THPDFHeadlessRenderOptions
Declared in HPDFHeadlessCairoDevice; initialise with Default before changing individual limits
| Field | Meaning | Default |
|---|---|---|
Scale: Double | Pixels per effective page point, including UserUnit | 1 |
MaxPixels: Int64 | Maximum rounded page surface or image pixel count | 16,777,216 |
MaxWorkingBytes: Int64 | Conservative active managed-buffer and surface admission | 134,217,728 |
MaxDecodedBytes: Int64 | Cumulative decoded content, image and font-stream bytes | 33,554,432 |
MaxPNGBytes: Int64 | Privately encoded PNG size | 33,554,432 |
MaxTokens: Integer | Bounded token work and selected array counts | 500,000 |
MaxOperations: Integer | Cumulative dispatched content operations | 500,000 |
MaxDepth: Integer | Recursive, font-array and graphics-stack depth | 32 |
RenderAnnotations: Boolean | Render available normal appearance streams | True |
Usage: THPDFHeadlessRenderUsage | Annotation visibility for view or print raster output | hruView |
ViewerState: THPDFHeadlessOptionalContentState | Borrowed explicit optional-content viewer state, alive and unchanged during rendering | nil |
All numeric limits must be positive; Scale must be finite and no greater than 64, MaxDepth must not exceed 256 and MaxPNGBytes must fit a positive signed 32-bit value
Usage must be hruView or hruPrint, even when RenderAnnotations is false; an invalid enum value fails before the extraction-permission callback or output publication
Usage changes annotation visibility and transforms only; the renderer retains its extraction-permission contract and does not authorise printing
Individual decoded reads are also capped by the borrowed access limit, remaining memory allowance and the signed 32-bit callback size, even when the cumulative MaxDecodedBytes allowance is larger
Font decoding reserves conservative transient capacity before parsing, including a 32 MiB base allowance, 64 times decoded font-stream size, recursively checked array allowances and twice retained decoder estimates
Even a small font may be rejected under a small memory budget; native-library caches and operating-system RSS lie outside the managed accounting
The borrowed access's decoded-byte and depth limits can impose additional bounds; cancellation comes from its caller-owned token
Refer to Native Linux Cairo renderer for the supported profile and output contracts