@laminapdf/viewer 0.2.0-alpha.5 → 0.2.0

package/README.md

@@ -5,7 +5,7 @@
 - **The view** handles layout, virtualisation, canvases and zoom.
 - **The document Web Worker**, one per open document, opens and renders the file away from the page's main thread.
 
-The package is private and ESM-only.
+The package is ESM-only.
 
 ```ts
 import pdfiumWasm from "@embedpdf/pdfium/pdfium.wasm?url";
@@ -48,10 +48,12 @@ The view keeps only the pages near the viewport in the DOM and paints each in tw
 | `jumpToPage(index)`, `jumpToDestination(target)` | Like `goToPage` and `goToDestination`, but recorded as history jumps, so Back returns to where the view was. |
 | `history` | Back and forward through the jumps (below). |
 | `getState()`, `subscribe(listener)` | The view state (`currentPage`, `pageCount`, `zoom`, `percent`, `rotation`, `scrollTop`, `visibleRange`), for `useSyncExternalStore`. |
-| `on("pagechange" \| "zoomchange" \| "renderstats", …)`, `stats()` | Events and counters. `renderstats` counts renders, for measuring performance. |
+| `on("pagechange" \| "zoomchange" \| "renderstats" \| "invalidate", …)`, `stats()` | Events and counters. `renderstats` counts renders, for measuring performance. `invalidate` lists the pages `invalidate` redrew, each with its size in points now. |
 | `addLayer({ name, onMount, onUnmount, onZoom })` | Mounts a layer into each page. |
 | `keepMounted(pages)` | Keeps these pages mounted wherever the view scrolls, replacing the previous set; `[]` releases them. The text layer pins the pages a selection touches. |
 | `pointAt(x, y)`, `positionOf(point)` | Converts between viewport positions and document points. |
+| `pageSizes()` | Every page's displayed size in points, as the view lays it out, edits included. A thumbnail strip lays its pages out from it. |
+| `applyEdit(ops)`, `invalidate(pages, sizes?)` | Edits the document and redraws the pages the edit touched (below). |
 | `MIN_ZOOM`, `MAX_ZOOM` | The bounds of a percentage zoom, 10 and 800, for a zoom control's range. |
 
 **Layers.** Each page shell stacks a canvas and three slots above it: `div.lamina-layer-text`, `div.lamina-layer-annot` and `div.lamina-layer-highlight`. The text layer fills the first, links the second and find highlights the third, through `addLayer`. A layer with another name gets its own slot on top. Every slot above the text lets the pointer through (`pointer-events: none`), so text stays selectable under it; an element a layer wants clicked, such as a link's anchor, sets `pointer-events: auto` on itself.
@@ -92,6 +94,13 @@ A left the file leaves out keeps the current horizontal scroll, and a top it lea
 
 Anchors follow page order, so Tab reaches a page's links in order. Each is named by its `/Contents` or by what it does ("Link to page 3"); `links.words` gives those names in another language. Only the anchors take pointer events, so text beside a link still selects. Style them as `a.lamina-link`; the viewer adds no style sheet.
 
+**Link previews.** The viewer asks to preview a link inside the document after 300 ms of mouse or pen hover or of visible keyboard focus, or on a 500 ms long-press with a finger that doesn't move. It cancels a long-press's click, and the long-press selects no text. Web links never preview.
+
+The viewer emits `linkpreview` with the link, its anchor, how it was asked for (`fine`, `keyboard` or `touch`) and what it shows: a destination, or the sentence of a page action or another file's link. `linkpreviewend` follows 300 ms after the pointer leaves both the link and the preview, or when focus leaves the link. The app draws the preview with these:
+- `viewer.preview(target, { signal })` draws where the link goes, in one render by the document's Web Worker. A destination with a point gets a crop from above and left of the point across its text column, at the reader's zoom clamped to 100–150 % and at most 480 × 180 CSS px. Any other destination gets the top of its page.
+- It returns the bitmap, its CSS size, the destination page and the text of the lines it shows. The viewer keeps the last 8 bitmaps and closes them on a zoom or rotation change and when the document closes, so draw the bitmap at once and never close it. `stats().previewBitmaps` counts them.
+- `viewer.holdLinkPreview(true | false)` keeps the preview while the pointer is on it, `viewer.dismissLinkPreview()` hides it on Escape or Close, and `viewer.followLinkPreview()` follows the previewed link, else the focused one.
+
 **History.** `viewer.history` records jumps: links, `jumpToPage`, `jumpToDestination`, find's moves and thumbnail clicks. Scrolling alone records nothing. Each jump saves the view it leaves, both scroll position and zoom, so Back returns there, not only to that page.
 - `back()`, `forward()` and `goTo(id)` move the view; `getState()` and `subscribe()` say where Back and Forward go (`back`, `forward`, `current`, each an entry with a page point and a zoom).
 - A jump that lands where the view already is adds nothing, and a new jump drops what Forward held.
@@ -104,6 +113,32 @@ Anchors follow page order, so Tab reaches a page's links in order. Each is named
 - **Keyboard and pointer.** A click, or Enter or Space, goes to that page. The arrow keys, Home and End move the focus, and only one thumbnail is in the Tab order.
 - **Names.** Each thumbnail is named by its page label and number ("Page iv (4 of 120)") and captioned with its label. For another language, pass `label` to replace both and `name` to replace the list's own name.
 
+**Edits.** `viewer.applyEdit(ops)` edits the open document and redraws the pages the edit touched, in one call. The ops are `@laminapdf/sdk`'s, such as `{ op: "rotatePage", args: { page, rotate: 90 } }`, and apply as one transaction. The call resolves with those pages as they are after the edit: index, ID, rotation and displayed size in points, so a quarter turn swaps width and height.
+- **How an edit reaches the screen.** PDFium draws from the bytes it opened, so the Web Worker writes the edit into memory as an incremental update and opens the render document again from the result. The old render document keeps drawing until the new one is open. The Web Worker runs one call at a time, so every render answered before the edit drew the old file, and every render after it draws the new one. A render the view asked for before an edit and that answers after it is dropped, never cached, and asked for again.
+- **What the viewer redraws.** Only the touched pages: their bitmaps go, here and in a thumbnail strip, and their layers read their text and links again. Every other page keeps what it drew. A page in view at its old size keeps its pixels until sharp tiles cover them, so it never flashes. A page whose size changed paints its quick pass first, and the page at the top of the viewport stays there.
+- **What changes nothing.** An edit of the document's metadata touches no page: the Web Worker opens nothing again, and the viewer redraws nothing. A failed edit, such as one naming a page that doesn't exist, rejects and leaves the document and the pages as they were. So does an edit whose new file the backend can't open: the Web Worker undoes it. An edit that adds, removes or moves pages is refused for now, since the view finds pages by index.
+- **When an edit can't be undone.** If the undo after a failed reopen fails too, the call rejects with `worker-failed` saying to open the document again, and every later edit does the same.
+- **Driving it yourself.** `ViewerClient.applyEdit(ops)` makes the edit without the redraw; pass its pages to `viewer.invalidate(indices, sizes)`, which redraws any pages you name.
+- **The zoom follows.** While the zoom fits the width or the page, a page that turned is fitted again, so a page lying on its side never runs past the window.
+
+**The edit session.** `viewer.edits` keeps the open document's history and is the store an editor reads (`getState()`, `subscribe()`):
+
+```ts
+await viewer.edits.apply([{ op: "rotatePage", args: { page, rotate: 90 } }], "Rotate page 5");
+await viewer.edits.undo(); // the page stands again
+await viewer.edits.redo();
+await viewer.edits.goTo(0); // back to the file as opened, in one call
+const { history, busy, blocked, notice } = viewer.edits.getState();
+```
+
+- **One step per edit.** Each edit is a step with its label, its pages and its time. `history.steps` lists them oldest first; the first `history.position` are done and the rest are undone, ready to redo. A new edit drops the undone ones. An edit that changed nothing (setting a value the document already had) makes no step.
+- **Undo and redo redraw too.** They draw only the pages the step touched, as an edit does, and `goTo` draws once however many steps it moves. Calls run one after another in the order they were made, so three quick presses of Undo undo three steps.
+- **When an undo can't restore everything.** A later change can replace part of what a step changed. Then the undo restores the rest and the step is marked `partial`; `notice` holds it until the next edit, and `onReverted(listener)` hears each undo and redo with how it went. An undo that could restore nothing takes the step out of the history.
+- **Unsaved changes.** `history.unsaved` counts the steps between the document now and the file as opened, so undoing every step leaves it clean again. The history keeps 500 steps and then drops the oldest (`history.dropped`); the steps it drops still count.
+- **What blocks editing.** `blocked` says why the document can't be edited: none is open, or it is encrypted, or an edit failed and couldn't be undone, so it must be opened again. An encrypted file's edits can't be written yet, and `OpenedDocument.encrypted` says so when it opens.
+- **A restart keeps the edits.** If the Web Worker crashes, the client opens the file again, replays every step, then undoes the ones that were undone, so the history and the pages are as they were (`restarted`'s `edits` is `restored`). A replay can't recreate an undo or redo that restored only part of a step, or none of it, so after one of those, or when the replay fails, the file opens as it was and `edits` is `lost`.
+- **Without the viewer.** `ViewerClient` has the same calls (`applyEdit(ops, { label })`, `undoEdit()`, `redoEdit()`, `goToStep(n)`, `editHistory()`), each resolving with the pages to redraw and the history, and fires `edit` after each.
+
 **Tuning.** The margin, pool size, pixel cap, cache budget and settle delay are measured by the perf harness ([Performance](#performance)); the first full run kept them.
 
 ## The document Web Worker
@@ -144,8 +179,9 @@ The client starts the Web Worker and talks to it; you call `ViewerClient`'s meth
   - Defaults are `soft` 10 s (`render-slow`) and `hard` 120 s.
   - At the hard cap the client calls `stop("hard-timeout")`. For a document that needed a password, it emits `render-stuck` instead and waits for the user's `stop()`.
 - **Crashes:** a crash is the Web Worker's `error` or `messageerror`, or a WebAssembly trap it reports, never silence.
-  - Pending calls reject with `worker-crashed`.
-  - A new Web Worker reopens the document from the same source, but nothing that was pending is re-sent. The UI offers Retry, so a page that crashes the engine can't loop.
+  - Pending calls reject with `worker-crashed`, and a new Web Worker reopens the document from the same source.
+  - `render()` sends again, once, in the new Web Worker, each render that was waiting when the old one was lost. The render that was drawing then isn't re-sent: its page shows an error the UI offers Retry for, so a page that crashes the engine can't loop.
+  - When the restart can't reopen the document (an encrypted one waits for its password), a waiting render rejects with an `AbortError`.
   - `stop()` takes the same path with `reason: "cancelled"`.
 - **Secrets:** the password crosses to the Web Worker once, when the document opens, and is kept only there. The page keeps the source and the other options.
   - After a crash of an encrypted document, `password-required` fires and the caller opens again.
@@ -191,6 +227,11 @@ There is one protocol, not two: the viewer's worker is `@laminapdf/sdk/worker`'s
 | `currentDocument` | — | `{ document, ticket }` of the open document, or `undefined`: `open()` asks after a cancelled open | document |
 | `closeDocument` | — | — | document |
 | `pageInfo` | `index` | `PageInfo` (displayed size in points, rotation, ID, label) | document |
+| `applyEdit` | `ops`, the document's `id`, `label?` | `EditResult`: the touched pages' `PageInfo`, after the edit (empty for a metadata edit), and the edit session's `history` | document. `client.applyEdit(ops)`. Saves into memory and opens the render document again when the edit touched pages; records a step unless nothing changed |
+| `undoEdit`, `redoEdit` | the document's `id` | `EditResult` with `reverted`: the step and how it went | document. Redraws as an edit does |
+| `goToStep` | `position`, the document's `id` | `EditResult` with every step undone or redone | document. One redraw; a failure half way takes every move back |
+| `editHistory` | the document's `id` | `EditHistory` | document |
+| `restoreEdits` | `steps` (ops, label, time), `undone`, the document's `id` | `EditResult` | document. A restarted worker's replay |
 | `find` | `query`, `FindOptions`, `pages` | `FindPageResult[]`: each page's matches as quads, and whether it has no text | `background` |
 | `render` | ADR 0004 `RenderRequest` | `{ bitmap: ImageBitmap, width, height }` (transferred) | `visible` > `prefetch` > `background` |
 | `memory` | — | `WorkerMemory`: the bytes of the backend's and Lamina PDF's WebAssembly memories | document. `client.memory()`; the perf harness samples it. |
@@ -232,7 +273,7 @@ The browser suites run in Chromium, Firefox and WebKit over the built package: r
   - page labels in the names;
   - the outline and a named destination of the links-and-outlines reference PDF landing on their pages.
 - Unit tests sit next to their modules (`src/**/*.test.ts`) and run in Node. They cover the layout's cost, counted in steps, and the fit modes for portrait, landscape and rotated pages. They also cover zoom anchoring, tiles, cache eviction and the pool's caps, and where each kind of destination puts the view at each rotation. `test/dependencies.test.ts` checks that `src/` imports no UI framework, and `test/types.test.ts` checks the RPC types.
-- Two demo pages are manual checks: run `pnpm --filter @laminapdf/viewer exec vite examples`. `examples/viewer-demo.html` is the viewer, with zoom buttons; `examples/rpc-demo.html` draws page 1 through the RPC alone. The perf harness has its own page, `perf/page/` ([Performance](#performance)).
+- Two demo pages are manual checks: run `pnpm --filter @laminapdf/viewer exec vite demo`. `demo/viewer-demo.html` is the viewer, with zoom buttons; `demo/rpc-demo.html` draws page 1 through the RPC alone. `examples/` holds the examples the docs site shows, under [the examples' rules](../../docs/guidelines/examples.md); `test/browser/show-a-pdf.browser.test.ts` runs `examples/show-a-pdf.ts`. The perf harness has its own page, `perf/page/` ([Performance](#performance)).
 
 ### Performance
 
@@ -246,7 +287,7 @@ cargo xtask viewer-perf [chromium|firefox|webkit]  # the same, plus the job summ
 
 It writes `target/viewer-perf/<browser>.json` and `summary.md`, and never fails on a missed target: no pull request lane asserts a duration ([ADR 0018](../../docs/decisions/0018-test-strategy.md#2-ci-lanes)).
 
-**What it does.** It opens three seeded files, built with `@laminapdf/sdk` and cached in `perf/.fixtures/`: 10 pages of text with an image each (about 1 MB), 1,000 pages of text, and 300 pages of full-page images. A Vite build of `perf/page/` shows them, and `perf/serve.ts` serves that page gzipped, as Cloudflare serves the app. Playwright drives real input, so every run scrolls the same way:
+**What it does.** It opens four seeded files, built with `@laminapdf/sdk` and cached in `perf/.fixtures/`: 10 pages of text with an image each (about 1 MB), 100 and 1,000 pages of text, and 300 pages of full-page images. A Vite build of `perf/page/` shows them, and `perf/serve.ts` serves that page gzipped, as Cloudflare serves the app. Playwright drives real input, so every run scrolls the same way:
 
 | Scenario | Measures | Target |
 | --- | --- | --- |
@@ -256,6 +297,7 @@ It writes `target/viewer-perf/<browser>.json` and `summary.md`, and never fails
 | Scroll the 1,000-page file end to end, twice, with wheel steps every 20 ms; stop at a quarter, a half and three quarters | the longest main-thread task, time to sharp after each stop, peak memory, memory after each pass, cancelled renders that painted | no task > 50 ms; sharp ≤ 300 ms; ≤ 600 MB; second pass ≤ first + 5 %; 0 |
 | Fling across the 300 image pages, then stop | time to sharp | ≤ 300 ms |
 | Three ctrl+wheel bursts in and out on the 10-page file | the longest frame, time to sharp after each burst | reported |
+| Turn the page in view a quarter (`viewer.applyEdit`), five times, in the 10-, 100- and 1,000-page files; on the 100-page file, go on to 20 turns in a row | the median time from the call to the page's first new pixels (its quick pass), and to sharp; the twentieth turn's first new pixels | ≤ 150 ms at 100 pages ([E1 plan §6](../../docs/plans/editor/e1-editing-foundation.md#6-redrawing-after-an-edit)) |
 
 "Time to sharp" runs from the last scroll or zoom event to the moment every visible page turned sharp. Memory is the page's JS heap (Chromium only), the document Web Worker's WebAssembly memories (`client.memory()`), the bitmap cache and the canvases' pixels. Firefox and WebKit have no Long Tasks API, so their longest task is the longest gap between frames, which is an upper bound.
 

package/dist/client.d.ts

@@ -1,7 +1,8 @@
 import type { RenderRequest } from "@laminapdf/render";
+import { type DocumentMetadata, type Op, type PlannedSave, type SaveOptions } from "@laminapdf/sdk";
 import { type WorkerInitOptions, type WorkerWasmSource } from "@laminapdf/sdk/worker";
 import type { FindOptions } from "./find/fold.js";
-import { type BackendInit, type LoadProgress, type MethodName, type NetworkRecord, type OpenedDocument, type Params, type PolicyViolation, type PrintOptions, type Priority, type RenderedBitmap, type Result, type SourceInit, type ViewerOpenOptions, type WorkerNetworkLog } from "./protocol.js";
+import { type BackendInit, type EditHistory, type EditResult, type LoadProgress, type MethodName, type NetworkRecord, type OpenedDocument, type Params, type PolicyViolation, type PrintOptions, type Priority, type RenderedBitmap, type Result, type SavedCopy, type SourceInit, type ViewerOpenOptions, type WorkerNetworkLog } from "./protocol.js";
 /** `ViewerClient.create`'s options: the backend, Lamina PDF's WebAssembly, the timeouts, the worker and a signal to stop starting. */
 export interface ViewerOptions {
     /** The render engine; PDFium needs its `.wasm` URL from your bundler (`pdfium.wasm?url`). */
@@ -69,11 +70,21 @@ export interface ViewerEvents {
     crashed: {
         readonly reason: string;
     };
-    /** A new worker serves again (and has reopened the document, unless it needed a password). */
+    /**
+     * A new worker serves again (and has reopened the document, unless it needed a password).
+     * `edits` says what became of the edit session's steps: `restored` (applied again, the same
+     * history), `lost` (the file is as it was opened), or absent when there were none.
+     */
     restarted: {
         readonly reason: RestartReason;
         readonly reopened: boolean;
+        readonly edits?: "restored" | "lost";
     };
+    /**
+     * An edit, undo or redo was made (the document's semantic dirty state is `history.unsaved`):
+     * the pages it touched, as they are now, and the edit session's history.
+     */
+    edit: EditResult;
     /** The restarted worker can't reopen the document without its password: open it again. */
     "password-required": Record<string, never>;
     /** A restart failed (the backend couldn't load again, …): the client serves nothing until `stop()` works. */
@@ -90,6 +101,13 @@ export interface ViewerCallOptions {
     /** Default `visible` for renders; document calls run above every render. */
     readonly priority?: Priority;
 }
+/**
+ * What a `Viewer` needs of the engine it draws from: the open document, its events, renders,
+ * and the text, link, find, edit and save calls of the layers and the edit session it builds. A
+ * `ViewerClient` over its document worker is one; the desktop app's client over its engine
+ * process is another, so the same viewer runs on both.
+ */
+export type ViewerEngine = Pick<ViewerClient, "document" | "on" | "render" | "pageText" | "readingOrder" | "structure" | "pageLinks" | "find" | "applyEdit" | "undoEdit" | "redoEdit" | "goToStep" | "editHistory" | "planSave" | "copyEdits" | "adoptEdits">;
 /** One document worker and the typed RPC to it. */
 export declare class ViewerClient {
     #private;
@@ -115,6 +133,44 @@ export declare class ViewerClient {
     get document(): OpenedDocument | undefined;
     /** Closes the document in the worker (the worker stays, ready for another `open`). */
     close(): Promise<void>;
+    /**
+     * Applies `ops` to the open document as one transaction (`@laminapdf/sdk`'s ops, such as
+     * `rotatePage`), and draws the pages it touched from the edited file from then on. The edit
+     * session records it as one step named `label` ("Rotate page 5"), which undo takes back; an
+     * edit that changed nothing records none. Resolves with those pages as they now are and the
+     * history; `document` gives their new sizes too. Pass the pages to `viewer.invalidate`, or call
+     * `viewer.applyEdit`, which does both. A failed edit changes nothing. A restarted worker opens
+     * the file and applies the session's steps again (`restarted`'s `edits`).
+     */
+    applyEdit(ops: readonly Op[], options?: ViewerCallOptions & {
+        readonly label?: string;
+    }): Promise<EditResult>;
+    /** Undoes the newest step of the edit session; the pages it touched are drawn as they were. */
+    undoEdit(options?: ViewerCallOptions): Promise<EditResult>;
+    /** Redoes the oldest undone step. */
+    redoEdit(options?: ViewerCallOptions): Promise<EditResult>;
+    /** Undoes or redoes steps until `position` of the history's steps are done, drawing once. */
+    goToStep(position: number, options?: ViewerCallOptions): Promise<EditResult>;
+    /** The edit session's history, read from the worker (after a failed call, which answers none). */
+    editHistory(options?: ViewerCallOptions): Promise<EditHistory>;
+    /** The open document's metadata as its edits leave it: Info and XMP read together. */
+    metadata(call?: ViewerCallOptions): Promise<DocumentMetadata>;
+    /** How saving the open document with `options` would go: its constraint, signatures, mode and warnings. */
+    planSave(options: SaveOptions, call?: ViewerCallOptions): Promise<PlannedSave>;
+    /**
+     * Writes the open document as a save with `options` would, for the caller to write where the
+     * file lives; the document stays unsaved until `adoptEdits(copy.token)`. Save a copy uses it
+     * and never adopts.
+     */
+    copyEdits(options: SaveOptions, call?: ViewerCallOptions): Promise<SavedCopy>;
+    /**
+     * Makes the copy `token` names the document's saved file, once it is written where the file
+     * lives: the worker rebases onto it, the history marks the point saved, and a restarted worker
+     * reopens that file. Emits `edit` with the history.
+     *
+     * @throws when the document changed since the copy (it stays unsaved).
+     */
+    adoptEdits(token: number, call?: ViewerCallOptions): Promise<EditHistory>;
     /**
      * Every request the document worker has made, and had blocked, since it started: what its
      * `network` and `csp-violation` events reported, including those sent before anyone listened.
@@ -177,8 +233,8 @@ export declare class ViewerClient {
     render(request: RenderRequest, options?: ViewerCallOptions): Promise<RenderedBitmap>;
     /**
      * Stops whatever the worker is doing by terminating it (the user's Stop, or the hard cap), then
-     * restarts it as after a crash: pending calls reject, the running one isn't re-sent, and an
-     * encrypted document asks for its password again.
+     * restarts it as after a crash: pending calls reject, renders that were waiting are sent again,
+     * the running one isn't, and an encrypted document asks for its password again.
      */
     stop(reason?: "cancelled" | "hard-timeout"): Promise<void>;
     /** Ends the worker for good. */

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,MAAM,EAEX,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAKvB,sIAAsI;AACtI,MAAM,WAAW,aAAa;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;IACvD,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,uBAAuB;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,oCAAoC;AACpC,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,cAAc,CAAC;AAE7F,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,8EAA8E;IAC9E,QAAQ,EAAE,YAAY,CAAC;IACvB,wGAAwG;IACxG,cAAc,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,sHAAsH;IACtH,iBAAiB,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,iHAAiH;IACjH,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC;IAC7F,uEAAuE;IACvE,eAAe,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;KAAE,CAAC;IAC1G,oDAAoD;IACpD,aAAa,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,qGAAqG;IACrG,cAAc,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;KAAE,CAAC;IAC7F,4CAA4C;IAC5C,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,8FAA8F;IAC9F,SAAS,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,0FAA0F;IAC1F,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,6GAA6G;IAC7G,gBAAgB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/E;AAED,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC;AAE7C,wBAAwB;AACxB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAgCD,mDAAmD;AACnD,qBAAa,YAAY;;IAmBvB,OAAO,eAWN;IAsBD;;;OAGG;IACH,OAAa,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA8BjE;IAED,oEAAoE;IACpE,EAAE,CAAC,CAAC,SAAS,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAEzF;IAED,yEAAyE;IACnE,IAAI,CAAC,CAAC,SAAS,UAAU,EAC7B,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EACjB,OAAO,GAAE,iBAAiB,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GACjD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAepB;IAED;;;;OAIG;IACG,IAAI,CACR,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,iBAAsB,EAC/B,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAkBzB;IAQD,iCAAiC;IACjC,IAAI,QAAQ,IAAI,cAAc,GAAG,SAAS,CAEzC;IAED,sFAAsF;IAChF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAI3B;IAED;;;OAGG;IACH,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEjE;IAED,oFAAoF;IACpF,MAAM,CAAC,OAAO,CAAC,EAAE,iBAAiB,iDAEjC;IAED,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,sDAElD;IAED;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,iDAI5D;IAED;;;OAGG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,mDAIhE;IAED;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,iBAAsB,qDAE/F;IAED,2FAA2F;IACrF,SAAS,CAAC,OAAO,CAAC,EAAE,iBAAiB,kDAG1C;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,iBAAiB,4CAEjC;IAED;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,iBAAiB,2DAElC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,gEAEzD;IAED;;;OAGG;IACH,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,wDAErC;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,iBAAsB,gDAE5E;IAED;;;OAGG;IACH,SAAS,CAAC,OAAO,CAAC,EAAE,iBAAiB,wCAEpC;IAED,wHAAwH;IAClH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,iEAK7D;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAiD7F;IAED;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,WAAW,GAAG,cAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtE;IAED,gCAAgC;IAChC,SAAS,IAAI,IAAI,CAIhB;CAgCF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,KAAK,gBAAgB,EAAoB,KAAK,EAAE,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACtH,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,MAAM,EAEX,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAKvB,sIAAsI;AACtI,MAAM,WAAW,aAAa;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;IACvD,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,uBAAuB;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,oCAAoC;AACpC,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,cAAc,CAAC;AAE7F,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,8EAA8E;IAC9E,QAAQ,EAAE,YAAY,CAAC;IACvB,wGAAwG;IACxG,cAAc,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,sHAAsH;IACtH,iBAAiB,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,iHAAiH;IACjH,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC;IAC7F,uEAAuE;IACvE,eAAe,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;KAAE,CAAC;IAC1G,oDAAoD;IACpD,aAAa,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,qGAAqG;IACrG,cAAc,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;KAAE,CAAC;IAC7F,4CAA4C;IAC5C,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC;;;;OAIG;IACH,SAAS,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAAA;KAAE,CAAC;IAChH;;;OAGG;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,0FAA0F;IAC1F,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,6GAA6G;IAC7G,gBAAgB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/E;AAED,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC;AAE7C,wBAAwB;AACxB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAC7B,YAAY,EACV,UAAU,GACV,IAAI,GACJ,QAAQ,GACR,UAAU,GACV,cAAc,GACd,WAAW,GACX,WAAW,GACX,MAAM,GACN,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,aAAa,GACb,UAAU,GACV,WAAW,GACX,YAAY,CACf,CAAC;AAgCF,mDAAmD;AACnD,qBAAa,YAAY;;IAyBvB,OAAO,eAWN;IAsBD;;;OAGG;IACH,OAAa,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA8BjE;IAED,oEAAoE;IACpE,EAAE,CAAC,CAAC,SAAS,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAEzF;IAED,yEAAyE;IACnE,IAAI,CAAC,CAAC,SAAS,UAAU,EAC7B,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EACjB,OAAO,GAAE,iBAAiB,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GACjD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAepB;IAED;;;;OAIG;IACG,IAAI,CACR,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,iBAAsB,EAC/B,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAmBzB;IAQD,iCAAiC;IACjC,IAAI,QAAQ,IAAI,cAAc,GAAG,SAAS,CAEzC;IAED,sFAAsF;IAChF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAK3B;IAED;;;;;;;;OAQG;IACH,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAM5G;IAED,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAEzD;IAED,qCAAqC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAEzD;IAED,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAE3E;IAED,kGAAkG;IAC5F,WAAW,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAOnE;IAED,sFAAsF;IAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAGlE;IAED,2GAA2G;IACrG,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAGnF;IAED;;;;OAIG;IACG,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,CAKlF;IAED;;;;;;OAMG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAW9E;IA8BD;;;OAGG;IACH,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEjE;IAED,oFAAoF;IACpF,MAAM,CAAC,OAAO,CAAC,EAAE,iBAAiB,iDAEjC;IAED,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,sDAElD;IAED;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,iDAI5D;IAED;;;OAGG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,mDAIhE;IAED;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,iBAAsB,qDAE/F;IAED,2FAA2F;IACrF,SAAS,CAAC,OAAO,CAAC,EAAE,iBAAiB,kDAG1C;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,iBAAiB,4CAEjC;IAED;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,iBAAiB,2DAElC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,gEAEzD;IAED;;;OAGG;IACH,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,wDAErC;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,iBAAsB,gDAE5E;IAED;;;OAGG;IACH,SAAS,CAAC,OAAO,CAAC,EAAE,iBAAiB,wCAEpC;IAED,wHAAwH;IAClH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,iEAK7D;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAa7F;IAgED;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,WAAW,GAAG,cAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtE;IAED,gCAAgC;IAChC,SAAS,IAAI,IAAI,CAKhB;CAgFF"}

package/dist/client.js

@@ -11,11 +11,13 @@
 //   (`hard-timeout`) or, for an encrypted document, `render-stuck` and a restart only on `stop()`;
 // - restart after a crash (the worker's error, messageerror or a reported trap; never silence):
 //   pending calls reject with `worker-crashed`, a new worker reopens the document from the same
-//   source, but the call that was running is never re-sent (the UI offers Retry). An encrypted
+//   source, and renders that were waiting are sent again once, there; the render that was running
+//   is never re-sent, so a page that crashes the engine can't loop (the UI offers Retry). An encrypted
 //   document isn't reopened: the password lived only in the dead worker, so `password-required`
 //   fires and the caller opens again with the password.
 import { isLaminaPdfError } from "@laminapdf/sdk";
 import { connect, Emitter, } from "@laminapdf/sdk/worker";
+import { EditLog } from "./edit-log.js";
 import { FirstDraw } from "./first-draw.js";
 import { PRIORITY, renderKey, } from "./protocol.js";
 /** Default render timeouts (ADR 0009 §3.7), in ms. */
@@ -47,6 +49,10 @@ export class ViewerClient {
     /** What to reopen after a restart: the source and the options without the password. */
     #reopen;
     #document;
+    /** The open document's edit session, kept so a restarted worker takes it back. */
+    #edits = new EditLog();
+    /** The last copy a save wrote (`copyEdits`), until it is adopted or another replaces it. */
+    #copy;
     /** Opens asked for so far: each open's ticket. */
     #opens = 0;
     #recovering;
@@ -57,6 +63,8 @@ export class ViewerClient {
     #timers = new Map();
     /** The key the worker is drawing now: a render that joins it starts its timers at once. */
     #drawing;
+    /** The render that was drawing when the worker crashed or was stopped: it isn't sent again. */
+    #lost;
     constructor(pdf, options) {
         this.#pdf = pdf;
         this.#backend = options.backend;
@@ -178,6 +186,7 @@ export class ViewerClient {
         }
         this.#reopen = { source, options: rest };
         this.#document = opened;
+        this.#edits.reset();
         // Only once it opened: a failed open leaves the shown document's gate as it was.
         this.#firstDraw = new FirstDraw(opened.id);
         return opened;
@@ -195,8 +204,121 @@ export class ViewerClient {
     async close() {
         this.#reopen = undefined;
         this.#document = undefined;
+        this.#edits.reset();
         await this.call("closeDocument", []);
     }
+    /**
+     * Applies `ops` to the open document as one transaction (`@laminapdf/sdk`'s ops, such as
+     * `rotatePage`), and draws the pages it touched from the edited file from then on. The edit
+     * session records it as one step named `label` ("Rotate page 5"), which undo takes back; an
+     * edit that changed nothing records none. Resolves with those pages as they now are and the
+     * history; `document` gives their new sizes too. Pass the pages to `viewer.invalidate`, or call
+     * `viewer.applyEdit`, which does both. A failed edit changes nothing. A restarted worker opens
+     * the file and applies the session's steps again (`restarted`'s `edits`).
+     */
+    applyEdit(ops, options) {
+        const label = options?.label;
+        return this.#edit((id) => this.call("applyEdit", label === undefined ? [ops, id] : [ops, id, label], options), {
+            ops,
+            label: label ?? "",
+        });
+    }
+    /** Undoes the newest step of the edit session; the pages it touched are drawn as they were. */
+    undoEdit(options) {
+        return this.#edit((id) => this.call("undoEdit", [id], options));
+    }
+    /** Redoes the oldest undone step. */
+    redoEdit(options) {
+        return this.#edit((id) => this.call("redoEdit", [id], options));
+    }
+    /** Undoes or redoes steps until `position` of the history's steps are done, drawing once. */
+    goToStep(position, options) {
+        return this.#edit((id) => this.call("goToStep", [position, id], options));
+    }
+    /** The edit session's history, read from the worker (after a failed call, which answers none). */
+    async editHistory(options) {
+        if (this.#recovering !== undefined)
+            await this.#recovering.catch(() => { });
+        const opened = this.#document;
+        const history = await this.call("editHistory", [opened?.id ?? 0], options);
+        // A failed edit clears the steps undone: what a restart would replay follows.
+        if (opened !== undefined && this.#document === opened)
+            this.#edits.take({ pages: [], history });
+        return history;
+    }
+    /** The open document's metadata as its edits leave it: Info and XMP read together. */
+    async metadata(call) {
+        if (this.#recovering !== undefined)
+            await this.#recovering.catch(() => { });
+        return this.call("metadata", [this.#document?.id ?? 0], call);
+    }
+    /** How saving the open document with `options` would go: its constraint, signatures, mode and warnings. */
+    async planSave(options, call) {
+        if (this.#recovering !== undefined)
+            await this.#recovering.catch(() => { });
+        return this.call("planSave", [options, this.#document?.id ?? 0], call);
+    }
+    /**
+     * Writes the open document as a save with `options` would, for the caller to write where the
+     * file lives; the document stays unsaved until `adoptEdits(copy.token)`. Save a copy uses it
+     * and never adopts.
+     */
+    async copyEdits(options, call) {
+        if (this.#recovering !== undefined)
+            await this.#recovering.catch(() => { });
+        const copy = await this.call("copyEdits", [options, this.#document?.id ?? 0], call);
+        this.#copy = { token: copy.token, bytes: copy.bytes };
+        return copy;
+    }
+    /**
+     * Makes the copy `token` names the document's saved file, once it is written where the file
+     * lives: the worker rebases onto it, the history marks the point saved, and a restarted worker
+     * reopens that file. Emits `edit` with the history.
+     *
+     * @throws when the document changed since the copy (it stays unsaved).
+     */
+    async adoptEdits(token, call) {
+        if (this.#recovering !== undefined)
+            await this.#recovering.catch(() => { });
+        const opened = this.#document;
+        const history = await this.call("adoptEdits", [token, opened?.id ?? 0], call);
+        const copy = this.#copy;
+        if (opened === undefined || this.#document !== opened)
+            return history;
+        this.#copy = undefined;
+        if (copy?.token === token && this.#reopen !== undefined)
+            this.#reopen = { ...this.#reopen, source: copy.bytes };
+        this.#edits.saved(history);
+        this.#events.emit("edit", { pages: [], history });
+        return history;
+    }
+    /**
+     * Runs one edit session call on the open document, then keeps what it changed: the pages'
+     * sizes in `document`, the steps for a restart, and an `edit` event.
+     */
+    async #edit(call, edit) {
+        if (this.#recovering !== undefined)
+            await this.#recovering.catch(() => { });
+        const opened = this.#document;
+        // 0 names no document: the worker answers `disposed`.
+        const result = await call(opened?.id ?? 0);
+        // Another document opened meanwhile: this answer is the old one's.
+        if (opened === undefined || this.#document !== opened)
+            return result;
+        this.#takePages(opened, result);
+        this.#edits.take(result, edit);
+        this.#events.emit("edit", result);
+        return result;
+    }
+    /** The pages keep their sizes in `document`, for whoever lays them out. */
+    #takePages(opened, result) {
+        if (result.pages.length === 0)
+            return;
+        const pages = [...opened.pages];
+        for (const page of result.pages)
+            pages[page.index] = page;
+        this.#document = { ...opened, pages };
+    }
     /**
      * Every request the document worker has made, and had blocked, since it started: what its
      * `network` and `csp-violation` events reported, including those sent before anyone listened.
@@ -293,6 +415,24 @@ export class ViewerClient {
      * drawn once. An aborted render rejects with `AbortError` and never paints.
      */
     async render(request, options = {}) {
+        const attempt = { interrupted: false };
+        try {
+            return await this.#render(request, options, attempt);
+        }
+        catch (e) {
+            if (!attempt.interrupted)
+                throw e;
+        }
+        // The worker was lost while this render waited: it is sent again, once, in the restarted
+        // worker (ADR 0009 §3.6). A restart that didn't reopen the document (an encrypted one waits
+        // for its password) leaves it nothing to draw from: it ends as cancelled, as for a new open.
+        await this.#recovering?.catch(() => { });
+        if (this.#document === undefined)
+            throw new DOMException("the document closed in a restart", "AbortError");
+        return this.#render(request, options, { interrupted: false });
+    }
+    /** One render; `attempt.interrupted` says a failure was only the worker's loss (see `render`). */
+    async #render(request, options, attempt) {
         const id = this.#nextRender++;
         // A restarted worker numbers its documents again: read the ID once it serves.
         if (this.#recovering !== undefined)
@@ -334,6 +474,13 @@ export class ViewerClient {
             this.#firstDraw?.drawn(documentId);
             return drawn;
         }
+        catch (e) {
+            // Lost with its worker while it waited: a restart is under way, and it wasn't the render
+            // drawing then, which isn't re-sent so a page that crashes the engine can't loop.
+            attempt.interrupted =
+                isLaminaPdfError(e, "worker-crashed") && this.#recovering !== undefined && key !== this.#lost;
+            throw e;
+        }
         finally {
             const own = this.#timers.get(key);
             own?.delete(timers);
@@ -347,8 +494,8 @@ export class ViewerClient {
     }
     /**
      * Stops whatever the worker is doing by terminating it (the user's Stop, or the hard cap), then
-     * restarts it as after a crash: pending calls reject, the running one isn't re-sent, and an
-     * encrypted document asks for its password again.
+     * restarts it as after a crash: pending calls reject, renders that were waiting are sent again,
+     * the running one isn't, and an encrypted document asks for its password again.
      */
     stop(reason = "cancelled") {
         // A restart already under way serves: a second would end the worker it is starting.
@@ -361,33 +508,83 @@ export class ViewerClient {
     terminate() {
         this.#reopen = undefined;
         this.#document = undefined;
+        this.#edits.reset();
         this.#pdf.terminate();
     }
+    /**
+     * Applies the edit session's steps to the document a new worker reopened, which is the file as
+     * first opened. When they can't all be applied again, the session starts over.
+     */
+    /**
+     * `restored`; `lost` when the steps couldn't be replayed, and nothing was sent; `failed` when the
+     * replay failed half way, leaving edits in the model that aren't drawn.
+     */
+    async #restoreEdits(opened) {
+        if (this.#edits.empty)
+            return undefined;
+        const replay = this.#edits.replay();
+        // A replay that can't reproduce the document would show something else as restored.
+        if (replay === undefined) {
+            this.#edits.reset();
+            return "lost";
+        }
+        const { steps, undone } = replay;
+        try {
+            const result = (await this.#pdf.request("restoreEdits", [steps, undone, opened.id], {
+                priority: PRIORITY.document,
+            }));
+            this.#takePages(opened, result);
+            this.#edits.replayed(result);
+            this.#events.emit("edit", result);
+            return "restored";
+        }
+        catch {
+            this.#edits.reset();
+            return "failed";
+        }
+    }
+    /**
+     * Opens the document again in a restarted worker, with its edits: `reopened` when it did,
+     * `edits` what became of the session's steps. An encrypted document waits for its password.
+     */
+    async #reopenAfterRestart() {
+        const reopen = this.#reopen;
+        if (reopen === undefined)
+            return { reopened: false, edits: undefined };
+        if (this.#document?.needsPassword === true) {
+            // The password died with the worker; it is never kept on the page.
+            this.#reopen = undefined;
+            this.#document = undefined;
+            const edits = this.#edits.empty ? undefined : "lost";
+            this.#edits.reset();
+            this.#events.emit("password-required", {});
+            return { reopened: false, edits };
+        }
+        const open = async () => {
+            this.#document = (await this.#pdf.request("openDocument", [reopen.source, reopen.options], {
+                priority: PRIORITY.document,
+            }));
+            // The restarted worker has no extract module yet: its first page goes first again.
+            this.#firstDraw = new FirstDraw(this.#document.id);
+            return this.#document;
+        };
+        const restored = await this.#restoreEdits(await open());
+        // A replay that failed half way left edits in the model that aren't drawn: open the file once
+        // more, as it was. One that never started left the file as opened, so it isn't opened again.
+        if (restored === "failed")
+            await open();
+        return { reopened: true, edits: restored === "failed" ? "lost" : restored };
+    }
     #recover(reason) {
         if (this.#recovering !== undefined)
             return this.#recovering;
+        // Read before the lost calls' rejections run, which clear what was drawing.
+        this.#lost = this.#drawing;
         const recovering = (async () => {
             await this.#pdf.restart();
             await this.#pdf.request("initBackend", [this.#backend], { priority: PRIORITY.document });
-            let reopened = false;
-            const reopen = this.#reopen;
-            if (reopen !== undefined) {
-                if (this.#document?.needsPassword === true) {
-                    // The password died with the worker; it is never kept on the page.
-                    this.#reopen = undefined;
-                    this.#document = undefined;
-                    this.#events.emit("password-required", {});
-                }
-                else {
-                    this.#document = (await this.#pdf.request("openDocument", [reopen.source, reopen.options], {
-                        priority: PRIORITY.document,
-                    }));
-                    // The restarted worker has no extract module yet: its first page goes first again.
-                    this.#firstDraw = new FirstDraw(this.#document.id);
-                    reopened = true;
-                }
-            }
-            this.#events.emit("restarted", { reason, reopened });
+            const { reopened, edits } = await this.#reopenAfterRestart();
+            this.#events.emit("restarted", { reason, reopened, ...(edits === undefined ? {} : { edits }) });
         })();
         const tracked = recovering.finally(() => {
             if (this.#recovering === tracked)