@inkbar/core 0.11.0 → 0.12.0

package/dist/{sign-DZVDJhqT.mjs → sign-BSP7H3b7.mjs}

@@ -130,6 +130,38 @@ function rectsIntersect(a, b) {
 function rectContainsPoint(r, p) {
 	return p.x >= r.x && p.x <= r.x + r.width && p.y >= r.y && p.y <= r.y + r.height;
 }
+/**
+* Whether `p` is inside `q` or on its edge. A quad's corners run top-left, top-right,
+* bottom-left, bottom-right (PDF QuadPoints order), so its outline is p1, p2, p4, p3. Works for
+* any convex quad, whichever way round it winds. A quad with no area (a point or a line, as a
+* malformed file may give) contains nothing.
+*/
+function quadContainsPoint(q, p) {
+	const ring = [
+		q.p1,
+		q.p2,
+		q.p4,
+		q.p3
+	];
+	let area = 0;
+	for (let i = 0; i < 4; i++) {
+		const a = ring[i];
+		const b = ring[(i + 1) % 4];
+		area += a.x * b.y - b.x * a.y;
+	}
+	if (area === 0) return false;
+	let sign = 0;
+	for (let i = 0; i < 4; i++) {
+		const a = ring[i];
+		const b = ring[(i + 1) % 4];
+		const cross = (b.x - a.x) * (p.y - a.y) - (b.y - a.y) * (p.x - a.x);
+		if (cross === 0) continue;
+		const s = Math.sign(cross);
+		if (sign === 0) sign = s;
+		else if (s !== sign) return false;
+	}
+	return true;
+}
 function translateRect(r, dx, dy) {
 	return {
 		x: r.x + dx,
@@ -1542,20 +1574,94 @@ async function openPdfObjects(bytes) {
 }
 //#endregion
 //#region src/pdfjs/destinations.ts
+/** A coordinate from a destination array: a finite number, or `undefined` for `null` or junk. */
+function coord(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
 /**
-* The page index a named destination points at, through PDF.js, which looks the name up in the
-* catalog's `/Names /Dests` tree and its older `/Dests` dictionary. `undefined` when the name
-* is unknown or its destination names no page of the document.
+* The destination `raw` names, through PDF.js, which looks a name up in the catalog's
+* `/Names /Dests` tree and its older `/Dests` dictionary. `undefined` when the name is unknown,
+* the array is malformed, or it names no page of the document.
 */
-async function destinationPage(proxy, name) {
+async function resolveDestination(proxy, raw) {
 	try {
-		const target = (await proxy.getDestination(name))?.[0];
+		const array = typeof raw === "string" ? await proxy.getDestination(raw) : raw;
+		if (!array) return void 0;
+		const target = array[0];
 		const page = typeof target === "number" ? target : typeof target === "object" && target !== null && "num" in target ? await proxy.getPageIndex(target) : void 0;
-		return page !== void 0 && Number.isInteger(page) && page >= 0 && page < proxy.numPages ? page : void 0;
+		if (page === void 0 || !Number.isInteger(page) || page < 0 || page >= proxy.numPages) return;
+		const name = array[1]?.name;
+		switch (typeof name === "string" ? name.toLowerCase() : "") {
+			case "xyz": return {
+				page,
+				fit: "xyz",
+				left: coord(array[2]),
+				top: coord(array[3]),
+				zoom: coord(array[4])
+			};
+			case "fit": return {
+				page,
+				fit: "fit"
+			};
+			case "fitb": return {
+				page,
+				fit: "fitb"
+			};
+			case "fith": return {
+				page,
+				fit: "fith",
+				top: coord(array[2])
+			};
+			case "fitbh": return {
+				page,
+				fit: "fitbh",
+				top: coord(array[2])
+			};
+			case "fitv": return {
+				page,
+				fit: "fitv",
+				left: coord(array[2])
+			};
+			case "fitbv": return {
+				page,
+				fit: "fitbv",
+				left: coord(array[2])
+			};
+			case "fitr": {
+				const [left, bottom, right, top] = [
+					2,
+					3,
+					4,
+					5
+				].map((i) => coord(array[i]));
+				if (left === void 0 || bottom === void 0 || right === void 0 || top === void 0) return;
+				return {
+					page,
+					fit: "fitr",
+					rect: {
+						x: Math.min(left, right),
+						y: Math.min(bottom, top),
+						width: Math.abs(right - left),
+						height: Math.abs(top - bottom)
+					}
+				};
+			}
+			default: return {
+				page,
+				fit: "fit"
+			};
+		}
 	} catch {
 		return;
 	}
 }
+/**
+* The page index a named destination points at. `undefined` when the name is unknown or its
+* destination names no page of the document.
+*/
+async function destinationPage(proxy, name) {
+	return (await resolveDestination(proxy, name))?.page;
+}
 //#endregion
 //#region src/pdfjs/glyphs.ts
 const IDENTITY = [
@@ -1817,1485 +1923,1630 @@ function mapLoadError(cause, context) {
 	}, cause);
 }
 //#endregion
-//#region src/model/form/values.ts
-/**
-* Why `value` cannot be the field's value, or `undefined` when it can. A locked or read-only
-* field is `readOnly`; otherwise the value must suit the type: any text within `maxLength`, an
-* option of a non-editable choice, an array of options for a multi-select list, an on state or
-* `Off` for a checkbox or radio, and `{ signature }` for a signature field. A button has no value.
-*/
-function checkValue(field, value) {
-	if (field.locked || field.flags.readOnly) return "readOnly";
-	return suits(field, value) ? void 0 : "invalid";
-}
-/** Whether `value` suits the field's type, whatever its flags. */
-function suits(field, value) {
-	const isOption = (v) => field.options.some((o) => o.value === v);
-	switch (field.type) {
-		case "text": return typeof value === "string" && (field.maxLength === void 0 || value.length <= field.maxLength);
-		case "combo": return typeof value === "string" && (field.flags.editable || isOption(value));
-		case "list": return field.flags.multiSelect ? Array.isArray(value) && value.every(isOption) : typeof value === "string" && isOption(value);
-		case "checkbox":
-		case "radio": return value === "Off" || typeof value === "string" && (isOption(value) || field.widgets.some((w) => w.onState === value));
-		case "signature": return typeof value === "object" && value !== null && !Array.isArray(value) && typeof value.signature === "string" && value.signature !== "";
-		case "button": return false;
+//#region src/model/pdf-date.ts
+/** Parses a PDF date string (`D:YYYYMMDDHHmmSSOHH'mm'`) into ISO 8601. Returns `fallback` on anything unparseable. */
+function parsePdfDate(value, fallback) {
+	if (!value) return fallback;
+	const m = /^(?:D:)?(\d{4})(\d{2})?(\d{2})?(\d{2})?(\d{2})?(\d{2})?(Z|[+-]\d{2}(?:'\d{2}')?)?/.exec(value.trim());
+	if (!m) return fallback;
+	const [, y, mo = "01", d = "01", h = "00", mi = "00", s = "00", zone] = m;
+	let offsetMinutes = 0;
+	if (zone && zone !== "Z") {
+		const sign = zone.startsWith("-") ? -1 : 1;
+		const zh = Number(zone.slice(1, 3));
+		const zm = Number(zone.slice(4, 6) || 0);
+		offsetMinutes = sign * (zh * 60 + zm);
 	}
+	const utc = Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s)) - offsetMinutes * 6e4;
+	if (Number.isNaN(utc)) return fallback;
+	return new Date(utc).toISOString();
 }
-/**
-* A checked value as it is stored: frozen, a multi-select's options in option order without
-* repeats, and a signature with only its id.
-*/
-function normaliseValue(field, value) {
-	if (Array.isArray(value)) {
-		const chosen = new Set(value);
-		return Object.freeze(field.options.map((o) => o.value).filter((v) => chosen.has(v) && chosen.delete(v)));
-	}
-	if (typeof value === "object") return Object.freeze({ signature: value.signature });
-	return value;
+//#endregion
+//#region src/model/annotations/defaults.ts
+const COLORS = {
+	highlight: "#F2C230",
+	underline: "#2B5A9E",
+	strikeout: "#C0392B",
+	squiggly: "#1F7A4D",
+	text: "#F2C230",
+	freetext: "#151820",
+	square: "#C0392B",
+	circle: "#C0392B",
+	line: "#151820",
+	polyline: "#151820",
+	polygon: "#151820",
+	ink: "#151820",
+	stamp: "#151820",
+	loupe: "#151820",
+	mask: "#000000",
+	redact: "#C0392B"
+};
+const staticDefaults = {
+	color: (type) => COLORS[type],
+	fill: () => "#000000",
+	opacity: (type) => type === "highlight" ? .4 : 1
+};
+const VARIABLES = {
+	highlight: "--ink-highlight",
+	underline: "--ink-underline",
+	strikeout: "--ink-strikeout",
+	squiggly: "--ink-squiggly",
+	text: "--ink-note",
+	freetext: "--ink-free-text",
+	square: "--ink-shape",
+	circle: "--ink-shape",
+	line: "--ink-shape",
+	polyline: "--ink-shape",
+	polygon: "--ink-shape",
+	ink: "--ink-ink",
+	stamp: "--ink-ink",
+	loupe: "--ink-shape",
+	mask: "--ink-mask",
+	redact: "--ink-redact"
+};
+/** Resolves default colours from CSS custom properties on `el`, falling back to `staticDefaults`. */
+function cssVariableDefaults(el) {
+	const read = (name) => {
+		const view = el.ownerDocument.defaultView;
+		if (!view) return void 0;
+		return normalizeColor(view.getComputedStyle(el).getPropertyValue(name));
+	};
+	return {
+		color: (type) => read(VARIABLES[type]) ?? staticDefaults.color(type),
+		fill: () => read("--ink-redact-fill") ?? staticDefaults.fill(),
+		opacity: (type) => staticDefaults.opacity(type)
+	};
 }
-/** The value a reset gives: the PDF's default, else empty for the type, else none. */
-function resetValue(field) {
-	if (field.defaultValue !== void 0) return field.defaultValue;
-	switch (field.type) {
-		case "text":
-		case "combo": return "";
-		case "checkbox":
-		case "radio": return "Off";
-		case "list": return field.flags.multiSelect ? Object.freeze([]) : void 0;
-		default: return;
+/** Accepts `#rgb`, `#rrggbb`, `rgb(r, g, b)` and `rgb(r g b)`; returns `#RRGGBB` or undefined. */
+function normalizeColor(value) {
+	const v = value.trim();
+	const short = /^#([0-9a-f])([0-9a-f])([0-9a-f])$/i.exec(v);
+	if (short) {
+		const [, r = "", g = "", b = ""] = short;
+		return `#${r}${r}${g}${g}${b}${b}`.toUpperCase();
 	}
-}
-function sameValue$1(a, b) {
-	if (a === b) return true;
-	if (a === void 0 || b === void 0) return false;
-	if (Array.isArray(a) || Array.isArray(b)) return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => v === b[i]);
-	return typeof a === "object" && typeof b === "object" && a.signature === b.signature;
+	if (/^#[0-9a-f]{6}$/i.test(v)) return v.toUpperCase();
+	const rgb = /^rgba?\(\s*(\d{1,3})[\s,]+(\d{1,3})[\s,]+(\d{1,3})/i.exec(v);
+	if (rgb) return `#${[
+		rgb[1],
+		rgb[2],
+		rgb[3]
+	].map((n) => Math.min(255, Number(n)).toString(16).padStart(2, "0")).join("")}`.toUpperCase();
 }
 //#endregion
-//#region src/model/form/gloss.ts
-/** A field value as Gloss writes it: text, the options of a multi-select, or a signature id. */
-const GlossFieldValueSchema = z.union([
-	z.string(),
-	z.array(z.string()),
-	z.looseObject({ signature: z.string().min(1) })
-]);
-z.record(z.string().min(1), GlossFieldValueSchema);
+//#region src/model/annotations/callout.ts
 /**
-* The values to export: every field that has one and is not no-export, in field order, with a
-* multi-select's options in option order.
+* The insets from a free text's `rect` to its text box, in points (PDF `/RD`, XFDF `fringe`,
+* both in this order).
 */
-function fieldsToGloss(values, fields) {
-	const out = {};
-	for (const field of fields) {
-		const value = values[field.name];
-		if (value === void 0 || field.flags.noExport) continue;
-		out[field.name] = normaliseValue(field, value);
-	}
-	return out;
-}
+const FringeSchema = z.object(Fringe.shape);
+/** An ending's length, and its full width, as a multiple of the stroke width. */
+const ENDING_SCALE = 3;
 /**
-* The values of a Gloss `fields` map that suit the form, and the names that do not: unknown,
-* read-only (or locked), or invalid for the field. Anything other than a map applies nothing.
+* A free text's text box: `rect` inset by `fringe`, or `rect` itself without one. Insets wider
+* or taller than `rect` leave a box of width or height 0 at the inset origin.
 */
-function fieldsFromGloss(raw, fields) {
-	const values = {};
-	const rejected = [];
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
-		values,
-		rejected
-	};
-	const byName = new Map(fields.map((f) => [f.name, f]));
-	for (const [name, value] of Object.entries(raw)) {
-		const field = byName.get(name);
-		if (!field) {
-			rejected.push({
-				name,
-				reason: "unknown"
-			});
-			continue;
-		}
-		const parsed = GlossFieldValueSchema.safeParse(value);
-		const reason = checkValue(field, value) ?? (parsed.success ? void 0 : "invalid");
-		if (reason || !parsed.success) {
-			rejected.push({
-				name,
-				reason: reason ?? "invalid"
-			});
-			continue;
-		}
-		values[name] = normaliseValue(field, parsed.data);
-	}
+function freeTextBox(a) {
+	const { rect, fringe } = a;
+	if (!fringe) return rect;
 	return {
-		values,
-		rejected
+		x: rect.x + fringe.left,
+		y: rect.y + fringe.bottom,
+		width: Math.max(0, rect.width - fringe.left - fringe.right),
+		height: Math.max(0, rect.height - fringe.top - fringe.bottom)
 	};
 }
-//#endregion
-//#region src/model/form/submit.ts
 /**
-* The values a submit sends: every field with a value that is not no-export, limited to
-* `names` (or everything but them, when `include` is false). A name covers the fields under it.
-* An empty list means every field.
+* True for a free-text callout drawn the standard way: a box with a leader line through
+* `callout`. A callout with `cornerRadius` is Inkbar's speech bubble instead.
 */
-function submitValues(values, fields, names, include) {
-	const all = fieldsToGloss(values, fields);
-	if (names.length === 0) return Object.freeze(all);
-	const listed = (name) => names.some((n) => name === n || name.startsWith(`${n}.`));
-	const out = {};
-	for (const [name, value] of Object.entries(all)) if (listed(name) === include) out[name] = value;
-	return Object.freeze(out);
+function isStandardCallout(a) {
+	return a.type === "freetext" && a.intent === "FreeTextCallout" && a.callout !== void 0 && a.callout.length >= 2 && a.cornerRadius === void 0;
 }
-//#endregion
-//#region src/model/form/url.ts
-/** The schemes a form may hand the host, as PDF.js allows for `/URI`. */
-const SAFE = /* @__PURE__ */ new Set([
-	"http:",
-	"https:",
-	"mailto:",
-	"tel:"
-]);
 /**
-* `url` when it is absolute and uses http, https, mailto or tel; otherwise `undefined`, so a
-* `javascript:`, `data:`, `file:` or relative URL from a PDF never reaches the host.
+* The leader line's stroke: the border colour, else the text colour, and the border width, with
+* 1 pt when the box has no border.
 */
-function safeUrl(url) {
-	try {
-		return SAFE.has(new URL(url).protocol) ? url : void 0;
-	} catch {
-		return;
-	}
+function calloutStroke(a) {
+	return {
+		color: a.borderColor ?? a.defaultStyle.color,
+		width: a.width > 0 ? a.width : 1
+	};
 }
 /**
-* A mail address, kept unless it reads as a URL with another scheme (a script passing
-* `javascript:…` as a recipient). A `mailto:` or `tel:` prefix is kept as it was given, not
-* stripped, so the host may see `mailto:a@example.com` as a recipient.
+* The `rect` and `fringe` that hold the text box `box` and a leader line through `callout`
+* stroked `width` points wide: every point is padded by half the stroke, and by the ending's
+* size as well when `head` is one Inkbar draws.
 */
-function safeAddress(address) {
-	try {
-		return SAFE.has(new URL(address).protocol) ? address : void 0;
-	} catch {
-		return address;
-	}
+function withCalloutBounds(box, callout, width, head) {
+	const drawn = head !== void 0 && head !== "None" && isKnown(LINE_ENDINGS, head);
+	const pad = width / 2 + (drawn ? ENDING_SCALE * Math.max(width, 1) : 0);
+	const xs = [
+		box.x,
+		box.x + box.width,
+		...callout.map((p) => p.x)
+	];
+	const ys = [
+		box.y,
+		box.y + box.height,
+		...callout.map((p) => p.y)
+	];
+	const left = Math.min(...xs) - pad;
+	const bottom = Math.min(...ys) - pad;
+	const right = Math.max(...xs) + pad;
+	const top = Math.max(...ys) + pad;
+	return {
+		rect: {
+			x: left,
+			y: bottom,
+			width: right - left,
+			height: top - bottom
+		},
+		fringe: {
+			left: box.x - left,
+			top: top - (box.y + box.height),
+			right: right - (box.x + box.width),
+			bottom: box.y - bottom
+		}
+	};
 }
 //#endregion
-//#region src/pdfjs/sandbox-patch.ts
+//#region src/model/annotations/types.ts
+const PointSchema = z.object(Point.shape);
+const RectSchema = z.object(Rect.shape);
+const QuadSchema = z.object({
+	p1: PointSchema,
+	p2: PointSchema,
+	p3: PointSchema,
+	p4: PointSchema
+});
+/** What Inkbar adds to every Gloss type: the fields it always fills in, and its viewer state. */
+const Base = {
+	/** Bounding box in PDF user space. */
+	rect: RectSchema,
+	/** Resolved #RRGGBB. Written into the PDF later, so it is always concrete. */
+	color: Color,
+	opacity: commonFields.opacity.removeDefault(),
+	createdAt: commonFields.createdAt.unwrap(),
+	modifiedAt: commonFields.modifiedAt.unwrap(),
+	/** Created in this session, or imported from the file. Viewer state, never exported. */
+	source: z.enum(["session", "pdf"]),
+	/** Embedded annotations are locked until the engine can rewrite the file. Viewer state, never exported. */
+	locked: z.boolean().optional(),
+	/**
+	* Embedded annotations only: whether the file carries its own appearance stream for it. PDF.js
+	* paints the page with it; without one, it paints a stand-in for most types but nothing for a
+	* note. Viewer state, never exported.
+	*/
+	hasAppearance: z.boolean().optional()
+};
+const Quads = z.array(QuadSchema).min(1);
+const TextMarkupSchema = z.object({
+	...Highlight.shape,
+	...Base,
+	type: z.enum([
+		"highlight",
+		"underline",
+		"strikeout",
+		"squiggly"
+	]),
+	quads: Quads
+});
+/** A note's icon (XFDF `icon`): a PDF name, so a name Inkbar does not know is kept. */
+const NoteIconSchema = NoteIcon;
+const NoteSchema = z.object({
+	...Note.shape,
+	...Base
+});
+/** A line ending (XFDF `head`/`tail`): a PDF name, so a name Inkbar does not know is kept. */
+const LineEndingSchema = LineEnding;
 /**
-* PDF.js's scripting API defines `submitForm`, `mailDoc`, `mailForm` (on Doc) and `launchURL`
-* (on App) as empty methods, so a script calling them is silent. They cannot be replaced from a
-* script run inside the sandbox: scripts run as global code, where `this` is the global object,
-* and PDF.js copies each Doc method onto it as a bound, non-writable, non-configurable property
-* before any script runs. So the bridge rewrites the four empty bodies in the scripting source
-* before the sandbox evaluates it. Each replacement reports the call through the sandbox's own
-* `send` channel, with a command name only Inkbar uses; the host maps the arguments.
+* A key a type refuses outright rather than dropping like other unknown keys: one an older
+* shape used (so its value is not silently lost), or one that means nothing on the type (so a
+* later version is free to give it a meaning).
 */
-/** The command a rewritten method sends. */
-const ACTION_COMMAND = "inkbar:action";
-const METHODS = [
-	"submitForm",
-	"mailDoc",
-	"mailForm",
-	"launchURL"
-];
-/** The empty method as it appears in PDF.js's scripting source, one class member per line. */
-const stub = (method) => `\n  ${method}() {}\n`;
-const replacement = (method) => `\n  ${method}(...args) { this._send({ command: "${ACTION_COMMAND}", method: "${method}", args }); }\n`;
-/** How many times each empty method appears in `source`. */
-function countStubs(source) {
-	const counts = {};
-	for (const m of METHODS) counts[m] = source.split(stub(m)).length - 1;
-	return counts;
-}
+const Refused = z.never().optional();
 /**
-* Rewrites the four empty methods. Throws when any of them does not appear exactly once, which
-* means the PDF.js build differs from the one this was written against.
+* A free-text box's text style, keyed by the CSS property names XFDF writes in its
+* `defaultstyle` string. The older `align` is refused; other unknown keys are dropped.
 */
-function patchScriptingSource(source) {
-	const counts = countStubs(source);
-	const off = METHODS.filter((m) => counts[m] !== 1);
-	if (off.length > 0) throw new Error(`The PDF.js scripting source does not match: ${off.join(", ")}`);
-	return METHODS.reduce((src, m) => src.replace(stub(m), () => replacement(m)), source);
-}
+const FreeTextStyleSchema = z.object({
+	...FreeTextStyle.shape,
+	/** The text colour. */
+	color: Color,
+	align: Refused
+});
 /**
-* Wraps the engine's string copy so the first string it receives, the scripting source that
-* `Sandbox.create` hands it, is patched. A mismatch throws inside `create`, which then fails to
-* start the sandbox; `failure()` gives the reason.
+* Free text, as XFDF has it: `color` is the box's fill and the text style lives in
+* `defaultStyle`. A box in the older shape (top-level `fontFamily`, `fontSize`, `align`) is
+* refused rather than silently losing its style; other unknown keys are dropped.
 */
-function patchSandboxSource(module) {
-	const original = module.stringToNewUTF8.bind(module);
-	let done = false;
-	let failure;
-	module.stringToNewUTF8 = (source) => {
-		if (done) return original(source);
-		done = true;
-		try {
-			return original(patchScriptingSource(source));
-		} catch (e) {
-			failure = e instanceof Error ? e : new Error(String(e));
-			throw failure;
-		}
-	};
-	return { failure: () => failure };
+const FreeTextSchema = z.object({
+	...FreeText.shape,
+	...Base,
+	/** The box's fill (XFDF `color`). Absent means no fill. */
+	color: FreeText.shape.color,
+	/** The box's border colour. Absent means the text colour. */
+	borderColor: Color.optional(),
+	defaultStyle: FreeTextStyleSchema,
+	fringe: FringeSchema.optional(),
+	callout: z.array(PointSchema).min(2).max(3).optional(),
+	fontFamily: Refused,
+	fontSize: Refused,
+	align: Refused
+});
+const SquareSchema = z.object({
+	...Square.shape,
+	...Base
+});
+const CircleSchema = z.object({
+	...Circle.shape,
+	...Base,
+	cornerRadius: Refused
+});
+const ShapeSchema = z.discriminatedUnion("type", [SquareSchema, CircleSchema]);
+const LineSchema = z.object({
+	...Line.shape,
+	...Base,
+	start: PointSchema,
+	end: PointSchema
+});
+const Vertices = z.array(PointSchema).min(2);
+const PolylineSchema = z.object({
+	...Polyline.shape,
+	...Base,
+	vertices: Vertices
+});
+const PolygonSchema = z.object({
+	...Polygon.shape,
+	...Base,
+	vertices: Vertices,
+	head: Refused,
+	tail: Refused
+});
+const PolySchema = z.discriminatedUnion("type", [PolylineSchema, PolygonSchema]);
+const InkShape = z.object({
+	...Ink.shape,
+	...Base,
+	inklist: z.array(z.array(PointSchema).min(1)).min(1),
+	/** Pen pressure from 0 to 1, one value per point of each stroke. Absent means even pressure. */
+	pressure: z.array(z.array(z.number().min(0).max(1))).optional()
+});
+/** Pressure must have one value per point of each stroke. */
+function checkPressure(a, ctx) {
+	if (!a.pressure) return;
+	if (!(a.pressure.length === a.inklist.length && a.pressure.every((p, i) => p.length === a.inklist[i]?.length))) ctx.addIssue({
+		code: "custom",
+		path: ["pressure"],
+		message: "pressure must have the same shape as inklist"
+	});
 }
-//#endregion
-//#region src/pdfjs/scripting.ts
-/** Where the sandbox module comes from. An object, so tests can see whether it was loaded. */
-const sandboxLoader = { load: () => import("#pdfjs-sandbox") };
+const InkSchema = InkShape.superRefine(checkPressure);
 /**
-* Runs the document's JavaScript in PDF.js's QuickJS sandbox, wired to `form`. Resolves
-* `undefined` without loading the sandbox when the document has no JavaScript. A sandbox that
-* fails to load or start is reported as a `FormScriptError` on `form`, and resolves `undefined`,
-* so the form stays fillable without scripts.
-*
-* The sandbox gets its own `window`: alerts go to `form`'s `alert` event, `app.response` returns
-* `null` and asks the host with a `prompt` action, and timers are tracked and cleared on destroy.
-* Nothing reaches the page's `window.alert`, `prompt` or `confirm`, and nothing is fetched.
+* An image on the page (XFDF `stamp`), drawn to fill `rect`. Image and typed signatures are
+* stamps with `subject: 'Signature'`.
 */
-async function createFormScripting(opts) {
-	const { proxy, assets, form } = opts;
-	if (typeof window === "undefined") return void 0;
-	if (!await proxy.hasJSActions()) return void 0;
-	const [objects, calculationOrder, actions] = await Promise.all([
-		proxy.getFieldObjects(),
-		proxy.getCalculationOrderIds(),
-		proxy.getJSActions()
-	]);
-	if (![...objects?.values() ?? []].some((list) => list.some((o) => hasEntries(o.actions))) && !hasEntries(actions)) return void 0;
-	const fields = form.fields.get();
-	const byName = new Map(fields.map((f) => [f.name, f]));
-	const byWidget = new Map(fields.flatMap((f) => f.widgets.map((w) => [w.id, f])));
-	const widgets = new Map(fields.flatMap((f) => f.widgets.map((w) => [w.id, w])));
-	/** Fields PDF.js reads as a date or time, from their standard format scripts. */
-	const dates = new Set([...objects?.entries() ?? []].filter(([, list]) => list.some((o) => o.hasDatetimeHTML === true)).map(([name]) => name));
-	/** What the sandbox holds, by field name, in the form's terms. */
-	const mirror = /* @__PURE__ */ new Map();
-	for (const f of fields) if (f.value !== void 0) mirror.set(f.name, f.value);
-	let dead = false;
-	/** Updates sent during a synchronous dispatch, applied together once it returns. */
-	let buffer;
-	const report = (cause) => {
-		if (dead) return;
-		const message = cause instanceof Error ? cause.message : String(cause);
-		form._error(new InkError("FormScriptError", message, {}, cause));
-	};
-	const onSend = (detail) => {
-		if (dead || typeof detail !== "object" || detail === null) return;
-		if (buffer) buffer.push(detail);
-		else apply([detail], { values: true });
-	};
-	const win = createWindow(form, onSend, report, () => dead);
-	let sandbox;
-	try {
-		sandbox = await withTimeout(sandboxLoader.load().then(({ QuickJSSandbox }) => QuickJSSandbox(assets.wasm)), SANDBOX_TIMEOUT_MS);
-		const support = sandbox.support;
-		const engine = sandbox._module;
-		if (!support || !engine) throw new Error("The PDF.js sandbox has no engine");
-		support.win = win.shim;
-		const patch = patchSandboxSource(engine);
-		try {
-			sandbox.create({
-				objects,
-				calculationOrder,
-				appInfo: {
-					platform: navigator.platform,
-					language: navigator.language
-				},
-				docInfo: {
-					Title: opts.info.title ?? "",
-					Author: opts.info.author ?? "",
-					numPages: opts.info.pageCount,
-					URL: "",
-					baseURL: "",
-					actions
-				}
-			});
-		} catch (cause) {
-			win.clear();
-			throw patch.failure() ?? cause;
-		}
-	} catch (cause) {
-		dead = true;
-		try {
-			sandbox?.nukeSandbox();
-		} catch {}
-		form._error(new InkError("FormScriptError", "The form's scripts could not start; it can still be filled in", {}, cause));
-		return;
-	}
-	/** Page events run one after another. */
-	let pages = Promise.resolve();
-	/** Pages whose actions the sandbox already has. */
-	const visited = /* @__PURE__ */ new Set();
-	/** Dispatches `event` and returns what the scripts sent while it ran. */
-	const run = (event) => {
-		const outer = buffer;
-		const got = [];
-		buffer = got;
-		try {
-			sandbox.dispatchEvent(event);
-		} catch (cause) {
-			report(cause);
-		} finally {
-			buffer = outer;
-		}
-		return got;
-	};
-	const fieldOf = (id) => typeof id === "string" ? byWidget.get(id) : void 0;
-	const ownOf = (u, field) => fieldOf(u.id) === field;
-	/**
-	* Applies updates. `values: false` keeps the sandbox's values out of the form (an undo
-	* replaying a state calculate already produced). The `source` field's own updates are
-	* skipped when its commit was rejected, and its value always, since the form writes it.
-	*/
-	function apply(updates, o) {
-		const next = {};
-		for (const u of updates) {
-			if (dead) return;
-			if (u.id === void 0 || u.id === null) {
-				command(u);
-				continue;
-			}
-			const field = fieldOf(u.id);
-			if (!field) continue;
-			const own = o.source?.field === field;
-			if (own && !o.source?.accepted) continue;
-			if ("value" in u) {
-				const raw = dates.has(field.name) && typeof u.value === "number" ? u.formattedValue : u.value;
-				const value = raw === u.value || typeof raw === "string" ? fromSandbox(field, u.id, raw) : void 0;
-				if (value !== void 0) {
-					mirror.set(field.name, value);
-					if (o.values && !own) next[field.name] = value;
-				}
-			}
-			if ("formattedValue" in u) form._setFormatted(field.name, typeof u.formattedValue === "string" ? u.formattedValue : void 0);
-			const override = overrideOf(u);
-			if (override) {
-				const siblings = Array.isArray(u.siblings) ? u.siblings : [];
-				for (const id of [u.id, ...siblings]) if (typeof id === "string" && widgets.has(id)) form._setWidgetState(id, override);
-			}
-			if (u.focus === true) form._focus(u.id);
-		}
-		if (Object.keys(next).length > 0) form._scriptValues(next);
-	}
-	function command(u) {
-		switch (u.command) {
-			case "print":
-				form._emitAction({ kind: "print" });
-				break;
-			case ACTION_COMMAND: {
-				const action = scriptAction$1(u.method, u.args, form);
-				if (action) form._emitAction(action);
-				break;
-			}
-			case "error": report(new Error(typeof u.value === "string" ? u.value : "A form script failed"));
-		}
-	}
-	/**
-	* Commits `value` to `field` in the sandbox: validate, calculate and format run. Returns the
-	* value the sandbox kept, which a script may have changed, or `undefined` when rejected.
-	*/
-	const commitTo = (field, value, values) => {
-		const event = commitEvent(field, value);
-		if (!event) {
-			mirror.set(field.name, value);
-			return value;
-		}
-		const updates = run(event);
-		const accepted = !updates.some((u) => ownOf(u, field) && "selRange" in u);
-		apply(updates, {
-			values,
-			source: {
-				field,
-				accepted
-			}
-		});
-		if (!accepted) return void 0;
-		const echo = updates.filter((u) => ownOf(u, field) && "value" in u).at(-1);
-		const kept = echo ? scriptChange(field, echo) : void 0;
-		const stored = kept !== void 0 && !sameValue$1(kept, value) ? kept : value;
-		mirror.set(field.name, stored);
-		return stored;
-	};
-	/**
-	* The value a script changed a commit to, from the sandbox's echo of it; `undefined` when
-	* the echo is no change. The sandbox reports a text value as the string it was given (it
-	* keeps the original alongside any number it parses), so a different string is a script's
-	* change. A number is the sandbox's own parse: a date or time field reports the time it
-	* read. A checkbox or radio echo names the first widget with the export value, which is
-	* not always the one chosen, so the chosen state stands; a rejection shows as a selection.
-	*/
-	const scriptChange = (field, echo) => {
-		switch (field.type) {
-			case "text":
-			case "combo": return typeof echo.value === "string" ? fromSandbox(field, echo.id, echo.value) : void 0;
-			case "list": return fromSandbox(field, echo.id, echo.value);
-			default: return;
-		}
-	};
-	const scripting = {
-		commit(name, value) {
-			const field = byName.get(name);
-			if (dead || !field) return value;
-			return commitTo(field, value, true);
-		},
-		sync(values, calculate) {
-			if (dead) return;
-			for (const field of fields) {
-				const value = values[field.name];
-				if (value === void 0 || sameValue$1(value, mirror.get(field.name))) continue;
-				commitTo(field, value, calculate);
-				if (dead) return;
-			}
-		},
-		dispatch(event) {
-			const field = byWidget.get(event.widget);
-			const widget = widgets.get(event.widget);
-			if (dead || !field || !widget) return;
-			const value = event.value ?? currentValue(form, field, widget);
-			apply(run(toSandboxEvent(event, value)), { values: true });
-		},
-		keystroke(widget, text, change, selStart, selEnd) {
-			const field = byWidget.get(widget);
-			if (dead || !field) return void 0;
-			const updates = run({
-				id: widget,
-				name: "Keystroke",
-				value: text,
-				change,
-				selStart,
-				selEnd,
-				willCommit: false
-			});
-			mirror.delete(field.name);
-			apply(updates, {
-				values: true,
-				source: {
-					field,
-					accepted: false
-				}
-			});
-			return keystrokeResult(updates, field, text, change, selStart, selEnd);
-		},
-		pageEvent(page, name) {
-			if (dead) return Promise.resolve();
-			pages = pages.then(async () => {
-				let actions = null;
-				if (name === "PageOpen" && !visited.has(page)) {
-					visited.add(page);
-					actions = await (await proxy.getPage(page + 1)).getJSActions();
-				}
-				if (dead) return;
-				apply(run({
-					id: "page",
-					name,
-					pageNumber: page + 1,
-					actions
-				}), { values: true });
-			}).catch(report);
-			return pages;
-		},
-		destroy() {
-			if (dead) return;
-			dead = true;
-			win.clear();
-			try {
-				sandbox.nukeSandbox();
-			} catch {}
-		}
-	};
-	if (opts.testing) scripting._sandboxForTesting = sandbox;
-	apply(run({
-		id: "doc",
-		name: "Open"
-	}), { values: true });
-	scripting.sync(form.values.get(), opts.calculateAtStart === true);
-	return scripting;
-}
-/** A scalar from the sandbox as text; anything else is empty. */
-function textOf(v) {
-	if (typeof v === "string") return v;
-	return typeof v === "number" || typeof v === "boolean" ? String(v) : "";
-}
-/** How long the sandbox may take to load before the form goes on without scripts. */
-const SANDBOX_TIMEOUT_MS = 1e4;
-/**
-* Rejects when `promise` takes longer than `ms`, so a stalled wasm load never holds up the
-* document. A sandbox that arrives late is torn down.
-*/
-function withTimeout(promise, ms) {
-	return new Promise((resolve, reject) => {
-		let late = false;
-		const timer = setTimeout(() => {
-			late = true;
-			reject(/* @__PURE__ */ new Error(`The PDF.js sandbox did not load within ${ms} ms`));
-		}, ms);
-		promise.then((sandbox) => {
-			clearTimeout(timer);
-			if (late) sandbox.nukeSandbox();
-			else resolve(sandbox);
-		}, (cause) => {
-			clearTimeout(timer);
-			reject(cause instanceof Error ? cause : new Error(String(cause)));
-		});
-	});
-}
-function hasEntries(value) {
-	if (value instanceof Map) return value.size > 0;
-	return typeof value === "object" && value !== null && Object.keys(value).length > 0;
-}
-/** The `window` the sandbox sees. */
-function createWindow(form, onSend, report, isDead) {
-	const timers = /* @__PURE__ */ new Map();
-	const clear = (id) => {
-		const kind = timers.get(id);
-		if (!kind) return;
-		timers.delete(id);
-		if (kind === "interval") clearInterval(id);
-		else clearTimeout(id);
-	};
-	const noop = () => void 0;
-	class ShimEvent {
-		type;
-		detail;
-		constructor(type, init) {
-			this.type = type;
-			this.detail = init?.detail;
-		}
-	}
-	return {
-		shim: {
-			alert: (message) => {
-				if (!isDead()) form._alert(message);
-			},
-			confirm: () => false,
-			prompt: (message) => {
-				if (!isDead()) form._emitAction({
-					kind: "prompt",
-					message
-				});
-				return null;
-			},
-			setTimeout: (fn, ms) => {
-				if (isDead()) return 0;
-				const id = setTimeout(() => {
-					timers.delete(id);
-					if (!isDead()) fn();
-				}, ms);
-				timers.set(id, "timeout");
-				return id;
-			},
-			setInterval: (fn, ms) => {
-				if (isDead()) return 0;
-				const id = setInterval(() => {
-					if (!isDead()) fn();
-				}, ms);
-				timers.set(id, "interval");
-				return id;
-			},
-			clearTimeout: clear,
-			clearInterval: clear,
-			console: {
-				log: noop,
-				info: noop,
-				warn: noop,
-				debug: noop,
-				error: report
-			},
-			URL,
-			CustomEvent: ShimEvent,
-			dispatchEvent: (event) => {
-				if (event.type === "updatefromsandbox") onSend(event.detail);
-				return true;
-			}
-		},
-		clear() {
-			for (const id of [...timers.keys()]) clear(id);
-		}
-	};
-}
-/** The event that commits `value` the way a person would, or none for a field without one. */
-function commitEvent(field, value) {
-	const first = field.widgets[0];
-	if (!first) return void 0;
-	switch (field.type) {
-		case "checkbox":
-		case "radio": {
-			const on = field.widgets.find((w) => w.onState !== void 0 && w.onState === value);
-			if (!on && (value !== "Off" || field.type === "radio")) return void 0;
-			return {
-				id: (on ?? first).id,
-				name: "Validate",
-				value: on !== void 0
-			};
-		}
-		case "text":
-		case "combo":
-		case "list": {
-			if (typeof value !== "string" && !Array.isArray(value)) return void 0;
-			const end = typeof value === "string" ? value.length : 0;
-			return {
-				id: first.id,
-				name: "Keystroke",
-				value,
-				change: "",
-				willCommit: true,
-				commitKey: 1,
-				selStart: end,
-				selEnd: end
-			};
-		}
-		default: return;
-	}
-}
-/** The value an event carries when the form layer gives none: what the widget shows. */
-function currentValue(form, field, widget) {
-	const value = form.get(field.name);
-	switch (field.type) {
-		case "checkbox":
-		case "radio": return widget.onState !== void 0 && value === widget.onState;
-		case "text":
-		case "combo":
-		case "list": return typeof value === "string" || Array.isArray(value) ? value : "";
-		default: return;
-	}
+const StampSchema = z.object({
+	...Stamp.shape,
+	...Base
+});
+/**
+* A loupe (Inkbar's own type, a circle with `custom.inkbar.type: 'loupe'` in a file): a circle
+* inscribed in `rect` that shows the page content under its own centre, magnified. `color` and
+* `width` draw its rim.
+*/
+const LoupeSchema = z.object({
+	type: z.literal("loupe"),
+	...commonFields,
+	/** How many times larger the content under the centre is drawn. Above 1. */
+	magnification: z.number().gt(1).default(2),
+	/** The rim's width in points. */
+	width: z.number().nonnegative().default(2),
+	...Base
+});
+/**
+* A mask (Inkbar's own type, a circle or square with `custom.inkbar.type: 'mask'` in a file):
+* dims everything on the page outside `shape` drawn in `rect`, an ellipse inscribed in it or the
+* rectangle itself. `color` is the dimming colour and `dim` how strongly it covers, from 0 to 1.
+* One per page: adding a second replaces the first.
+*/
+const MaskSchema = z.object({
+	type: z.literal("mask"),
+	...commonFields,
+	shape: z.enum(["rect", "ellipse"]),
+	dim: z.number().min(0).max(1).default(.5),
+	...Base
+});
+const RedactSchema = z.object({
+	...Redact.shape,
+	...Base,
+	/** Present when the mark came from text; absent for an area mark. */
+	quads: Quads.optional(),
+	/** Colour the redaction will be filled with when applied. */
+	interiorColor: Color
+});
+const AnnotationSchema = z.discriminatedUnion("type", [
+	TextMarkupSchema,
+	NoteSchema,
+	FreeTextSchema,
+	SquareSchema,
+	CircleSchema,
+	LineSchema,
+	PolylineSchema,
+	PolygonSchema,
+	InkSchema,
+	StampSchema,
+	LoupeSchema,
+	MaskSchema,
+	RedactSchema
+]);
+/** The viewer's own state on an annotation, left out of exports. */
+const VIEWER_STATE = {
+	source: true,
+	locked: true,
+	hasAppearance: true
+};
+/** One exported annotation: the stored annotation without its viewer state. */
+const ExportedAnnotationSchema = z.discriminatedUnion("type", [
+	TextMarkupSchema.omit(VIEWER_STATE),
+	NoteSchema.omit(VIEWER_STATE),
+	FreeTextSchema.omit(VIEWER_STATE),
+	SquareSchema.omit(VIEWER_STATE),
+	CircleSchema.omit(VIEWER_STATE),
+	LineSchema.omit(VIEWER_STATE),
+	PolylineSchema.omit(VIEWER_STATE),
+	PolygonSchema.omit(VIEWER_STATE),
+	InkShape.omit(VIEWER_STATE).superRefine(checkPressure),
+	StampSchema.omit(VIEWER_STATE),
+	LoupeSchema.omit(VIEWER_STATE),
+	MaskSchema.omit(VIEWER_STATE),
+	RedactSchema.omit(VIEWER_STATE)
+]);
+const AnnotationDocumentSchema = z.object({
+	format: z.literal(GLOSS_FORMAT),
+	version: z.literal(GLOSS_VERSION),
+	documentKey: z.string().optional(),
+	/** Validated item by item on import so unknown types can be preserved. */
+	annotations: z.array(z.unknown()),
+	/** Form field values by full name, validated field by field against the form on import. */
+	fields: z.record(z.string(), z.unknown()).optional()
+});
+//#endregion
+//#region src/model/annotations/embedded.ts
+const SUPPORTED_SUBTYPES = /* @__PURE__ */ new Set([
+	"Highlight",
+	"Underline",
+	"StrikeOut",
+	"Squiggly",
+	"Text",
+	"FreeText",
+	"Square",
+	"Circle",
+	"Line",
+	"Polygon",
+	"PolyLine",
+	"Ink",
+	"Redact"
+]);
+/** Subtypes the document reads as links rather than annotations. */
+const LINK_SUBTYPES = /* @__PURE__ */ new Set(["Link"]);
+/** An RGB colour in 0–255 as upper-case `#RRGGBB`; `fallback` when it has fewer than three parts. */
+function pdfColorToHex(c, fallback) {
+	if (!c || c.length < 3) return fallback;
+	return `#${[
+		c[0],
+		c[1],
+		c[2]
+	].map((n) => Math.round(n).toString(16).padStart(2, "0")).join("")}`.toUpperCase();
 }
-function toSandboxEvent(event, value) {
-	const out = {
-		id: event.widget,
-		name: event.name
-	};
-	if (value !== void 0) out.value = value;
-	for (const key of [
-		"change",
-		"selStart",
-		"selEnd",
-		"willCommit",
-		"commitKey"
-	]) if (event[key] !== void 0) out[key] = event[key];
-	return out;
+/** PDF.js hands back `rect` already in user space, but not always ordered; normalise with min/max. */
+function rectFromPdf(r) {
+	return rectFromPoints({
+		x: r[0],
+		y: r[1]
+	}, {
+		x: r[2],
+		y: r[3]
+	});
 }
-/** A value from the sandbox in the form's terms; `undefined` for a field without one. */
-function fromSandbox(field, id, value) {
-	switch (field.type) {
-		case "checkbox":
-		case "radio":
-			if (value === "Off" || value === "" || value === null || value === void 0) return "Off";
-			return (field.widgets.find((w) => w.id === id && w.onState !== void 0) ?? field.widgets.find((w) => w.onState === value))?.onState ?? textOf(value);
-		case "list":
-			if (field.flags.multiSelect) return Array.isArray(value) ? value.map(textOf) : value === "" ? [] : [textOf(value)];
-			return Array.isArray(value) ? textOf(value[0]) : textOf(value);
-		case "text":
-		case "combo": return Array.isArray(value) ? textOf(value[0]) : textOf(value);
-		default: return;
-	}
+/** A PDF name exactly as PDF.js gives it (names are case-sensitive), or undefined if invalid. */
+function pdfName(raw) {
+	return raw !== void 0 && PDF_NAME$1.test(raw) ? raw : void 0;
 }
-/** `["RGB", r, g, b]`, `["G", g]`, `["CMYK", c, m, y, k]` or `["T"]` as `#rrggbb`. */
-function colorOf(value) {
-	if (!Array.isArray(value) || typeof value[0] !== "string") return void 0;
-	const [space, ...raw] = value;
-	const n = raw.map((v) => typeof v === "number" ? Math.min(1, Math.max(0, v)) : 0);
-	let rgb;
-	if (space === "T") return "transparent";
-	if (space === "G") rgb = [
-		n[0] ?? 0,
-		n[0] ?? 0,
-		n[0] ?? 0
-	];
-	else if (space === "RGB") rgb = [
-		n[0] ?? 0,
-		n[1] ?? 0,
-		n[2] ?? 0
-	];
-	else if (space === "CMYK") {
-		const k = n[3] ?? 0;
-		rgb = [
-			n[0] ?? 0,
-			n[1] ?? 0,
-			n[2] ?? 0
-		].map((c) => (1 - c) * (1 - k));
-	} else return void 0;
-	return `#${rgb.map((c) => Math.round(c * 255).toString(16).padStart(2, "0")).join("")}`;
+/** `head` and `tail` from a Line's or PolyLine's `/LE`, left out when both are `None`. */
+function lineEndingsOf(raw) {
+	const endings = raw?.map((e) => pdfName(e) ?? "None");
+	return endings && endings.length === 2 && endings.some((e) => e !== "None") ? {
+		head: endings[0],
+		tail: endings[1]
+	} : {};
 }
-function overrideOf(u) {
-	const o = {};
-	if (typeof u.hidden === "boolean") o.hidden = u.hidden;
-	if (typeof u.display === "number") o.hidden = u.display % 2 === 1;
-	if (typeof u.readonly === "boolean") o.readOnly = u.readonly;
-	if (typeof u.required === "boolean") o.required = u.required;
-	const text = colorOf(u.textColor ?? u.fgColor);
-	const fill = colorOf(u.fillColor ?? u.bgColor);
-	const stroke = colorOf(u.strokeColor ?? u.borderColor);
-	if (text) o.textColor = text;
-	if (fill) o.fillColor = fill;
-	if (stroke) o.strokeColor = stroke;
-	if (typeof u.textSize === "number" && Number.isFinite(u.textSize) && u.textSize >= 0) o.textSize = u.textSize;
-	return Object.keys(o).length > 0 ? o : void 0;
+/**
+* Imported ids are `pdf:<page>:<pdfjsId>` (page is 0-based, pdfjsId is the annotation's object
+* reference such as `12R`). They are stable across opens of the same file, and `inReplyTo`
+* uses the same scheme so threads resolve.
+*/
+function importedId(page, pdfjsId) {
+	return `pdf:${page}:${pdfjsId}`;
 }
-function keystrokeResult(updates, field, text, change, selStart, selEnd) {
-	const merged = text.slice(0, selStart) + change + text.slice(selEnd);
-	const caret = selStart + change.length;
-	const last = updates.filter((u) => {
-		const id = typeof u.id === "string" ? u.id : void 0;
-		return id !== void 0 && field.widgets.some((w) => w.id === id) && "value" in u;
-	}).at(-1);
-	if (!last) return {
-		accepted: true,
-		value: merged,
-		selStart: caret,
-		selEnd: caret
-	};
-	const value = textOf(last.value);
-	const accepted = !(value === text && merged !== text);
-	const range = Array.isArray(last.selRange) ? last.selRange : [];
-	const start = typeof range[0] === "number" ? range[0] : caret;
-	const end = typeof range[1] === "number" ? range[1] : start;
-	return accepted ? {
-		accepted,
-		value,
-		selStart: start,
-		selEnd: end
-	} : {
-		accepted,
-		value: text,
-		selStart,
-		selEnd
+/**
+* Imports one page's PDF.js annotation data. `targets` is @internal: the annotations whose
+* missing fields the document reads from the file after `ready`.
+*/
+function importEmbeddedPage(page, raw, importedAt) {
+	const counts = {};
+	const annotations = [];
+	const targets = [];
+	for (const data of raw) {
+		counts[data.subtype] = (counts[data.subtype] ?? 0) + 1;
+		if (!SUPPORTED_SUBTYPES.has(data.subtype) || data.hidden || data.noView) continue;
+		const converted = convert(page, data, importedAt);
+		if (!converted) continue;
+		annotations.push(converted);
+		const target = targetOf$1(converted.id, data);
+		if (target) targets.push(target);
+	}
+	return {
+		annotations,
+		counts,
+		targets
 	};
 }
-/** Maps a rewritten method's call (positional or Acrobat's single-object form) to an action. */
-function scriptAction$1(method, args, form) {
-	const list = Array.isArray(args) ? args : [];
-	const first = list[0];
-	const named = typeof first === "object" && first !== null && !Array.isArray(first) ? first : void 0;
-	const arg = (key, index) => named ? named[key] : list[index];
-	const str = (key, index) => {
-		const v = arg(key, index);
-		return typeof v === "string" ? v : void 0;
+function targetOf$1(id, d) {
+	const rect = Array.from(d.rect);
+	if (d.subtype === "Text") return d.name === "NoIcon" ? {
+		id,
+		subtype: "Text",
+		rect
+	} : void 0;
+	if (d.subtype !== "FreeText") return void 0;
+	const daFont = d.defaultAppearanceData?.fontName;
+	return {
+		id,
+		subtype: "FreeText",
+		rect,
+		...daFont ? { daFont } : {}
 	};
-	switch (method) {
-		case "submitForm": {
-			const url = safeUrl(str("cURL", 0) ?? "");
-			if (!url) return void 0;
-			const format = submitFormat(str("cSubmitAs", 15), arg("bPDF", 8), arg("bXML", 6), arg("bFDF", 1));
-			const raw = arg("aFields", 3);
-			const names = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).filter((n) => typeof n === "string");
-			return {
-				kind: "submit",
-				url,
-				fields: submitValues(form.values.get(), form.fields.get(), names, true),
-				format,
-				...format === "html" ? { method: arg("bGet", 4) === true ? "GET" : "POST" } : {}
+}
+function summarise(perPage) {
+	const totals = /* @__PURE__ */ new Map();
+	for (const counts of perPage) for (const [k, v] of Object.entries(counts)) totals.set(k, (totals.get(k) ?? 0) + v);
+	return [...totals.entries()].map(([subtype, count]) => ({
+		subtype,
+		count,
+		supported: SUPPORTED_SUBTYPES.has(subtype) || LINK_SUBTYPES.has(subtype)
+	})).sort((a, b) => a.subtype < b.subtype ? -1 : a.subtype > b.subtype ? 1 : 0);
+}
+function convert(page, d, importedAt) {
+	const created = parsePdfDate(d.creationDate, parsePdfDate(d.modificationDate, importedAt));
+	const author = d.titleObj?.str;
+	const contents = d.contentsObj?.str;
+	const stroke = d.borderStyle?.width ?? 1;
+	const quads = d.quadPoints ? quadsFromFlat(d.quadPoints) : [];
+	const optional = (v) => v !== void 0 && v !== "";
+	const withColor = (type, source = d.color) => pdfColorToHex(source, staticDefaults.color(type));
+	const intent = pdfName(d.it);
+	const base = (type, color = withColor(type)) => ({
+		id: importedId(page, d.id),
+		page,
+		rect: rectFromPdf(d.rect),
+		color,
+		opacity: d.opacity ?? 1,
+		...optional(author) ? { author } : {},
+		...optional(contents) ? { contents } : {},
+		...d.inReplyTo ? { inReplyTo: importedId(page, d.inReplyTo) } : {},
+		...intent !== void 0 ? { intent } : {},
+		createdAt: created,
+		modifiedAt: parsePdfDate(d.modificationDate, created),
+		source: "pdf",
+		locked: true,
+		hasAppearance: d.hasAppearance === true
+	});
+	const fillOf = (c) => c && c.length >= 3 ? { interiorColor: pdfColorToHex(c, "#FFFFFF") } : {};
+	let candidate;
+	switch (d.subtype) {
+		case "Highlight":
+		case "Underline":
+		case "StrikeOut":
+		case "Squiggly": {
+			if (quads.length === 0) return void 0;
+			const type = d.subtype === "StrikeOut" ? "strikeout" : d.subtype.toLowerCase();
+			candidate = {
+				...base(type),
+				type,
+				quads
 			};
+			break;
 		}
-		case "mailDoc":
-		case "mailForm": {
-			const out = {
-				kind: "mail",
-				withData: method === "mailForm"
+		case "Text": {
+			const icon = d.name === "NoIcon" ? void 0 : pdfName(d.name);
+			candidate = {
+				...base("text"),
+				type: "text",
+				...icon !== void 0 ? { icon } : {}
 			};
-			const to = str("cTo", 1);
-			const cc = str("cCc", 2);
-			const bcc = str("cBcc", 3);
-			const subject = str("cSubject", 4);
-			const body = str("cMsg", 5);
-			for (const address of [
-				to,
-				cc,
-				bcc
-			]) if (address !== void 0 && safeAddress(address) === void 0) return void 0;
-			if (to !== void 0) out.to = to;
-			if (cc !== void 0) out.cc = cc;
-			if (bcc !== void 0) out.bcc = bcc;
-			if (subject !== void 0) out.subject = subject;
-			if (body !== void 0) out.body = body;
-			return out;
+			break;
 		}
-		case "launchURL": {
-			const url = safeUrl(str("cURL", 0) ?? "");
-			return url ? {
-				kind: "open-url",
-				url,
-				newWindow: arg("bNewFrame", 1) === true
-			} : void 0;
+		case "FreeText": {
+			const da = d.defaultAppearanceData;
+			const { color: _stroke, ...rest } = base("freetext");
+			candidate = {
+				...rest,
+				...d.color && d.color.length >= 3 ? { color: pdfColorToHex(d.color, "#FFFFFF") } : {},
+				type: "freetext",
+				contents: contents ?? "",
+				width: d.borderStyle?.width ?? 0,
+				defaultStyle: {
+					color: pdfColorToHex(da?.fontColor, staticDefaults.color("freetext")),
+					...da && da.fontSize > 0 ? { fontSize: da.fontSize } : {}
+				}
+			};
+			break;
+		}
+		case "Square":
+		case "Circle": {
+			const type = d.subtype.toLowerCase();
+			candidate = {
+				...base(type),
+				type,
+				width: stroke,
+				...fillOf(d.interiorColor)
+			};
+			break;
+		}
+		case "Line": {
+			const l = d.lineCoordinates ?? [
+				d.rect[0],
+				d.rect[1],
+				d.rect[2],
+				d.rect[3]
+			];
+			candidate = {
+				...base("line"),
+				type: "line",
+				start: {
+					x: l[0],
+					y: l[1]
+				},
+				end: {
+					x: l[2],
+					y: l[3]
+				},
+				width: stroke,
+				...lineEndingsOf(d.lineEndings)
+			};
+			break;
+		}
+		case "Polygon":
+		case "PolyLine": {
+			const type = d.subtype === "Polygon" ? "polygon" : "polyline";
+			const vertices = d.vertices ? pointsFromFlat(d.vertices) : [];
+			if (vertices.length < 2) return void 0;
+			candidate = {
+				...base(type),
+				type,
+				vertices,
+				width: stroke,
+				...fillOf(d.interiorColor),
+				...type === "polyline" ? lineEndingsOf(d.lineEndings) : {}
+			};
+			break;
+		}
+		case "Ink": {
+			const inklist = (d.inkLists ?? []).map((p) => pointsFromFlat(p)).filter((p) => p.length > 0);
+			if (inklist.length === 0) return void 0;
+			candidate = {
+				...base("ink"),
+				type: "ink",
+				inklist,
+				width: stroke
+			};
+			break;
 		}
+		case "Redact":
+			candidate = {
+				...base("redact"),
+				type: "redact",
+				interiorColor: pdfColorToHex(d.interiorColor, staticDefaults.fill()),
+				...quads.length > 0 ? { quads } : {}
+			};
+			break;
 		default: return;
 	}
+	const parsed = AnnotationSchema.safeParse(candidate);
+	return parsed.success ? parsed.data : void 0;
 }
-/** `cSubmitAs` wins, then `bPDF`, then `bXML`; otherwise FDF, or HTML when `bFDF` is false. */
-function submitFormat(submitAs, pdf, xml, fdf) {
-	switch (submitAs?.toUpperCase()) {
-		case "FDF": return "fdf";
-		case "XFDF":
-		case "XFD":
-		case "XML": return "xfdf";
-		case "HTML": return "html";
-		case "PDF": return "pdf";
-	}
-	if (pdf === true) return "pdf";
-	if (xml === true) return "xfdf";
-	return fdf === false ? "html" : "fdf";
+//#endregion
+//#region src/model/destination.ts
+const NAMED_ACTIONS = [
+	"NextPage",
+	"PrevPage",
+	"FirstPage",
+	"LastPage"
+];
+/** Whether `s` is one of the four page-navigation actions Inkbar follows. */
+function isNamedAction(s) {
+	return typeof s === "string" && NAMED_ACTIONS.includes(s);
+}
+//#endregion
+//#region src/model/form/url.ts
+/** The schemes a form may hand the host, as PDF.js allows for `/URI`. */
+const SAFE = /* @__PURE__ */ new Set([
+	"http:",
+	"https:",
+	"mailto:",
+	"tel:"
+]);
+/**
+* `url` when it is absolute and uses http, https, mailto or tel; otherwise `undefined`, so a
+* `javascript:`, `data:`, `file:` or relative URL from a PDF never reaches the host.
+*/
+function safeUrl(url) {
+	try {
+		return SAFE.has(new URL(url).protocol) ? url : void 0;
+	} catch {
+		return;
+	}
 }
-//#endregion
-//#region src/pdfjs/structure.ts
-/** The prefix PDF.js gives an annotation's id in its structure tree. */
-const ANNOTATION_PREFIX = "pdfjs_internal_id_";
 /**
-* The page's annotations in structure order, by PDF.js annotation id (`12R`): the order of the
-* OBJR references in the page's part of the structure tree, depth first. Empty when the file has
-* no structure tree or PDF.js cannot read it.
+* A mail address, kept unless it reads as a URL with another scheme (a script passing
+* `javascript:…` as a recipient). A `mailto:` or `tel:` prefix is kept as it was given, not
+* stripped, so the host may see `mailto:a@example.com` as a recipient.
 */
-async function structureAnnotationOrder(page) {
-	let root;
+function safeAddress(address) {
 	try {
-		root = await page.getStructTree();
+		return SAFE.has(new URL(address).protocol) ? address : void 0;
 	} catch {
-		return [];
+		return address;
 	}
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node, depth) => {
-		if (depth > 64 || typeof node !== "object" || node === null) return;
-		const n = node;
-		if (n.type === "annotation" && typeof n.id === "string") {
-			const id = n.id.startsWith(ANNOTATION_PREFIX) ? n.id.slice(18) : n.id;
-			if (!seen.has(id)) {
-				seen.add(id);
-				out.push(id);
-			}
-		}
-		if (Array.isArray(n.children)) for (const kid of n.children) walk(kid, depth + 1);
-	};
-	walk(root, 0);
-	return out;
 }
 //#endregion
-//#region src/model/annotations/defaults.ts
-const COLORS = {
-	highlight: "#F2C230",
-	underline: "#2B5A9E",
-	strikeout: "#C0392B",
-	squiggly: "#1F7A4D",
-	text: "#F2C230",
-	freetext: "#151820",
-	square: "#C0392B",
-	circle: "#C0392B",
-	line: "#151820",
-	polyline: "#151820",
-	polygon: "#151820",
-	ink: "#151820",
-	stamp: "#151820",
-	loupe: "#151820",
-	mask: "#000000",
-	redact: "#C0392B"
-};
-const staticDefaults = {
-	color: (type) => COLORS[type],
-	fill: () => "#000000",
-	opacity: (type) => type === "highlight" ? .4 : 1
-};
-const VARIABLES = {
-	highlight: "--ink-highlight",
-	underline: "--ink-underline",
-	strikeout: "--ink-strikeout",
-	squiggly: "--ink-squiggly",
-	text: "--ink-note",
-	freetext: "--ink-free-text",
-	square: "--ink-shape",
-	circle: "--ink-shape",
-	line: "--ink-shape",
-	polyline: "--ink-shape",
-	polygon: "--ink-shape",
-	ink: "--ink-ink",
-	stamp: "--ink-ink",
-	loupe: "--ink-shape",
-	mask: "--ink-mask",
-	redact: "--ink-redact"
-};
-/** Resolves default colours from CSS custom properties on `el`, falling back to `staticDefaults`. */
-function cssVariableDefaults(el) {
-	const read = (name) => {
-		const view = el.ownerDocument.defaultView;
-		if (!view) return void 0;
-		return normalizeColor(view.getComputedStyle(el).getPropertyValue(name));
+//#region src/model/links.ts
+/** A URL with a scheme of its own, as opposed to a file name or relative path. */
+const HAS_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+/**
+* Why PDF.js's `unsafeUrl` was not passed on. PDF.js reads a GoToR's file and destination into
+* `file#dest`, and a Launch's file as a bare name, so those two are told apart by the `#`; a
+* scheme `safeUrl` refuses (`javascript:`, `file:`, `data:`) is unsafe whatever follows it.
+*/
+function unsafeReason(unsafeUrl) {
+	if (HAS_SCHEME.test(unsafeUrl)) return "unsafe-url";
+	return unsafeUrl.includes("#") ? "remote" : "launch";
+}
+/**
+* Where a link or outline item goes, from what PDF.js read of its `/Dest` or `/A`. A
+* destination stays raw (`dest`); a URL is passed only through `safeUrl`.
+*/
+function targetOf(data) {
+	if (data.dest !== void 0 && data.dest !== null) return {
+		kind: "dest",
+		raw: data.dest
+	};
+	if (isNamedAction(data.action)) return {
+		kind: "named",
+		action: data.action
+	};
+	if (data.url) {
+		const url = safeUrl(data.url);
+		if (url) return {
+			kind: "url",
+			url,
+			newWindow: !!data.newWindow
+		};
+	}
+	if (data.unsafeUrl) return safeUrl(data.unsafeUrl) ? {
+		kind: "unsupported",
+		reason: "unknown"
+	} : {
+		kind: "unsupported",
+		reason: unsafeReason(data.unsafeUrl)
 	};
 	return {
-		color: (type) => read(VARIABLES[type]) ?? staticDefaults.color(type),
-		fill: () => read("--ink-redact-fill") ?? staticDefaults.fill(),
-		opacity: (type) => staticDefaults.opacity(type)
+		kind: "unsupported",
+		reason: "unknown"
 	};
 }
-/** Accepts `#rgb`, `#rrggbb`, `rgb(r, g, b)` and `rgb(r g b)`; returns `#RRGGBB` or undefined. */
-function normalizeColor(value) {
-	const v = value.trim();
-	const short = /^#([0-9a-f])([0-9a-f])([0-9a-f])$/i.exec(v);
-	if (short) {
-		const [, r = "", g = "", b = ""] = short;
-		return `#${r}${r}${g}${g}${b}${b}`.toUpperCase();
+/**
+* A link annotation read from PDF.js, or `undefined` for anything that is not a visible link.
+* Links are never Gloss annotations: they are read-only structure of the file. `order` is its
+* position in the page's `/Annots`.
+*/
+function linkFromPdfjs(page, data, order) {
+	if (data.subtype !== "Link" || data.hidden || data.noView) return void 0;
+	const quads = data.quadPoints ? quadsFromFlat(data.quadPoints) : [];
+	return {
+		id: importedId(page, data.id),
+		page,
+		rect: rectFromPoints({
+			x: data.rect[0],
+			y: data.rect[1]
+		}, {
+			x: data.rect[2],
+			y: data.rect[3]
+		}),
+		...quads.length > 0 ? { quads } : {},
+		...order === void 0 ? {} : { order },
+		target: targetOf(data)
+	};
+}
+//#endregion
+//#region src/model/map-in-order.ts
+/** Runs `task(0..count-1)` with at most `limit` in flight; results come back in index order. */
+async function mapInOrder(count, limit, task) {
+	const results = new Array(count);
+	let next = 0;
+	const worker = async () => {
+		while (next < count) {
+			const i = next++;
+			results[i] = await task(i);
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, count) }, worker));
+	return results;
+}
+//#endregion
+//#region src/pdfjs/outline.ts
+/** Destinations looked up at once. A long outline names many, each a request to the worker. */
+const CONCURRENCY = 8;
+/**
+* The document's outline, every destination resolved in full: the current item needs each
+* one's position. `[]` when the file has none or PDF.js cannot read it.
+*/
+async function readOutline(proxy) {
+	const roots = await proxy.getOutline().catch(() => null);
+	if (!roots || roots.length === 0) return [];
+	const raws = [];
+	const collect = (nodes) => {
+		for (const node of nodes) {
+			const target = targetOf(node);
+			if (target.kind === "dest") raws.push(target.raw);
+			collect(node.items ?? []);
+		}
+	};
+	collect(roots);
+	const dests = await mapInOrder(raws.length, CONCURRENCY, (i) => resolveDestination(proxy, raws[i]));
+	let next = 0;
+	const build = (nodes, path) => nodes.map((node, i) => {
+		const id = path === "" ? String(i) : `${path}.${i}`;
+		let target = targetOf(node);
+		if (target.kind === "dest") {
+			const dest = dests[next++];
+			target = dest ? {
+				kind: "resolved",
+				dest
+			} : {
+				kind: "unsupported",
+				reason: "unknown"
+			};
+		}
+		return {
+			id,
+			title: String(node.title ?? "").replace(/\s+/g, " ").trim(),
+			target,
+			bold: !!node.bold,
+			italic: !!node.italic,
+			open: (node.count ?? 0) > 0,
+			children: build(node.items ?? [], id)
+		};
+	});
+	return build(roots, "");
+}
+//#endregion
+//#region src/model/form/values.ts
+/**
+* Why `value` cannot be the field's value, or `undefined` when it can. A locked or read-only
+* field is `readOnly`; otherwise the value must suit the type: any text within `maxLength`, an
+* option of a non-editable choice, an array of options for a multi-select list, an on state or
+* `Off` for a checkbox or radio, and `{ signature }` for a signature field. A button has no value.
+*/
+function checkValue(field, value) {
+	if (field.locked || field.flags.readOnly) return "readOnly";
+	return suits(field, value) ? void 0 : "invalid";
+}
+/** Whether `value` suits the field's type, whatever its flags. */
+function suits(field, value) {
+	const isOption = (v) => field.options.some((o) => o.value === v);
+	switch (field.type) {
+		case "text": return typeof value === "string" && (field.maxLength === void 0 || value.length <= field.maxLength);
+		case "combo": return typeof value === "string" && (field.flags.editable || isOption(value));
+		case "list": return field.flags.multiSelect ? Array.isArray(value) && value.every(isOption) : typeof value === "string" && isOption(value);
+		case "checkbox":
+		case "radio": return value === "Off" || typeof value === "string" && (isOption(value) || field.widgets.some((w) => w.onState === value));
+		case "signature": return typeof value === "object" && value !== null && !Array.isArray(value) && typeof value.signature === "string" && value.signature !== "";
+		case "button": return false;
 	}
-	if (/^#[0-9a-f]{6}$/i.test(v)) return v.toUpperCase();
-	const rgb = /^rgba?\(\s*(\d{1,3})[\s,]+(\d{1,3})[\s,]+(\d{1,3})/i.exec(v);
-	if (rgb) return `#${[
-		rgb[1],
-		rgb[2],
-		rgb[3]
-	].map((n) => Math.min(255, Number(n)).toString(16).padStart(2, "0")).join("")}`.toUpperCase();
+}
+/**
+* A checked value as it is stored: frozen, a multi-select's options in option order without
+* repeats, and a signature with only its id.
+*/
+function normaliseValue(field, value) {
+	if (Array.isArray(value)) {
+		const chosen = new Set(value);
+		return Object.freeze(field.options.map((o) => o.value).filter((v) => chosen.has(v) && chosen.delete(v)));
+	}
+	if (typeof value === "object") return Object.freeze({ signature: value.signature });
+	return value;
+}
+/** The value a reset gives: the PDF's default, else empty for the type, else none. */
+function resetValue(field) {
+	if (field.defaultValue !== void 0) return field.defaultValue;
+	switch (field.type) {
+		case "text":
+		case "combo": return "";
+		case "checkbox":
+		case "radio": return "Off";
+		case "list": return field.flags.multiSelect ? Object.freeze([]) : void 0;
+		default: return;
+	}
+}
+function sameValue$1(a, b) {
+	if (a === b) return true;
+	if (a === void 0 || b === void 0) return false;
+	if (Array.isArray(a) || Array.isArray(b)) return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => v === b[i]);
+	return typeof a === "object" && typeof b === "object" && a.signature === b.signature;
 }
 //#endregion
-//#region src/model/pdf-date.ts
-/** Parses a PDF date string (`D:YYYYMMDDHHmmSSOHH'mm'`) into ISO 8601. Returns `fallback` on anything unparseable. */
-function parsePdfDate(value, fallback) {
-	if (!value) return fallback;
-	const m = /^(?:D:)?(\d{4})(\d{2})?(\d{2})?(\d{2})?(\d{2})?(\d{2})?(Z|[+-]\d{2}(?:'\d{2}')?)?/.exec(value.trim());
-	if (!m) return fallback;
-	const [, y, mo = "01", d = "01", h = "00", mi = "00", s = "00", zone] = m;
-	let offsetMinutes = 0;
-	if (zone && zone !== "Z") {
-		const sign = zone.startsWith("-") ? -1 : 1;
-		const zh = Number(zone.slice(1, 3));
-		const zm = Number(zone.slice(4, 6) || 0);
-		offsetMinutes = sign * (zh * 60 + zm);
+//#region src/model/form/gloss.ts
+/** A field value as Gloss writes it: text, the options of a multi-select, or a signature id. */
+const GlossFieldValueSchema = z.union([
+	z.string(),
+	z.array(z.string()),
+	z.looseObject({ signature: z.string().min(1) })
+]);
+z.record(z.string().min(1), GlossFieldValueSchema);
+/**
+* The values to export: every field that has one and is not no-export, in field order, with a
+* multi-select's options in option order.
+*/
+function fieldsToGloss(values, fields) {
+	const out = {};
+	for (const field of fields) {
+		const value = values[field.name];
+		if (value === void 0 || field.flags.noExport) continue;
+		out[field.name] = normaliseValue(field, value);
+	}
+	return out;
+}
+/**
+* The values of a Gloss `fields` map that suit the form, and the names that do not: unknown,
+* read-only (or locked), or invalid for the field. Anything other than a map applies nothing.
+*/
+function fieldsFromGloss(raw, fields) {
+	const values = {};
+	const rejected = [];
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
+		values,
+		rejected
+	};
+	const byName = new Map(fields.map((f) => [f.name, f]));
+	for (const [name, value] of Object.entries(raw)) {
+		const field = byName.get(name);
+		if (!field) {
+			rejected.push({
+				name,
+				reason: "unknown"
+			});
+			continue;
+		}
+		const parsed = GlossFieldValueSchema.safeParse(value);
+		const reason = checkValue(field, value) ?? (parsed.success ? void 0 : "invalid");
+		if (reason || !parsed.success) {
+			rejected.push({
+				name,
+				reason: reason ?? "invalid"
+			});
+			continue;
+		}
+		values[name] = normaliseValue(field, parsed.data);
 	}
-	const utc = Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s)) - offsetMinutes * 6e4;
-	if (Number.isNaN(utc)) return fallback;
-	return new Date(utc).toISOString();
+	return {
+		values,
+		rejected
+	};
 }
 //#endregion
-//#region src/model/annotations/callout.ts
+//#region src/model/form/submit.ts
 /**
-* The insets from a free text's `rect` to its text box, in points (PDF `/RD`, XFDF `fringe`,
-* both in this order).
+* The values a submit sends: every field with a value that is not no-export, limited to
+* `names` (or everything but them, when `include` is false). A name covers the fields under it.
+* An empty list means every field.
 */
-const FringeSchema = z.object(Fringe.shape);
-/** An ending's length, and its full width, as a multiple of the stroke width. */
-const ENDING_SCALE = 3;
+function submitValues(values, fields, names, include) {
+	const all = fieldsToGloss(values, fields);
+	if (names.length === 0) return Object.freeze(all);
+	const listed = (name) => names.some((n) => name === n || name.startsWith(`${n}.`));
+	const out = {};
+	for (const [name, value] of Object.entries(all)) if (listed(name) === include) out[name] = value;
+	return Object.freeze(out);
+}
+//#endregion
+//#region src/pdfjs/sandbox-patch.ts
 /**
-* A free text's text box: `rect` inset by `fringe`, or `rect` itself without one. Insets wider
-* or taller than `rect` leave a box of width or height 0 at the inset origin.
+* PDF.js's scripting API defines `submitForm`, `mailDoc`, `mailForm` (on Doc) and `launchURL`
+* (on App) as empty methods, so a script calling them is silent. They cannot be replaced from a
+* script run inside the sandbox: scripts run as global code, where `this` is the global object,
+* and PDF.js copies each Doc method onto it as a bound, non-writable, non-configurable property
+* before any script runs. So the bridge rewrites the four empty bodies in the scripting source
+* before the sandbox evaluates it. Each replacement reports the call through the sandbox's own
+* `send` channel, with a command name only Inkbar uses; the host maps the arguments.
 */
-function freeTextBox(a) {
-	const { rect, fringe } = a;
-	if (!fringe) return rect;
-	return {
-		x: rect.x + fringe.left,
-		y: rect.y + fringe.bottom,
-		width: Math.max(0, rect.width - fringe.left - fringe.right),
-		height: Math.max(0, rect.height - fringe.top - fringe.bottom)
-	};
+/** The command a rewritten method sends. */
+const ACTION_COMMAND = "inkbar:action";
+const METHODS = [
+	"submitForm",
+	"mailDoc",
+	"mailForm",
+	"launchURL"
+];
+/** The empty method as it appears in PDF.js's scripting source, one class member per line. */
+const stub = (method) => `\n  ${method}() {}\n`;
+const replacement = (method) => `\n  ${method}(...args) { this._send({ command: "${ACTION_COMMAND}", method: "${method}", args }); }\n`;
+/** How many times each empty method appears in `source`. */
+function countStubs(source) {
+	const counts = {};
+	for (const m of METHODS) counts[m] = source.split(stub(m)).length - 1;
+	return counts;
 }
 /**
-* True for a free-text callout drawn the standard way: a box with a leader line through
-* `callout`. A callout with `cornerRadius` is Inkbar's speech bubble instead.
+* Rewrites the four empty methods. Throws when any of them does not appear exactly once, which
+* means the PDF.js build differs from the one this was written against.
 */
-function isStandardCallout(a) {
-	return a.type === "freetext" && a.intent === "FreeTextCallout" && a.callout !== void 0 && a.callout.length >= 2 && a.cornerRadius === void 0;
+function patchScriptingSource(source) {
+	const counts = countStubs(source);
+	const off = METHODS.filter((m) => counts[m] !== 1);
+	if (off.length > 0) throw new Error(`The PDF.js scripting source does not match: ${off.join(", ")}`);
+	return METHODS.reduce((src, m) => src.replace(stub(m), () => replacement(m)), source);
 }
 /**
-* The leader line's stroke: the border colour, else the text colour, and the border width, with
-* 1 pt when the box has no border.
+* Wraps the engine's string copy so the first string it receives, the scripting source that
+* `Sandbox.create` hands it, is patched. A mismatch throws inside `create`, which then fails to
+* start the sandbox; `failure()` gives the reason.
 */
-function calloutStroke(a) {
-	return {
-		color: a.borderColor ?? a.defaultStyle.color,
-		width: a.width > 0 ? a.width : 1
+function patchSandboxSource(module) {
+	const original = module.stringToNewUTF8.bind(module);
+	let done = false;
+	let failure;
+	module.stringToNewUTF8 = (source) => {
+		if (done) return original(source);
+		done = true;
+		try {
+			return original(patchScriptingSource(source));
+		} catch (e) {
+			failure = e instanceof Error ? e : new Error(String(e));
+			throw failure;
+		}
 	};
+	return { failure: () => failure };
 }
+//#endregion
+//#region src/pdfjs/scripting.ts
+/** Where the sandbox module comes from. An object, so tests can see whether it was loaded. */
+const sandboxLoader = { load: () => import("#pdfjs-sandbox") };
 /**
-* The `rect` and `fringe` that hold the text box `box` and a leader line through `callout`
-* stroked `width` points wide: every point is padded by half the stroke, and by the ending's
-* size as well when `head` is one Inkbar draws.
+* Runs the document's JavaScript in PDF.js's QuickJS sandbox, wired to `form`. Resolves
+* `undefined` without loading the sandbox when the document has no JavaScript. A sandbox that
+* fails to load or start is reported as a `FormScriptError` on `form`, and resolves `undefined`,
+* so the form stays fillable without scripts.
+*
+* The sandbox gets its own `window`: alerts go to `form`'s `alert` event, `app.response` returns
+* `null` and asks the host with a `prompt` action, and timers are tracked and cleared on destroy.
+* Nothing reaches the page's `window.alert`, `prompt` or `confirm`, and nothing is fetched.
 */
-function withCalloutBounds(box, callout, width, head) {
-	const drawn = head !== void 0 && head !== "None" && isKnown(LINE_ENDINGS, head);
-	const pad = width / 2 + (drawn ? ENDING_SCALE * Math.max(width, 1) : 0);
-	const xs = [
-		box.x,
-		box.x + box.width,
-		...callout.map((p) => p.x)
-	];
-	const ys = [
-		box.y,
-		box.y + box.height,
-		...callout.map((p) => p.y)
-	];
-	const left = Math.min(...xs) - pad;
-	const bottom = Math.min(...ys) - pad;
-	const right = Math.max(...xs) + pad;
-	const top = Math.max(...ys) + pad;
-	return {
-		rect: {
-			x: left,
-			y: bottom,
-			width: right - left,
-			height: top - bottom
-		},
-		fringe: {
-			left: box.x - left,
-			top: top - (box.y + box.height),
-			right: right - (box.x + box.width),
-			bottom: box.y - bottom
+async function createFormScripting(opts) {
+	const { proxy, assets, form } = opts;
+	if (typeof window === "undefined") return void 0;
+	if (!await proxy.hasJSActions()) return void 0;
+	const [objects, calculationOrder, actions] = await Promise.all([
+		proxy.getFieldObjects(),
+		proxy.getCalculationOrderIds(),
+		proxy.getJSActions()
+	]);
+	if (![...objects?.values() ?? []].some((list) => list.some((o) => hasEntries(o.actions))) && !hasEntries(actions)) return void 0;
+	const fields = form.fields.get();
+	const byName = new Map(fields.map((f) => [f.name, f]));
+	const byWidget = new Map(fields.flatMap((f) => f.widgets.map((w) => [w.id, f])));
+	const widgets = new Map(fields.flatMap((f) => f.widgets.map((w) => [w.id, w])));
+	/** Fields PDF.js reads as a date or time, from their standard format scripts. */
+	const dates = new Set([...objects?.entries() ?? []].filter(([, list]) => list.some((o) => o.hasDatetimeHTML === true)).map(([name]) => name));
+	/** What the sandbox holds, by field name, in the form's terms. */
+	const mirror = /* @__PURE__ */ new Map();
+	for (const f of fields) if (f.value !== void 0) mirror.set(f.name, f.value);
+	let dead = false;
+	/** Updates sent during a synchronous dispatch, applied together once it returns. */
+	let buffer;
+	const report = (cause) => {
+		if (dead) return;
+		const message = cause instanceof Error ? cause.message : String(cause);
+		form._error(new InkError("FormScriptError", message, {}, cause));
+	};
+	const onSend = (detail) => {
+		if (dead || typeof detail !== "object" || detail === null) return;
+		if (buffer) buffer.push(detail);
+		else apply([detail], { values: true });
+	};
+	const win = createWindow(form, onSend, report, () => dead);
+	let sandbox;
+	try {
+		sandbox = await withTimeout(sandboxLoader.load().then(({ QuickJSSandbox }) => QuickJSSandbox(assets.wasm)), SANDBOX_TIMEOUT_MS);
+		const support = sandbox.support;
+		const engine = sandbox._module;
+		if (!support || !engine) throw new Error("The PDF.js sandbox has no engine");
+		support.win = win.shim;
+		const patch = patchSandboxSource(engine);
+		try {
+			sandbox.create({
+				objects,
+				calculationOrder,
+				appInfo: {
+					platform: navigator.platform,
+					language: navigator.language
+				},
+				docInfo: {
+					Title: opts.info.title ?? "",
+					Author: opts.info.author ?? "",
+					numPages: opts.info.pageCount,
+					URL: "",
+					baseURL: "",
+					actions
+				}
+			});
+		} catch (cause) {
+			win.clear();
+			throw patch.failure() ?? cause;
+		}
+	} catch (cause) {
+		dead = true;
+		try {
+			sandbox?.nukeSandbox();
+		} catch {}
+		form._error(new InkError("FormScriptError", "The form's scripts could not start; it can still be filled in", {}, cause));
+		return;
+	}
+	/** Page events run one after another. */
+	let pages = Promise.resolve();
+	/** Pages whose actions the sandbox already has. */
+	const visited = /* @__PURE__ */ new Set();
+	/** Dispatches `event` and returns what the scripts sent while it ran. */
+	const run = (event) => {
+		const outer = buffer;
+		const got = [];
+		buffer = got;
+		try {
+			sandbox.dispatchEvent(event);
+		} catch (cause) {
+			report(cause);
+		} finally {
+			buffer = outer;
+		}
+		return got;
+	};
+	const fieldOf = (id) => typeof id === "string" ? byWidget.get(id) : void 0;
+	const ownOf = (u, field) => fieldOf(u.id) === field;
+	/**
+	* Applies updates. `values: false` keeps the sandbox's values out of the form (an undo
+	* replaying a state calculate already produced). The `source` field's own updates are
+	* skipped when its commit was rejected, and its value always, since the form writes it.
+	*/
+	function apply(updates, o) {
+		const next = {};
+		for (const u of updates) {
+			if (dead) return;
+			if (u.id === void 0 || u.id === null) {
+				command(u);
+				continue;
+			}
+			const field = fieldOf(u.id);
+			if (!field) continue;
+			const own = o.source?.field === field;
+			if (own && !o.source?.accepted) continue;
+			if ("value" in u) {
+				const raw = dates.has(field.name) && typeof u.value === "number" ? u.formattedValue : u.value;
+				const value = raw === u.value || typeof raw === "string" ? fromSandbox(field, u.id, raw) : void 0;
+				if (value !== void 0) {
+					mirror.set(field.name, value);
+					if (o.values && !own) next[field.name] = value;
+				}
+			}
+			if ("formattedValue" in u) form._setFormatted(field.name, typeof u.formattedValue === "string" ? u.formattedValue : void 0);
+			const override = overrideOf(u);
+			if (override) {
+				const siblings = Array.isArray(u.siblings) ? u.siblings : [];
+				for (const id of [u.id, ...siblings]) if (typeof id === "string" && widgets.has(id)) form._setWidgetState(id, override);
+			}
+			if (u.focus === true) form._focus(u.id);
+		}
+		if (Object.keys(next).length > 0) form._scriptValues(next);
+	}
+	function command(u) {
+		switch (u.command) {
+			case "print":
+				form._emitAction({ kind: "print" });
+				break;
+			case ACTION_COMMAND: {
+				const action = scriptAction$1(u.method, u.args, form);
+				if (action) form._emitAction(action);
+				break;
+			}
+			case "error": report(new Error(typeof u.value === "string" ? u.value : "A form script failed"));
+		}
+	}
+	/**
+	* Commits `value` to `field` in the sandbox: validate, calculate and format run. Returns the
+	* value the sandbox kept, which a script may have changed, or `undefined` when rejected.
+	*/
+	const commitTo = (field, value, values) => {
+		const event = commitEvent(field, value);
+		if (!event) {
+			mirror.set(field.name, value);
+			return value;
 		}
+		const updates = run(event);
+		const accepted = !updates.some((u) => ownOf(u, field) && "selRange" in u);
+		apply(updates, {
+			values,
+			source: {
+				field,
+				accepted
+			}
+		});
+		if (!accepted) return void 0;
+		const echo = updates.filter((u) => ownOf(u, field) && "value" in u).at(-1);
+		const kept = echo ? scriptChange(field, echo) : void 0;
+		const stored = kept !== void 0 && !sameValue$1(kept, value) ? kept : value;
+		mirror.set(field.name, stored);
+		return stored;
 	};
-}
-//#endregion
-//#region src/model/annotations/types.ts
-const PointSchema = z.object(Point.shape);
-const RectSchema = z.object(Rect.shape);
-const QuadSchema = z.object({
-	p1: PointSchema,
-	p2: PointSchema,
-	p3: PointSchema,
-	p4: PointSchema
-});
-/** What Inkbar adds to every Gloss type: the fields it always fills in, and its viewer state. */
-const Base = {
-	/** Bounding box in PDF user space. */
-	rect: RectSchema,
-	/** Resolved #RRGGBB. Written into the PDF later, so it is always concrete. */
-	color: Color,
-	opacity: commonFields.opacity.removeDefault(),
-	createdAt: commonFields.createdAt.unwrap(),
-	modifiedAt: commonFields.modifiedAt.unwrap(),
-	/** Created in this session, or imported from the file. Viewer state, never exported. */
-	source: z.enum(["session", "pdf"]),
-	/** Embedded annotations are locked until the engine can rewrite the file. Viewer state, never exported. */
-	locked: z.boolean().optional(),
 	/**
-	* Embedded annotations only: whether the file carries its own appearance stream for it. PDF.js
-	* paints the page with it; without one, it paints a stand-in for most types but nothing for a
-	* note. Viewer state, never exported.
+	* The value a script changed a commit to, from the sandbox's echo of it; `undefined` when
+	* the echo is no change. The sandbox reports a text value as the string it was given (it
+	* keeps the original alongside any number it parses), so a different string is a script's
+	* change. A number is the sandbox's own parse: a date or time field reports the time it
+	* read. A checkbox or radio echo names the first widget with the export value, which is
+	* not always the one chosen, so the chosen state stands; a rejection shows as a selection.
 	*/
-	hasAppearance: z.boolean().optional()
-};
-const Quads = z.array(QuadSchema).min(1);
-const TextMarkupSchema = z.object({
-	...Highlight.shape,
-	...Base,
-	type: z.enum([
-		"highlight",
-		"underline",
-		"strikeout",
-		"squiggly"
-	]),
-	quads: Quads
-});
-/** A note's icon (XFDF `icon`): a PDF name, so a name Inkbar does not know is kept. */
-const NoteIconSchema = NoteIcon;
-const NoteSchema = z.object({
-	...Note.shape,
-	...Base
-});
-/** A line ending (XFDF `head`/`tail`): a PDF name, so a name Inkbar does not know is kept. */
-const LineEndingSchema = LineEnding;
-/**
-* A key a type refuses outright rather than dropping like other unknown keys: one an older
-* shape used (so its value is not silently lost), or one that means nothing on the type (so a
-* later version is free to give it a meaning).
-*/
-const Refused = z.never().optional();
-/**
-* A free-text box's text style, keyed by the CSS property names XFDF writes in its
-* `defaultstyle` string. The older `align` is refused; other unknown keys are dropped.
-*/
-const FreeTextStyleSchema = z.object({
-	...FreeTextStyle.shape,
-	/** The text colour. */
-	color: Color,
-	align: Refused
-});
-/**
-* Free text, as XFDF has it: `color` is the box's fill and the text style lives in
-* `defaultStyle`. A box in the older shape (top-level `fontFamily`, `fontSize`, `align`) is
-* refused rather than silently losing its style; other unknown keys are dropped.
-*/
-const FreeTextSchema = z.object({
-	...FreeText.shape,
-	...Base,
-	/** The box's fill (XFDF `color`). Absent means no fill. */
-	color: FreeText.shape.color,
-	/** The box's border colour. Absent means the text colour. */
-	borderColor: Color.optional(),
-	defaultStyle: FreeTextStyleSchema,
-	fringe: FringeSchema.optional(),
-	callout: z.array(PointSchema).min(2).max(3).optional(),
-	fontFamily: Refused,
-	fontSize: Refused,
-	align: Refused
-});
-const SquareSchema = z.object({
-	...Square.shape,
-	...Base
-});
-const CircleSchema = z.object({
-	...Circle.shape,
-	...Base,
-	cornerRadius: Refused
-});
-const ShapeSchema = z.discriminatedUnion("type", [SquareSchema, CircleSchema]);
-const LineSchema = z.object({
-	...Line.shape,
-	...Base,
-	start: PointSchema,
-	end: PointSchema
-});
-const Vertices = z.array(PointSchema).min(2);
-const PolylineSchema = z.object({
-	...Polyline.shape,
-	...Base,
-	vertices: Vertices
-});
-const PolygonSchema = z.object({
-	...Polygon.shape,
-	...Base,
-	vertices: Vertices,
-	head: Refused,
-	tail: Refused
-});
-const PolySchema = z.discriminatedUnion("type", [PolylineSchema, PolygonSchema]);
-const InkShape = z.object({
-	...Ink.shape,
-	...Base,
-	inklist: z.array(z.array(PointSchema).min(1)).min(1),
-	/** Pen pressure from 0 to 1, one value per point of each stroke. Absent means even pressure. */
-	pressure: z.array(z.array(z.number().min(0).max(1))).optional()
-});
-/** Pressure must have one value per point of each stroke. */
-function checkPressure(a, ctx) {
-	if (!a.pressure) return;
-	if (!(a.pressure.length === a.inklist.length && a.pressure.every((p, i) => p.length === a.inklist[i]?.length))) ctx.addIssue({
-		code: "custom",
-		path: ["pressure"],
-		message: "pressure must have the same shape as inklist"
-	});
+	const scriptChange = (field, echo) => {
+		switch (field.type) {
+			case "text":
+			case "combo": return typeof echo.value === "string" ? fromSandbox(field, echo.id, echo.value) : void 0;
+			case "list": return fromSandbox(field, echo.id, echo.value);
+			default: return;
+		}
+	};
+	const scripting = {
+		commit(name, value) {
+			const field = byName.get(name);
+			if (dead || !field) return value;
+			return commitTo(field, value, true);
+		},
+		sync(values, calculate) {
+			if (dead) return;
+			for (const field of fields) {
+				const value = values[field.name];
+				if (value === void 0 || sameValue$1(value, mirror.get(field.name))) continue;
+				commitTo(field, value, calculate);
+				if (dead) return;
+			}
+		},
+		dispatch(event) {
+			const field = byWidget.get(event.widget);
+			const widget = widgets.get(event.widget);
+			if (dead || !field || !widget) return;
+			const value = event.value ?? currentValue(form, field, widget);
+			apply(run(toSandboxEvent(event, value)), { values: true });
+		},
+		keystroke(widget, text, change, selStart, selEnd) {
+			const field = byWidget.get(widget);
+			if (dead || !field) return void 0;
+			const updates = run({
+				id: widget,
+				name: "Keystroke",
+				value: text,
+				change,
+				selStart,
+				selEnd,
+				willCommit: false
+			});
+			mirror.delete(field.name);
+			apply(updates, {
+				values: true,
+				source: {
+					field,
+					accepted: false
+				}
+			});
+			return keystrokeResult(updates, field, text, change, selStart, selEnd);
+		},
+		pageEvent(page, name) {
+			if (dead) return Promise.resolve();
+			pages = pages.then(async () => {
+				let actions = null;
+				if (name === "PageOpen" && !visited.has(page)) {
+					visited.add(page);
+					actions = await (await proxy.getPage(page + 1)).getJSActions();
+				}
+				if (dead) return;
+				apply(run({
+					id: "page",
+					name,
+					pageNumber: page + 1,
+					actions
+				}), { values: true });
+			}).catch(report);
+			return pages;
+		},
+		destroy() {
+			if (dead) return;
+			dead = true;
+			win.clear();
+			try {
+				sandbox.nukeSandbox();
+			} catch {}
+		}
+	};
+	if (opts.testing) scripting._sandboxForTesting = sandbox;
+	apply(run({
+		id: "doc",
+		name: "Open"
+	}), { values: true });
+	scripting.sync(form.values.get(), opts.calculateAtStart === true);
+	return scripting;
 }
-const InkSchema = InkShape.superRefine(checkPressure);
-/**
-* An image on the page (XFDF `stamp`), drawn to fill `rect`. Image and typed signatures are
-* stamps with `subject: 'Signature'`.
-*/
-const StampSchema = z.object({
-	...Stamp.shape,
-	...Base
-});
-/**
-* A loupe (Inkbar's own type, a circle with `custom.inkbar.type: 'loupe'` in a file): a circle
-* inscribed in `rect` that shows the page content under its own centre, magnified. `color` and
-* `width` draw its rim.
-*/
-const LoupeSchema = z.object({
-	type: z.literal("loupe"),
-	...commonFields,
-	/** How many times larger the content under the centre is drawn. Above 1. */
-	magnification: z.number().gt(1).default(2),
-	/** The rim's width in points. */
-	width: z.number().nonnegative().default(2),
-	...Base
-});
+/** A scalar from the sandbox as text; anything else is empty. */
+function textOf(v) {
+	if (typeof v === "string") return v;
+	return typeof v === "number" || typeof v === "boolean" ? String(v) : "";
+}
+/** How long the sandbox may take to load before the form goes on without scripts. */
+const SANDBOX_TIMEOUT_MS = 1e4;
 /**
-* A mask (Inkbar's own type, a circle or square with `custom.inkbar.type: 'mask'` in a file):
-* dims everything on the page outside `shape` drawn in `rect`, an ellipse inscribed in it or the
-* rectangle itself. `color` is the dimming colour and `dim` how strongly it covers, from 0 to 1.
-* One per page: adding a second replaces the first.
+* Rejects when `promise` takes longer than `ms`, so a stalled wasm load never holds up the
+* document. A sandbox that arrives late is torn down.
 */
-const MaskSchema = z.object({
-	type: z.literal("mask"),
-	...commonFields,
-	shape: z.enum(["rect", "ellipse"]),
-	dim: z.number().min(0).max(1).default(.5),
-	...Base
-});
-const RedactSchema = z.object({
-	...Redact.shape,
-	...Base,
-	/** Present when the mark came from text; absent for an area mark. */
-	quads: Quads.optional(),
-	/** Colour the redaction will be filled with when applied. */
-	interiorColor: Color
-});
-const AnnotationSchema = z.discriminatedUnion("type", [
-	TextMarkupSchema,
-	NoteSchema,
-	FreeTextSchema,
-	SquareSchema,
-	CircleSchema,
-	LineSchema,
-	PolylineSchema,
-	PolygonSchema,
-	InkSchema,
-	StampSchema,
-	LoupeSchema,
-	MaskSchema,
-	RedactSchema
-]);
-/** The viewer's own state on an annotation, left out of exports. */
-const VIEWER_STATE = {
-	source: true,
-	locked: true,
-	hasAppearance: true
-};
-/** One exported annotation: the stored annotation without its viewer state. */
-const ExportedAnnotationSchema = z.discriminatedUnion("type", [
-	TextMarkupSchema.omit(VIEWER_STATE),
-	NoteSchema.omit(VIEWER_STATE),
-	FreeTextSchema.omit(VIEWER_STATE),
-	SquareSchema.omit(VIEWER_STATE),
-	CircleSchema.omit(VIEWER_STATE),
-	LineSchema.omit(VIEWER_STATE),
-	PolylineSchema.omit(VIEWER_STATE),
-	PolygonSchema.omit(VIEWER_STATE),
-	InkShape.omit(VIEWER_STATE).superRefine(checkPressure),
-	StampSchema.omit(VIEWER_STATE),
-	LoupeSchema.omit(VIEWER_STATE),
-	MaskSchema.omit(VIEWER_STATE),
-	RedactSchema.omit(VIEWER_STATE)
-]);
-const AnnotationDocumentSchema = z.object({
-	format: z.literal(GLOSS_FORMAT),
-	version: z.literal(GLOSS_VERSION),
-	documentKey: z.string().optional(),
-	/** Validated item by item on import so unknown types can be preserved. */
-	annotations: z.array(z.unknown()),
-	/** Form field values by full name, validated field by field against the form on import. */
-	fields: z.record(z.string(), z.unknown()).optional()
-});
-//#endregion
-//#region src/model/annotations/embedded.ts
-const SUPPORTED_SUBTYPES = /* @__PURE__ */ new Set([
-	"Highlight",
-	"Underline",
-	"StrikeOut",
-	"Squiggly",
-	"Text",
-	"FreeText",
-	"Square",
-	"Circle",
-	"Line",
-	"Polygon",
-	"PolyLine",
-	"Ink",
-	"Redact"
-]);
-/** An RGB colour in 0–255 as upper-case `#RRGGBB`; `fallback` when it has fewer than three parts. */
-function pdfColorToHex(c, fallback) {
-	if (!c || c.length < 3) return fallback;
-	return `#${[
-		c[0],
-		c[1],
-		c[2]
-	].map((n) => Math.round(n).toString(16).padStart(2, "0")).join("")}`.toUpperCase();
-}
-/** PDF.js hands back `rect` already in user space, but not always ordered; normalise with min/max. */
-function rectFromPdf(r) {
-	return rectFromPoints({
-		x: r[0],
-		y: r[1]
-	}, {
-		x: r[2],
-		y: r[3]
+function withTimeout(promise, ms) {
+	return new Promise((resolve, reject) => {
+		let late = false;
+		const timer = setTimeout(() => {
+			late = true;
+			reject(/* @__PURE__ */ new Error(`The PDF.js sandbox did not load within ${ms} ms`));
+		}, ms);
+		promise.then((sandbox) => {
+			clearTimeout(timer);
+			if (late) sandbox.nukeSandbox();
+			else resolve(sandbox);
+		}, (cause) => {
+			clearTimeout(timer);
+			reject(cause instanceof Error ? cause : new Error(String(cause)));
+		});
 	});
 }
-/** A PDF name exactly as PDF.js gives it (names are case-sensitive), or undefined if invalid. */
-function pdfName(raw) {
-	return raw !== void 0 && PDF_NAME$1.test(raw) ? raw : void 0;
+function hasEntries(value) {
+	if (value instanceof Map) return value.size > 0;
+	return typeof value === "object" && value !== null && Object.keys(value).length > 0;
+}
+/** The `window` the sandbox sees. */
+function createWindow(form, onSend, report, isDead) {
+	const timers = /* @__PURE__ */ new Map();
+	const clear = (id) => {
+		const kind = timers.get(id);
+		if (!kind) return;
+		timers.delete(id);
+		if (kind === "interval") clearInterval(id);
+		else clearTimeout(id);
+	};
+	const noop = () => void 0;
+	class ShimEvent {
+		type;
+		detail;
+		constructor(type, init) {
+			this.type = type;
+			this.detail = init?.detail;
+		}
+	}
+	return {
+		shim: {
+			alert: (message) => {
+				if (!isDead()) form._alert(message);
+			},
+			confirm: () => false,
+			prompt: (message) => {
+				if (!isDead()) form._emitAction({
+					kind: "prompt",
+					message
+				});
+				return null;
+			},
+			setTimeout: (fn, ms) => {
+				if (isDead()) return 0;
+				const id = setTimeout(() => {
+					timers.delete(id);
+					if (!isDead()) fn();
+				}, ms);
+				timers.set(id, "timeout");
+				return id;
+			},
+			setInterval: (fn, ms) => {
+				if (isDead()) return 0;
+				const id = setInterval(() => {
+					if (!isDead()) fn();
+				}, ms);
+				timers.set(id, "interval");
+				return id;
+			},
+			clearTimeout: clear,
+			clearInterval: clear,
+			console: {
+				log: noop,
+				info: noop,
+				warn: noop,
+				debug: noop,
+				error: report
+			},
+			URL,
+			CustomEvent: ShimEvent,
+			dispatchEvent: (event) => {
+				if (event.type === "updatefromsandbox") onSend(event.detail);
+				return true;
+			}
+		},
+		clear() {
+			for (const id of [...timers.keys()]) clear(id);
+		}
+	};
+}
+/** The event that commits `value` the way a person would, or none for a field without one. */
+function commitEvent(field, value) {
+	const first = field.widgets[0];
+	if (!first) return void 0;
+	switch (field.type) {
+		case "checkbox":
+		case "radio": {
+			const on = field.widgets.find((w) => w.onState !== void 0 && w.onState === value);
+			if (!on && (value !== "Off" || field.type === "radio")) return void 0;
+			return {
+				id: (on ?? first).id,
+				name: "Validate",
+				value: on !== void 0
+			};
+		}
+		case "text":
+		case "combo":
+		case "list": {
+			if (typeof value !== "string" && !Array.isArray(value)) return void 0;
+			const end = typeof value === "string" ? value.length : 0;
+			return {
+				id: first.id,
+				name: "Keystroke",
+				value,
+				change: "",
+				willCommit: true,
+				commitKey: 1,
+				selStart: end,
+				selEnd: end
+			};
+		}
+		default: return;
+	}
 }
-/** `head` and `tail` from a Line's or PolyLine's `/LE`, left out when both are `None`. */
-function lineEndingsOf(raw) {
-	const endings = raw?.map((e) => pdfName(e) ?? "None");
-	return endings && endings.length === 2 && endings.some((e) => e !== "None") ? {
-		head: endings[0],
-		tail: endings[1]
-	} : {};
+/** The value an event carries when the form layer gives none: what the widget shows. */
+function currentValue(form, field, widget) {
+	const value = form.get(field.name);
+	switch (field.type) {
+		case "checkbox":
+		case "radio": return widget.onState !== void 0 && value === widget.onState;
+		case "text":
+		case "combo":
+		case "list": return typeof value === "string" || Array.isArray(value) ? value : "";
+		default: return;
+	}
 }
-/**
-* Imported ids are `pdf:<page>:<pdfjsId>` (page is 0-based, pdfjsId is the annotation's object
-* reference such as `12R`). They are stable across opens of the same file, and `inReplyTo`
-* uses the same scheme so threads resolve.
-*/
-function importedId(page, pdfjsId) {
-	return `pdf:${page}:${pdfjsId}`;
+function toSandboxEvent(event, value) {
+	const out = {
+		id: event.widget,
+		name: event.name
+	};
+	if (value !== void 0) out.value = value;
+	for (const key of [
+		"change",
+		"selStart",
+		"selEnd",
+		"willCommit",
+		"commitKey"
+	]) if (event[key] !== void 0) out[key] = event[key];
+	return out;
 }
-/**
-* Imports one page's PDF.js annotation data. `targets` is @internal: the annotations whose
-* missing fields the document reads from the file after `ready`.
-*/
-function importEmbeddedPage(page, raw, importedAt) {
-	const counts = {};
-	const annotations = [];
-	const targets = [];
-	for (const data of raw) {
-		counts[data.subtype] = (counts[data.subtype] ?? 0) + 1;
-		if (!SUPPORTED_SUBTYPES.has(data.subtype) || data.hidden || data.noView) continue;
-		const converted = convert(page, data, importedAt);
-		if (!converted) continue;
-		annotations.push(converted);
-		const target = targetOf(converted.id, data);
-		if (target) targets.push(target);
+/** A value from the sandbox in the form's terms; `undefined` for a field without one. */
+function fromSandbox(field, id, value) {
+	switch (field.type) {
+		case "checkbox":
+		case "radio":
+			if (value === "Off" || value === "" || value === null || value === void 0) return "Off";
+			return (field.widgets.find((w) => w.id === id && w.onState !== void 0) ?? field.widgets.find((w) => w.onState === value))?.onState ?? textOf(value);
+		case "list":
+			if (field.flags.multiSelect) return Array.isArray(value) ? value.map(textOf) : value === "" ? [] : [textOf(value)];
+			return Array.isArray(value) ? textOf(value[0]) : textOf(value);
+		case "text":
+		case "combo": return Array.isArray(value) ? textOf(value[0]) : textOf(value);
+		default: return;
 	}
-	return {
-		annotations,
-		counts,
-		targets
-	};
 }
-function targetOf(id, d) {
-	const rect = Array.from(d.rect);
-	if (d.subtype === "Text") return d.name === "NoIcon" ? {
-		id,
-		subtype: "Text",
-		rect
-	} : void 0;
-	if (d.subtype !== "FreeText") return void 0;
-	const daFont = d.defaultAppearanceData?.fontName;
-	return {
-		id,
-		subtype: "FreeText",
-		rect,
-		...daFont ? { daFont } : {}
-	};
+/** `["RGB", r, g, b]`, `["G", g]`, `["CMYK", c, m, y, k]` or `["T"]` as `#rrggbb`. */
+function colorOf(value) {
+	if (!Array.isArray(value) || typeof value[0] !== "string") return void 0;
+	const [space, ...raw] = value;
+	const n = raw.map((v) => typeof v === "number" ? Math.min(1, Math.max(0, v)) : 0);
+	let rgb;
+	if (space === "T") return "transparent";
+	if (space === "G") rgb = [
+		n[0] ?? 0,
+		n[0] ?? 0,
+		n[0] ?? 0
+	];
+	else if (space === "RGB") rgb = [
+		n[0] ?? 0,
+		n[1] ?? 0,
+		n[2] ?? 0
+	];
+	else if (space === "CMYK") {
+		const k = n[3] ?? 0;
+		rgb = [
+			n[0] ?? 0,
+			n[1] ?? 0,
+			n[2] ?? 0
+		].map((c) => (1 - c) * (1 - k));
+	} else return void 0;
+	return `#${rgb.map((c) => Math.round(c * 255).toString(16).padStart(2, "0")).join("")}`;
 }
-function summarise(perPage) {
-	const totals = /* @__PURE__ */ new Map();
-	for (const counts of perPage) for (const [k, v] of Object.entries(counts)) totals.set(k, (totals.get(k) ?? 0) + v);
-	return [...totals.entries()].map(([subtype, count]) => ({
-		subtype,
-		count,
-		supported: SUPPORTED_SUBTYPES.has(subtype)
-	})).sort((a, b) => a.subtype < b.subtype ? -1 : a.subtype > b.subtype ? 1 : 0);
+function overrideOf(u) {
+	const o = {};
+	if (typeof u.hidden === "boolean") o.hidden = u.hidden;
+	if (typeof u.display === "number") o.hidden = u.display % 2 === 1;
+	if (typeof u.readonly === "boolean") o.readOnly = u.readonly;
+	if (typeof u.required === "boolean") o.required = u.required;
+	const text = colorOf(u.textColor ?? u.fgColor);
+	const fill = colorOf(u.fillColor ?? u.bgColor);
+	const stroke = colorOf(u.strokeColor ?? u.borderColor);
+	if (text) o.textColor = text;
+	if (fill) o.fillColor = fill;
+	if (stroke) o.strokeColor = stroke;
+	if (typeof u.textSize === "number" && Number.isFinite(u.textSize) && u.textSize >= 0) o.textSize = u.textSize;
+	return Object.keys(o).length > 0 ? o : void 0;
 }
-function convert(page, d, importedAt) {
-	const created = parsePdfDate(d.creationDate, parsePdfDate(d.modificationDate, importedAt));
-	const author = d.titleObj?.str;
-	const contents = d.contentsObj?.str;
-	const stroke = d.borderStyle?.width ?? 1;
-	const quads = d.quadPoints ? quadsFromFlat(d.quadPoints) : [];
-	const optional = (v) => v !== void 0 && v !== "";
-	const withColor = (type, source = d.color) => pdfColorToHex(source, staticDefaults.color(type));
-	const intent = pdfName(d.it);
-	const base = (type, color = withColor(type)) => ({
-		id: importedId(page, d.id),
-		page,
-		rect: rectFromPdf(d.rect),
-		color,
-		opacity: d.opacity ?? 1,
-		...optional(author) ? { author } : {},
-		...optional(contents) ? { contents } : {},
-		...d.inReplyTo ? { inReplyTo: importedId(page, d.inReplyTo) } : {},
-		...intent !== void 0 ? { intent } : {},
-		createdAt: created,
-		modifiedAt: parsePdfDate(d.modificationDate, created),
-		source: "pdf",
-		locked: true,
-		hasAppearance: d.hasAppearance === true
-	});
-	const fillOf = (c) => c && c.length >= 3 ? { interiorColor: pdfColorToHex(c, "#FFFFFF") } : {};
-	let candidate;
-	switch (d.subtype) {
-		case "Highlight":
-		case "Underline":
-		case "StrikeOut":
-		case "Squiggly": {
-			if (quads.length === 0) return void 0;
-			const type = d.subtype === "StrikeOut" ? "strikeout" : d.subtype.toLowerCase();
-			candidate = {
-				...base(type),
-				type,
-				quads
-			};
-			break;
-		}
-		case "Text": {
-			const icon = d.name === "NoIcon" ? void 0 : pdfName(d.name);
-			candidate = {
-				...base("text"),
-				type: "text",
-				...icon !== void 0 ? { icon } : {}
-			};
-			break;
-		}
-		case "FreeText": {
-			const da = d.defaultAppearanceData;
-			const { color: _stroke, ...rest } = base("freetext");
-			candidate = {
-				...rest,
-				...d.color && d.color.length >= 3 ? { color: pdfColorToHex(d.color, "#FFFFFF") } : {},
-				type: "freetext",
-				contents: contents ?? "",
-				width: d.borderStyle?.width ?? 0,
-				defaultStyle: {
-					color: pdfColorToHex(da?.fontColor, staticDefaults.color("freetext")),
-					...da && da.fontSize > 0 ? { fontSize: da.fontSize } : {}
-				}
-			};
-			break;
-		}
-		case "Square":
-		case "Circle": {
-			const type = d.subtype.toLowerCase();
-			candidate = {
-				...base(type),
-				type,
-				width: stroke,
-				...fillOf(d.interiorColor)
-			};
-			break;
-		}
-		case "Line": {
-			const l = d.lineCoordinates ?? [
-				d.rect[0],
-				d.rect[1],
-				d.rect[2],
-				d.rect[3]
-			];
-			candidate = {
-				...base("line"),
-				type: "line",
-				start: {
-					x: l[0],
-					y: l[1]
-				},
-				end: {
-					x: l[2],
-					y: l[3]
-				},
-				width: stroke,
-				...lineEndingsOf(d.lineEndings)
+function keystrokeResult(updates, field, text, change, selStart, selEnd) {
+	const merged = text.slice(0, selStart) + change + text.slice(selEnd);
+	const caret = selStart + change.length;
+	const last = updates.filter((u) => {
+		const id = typeof u.id === "string" ? u.id : void 0;
+		return id !== void 0 && field.widgets.some((w) => w.id === id) && "value" in u;
+	}).at(-1);
+	if (!last) return {
+		accepted: true,
+		value: merged,
+		selStart: caret,
+		selEnd: caret
+	};
+	const value = textOf(last.value);
+	const accepted = !(value === text && merged !== text);
+	const range = Array.isArray(last.selRange) ? last.selRange : [];
+	const start = typeof range[0] === "number" ? range[0] : caret;
+	const end = typeof range[1] === "number" ? range[1] : start;
+	return accepted ? {
+		accepted,
+		value,
+		selStart: start,
+		selEnd: end
+	} : {
+		accepted,
+		value: text,
+		selStart,
+		selEnd
+	};
+}
+/** Maps a rewritten method's call (positional or Acrobat's single-object form) to an action. */
+function scriptAction$1(method, args, form) {
+	const list = Array.isArray(args) ? args : [];
+	const first = list[0];
+	const named = typeof first === "object" && first !== null && !Array.isArray(first) ? first : void 0;
+	const arg = (key, index) => named ? named[key] : list[index];
+	const str = (key, index) => {
+		const v = arg(key, index);
+		return typeof v === "string" ? v : void 0;
+	};
+	switch (method) {
+		case "submitForm": {
+			const url = safeUrl(str("cURL", 0) ?? "");
+			if (!url) return void 0;
+			const format = submitFormat(str("cSubmitAs", 15), arg("bPDF", 8), arg("bXML", 6), arg("bFDF", 1));
+			const raw = arg("aFields", 3);
+			const names = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).filter((n) => typeof n === "string");
+			return {
+				kind: "submit",
+				url,
+				fields: submitValues(form.values.get(), form.fields.get(), names, true),
+				format,
+				...format === "html" ? { method: arg("bGet", 4) === true ? "GET" : "POST" } : {}
 			};
-			break;
 		}
-		case "Polygon":
-		case "PolyLine": {
-			const type = d.subtype === "Polygon" ? "polygon" : "polyline";
-			const vertices = d.vertices ? pointsFromFlat(d.vertices) : [];
-			if (vertices.length < 2) return void 0;
-			candidate = {
-				...base(type),
-				type,
-				vertices,
-				width: stroke,
-				...fillOf(d.interiorColor),
-				...type === "polyline" ? lineEndingsOf(d.lineEndings) : {}
+		case "mailDoc":
+		case "mailForm": {
+			const out = {
+				kind: "mail",
+				withData: method === "mailForm"
 			};
-			break;
+			const to = str("cTo", 1);
+			const cc = str("cCc", 2);
+			const bcc = str("cBcc", 3);
+			const subject = str("cSubject", 4);
+			const body = str("cMsg", 5);
+			for (const address of [
+				to,
+				cc,
+				bcc
+			]) if (address !== void 0 && safeAddress(address) === void 0) return void 0;
+			if (to !== void 0) out.to = to;
+			if (cc !== void 0) out.cc = cc;
+			if (bcc !== void 0) out.bcc = bcc;
+			if (subject !== void 0) out.subject = subject;
+			if (body !== void 0) out.body = body;
+			return out;
 		}
-		case "Ink": {
-			const inklist = (d.inkLists ?? []).map((p) => pointsFromFlat(p)).filter((p) => p.length > 0);
-			if (inklist.length === 0) return void 0;
-			candidate = {
-				...base("ink"),
-				type: "ink",
-				inklist,
-				width: stroke
-			};
-			break;
+		case "launchURL": {
+			const url = safeUrl(str("cURL", 0) ?? "");
+			return url ? {
+				kind: "open-url",
+				url,
+				newWindow: arg("bNewFrame", 1) === true
+			} : void 0;
 		}
-		case "Redact":
-			candidate = {
-				...base("redact"),
-				type: "redact",
-				interiorColor: pdfColorToHex(d.interiorColor, staticDefaults.fill()),
-				...quads.length > 0 ? { quads } : {}
-			};
-			break;
 		default: return;
 	}
-	const parsed = AnnotationSchema.safeParse(candidate);
-	return parsed.success ? parsed.data : void 0;
+}
+/** `cSubmitAs` wins, then `bPDF`, then `bXML`; otherwise FDF, or HTML when `bFDF` is false. */
+function submitFormat(submitAs, pdf, xml, fdf) {
+	switch (submitAs?.toUpperCase()) {
+		case "FDF": return "fdf";
+		case "XFDF":
+		case "XFD":
+		case "XML": return "xfdf";
+		case "HTML": return "html";
+		case "PDF": return "pdf";
+	}
+	if (pdf === true) return "pdf";
+	if (xml === true) return "xfdf";
+	return fdf === false ? "html" : "fdf";
+}
+//#endregion
+//#region src/pdfjs/structure.ts
+/** The prefix PDF.js gives an annotation's id in its structure tree. */
+const ANNOTATION_PREFIX = "pdfjs_internal_id_";
+/**
+* The page's annotations in structure order, by PDF.js annotation id (`12R`): the order of the
+* OBJR references in the page's part of the structure tree, depth first. Empty when the file has
+* no structure tree or PDF.js cannot read it.
+*/
+async function structureAnnotationOrder(page) {
+	let root;
+	try {
+		root = await page.getStructTree();
+	} catch {
+		return [];
+	}
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node, depth) => {
+		if (depth > 64 || typeof node !== "object" || node === null) return;
+		const n = node;
+		if (n.type === "annotation" && typeof n.id === "string") {
+			const id = n.id.startsWith(ANNOTATION_PREFIX) ? n.id.slice(18) : n.id;
+			if (!seen.has(id)) {
+				seen.add(id);
+				out.push(id);
+			}
+		}
+		if (Array.isArray(n.children)) for (const kid of n.children) walk(kid, depth + 1);
+	};
+	walk(root, 0);
+	return out;
 }
 //#endregion
 //#region src/model/annotations/embedded-fields.ts
@@ -5233,7 +5484,7 @@ function buildFormFields(raw, extras) {
 		const name = w.data.fieldName;
 		if (w.data.subtype !== "Widget" || !name) continue;
 		const at = perPage.get(w.page) ?? 0;
-		order.set(w, at);
+		order.set(w, w.at ?? at);
 		perPage.set(w.page, at + 1);
 		namesById.set(w.data.id, name);
 		let group = groups.get(name);
@@ -5875,6 +6126,10 @@ async function openDocument(source, options) {
 		defaults: options.defaults ?? staticDefaults
 	});
 	const embedded = [];
+	const linksByPage = /* @__PURE__ */ new Map();
+	const destinationCache = /* @__PURE__ */ new Map();
+	/** The outline, read on the first `outline()` call: most viewers never show it. */
+	let outlineRead;
 	let preserved = [];
 	/** Embedded annotations whose PDF.js data lacks fields the file holds; read after `ready`. */
 	const targets = [];
@@ -5933,15 +6188,21 @@ async function openDocument(source, options) {
 			const raw = await (await getPage(i)).getAnnotations().catch(() => {
 				return [];
 			});
-			const widgets = raw.flatMap((data) => data.subtype === "Widget" ? [{
+			const widgets = raw.flatMap((data, at) => data.subtype === "Widget" ? [{
 				page: i,
-				data
+				data,
+				at
 			}] : []);
+			const links = raw.flatMap((data, at) => linkFromPdfjs(i, data, at) ?? []);
 			return {
 				...importEmbeddedPage(i, raw, importedAt),
-				widgets
+				widgets,
+				links
 			};
 		});
+		perPage.forEach((r, i) => {
+			if (r.links.length > 0) linksByPage.set(i, r.links);
+		});
 		embedded.push(...summarise(perPage.map((r) => r.counts)));
 		const fromFile = perPage.flatMap((r) => r.annotations);
 		targets.push(...perPage.flatMap((r) => r.targets));
@@ -6096,6 +6357,21 @@ async function openDocument(source, options) {
 			};
 		},
 		annotations: store,
+		links: (page) => linksByPage.get(page) ?? [],
+		resolveDestination(raw) {
+			if (destroyed || !handles) return Promise.resolve(void 0);
+			const key = JSON.stringify(raw);
+			let found = destinationCache.get(key);
+			if (!found) {
+				found = resolveDestination(handles.proxy, raw).catch(() => void 0);
+				destinationCache.set(key, found);
+			}
+			return found;
+		},
+		outline() {
+			outlineRead ??= ready.then(() => destroyed || !handles ? [] : readOutline(handles.proxy));
+			return outlineRead;
+		},
 		embedded,
 		history,
 		form,
@@ -6121,6 +6397,7 @@ async function openDocument(source, options) {
 			store.destroy();
 			pageCache?.clear();
 			searchable.clear();
+			destinationCache.clear();
 			if (destroyTask) teardown(destroyTask);
 		},
 		get _pdfjs() {
@@ -6131,19 +6408,6 @@ async function openDocument(source, options) {
 	return doc;
 }
 const EMBEDDED_CONCURRENCY = 8;
-/** Runs `task(0..count-1)` with at most `limit` in flight; results come back in index order. */
-async function mapInOrder(count, limit, task) {
-	const results = new Array(count);
-	let next = 0;
-	const worker = async () => {
-		while (next < count) {
-			const i = next++;
-			results[i] = await task(i);
-		}
-	};
-	await Promise.all(Array.from({ length: Math.min(limit, count) }, worker));
-	return results;
-}
 function teardown(destroyTask) {
 	destroyTask().catch(() => {});
 }
@@ -7648,6 +7912,97 @@ function recogniseStroke(points) {
 	};
 }
 //#endregion
+//#region src/model/storage.ts
+const copy$1 = (value) => value === void 0 ? void 0 : JSON.parse(JSON.stringify(value));
+/** Values in memory, gone on reload. The default when a host passes no store. */
+function createMemoryStorage(initial = {}) {
+	const map = new Map(Object.entries(initial).map(([k, v]) => [k, copy$1(v)]));
+	return {
+		get: (key) => copy$1(map.get(key)),
+		set(key, value) {
+			map.set(key, copy$1(value));
+		},
+		remove(key) {
+			map.delete(key);
+		}
+	};
+}
+/**
+* A `localStorage` store whose keys go to storage as `keyOf` maps them. Storage is probed once.
+* Where it is blocked (it refuses even a tiny test write, as in some private windows) values
+* stay in memory for the page's life. A full store that already `holdsOurs` is kept, so its
+* values show and writes reject.
+*/
+function createLocalStore(keyOf, probeKey, holdsOurs) {
+	const storage = (() => {
+		try {
+			const s = globalThis.localStorage ?? void 0;
+			if (!s) return void 0;
+			try {
+				s.setItem(probeKey, "1");
+				s.removeItem(probeKey);
+			} catch {
+				return holdsOurs(s) ? s : void 0;
+			}
+			return s;
+		} catch {
+			return;
+		}
+	})();
+	if (!storage) return createMemoryStorage();
+	return {
+		get(key) {
+			try {
+				const raw = storage.getItem(keyOf(key));
+				return raw === null ? void 0 : JSON.parse(raw);
+			} catch {
+				return;
+			}
+		},
+		set(key, value) {
+			try {
+				storage.setItem(keyOf(key), JSON.stringify(value));
+			} catch (cause) {
+				return Promise.reject(new Error(`Browser storage could not save "${key}"`, { cause }));
+			}
+		},
+		remove(key) {
+			try {
+				storage.removeItem(keyOf(key));
+			} catch {}
+		}
+	};
+}
+/**
+* Values in `localStorage` as JSON under `<prefix>:<key>`, read on every call so another tab's
+* write shows. Where storage is blocked the values stay in memory. A `set` that storage
+* refuses, as when it is full, keeps the old value and returns a rejected promise.
+*/
+function createLocalStorage(prefix = "inkbar") {
+	const start = `${prefix}:`;
+	return createLocalStore((key) => start + key, `${start}probe`, (s) => {
+		for (let i = 0; i < s.length; i++) if (s.key(i)?.startsWith(start)) return true;
+		return false;
+	});
+}
+/**
+* Like `createLocalStorage`, but keys reach storage exactly as given, with no prefix. Internal:
+* the signature store keeps its caller's key. `own` is the key whose presence marks a full
+* store as ours.
+*/
+function createRawLocalStorage(own) {
+	return createLocalStore((key) => key, `${own}:probe`, (s) => s.getItem(own) !== null);
+}
+/** Keys under `<prefix>.`: `get('x')` reads `<prefix>.x`. */
+function scopeStorage(storage, prefix) {
+	const scoped = (key) => `${prefix}.${key}`;
+	return {
+		get: (key) => storage.get(scoped(key)),
+		set: (key, value) => storage.set(scoped(key), value),
+		remove: (key) => storage.remove(scoped(key))
+	};
+}
+//#endregion
 //#region src/model/signatures.ts
 /** How wide a placed signature is, in points. */
 const DEFAULT_SIGNATURE_WIDTH = 150;
@@ -7696,99 +8051,64 @@ function createMemorySignatureStore(initial = []) {
 		}
 	};
 }
+/** The id of an entry that may not be a template, if it has one. */
+const idOf = (x) => typeof x === "object" && x !== null ? x.id : void 0;
 /**
-* Templates in `localStorage` under `key`, as a JSON array. Where storage is blocked (it refuses
-* even a tiny test write, as in some private windows) the templates stay in memory for the
-* page's life, so signing still works. Where storage works, or is full but holds a saved list,
-* and has no room for a change, the change is undone and `save` or `remove` rejects, so the host can say so. Stored entries it
-* cannot read, such as a later version's templates, are left out of `list` and kept on write.
+* Templates under `key` (default `'signatures'`) in `storage`, as a JSON array, read on every
+* call so another tab's write shows. Stored entries it cannot read, such as a later version's
+* templates, are left out of `list`, kept on write, and dropped only when a template takes
+* their id. When `storage.set` rejects, as when it is full, the list stays as it was and `save`
+* or `remove` rejects, so the host can say so.
 */
-function createLocalSignatureStore(key) {
-	/** Usable storage, or undefined when it is missing or blocked. */
-	const storage = (() => {
-		try {
-			const s = globalThis.localStorage ?? void 0;
-			if (!s) return void 0;
-			const probe = `${key}:probe`;
-			try {
-				s.setItem(probe, "1");
-				s.removeItem(probe);
-			} catch {
-				return s.getItem(key) === null ? void 0 : s;
-			}
-			return s;
-		} catch {
-			return;
-		}
-	})();
-	/** The stored list; undefined when storage cannot be read. */
-	const read = () => {
-		if (!storage) return void 0;
-		try {
-			const raw = storage.getItem(key);
-			if (raw === null) return {
-				items: [],
-				unread: []
-			};
-			const parsed = JSON.parse(raw);
-			if (!Array.isArray(parsed)) return {
-				items: [],
-				unread: []
-			};
-			return {
-				items: validTemplates(parsed),
-				unread: parsed.filter((x) => validTemplates([x]).length === 0)
-			};
-		} catch (e) {
-			return e instanceof SyntaxError ? {
-				items: [],
-				unread: []
-			} : void 0;
-		}
-	};
-	let { items, unread } = read() ?? {
-		items: [],
-		unread: []
-	};
-	/** Picks up what another tab wrote. */
-	const sync = () => {
-		const stored = read();
-		if (stored) ({items, unread} = stored);
+function createStorageSignatureStore(storage, key = "signatures") {
+	/** The stored list: the templates, and the entries that are not (kept, never shown). */
+	const read = async () => {
+		const stored = await storage.get(key);
+		if (!Array.isArray(stored)) return {
+			items: [],
+			unread: []
+		};
+		const parsed = stored;
+		return {
+			items: validTemplates(parsed),
+			unread: parsed.filter((x) => validTemplates([x]).length === 0)
+		};
 	};
-	/** The id of an entry that may not be a template, if it has one. */
-	const idOf = (x) => typeof x === "object" && x !== null ? x.id : void 0;
-	/**
-	* Writes `next`, then adopts it; leaves everything as it was when storage refuses. Entries
-	* it cannot read go back after the templates, less any whose id a template now has.
-	*/
-	const commit = (next) => {
+	/** Writes `next` with the unread entries after it, less any whose id a template now has. */
+	const commit = async (next, unread) => {
 		const ids = new Set(next.map((t) => t.id));
 		const kept = unread.filter((x) => idOf(x) === void 0 || !ids.has(idOf(x)));
-		if (storage) try {
-			storage.setItem(key, JSON.stringify([...next, ...kept]));
+		try {
+			await storage.set(key, [...next, ...kept]);
 		} catch (cause) {
-			return Promise.reject(new Error("The signature could not be saved: browser storage is full", { cause }));
+			throw new Error("The signature could not be saved: browser storage is full", { cause });
 		}
-		items = next;
-		unread = kept;
-		return Promise.resolve();
 	};
 	return {
-		list() {
-			sync();
-			return Promise.resolve(items.map(copy));
+		async list() {
+			return (await read()).items.map(copy);
 		},
-		save(t) {
-			sync();
-			return commit(upsert(items, t));
+		async save(t) {
+			const { items, unread } = await read();
+			await commit(upsert(items, t), unread);
 		},
-		remove(id) {
-			sync();
-			return commit(items.filter((x) => x.id !== id));
+		async remove(id) {
+			const { items, unread } = await read();
+			await commit(items.filter((x) => x.id !== id), unread);
 		}
 	};
 }
 /**
+* Templates in `localStorage` under `key`, as a JSON array. Where storage is blocked the
+* templates stay in memory for the page's life, so signing still works. Where storage is full
+* and has no room for a change, `save` or `remove` rejects.
+*
+* @deprecated Pass `storage` (for example `createLocalStorage()`) to the viewer instead.
+*/
+function createLocalSignatureStore(key) {
+	return createStorageSignatureStore(createRawLocalStorage(key), key);
+}
+/**
 * Fits strokes into a unit box, for an ink template. Points come in any y-up space; they go
 * out between 0 and 1 on both axes, and `aspect` is the box's width over its height. A flat
 * side is given 1% of the long side (a dot, a square), so the aspect stays finite, and the
@@ -7984,6 +8304,6 @@ function signField(doc, field, widget, t) {
 	return id;
 }
 //#endregion
-export { deriveRect as $, pdfNameSet as $t, fromAnnotation as A, PolylineSchema as At, isBubble as B, freeTextBox as Bt, isThreadRoot as C, isInkError as Cn, LoupeSchema as Ct, withoutReplies as D, PointSchema as Dt, threadRoot as E, NoteSchema as Et, toFields as F, SquareSchema as Ft, resizedBox as G, normalizeColor as Gt, keepsAspect as H, withCalloutBounds as Ht, typesInGroup as I, StampSchema as It, translated as J, INTENTS as Jt, resizedRect as K, staticDefaults as Kt, hasCallout as L, TextMarkupSchema as Lt, styleGroupOfType as M, RectSchema as Mt, styleGroupsOf as N, RedactSchema as Nt, STYLE_GROUPS as O, PolySchema as Ot, supportedProps as P, ShapeSchema as Pt, createAnnotationStore as Q, isKnown as Qt, hasCornerHandles as R, FringeSchema as Rt, isReply as S, InkError as Sn, LineSchema as St, threadOf as T, NoteIconSchema as Tt, movedEndpoint as U, parsePdfDate as Ut, isTextMarkup as V, isStandardCallout as Vt, movedTip as W, cssVariableDefaults as Wt, openDocument as X, NOTE_ICONS as Xt, withBox as Y, LINE_ENDINGS as Yt, isBlankQuery as Z, PDF_NAME$1 as Zt, constrain as _, rectsIntersect as _n, GLOSS_SCHEMA_ID as _t, createInkTemplate as a, applyMatrix as an, importEmbeddedPage as at, shapeInput as b, unionRects as bn, InkSchema as bt, createSignatureLibrary as c, multiplyMatrix as cn, summarise as ct, RECOGNISE_THRESHOLD as d, quadsFromFlat as dn, CircleSchema as dt, mergeLineRects as en, exportAnnotations as et, recogniseStroke as f, quadsFromRect as fn, ExportedAnnotationSchema as ft, SHAPE_KINDS as g, rectFromQuads as gn, GLOSS_MEDIA_TYPE as gt, DEFAULT_SHAPE_SIZE as h, rectFromQuad as hn, GLOSS_FORMAT$1 as ht, createImageTemplate as i, writable as in, SUPPORTED_SUBTYPES as it, styleGroupOf as j, QuadSchema as jt, createToolStyle as k, PolygonSchema as kt, normaliseInk as l, pointsFromFlat as ln, AnnotationDocumentSchema as lt, DEFAULT_SHAPE_OPTIONS as m, rectFromPoints as mn, FreeTextStyleSchema as mt, DEFAULT_SIGNATURE_WIDTH as n, derived as nn, createHistory as nt, createLocalSignatureStore as o, approxEqual as on, importedId as ot, DEFAULT_CORNER_RADIUS as p, rectContainsPoint as pn, FreeTextSchema as pt, scaled as q, sameValue$1 as qt, SIGNATURE_INK_WIDTH as r, readonly as rn, isProduction as rt, createMemorySignatureStore as s, invertMatrix as sn, pdfColorToHex as st, signField as t, createRecordStore as tn, importAnnotations as tt, placeSignature as u, quadFromRect as un, AnnotationSchema as ut, defaultEnds as v, translateQuad as vn, GLOSS_VERSION$1 as vt, repliesTo as w, MaskSchema as wt, isAbandonedNote as x, Emitter as xn, LineEndingSchema as xt, isPointerOnlyKind as y, translateRect as yn, IMAGE_DATA_URL as yt, hasRectGeometry as z, calloutStroke as zt };
+export { withBox as $, INTENTS as $t, threadRoot as A, MaskSchema as At, typesInGroup as B, ShapeSchema as Bt, isPointerOnlyKind as C, rectsIntersect as Cn, GLOSS_SCHEMA_ID as Ct, isThreadRoot as D, Emitter as Dn, LineEndingSchema as Dt, isReply as E, unionRects as En, InkSchema as Et, styleGroupOf as F, PolygonSchema as Ft, isTextMarkup as G, calloutStroke as Gt, hasCornerHandles as H, StampSchema as Ht, styleGroupOfType as I, PolylineSchema as It, movedTip as J, withCalloutBounds as Jt, keepsAspect as K, freeTextBox as Kt, styleGroupsOf as L, QuadSchema as Lt, STYLE_GROUPS as M, NoteSchema as Mt, createToolStyle as N, PointSchema as Nt, repliesTo as O, InkError as On, LineSchema as Ot, fromAnnotation as P, PolySchema as Pt, translated as Q, parsePdfDate as Qt, supportedProps as R, RectSchema as Rt, defaultEnds as S, rectFromQuads as Sn, GLOSS_MEDIA_TYPE as St, isAbandonedNote as T, translateRect as Tn, IMAGE_DATA_URL as Tt, hasRectGeometry as U, TextMarkupSchema as Ut, hasCallout as V, SquareSchema as Vt, isBubble as W, FringeSchema as Wt, resizedRect as X, normalizeColor as Xt, resizedBox as Y, cssVariableDefaults as Yt, scaled as Z, staticDefaults as Zt, DEFAULT_CORNER_RADIUS as _, quadsFromFlat as _n, CircleSchema as _t, createInkTemplate as a, mergeLineRects as an, importAnnotations as at, SHAPE_KINDS as b, rectFromPoints as bn, FreeTextStyleSchema as bt, createSignatureLibrary as c, readonly as cn, sameValue$1 as ct, placeSignature as d, approxEqual as dn, importEmbeddedPage as dt, LINE_ENDINGS as en, openDocument as et, createLocalStorage as f, invertMatrix as fn, importedId as ft, recogniseStroke as g, quadFromRect as gn, AnnotationSchema as gt, RECOGNISE_THRESHOLD as h, quadContainsPoint as hn, AnnotationDocumentSchema as ht, createImageTemplate as i, pdfNameSet as in, exportAnnotations as it, withoutReplies as j, NoteIconSchema as jt, threadOf as k, isInkError as kn, LoupeSchema as kt, createStorageSignatureStore as l, writable as ln, safeUrl as lt, scopeStorage as m, pointsFromFlat as mn, summarise as mt, DEFAULT_SIGNATURE_WIDTH as n, PDF_NAME$1 as nn, createAnnotationStore as nt, createLocalSignatureStore as o, createRecordStore as on, createHistory as ot, createMemoryStorage as p, multiplyMatrix as pn, pdfColorToHex as pt, movedEndpoint as q, isStandardCallout as qt, SIGNATURE_INK_WIDTH as r, isKnown as rn, deriveRect as rt, createMemorySignatureStore as s, derived as sn, isProduction as st, signField as t, NOTE_ICONS as tn, isBlankQuery as tt, normaliseInk as u, applyMatrix as un, SUPPORTED_SUBTYPES as ut, DEFAULT_SHAPE_OPTIONS as v, quadsFromRect as vn, ExportedAnnotationSchema as vt, shapeInput as w, translateQuad as wn, GLOSS_VERSION$1 as wt, constrain as x, rectFromQuad as xn, GLOSS_FORMAT$1 as xt, DEFAULT_SHAPE_SIZE as y, rectContainsPoint as yn, FreeTextSchema as yt, toFields as z, RedactSchema as zt };
 
-//# sourceMappingURL=sign-DZVDJhqT.mjs.map
+//# sourceMappingURL=sign-BSP7H3b7.mjs.map