Native PDF generation, editing, signing, standards-aware output, font optimisation, and imaging for RAD Studio applications

Project Overview

HotPDF is a source-level PDF component library for Delphi and C++Builder. It is built for desktop software that needs deterministic PDF output, direct page drawing, strong RAD Studio integration, and compact deployment

The component covers everyday PDF generation, advanced document assembly, PDF editing, image-heavy output, forms with duplicate field-name guards, annotations, creation-time AcroForm field wrappers, reusable action-builder chains for open actions, document lifecycle actions, page additional actions, annotation actions, annotation additional actions, AcroForm additional actions, encryption, signing workflows, font optimisation, and stream-based workflows from a single native API surface

The loaded-document toolkit adds page-range deletion, outline-aware and AcroForm-aware merging, multi-widget form constraint, geometry, visibility, rotation, border, and colour editing, complete annotation editing, automatic activation of bare web and email addresses, stateless next-match search, complete typed outline snapshots, Windows certificate-store signing, deterministic collated printing with paper capability discovery, full-page, bounded-region, and pixel-bounded Viewer snapshots, cache-aware adjacent-page prefetch, persistent page highlights, rotation-aware marquee selection, current-view printing, keyboard and wheel navigation, and VCL viewer components

Recent library releases expanded HotPDF from a classic PDF writer into a broader native PDF toolkit covering version-specific PDF 1.3 / 1.4 / 1.5 / 1.6 / 1.7 feature gating, native PDF 2.0 output, PDF/A-1 / -2 / -3 / -4 + PDF/X-1a / -3 / -4 + PDF/UA-1 / -2 standards conformance, PAdES baseline / extended / long-term-validation digital signatures, an in-process PFX / PKCS#12 signing pipeline with native RSA and ECDSA plus optional OpenSSL 3 Ed25519 and Ed448, credential-preserving Standard and public-key encrypted incremental updates with stable permanent IDs, rotating modification IDs, byte-exact source prefixes, and byte-exact no-op saves, CFF / OpenType / CID-keyed CFF font subsetting, and PDF export adapters for FastReport, QuickReport, ReportBuilder, and DevExpress ExpressPrinting that route their existing reports through HotPDF as a single PDF backend. A Direct File API processes multi-gigabyte, million-object PDFs file-to-file - page counts, copies, document-information rewrites, and AES-256 encryption or decryption - in seconds, while the bounded recovery loader can relocate a valid xref section or rebuild direct-object offsets after damaged startxref and xref data without trusting nested object-like text or binary data, and publishes byte-ranged recovery events with explicit confidence levels

The opt-in LinearizeOutput writer adds fast web view output with a first-page dependency section, shared-object grouping, primary page and shared-object hint tables, and an early compatibility cross-reference table while retaining direct file and stream destinations

Loaded stream filters run through a reusable pipeline whose final stage writes directly to caller-owned streams and whose intermediate stages spill through independently compressed blocks and a bounded asynchronous batch queue, with strict ASCII85 and ASCIIHex end markers, independent per-chain and document-wide decoded-byte ceilings, filter-count and pipeline-depth limits, indirect-reference cycle detection, same-stream recursion rejection, and structured diagnostics for every success or failure

Predictor encoding now exposes strict reusable TIFF and fixed or adaptive PNG paths for packed, 8-bit, and 16-bit rasters; loaded images can copy native or generically decoded payloads directly to caller streams, while selective optimisation uses memory-to-disk spill buffers, a deterministic four-strategy zlib baseline followed by budgeted Zopfli block splitting, and bounded parallel image jobs that commit only smaller payloads in source order

Loaded JPEG and JPEG 2000 recompression can run bounded quality trials and select a deterministic output by jointly scoring sampled perceptual error and relative encoded byte cost, subject to explicit visual-error and minimum-savings limits

Large local documents use bounded windowed memory mapping with a shared LRU cache for parser reads and immutable lazy stream ranges, while mapping thresholds and window geometry remain configurable and failures fall back automatically; raw compressed ranges, decoded images, compiled display lists, and rendered raster pages have independent entry-count, total-byte, and per-entry admission limits, combine recency with aging fixed-memory frequency admission to resist scan pollution, and expose occupancy, traffic, and frequency statistics; a fair process-wide peak-memory scheduler delays competing document loads, renders, stream optimisation, and parallel image optimisation before their main working sets overlap, while preserving cancellation and reporting admission pressure; unencrypted stream serialisation and caller-directed transfers write memory, mapped-file, lazy-file, adaptive-cache, and range-cache bytes without an intermediate full-stream copy; short-lived parser tokens and buffers use a retained block arena across loads, simple dictionaries and arrays scan immutable spans with direct numeric conversion and single-pass nesting, configurable byte, aggregate-token, container-entry, and malformed-token budgets stop hostile input with typed telemetry, dictionary keys no longer require temporary name objects, and repeated names, content operators, and immutable short strings share a bounded document-scoped pool; modified loaded streams use LoadedStreamMemoryThreshold to select memory or an owned compressed temporary stream whose raw and compressed blocks share a bounded asynchronous write queue; object-stream members are indexed by object number and parsed only when referenced, while LoadFromRandomAccessSource connects HTTP range readers and custom storage, coalesces adjacent reads through a bounded cache, adaptively grows asynchronous read-ahead during sustained forward parsing, suppresses speculative transport after random jumps, cooperatively cancels in-flight work for foreground seeks, recovers password keys from bounded trailer, xref, document-ID, and encryption-dictionary ranges without requesting the complete source, captures exact binary security-handler entries from the authoritative object offset so delayed decryption needs no source reread, exposes the first linearised page from its self-contained prefix, and plans bounded minimal bootstrap, hint, page, shared-object, and cross-reference ranges for any later page while accepting legal short reads and both interoperable and Annex F hint layouts under strict memory and structure limits

Mapped local files now adapt within the configured byte cap: sustained forward reads use larger views to reduce remapping, sustained distant or backward reads retain up to 16 smaller MRU views, mode changes require repeated evidence, and THPDFMappedFileStatistics reports active geometry, peak mapped bytes, access-pattern counts, and transitions

HotPDFABI.dll exposes a versioned flat C ABI with layout-checked Win32 and Win64 callback structures, validated opaque handles, fixed status codes, 64-bit random-access reads directly into parser buffers, retryable streamed writes, explicit byte lengths, cancellation, progress, and diagnostics; build-HotPDF-ABI.cmd produces the DLL and import library for each platform

JSON and C ABI document operations share capability discovery, rendering, Unicode text and forms, OCR layers, redaction, PFX signing, and bounded PDF/A-4 raster archival conversion through a versioned schema, resource budgets, callback rollback, and atomic file output; archival requests explicitly accept information loss and preserve their loaded source

Windows and Linux typed JSON rich-text runs accept explicit normal, numeric, point, percentage and em line heights with bounded computed metrics, supplied parent font admission and transactional saved appearances; Linux rejects rich runs on non-text fields and preserves exact source bytes for unchanged rich-only fills

Native rich text and imported inline CSS preserve explicit line height, inherited factors, computed lengths and parent font metrics across wrapped lines, saved appearances and read-only fields; native records, Windows file jobs and callbacks, and Linux FDF/XFDF JSON imports share bounded font admission and cancellation-safe planning

Legacy XFA text, numeric, date and password fields create real Unicode font appearances with effective instance styles, editable font resources and cancellation-safe adoption; password appearances count supplementary characters as single Unicode scalars

Native sampled colour functions support bounded multidimensional cubic interpolation with the existing four-knot convention, short-dimension linear fallback, packed samples and cancellation across tint and shading evaluation

Native Cairo JPEG 2000 rendering accepts signed and unsigned source precision through 26 bits, mixed component depths, subsampling and opacity, and honours JPX image declaration semantics through Windows and Linux native APIs

Free Pascal builds need FPC 3.3.1 or later on every platform; current acceptance records the actual compiler build, and existing results from older compilers remain historical evidence

FPC native backends provide TIFF, JPEG/JPX, ICC, JBIG2, and Zopfli through a validated Windows codec bridge, together with actual parallel page, ordered-page, tile, band, and JPEG 2000 tile rendering

Deterministic differential regression probes compare named engines across parse, render, text, and save domains, repeat each result to detect instability, isolate exceptions, enforce input and output bounds, provide built-in SHA-256 HotPDF fingerprints, and emit the ordered hotpdf.differential.v1 JSON schema

The native statistical performance regression harness isolates Win32 and Win64 load, save, render, and extraction workloads, records warmups plus 30 raw samples with p50, p95, sample variance, RSS, process I/O, deterministic fixture identity, and environment metadata, and fails against versioned JSON thresholds

Continuous malformed-PDF corpus storage revalidates and re-minimises every failure case under configurable bounds, keeps the smallest signature-equivalent input across runs, serialises competing writers with a process-safe lock, and atomically publishes SHA-256-addressed PDF and hotpdf.corpus.case.v1 metadata files

Unified operation telemetry separates scheduler reservation and queue delay, wall time from current-thread CPU time, portable component-retained memory from sampled process working set, and encoded input from final decoded output, while also reporting peak additional live allocations, process I/O byte deltas, cache activity, aggregate filter work, and decode expansion

Bounded deterministic replay logs capture cancellation checkpoints, random-access range availability, and boolean or integer callback outcomes in an ordered JSON schema; strict replay validates every event signature and substitutes recorded decisions so intermittent external timing and callback behaviour can be reproduced without changing document operations

Revision-aware loading now validates xref free lists and generation transitions while retaining bounded details for duplicate and shadowed object definitions; destructive incremental edits merge existing and newly freed objects into a complete deterministic free chain, advance generations with saturation, preserve dirty-object generations, and expose rebuild statistics; explicit clean, dirty, released, and must-write object states support low-memory post-save object-stream cache release, while deterministic dictionary order, streaming versioned object graph JSON snapshots and incremental updates, editable QDF diagnostic output with bounded stream-length and xref repair, bounded dependency edges, and dominator-based retained-memory attribution make structural inspection reproducible

Searchable OCR text layers connect an application-selected recogniser to bounded page rendering, validate confidence, Unicode and pixel geometry, invert page rotation for aligned invisible text, optionally bind output to one OCG, and commit every selected page through one graph transaction; marked HotPDF OCR layers can be replaced safely after saving and reloading, adjacent Latin and Cyrillic words gain explicit Unicode spaces, and the SearchableOCR console example generates scan samples and converts selected pages with built-in OCR, RapidOCR, or Tesseract DLL/CLI engines, configurable limits, and conversion statistics

Scan preprocessing and structured OCR adds evidence-based page orientation, continuous-angle deskew, border/shadow cleanup, explicit perspective rectification, reversible raster/page geometry, and semantic text/DOM output through an application-selected OCR engine

The built-in OCR engine recognises regular, bold, italic, and bold italic ASCII text, including faded lettering and light text on a predominantly dark page; words with uncertain retained glyphs are omitted as a whole to prevent silently dropping characters, blank or unrecognised pages complete successfully, and Windows FPC preserves 24-bit and 32-bit input pixels

The optional native Tesseract DLL adapter provides configurable page segmentation and engine modes, multilingual Unicode recognition, confidence, word bounds, and baselines through HPDFCreateTesseractDLLOCREngine in Delphi, C++Builder, and Windows FPC/Lazarus builds

The local Tesseract CLI adapter also accepts THPDFTesseractOptions for single-line, single-word, sparse-text, and vertical-block layouts, with explicit engine mode, timeout, and input pixel limits; the native DLL adapter uses baseline direction to keep vertical word lengths from inflating the searchable text size

The RapidOCR local model adapter adds explicit ONNX model paths, optional angle classification, local dictionaries and fonts, CPU thread controls, offline preflight, exact recognised line spacing, and bounded Unicode recognition through THPDFRapidOCROptions in Delphi, C++Builder, and Windows FPC/Lazarus builds

The native RapidOCR DLL adapter keeps CPU ONNX models in process and recognises memory snapshots through HPDFCreateRapidOCRDLLOCREngine, with THPDFRapidOCRDLLOptions.ForLanguage presets for Simplified and Traditional Chinese, English, Japanese, Korean, Russian, common Latin languages, Arabic, and Hindi, verified local model packages, horizontal reading order, optional angle classification, Unicode text, bounded output, and cooperative cancellation in Delphi, C++Builder, and Windows FPC/Lazarus builds

Optional local Tesseract and RapidOCR adapters provide cancellable Chinese OCR with explicit executable and model paths; JSON and C ABI OCR jobs expose the CLI and DLL adapters through explicit engine settings and bounded searchable-PDF output; the built-in engine remains the default, and external engines, Python packages, models, and RapidOCR's local Arial prerequisite must be provisioned separately

OCR validates local TSV encoding and native detection tensor contracts before using results, counts discarded words against cross-page recognition limits, and stops atomically when the remaining budget cannot cover another eligible page

SetLoadedFreeTextPlainText explicitly replaces a supported loaded FreeText annotation's appearance with left-aligned ASCII Helvetica text for rewrite or incremental saving, whilst SetLoadedAnnotationContents changes only its stored contents

SetLoadedFreeTextText rebuilds loaded Unicode and rich FreeText appearances with embedded fonts, wrapping, alignment, opacity, rotation, and atomic overflow handling; SetLoadedFreeTextRichText now updates both visible appearance and stored content

Loaded-page barcode decoding renders a complete page or media-box-contained region in progressive bounded slices, lends each original or quarter-turn raster to an application-selected decoder, validates Unicode, raw bytes, confidence and bounds, reverses raster and page rotations into PDF user space, and deduplicates overlapping payloads

Review-first redaction detection combines checksum-aware built-in PII patterns with application-selected entity and face detectors, maps every accepted span or raster rectangle into PDF page space, starts every finding as pending, and atomically stages only findings carrying both explicit approval and reviewer identity without burning in content

Loaded-page colour rewrite converts selected paint to DeviceGray, DeviceRGB, or DeviceCMYK, retains ordinary device-colour text and paths as searchable vectors, renders images, Forms, patterns, shadings, transparency, ICC, and Type 3 colour through one lossless process image when required, preserves spot-bearing pages by default, and commits the complete bounded batch atomically

Structured loaded-page export writes selected pages as UTF-8 HTML, XHTML, XML, or JSON from one accessible reading model, preferring tagged order and retaining document language and title, headings, lists, tables, figures, alternatives, outlines, page labels, safe links, annotations, and non-sensitive form controls under atomic cancellation and byte budgets

Typed table extraction converts detected table geometry into a public canonical grid, joins compatible fragments and adjacent pages, marks repeated headers and merged column spans, infers locale-controlled integer, number, boolean, date, date-time, currency, and percentage values with confidence, and writes bounded CSV or metadata-rich JSON atomically

Optional document handlers recognise XPS, EPUB, and CBZ from inspected content, preserve fixed-page, spine, or natural image order, convert XPS abbreviated paths and property-element solid, multi-stop linear, or elliptical radial gradient brushes to native PDF vectors and shading patterns, fill paths from cached package JPEG, PNG, TIFF, or JPEG XR ImageBrush resources with bounded viewbox and viewport mapping, brush-local transforms, native repeated or reflected image patterns, and PNG soft-mask alpha, apply solid, gradient, or image Path.OpacityMask values through folded alpha or shared DeviceGray transparency groups, composite overlapping Canvas descendants once through isolated DeviceRGB groups for Opacity and Canvas.OpacityMask, compile inline or resource-backed XPS VisualBrush trees into reusable Form XObjects and bounded tiling patterns, map bounded transformed and structured Canvas.Clip geometry to nested native PDF clipping paths, preserve bounded XPS Glyphs clusters, exact package font programs and glyph IDs, explicit advances, offsets, RTL origins, opacity, resource reuse, Unicode extraction, transformed HTTP, HTTPS, mail, package-page, and LinkTarget navigation through clipped native PDF annotations, inherit Canvas-scoped navigation through descendant visuals with nested overrides, emit positioned TJ runs, enforce shared archive, resource, reflow, page, link, URI, geometry, group-content, pixel, output, and cancellation budgets, and reuse one immutable PDF cache for atomic export and rendering

CSC remote signing connects the existing CMS provider pipeline to CSC API v2 services through an application-owned HTTP transport, with OAuth refresh, credential-chain discovery, exact hash-pinned SAD handling, bounded ordered multisign batches, synchronous or asynchronous signing, bounded polling, RFC 3161 timestamps, cancellation, SHA-256 content-addressed idempotency keys, and a finite completed-operation cache

Nested copy-on-write object graph transactions snapshot each touched indirect root once per savepoint, preserve root addresses during rollback, restore object-number allocation, remove appended roots, spill large stream history beyond a configurable threshold, and expose resident and file-backed snapshot statistics

Reusable layout elements support side-effect-free measurement, verified split heads, and owned overflow continuations for paragraphs, rows, containers, and custom content; declarative page callbacks compose backgrounds, headers, document content, footers, and foregrounds in stable order, while unbounded reports retain file-backed page staging, paragraph constraints, bounded diagnostics, semantic helpers, and bidi direction control

Loaded-page rendering executes coloured and uncoloured tiling patterns plus axial, radial, free-form and lattice Gouraud, Coons patch, and tensor-product patch shadings for fills and strokes, honours pattern matrices in the parent content default coordinate system, supports all three tiling types and signed steps, isolates each cell path, applies uncoloured base tints to fill and stroke operations, and bounds recursive pattern depth, tile execution, mesh decoding, and adaptive tessellation for hostile resources

Production bitmap, direct-DC, Form and display-list replay now share one content-token interpreter with per-operator cancellation; compiled display lists cache operator indexes for operand-scan-free replay and expose the command count through THPDFPageDisplayList.OperatorCount and THPDFDisplayListInfo.OperatorCount, while the renderer retains its complete graphics and resource state machine

Isolated and knockout transparency groups render through bounded 768-pixel tiles with absolute device-coordinate continuity, tile-local alpha and soft-mask storage, single-pass Form decoding and tokenisation, deterministic nested-group state restoration, and peak working-set statistics available through GetLastTransparencyGroupTileStats

Opt-in overprint proofing preserves process plates that a paint does not name, applies /OPM 1 zero-component protection for DeviceCMYK, treats DeviceGray as the black process plate, and combines Separation and DeviceN spot tints through their alternate colour transforms

Repeated Type 3 glyphs reuse bounded CharProc display lists keyed by font, glyph, linear matrix, and colour state, avoiding repeated stream decoding and tokenisation while preserving translation, clipping, nested resources, d0/d1 colour rules, and recursion limits

Progressive loaded-page sessions decode eligible progressive DCTDecode images one scan per bounded continuation for earlier visible previews, expose scan and image counters through THPDFLoadedPageRenderSession, and provide cancellable THPDFProgressiveJPEGScanEvent notifications while retaining the complete-image fallback for unsupported paint state or decoding failures

Progressive region sessions allocate only the requested user-space window, retain graphics and text state across bounded continuations, use conservative display-list bounds to cull unrelated paths, text, images, Forms, and shadings, and expose visible and culled paint counts for telemetry

JPEG 2000 decoding validates individual codestream tiles, combines source-region and resolution-of-interest reconstruction, and concurrently decodes independent visible tiles with private codec state, cancellation, CPU and user worker limits, deterministic composition, and automatic peak-memory budget fallback

Loaded-image cache hits now return immutable reference-counted decoded bitmap handles that survive eviction and document destruction, support thread-safe direct drawing, preserve isolated mutable copies on demand, and eliminate repeated pixel copies from renderer warm paths

Parallel loaded-page rendering now overlaps display-list compilation with playback across dynamically balanced workers, compiles unrelated pages outside the cache lock, begins output before the full input set is compiled, preserves input order, and reports stage concurrency, cache use, completion, and latency telemetry through THPDFParallelRenderPipelineInfo; RenderLoadedPagesParallelOrdered adds calling-thread callbacks with a bounded completed-bitmap queue, ordered-window backpressure, cooperative callback cancellation, and borrowed bitmap lifetimes for jobs whose complete raster output must not remain resident

Both parallel page APIs now use the process-wide peak-memory scheduler to reduce requested workers from conservative page estimates, reserve every claimed page, delay work fairly under pressure, and report memory-derived concurrency, peak reserved bytes, admissions, delays, and wait time; ordered callbacks keep output reservations active until bitmap release so queued rasters and active workers share one budget

RenderLoadedPageTilesParallel and RenderLoadedPageBandsParallel stream one page through isolated workers with row-major tile or top-to-bottom band delivery, borrowed bitmap lifetimes, cooperative cancellation, caller-controlled in-flight memory, and a bounded immutable cache for Type 3 glyph token sequences and halftone threshold screens

SaveLoadedPageToPng, SaveLoadedPageToPngStream, SaveLoadedPagesToTiffBanded, and SaveLoadedPagesToTiffStreamBanded feed the same band renderer into streaming PNG or TIFF encoders, emitting compressed rows without a complete framebuffer and reporting band, row, worker, memory, output, timing, and cancellation telemetry

Pluggable loaded-page render backends receive compiled display lists and document resource access, advertise concurrency and colour-management capabilities, participate in synchronous and parallel rendering, invalidate stale raster caches when replaced, and expose deterministic failure, fallback, and execution statistics; the built-in native GDI backend preserves existing output without claiming device acceleration

Loaded-page prefetch now compiles and renders outside the cache lock with cooperative cancellation checkpoints, yields immediately to foreground page rendering, and reports request progress, cache use, failures, preemption counts, and cancellation latency through THPDFLoadedPagePrefetchInfo

Foreground cached renders acquire their normal memory reservation before overlapping an existing bitmap copy with prefetch cancellation, retain strict miss ordering and accurate operation telemetry, and recheck cancellation after waiting for a reservation or cache lock

JBIG2 segment-graph validation now checks both image and global streams before native or external decoding, rejects malformed dependencies and invalid embedded organisation within explicit segment, edge, depth, and symbol budgets, and prevents invalid shared dictionaries from entering the globals cache

JBIG2 batch encoding now trains symbols across the complete page set through the external static backend, shares one global dictionary across every image XObject, collapses exact duplicate pages, falls back to the native accumulator when allowed, and publishes backend, size, symbol, and budget telemetry

ICC-based vector and image rendering applies complete source, proof, output and sRGB colour pipelines with selectable rendering intent and black-point compensation, while a thread-safe bounded LRU cache reuses transforms across document and renderer instances

Loaded-image recompression and effective-DPI downsampling retain calibrated output definitions, while transparency flattening emits calibrated RGB and preserves Separation or DeviceN pages as vector content instead of discarding spot-colour identity

Loaded AcroForm calculation and validation actions can use a bounded typed expression subset with booleans, numbers, strings, null, undefined, arrays, conditional and short-circuit operators, deterministic UTC dates, and allowlisted string, array, conversion, and Math helpers, while unsupported active scripting fails closed without starting a JavaScript engine

The optional QuickJS runtime bindings execute broader application-controlled JavaScript through either static objects or an ABI-neutral bridge DLL on Win32 and Win64, with configurable memory, stack, script, time, and interrupt limits plus explicit status and recovery semantics

XFA form scripting extends bounded FormCalc with conditional logic, repeated numeric arrays, and validated instance callbacks, while an explicitly enabled QuickJS sandbox adds full control flow and native typed arrays without exposing file, process, browser, or network objects; the interactive dynamic XFA runtime adds host-neutral focus, Unicode editing, hit testing, instance-aware validation and calculation, atomic rollback, and bounded reflow without flattening

Native XFA list selection windows use actual embedded-font line metrics to keep selected options visible, save the top index with complete option and value arrays, and preserve repeated-instance font changes and event rollback with bounded visible glyph preparation

SanitiseLoadedDocument applies JavaScript-only, active-content, or strict untrusted-document policies to loaded PDFs, removes unreachable payload objects, compacts live object numbers, and safely rewrites in place through atomic file replacement

Preflight JSON, HTML, and veraPDF-style findings expose stable namespaced rule identifiers and structured PDF locations with logical scope, path, key, and exact object, page, or byte coordinates when available, while text and CSV compatibility remains unchanged

Reusable validation policies now combine structural preflight with strict or WTPDF intake requirements, extract canonical declaration and claim metadata, run ordered file batches through bounded worker and queue limits, preserve source-aware errors, and offer inspect, add-missing, and synchronise modes for XMP repair independently of structural PDF repair

Factur-X and ZUGFeRD intake now cross-checks the primary invoice attachment MIME type and FileSpec names against the EmbeddedFiles and Catalogue AF registrations, exposes the decoded MIME type and XMP namespace URI, and rejects mismatched XMP document types or extension namespaces

Built-in e-invoice business-rule validation executes all profile-specific Schematron checks with reviewed XPath 2 compatibility, external code databases, stable rule identifiers, explicit evaluation errors, secure XML parsing, and fail-closed combined verdicts

Incremental signing jobs retain previous signatures and fill existing fields through PFX credentials, while two-document comparison jobs expose six comparison modes and two-sided contract JSON, HTML and annotated-PDF artefacts through versioned JSON and the unchanged ABI v1 layouts

Native Unicode AcroForm appearances fill supported single-line fields with genuine embedded TrueType, exact glyph widths, CID-to-glyph mapping and supplementary ToUnicode, update every widget transactionally, preserve AES security, and render consistently before and after atomic saving

The versioned native Linux C ABI delivers actual text, form, PNG and encrypted signing operations through bounded callbacks; real C and Python clients run on Ubuntu 24.04, Ubuntu 26.04 and Debian 12, including concurrent handle use, cancellation and failure rollback

Native Linux PDF-to-PNG rendering uses Cairo/FreeType CPU surfaces and shared bounded content interpretation for paths, text, images, Forms and existing annotation appearances, with canonical standard-font advances, cooperative cancellation, source protection and atomic PNG publication

Native headless PDF signing fills an existing unsigned signature field, preserves the original revision and AES-256 security, verifies the resulting CMS/CAdES against the exact file bytes, and atomically publishes a genuine incrementally signed PDF from explicit PEM credentials

Native headless CMS streams shared ByteRange segments through OpenSSL 3, verifies existing PDF signature revisions, generates detached CMS/CAdES from explicit PEM credentials, and distinguishes integrity from explicit CA trust

Native headless AES-256 security opens R5/R6 documents with user or owner passwords, authenticates encrypted permissions, decrypts compressed objects and content, and publishes encrypted incremental form values while preserving the original source prefix on Linux and Windows

Dynamic XFA instance presentation supports bounded conditional events, explicit repeated data binding, independent presence and access, stable persisted identities, host canvas painting and accessibility records; this helper interprets its own form packet extension, which external XFA readers do not automatically apply

Bounded paragraph editing reflows selected text across baselines and supported shared Form invocations with explicit font and rectangle controls, conservative collision reports, sealed preview, commit and rollback; repeated saves retain the serialised edited graph

Version 2.825.0: Sign encrypted documents through Windows JSON and C ABI jobs while preserving the original revisions, AES security settings, document IDs and signature permissions

Version 2.826.0: Read and write Unicode array-valued choice selections, maintain sorted option indices and generate matching appearances for visible and scrolled list-box selections

Version 2.827.0: Execute locale-aware XFA date, time, numeric and text pictures with embedded locale sets, bounded transactional locale queries and protected JavaScript IEEE arithmetic

Version 2.828.0: Render four-component CMYK and ICC transparency groups and page groups with all blend modes, nested knockout geometry and shared colour-profile budgets

Version 2.829.0: Import native page resource graphs and transformed annotation appearances into plain or encrypted documents and convert compatible inputs to searchable text and vector PDF/A-4 with genuine validation before atomic publication

Version 2.830.0: Execute advanced XFA numeric, calendar, text and compound picture clauses through real form events, preserving input precision, locale semantics and transactional script replay

Version 2.831.0: Apply signing seed, lock and read-only constraints consistently to encoded PDF names, reject semantic duplicate keys and validate inherited policy dictionaries

Version 2.832.0: Sign through the native Linux callback ABI with PEM or bounded PFX identities, new Unicode appearance fields and certification, and retain the prepared signed document as the current context after successful publication

Version 2.833.0: Render vertical Identity-V and Unicode predefined CMaps with real W2/DW2 origins, matrices, text movement and clipping, and correctly decode embedded Encoding CMap streams

Version 2.834.0: Validate CAdES signing-certificate identifiers against the actual signer independently of optional certificate trust, and resolve embedded Encoding CMap streams through the native font adapter

Version 2.835.0: Execute transactional XFA host state, page and lifecycle flags, per-instance focus changes, pending-edit validation and reset operations with stable identity and lexical-state replay

Version 2.836.0: Provide synchronous RFC 3161 timestamp transport through a compatible extended native signing operation record, with bounded responses, shared cancellation and explicit TSA trust and revocation validation

Version 2.837.0: Generate embedded Unicode appearances through native Linux JSON form filling for text, choice and multiselect fields, checkbox and radio states, and push-button captions, retaining transactional publication and encryption

Version 2.838.0: Execute runtime-generated FormCalc Eval programs with isolated calculation scopes, nested evaluation, Unicode source, bounded compilation retries and transactional host response replay

Version 2.839.0: Implement FormCalc value copying and stable node references with assignment-through-reference, rebinding and null detachment, numeric identity equality, retained handles and transactional rollback

Version 2.840.0: Render calibrated CalGray, CalRGB and Lab source colours, calibrated group and page blending, Indexed bases, 16-bit image samples and XYZ luminance soft masks with bounded conversion and safe gamma evaluation

Version 2.841.0: Authenticate original CMS and CAdES revisions before native form updates, enforce original DocMDP and FieldMDP permissions and locked fields, preserve signed content and resources, and synchronise push-button caption metadata atomically

Version 2.842.0: Provide native two-document C ABI and Pascal semantic contract comparison through a shared portable core, with source glyph geometry, encrypted and nested-content inputs, prepared JSON or HTML review output and stable concurrent lock ordering

Version 2.843.0: Resolve dynamic XFA SOM paths with inferred and relative occurrences, scoped predicates, class and descendant selectors, wildcard collections and transactional script-object property assignments

Version 2.844.0: Render Separation and DeviceN alternate tints with bounded vector functions, packed images and CMYK group blending, preserve None knockout geometry and map All registration colours consistently

Version 2.845.0: Emit authenticated FieldMDP references from existing or inherited signature field locks, preserve encrypted Unicode field names and certification references, and apply lock permission levels without weakening original signed policies

Version 2.846.0: Expose native XFA datasets and data nodes with bidirectional form bindings, dynamic instance data mirroring, stable retained references, independent unbound form values and transactional script replay

Version 2.847.0: Enforce inherited native signature seed and certificate constraints with real issuer chains, subject and key usage policies, selectable CMS digests, encrypted Unicode signature metadata and locked-document transforms

Version 2.848.0: Resolve complete XFA descendant path suffixes within each wildcard context, preserve local occurrence boundaries and execute predicates in the current event scope with exact transactional rollback

Version 2.849.0: Render embedded simple Type1 and Type1C fonts with exact declared or built-in Adobe glyph encodings, keep ToUnicode extraction separate from displayed outlines, and accept validated neutral stroke-adjustment and relative colorimetric graphics state

Version 2.850.0: Convert compatible missing-font documents to searchable text and vector PDF/A-4 with explicit bounded Ghostscript font embedding, genuine veraPDF validation and atomic publication, and select native Unicode TrueType fonts consistently across distributions

Version 2.851.0: Render physical Lab ICC source colours and bounded XYZ compatibility inputs in paths, text, packed images and Indexed palettes, preserve calibrated and ICC alternate tints through RGB or CMYK groups, and apply embedded JPX profiles with separate or associated alpha

Version 2.852.0: Write authenticated Unicode legal attestations in certification signatures, honour certification-only Legal seed requirements, preserve existing legal statistics and catalogue permissions, and retain encrypted string policies

Version 2.853.0: Embed genuine Adobe revocation evidence as authenticated CMS signed attributes, validate complete certificate and timestamp chains against explicit trust and current CRL or OCSP evidence before publication, and enforce required signature seed revocation embedding

Version 2.854.0: Expose native XFA property and attribute objects with persistent per-instance form bindings, synchronised value/data writes and actual font, border, paragraph and UI layout effects, preserving transactional rollback and scriptless focus budgets

Version 2.855.0: Apply native XFA property schema defaults and preserve explicit empty values, per-instance styles and fractional point font, border and draw measurements through actual AcroForm and flattened PDF output

Version 2.856.0: Select actual native signature appearance presets by registered profile name, generate distinct approval, certification and compact layouts, preserve authenticated profile metadata and encrypted policies, and reject unknown profiles before publication

Version 2.857.0: Compare native documents by page and object counts, Unicode text, normalised structural graphs and actual rendered RGB or luminance pixels, with semantic stream equivalence, authenticated encrypted inputs and bounded preparation before callback publication

Version 2.858.0: Decode escaped PDF font, encoding, glyph, colour and resource names exactly once in native rendering and shared text extraction, preserve literal hash resource keys and keep equivalent names aligned with actual outlines and glyph metrics

Version 2.859.0: Apply live per-instance XFA font, paragraph and scalar body overrides to actual rich text drawing and measurement, preserve inline CSS precedence and explicit empty content through native XDP persistence, and retain exact transactional rollback

Version 2.860.0: Bind native Linux signing and verification options to actual digest selection, Unicode signature metadata, named appearance profiles, explicit trust bytes, timestamp transport identity and authenticated revocation evidence, with bounded private preparation before publication

Version 2.861.0: Export actual native annotated contract review PDFs and explicit Unicode highlights with visible normal appearances, preserving source content and incremental signature revisions, enforcing authenticated P3 annotation permissions and encrypted user rights, and preparing bounded outputs before callback publication

Version 2.862.0: Render actual native function, axial and radial PDF shadings with bounded geometry and function evaluation, inherited clipping, Domain, Matrix, Extend and BBox semantics, calibrated and special colours, transparency, soft masks, blending and knockout groups

Version 2.863.0: Honour valid inherited Windows signature seed and certificate constraints with actual digest and CAdES selection, Unicode signature information, normalised indirect field locks, authenticated historical lock permissions, permitted second signatures and encrypted form policies

Version 2.864.0: Preserve the original barcode scan deadline by prioritising complete linear rasters and quiet-zone candidate groups, and reject invalid DataMatrix projective finder borders before sampling interior modules without changing finder tolerances

Version 2.865.0: Request and authenticate RFC 3161 timestamps for explicit SHA256, SHA384 and SHA512 message imprints without hashing the imprint again, preserving strict digest lengths, fresh nonces, bounded transport, trust chains and revocation validation

Version 2.866.0: Align mixed-size XFA rich text runs to a common saved-PDF baseline, preserve the caller text-position mode, and apply the larger adjacent paragraph margin including empty paragraph transitions

Version 2.866.1: Authenticate raw-signature RFC 3161 tokens using their actual supported SHA256, SHA384 or SHA512 message imprint algorithm while retaining the existing SHA256 request default and full token trust and revocation checks

Version 2.867.0: Wrap XFA rich text across inline styles with measured word boundaries, explicit line breaks, shared line baselines and alignment, actual justified word gaps and fragment link geometry, preserving native repeated-instance XDP persistence

Version 2.868.0: Generate masked password and literal file-select field appearances with preserved Unicode values and AES-256 policies, carry escaped supplementary Unicode through the native JSON ABI, retain subnormal PDF decimal source tokens, and create RGB prefetch buffers without a screen DC

Version 2.869.0: Sign Windows documents with real synchronous C ABI RFC 3161 transport callbacks and SHA256, SHA384 or SHA512 imprints, authenticated TSA trust and CRL checks, required timestamp seed constraints and bounded transactional publication

Version 2.870.0: Render actual native Windows Cairo output with explicit GDI standard-font outlines and correct Win32 OpenJPEG calling conventions, using reproducible pinned native dependencies and independent output acceptance

Version 2.871.0: Create missing XFA font, paragraph, fill, colour, border, edge and corner properties through actual native event scripts, persist stable per-instance form bindings with exact rollback, and regenerate optional widget appearances after effective style changes

Version 2.871.1: Execute XFA event bodies in their own lexical and strict scope while preserving field aliases in the outer scope, the event this value, explicit returns and exact failure rollback

Version 2.872.0: Create actual Windows DocMDP certification signatures with P1, P2 or P3 permissions and authenticated Unicode legal attestations, honour required seed policies and FieldMDP locks, and permit subsequent signatures only where the signed policy allows them

Version 2.873.0: Create persistent per-instance XFA UI choices through native scripts and consume actual text, password and choice widgets with multiline and measured long-word appearances

Version 2.874.0: Edit native rich-text fields with typed Unicode style runs, actual embedded regular, bold, italic and bold-italic fonts, measured mixed-size appearance baselines, decorations and synchronised V/RV values across widgets and encrypted output

Version 2.875.0: Resolve actual XFA field defaults without manufacturing data while reading, preserve explicit empty instance values and ensure edits write independent instance data without modifying shared templates

Version 2.876.0: Embed authenticated CRL and OCSP evidence in signed Windows Adobe RevocationInfoArchival attributes, enforce actual seed policies and validate trusted status, response authorisation and freshness before publishing signatures

Version 2.876.1: Preserve complete XFA SOM binding and actual emitted-instance data selection while applying missing-instance form and template defaults, without borrowing values from another repeated occurrence

Version 2.877.0: Render actual coloured and uncoloured PDF tiling and shading patterns with inherited pattern origins, nested cells, overlap, stroke and stencil paints, transparency and bounded cancellation across native Linux and Windows targets

Version 2.878.0: Generate actual Windows signature appearance profiles with embedded Unicode fonts for merged and separate widgets, rotation, encryption and certification workflows, and enforce required AppearanceFilter against the profile actually generated

Version 2.879.0: Create persistent native XFA scalar value children with immediate field, data and shared-alias synchronisation, typed form persistence, widget commits, repeated-instance isolation and exact transactional rollback

Version 2.880.0: Render actual native XFA scalar draw and caption values after script creation, preserve explicitly empty values and repeated-instance isolation, and retain exact rollback when later native drawing exhausts its budget

Version 2.880.1: Observe cancellation before page renderer allocation and context installation and during initialisation, preserve an active caller colour context when construction is initially rejected, and release borrowed display lists without publishing partial bitmaps

Version 2.880.2: Retain rich paragraph alignment across empty initial runs, inline style changes and explicit line breaks, and paint requested rectangle or circle borders and measured highlighted rows instead of silently omitting them

Version 2.881.0: Automatically authenticate standard detached CAdES signatures with required signing-certificate binding and read genuine hexadecimal or escaped literal Contents strings consistently for verification, permitted form updates and long-term validation evidence

Version 2.882.0: Inherit actual child-stream font resources and PDF text parameters in Form, Type3 and Pattern rendering, preserve graphics-state text saves, honour invisible Type3 text and reset independent annotation appearance defaults

Version 2.883.0: Create persistent native XFA image and geometric value children and render real PNG alpha, image DPI and aspect geometry, preserving repeated-instance isolation and transactional rollback; correct FPC image pixels that previously rendered black

Version 2.884.0: Expose portable Unicode 17 default extended grapheme boundaries and wrap overwide rich words at complete clusters, retaining actual Unicode appearance content and correcting joining-form width changes after substring shaping

Version 2.885.0: Expose Unicode 17 default line-break opportunities and consume them in actual native rich fields, preserving nonbreaking-space, hyphen and punctuation groups and Unicode explicit separators with exact original V and RV values

Version 2.886.0: Create and authenticate standalone RFC3161 PDF document timestamps with bounded streaming, SHA256, SHA384 or SHA512 imprints, trusted TSA identity and nonce binding, required ESIC extension declarations and authenticated certification or field-lock exceptions

Version 2.887.0: Import and serialise persistent native XFA exData XML with immediate script reads, namespace and mixed-content preservation, retained repeated-instance identities, transactional rollback and genuine saved XHTML rendering

Version 2.888.0: Apply complete Unicode 17 properties and contextual line breaking through existing document APIs, expose raw or LB1-resolved portable property queries, preserve established enum ordinals and tailoring contracts, and honour soft-hyphen prohibitions

Version 2.889.0: Synchronise materialised hidden and invisible XFA scalar aliases after visible field commits while preserving native repeated data scopes, explicit empty values and exact transactional rollback

Version 2.890.0: Preserve legal Unicode word, nonbreaking-space, punctuation and numeric groups across typed rich style runs, fit whole groups with real styled font advances, retain mixed-size baselines and coalesce CRLF across style seams

Version 2.890.1: Recover transient Windows atomic publication locks with at most eight cancellable replacement attempts while preserving exact targets, prepared bytes, permanent operating-system errors and owned staging cleanup

Version 2.891.0: Preserve ordered native XFA XML comments and processing instructions through event import, serialisation, cloning and transactional rollback, while excluding them from scalar text, rich text and SOM element selection

Version 2.892.0: Render bounded free-form and lattice triangle mesh shadings with genuine coordinate, flag, function, colour and transparency semantics, and decode hexadecimal Indexed palette streams exactly once

Version 2.893.0: Read and write bounded native FDF and XFDF scalar field data and transactionally import real Unicode, choice and button appearances into independently published PDFs, preserving authenticated signature policies and AES encryption

Version 2.893.1: Authenticate required Adobe signed CRL and OCSP evidence inside genuine RFC3161 document timestamps before accepting signature policy protected form updates, preserving transactional refusal for missing, revoked, expired or untrusted evidence

Version 2.894.0: Wrap overwide typed rich text at complete Unicode grapheme boundaries across font and colour styles, measure actual styled ranges before line assignment and preserve indivisible oversized clusters, mixed point sizes and explicit character spacing

Version 2.895.0: Import and export actual FDF and XFDF bytes through existing versioned native Linux JSON callbacks, preserve Unicode field values, AES security and authenticated signature policies, and roll back the current document after failed output or result publication

Version 2.895.1: Compile static native XFA event support once per owned JavaScript engine and replay complete compact dynamic event arguments, preserving closures, recorded host responses, instance isolation, original journal budgets and transaction deadlines during rollback

Version 2.896.0: Resolve native XFA binding SOM through repeated data scopes with bounded descendant traversal, escaped names, Unicode matching, per-instance missing-leaf fallbacks and transactional runtime value synchronisation

Version 2.897.0: Shape selected Unicode style spans with genuine surrounding HarfBuzz context, expose native paragraph order and direction APIs and place typed rich items within actual wrapped physical lines while preserving logical styles and object ownership

Version 2.898.0: Read and write bounded FDF and XFDF rich text, decode native XHTML style spans into four genuine embedded font styles and transactionally import real appearances into signed or encrypted PDFs, including canonical comparison of existing read-only rich values

Version 2.899.0: Attach styled combining marks to actual GPOS base, ligature and mark anchors with independent font scales, preserve negative-origin glyph outlines inside rich widget clips and reserve fitting line extents for visible stacked marks

Version 2.900.0: Load and save namespace-aware native XFA Data DOM XML transactionally, preserve ordered mixed content and data binding identities, quote host values in linear time and retain an exact per-session JavaScript module lease through bounded engine replay

Version 2.901.0: Render Coons and tensor patch mesh shadings with bounded cubic geometry, source-space colour interpolation, continuation edges, fold handling and transactional resource and cancellation limits

Version 2.902.0: Import and export styled FDF and XFDF through real Linux JSON C ABI callbacks, embed configured genuine font faces, preserve signature policies and exact private source bytes for no-op imports, and publish current document state only after both callback outputs succeed

Version 2.903.0: Preserve directional embeddings, overrides, isolates and paired-bracket paragraph context across wrapped rich style lines, expose bounded paragraph-derived and cached physical-line ordering APIs and shape actual line items with resolved levels and scripts

Version 2.903.1: Keep Unicode directional-only shaping clusters at zero character-spacing advance while retaining logical controls, glyph identities and normal visible-cluster and word spacing

Version 2.904.0: Execute the native XFA JavaScript, event journal, Data DOM, XML, FormCalc and ICU locale runtime on Linux with owned shared-module leases and real monotonic clocks while preserving existing Windows Unicode initialisation

Version 2.904.1: Preserve complete paragraph direction controls and paired brackets through automatic standalone shaping and plain multiline field wrapping, with physical-line joining contexts, immutable paragraph caching and bounded total glyph output

Version 2.904.2: Read actual outer cross-reference stream dictionaries without confusing nested encryption settings, resolve escaped entry names and preserve direct encryption dictionaries in ordinary Windows incremental revisions

Version 2.905.0: Create native PDF page trees, repeated editable fields, push buttons and Unicode static text directly from XDP and saved runtime values on Linux and Windows, with genuine embedded appearances and bounded candidate preparation before caller output

Version 2.905.1: Resolve escaped predictor parameters within the actual DecodeParms dictionary and locate the real stream token after balanced outer dictionary syntax, preserving whitespace-valued binary xref payloads in ordinary Windows loading

Version 2.906.0: Position cross-style combining marks using actual selected glyph bounds and canonical combining classes when attachment anchors are absent, with independent font scales, same-side stacking and actual resolved item directions for double marks

Version 2.907.0: Render real CID-keyed CFF glyph identities and bounded notdef substitutions through actual font CID-to-GID mappings, preserving independent text extraction and cancellation checks throughout escaped CMap parsing

Built-in legacy CMaps decode one-to-four-byte PDF character codes for native rendering and Unicode extraction, preserve parent and child writing modes, recover malformed code sequences deterministically and bound cancellable inheritance; redistribution packages include the complete CMap data notice

Windows FDF and XFDF imports select actual supplied named families and font styles from nested file paths or unchanged V1 callbacks, preserving signed or AES-encrypted revisions and two-phase publication; synchronised random input reads use an independent source cursor so background reads cannot corrupt sequential output copies

Version 2.907.1: Decode actual PDF hexadecimal escapes and UTF-8 bytes in name-valued and inherited form fields, preserving spaced, punctuated and Unicode button export states through native saved-document reload

Version 2.908.0: Create genuine native XFA combo boxes, list boxes, multi-selection fields, checkboxes and structurally scoped radio groups directly from saved runtime data, with paired display/export labels, per-instance items, access flags and independent native appearance states

Version 2.908.1: Apply valid inline rich-text declarations with independent important priority, enclosing computed font-size bases and explicit inherited properties, preserving CSS comment and quoted/function declaration boundaries

Supplied rich-text font fallback selects complete styled Unicode graphemes from actual candidate family programs while preserving authored values and precise appearance styles; native Linux JSON fallback exposes the same opt-in behaviour through unchanged V1 records and retains the aggregate font allowance across actual provider allocations

Version 2.909.0: Select actual supplied named TrueType families per rich run and bounded XHTML font-family declaration, preserve per-family style metrics and mark caches, and import real FDF or XFDF rich values with family-aware canonical comparison

Version 2.910.0: Fit NoZoom and NoRotate annotation appearances around the transformed upper-left rectangle anchor, preserving UserUnit, fitted form geometry, opacity and the actual page clip across scale and rotation

Version 2.911.0: Create native XFA rectangle, line and arc draws and inline PNG or JPEG images with actual sample decoding, alpha masks, fitted aspect and rotated placement, bounded preparation and transactional ownership under cancellation

Version 2.912.0: Import and export real FDF or XFDF through Windows file jobs and V1 callbacks with immutable owned input, current unsaved graph preparation, actual four-font rich appearances, authenticated signed AES policies and context commit only after both output callbacks succeed

Version 2.913.0: Select configured native rich font families through unchanged Linux V1 JSON callbacks for typed fills and FDF or XFDF imports, load actual required family and style programs with aggregate budgets, and advertise both implemented rich profiles

Version 2.913.1: Resolve existing implicit XFA values through bounded live data contexts without repeating selector parsing charged to the script operation allowance, preserving original transaction deadlines and explicit binding behaviour

Version 2.913.2: Decode complete rotated matrix barcodes before disconnected fragments and reject exact QR finder mismatches before full-grid sampling, retaining tighter grouping, original linear-bar behaviour, atomic scan budgets and the unchanged two-second deadline

Version 2.914.0: Create native XFA Boolean appearances with six custom marks, round or square borders, mark colours and sizes, five caption placements and shared embedded caption fonts; preserve reversible Unicode export aliases and distinct legal neutral states through event execution and saved PDF reload

Version 2.914.1: Overlap foreground memory-cache hits with cooperative prefetch cancellation after acquiring the real memory reservation, preserve operation cache telemetry and recheck cancellation after cache-lock or reservation waits while retaining strict miss ordering and thread joins

Version 2.915.0: Keep selected native XFA list options visible through font-metric selection windows and persisted top indices, preserve complete option and value arrays, and retain repeated-instance font changes and event rollback with bounded visible glyph preparation

Version 2.916.0: Decode and render 182 built-in legacy CMaps with bounded one-to-four-byte codes, exact parent and child writing modes, Unicode mappings, deterministic malformed-code recovery, cancellable inheritance and bundled redistribution notices

Version 2.917.0: Select genuine named family and style programs for Windows FDF and XFDF imports through nested file paths or existing versioned font callbacks, and isolate synchronised random source reads from sequential transaction publication

Version 2.918.0: Render native XFA Boolean captions from effective XHTML and supplied named style fonts, preserve repeated-instance overlays and saved runtime XML, and measure automatic caption reserves with final logical text-line extents

Version 2.919.0: Resolve complete styled Unicode graphemes through explicitly supplied candidate font families, preserve authored values and precise appearance styles, expose opt-in native Linux JSON fallback through unchanged V1 callbacks, and retain the actual aggregate font allowance while loading configured programs

Version 2.920.0: Save mixed scalar fields and original typed rich-text runs in one independent atomic document transaction, retain precise appearance values and supplied font programs, preserve authenticated policies and current graph edits, and recognise genuine read-only appearance no-ops

Version 2.920.1: Keep successful native Linux C ABI PDF mutations aligned with their committed source snapshot, so following same-value FDF or XFDF imports preserve the exact published form values, typed appearances, drawn text and imported pages instead of restoring stale input bytes

Version 2.921.0: Render native XFA push-button scalar and XHTML captions with genuine supplied family and style programs, preserved inline separators and authored padding, actual normal/down/rollover appearances, caption visibility and persistent repeated-instance overrides

Version 2.922.0: Select native annotation view or print visibility with PDF 2.0 Invisible rules, recognise RichMedia and Projection static appearances and implicit Text transforms, and retain bounded cancellable Windows PNG atomic replacement with actual OS error diagnostics

Version 2.923.0: Preserve ordered rich-text font candidate lists through native appearances and Linux V1 JSON, and bind mixed scalar and original typed runs to Windows file jobs and unchanged V1 callbacks with precise paint, supplied style programs and two-phase publication

Version 2.924.0: Render default document optional-content groups and membership expressions across marked page content, form XObjects and annotations, preserve hidden graphics and text state, and expose explicit view or print usage through the native Linux V1 JSON interface

Version 2.925.0: Select ordered caller-supplied font families for complete styled rich-text graphemes through Windows file jobs and V1 callbacks, preserving CSS and typed candidates, genuine empty-value transactions and aggregate font budgets

Version 2.926.0: Expand bounded inline CSS font shorthand into independently cascaded size, weight, italic and supplied-family candidates, preserving inherited relative sizing, omitted-style resets, important component priorities and actual saved font appearances

Version 2.927.0: Paint original Windows ApplyXFAAsAcroForm push-button scalar and rich captions with actual installed family/style programs, persistent per-instance overrides and native normal/down/rollover appearance bundles, registering genuine AcroForm font resources

Version 2.928.0: Render ExtGState dash arrays and phases with bounded typed PDF array scanning, preserving comments, strict operand validation, inherited stroke geometry, cancellation and ordinary text arrays

Version 2.929.0: Build scalar text, comb cells, choice labels and button marks from ordered supplied regular font families across native setters, Windows jobs and versioned Windows/Linux callbacks; preserve ordinary scalar metadata and distinguish an empty choice selection from a selected empty export

Version 2.930.0: Evaluate automatic optional-content usage applications with explicit zoom, language and user context, persistent native manual selections and bounded Linux JSON operation state; invalidate borrowed rendering contexts after document changes

Version 2.931.0: Preserve legacy XFA checkbox on, off and neutral export states, styled Unicode captions and native appearance bundles, encode special PDF names consistently, and restore direct page resources after cancelled widget adoption

Version 2.932.0: Decode signed and unsigned JPEG 2000 components through26 bits with mixed precision, subsampling and opacity, normalise bounded samples and ignore JPX image BitsPerComponent declarations before rendering

Version 2.933.0: Evaluate multidimensional sampled cubic colour functions with the existing four-knot scalar convention, short-dimension linear fallback, bounded tensor work, cancellation and unchanged scalar interpolation

Version 2.934.0: Create real Unicode legacy XFA text, numeric, date and password appearances with effective per-instance font family and style, editable embedded font resources, scalar password masking and transactional resource adoption

Version 2.935.0: Preserve rich-text line height, computed CSS lengths, inherited factors and parent font metrics across native layout, saved appearances, Windows file jobs and callbacks, and Linux FDF/XFDF JSON imports with bounded metric-font planning

Version 2.935.1: Count supplementary Unicode characters once in portable XFA password appearances, retain original values and enforce aggregate glyph budgets before allocating masks with scalar-granular cancellation

Version 2.936.0: Bind explicit typed JSON rich-text line heights to Windows and Linux saved appearances, preserving authored runs, supplied parent metrics, bounded aggregate planning and transactional mixed-field updates

Legacy XFA radio groups preserve repeated instance scopes, exact exports and styled Unicode captions, with whole-group rollback and a supplied-font native member appearance factory

Version 2.936.1: Parse valid PDF dictionaries and trailers with arithmetic overflow checking enabled by explicitly retaining the low32 bits of the FNV hash multiplication

Native rendering intents preserve graphics-state, image and transparency-group colour intent through bounded ICC transformations

Version 2.937.0: Create independent legacy XFA radio groups from actual repeated instance scopes, preserving exact exports, selected states and styled Unicode captions with whole-group adoption rollback and a detached supplied-font native member appearance API

Legacy XFA choice fields preserve repeated instance values, display labels, list selection windows and styled Unicode appearances, with per-field rollback and a supplied-font detached factory

Version 2.938.0: Render the four standard colour intents across graphics states, forms, images, shadings, patterns and transparency groups with image overrides, relative fallback for unknown names and bounded cancellable ICC transform caching

Binary annotation FDF exchange preserves supplied annotation dictionaries, appearance states, shared font and image resources, and explicit local GoTo targets through bounded native APIs, modern Windows loaded-document interchange, file jobs and versioned Windows/Linux callbacks

Matching annotation names on the same page select replacements; unnamed or unmatched annotations are appended, whilst authenticated policy, atomic publication and exact committed no-op bytes remain enforced

Native annotation XFDF exchange appends eighteen mapped annotation types with bounded binary data, Unicode rich contents, popup and reply objects, authenticated permissions and transactional native/Linux callback publication

Version 2.939.0: Create legacy XFA combo and list fields with exact repeated-instance exports, display labels, selected indices, scroll positions and styled Unicode appearances, preserving high field flags and per-field rollback with a supplied-font detached choice factory and metadata-only mode

Version 2.940.0: Exchange eighteen mapped annotation types through bounded native XFDF and Linux V1 JSON operations, preserving Unicode rich contents, callouts, transparent colours, binary attachments, popup and forward-reply links, authenticated permissions and transactional append publication

Version 2.941.0: Apply independently cascaded native CSS and original typed letter and word spacing to shaped runs, physical lines, fitting and saved appearances, with computed point serialisation, exact decimal rounding and transactional Windows/Linux JSON publication

Native annotation fallback paints supported annotations without normal appearances using bounded temporary geometry, text and font resources

FreeText default appearances apply a bounded DA operator profile, transformed automatic fitting, word-boundary wrapping and root-scoped text and decoration state whilst preserving annotation geometry and source resources; the four finite Tr4 to Tr7 paint-and-clip controls passed independent MuPDF 1.28.5 and Poppler readers, and the original 90 reader images passed a full-cell independent model within their pinned corpus

Version 2.941.1: Validate native XFA choice selection uniqueness with bounded cancellable sorting while preserving exact case-sensitive export values, original selection order and transactional failure behaviour

Windows annotation XFDF exchange exports mapped annotations and appends authenticated XFDF through bounded file jobs and original V1 callbacks with atomic publication and exact no-op bytes

Version 2.942.0: Render supported annotations without normal appearances through bounded temporary geometry, line endings, icons and Unicode FreeText, retaining source resources, rich text, view/print flags and cancellation

Native typed form no-op publication retains exact loaded PDF bytes for unchanged mixed updates and empty batches whilst preserving pending graph edits, authenticated policies and atomic publication

Version 2.943.0: Exchange mapped annotation XFDF through Windows file jobs and original V1 callbacks with authenticated append transactions, bounded binary and Unicode data, exact no-op bytes and atomic publication

Dynamic XFA choice items update live display and export lists, preserve surviving node aliases and exact selections, and save native and legacy PDF choice appearances with bounded transactional script operations

Version 2.943.1: Preserve exact loaded PDF bytes when native mixed scalar and typed rich-text transactions or empty batches make no changes, retaining pending graph edits, authenticated signature and encryption policies, resource limits and atomic publication

Local annotation destinations preserve eight page-target modes, Unicode names and authored decimal precision through native and legacy XFDF exchange, with qualified Adobe XML and transactional Windows/Linux callbacks

Version 2.944.0: Manage live XFA choice display and export items through JavaScript and FormCalc, preserving surviving aliases, exact duplicate or empty selections, native per-instance lists and saved native or legacy PDF appearances under bounded mutation limits

Read-only rich annotation fonts support Preview/Print embedding and complete no-subsetting fonts under explicit per-call permissions; Screen annotations preserve existing appearances and paint no implicit media placeholder

Version 2.945.0: Preserve local annotation page and named destinations through native and legacy XFDF exchange, with exact bounded decimal tokens, qualified Adobe XML, duplicate-attribute validation and transactional Windows/Linux callback publication

Version 2.946.0: Render temporary rich annotation text with explicit read-only Preview/Print font permissions and unchanged full-font bytes, preserving editable embedding policies and existing Screen appearances without implicit media placeholders

Version 2.946.1: Preserve present-empty XFA attributes and UTF-8 names, values, namespaces and indexed queries through native XML serialisation, persistent property defaults, repeated script events and transactional rollback

Version 2.946.2: Fix SHA-1, SHA-256, SHA-384 and SHA-512 word arithmetic with compiler range and overflow checks enabled, preserving valid digests and AES-256 password authentication without changing public interfaces

Version 2.946.3: Apply xfa.host.resetData through native events without misreading it as a Data XML import, preserving template defaults, bound values, repeated scopes, pending edits and transactional rollback

Version 2.947.0: Render bevelled and inset rectangular annotation borders and measured Unicode or rich line captions, preserving opacity, endpoint offsets, existing appearances, bounded font resources and annotation clipping

Version 2.947.1: Preserve explicit empty default XML namespace declarations during XFA parsing and serialisation, preventing unqualified data subtrees from inheriting an ancestor namespace after save and reload

Version 2.948.0: Render filled glyph masks with captured fractional clip coverage whilst preserving PDF paths, patterns, alpha and blend operators, and check raster working-memory capacity before allocation

Version 2.949.0: Preserve the distinction between no selected choice options and a selected empty export value through native, Windows and Linux XFDF exchange, with exact no-op publication, bounded validation and checked encrypted-document loading

Version 2.950.0: Create, clone, rename, insert and remove native XFA Data DOM nodes with bounded ownership, inherited namespaces, stable imported references, binding refresh and complete event rollback; preserve UTF-8 attributes and retained FormCalc references through saved XML and native PDF consumers

Version 2.951.0: Render bounded cloudy borders for Square, Circle, Polygon and FreeText annotations without normal appearances, preserving width, dash, opacity and source graphs; share immutable generated font bytes across FreeText views without repeated decoded-byte charges whilst retaining parsing budgets and cancellation

Version 2.952.0: Remote annotation destinations retain Unicode file specifications and exact coordinates across native and Windows/Linux callback exchange; ordinary loaded annotation imports preserve authenticated encryption and signature policies, exact signature ranges and shared RC4 field values

Version 2.953.0: XFA query node collections provide independent retained lists, occurrence metadata and bounded transactional edits through native saved values and appearances; retained managers follow the current event graph and ordinary SOM evaluation retains the original stack limits

Version 2.954.0: native rich-text style sheets apply bounded internal selectors, importance, specificity and source order through actual saved fields and Windows/Linux FDF/XFDF transactions

Version 2.955.0: XFA live child collections track current form and property children, repeated instances and implicit properties across events; independent clones reference actual native values and saved PDF appearances with bounded event rollback

Version 2.955.1: checked crypto arithmetic and key agreement preserve SHA3/SHAKE and full-width curve exchanges with integer checks enabled, and reject canonical all-zero X25519/X448 shared secrets

Version 2.956.0: OpenType CFF field and annotation appearances preserve actual charset identities, complete font bytes, shaped metrics, Unicode text and bounded font resources

Version 2.956.1: FormCalc child collections resolve nodes paths through the actual compiler and retain bounded event replay, saved values and native PDF appearances

Version 2.957.0: extended native rich-text selectors apply attributes, siblings, structural positions, language and negation to saved values and transactional field appearances

Version 2.958.0: live Data DOM numeric child indices preserve current native order and enforce read-only access inside retained script objects, with bounded event rollback and saved PDF appearances

Version 2.959.0: logical and relational rich-text selectors apply complex not/is/where lists, anchored has relations and filtered nth-child positions to actual saved values and transactional field appearances

Version 2.960.0: standard XFDF Stamp appearance transport preserves actual Form streams, bounded font and image resources, authenticated permissions and atomic native or callback publication

Version 2.961.0: raw default-font annotation appearances use original Type1C, CIDFontType0C and bare Type1 programmes for bounded temporary text and rich-caption appearances

Version 2.962.0: raw-font annotation word wrapping preserves complete encoded cells and style runs, with bounded reflow and measured cancellation

Version 2.963.0: native rich-text CSS namespaces apply scoped declarations and qualified selectors to actual saved appearances and Windows/Linux form transactions, with bounded inherited namespace lookup and checked-build compatibility

Version 2.964.0: OpenType CFF2 default-instance appearances preserve original glyph identity, Unicode mapping and font permissions whilst converting complete default outlines into static CID-keyed CFF 1 programmes for saved PDF fields

Version 2.965.0: transactional native XFA form trees support creation, cloning and child ownership edits with stable surviving aliases, rollback, empty-merge occurrences and saved form-packet persistence

Version 2.966.0: native rich-text media queries evaluate explicit print/screen host profiles, style media attributes, nested Boolean conditions and feature ranges before saving computed rich values and appearances

Version 2.967.0: caller-supplied external rich-text style sheets resolve linked sheets and imports, shared preferred or alternate title sets and document bases before transactional native, Windows and Linux form-data publication

Version 2.968.0: explicit rich-text preferences add colour scheme, reduced motion/transparency/data, contrast, forced and inverted colours and scripting availability, retaining unknown values when omitted

Version 2.969.0: finite rich-text CSS numeric math adds calc, min, max and clamp, root-relative and explicit viewport lengths, and computed line and spacing metrics in actual saved appearances

Version 2.970.0: native CSS support queries admit conditional rich-text groups and imports using the supported declaration and selector grammar, shared budgets and transactional saved appearances

Version 2.971.0: root scope and static user-action selectors preserve logical selector matching, conditional stylesheet admission and computed saved appearances

Version 2.971.1: shaped-run cache hashing preserves modular arithmetic with range and overflow checks enabled in FPC 3.3.1 Windows builds

Version 2.974.0: page-and-name annotation removal prepares bounded popup and reply cascades through native APIs, Windows transactions, JSON jobs and versioned callbacks, preserving permissions, signed revisions and failed-publication rollback

Version 2.973.0: binary annotation FDF exchange preserves appearance resources, shared object graphs and local action destinations through bounded native APIs, Windows interchange and versioned callbacks

Version 2.972.0: native annotation default appearances preserve text state, automatic fitting, rich text and clipping in headless rendering

Native Linux document workflows create HTML documents with embedded Unicode fonts and AcroForm controls, insert visible or searchable page text, perform actual Tesseract OCR with bounded cancellable child processes, and author independently validated raster PDF/A-4 output

Headless DSS/VRI evidence validates certificate chains and supplied OCSP/CRL authorisation, signatures, status and freshness before incremental evidence publication, including encrypted documents

XFA host transport supplies explicit typed callbacks for host actions and FormCalc Get/Post/Put, records responses for safe request retries and module-state replay, and reports transaction completion for application compensation

Headless RFC 3161 timestamps validate message imprints, nonces, TSA authorisation, certificate trust and supplied revocation evidence, then embed the actual timestamp token in detached CMS signatures; required timestamp failures preserve the destination

Persistent XFA JavaScript sessions retain script-object lexical state, nested closures and independent repeated-instance modules with bounded, deterministic transactional rollback

Loaded PDF/A-4 preservation retains original text operators, vectors, images, embedded font programs, and existing OCR layers; it composes visible annotation/widget appearances, optionally adds searchable OCR, reports explicit interaction and metadata losses, validates the reloaded result, and publishes files atomically within its documented font and colour profile

Loaded PDF/A-4 raster archival conversion rebuilds visible page content as bounded sRGB images in a newly validated PDF/A-4 document, normalising fonts, transparency, and painted colours through the strict native renderer; the file API stages and atomically publishes the result, whilst the report identifies removed annotations, forms, and attachments. This opt-in visual archival path discards original vector text, searchable text, signatures, and interactive content

PDF 2.0 output now supports PDF/A-4, PDF/A-4e, PDF/A-4f, PDF/UA-2, PDF/X-6, PDF/X-6p, and PDF/X-6n identification and validation, including revision-aware XMP resolved by namespace URI, transactional PDF/A-4 repair for safe header, trailer, metadata, Catalogue, and presentation normalisation with byte-exact rollback and preserved page content, selectable ISO 15930-9:2020 and resolved-errata PDF/X-6 rule sets, actual ICC header and channel checks, document and page output intents, actual painted colour and overprint through content arrays, nested forms, tiling and shading patterns, images, image masks, shadings, Type 3 glyphs, soft masks and annotation appearances, inherited graphics and transparency state, combined fill-and-stroke compositing, CIDFont and CMap relationships, bounded decoded-byte and content-token work, namespace-aware structure elements, document metadata and string checks, optional content, physical annotation ownership, form semantics, structure destinations, outlines, nested page labels, associated-file authoring, inherited production page boxes, clause-aware diagnostics with rule-set provenance, automatic fail-closed generation validation, and transactional PDF/UA-2 repair for namespaces, attributes, lists, tables, Ruby, Warichu, pronunciation, alternate text, language inheritance, heading order, and Artifact tags

Tagged PDF 2.0 tables receive bounded grid expansion, intersection and row-group checks, table-local header association and cycle detection, while lists receive complete numbering and continuation-chain checks; exact Ruby and Warichu sequences are enforced, and applications can write per-element pronunciation hints or ordered embedded PLS lexicons through SetStructurePronunciation and AddPronunciationLexicon

The v2.119.32-51 cycle added producer-side Arabic / Persian / Urdu shaping (LAM-ALEF mandatory ligature, Arabic Presentation Forms-A 9 letters), a feature-complete OpenType GSUB substitution engine covering every LookupType 1-8 with Script / LangSys selection and TTF subsetter closure for substitute glyphs, XFA (XML Forms Architecture) container support (AddXFAPacket / ClearXFAPackets / XFAPacketCount), an AcroForm /AA /K + /F + /V + /C form-field trigger family, multi-Unicode /DR font registration via RegisterAcroFormFont, structure-element accessibility attribute setters (/Lang / /E / /T) with a Table 333 standard structure type enum and AddStructureElement typed overload, and marked-content sequence properties on BeginTaggedContent

The v2.119.52-68 cycle closed the Phase 8 automatic shaping pipeline and broadened script coverage: Arabic Extended-A (including the U+0750-077F Arabic Supplement and U+08A0-08FF Arabic Extended-A) and Persian / Urdu Form-B were extended into the full U+0672-06D5 joining-class table plus 26 new Forms-A mappings, with post-pass folding for LAM-ALEF, YEH-HAMZA + vowel pairs (8 ligatures in U+FBEA-FBFB), the standalone Allah ligature (U+FDF2), and the 22-codepoint Bismillah phrase (U+FDFD). The new opt-in ShapingFeatures property + THPDFShapingFeature enum (sfArabicGSUB / sfStandardLigatures / sfContextualLigatures / sfContextualAlternates / sfIndicShaping) makes the producer emit GSUB-driven font-specific rlig / liga / clig / rclt substitutions automatically, with Latin Standard Ligatures (ff / fi / fl / ffi / ffl / ſt / st via U+FB00-FB06) and Devanagari Indic syllable reordering (Repha + pre-base I-matra) joining the same pipeline. New shaping capability methods for Syriac (GetSyriacJoiningClass / GetSyriacPosition), Mongolian (GetMongolianJoiningClass / GetMongolianPosition), and Devanagari (GetDevanagariCategory / ApplyDevanagariReorder) let callers drive non-Arabic complex scripts through the same GSUB engine. GetCodepointAdvance exposes the cached /W em-fraction for wrap calculations, and AssignSyntheticCodepointForGID / GetSyntheticCodepointForGID let producer emit any GSUB substitute GID (Devanagari cluster shapes, stylistic alternates, CJK variation sequences) through Private-Use-Area codepoints with full /CIDToGIDMap + /ToUnicode + /W integration. Cumulative ToUnicode CMap now ships 35 ligature reverse-mapping entries (8 LAM-ALEF + 18 YEH-HAMZA family + 1 Allah + 1 Bismillah + 7 Latin) so consumer-reader copy / paste produces the source codepoints. Documentation skeletons for ChangeLog now ship in 11 languages (EN / CN / AR / DE / ES / FR / IT / JA / KO / PT / RU) with a language-picker UI; ChangeLog retention limit was raised from 250 to 500 version sections

The v2.152-v2.190 cycle built out a complete OpenType GPOS positioning engine and broadened complex-script coverage. Opt-in shaping options now apply the font's own kerning (pair, contextual, and right-to-left), combining-mark placement (mark-to-base, mark-to-mark, and per-component mark-to-ligature), cursive connection anchors, and vertical kerning for vertical text, all written as standard PDF text operators so any reader renders the same result. Producer-side shaping now covers Arabic (including the Supplement, Extended-A, and Extended-B blocks), Syriac, Mongolian, N'Ko, Adlam, Hanifi Rohingya, Tibetan consonant stacking, Devanagari and the other Indic scripts through the font's Indic feature chain, Javanese, Thai and Lao mark ordering, Hebrew vowel-point ordering, Khmer, Myanmar, Tai Viet, and Meetei Mayek. A family of optional OpenType typography features - standard, discretionary, and historical ligatures, small capitals, oldstyle / lining / proportional / tabular figures, superscripts, subscripts, ordinals, fractions, scientific inferiors, numerators, denominators, stylistic and contextual alternates, localised forms, case-sensitive forms, slashed zero, and vertical alternates - can be applied automatically during text output. Copy, paste, and text search recover the original characters across all shaped output, including ligatures and chained feature substitutions. Font output also became smaller: embedded font programs are always Flate-compressed, a font used on several pages is embedded once per document, subset tags are derived deterministically for reproducible output, and an optional compact mode writes plain-ASCII text with standard fonts as unembedded WinAnsi text

PDF Standards Coverage

Why Choose HotPDF

Competitive Strengths

The capabilities below are hard technical differentiators for HotPDF versus typical Delphi PDF components. Most competing commercial components either lack these features entirely or are materially weaker in production. Each row maps to a verifiable implementation and a public API surface inside the library

Recent Library Highlights

Advanced PDF Feature Coverage

High-Performance Compression and Imaging Stack

Quick Delphi Example

program HelloHotPDF;

uses
  System.SysUtils,
  HPDFDoc;

var
  PDF: THotPDF;
begin
  PDF := THotPDF.Create(nil);
  try
    PDF.AutoLaunch := False;
    PDF.FileName := 'HelloHotPDF.pdf';
    PDF.Compression := cmFlateDecode;
    PDF.EnableFontSubsetting := True;
    PDF.BeginDoc;
    PDF.CurrentPage.SetFont('Arial', [], 18);
    PDF.CurrentPage.TextOut(50, 50, 0, 'Hello HotPDF');
    PDF.EndDoc;
  finally
    PDF.Free;
  end;
end.

Package Contents

• Lib: HotPDF source units, package and C ABI DLL projects, hotpdf_abi.h, static object files, and bundled third-party library integration
• Demo\Delphi: Delphi examples for document generation, drawing, images, page setup, encryption, merge/edit workflows, and more
• Demo\C++Builder: C++Builder examples aligned with the main Delphi demo workflows
• HtmlHelp: product help and developer reference content

Typical Use Cases

• Business reports, invoices, statements, and printable records generated from VCL applications
• Engineering, imaging, and technical-documentation workflows that require direct PDF control
• Applications that need encrypted, permission-controlled, certificate-recipient, or digitally signed PDF output
• PDF copy, merge, stamp, edit, and page assembly workflows
• CJK and multilingual PDF generation where large TrueType or OpenType-CFF fonts must be embedded efficiently
• Interactive PDF forms, annotation review workflows, presentation PDFs, and document packages with reliable reader compatibility
• Desktop products that need repeatable PDF generation without installing an external PDF engine