Release Next v3.0.0-next.11

@embedpdf/plugin-actions@3.0.0-next.11

Major Changes

• #793 by @bobsingor – Introduces the PDF action engine: one policy-gated dispatcher for the payload-carrying /A action trees (execute/canExecute, dispatch/canDispatch by annotation ref). Domain plugins register executors and sinks through the /contract/host lens (stage: goto/named; form: javascript/reset-form; annotation: the session-visibility sink), the framework installs a URI/Print UI adapter via setUiAdapter, and onAction/onDiagnostic event hooks report every dispatch. Chains walk in PDF /Next order with document-lifetime work first and navigation/external effects deferred until it succeeds; launch/goto-remote/media stay never-executable and incomplete trees are refused whole.

  Phase 2 adds annotation /AA events, ordered page lifecycle events, and the document-open sequence. Dispatch now submits synchronously into the serial queue, returns per-step trigger results, derives origin centrally, and never rejects. The lifecycle coordinator buffers initial page state behind the open barrier and caps programmatic cascades; /A shadows /AA U. The shared hover pump coalesces Exit→Enter pairs, and configuration can gate triggers and the open sequence.

  The package now publishes bundle-safe /contract and /contract/host entries. They expose the public and sibling-host protocols over the same token without pulling in dispatcher or plugin wiring; the package root remains the explicit implementation opt-in.

Minor Changes

• #793 by @bobsingor – Document lifecycle events + the submit sink chain (Phase 4). The five catalog /AA verbs (ISO 32000-2 Table 200 — WC/WS/DS/WP/DP) dispatch through the trigger spine ({scope:'document', event:'will-save'|…}), with the open-ordering law: catalog OpenAction can never run AFTER a lifecycle verb. NEW runDocumentVerb('save'|'print', operation) — before-event → operation → after-event as ONE serialized queue op (two saves can never interleave; a before-event failure never cancels the verb; an operation throw skips the after-event and rethrows) — and prepareClose() (the cooperative WC door; scripts never run in teardown). The Print door fires WP → adapter EXACTLY once → DP under one latch: a nested print request (a WillPrint script calling doc.print()) is suppressed with a reentrant-print diagnostic, never a second dialog; an adapter throw skips DP. SubmitForm graduates from hard-blocked to the SINK CHAIN — embedder setSubmitHandler (consent = installation; detached-promise contract: executed means handed to the embedder) → the document's home (doc.forms.submit, engine-asserted, awaited) → blocked with no-submit-sink; the form plugin registers the ONE dataset resolver (registerSubmitResolver), both action nodes and script doc.submitForm() effects normalize to one SubmitIntent, and policy gains a 'submit-form' row (user-origin only by default). The catalog read is memoized per document with rejection eviction. Ships submitEntriesToUrlEncoded for handlers. The plugin still never touches a network.

• #793 by @bobsingor – THE JavaScript switch lives here now: actionsPlugin({ javascript }) owns the per-document ScriptHost realm, registers the real javascript executor (page-scoped world prefetch → boot → run → owner-sink commits → surface, ALL inside the host transaction — the commit-inside-the-boundary law), and exposes the transaction port + surfaceScriptResult on contract/host. Owner commit sinks replace direct engine writes (registerFormCommitSink / registerAnnotCommitSink — each plugin commits AND reconciles its own model, so the PDF and the pixels can never diverge). Trigger provenance reaches executors (ActionContext.event + eventOf), and — full ISO — the Hide action routes by OWNING plane: field names and widget object numbers become form setDisplay effects, plain annotations become document flag patches; the session-visibility sink (SessionEffectSink/registerSessionSink) is REMOVED. ActionUiAdapter gains alert/gotoPage (+ print context) as the ONE UI port for every script effect, with the doc.print authority gate upstream and onScriptDiagnostic/onScriptError hooks. A deterministic per-dispatch JS node cap (maxScriptNodesPerDispatch) bounds /Next chains.

@cloudpdf/contract@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – The annotation and form response schemas now describe action nodes as a payload-carrying discriminated union exposed through reusable OpenAPI components. Recursive /Next elements intentionally remain open ({}) for Fern compatibility, so generated SDK types show unknown[] for nested chains without duplicating the action model for every response path.

@cloudpdf/engine@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Action trees parsed from the hosted engine now carry full interpreter payloads (the discriminated PdfActionNode union) and DocumentActionsSnapshot.openDestination; the snapshot schema defaults openDestination so responses from older deployments still parse. Cloud actions conformance now gates the payload matrix and the destination-form /OpenAction on the HTTP + native-runtime path.

@cloudpdf/sdk@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Action trees now use shared generated types for their payload-carrying union (destinations, URIs, named actions, Hide targets, ResetForm state, file specs) instead of repeating the same models for every annotation and form response path. Recursive /Next chain elements remain unknown[] — a Fern limitation of the emitted recursive schema, not missing data.

@cloudpdf/server@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Action reads served by /v1/docs/:docId/actions@:token (and the layer-scoped variant) now include interpreter payloads on every executable node and the destination-form /OpenAction as openDestination, via the shared engine-services reader. The wire representation of action nodes changed shape (payload-carrying discriminated union); deploy server and clients from the same prerelease train.

@embedpdf/core-acrojs@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Complete the Acrobat AF forms support library in the scripting prelude: AFNumber_Keystroke, AFPercent_Keystroke, AFDate_Format/AFDate_Keystroke(Ex), AFTime_Format(Ex)/AFTime_Keystroke, AFSpecial_Format/AFSpecial_Keystroke, AFRange_Validate, AFMergeChange, AFMakeNumber, and AFExtractNums, with Acrobat-compatible rejection alerts, a lenient scand-style date parser, and new h/hh/tt 12-hour tokens in util.printd. Forms built with Acrobat's standard number/date/time/special formats (for example the Apryse demo form) now validate, format, and auto-calculate instead of failing on missing globals.

  javaScriptSourcesFromActionTree now narrows on the payload-carrying action-node union and collects only javascript arms; rendition /JS remains represented but is deliberately not executed. A new ui-effect-suppressed diagnostic also makes permission-withheld script UI effects observable.

• #793 by @bobsingor – doc.submitForm(...) emits a submit INTENT (Phase 4): both Acrobat forms — positional (cURL, bFDF, bEmpty, aFields) and the argument object (cURL/aFields/bEmpty/cSubmitAs/bGet) — become a {kind:'submitForm'} UI effect (include-mode field names; cSubmitAs beats bFDF; nothing in the VM ever touches a network — resolution and the sink chain live outside). Doc-typed events now carry event.target = the Doc object (Acrobat's WillSave boilerplate does event.target.getField(...)). The v1-frozen posture constants are honest again: submitForm: 'sink-chain', catalogLifecycleActions: 'execute-on-verb', page/annotation events execute-* — the actions plugin's policy is the live authority these document.

• #793 by @bobsingor – The ScriptHost and the annots plane. createScriptHost owns the ONE realm per document (its own serialized transaction port; lazy name-tree boot delivered exactly once to the first transaction; resource faults poison and lazily rebuild the realm; per-run and caller-sliced budgets). The script world grows the curated annotation plane: this.getAnnots({nPage}) / getAnnot(nPage, name) over a caller-prefetched, page-scoped input (null when nothing matches — Acrobat parity; unfetched pages are a NAMED compatibility deviation), Annot wrappers with a per-subtype validity matrix (ANNOT_WRITABLE_KEYS, drift-guarded against the kind registry; no dictionary access — the Acrobat model), setProps/getProps, and diff-derived canonical annotEffects beside formEffects (declared cross-plane commit order: form first, then annot). Ships the standard color object (constants + convert/equal with the documented G/RGB/CMYK vectors), Acrobat {type, name} event overrides, and — cycle fix — the ScriptSandbox/ScriptSandboxFactory structural contract now lives HERE (core-js-sandbox implements and re-exports it).

@embedpdf/core-annotation@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Session-visibility overlay: Model.sessionHidden with setSessionHidden/forgetSessionHidden/clearSessionHidden messages, composed through the new effFlags/effBearer lenses so Hide actions and scripts flip presentation-only visibility (paint, hit-testing, selectability, handles) without ever touching the document /F flags — and a session-SHOWN annotation is live, not painted-but-dead. The overlay survives page reloads and is forgotten only on true deletes.

• #793 by @bobsingor – sessionHidden, effFlags/effBearer, and the session-visibility messages are REMOVED — visibility is document truth again (/F flags, mutated through the normal write path), and every paint/hit/selection gate reads the annotation's own flags.

@embedpdf/core@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Adds createEventHook (the one capability-event primitive: subscribe-only EventHook<T> face, snapshot fan-out, listener error isolation, inert after dispose) and createSerialQueue (promise-tail serialization) to the core toolkit.

@embedpdf/engine-core@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – The SubmitForm intent and the document's-home submit contract (Phase 4). The submit-form node grows an ATOMIC optional payload (url + fields + decoded SubmitFormFlags + charSet?; absent = older-runtime extraction, the node stays recognized-inert — partial states are unrepresentable). decodeSubmitFormFlags is the ONE ISO Table-240 decode (exclude derived from bit 1, never duplicated; bit 12 is ExclFKey, bit 13 reserved, EmbedForm is bit 14; bit 9 SubmitPDF dominates format with GetMethod kept alive). NEW: doc.forms.submit?(request) — the optional delivery-to-the-document's-HOME capability (present only where a home exists; the local engine truthfully lacks it), gated by the NEW grant-minted doc.forms.submit scope (no PDF permission bit exists for submission, so pdf.permissions never expands it); FormSubmissionRequest/Receipt DTOs + wire schemas fix the record shape (dataset entries + declared intent as METADATA — the home derives WHO submitted from its own verified session, and never fetches the PDF's URL). Conformance pins the payload extraction (/UF precedence, flag decode, both degrade shapes) in both flavors.

• #793 by @bobsingor – PdfActionNode is now a discriminated union carrying full interpreter payloads — a goto without its destination or a uri without its URI is unrepresentable. Executable arms: javascript (script), goto (destination), uri (+ isMap), named, hide (targets + /H), reset-form (fields: PdfActionTargetRef[] | null — null means /Fields was absent and every field resets — plus the exclude flag), the file-spec arms, and rendition with its optional /JS. Unreadable payloads degrade that node to unknown with the new payload-dropped tree warning. DocumentActionsSnapshot gains openDestination (the destination-form /OpenAction, schema-defaulted and mutually exclusive with openAction), ActionReadBudget gains target-entry and payload-text limits, and PdfDestinationSchema moved to a neutral dto/ module (re-exported from its old home). The wire entry now also exposes PdfActionWireComponents, the stable named-schema registry used by API generators. This is a breaking source-level contract for code that constructed or narrowed action nodes, recorded as minor only because the 3.0.0-next train is prerelease.

@embedpdf/engine-runtime@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – SubmitForm payload getters (Phase 4). EPDFAction_GetNodeSubmitForm (has-fields + the raw ISO Table-240 flag word; returns true only when the REQUIRED /F resolved to a URL — a << /FS /URL >> file specification with /UF preferred over /F per 7.11.2, or a bare string /F accepted as a producer-compat extension), EPDFAction_GetNodeSubmitFormURL, and EPDFAction_GetNodeSubmitFormCharSet (PDF 2.0 /CharSet, extracted not encoded). /Fields entries ride the existing shared target storage (GetNodeTargetCount/TargetName/TargetObjectNumber now also answer for submit-form nodes) and the aggregate payload/target budgets. An unresolvable required component withholds the WHOLE payload — the reader degrades the node; never a half payload.

• #793 by @bobsingor – Add action-payload getters to the fork's detached action model: unified Hide /T / ResetForm /Fields target accessors (EPDFAction_GetNodeTargetCount/Name/ObjectNumber, with -1 marking a target list that could not be fully represented — a partial list must never execute), EPDFAction_GetNodeHideFlag (/H, spec default hide), EPDFAction_GetNodeResetForm (/Fields presence + /Flags exclude bit — absent and empty are different states), EPDFAction_GetNodeURIIsMap, and EPDFDoc_GetOpenActionDest for the destination-form catalog /OpenAction. Payload capture stays inside the build-time snapshot (nothing lazy, nothing stateful), guarded by new cumulative per-model budgets for target entries and payload bytes plus a destination-array element cap.

@embedpdf/engine-services@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – The action model reader extracts the SubmitForm payload atomically (feature-detecting the Phase-4 runtime getters: an older runtime payload yields the bare recognized-inert node — the pin-lag skew case, unit-pinned; a NEW runtime withholding an unresolvable /F degrades the whole node to unknown + payload-dropped). /Fields targets and the URL/CharSet strings charge the existing aggregate budgets.

• #793 by @bobsingor – The action-model walker now materialises interpreter payloads (destinations, URIs + /IsMap, named-action names, Hide targets + /H, ResetForm three-state fields + exclude, file specs) with reserve-before-allocate budgeting — payload lengths are charged against the aggregate read budget before any scratch buffer is allocated, and name-tree script names ride the same budget. readActionModel and the annotation/form field readers take the owning document pointer; readDestination moved to a shared features/destinations/ home. The link target is now a pure projection of the payload-carrying activate tree (linkTargetFromActionTree) — the duplicate native root-read is gone, an incomplete tree projects unsupported, and a malformed /A no longer silently falls back to /Dest.

@embedpdf/angular@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – NEW @embedpdf/angular/actions entry: injectActionsUiAdapter(handlers?) — Angular's spelling of React's useActionsUiAdapter (the inject* law), installing the SHARED default policy from @embedpdf/web so the two bindings can never drift; re-exports the @embedpdf/plugin-actions contract. The parity gate goes green (actions ported; anchored consciously added to PENDING).

Patch Changes

• #793 by @bobsingor – Route the Stage adapter's interaction dependency through the bundle-safe plugin contract entry instead of the interaction implementation root.

@embedpdf/react@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – New @embedpdf/react/actions entry with useActionsUiAdapter (browser-default URI open through sanitizeExternalUri + print dialog, overridable per handler), a useCapabilityEvent hook for capability event subscriptions, and link-layer delegation: chain-bearing URI links drop the native href fast path so the dispatcher runs the whole chain (the 'dispatched' outcome opens nothing itself — the adapter owns it).

  Widget fill controls become always-active /AA event surfaces, link anchors feed link hover events, and scripting-provider defaults use the dispatch origin when deciding whether to suppress lifecycle/boot UI effects.

  Route sibling feature dependencies through plugin contract/helper entries. Annotation selection hooks and anchor equality helpers are split into leaf modules so form and annotation-menu entries no longer import the full annotation feature implementation.

  Render PDF list boxes as visible native scrolling controls in both form surfaces, with stable optimistic selection and wheel isolation so row hit-testing, selection, and scrolling stay synchronized while engine writes complete. Combo boxes retain their baked resting appearance and native popup behavior.

  Keep keyboard focus indicators above baked PDF appearances so checkboxes and choice controls display the same clear blue focus ring as text fields and radio buttons.

• #793 by @bobsingor – useActionsUiAdapter is the ONE script UI port: it gains alert and gotoPage defaults with the origin×phase visibility matrix (lifecycle/boot alerts and non-user print suppressed unless the embedder passes handlers — which receive everything, context attached). useFormScriptingProvider and FormScriptingUiHandlers are DELETED.

Patch Changes

• #793 by @bobsingor – useActionsUiAdapter is now glue over @embedpdf/web's createDefaultActionsUiAdapter — behavior-identical (the corpus alert matrix pins it); the default policy lives in ONE place for every binding.

• #793 by @bobsingor – Widget activation is a WIDGET behavior, not a push-button behavior: clicking ANY form widget now dispatches its /A through form.activateWidget — text, toggle, and choice widgets (both the annotation-backed renderers and the standalone fill layer) join the button path. This makes real-world "fake buttons" work: producers ship Reset/Next/Hide controls as READ-ONLY text fields carrying a widget /A (ISO puts the activate action on the annotation dictionary, any field type), which previously died in the viewer because only push buttons routed clicks to activation while the pointer feed's mouseUp was — correctly — shadowed by /A precedence. Disabled controls become pointer-transparent so their clicks reach the activation surface (a disabled form control suppresses click events entirely); toggles keep Acrobat's order (the value change first, THEN the /A); push buttons keep their gated door (disabled still blocks activation there). Proven end-to-end by a real-DOM regression test (rendered FormLayer over a real engine — the gap every prior activateWidget()-direct test masked) and a read-only fake-button fixture in the plugin e2e.

@embedpdf/web@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – createDefaultActionsUiAdapter — the actions UI adapter's DEFAULT policy (the origin×phase visibility matrix: hover/lifecycle prints suppressed, boot/lifecycle alerts suppressed, sanitizeExternalUri URI opens, browser fallbacks), hoisted here and written ONCE so every framework binding (react, angular) ships the same behavior instead of forking it. Structural twins keep this package plugin-free per the layering law; overrides accepts a getter for late-bound handlers.

@embedpdf/plugin-annotation@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Registers the action engine's session-visibility sink (applySessionVisibility on the host lens) when @embedpdf/plugin-actions is present, and carries the full activate action tree + annotation ref on LinkNavItem so the nav layer can delegate chains to the dispatcher.

  The pointer-driven hover diff feeds annotation /AA cursorEnter/cursorExit through the shared hover pump while reducer-side clears, widgets, links, and tree-less items stay inert. LinkNavItem also carries hover-event presence flags for the link plane.

  Publish bundle-safe /contract and /contract/host entries over the same annotation token, plus the focused /authoring helper entry. /internal keeps its implementation-helper meaning and no longer serves as the sibling bundle boundary.

• #793 by @bobsingor – The session-visibility overlay is RETIRED — applySessionVisibility is replaced by commitScriptEffects, the annotation DOCUMENT-commit sink: script/Hide effects become engine annotations.update patches (colors crossing the Acrobat-array → engine boundary, /AP regenerated engine-side), authority-enforced, stop-on-failure, with the owner reconciling its own model per touched page.

@embedpdf/plugin-commands@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for command tokens, definitions, resolved-command equality, and capability types without command plugin wiring.

@embedpdf/plugin-form@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Widget activation joins the action engine: with @embedpdf/plugin-actions installed, activateWidget delegates the full /A tree to the dispatcher (return type is now WidgetActivationResult, discriminating the two worlds), so Hide/ResetForm push buttons work with scripting disabled. The host lens exposes the interim executors' doors: runActivationScript (one JS node as a widget transaction) and resetFormAction (three-state target resolution, one batch reset skipping non-resettable families, recalculate after). Executor-driven form mutations ride the same serial mutation queue as user commits — strictly actions-queue → form-queue, never the reverse.

  The widget DOM-event door dispatches widget /AA trees, including coalesced hover events. Activation now submits synchronously through the dispatcher, and script UI effects carry their dispatch origin; print requests without document permission are withheld with an observable diagnostic.

  Form scripting is fault-tolerant per event: Keystroke, Validate, Calculate, and Format exceptions degrade to diagnostics while explicit event.rc = false remains a rejection and resource-budget faults still fail the transaction. Keystroke actions now run Acrobat's typing and commit passes so standard AF validators and custom transforms see the expected event shape.

  Publish bundle-safe /contract and /contract/host entries over the same form token, plus a focused /scripting helper entry. /internal remains an implementation visibility surface rather than the sibling bundle boundary.

• #793 by @bobsingor – The submit dataset resolver + the reset() symmetry fix (Phase 4). resolveSubmitDataset (registered as THE actions submit resolver) does a FRESH engine read and applies the ISO Table-239/240 semantics through the new shared field-selection module: include-mode NAMES select descendants by FQN dot-prefix (fixing the ResetForm exact-match conformance bug too — Tables 241/242 want subtrees), the NoExport veto is unconditional (diagnosed when explicitly listed), explicitly listed push-buttons/signatures and unsupported /V shapes are DIAGNOSED (submit-entry-unsupported), never silently dropped, and IncludeNoValueFields yields name-only entries. resetFormAction gains an origin parameter threaded from the executor's ActionContext — a lifecycle/hover ResetForm can no longer launder its recalculation alerts into user origin — and the public form.reset(key) now rides the SAME shared reset core (one effects batch → refresh → V/C/F recalculation), so a dependent calculated field can no longer go stale through the API door.

• #793 by @bobsingor – The K/V/C/F pipeline rides the shared realm: FormScriptingController keeps its ordering, event.rc semantics, two-pass keystroke, overlay, and fault ladder UNCHANGED, but acquires the realm through a transaction port — the actions plugin's per-document host in viewers, or a self-owned standalone host (createFormScriptingHost / the { config } constructor arm) for stamp and tests. The snapshot moves INSIDE the transaction boundary (commit(ref, value) / activate(ref, action) / recalculate() — no snapshot parameters). formPlugin({ scripting }) is DELETED (the switch is actionsPlugin({ javascript })); the interim runActivationScript executor and the form-side UI-effect provider (setUiEffectProvider/FormUiEffectProvider) are gone — every script surface flows through the actions port with origin/phase attached, and the new commitScriptFormEffects sink commits script form effects with engine write + snapshot AND annotation-plane reconciliation in one place.

@embedpdf/plugin-i18n@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for the translation token, locale vocabulary, and capability types without i18n plugin wiring.

@embedpdf/plugin-interaction@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for interaction and platform-feedback tokens, pointer/tool protocols, and capability types without either plugin implementation.

@embedpdf/plugin-link@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – activate() accepts an optional LinkActivateContext; when the actions plugin is installed and the item carries its /A tree, activation delegates to the dispatcher and returns the new { outcome: 'dispatched', dispatch } arm — named verbs execute and mixed /Next chains behind links finally run. Without the actions plugin the classic root-projection path is unchanged.

  Link /AA hover presence flags now ride LinkNavItem from the standalone source so the navigation layer can deliver cursorEnter/cursorExit without waking the annotation behavior plane.

  Publish a bundle-safe /contract entry so navigation consumers can depend on the link protocol without pulling in source/effect/plugin wiring.

@embedpdf/plugin-metadata@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for the metadata token, state, and capability types without event, reducer, or plugin wiring.

@embedpdf/plugin-page-edit@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for the page-edit token and capability type without mutation or plugin wiring.

@embedpdf/plugin-redaction@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for the redaction token, state, pending-item, and capability protocols without destructive-apply plugin wiring.

@embedpdf/plugin-render@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for the render token, paint-plan vocabulary, settings, and capability types without raster or plugin wiring.

@embedpdf/plugin-search@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for the search token, query validation, results, and capability types without scan, effect, or plugin wiring.

@embedpdf/plugin-selection@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish bundle-safe /contract and /contract/host entries over the same selection token so sibling features can use selection protocols without gesture, reducer, or plugin wiring. /internal retains its framework implementation helpers and makes no bundle-purity promise.

@embedpdf/plugin-shell@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for the shell token, surface state, options, and capability types without reducer or plugin wiring.

@embedpdf/plugin-stage@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – The main stage lens registers goto and named action executors with the action engine when present: GoTo destinations reveal through the camera, NextPage/PrevPage/FirstPage/LastPage execute, unknown named verbs report inert.

  The stage lens also reports placed/current/visible page state and user-versus-programmatic motion causes to the action lifecycle coordinator.

  Publish a bundle-safe /contract entry and a focused /destination helper entry so camera consumers do not pull in stage reducer/effect/plugin wiring.

@embedpdf/plugin-stamp@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for stamp-library tokens, assets, previews, configuration, and capability types without import, render, or plugin wiring.

Patch Changes

• #793 by @bobsingor – Dynamic stamp evaluation constructs its OWN standalone realm per detached stamp-asset document (StampScriptingOptions — the opt-in and script observers stay stamp-config; the viewer document's shared host is never involved).

@embedpdf/plugin-view-manager@3.0.0-next.11

Minor Changes

• #793 by @bobsingor – Publish a bundle-safe /contract entry for view-registry tokens, view state, and capability types without reducer or plugin wiring.

@embedpdf/core-js-sandbox@3.0.0-next.11

Patch Changes

• #793 by @bobsingor – The ScriptSandbox/ScriptSandboxFactory structural contract moved to @embedpdf/core-acrojs (cycle fix); this package implements and re-exports it, and threads the new annots plane + annotEffects through the QuickJS bridge unchanged.

@embedpdf/viewer-chrome@3.0.0-next.11

Patch Changes

• #793 by @bobsingor – The viewer wires the action engine in: actionsPlugin() joins the plugin set and the Shell installs the default URI/Print UI adapter.

• #793 by @bobsingor – The chrome save/print commands become the Phase-4 verb owners: document:download runs WS → serialize → DS as ONE queued operation (the WillSave mutations are IN the downloaded bytes; two rapid saves can never interleave) and document:print runs WP → window.print() → DP under the reentrancy latch — both degrading to today's behavior when the actions plugin is absent.

• #793 by @bobsingor – Scripting migrates to actionsPlugin({ javascript: { enabled: true } }) with a bare formPlugin(); the Shell's form scripting provider hook is gone — useActionsUiAdapter carries everything.

@cloudpdf/viewer@3.0.0-next.11

@cloudpdf/viewer-react@3.0.0-next.11

@embedpdf/core-geometry@3.0.0-next.11

@embedpdf/core-stage@3.0.0-next.11

@embedpdf/core-ui@3.0.0-next.11

@embedpdf/engine@3.0.0-next.11

@embedpdf/engine-runtime-darwin-arm64@3.0.0-next.11

@embedpdf/engine-runtime-darwin-x64@3.0.0-next.11

@embedpdf/engine-runtime-linux-arm64@3.0.0-next.11

@embedpdf/engine-runtime-linux-x64@3.0.0-next.11

@embedpdf/engine-runtime-linuxmusl-arm64@3.0.0-next.11

@embedpdf/engine-runtime-linuxmusl-x64@3.0.0-next.11

@embedpdf/engine-runtime-wasm32@3.0.0-next.11

@embedpdf/engine-runtime-win32-arm64@3.0.0-next.11

@embedpdf/engine-runtime-win32-x64@3.0.0-next.11

@embedpdf/viewer@3.0.0-next.11

@embedpdf/viewer-react@3.0.0-next.11