Native field-lock signing

THPDFHeadlessDocument.SignToFile and SignPFXToFile honor a signature field's local or inherited Lock dictionary and create the corresponding FieldMDP signature reference

All locks every field, Include locks the named fields and their descendants, and Exclude locks every field outside the named fields and their descendants

Each transform uses Type SigRef, TransformMethod FieldMDP, the actual Catalog reference, and version 1.2 parameters; a certification signature includes its DocMDP reference in the same Reference array

Field names retain their exact Unicode values and follow the current document string-encryption policy, while the cryptographic signature Contents retains its required encryption exception

An authenticated Lock.P permission restricts updates following that signature; earlier stricter DocMDP or Lock permissions continue to apply and cannot be relaxed by a later signature

For FieldMDP-only field selection without an additional document-wide modification permission, a locked widget's P backlink anchors the page identity instead of selecting the entire page graph

The anchor requires the same reference type, object number and generation in the authenticated and current revisions, actual page-tree targets, and exactly one matching widget membership in the original and current page Annots arrays

Adding another permitted field does not authorize moving the locked widget to another page, changing its P reference, removing or duplicating its page membership, or changing its protected V or AP graph

This page-anchor boundary does not relax DocMDP P1, P2 or P3, an authenticated Lock.P restriction, or ordinary locked-field comparisons; it does not grant a separate permission to rewrite page contents

Policies are parsed and names are validated before publishing a signature, while subsequent field updates verify the CMS and ESS binding and apply policies from each original authenticated revision

Native signing · Prior-signature validation options · Low-level signature reservation · Authenticated security copies