@cloudpdf/engine 3.0.0-next.8 → 3.0.0-next.9

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { AbortError, AbortablePromise, AbortablePromise as AbortablePromise$1, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationAppearanceRenderOptions, AnnotationAppearancesResult, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationListPageSnapshot, AnnotationListSnapshotAllPages, AnnotationMoveResult, AnnotationPatch, AnnotationRef, AnnotationUpdateResult, AttachmentContent, AttachmentsCache, DocumentAccessInfo, DocumentActionsService, DocumentAnnotationsService, DocumentAnnotationsService as DocumentAnnotationsService$1, DocumentAttachmentsService, DocumentCapabilities, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentHandle as DocumentHandle$1, DocumentIdentity, DocumentMetadata, DocumentPagesService, DocumentPagesService as DocumentPagesService$1, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSecurityService as DocumentSecurityService$1, DocumentSecurityState, DocumentUnlockInput, DocumentUnlockResult, Engine, Engine as Engine$1, EngineError, EngineError as EngineError$1, EngineErrorCode, EngineFactory, MetadataCache, MetadataPatch, MetadataService, MetadataService as MetadataService$1, MetadataUpdateResult, MutationMeta, OpenInput, OpenInput as OpenInput$1, OpenInputShare, OpenOptions, OpenOptions as OpenOptions$1, PageAnnotationsService, PageAnnotationsService as PageAnnotationsService$1, PageDeleteResult, PageFlattenResult, PageFlattenUsage, PageGeometryService, PageGeometryService as PageGeometryService$1, PageGeometrySnapshot, PageHandle, PageHandle as PageHandle$1, PageImageHandle, PageImageOptions, PageListSnapshot, PageMoveResult, PageObjectNumber, PageRaster, PageRenderOptions, PageRenderService, PageRenderService as PageRenderService$1, PageRotateResult, PageRotation, PageStructureCache, PageTextService, PageTextService as PageTextService$1, PageTextSnapshot, PdfSaveMode, PdfSaveMode as PdfSaveMode$1, SearchRequest, SearchSlice, TokenSource, WeakAnnotationEditSession } from "@embedpdf/engine-core/runtime";
+import { AbortError, AbortablePromise, AbortablePromise as AbortablePromise$1, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationAppearanceRenderOptions, AnnotationAppearancesResult, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationListPageSnapshot, AnnotationListSnapshotAllPages, AnnotationMoveResult, AnnotationPatch, AnnotationRef, AnnotationUpdateResult, AttachmentContent, AttachmentsCache, DocumentAccessInfo, DocumentActionsService, DocumentAnnotationsService, DocumentAnnotationsService as DocumentAnnotationsService$1, DocumentAttachmentsService, DocumentCapabilities, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentHandle as DocumentHandle$1, DocumentIdentity, DocumentMetadata, DocumentPagesService, DocumentPagesService as DocumentPagesService$1, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSecurityService as DocumentSecurityService$1, DocumentSecurityState, DocumentUnlockInput, DocumentUnlockResult, Engine, Engine as Engine$1, EngineError, EngineError as EngineError$1, EngineErrorCode, EngineFactory, MetadataCache, MetadataPatch, MetadataService, MetadataService as MetadataService$1, MetadataUpdateResult, MutationMeta, OpenInput, OpenInput as OpenInput$1, OpenInputShare, OpenOptions, OpenOptions as OpenOptions$1, PageAnnotationsService, PageAnnotationsService as PageAnnotationsService$1, PageDeleteResult, PageFlattenResult, PageFlattenUsage, PageGeometryService, PageGeometryService as PageGeometryService$1, PageGeometrySnapshot, PageHandle, PageHandle as PageHandle$1, PageImageHandle, PageImageOptions, PageInsertBlankSpec, PageInsertResult, PageListSnapshot, PageMoveResult, PageObjectNumber, PageRaster, PageRenderOptions, PageRenderService, PageRenderService as PageRenderService$1, PageRotateResult, PageRotation, PageStructureCache, PageTextService, PageTextService as PageTextService$1, PageTextSnapshot, PdfSaveMode, PdfSaveMode as PdfSaveMode$1, SearchRequest, SearchSlice, TokenSource, WeakAnnotationEditSession } from "@embedpdf/engine-core/runtime";
 import { CdnAccessInfoForApply, DocumentHead, DocumentManifest, LayerScopePlane } from "@embedpdf/engine-core/wire";
 import { SessionEventPublisher } from "@embedpdf/engine-services";
 //#region src/transport/HttpClient.d.ts
@@ -22,12 +22,19 @@ interface HttpClientOptions {
   /** Replace the global fetch (e.g. in Node tests with undici). */
   fetch?: typeof globalThis.fetch;
   /**
-   * Document affinity (opt-in; requires a server whose CORS
-   * allowlist includes the header): send `X-CloudPDF-Doc` on
-   * origin-bound doc requests so consistent-hash load balancers pin a
-   * document's traffic to one warm replica. Derived from the request
-   * path (`/v1/docs/:docId/…` — the same extraction the Helm chart's
-   * uri-mode fallback uses); never sent on CDN-rewritten requests.
+   * Document affinity key: `X-CloudPDF-Doc` is sent BY DEFAULT on
+   * origin-bound doc requests so consistent-hash load balancers can pin
+   * a document's traffic to one warm replica. Routing hints are
+   * unconditional client behavior — whether they are USED is the
+   * operator's choice at the load balancer, never the app's. Derived
+   * from the request path (`/v1/docs/:docId/…` — the same extraction
+   * the Helm chart's uri-mode fallback uses); never sent on
+   * CDN-rewritten requests.
+   *
+   * `false` is an ESCAPE HATCH, not a feature toggle: use it only
+   * against a stale server whose CORS allowlist predates the header
+   * (browser preflights would fail) or behind a proxy that rejects
+   * unknown request headers.
    */
   docAffinityHeader?: boolean;
   /** Observability: fired once per transport-level retry (engine busy /
@@ -172,6 +179,8 @@ declare class HttpClient {
   /** PATCH counterpart of {@link postMultipartJson} (binary-carrying mutations). */
   patchMultipartJson<T>(path: string, body: FormData, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
   postJson<T>(path: string, body: unknown, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
+  /** POST a JSON body and return the raw binary response (pages.extract). */
+  postJsonBytes(path: string, body: unknown, signal: AbortSignal): Promise<Uint8Array>;
   /** POST a raw binary body (FDF/XFDF import) and parse the JSON response. */
   postBytesJson<T>(path: string, bytes: Uint8Array, contentType: string, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
   patchJson<T>(path: string, body: unknown, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
@@ -287,6 +296,10 @@ interface ManifestAccessor {
   /** Same advance for a page delete, additionally dropping the deleted
    *  pages' manifest rows so per-page leaf URLs stop resolving locally. */
   applyPageDelete(cache: PageStructureCache, deletedPages: PageObjectNumber[]): void;
+  /** Page insert: the cached manifest has no rows for the fresh PONs (the
+   *  result carries only their object numbers), so the absorb drops the
+   *  cache for a lazy refetch instead of patching. */
+  applyPageInsert(cache: PageStructureCache): void;
   /** Advance the cached manifest's docVersion + metadataVersion after a metadata write. */
   applyMetadata(cache: MetadataCache): void;
   /** Advance the cached manifest's docVersion + attachmentsVersion after an
@@ -388,6 +401,18 @@ declare class CloudDocumentHandle implements DocumentHandle$1 {
    * 404 anyway — this keeps the failure local and instant).
    */
   private absorbPageDelete;
+  /**
+   * Patch bookkeeping after a page insert — the mirror of
+   * {@link absorbPageDelete}, with one asymmetry: delete can patch the
+   * cached manifest losslessly (it only REMOVES rows), but an insert needs
+   * manifest rows for the fresh PONs and the result doesn't carry them. So
+   * this absorb flips the planes (insert changes the page SET, so like
+   * delete it owns content + annotations alongside layout), raises the
+   * version floor, and DROPS the cache — the next read refetches a manifest
+   * that includes the new pages' rows. The UI never waits on that refetch:
+   * the mutation result / event already carries the full new layout.
+   */
+  private absorbPageInsert;
   /**
    * Patch the cached manifest after a metadata write. Symmetric with
    * {@link absorbPageMove}: a metadata edit advances `docVersion` (so leaf
@@ -471,6 +496,9 @@ declare class CloudDocumentPagesService implements DocumentPagesService$1 {
   move(pageObjectNumbers: PageObjectNumber[], destIndex: number): AbortablePromise$1<PageMoveResult>;
   rotate(pageObjectNumbers: PageObjectNumber[], rotation: PageRotation): AbortablePromise$1<PageRotateResult>;
   delete(pageObjectNumbers: PageObjectNumber[]): AbortablePromise$1<PageDeleteResult>;
+  insert(bytes: Uint8Array | ArrayBuffer, destIndex?: number): AbortablePromise$1<PageInsertResult>;
+  insertBlank(spec: PageInsertBlankSpec, destIndex?: number): AbortablePromise$1<PageInsertResult>;
+  extract(pageObjectNumbers: PageObjectNumber[]): AbortablePromise$1<Uint8Array>;
   flatten(pageObjectNumbers: PageObjectNumber[], usage?: PageFlattenUsage): AbortablePromise$1<PageFlattenResult>;
 }
 //#endregion

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AbortError, AbortablePromise, AbortablePromise as AbortablePromise$1, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationAppearanceRenderOptions, AnnotationAppearancesResult, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationListPageSnapshot, AnnotationListSnapshotAllPages, AnnotationMoveResult, AnnotationPatch, AnnotationRef, AnnotationUpdateResult, AttachmentContent, AttachmentsCache, DocumentAccessInfo, DocumentActionsService, DocumentAnnotationsService, DocumentAnnotationsService as DocumentAnnotationsService$1, DocumentAttachmentsService, DocumentCapabilities, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentHandle as DocumentHandle$1, DocumentIdentity, DocumentMetadata, DocumentPagesService, DocumentPagesService as DocumentPagesService$1, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSecurityService as DocumentSecurityService$1, DocumentSecurityState, DocumentUnlockInput, DocumentUnlockResult, Engine, Engine as Engine$1, EngineError, EngineError as EngineError$1, EngineErrorCode, EngineFactory, MetadataCache, MetadataPatch, MetadataService, MetadataService as MetadataService$1, MetadataUpdateResult, MutationMeta, OpenInput, OpenInput as OpenInput$1, OpenInputShare, OpenOptions, OpenOptions as OpenOptions$1, PageAnnotationsService, PageAnnotationsService as PageAnnotationsService$1, PageDeleteResult, PageFlattenResult, PageFlattenUsage, PageGeometryService, PageGeometryService as PageGeometryService$1, PageGeometrySnapshot, PageHandle, PageHandle as PageHandle$1, PageImageHandle, PageImageOptions, PageListSnapshot, PageMoveResult, PageObjectNumber, PageRaster, PageRenderOptions, PageRenderService, PageRenderService as PageRenderService$1, PageRotateResult, PageRotation, PageStructureCache, PageTextService, PageTextService as PageTextService$1, PageTextSnapshot, PdfSaveMode, PdfSaveMode as PdfSaveMode$1, SearchRequest, SearchSlice, TokenSource, WeakAnnotationEditSession } from "@embedpdf/engine-core/runtime";
+import { AbortError, AbortablePromise, AbortablePromise as AbortablePromise$1, AnnotationAppearanceImageOptions, AnnotationAppearanceImagesResult, AnnotationAppearanceRenderOptions, AnnotationAppearancesResult, AnnotationCreateResult, AnnotationDeleteResult, AnnotationDraft, AnnotationListPageSnapshot, AnnotationListSnapshotAllPages, AnnotationMoveResult, AnnotationPatch, AnnotationRef, AnnotationUpdateResult, AttachmentContent, AttachmentsCache, DocumentAccessInfo, DocumentActionsService, DocumentAnnotationsService, DocumentAnnotationsService as DocumentAnnotationsService$1, DocumentAttachmentsService, DocumentCapabilities, DocumentEventStream, DocumentFormsService, DocumentHandle, DocumentHandle as DocumentHandle$1, DocumentIdentity, DocumentMetadata, DocumentPagesService, DocumentPagesService as DocumentPagesService$1, DocumentRedactionService, DocumentRenderService, DocumentSearchService, DocumentSecurityService, DocumentSecurityService as DocumentSecurityService$1, DocumentSecurityState, DocumentUnlockInput, DocumentUnlockResult, Engine, Engine as Engine$1, EngineError, EngineError as EngineError$1, EngineErrorCode, EngineFactory, MetadataCache, MetadataPatch, MetadataService, MetadataService as MetadataService$1, MetadataUpdateResult, MutationMeta, OpenInput, OpenInput as OpenInput$1, OpenInputShare, OpenOptions, OpenOptions as OpenOptions$1, PageAnnotationsService, PageAnnotationsService as PageAnnotationsService$1, PageDeleteResult, PageFlattenResult, PageFlattenUsage, PageGeometryService, PageGeometryService as PageGeometryService$1, PageGeometrySnapshot, PageHandle, PageHandle as PageHandle$1, PageImageHandle, PageImageOptions, PageInsertBlankSpec, PageInsertResult, PageListSnapshot, PageMoveResult, PageObjectNumber, PageRaster, PageRenderOptions, PageRenderService, PageRenderService as PageRenderService$1, PageRotateResult, PageRotation, PageStructureCache, PageTextService, PageTextService as PageTextService$1, PageTextSnapshot, PdfSaveMode, PdfSaveMode as PdfSaveMode$1, SearchRequest, SearchSlice, TokenSource, WeakAnnotationEditSession } from "@embedpdf/engine-core/runtime";
 import { CdnAccessInfoForApply, DocumentHead, DocumentManifest, LayerScopePlane } from "@embedpdf/engine-core/wire";
 import { SessionEventPublisher } from "@embedpdf/engine-services";
 //#region src/transport/HttpClient.d.ts
@@ -22,12 +22,19 @@ interface HttpClientOptions {
   /** Replace the global fetch (e.g. in Node tests with undici). */
   fetch?: typeof globalThis.fetch;
   /**
-   * Document affinity (opt-in; requires a server whose CORS
-   * allowlist includes the header): send `X-CloudPDF-Doc` on
-   * origin-bound doc requests so consistent-hash load balancers pin a
-   * document's traffic to one warm replica. Derived from the request
-   * path (`/v1/docs/:docId/…` — the same extraction the Helm chart's
-   * uri-mode fallback uses); never sent on CDN-rewritten requests.
+   * Document affinity key: `X-CloudPDF-Doc` is sent BY DEFAULT on
+   * origin-bound doc requests so consistent-hash load balancers can pin
+   * a document's traffic to one warm replica. Routing hints are
+   * unconditional client behavior — whether they are USED is the
+   * operator's choice at the load balancer, never the app's. Derived
+   * from the request path (`/v1/docs/:docId/…` — the same extraction
+   * the Helm chart's uri-mode fallback uses); never sent on
+   * CDN-rewritten requests.
+   *
+   * `false` is an ESCAPE HATCH, not a feature toggle: use it only
+   * against a stale server whose CORS allowlist predates the header
+   * (browser preflights would fail) or behind a proxy that rejects
+   * unknown request headers.
    */
   docAffinityHeader?: boolean;
   /** Observability: fired once per transport-level retry (engine busy /
@@ -172,6 +179,8 @@ declare class HttpClient {
   /** PATCH counterpart of {@link postMultipartJson} (binary-carrying mutations). */
   patchMultipartJson<T>(path: string, body: FormData, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
   postJson<T>(path: string, body: unknown, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
+  /** POST a JSON body and return the raw binary response (pages.extract). */
+  postJsonBytes(path: string, body: unknown, signal: AbortSignal): Promise<Uint8Array>;
   /** POST a raw binary body (FDF/XFDF import) and parse the JSON response. */
   postBytesJson<T>(path: string, bytes: Uint8Array, contentType: string, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
   patchJson<T>(path: string, body: unknown, parser: (raw: unknown) => T, signal: AbortSignal): Promise<T>;
@@ -287,6 +296,10 @@ interface ManifestAccessor {
   /** Same advance for a page delete, additionally dropping the deleted
    *  pages' manifest rows so per-page leaf URLs stop resolving locally. */
   applyPageDelete(cache: PageStructureCache, deletedPages: PageObjectNumber[]): void;
+  /** Page insert: the cached manifest has no rows for the fresh PONs (the
+   *  result carries only their object numbers), so the absorb drops the
+   *  cache for a lazy refetch instead of patching. */
+  applyPageInsert(cache: PageStructureCache): void;
   /** Advance the cached manifest's docVersion + metadataVersion after a metadata write. */
   applyMetadata(cache: MetadataCache): void;
   /** Advance the cached manifest's docVersion + attachmentsVersion after an
@@ -388,6 +401,18 @@ declare class CloudDocumentHandle implements DocumentHandle$1 {
    * 404 anyway — this keeps the failure local and instant).
    */
   private absorbPageDelete;
+  /**
+   * Patch bookkeeping after a page insert — the mirror of
+   * {@link absorbPageDelete}, with one asymmetry: delete can patch the
+   * cached manifest losslessly (it only REMOVES rows), but an insert needs
+   * manifest rows for the fresh PONs and the result doesn't carry them. So
+   * this absorb flips the planes (insert changes the page SET, so like
+   * delete it owns content + annotations alongside layout), raises the
+   * version floor, and DROPS the cache — the next read refetches a manifest
+   * that includes the new pages' rows. The UI never waits on that refetch:
+   * the mutation result / event already carries the full new layout.
+   */
+  private absorbPageInsert;
   /**
    * Patch the cached manifest after a metadata write. Symmetric with
    * {@link absorbPageMove}: a metadata edit advances `docVersion` (so leaf
@@ -471,6 +496,9 @@ declare class CloudDocumentPagesService implements DocumentPagesService$1 {
   move(pageObjectNumbers: PageObjectNumber[], destIndex: number): AbortablePromise$1<PageMoveResult>;
   rotate(pageObjectNumbers: PageObjectNumber[], rotation: PageRotation): AbortablePromise$1<PageRotateResult>;
   delete(pageObjectNumbers: PageObjectNumber[]): AbortablePromise$1<PageDeleteResult>;
+  insert(bytes: Uint8Array | ArrayBuffer, destIndex?: number): AbortablePromise$1<PageInsertResult>;
+  insertBlank(spec: PageInsertBlankSpec, destIndex?: number): AbortablePromise$1<PageInsertResult>;
+  extract(pageObjectNumbers: PageObjectNumber[]): AbortablePromise$1<Uint8Array>;
   flatten(pageObjectNumbers: PageObjectNumber[], usage?: PageFlattenUsage): AbortablePromise$1<PageFlattenResult>;
 }
 //#endregion

package/dist/index.js

@@ -1,5 +1,5 @@
 import { AbortError, AbortError as AbortError$1, AbortablePromise, AbortablePromise as AbortablePromise$1, CONTINUOUS_RENDER_POLICY, DEFAULT_PDF_SAVE_MODE, EngineError, EngineError as EngineError$1, EngineErrorCode, EngineErrorCode as EngineErrorCode$1, canonicalSearchQuery, checkCapability, createPageImageHandle, decodePdfBits, encodeFieldRefKey, encodeStableIdKey, expandRawScope, normalizeAnnotationDraft, normalizeAnnotationPatch, normalizeAttachmentFileSource, passwordPromptFromState, searchContentEpoch, securityStateFromHead } from "@embedpdf/engine-core/runtime";
-import { AccessResponseSchema, AnnotationAppearanceManifestSchema, AnnotationCreateResultSchema, AnnotationDeleteResultSchema, AnnotationListPageSnapshotSchema, AnnotationMoveResultSchema, AnnotationUpdateResultSchema, AttachmentCreateResultSchema, AttachmentDeleteResultSchema, DEFAULT_LAYER_NAME, DocumentActionsSnapshotSchema, DocumentHeadSchema, DocumentManifestSchema, DocumentMetadataSchema, EmbeddedFileItemSchema, EngineErrorPayloadSchema, FormEffectsResultSchema, FormFieldCreateResultSchema, FormFieldDTOSchema, FormFieldDeleteResultSchema, FormFieldUpdateResultSchema, FormImportResultSchema, FormRepairResultSchema, FormSetValueResultSchema, FormSnapshotSchema, FormWidgetLinkResultSchema, MetadataUpdateResultSchema, PageDeleteResultSchema, PageFlattenResultSchema, PageGeometrySnapshotSchema, PageListSnapshotSchema, PageMoveResultSchema, PageRotateResultSchema, PageTextSnapshotSchema, RedactionApplyResultSchema, SearchSliceSchema, WeakAnnotationSessionResponseSchema, annotationAppearancesImageOptionsToWire, applyCdnAccess, decodeSearchToken, decodeTokenText, encodeSearchToken, renderImageOptionsToWire, wirePaths } from "@embedpdf/engine-core/wire";
+import { AccessResponseSchema, AnnotationAppearanceManifestSchema, AnnotationCreateResultSchema, AnnotationDeleteResultSchema, AnnotationListPageSnapshotSchema, AnnotationMoveResultSchema, AnnotationUpdateResultSchema, AttachmentCreateResultSchema, AttachmentDeleteResultSchema, DEFAULT_LAYER_NAME, DocumentActionsSnapshotSchema, DocumentHeadSchema, DocumentManifestSchema, DocumentMetadataSchema, EmbeddedFileItemSchema, EngineErrorPayloadSchema, FormEffectsResultSchema, FormFieldCreateResultSchema, FormFieldDTOSchema, FormFieldDeleteResultSchema, FormFieldUpdateResultSchema, FormImportResultSchema, FormRepairResultSchema, FormSetValueResultSchema, FormSnapshotSchema, FormWidgetLinkResultSchema, MetadataUpdateResultSchema, PageDeleteResultSchema, PageFlattenResultSchema, PageGeometrySnapshotSchema, PageInsertResultSchema, PageListSnapshotSchema, PageMoveResultSchema, PageRotateResultSchema, PageTextSnapshotSchema, RedactionApplyResultSchema, SearchSliceSchema, WeakAnnotationSessionResponseSchema, annotationAppearancesImageOptionsToWire, applyCdnAccess, decodeSearchToken, decodeTokenText, encodeSearchToken, renderImageOptionsToWire, wirePaths } from "@embedpdf/engine-core/wire";
 import { EventHub, SessionEventPublisher, generateUuid } from "@embedpdf/engine-services";
 //#region src/document/planes.ts
 /**
@@ -449,6 +449,13 @@ var CloudDocumentFormsService = class {
 };
 //#endregion
 //#region src/document/CloudDocumentPagesService.ts
+/** Detach a Uint8Array view into a standalone ArrayBuffer (the resource-map
+*  shape) without disturbing a larger buffer the caller still owns. */
+function copyToExactBuffer(view) {
+	const copy = new ArrayBuffer(view.byteLength);
+	new Uint8Array(copy).set(view);
+	return copy;
+}
 /**
 * Cloud-side document pages service. Mirrors `LocalDocumentPagesService`
 * over HTTP: GET /pages for `list`, POST /pages/move for the reorder.
@@ -541,6 +548,46 @@ var CloudDocumentPagesService = class {
 			return result;
 		});
 	}
+	insert(bytes, destIndex) {
+		if (this.isClosed()) return AbortablePromise$1.rejectReason(new EngineError$1(EngineErrorCode$1.DocNotOpen, `document ${this.docId} is closed`));
+		return AbortablePromise$1.run(async (signal) => {
+			const buffer = bytes instanceof ArrayBuffer ? bytes : copyToExactBuffer(bytes);
+			const form = buildMutationForm(destIndex !== void 0 ? { destIndex } : {}, { source: {
+				bytes: buffer,
+				mimeType: "application/pdf",
+				name: "source.pdf"
+			} });
+			const result = await this.http.postMultipartJson(wirePaths.layerPagesInsert(this.docId, this.layerName), form, (raw) => PageInsertResultSchema.parse(raw), signal);
+			if (result.cache) this.manifest.applyPageInsert(result.cache);
+			this.publisher.publishLocal({
+				type: "pages.inserted",
+				destIndex,
+				...result
+			});
+			return result;
+		});
+	}
+	insertBlank(spec, destIndex) {
+		if (this.isClosed()) return AbortablePromise$1.rejectReason(new EngineError$1(EngineErrorCode$1.DocNotOpen, `document ${this.docId} is closed`));
+		return AbortablePromise$1.run(async (signal) => {
+			const result = await this.http.postJson(wirePaths.layerPagesInsertBlank(this.docId, this.layerName), {
+				size: spec.size,
+				...spec.count !== void 0 ? { count: spec.count } : {},
+				...destIndex !== void 0 ? { destIndex } : {}
+			}, (raw) => PageInsertResultSchema.parse(raw), signal);
+			if (result.cache) this.manifest.applyPageInsert(result.cache);
+			this.publisher.publishLocal({
+				type: "pages.inserted",
+				destIndex,
+				...result
+			});
+			return result;
+		});
+	}
+	extract(pageObjectNumbers) {
+		if (this.isClosed()) return AbortablePromise$1.rejectReason(new EngineError$1(EngineErrorCode$1.DocNotOpen, `document ${this.docId} is closed`));
+		return AbortablePromise$1.run(async (signal) => this.http.postJsonBytes(wirePaths.layerPagesExtract(this.docId, this.layerName), { pageObjectNumbers }, signal));
+	}
 	flatten(pageObjectNumbers, usage = "display") {
 		if (this.isClosed()) return AbortablePromise$1.rejectReason(new EngineError$1(EngineErrorCode$1.DocNotOpen, `document ${this.docId} is closed`));
 		return AbortablePromise$1.run(async (signal) => {
@@ -809,8 +856,7 @@ var CloudDocumentSecurityService = class {
 	* and `applyCdnAccess` short-circuits to origin; safe to call always.
 	*/
 	async postAccess(signal, body) {
-		const response = await this.http.postJson(wirePaths.access(this.docId), {
-			layerName: this.layerName,
+		const response = await this.http.postJson(wirePaths.access(this.docId, this.layerName), {
 			...body.password ? { password: body.password } : {},
 			mode: body.mode
 		}, (raw) => AccessResponseSchema.parse(raw), signal);
@@ -1340,6 +1386,12 @@ function auditRowToEvent(row, mySessionId) {
 			origin,
 			...row.payload
 		};
+		case "pages.insert":
+		case "pages.insertBlank": return {
+			type: "pages.inserted",
+			origin,
+			...row.payload
+		};
 		case "pages.flatten": return {
 			type: "pages.flattened",
 			origin,
@@ -1582,6 +1634,7 @@ var CloudDocumentHandle = class {
 			apply: (meta, owns) => this.absorbMutation(meta, owns),
 			applyPageStructure: (cache) => this.absorbPageStructure(cache),
 			applyPageDelete: (cache, deletedPages) => this.absorbPageDelete(cache, deletedPages),
+			applyPageInsert: (cache) => this.absorbPageInsert(cache),
 			applyMetadata: (cache) => this.absorbMetadata(cache),
 			applyAttachments: (cache) => this.absorbAttachments(cache)
 		};
@@ -1747,6 +1800,27 @@ var CloudDocumentHandle = class {
 		};
 	}
 	/**
+	* Patch bookkeeping after a page insert — the mirror of
+	* {@link absorbPageDelete}, with one asymmetry: delete can patch the
+	* cached manifest losslessly (it only REMOVES rows), but an insert needs
+	* manifest rows for the fresh PONs and the result doesn't carry them. So
+	* this absorb flips the planes (insert changes the page SET, so like
+	* delete it owns content + annotations alongside layout), raises the
+	* version floor, and DROPS the cache — the next read refetches a manifest
+	* that includes the new pages' rows. The UI never waits on that refetch:
+	* the mutation result / event already carries the full new layout.
+	*/
+	absorbPageInsert(cache) {
+		this.flipScopes([
+			"layout",
+			"content",
+			"annotations"
+		]);
+		this.manifestFloorVersion = Math.max(this.manifestFloorVersion, cache.docVersion);
+		this.inflightManifest = null;
+		this.manifestCache = null;
+	}
+	/**
 	* Patch the cached manifest after a metadata write. Symmetric with
 	* {@link absorbPageMove}: a metadata edit advances `docVersion` (so leaf
 	* URLs re-resolve) and `metadataVersion` (so the /metadata leaf re-fetches),
@@ -1882,6 +1956,9 @@ var CloudDocumentHandle = class {
 			case "pages.deleted":
 				if (event.cache) this.absorbPageDelete(event.cache, event.pageObjectNumbers);
 				return;
+			case "pages.inserted":
+				if (event.cache) this.absorbPageInsert(event.cache);
+				return;
 			case "metadata.updated":
 				if (event.cache) this.absorbMetadata(event.cache);
 				return;
@@ -1933,7 +2010,7 @@ function fallbackUnknownHead(id) {
 		access: {
 			required: true,
 			reasons: ["permissions-unknown"],
-			endpoint: wirePaths.access(id)
+			endpoint: wirePaths.access(id, DEFAULT_LAYER_NAME)
 		}
 	};
 }
@@ -2050,7 +2127,7 @@ var HttpClient = class HttpClient {
 		this.tokenFn = token === void 0 ? null : typeof token === "function" ? token : () => token;
 		this.sessionId = opts.sessionId ?? null;
 		this.fetchFn = opts.fetch ?? globalThis.fetch.bind(globalThis);
-		this.docAffinityHeader = opts.docAffinityHeader ?? false;
+		this.docAffinityHeader = opts.docAffinityHeader ?? true;
 		this.onRetry = opts.onRetry;
 	}
 	/** Normalized server base URL (no trailing slash). */
@@ -2282,6 +2359,12 @@ var HttpClient = class HttpClient {
 		const res = await this.requestJson(path, "POST", body, signal);
 		return await this.parseJsonResponse(res, parser);
 	}
+	/** POST a JSON body and return the raw binary response (pages.extract). */
+	async postJsonBytes(path, body, signal) {
+		const res = await this.requestJson(path, "POST", body, signal);
+		if (!res.ok) await this.throwFromBody(res);
+		return new Uint8Array(await res.arrayBuffer());
+	}
 	/** POST a raw binary body (FDF/XFDF import) and parse the JSON response. */
 	async postBytesJson(path, bytes, contentType, parser, signal) {
 		const headers = new Headers({ "Content-Type": contentType });