErrorCode.InvalidArg, "attachment file requires a name");
-		if (resolveAttachmentIndex(fn, mem, docPtr, {
-			kind: "key",
-			key: file.name
-		}) !== -1) throw new EngineError(EngineErrorCode.InvalidArg, `an embedded file with key '${file.name}' already exists — keys are unique; rename and retry`);
-		throwIfAborted(signal);
-		const namePtr = mem.writeU16String(file.name);
-		let attachmentPtr;
-		try {
-			attachmentPtr = fn.FPDFDoc_AddAttachment(docPtr, namePtr);
-		} finally {
-			mem.free(namePtr);
-		}
-		if (!attachmentPtr) throw new EngineError(EngineErrorCode.Unknown, "FPDFDoc_AddAttachment returned NULL");
-		writeAttachmentFilePayload(fn, mem, attachmentPtr, docPtr, file, resource);
-		const ref = toAttachmentRef(file.name);
-		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
-		if (index < 0) throw new EngineError(EngineErrorCode.Unknown, "created attachment did not resolve by key after the write");
-		return {
-			attachment: {
-				...readAttachmentFileInfo(fn, mem, attachmentPtr),
-				ref,
-				index
-			},
-			meta: {
-				affectedPages: [],
-				cacheDelta: null,
-				...this.session.writeStamp(),
-				changed: [ref]
-			}
-		};
-	}
-	/** Delete an embedded file by key. Unlinks the tree entry only. */
-	delete(ref, signal) {
-		throwIfAborted(signal);
-		const { fn, mem } = this.runtime;
-		const docPtr = this.session.requireDocPtr();
-		const index = resolveAttachmentIndex(fn, mem, docPtr, ref);
-		if (index < 0) throw new EngineError(EngineErrorCode.NotFound, `no embedded file with key '${ref.key}' in the document`);
-		if (!fn.FPDFDoc_DeleteAttachment(docPtr, index)) throw new EngineError(EngineErrorCode.Unknown, "FPDFDoc_DeleteAttachment returned false");
-		return { meta: {
-			affectedPages: [],
-			cacheDelta: null,
-			...this.session.writeStamp(),
-			changed: [ref]
-		} };
-	}
-};
-//#endregion
 //#region src/features/security/internal/buildSecurityInfo.ts
 /**
 * Single constructor for the "successfully inspected" shape of
@@ -15561,11 +16909,6 @@ function assertSealedSignature(runtime, docPtr, model, expected) {
 function sameRange(a, b) {
 	return a[0] === b[0] && a[1] === b[1] && a[2] === b[2] && a[3] === b[3];
 }
-function bytesEqual(a, b) {
-	if (a.byteLength !== b.byteLength) return false;
-	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
-	return true;
-}
 //#endregion
 //#region src/features/forms/internal/fieldGroups.ts
 /** The group of the field `fieldObjectNumber`; `null` in none, or when the form has no such field. */
@@ -17095,13 +18438,8 @@ function resultInPageSpace(payload, boxOf) {
 			...payload,
 			snapshot: pageListOf(payload.snapshot)
 		};
-		case "pages.reorder":
-		case "pages.rotate":
-		case "pages.delete":
 		case "pages.setName":
-		case "pages.removeName":
-		case "pages.insert":
-		case "pages.insertBlank": return {
+		case "pages.removeName": return {
 			...payload,
 			result: {
 				...payload.result,
@@ -17144,6 +18482,10 @@ function resultInPageSpace(payload, boxOf) {
 			...payload,
 			snapshot: mapDocumentActions(payload.snapshot, toPage)
 		};
+		case "outline.read": return {
+			...payload,
+			outline: pageOutlineOf(payload.outline, boxOf)
+		};
 		case "annotations.list": return {
 			...payload,
 			list: {
@@ -17165,17 +18507,8 @@ function resultInPageSpace(payload, boxOf) {
 				annotation: annotation(payload.result.annotation)
 			}
 		};
-		case "document.apply": return {
-			...payload,
-			result: changeResultInPageSpace(payload.result, boxOf)
-		};
-		case "document.applyChanges": return {
-			...payload,
-			outcomes: payload.outcomes.map((outcome) => outcome.status === "applied" ? {
-				...outcome,
-				result: changeResultInPageSpace(outcome.result, boxOf)
-			} : outcome)
-		};
+		case "document.apply":
+		case "document.applyChanges": return payload;
 		case "annotations.import": return {
 			...payload,
 			result: {
@@ -17270,17 +18603,8 @@ function requestInFileSpace(job, boxOf) {
 			...job,
 			draft: pdfFormFieldDraftOf(job.draft, boxOf)
 		};
-		case "document.apply": return {
-			...job,
-			change: changeInFileSpace(job.change, boxOf)
-		};
-		case "document.applyChanges": return {
-			...job,
-			changes: job.changes.map((entry) => ({
-				...entry,
-				change: changeInFileSpace(entry.change, boxOf)
-			}))
-		};
+		case "document.apply":
+		case "document.applyChanges": return job;
 		case "forms.addWidget": return {
 			...job,
 			placement: pdfWidgetPlacementOf(job.placement, boxOf)
@@ -17313,10 +18637,7 @@ function renderOptionsInFileSpace(options, visible) {
 		target: target.kind === "rect" ? pdfRenderTargetOf(target, visible()) : target
 	};
 }
-function changeInFileSpace(change, boxOf) {
-	if ("undoOf" in change) return change;
-	return { ops: change.ops.map((op) => opInFileSpace(op, boxOf)) };
-}
+/** An op's places in the file's coordinates, as its single verb's job's are. */
 function opInFileSpace(op, boxOf) {
 	switch (op.type) {
 		case "annotations.import":
@@ -17366,16 +18687,29 @@ function opInFileSpace(op, boxOf) {
 				expect: pdfWidgetPatchOf(expect, boxOf(op.widget.page), boxOf)
 			} : rest;
 		}
+		case "outline.create": return {
+			...op,
+			data: pdfOutlineDraftOf(op.data, boxOf)
+		};
+		case "outline.update": {
+			const { expect, ...rest } = op;
+			return {
+				...rest,
+				patch: pdfOutlinePatchOf(op.patch, boxOf),
+				...expect ? { expect: pdfOutlinePatchOf(expect, boxOf) } : {}
+			};
+		}
+		case "outline.delete": {
+			const { expect, ...rest } = op;
+			return expect ? {
+				...rest,
+				expect: pdfOutlinePatchOf(expect, boxOf)
+			} : rest;
+		}
 		default: return op;
 	}
 }
-/** What a change did, each place in page space, as its single verbs' results are. */
-function changeResultInPageSpace(result, boxOf) {
-	return {
-		...result,
-		items: result.items.map((item) => itemInPageSpace(item, boxOf))
-	};
-}
+/** What an op did, each place in page space, as its single verb's result is. */
 function itemInPageSpace(item, boxOf) {
 	if (isSkippedItem(item)) return item;
 	const annotation = (read) => pageAnnotationOf(read, boxOf(read.page), boxOf);
@@ -17427,6 +18761,24 @@ function itemInPageSpace(item, boxOf) {
 			field: item.field && pageFormFieldOf(item.field, boxOf),
 			widgets: widgets(item.widgets)
 		};
+		case "outline.create":
+		case "outline.update": return {
+			...item,
+			item: pageOutlineItemOf(item.item, boxOf)
+		};
+		case "outline.restore": return {
+			...item,
+			items: item.items.map((read) => pageOutlineItemOf(read, boxOf))
+		};
+		case "pages.rotate":
+		case "pages.reorder":
+		case "pages.delete":
+		case "pages.insertBlank":
+		case "pages.insert":
+		case "pages.restore": return {
+			...item,
+			layout: pageListOf(item.layout)
+		};
 		default: return item;
 	}
 }
@@ -17964,6 +19316,9 @@ var WorkerHost = class {
 				case "actions.read":
 					resultPack = this.handleActionsRead(msg, ctrl.signal);
 					break;
+				case "outline.read":
+					resultPack = this.handleOutlineRead(msg, ctrl.signal);
+					break;
 				case "annotations.list":
 					resultPack = this.handleAnnotationsList(msg, ctrl.signal);
 					break;
@@ -18069,15 +19424,6 @@ var WorkerHost = class {
 				case "pages.list":
 					resultPack = this.handlePagesList(msg, ctrl.signal);
 					break;
-				case "pages.reorder":
-					resultPack = this.handlePagesReorder(msg, ctrl.signal);
-					break;
-				case "pages.rotate":
-					resultPack = this.handlePagesRotate(msg, ctrl.signal);
-					break;
-				case "pages.delete":
-					resultPack = this.handlePagesDelete(msg, ctrl.signal);
-					break;
 				case "pages.setName":
 					resultPack = this.handlePagesSetName(msg, ctrl.signal);
 					break;
@@ -18108,24 +19454,12 @@ var WorkerHost = class {
 				case "pages.extract":
 					resultPack = this.handlePagesExtract(msg, ctrl.signal);
 					break;
-				case "pages.insert":
-					resultPack = this.handlePagesInsert(msg, ctrl.signal);
-					break;
-				case "pages.insertBlank":
-					resultPack = this.handlePagesInsertBlank(msg, ctrl.signal);
-					break;
 				case "attachments.list":
 					resultPack = this.handleAttachmentsList(msg, ctrl.signal);
 					break;
 				case "attachments.readFile":
 					resultPack = this.handleAttachmentsReadFile(msg, ctrl.signal);
 					break;
-				case "attachments.create":
-					resultPack = this.handleAttachmentsCreate(msg, ctrl.signal);
-					break;
-				case "attachments.delete":
-					resultPack = this.handleAttachmentsDelete(msg, ctrl.signal);
-					break;
 				case "measure.setScale":
 					resultPack = this.handleMeasureSetScale(msg, ctrl.signal);
 					break;
@@ -18483,6 +19817,13 @@ var WorkerHost = class {
 			snapshot: new DocumentActionsReader(this.runtime, session).read(signal)
 		});
 	}
+	handleOutlineRead(req, signal) {
+		const session = this.requireSession(req);
+		return wirePack({
+			tag: "outline.read",
+			outline: new OutlineReader(this.runtime, session).read(signal)
+		});
+	}
 	handleAnnotationsList(req, signal) {
 		const session = this.requireSession(req);
 		const pages = req.pages?.map((page) => session.resolvePageRef(page).pageObjectNumber);
@@ -18668,12 +20009,15 @@ var WorkerHost = class {
 		const prior = ledger.outcome(opId);
 		let result;
 		if (prior) result = this.replayed(prior, fingerprint, opId);
-		else result = this.recorded(session, opId, fingerprint, () => new ChangeApplier(this.runtime, session, this.fonts).apply(change.ops, authority, signal));
+		else result = this.recorded(session, opId, fingerprint, () => new ChangeApplier(this.runtime, session, this.fonts).apply(change.ops, authority, signal, FILE_SPACE));
 		const item = result.items[0];
 		if (!item || isSkippedItem(item)) throw new EngineError(EngineErrorCode.Unknown, `${op.type} wrote nothing`);
 		return item;
 	}
-	/** A change's answer the first time, kept under its `opId`; a retry's checks. */
+	/**
+	* A change's answer the first time, kept under its `opId`; a retry's
+	* checks. The answer is in the space its job answered in (`ChangeOutcome`).
+	*/
 	replayed(prior, fingerprint, opId) {
 		if (prior.fingerprint !== fingerprint) throw new EngineError(EngineErrorCode.IdempotencyKeyReused, `opId ${opId} already answered a different change`);
 		if (prior.kind === "refused") throw deserializeError(prior.error);
@@ -18706,12 +20050,13 @@ var WorkerHost = class {
 		session.assertUsable();
 		if (req.objectNumberFloor !== void 0) session.raiseLastObjectNumber(req.objectNumberFloor - 1);
 		const applier = new ChangeApplier(this.runtime, session, this.fonts);
+		const space = this.pageSpaceOf(session);
 		const records = /* @__PURE__ */ new Map();
 		const outcomes = [];
 		for (const entry of req.changes) {
 			session.beginTransaction(entry.opId);
 			try {
-				const applied = runServerChange(applier, entry, records, signal);
+				const applied = runServerChange(applier, entry, records, signal, space);
 				const result = resultOf(session, applied);
 				session.commitTransaction();
 				const record = result.meta.undoable ? applied.record : null;
@@ -18740,11 +20085,23 @@ var WorkerHost = class {
 		if (!outcomes.some((outcome) => outcome.status === "applied" && outcome.result.items.some(itemWrote))) return wirePack(payload);
 		return this.finishMutation(session, payload, req.artifactPath);
 	}
+	/**
+	* Page space for a change, measured as each op runs: the page boxes are read
+	* anew each time, as an op can add, remove or put back the page a later
+	* one names.
+	*/
+	pageSpaceOf(session) {
+		return {
+			opInFileSpace: (op) => opInFileSpace(op, visibleBoxReader(this.runtime, session)),
+			itemOut: (item) => itemInPageSpace(item, visibleBoxReader(this.runtime, session))
+		};
+	}
 	/** A change's ops, or the steps of the record an undo names. */
 	runChange(session, req, signal) {
 		const applier = new ChangeApplier(this.runtime, session, this.fonts);
+		const space = this.pageSpaceOf(session);
 		const userId = req.authority.identity.userId ?? null;
-		if (!isUndoChange(req.change)) return applier.apply(req.change.ops, req.authority, signal);
+		if (!isUndoChange(req.change)) return applier.apply(req.change.ops, req.authority, signal, space);
 		const kept = changeLedgerOf(session).record(req.change.undoOf);
 		if (!kept || "unavailable" in kept) throw new EngineError(EngineErrorCode.UndoUnavailable, `change ${req.change.undoOf} can no longer be undone`, { details: { reason: kept ? kept.unavailable : "expired" } });
 		if (!kept.record) return {
@@ -18755,7 +20112,7 @@ var WorkerHost = class {
 			}
 		};
 		if (kept.record.userId !== null && kept.record.userId !== userId) throw new PermissionDenied("changes:undo", "target");
-		return applier.undo(kept.record, req.authority, signal);
+		return applier.undo(kept.record, req.authority, signal, space);
 	}
 	handlePagesList(req, signal) {
 		const session = this.requireSession(req);
@@ -18764,30 +20121,6 @@ var WorkerHost = class {
 			snapshot: new PagesReader(this.runtime, session).read(signal)
 		});
 	}
-	handlePagesReorder(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesMutator(this.runtime, session).reorder(req.pages, req.position, signal);
-		return this.finishMutation(session, {
-			tag: "pages.reorder",
-			result
-		}, req.artifactPath);
-	}
-	handlePagesRotate(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesMutator(this.runtime, session).rotate(req.pages, req.rotation, signal);
-		return this.finishMutation(session, {
-			tag: "pages.rotate",
-			result
-		}, req.artifactPath);
-	}
-	handlePagesDelete(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesMutator(this.runtime, session).delete(req.pages, signal);
-		return this.finishMutation(session, {
-			tag: "pages.delete",
-			result
-		}, req.artifactPath);
-	}
 	handlePagesSetName(req, signal) {
 		const session = this.requireSession(req);
 		const result = new PagesMutator(this.runtime, session).setName({
@@ -18840,32 +20173,13 @@ var WorkerHost = class {
 	}
 	handlePagesExtract(req, signal) {
 		const session = this.requireSession(req);
-		const extracted = new PagesExtractor(this.runtime, session).extract(req.pages, signal);
+		const extracted = new PagesExtractor(this.runtime, session).extract(req.pages, req.flatten, signal);
 		return wirePack({
 			tag: "pages.extract",
 			bytes: extracted.bytes,
 			size: extracted.size
 		}, [extracted.bytes]);
 	}
-	handlePagesInsert(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesInserter(this.runtime, session).insert(req.bytes, req.position ?? "end", signal);
-		return this.finishMutation(session, {
-			tag: "pages.insert",
-			result
-		}, req.artifactPath);
-	}
-	handlePagesInsertBlank(req, signal) {
-		const session = this.requireSession(req);
-		const result = new PagesInserter(this.runtime, session).insertBlank({
-			size: req.size,
-			count: req.count
-		}, req.position ?? "end", signal, req.objectNumbers);
-		return this.finishMutation(session, {
-			tag: "pages.insertBlank",
-			result
-		}, req.artifactPath);
-	}
 	handleAttachmentsList(req, signal) {
 		const session = this.requireSession(req);
 		return wirePack({
@@ -18881,22 +20195,6 @@ var WorkerHost = class {
 			content
 		}, content.bytes !== void 0 ? [content.bytes] : []);
 	}
-	handleAttachmentsCreate(req, signal) {
-		const session = this.requireSession(req);
-		const result = new AttachmentMutator(this.runtime, session).create(req.file, req.resources, signal);
-		return this.finishMutation(session, {
-			tag: "attachments.create",
-			result
-		}, req.artifactPath);
-	}
-	handleAttachmentsDelete(req, signal) {
-		const session = this.requireSession(req);
-		const result = new AttachmentMutator(this.runtime, session).delete(req.ref, signal);
-		return this.finishMutation(session, {
-			tag: "attachments.delete",
-			result
-		}, req.artifactPath);
-	}
 	async handleAnnotationsReadFile(req, signal) {
 		const session = this.requireSession(req);
 		const content = await new AttachmentReader(this.runtime, session).readAnnotationFile(session.resolvePageRef(req.page).pageObjectNumber, req.ref, req.path, req.maxDecodedBytes, signal, this.slices);
@@ -19661,9 +20959,9 @@ function resultOf(session, applied) {
 * this job kept for an earlier change of the request, or the one the server
 * sent. A change that left no record leaves nothing to undo.
 */
-function runServerChange(applier, entry, records, signal) {
+function runServerChange(applier, entry, records, signal, space) {
 	const { change, authority } = entry;
-	if (!isUndoChange(change)) return applier.apply(change.ops, authority, signal);
+	if (!isUndoChange(change)) return applier.apply(change.ops, authority, signal, space);
 	const userId = authority.identity.userId ?? null;
 	const record = records.has(change.undoOf) ? records.get(change.undoOf) : entry.record;
 	if (record === void 0) throw new EngineError(EngineErrorCode.UndoUnavailable, `change ${change.undoOf} can no longer be undone`, { details: { reason: "expired" } });
@@ -19674,7 +20972,7 @@ function runServerChange(applier, entry, records, signal) {
 			steps: []
 		}
 	};
-	return applier.undo(record, authority, signal);
+	return applier.undo(record, authority, signal, space);
 }
 /** Every page a change's items touched, once each, in order. */
 function pagesOf(items) {
@@ -19746,6 +21044,6 @@ function assertNoImport(change) {
 	if (op) throw new EngineError(EngineErrorCode.InvalidArg, `doc.apply takes no import: import a bundle with ${verbs[op.type]}`);
 }
 //#endregion
-export { ALL_STANDARD_SECURITY_PERMISSIONS, ActionReadBudgetTracker, AnnotationAppearanceReader, AnnotationBatchApplier, AnnotationExporter, AnnotationFlattener, AnnotationImporter, AnnotationMutator, AnnotationReader, AttachmentMutator, AttachmentReader, BaseDocumentRegistry, CandidateFinalizer, ChangeApplier, ChangeLedger, CloseStack, DIGEST_CODE, DocumentActionsReader, PagesMutator as DocumentPagesMutator, PagesMutator, DocumentSaver, DocumentSession, EPDF_CHAR_GEOMETRY_LAYOUT, FontRegistrar, FormExporter, FormImporter, FormMutator, FormReader, MetadataMutator, MetadataReader, PageGeometryReader, PagesReader as PageLayoutReader, PagesReader, PagePtrPool, PageRenderReader as PageRasterReader, PageRenderReader, PageTextReader, PagesExtractor, PagesFlattener, PagesInserter, RawAnnotationReader, RedactionApplier, SearchReader, SecurityReader, SignatureAnalyzer, SignatureMutator, SignatureReader, WorkerHost, acquireSignatureModel, buildRunsFromRawGlyphs, changeLedgerOf, destroyLibrary, disposeFormModel, disposeSignatureModel, ensureInitialized, formatPdfDate, generateUuid, hasAllStandardSecurityPermissions, hasSignedSignature, normalizeU32, openFatMemoryDocument, openLayerDocument, packChangeRecord, pdfDateToIso, readActionModel, readAttachmentFileInfo, readRevisions, readSignaturesFromModel, readStructure, throwIfAborted, unpackChangeRecord, visibleBoxReader, writeAttachmentFilePayload };
+export { ALL_STANDARD_SECURITY_PERMISSIONS, ActionReadBudgetTracker, AnnotationAppearanceReader, AnnotationBatchApplier, AnnotationExporter, AnnotationFlattener, AnnotationImporter, AnnotationMutator, AnnotationReader, AttachmentMutator, AttachmentReader, BaseDocumentRegistry, CandidateFinalizer, ChangeApplier, ChangeLedger, CloseStack, DIGEST_CODE, DocumentActionsReader, PagesMutator as DocumentPagesMutator, PagesMutator, DocumentSaver, DocumentSession, EPDF_CHAR_GEOMETRY_LAYOUT, FILE_SPACE, FontRegistrar, FormExporter, FormImporter, FormMutator, FormReader, MetadataMutator, MetadataReader, PageGeometryReader, PagesReader as PageLayoutReader, PagesReader, PagePtrPool, PageRenderReader as PageRasterReader, PageRenderReader, PageTextReader, PagesExtractor, PagesFlattener, PagesInserter, RawAnnotationReader, RedactionApplier, SearchReader, SecurityReader, SignatureAnalyzer, SignatureMutator, SignatureReader, WorkerHost, acquireSignatureModel, buildRunsFromRawGlyphs, changeLedgerOf, destroyLibrary, disposeFormModel, disposeSignatureModel, ensureInitialized, formatPdfDate, generateUuid, hasAllStandardSecurityPermissions, hasSignedSignature, normalizeU32, openFatMemoryDocument, openLayerDocument, packChangeRecord, pdfDateToIso, readActionModel, readAttachmentFileInfo, readRevisions, readSignaturesFromModel, readStructure, rotationAt, throwIfAborted, unpackChangeRecord, visibleBoxReader, writeAttachmentFilePayload };
 
 //# sourceMappingURL=index.js.map