What you can replace

Dialogs you can replace. A replaced dialog is replaced wherever the SDK would open it: the signature hook answers both the Sign tool (field is null) and a form's signature fields (field is that field, and signatureCaptured reports method: 'host'). See Callbacks. Your own security panel, with the Security tool off: new PDFViewer(container, doc, { tools: { security: false } }), then on your lock button await doc.security.protect({ userPassword: form.openPassword, ownerPassword: form.ownerPassword, permissions: { print: true, copy: false, modify: false } }).

Keeping saved signatures and stamps. The signatures a user saves for reuse and the stamps they make with "Create a stamp" last for the page's session: the SDK stores nothing on disk, because a likeness of someone's signature is yours to decide about. To keep them, store what the savedSignaturesChanged and userStampsChanged events give you and pass it back next time, as the example above does. Both lists are plain JSON: a SavedSignature is { dataUrl: string; initialsDataUrl?: string | null; name?: string; method: 'draw' | 'type' | 'upload' } (the signature as an image data URL; the initials, when the user made them; the typed name, for a typed signature); a SavedStamp is either { kind: 'text'; label: string; color: string; dated: boolean; border: 'boxed' | 'ribbon' | 'plain' } (the wording, '#RRGGBB', the placing date under the wording) or { kind: 'image'; label: string; dataUrl: string; widthPt: number; heightPt: number } (the picture as an image data URL and its size on the page, in points). Both types are exported as SavedSignature and SavedStamp.

Both events carry the whole list after every change. The lists are the page's, not the viewer's: every viewer on the page reports the same change. An exception thrown by a handler (a full localStorage, say) is logged with console.error; the user's signature or stamp is kept all the same.

At most three signatures and eight stamps are kept. A restored list is not trusted — it comes from storage the page does not control: an entry that is not an object, a signature whose dataUrl is not an image data URL (PNG, JPEG, WebP, GIF or BMP, at most 10 MB), a text stamp without a label or a hex color, or a picture stamp without an image data URL and positive sizes, is skipped (a picture stamp whose image passes the check but does not decode leaves the list once it fails, and userStampsChanged reports the shorter list); skipped entries do not count toward the limit. Initials that are not an image data URL are dropped, and a missing name or unknown method takes a neutral value. A value that is not a list is ignored with a console warning.

Several viewers on one page share these two lists: a signature saved in one is offered in all. The list a viewer is constructed with replaces the page's, including anything saved in viewers already open, so pass the same, current list to each. Each viewer that has a change callback calls it, so a page with two viewers hears each change twice — harmless when the callback only stores the list.

Watching what the user adds. contentPlaced fires once for each new thing the user adds with a tool, added text included — when it is committed to the document, not while it is being drawn, and not again when it is moved, resized or edited. A duplicate is a new thing and fires. A highlight made from the selection bar reports 'textHighlight', the Mark text tool's name; an underline, squiggly underline, strikeout or black-out made there reports 'selectText'. Signing a form field is not a tool and does not fire it — that is signatureCaptured. Undo does not retract it (it fires documentChanged with source: 'undo', and commentsChanged where comments differ): a host that mirrors what was added should re-read the page's annotations (doc.annotations.list(pageIndex)) rather than count events. The event names the tool and the page, not the annotation itself: viewer.on('contentPlaced', ({ tool, pageIndex }) => audit.log(tool, pageIndex + 1)).

Editing existing text reports through textChanged instead: one event when Edit Text writes a session's edits into the document — on Done, on leaving the tool any other way, before an undo, or from viewer.tools.editText.commit() — with every block it wrote, however many. Each change names the page, the block (the id listBlocks() gave it in the session that ended; the blocks are detected afresh after a commit, so it names the block for a log, not for a later call), what changed — 'text' for the words, whatever changed with them; 'style' for the font, size, weight, slant or color alone; 'box' for a resize or a move alone; 'deleted' — and the block's text before and after, each with its lines joined by one space: the same text for a 'style' or 'box' change, an empty newText for a deleted block. A commit that wrote nothing reports nothing; one whose save failed reports its blocks with the commit that saves them. Under a license without extract the texts are empty, as form values are. It is the audit event for text: a host that saves as the user works listens to documentChanged instead, which carries no text. viewer.on('textChanged', ({ changes }) => { for (const { pageIndex, kind, oldText, newText } of changes) audit.log(pageIndex, kind, oldText, newText); }).

Saving as the user works. documentChanged fires once for every change to the document, after it is in the document, whatever made it — a tool, Manage Pages or a thumbnail's menu, the outline, attachments or comments panel, a form field filled in or signed, the document API, undo or redo — and carries only what made it and the viewer's state after it: source (and tool for a tool's change, where one is active), hasUnsavedChanges, canUndo, canRedo. It is the hook for autosave, for a dirty flag and for your own undo and redo buttons; nothing in it is the document's content, so there is nothing to blank under a license without extract and nothing large to log. A history step that left the document as it was — a snapshot of nothing, a move back to where it started — reports nothing. A form field is outside the history and reports every commit of its value — each keystroke, as formFieldChanged does, and a value set again: debounce the save. 'api' is the document API — the host's call, and the Security tool's, which writes through doc.security. A bookmark or attachment the host writes through doc.outline or doc.attachments reaches a viewer on the document like any other API change: its panel refreshes, it takes an undo step and documentChanged fires; the panels' own edits do the same.

viewer.hasUnsavedChanges is the same flag read directly: true from the first change until the document is exported whole by an exporter from viewer.createExporter() — the toolbar's Download, or download(), getBlob(), getArrayBuffer(), getBase64() or uploadTo() without pages — or until you call viewer.markSaved() after saving your own way (doc.save(), an upload of bytes you already had). "Saved" means the bytes left the viewer: a change made while an export ran is not in them and stays unsaved, and an undo back to the saved state still counts, since what you saved is not what is shown until it is saved again. Whether your upload of those bytes succeeded is yours to track — the flag does not go back to true on a failed upload. Nothing fires when it goes back to false: the export's exportCompleted, or your own markSaved(), is that moment. The page itself is yours to guard, with a beforeunload handler that checks viewer.hasUnsavedChanges, your own upload-failed flag and viewer.tools.editText.hasPendingEdits — see Unsaved changes for the full autosave pattern.

textChanged, contentPlaced, commentsChanged and formFieldChanged still say what changed, for an audit trail or a backend that syncs piece by piece; documentChanged says that it changed.