Embedded FDF import through jobs and callbacks

Windows file jobs, Windows V1 callbacks and native Linux V1 callbacks accept explicitly selected embedded FDF children through forms.import; the destination PDF must already be loaded and format must be fdf

The outer input is a package, not a PDF revision to adopt; a nonempty embeddedFDF path selects one child at each level, and decoding and publication use one held plan and one cumulative budget

Selection example

{
  "format": "fdf",
  "embeddedFDF": [
    {"index": 0, "fileKey": "F", "decode": "plain", "passwordHex": ""}
  ],
  "includeAnnotations": true
}

index is a nonnegative integer; fileKey is exactly F, UF, DOS, Mac or Unix; decode is plain or revision1 and must agree with the selected stream metadata

passwordHex contains the password bytes for revision-1 decoding and must contain complete valid hexadecimal byte pairs; selection never opens a referenced file path or guesses another child

Fields and annotations

includeAnnotations defaults to false on these transports, preserving the complete original annotation graph; true prepares both supported fields and the selected annotation graph, including annotation-only children with zero fields

Successful result JSON reports updated fields and updatedAnnotations separately; an equivalent repeated import preserves the exact current PDF bytes

Required named-family and style programs are selected from the held fields before commit; use the existing actual-font controls for the chosen Windows or Linux rich profile

Limits and validation

Optional embeddedFDFLimits accepts positive integer maxBytes, maxWorkingBytes, maxNodes, maxObjects, maxOperations and maxDepth values for the cumulative package session

The selected child has separate field-data limits: Windows uses formData and native Linux uses formDataLimits; a valid large outer package may contain a selected child smaller than its own field-data byte limit

Wrong formats, malformed selection entries, invalid Boolean values and embedded-only options without a selection fail before reading the outer input; selectors are not accepted by forms.fill or forms.export

Parsing, cancellation, policy, budget and publication failures preserve the loaded handle and existing output; callback PDF and result publication must both succeed before candidate adoption

Acceptance scope

Linux FPC 3.3.1 and Windows Delphi 64-bit callback gates each pass 70 commands, 40 strict snapshots, four positive profiles and eleven failure-and-retry controls; each independent reader checks fifteen complete graphs and fourteen glyph outputs

Windows file jobs pass 47 native assertions, four positive profiles, four exact repeated no-ops and ten failure-and-retry controls; the independent reader checks fourteen complete graphs and thirteen glyph outputs

C++Builder Win32 and Win64 compile actual calls against eight freshly generated interface units; this interface check does not claim C++ runtime execution

Working storage remains an admission budget rather than an exact native heap cap; full rich-layout, CFF/CFF2 and native shaping allocation coverage remains separate work

Arbitrary actions are not executed and embedded file specifications are never fetched; embedded PDF Differences are admitted separately, and FDF Differences streams are applied through the FDF Differences transport as bounded cumulative appends rather than an incremental FDF history

Native package and held import API · Windows jobs and callbacks · Native Linux callback profile