The KillerPDF.Engine changelog

Format follows Keep a Changelog and this project adheres to Semantic Versioning.

[1.8.5] - Unreleased#

The 1.8.5 engine package matches the engine source shipped with KillerPDF 1.8.5.

Fixed#

Added described overlays that extend existing PDF structure trees when saving markup.

[1.8.4] - 2026-09-06#

The 1.8.4 engine supports the application maintenance fixes.

Fixed#

Added localized round-trip failures with stable codes and numeric details in all 15 supported languages (#227).
Added explicit artifact overlays for temporary rasterization of tagged PDFs, preserving existing structure and ordinary content-editing guards (#356).

[1.8.3] - 2026-09-02#

The 1.8.3 engine package matches the engine source shipped with KillerPDF 1.8.3.

Empty signature strings emitted by other PDF tools are treated as unsigned fields during reading, writing, and signing.
Engine packages now follow app releases automatically, with matching versions required before building or publishing.

[1.8.2] - 2026-08-31#

The 1.8.2 engine release includes the document transformation and reliability fixes shipped with KillerPDF 1.8.2.

[1.8.0] - 2026-08-28#

The KillerPDF.Engine 1.8.0 establishes the independent PDF 2.0 document engine that now powers KillerPDF's parsing, authoring, editing, validation, security, and writing pipelines.

Highlights#

Completed the desktop migration to The KillerPDF.Engine and removed PdfSharpCore from the application, test suite, solution, and portable package.
Built an independent PDF 2.0 parser, object model, deterministic writer, incremental editor, and full-rewrite pipeline with bounded processing and fail-closed validation.
Added byte-preserving editing for pages, annotations, bookmarks, links, forms, metadata, attachments, optional content, and document structure.
Added complete document and selected-page imports with preservation for AcroForms, tagged PDF structure, bookmarks, named destinations, page labels, attachments, and optional-content layers.
Added PDF 2.0 digital signing with CAdES signatures, certification permissions, visible signature appearances, signature discovery, and cryptographic verification.
Added password encryption and authentication across Standard Security revisions 2 through 6, including RC4, AES-128, AES-256, crypt filters, permissions, and authenticated rewriting.
Added modern authoring for PDF/A-4, PDF/A-4e, PDF/A-4f, PDF/UA-2, tagged documents, forms, annotations, graphics, gradients, fonts, images, and accessible navigation.
Added extensive regression, corpus, qpdf, and veraPDF validation covering parsing, rewriting, importing, editing, encryption, signing, archival output, and accessibility output.

Complete change history#

Accepted the PDF-standard zero zoom value in /XYZ bookmark destinations as retaining the current viewer zoom, restoring Typst-generated outlines.
Added optional visible appearances for newly created digital-signature widgets, including editable text, page coordinates, dimensions, font size, a standard border, and standards-compliant appearance streams.
Expanded tolerant full rewrites across malformed but recoverable headers, cross-reference tables and streams, trailer metadata, stream lengths, and trailing data while retaining bounded parsing and deterministic output. Explicit signature invalidation now removes stale signature values and certification permissions before rewriting, and the corpus gates distinguish intentional skips from regressions.
Completed the desktop document-engine migration by replacing the mutable PdfSharpCore document with an engine-validated serialized working-state handle. Removed the production and test references, vendored source, compatibility formatter tests, solution project, and portable payload dependencies; Release, strict docs, qpdf, veraPDF PDF/UA-2, packaging, and launcher gates pass.
Reframed the desktop installed-font catalog and TrueType Collection extractor as an engine embedding service, removing the PdfSharpCore font-resolver interface and process-wide resolver registration while retaining Unicode coverage and styled-face selection.
Expanded the desktop engine boundary into Transform geometry, native-link removal validation, and image-export page state, then removed the unreachable PdfSharpCore named-destination importer and link-style scrub layer superseded by complete engine imports and annotation editing.
Added a byte-preserving page-dimension normalizer that proportionally scales page boundaries, existing content coordinate systems, annotation rectangles, and link quadrilaterals, and integrated it into the desktop Adobe-compatible save guard alongside engine-owned flatten, print, and rotation measurements.
Expanded the immutable desktop engine session into continuous viewport layout, displayed zoom, fit calculations, and crop editing, preserving application-managed and native page rotation while removing the remaining viewer and crop geometry reads from the mutable PdfSharpCore page model.
Expanded the immutable desktop engine session into stamp preview, search geometry, text placement and restyling, clipboard text placement, and annotation text scaling, removing measurement-only PdfSharpCore imports from those components.
Added a byte-preserving save sanitizer for empty or dangling outline roots and direct crop boxes that are degenerate or outside the effective media box, integrated it across desktop save and reload output, and removed the legacy live-document scrubbers.
Integrated save-time signature invalidation cleanup through the engine writer after application serialization and removed the legacy live-document scrubber, retaining empty signature fields and widgets for later re-signing.
Integrated temp-reload rotation capture through immutable engine page information and moved zero-rotation PDFium working-copy production onto a byte-preserving engine revision, removing live PdfSharpCore page-rotation mutation from the base serialization path.
Added an application-level immutable engine document session that owns the serialized source, parsed document, and crop-aware page information shared by desktop open finalization, page-list initialization, links, and forms, with centralized invalidation across reload, save, close, and tab-switch boundaries.
Integrated every desktop annotation and stamp burn path through isolated typed-content overlays, including rotated visual coordinates, Unicode styled text, multiply highlights, carved erasures, rounded ink and shapes, signatures, images, redactions, page numbers, and text or image watermarks. The legacy PdfSharpCore burn renderer has been removed.
Added a high-level form-widget reader with stable page and annotation identity, inherited hierarchical field state, values, flags, limits, default appearances, choice options, button states, effective page boxes, and rotation, and integrated it into desktop interactive form overlays.
Added a high-level native link reader with normalized rectangles, stable annotation-array indices, decoded URI actions, direct page targets, and resolved modern or legacy named destinations, and integrated it into all desktop viewer link overlays and hit testing.
Added a high-level hierarchical bookmark reader that preserves decoded titles, stable indirect-object identity, open state, styling, color, explicit page destinations, named destinations, and destination view geometry.
Integrated desktop bookmark reading and complete-hierarchy editing through the engine. Sidebar rows and multi-selection state no longer expose or hold legacy parser objects, and add, rename, delete, reorder, retarget, and clear operations are written as one engine revision.
Added byte-preserving signature invalidation cleanup that clears catalog certification permissions and signed field values while retaining empty signature fields and widgets for safe re-signing and later full rewrites.
Added bulk link-appearance normalization to the incremental annotation editor and integrated it into desktop Save and Save As output, including clean reload snapshots and annotation-burn saves.
Removed live PdfSharpCore page mutation from desktop rotation commands by routing selected turns through the application rotation-state boundary that the engine persists on final save.
Integrated viewer link removal through the engine's indexed native-annotation deletion path, preserving the original document bytes and all unselected annotations.
Integrated headless corpus resaving through the deterministic engine writer, exposed certification-permission inspection, and made batch validation explicitly clear invalidated signature values and certification permissions.
Integrated import-based repair and temp-reload recovery through complete engine document-graph rebuilds, with explicit preservation or stripping of native page rotations.
Integrated GUI and CLI searchable-PDF OCR through byte-preserving typed overlays with invisible Unicode text, per-script embedded fallback fonts, ToUnicode extraction maps, fitted word geometry, and native page-rotation transforms.
Added byte-preserving typed-content overlays for existing pages. Each overlay is isolated as a Form XObject with its complete font, image, color-space, and graphics-state resources, including embedded Unicode fonts and ToUnicode maps.
Integrated desktop detached signing through the engine's CAdES signature writer and removed the application's separate PDFsharp 6.2 signing dependency.
Integrated last-resort PDFium raster repair through direct engine raster-page authoring and retired the replaced PdfSharpCore image-page helper.
Integrated blank-document creation and Transform raster replacement-page authoring through the engine's page and image builders.
Integrated sidebar PDF and image drop append through complete engine imports, including repaired sources, multiframe images, and rotation-state remapping.
Integrated desktop image import plus combined folder and archive ingestion through the engine's complete-document and multiframe-image composition path.
Added a public crop-aware page-information reader for effective width, height, and normalized native rotation, and integrated it into every CLI raster workflow.
Added application integration gates for mixed PDF and multiframe-image merging plus direct raster-page authoring for desktop and CLI flattening, removing the remaining PdfSharpCore document construction from those workflows.
Integrated desktop form persistence through one engine revision for text, choice, checkbox, and radio fields, and added an optional validated text-size override that updates both the field default appearance and regenerated widget appearance.
Reused the application rotation gate to restore rotated CLI OCR output without a second full-document resave.
Integrated authenticated encryption removal into the desktop open pipeline, including engine-first handling for empty-password protected files before tolerant fallbacks.
Added an explicit full-rewrite policy for removing password encryption from an authenticated document, including omission of the encryption dictionary from the output object graph.
Added a shared application rendering gate that creates a byte-preserving zero-rotation copy for CLI image export, flattening, printing, and OCR.
Added application integration gates for complete-document CLI merge, ordered page extraction, and per-page splitting through the engine import pipeline.
Added application integration gates for deep page duplication, ordered selected-page extraction with effective rotations, and complete-document merging with normalized viewer rotation state.
Added an application integration gate that inserts blank A4 pages at a selected position or at the end of a document while shifting retained application rotation state.
Added an application integration gate that moves pages through the incremental page editor for sidebar button and thumbnail-drag reordering while moving application rotation state with each page.
Added an application integration gate that removes selected pages through the incremental page editor and renumbers the desktop application's retained-page rotation state.
Added an application integration gate that applies and removes matching crop and trim boundaries as an atomic, byte-preserving incremental revision while retaining existing page rotations.
Added an application integration gate that writes native and in-app page rotations as the final incremental revision, replaces saved files atomically, preserves the original byte prefix, and validates a dedicated rotation fixture with qpdf.
Added a high-level PdfDocumentInformation reader for decoded document metadata, PDF version, and validated page count.
Expanded PdfDocumentInformation to read catalog language, offset-aware creation and modification dates, and trapping status so metadata edits can round-trip the complete preserved state.
The primary document builder, content-stream builder, incremental page editor, and incremental annotation editor now have complete XML summaries across their public entry points, covering construction, conformance, pages, navigation, graphics state, paths, color, text, attachments, forms, annotations, editing, and serialization.
Typed viewer preferences, tagged-PDF structure roles, axial and radial shadings, link appearances, page transitions, annotation metadata and flags, and blend modes now provide complete XML summaries for their public values and properties.
Reusable tiling patterns and matrices, extended graphics states, alpha and luminosity soft masks, backdrop colors, and transparency-group Form XObjects now provide complete XML summaries across their public construction and state.
OpenType font loading and metrics, embedding permissions, Unicode glyph mapping, calibrated Gray and RGB color spaces, Lab color spaces, and device-color gradient stops now provide complete XML summaries.
Signature-field seed constraints, signer-certificate requirements, detached-signing options, and discovered signature state now provide complete XML summaries across their public properties.
Structural diagnostic severities and codes, inspection reports, lexical token kinds, defined PDF versions, and offset-aware syntax failures now provide complete XML summaries.
Cross-reference sections and merged revision tables, immutable PDF dictionaries, scalar objects, and indirect references and objects now provide complete XML summaries, including inherited collection contracts.
Annotation intents, reply relationships, line endings, caret and checkbox marks, stamp and text-note icons and states, and text rendering modes now provide complete XML summaries for every public value.
Bookmark appearance and destinations, RGB and CMYK colors, stroke geometry, annotation popup geometry, points, and document metadata now provide complete XML summaries across their public types and members.
Text and choice-field behavior, radio-button placement, widget appearance styling, push-button captions and icons, and field alignment now provide complete XML summaries across their public option models.
Associated-file relationships, certificate key-usage constraints, list and page-label numbering, widget borders and highlights, page boxes and tab order, text markup and alignment, attachment icons, and color-rendering intents now provide complete XML summaries for every public value.
PDF names, strings, arrays, cross-reference entries, and deterministic rewrite metadata and cross-reference policies now provide complete XML summaries, including inherited collection and equality contracts.
Every standard Type 1 font, image dimension and color-space property, indexed palette model, and AES-256 password and permission option now provides a complete XML summary.
Signed-revision changes and permission assessments, cryptographic verification outcomes, and deterministic round-trip validation results now provide complete XML summaries across their public models and entry points.
The remaining authoring models and visual annotation methods plus all public parsing, filtering, document, cross-reference, signing, syntax, diagnostic, and writing entry points now provide complete XML summaries; the reusable engine's strict documentation build is warning-free.
The desktop regression-test project is now part of KillerPDF.sln, so a normal solution-wide test run covers all 1,404 engine tests and all 90 existing application tests instead of silently omitting the application suite.
Incremental page editing can now set existing named checkbox and radio-button values without requesting viewer-generated appearances. Hierarchical field names, separate widget children, exact on and off appearance states, cleared radio selections, page-tree rebuilds, field-type validation, and button-kind rejection are handled while preserving the original byte prefix.
Existing named text fields can now receive new plain-text values with regenerated normal appearances imported from the authoring engine. Field flags, maximum lengths, multiline, password, comb, alignment, font size, RGB appearance colors, standard border styles, default values, hierarchical names, missing appearances, and page-tree rebuilds are handled without enabling viewer-generated appearances; callers can supply an embedded font for Unicode values.
Existing combo boxes and list boxes can now update their selections with regenerated appearances from the authoring engine. Separate export and display values, editable custom combo values, single and multiselect lists, selection indexes, cleared selections, top indexes, default values, styling, alignment, supplied Unicode fonts, and page-tree rebuilds remain synchronized without enabling viewer-generated appearances.
Existing text, checkbox, radio, combo-box, and list-box fields can now reset to their declared default values with coordinated value, selection-index, appearance-state, rich-text, and regenerated normal-appearance updates. Fields without defaults reset to an empty value, while push buttons remain value-less and reject reset requests through the direct editing API.
Existing fields can now set or clear their user-facing tooltip and export mapping name independently of values and defaults. Metadata changes compose with same-revision value updates and resets across hierarchical field trees instead of overwriting another pending field replacement.
Existing text, checkbox, radio, combo-box, and list-box fields can now change or remove their typed default values without changing current values. Proposed defaults are validated through the same reset and appearance path before serialization, and default changes compose with metadata and current-value changes in one revision.
Existing fields can now be removed with coordinated hierarchical field-tree pruning, widget removal from every affected page annotation array, calculation-order cleanup, empty parent pruning, and empty AcroForm plus NeedsRendering removal. Tagged removals also prune matching Form structure elements, OBJR children, and ParentTree entries while retaining unrelated field structure. Removal composes with page reordering, newly authored fields, and imported AcroForms in one user operation while preserving the original byte prefix.
Existing pages can now receive newly authored checkboxes, multi-page radio groups, text fields, and both simple-string and separate export/display variants of combo boxes and single or multiselect list boxes. The authoring engine supplies field dictionaries, widgets, values, defaults, metadata, flags, appearances, and font graphs; the AcroForm merger handles hierarchical-name validation, resource collisions, page ownership, existing annotations, and page reordering without importing temporary pages.
Existing pages can now receive URI, internal-page, named-destination, reset, and PDF-submit push buttons plus unsigned signature fields. Reset and submit actions support all fields, selected named fields, and exclusion lists with definition-order validation; actions, interaction appearances, page destinations, signature flags, widgets, and authored appearance text remain correctly linked through page reordering and complete AcroForm merging.
Form widgets added to tagged documents now receive final-page Form structure elements, OBJR children, ParentTree registrations, widget structure-parent keys, descriptive contents, and tooltip-derived alternate descriptions after AcroForm merging and page reordering. Direct structure roots and direct top-level Document elements are normalized to stable indirect identities. Tagged field removal prunes the same structure associations. PDF/A-4 and PDF/UA-2 text-bearing form appearances require embedded TrueType fonts; the incremental add-and-remove PDF/UA-2 form smoke passes qpdf and veraPDF 1.30.2.
Newly authored fields and imported AcroForms now merge together in the same page-tree operation through one coordinated resource-renaming, hierarchical-name validation, widget-remapping, and AcroForm merge pass. Value, reset, default, metadata, and removal changes requested alongside either source are applied to the completed graph in a follow-up incremental revision.
Incremental line, rectangle, ellipse, and ink annotations now accept validated dash patterns and serialize matching dashed border styles and appearance operators without changing existing call sites.
Incremental annotation editing now adds polylines and polygons with authored-equivalent vertex geometry, fills, interior colors, line endings, dash styles, intents, lifecycle metadata, tagged ParentTree integration, and deterministic appearances.
Incremental annotation editing now adds caret marks through both concise and authoring-compatible API names, including paragraph symbols, colors, opacity, lifecycle metadata, tagged ParentTree integration, and deterministic appearances.
Incremental image stamps now accept every standard semantic stamp icon name while retaining the caller-supplied image appearance and rejecting undefined icon values.
Incremental annotation editing now raises the effective catalog version to the exact required level for opacity-aware markup, vertex, caret, stamp, attachment, URI, and redaction features while preserving the original header and rejecting malformed existing version declarations.
Incremental annotation editing now adds multi-quad PDF 1.7 redaction marks with explicit review appearances, post-redaction fill colors, aligned or repeated replacement text, shared embedded TrueType subsets, baseline Helvetica support outside PDF/A, lifecycle metadata, and tagged ParentTree integration. PDF/A-4 overlays require an embedded TrueType font.
Incremental line annotations now support every standard start and end symbol, interior colors, arrow or dimension intent, expanded appearance bounds, and matching rendered endpoint geometry.
Incremental free-text annotations now support left, center, or right alignment, dashed borders, standard free-text intents, two- or three-point callouts, callout ending symbols, expanded bounds, and matching callout appearances.
Incremental text notes now support every standard icon and workflow state, stable Unicode names, replies to existing or earlier same-update annotations, grouped relationships, and reciprocal popup annotations. Popup additions authorize PDF 1.3 exactly.
Incremental annotation editing now removes existing named or indexed annotations, including unnamed annotations, while preserving the original byte prefix, cleaning up reciprocal popups, rejecting orphaned replies, detaching shared annotation arrays, and pruning tagged StructParent, ParentTree, Annot, and OBJR registrations. Removals compose with same-revision additions and named replacements.
Existing named or indexed annotations, including unnamed annotations, can now replace contents and lifecycle metadata in place without discarding subtype-specific entries or appearances. Tagged content updates synchronize the structure element alternate description and reject empty accessible descriptions, conflicting update and removal requests fail before serialization, and popup dictionaries must be edited through their parent annotations.
Incremental annotation editing now adds URI, page, and named-destination links with the complete authored appearance, quad geometry, destination-view, contents, and lifecycle-metadata model. Links participate in tagged ParentTree updates and annotation permission enforcement without emitting unused appearance objects, while authoring and editing share URI and quad validation.
Incremental annotation editing now places existing embedded files on pages with standard file-attachment icons, deterministic appearances, colors, contents, and lifecycle metadata. Embedded-file lookup follows bounded aliases, rejects malformed or case-insensitively duplicate name-tree entries, and reuses the final file-specification identity while tagged files receive structure alternate text.
Incremental notes, text markup, free text, lines, rectangles, ellipses, ink, and image stamps now accept the same annotation flags, author, subject, creation date, and modification date metadata as authored annotations without changing existing call sites.
Incremental highlights, underlines, strikeouts, and squiggles now accept multiple text quadrilaterals, emit exact QuadPoints hit geometry and tight bounds, and draw independent rotated runs in their appearance streams.
Incremental page editing now inserts and appends pages with raw PDF content streams while preserving the complete original byte prefix and every existing page presentation edit. Content-bearing additions to existing tagged documents remain fail-closed until matching structure can be supplied, while blank-page insertion stays supported.
Incremental page editing now appends raw content after existing streams without rewriting them, explicitly replaces or removes page content, coalesces repeated appends deterministically, and applies the same operations after imported-page graph remapping. Existing tagged documents reject unstructured content updates in every build path.
Incremental page insertion now accepts typed content builders and transfers their complete authored resource graphs through the shared page importer. Standard fonts retain PDF 1.0, alpha images upgrade exactly to PDF 1.4, optional content imports its catalog dependencies at PDF 1.5, and all other validation failures remain visible instead of being mistaken for version retries.
Selected-page imports now authorize a higher source PDF version even when no unrelated pending feature already requested a version upgrade, closing a path that could previously import newer page features into an older document without a catalog version declaration.
Incremental page editing can now retarget existing modern Unicode name-tree destinations and legacy catalog destinations without renaming them, so existing links, bookmarks, and open actions follow the new target. Existing and newly inserted target pages are supported with byte-preserving output.
Incremental page editing can now clear document open actions and complete page-label trees in ordinary revisions or page-tree rebuilds. New label ranges added after a clear replace the prior ranges in the same byte-preserving update.
Incremental page editing can now clear page layout, page mode, and viewer preferences from the catalog, restoring viewer defaults without rewriting existing bytes. A later setter in the same revision reestablishes the selected preference.
Incremental page editing can now remove output intents from ordinary documents while retaining the complete original byte prefix. PDF/A-4 documents reject the operation because their archival conformance requires a suitable output intent.
Incremental page editing can now remove thumbnail images from existing and imported pages in ordinary revisions or page-tree rebuilds, without allocating unused replacement image objects.
Incremental page editing can now remove explicit user-unit scaling, automatic display duration, transition effects, and annotation tab order from existing and imported pages in either ordinary revisions or rebuilt page trees.
Incremental page editing can now remove crop, bleed, trim, and art boxes from existing and imported pages. Explicit crop removal remains effective during page-tree rebuilds instead of being undone by inherited page state.
Incremental page editing can now reset effective page rotation to zero. Ordinary revisions write a local zero to neutralize inherited rotation, while rebuilt page trees omit rotation from the cleared page instead of rematerializing the inherited value.
Incremental page editing can now remove trailer document information, catalog XMP, and catalog language metadata as one coordinated operation in ordinary revisions or page-tree rebuilds. PDF/A-4 and PDF/UA-2 documents reject removal of their required conformance metadata.
Incremental page editing can now remove embedded files by case-insensitive name while cleaning both the EmbeddedFiles name tree and catalog /AF registrations. Empty containers disappear, page-tree rebuilds retain the removal, and the same name can receive a replacement payload in one revision.
Incremental page editing can now clear the complete bookmark tree in ordinary revisions or page-tree rebuilds. New bookmarks added after a clear form a fresh hierarchy in the same update rather than reconnecting the historical outline list.
Bounded indirect-reference readers now enforce the same 32-reference ceiling at stream lengths, tree structural values, diagnostics, graph import, page labels, named destinations, and writer validation instead of allowing an inconsistent extra hop; page, name, and number trees likewise enforce their declared 256-node nesting ceiling exactly.
Authoring, annotation updates, and page merges enforce the same one-million-entry ceiling as shared name-tree and number-tree readers before rebuilding destinations, embedded files, page labels, ParentTree, IDTree, or extension name trees.
Authoring and incremental page insertion enforce the shared one-million-page reader ceiling before mutating page state, preventing generated page trees that cannot be reopened.
Full rewrites retain canonical complete free lists within the cross-reference reader limit and switch to compact sparse table subsections or stream /Index ranges above it, preserving high-water allocation state without unbounded gap expansion.
Incremental writers reject revisions whose sparse cross-reference entry count would exceed the shared per-section reader ceiling before serializing the revision.
Revision-chain parsing rejects trailer /Prev and hybrid /XRefStm offsets that point forward in ordinary files, while recognizing the legal forward links from a validated linearized first-page section to its main and hybrid cross-reference data.
Hybrid /Size equality remains mandatory for ordinary revisions, while a validated linearized first-page hybrid stream may declare the smaller object-number range that precedes its primary table.
Generation-transition checks treat a validated linearized first-page and main cross-reference pair as complementary indexes of one revision instead of misclassifying overlapping entries as an incremental generation change.
The linearized forward-/Prev exception must agree with the declared main-xref /T hint within the bounded table-header allowance, preventing a merely plausible linearization dictionary from authorizing an arbitrary forward revision link.
A forward linearized hybrid /XRefStm is accepted only from a first-page trailer whose forward /Prev agrees with /T, and it must remain inside the declared first-page extent; /H continues to identify hint streams as required by the specification.
Linearization recognition requires the complete parameter dictionary, not merely its object header, to remain within the first 1,024 file bytes.
Linearization-only cross-reference ordering is enabled only when the PDF header begins the file; the ordinary reader retains its bounded tolerance for prefixed non-linearized documents.
The declared first-page end /E must precede the main cross-reference /T hint, preventing an inflated first-page extent from broadening forward-link exceptions.
Linearization parameter objects must use generation zero and be registered at their exact offset in the first-page cross-reference section; /O and the parameter object number must also remain below trailer /Size.
Primary /H hint ranges must follow the parameter dictionary and end within /E, while an optional overflow range must begin at or after /E and end before /T.
The main cross-reference /T hint may identify the forward target or a bounded position inside its classic table, but cannot precede the /Prev target.
The first-page table must precede the primary /H hint stream; a hybrid /XRefStm may legally follow that hint stream but remains bounded by /E.
A shorter linearized /L is accepted for appended revisions only when that exact original prefix ends as a complete PDF, and its own startxref identifies the section receiving linearization ordering.
Sparse full rewrites retain every known inherited free-object entry and generation in both classic tables and cross-reference streams instead of preserving only the high-water sentinel.
Bounded Flate and LZW decoding accounts for PNG predictor row selector bytes before reconstruction, so exact cross-reference row limits remain resistant to decompression expansion without rejecting legal predicted streams.
Multi-filter decoding bounds intermediate stages by their existing encoded footprint while applying the configured ceiling exactly to final output, allowing legal ASCII-wrapped compressed streams without permitting intermediate expansion beyond source storage.
Final startxref declarations reject offsets at or after their own marker, requiring the final cross-reference target to precede the declaration physically.
Final startxref markers and offsets require PDF whitespace token boundaries, rejecting embedded marker substrings and concatenated offsets or end markers.
Final startxref parsing treats comments as PDF trivia around the numeric offset while retaining strict token boundaries and rejecting any data after the final %%EOF marker.
Final-marker discovery ignores startxref text inside trailing PDF comments so legal commentary cannot eclipse the actual declaration.
Revision-chain parsing requires trailer /Size to remain nondecreasing across incremental revisions and requires hybrid companion streams to agree with their primary trailer, preserving the document's object-number high-water mark.
Cross-reference history enforces legal generation transitions: active updates retain their generation, deletion advances it, and free-object reuse retains the free generation, preventing stale or invented identities from replacing current objects.
Classic and stream cross-reference entries reject generation 65,535 for in-use objects because that terminal generation is permanently retired.
Canonical object serialization likewise rejects indirect object declarations at retired generation 65,535 while continuing to permit references that resolve to a free null identity.
Classic tables retain compatibility with a free entry exactly at the trailer /Size boundary while rejecting free object numbers beyond that boundary.
Compressed-object loading rejects object stream containers with nonzero generations, preserving the generation-zero identity required by object streams.
Cross-reference stream type 2 rows reject object stream zero, self-containing compressed objects, and object stream numbers outside the declared /Size range during section parsing.
Object-stream loading validates header membership across revision history, allowing legitimately superseded members without letting never-registered headers invalidate or masquerade as current compressed objects.
Historical object-stream membership is scoped to revisions using the same physical object-stream offset and generation, so a rewritten container cannot authorize inactive headers from its older byte version.
Encryption and decryption resolve aliased stream type names before applying signature, metadata, embedded-file, and cross-reference exemptions, preserving cleartext metadata and selecting the correct crypt method through multi-hop /Type references.
Selected-page imports retain named destinations whose page target is reached through a bounded multi-hop indirect alias chain, with cycle and depth rejection based on final page identity.
Corrected selected-page corpus reporting so deliberate fail-closed source-validation rejections are counted separately from unexpected importer failures; the complete 2,236-file gate now reports 2,149 successful imports, 64 validation rejections, 21 unsupported dependency cases, two malformed sources, and zero unexpected failures.
Full rewrites now reject application-defined, document-information, and encryption trailer graphs that reference xref or object-stream containers omitted from rewritten output, preventing dangling references in otherwise successful rewrites.
Reverified the compressed full-rewrite corpus baseline at 2,231 successful rewrites out of 2,236 files, with only five intentional strict source rejections and no new failure from final trailer-graph validation.
Full rewrites now validate all emitted object graphs, including unreachable live objects, against the final writable object set.
Cross-reference stream objects now reject nonzero generations.
Standalone cross-reference streams require an exact generation-zero in-use entry for their own object and offset; hybrid streams may receive that registration from either companion section in the same revision.
Cross-reference stream /Index ranges now reject disordered or overlapping subsection declarations before row decoding.
Cross-reference streams validate row counts before filter decoding and cap decoded output at one byte beyond the exact /W and /Index length, preventing oversized declarations and compressed payloads from reaching the generic stream limit.
Primitive object serialization now rejects direct and container-nested streams while retaining valid indirect stream output.
Logical round-trip comparison now canonicalizes resolved values as indirect objects so stream comparison remains valid under strict stream serialization.
Stream decoding now confines TIFF and PNG predictor reversal to Flate and LZW filters instead of applying predictor-like parameters to unrelated filters.
Signature discovery now uses the merged trailer chain for /Root, supporting incremental revisions that inherit the catalog reference from an older trailer.
Detached signature placeholder patching is now scoped to the exact appended signature object, preventing fixed-sentinel collisions with preserved source bytes.
Non-Unicode text strings now decode PDFDocEncoding special characters correctly instead of treating their bytes as Latin-1, and undefined PDFDocEncoding byte values fail closed.
Shared name-tree and number-tree readers now reject keys that are not strictly ordered across leaf and intermediate traversal, empty child arrays, and /Limits bounds that disagree with actual descendant keys.
Name-tree and number-tree structural arrays, keys, and bound endpoints can now be valid indirect objects, including nested /Kids, leaf /Names or /Nums, and /Limits arrays; every non-root node must provide its required bounds.
Page-tree traversal resolves indirect type, child-array, and count values; requires exact descendant counts and /Page versus /Pages identities; rejects branch entries on leaves and empty non-root branches; and verifies every reciprocal /Parent reference by complete identity.
Page editing resolves valid indirect catalog type and inherited rotation values while retaining strict catalog identity and multiple-of-90 rotation checks.
Signature discovery bounds total field traversal and resolves valid indirect field types, partial names, filter names, transform methods and parameters, locked-field strings, permissions, actions, and byte-range integers.
Signed field values and catalog certification targets must resolve to dictionaries declaring /Type /Sig; valid indirect signature-type names remain supported across discovery and permission enforcement.
Signature references validate optional /Type /SigRef identity, and FieldMDP Include or Exclude transforms require their /Fields arrays.
Detached signing resolves indirect field names, types, lock scalars, signature flags, seed constraints, timestamp controls, and certificate evidence throughout collision checks, lookup, rewriting, and validation; all signer field traversals are bounded, and existing signed values must be typed /Sig dictionaries.
Detached signing reuses the signature reader's certification parser instead of maintaining a weaker duplicate, and tagged signature creation resolves indirect structure-parent next-key integers.
Tagged page imports resolve valid indirect destination /ParentTreeNextKey and source page /StructParents integers before allocating and remapping structure-parent keys.
AcroForm merging resolves indirect form-level appearance flags, signature flags, default appearance strings, and quadding values while preserving resource renaming and inherited field defaults.
Imported graph transforms retain reverse source identities so indirect field types and default appearances, named-destination strings, legacy destination names, and tagged structure scalars can be interpreted during collision remapping.
Selected-page named-destination dependency discovery resolves bounded indirect scalar chains and rejects cycles instead of overlooking split targets hidden behind indirect strings or names.
Tagged merges resolve bounded indirect chains for structure-root types, document and child roles, ParentTree and IDTree structure scalars, structure IDs, and nested class-name arrays while remapping role, class, ID, and parent-key collisions; cycles fail closed.
Complete outline imports resolve bounded indirect root counts, identities, titles, colors, flags, destinations, actions, and page modes; bookmark lists require exact parent identity, reciprocal previous and next links, consistent endpoints, unique items, and bounded traversal.
Page-label editing resolves bounded indirect style, prefix, and start-number chains, strictly decodes prefix text, preserves effective labels through imports and reordering, recompresses consecutive ranges, and rejects malformed text, cycles, invalid starts, and arithmetic overflow.
Complete catalog imports resolve bounded indirect chains for catalog dictionaries, arrays, and validated scalar values, including output intents and viewer preferences, while rejecting cycles and excessive depth.
Selected-page imports resolve bounded indirect chains for page presentation values, content arrays, rectangles, resource categories, color spaces, functions, patterns, shadings, graphics states, fonts, optional-content properties, and associated dictionaries.
Name, number, and page trees now resolve bounded indirect structural chains, and incremental annotation editing plus incremental and full-rewrite writer validation accept the same legal catalog, tagged-structure, namespace, annotation-array, and metadata indirection while rejecting cycles and excessive depth.
Signature discovery and detached signing now resolve bounded indirect chains consistently for signature dictionaries, transform parameters, byte ranges, field values, and seed constraints, closing the remaining one-hop validation paths while retaining exact signature-reference identity checks.
Structural diagnostics now resolve bounded multi-hop catalog roots consistently with writer validation, require the root dictionary to declare /Type /Catalog, and report invalid types, cycles, and excessive depth as catalog findings.
Document and editor stream decoding now resolve bounded indirect chains for /Filter, /DecodeParms, filter and parameter arrays, and predictor scalars while rejecting cycles and excessive depth; encrypted explicit /Crypt selection applies the same rules across existing and pending incremental objects.
Password authentication resolves bounded multi-hop trailer /Encrypt aliases, rejects cycles and excessive depth, and keeps every bootstrap alias uncompressed through incremental and full rewrites so authentication remains possible.
Shared page-tree traversal resolves bounded trailer /Root and catalog /Pages alias chains to their final indirect identities, allowing edits through legal aliases while rejecting root and page-root cycles.
Full metadata removal follows complete /Info and catalog /Metadata alias chains, deletes every unshared link, and updates the final catalog identity behind an aliased trailer root while preserving shared-object fail-closed behavior.
Incremental updates treat freeing any live member of an inherited /Info alias chain as document-information removal and restore the inherited registration when that object is replaced in the same update.
Signature discovery compares the final resolved identities of field /V and catalog /Perms /DocMDP chains, correctly classifying certification signatures hidden behind distinct aliases to the same /Sig dictionary.
Detached signing resolves final AcroForm, field-array, field, and permissions identities before traversal or replacement, preserving legal alias chains while updating the actual form and field objects.
Tagged detached signing updates the final structure-root and parent-tree dictionaries behind aliases instead of overwriting alias nodes.
Tagged detached signing appends through final structure-kids arrays and updates final top-level element dictionaries while preserving their outer aliases.
Shared name-tree and number-tree traversal follows bounded node alias chains while retaining cycle and reused-node detection across every identity in each chain.
Incremental tagged-annotation editing replaces the final structure-root dictionary behind catalog aliases while preserving the original alias chain.
Incremental annotation editing appends to final indirect annotation arrays and detects duplicate annotations by final identity without replacing page-level aliases.
Shared annotation arrays remain copy-on-write: only unshared final arrays are updated in place, while pages sharing the same final identity detach before appending.
Tagged page merging updates final destination structure-root, ParentTree, and Document-element identities and seeds imported roots and Document elements by final source identity.
Complete outline imports resolve final source and destination bookmark-root identities, preserving catalog-level outline aliases during destination updates.
Bookmark traversal validates cycles, endpoints, parents, and previous links by final item identity; destination updates preserve outer list aliases while replacing final bookmark dictionaries.
Partial AcroForm imports select widgets, prune fields, retain calculation-order entries, apply overrides, and detect reused fields by final identity while preserving outer field aliases.
Tagged page removal rewrites final structure-root, ParentTree, kids-array, element, and page identities while preserving outer structure references.
Optional-content merging updates the final destination /OCProperties dictionary behind aliases instead of flattening the catalog value.
Named destinations, embedded files, and other name-tree category merges update the final catalog /Names dictionary while preserving its outer aliases.
AcroForm merging updates the final destination form dictionary behind aliases, and calculation-order membership is checked by final field identity.
Transplanted XFA form calculation-order entries use the same final field identities as ordinary complete and partial form merges.
Structure ID-tree values, indirect root-kids arrays, and top-level parent links resolve bounded alias chains during tagged merges and direct-root normalization.
Optional-content registration, visibility, radio groups, order arrays, and selected-page pruning compare final OCG identities across alias chains.
Incremental document-information removal follows pending alias replacements, so freeing an object from the superseded /Info chain does not remove the redirected live registration.
Encrypted incremental writes derive bootstrap objects from the pending /Encrypt alias chain, keeping redirected encryption dictionaries direct and clear even when object streams are enabled.
Direct tagged-document normalization derives the retained structure-element identity from final child /P references, preserving parent aliases instead of overwriting them.
Incremental annotation validation compares final page, reply, popup, and parent identities, accepting registered and reciprocal links expressed through legal alias chains.
Imported-page annotation registration and validation apply the same final-identity rules to duplicates, page ownership, replies, popups, and reciprocal parent links.
Shared page-tree traversal resolves bounded alias chains for every /Kids node and reciprocal /Parent link, using final identities for cycle and reuse checks.
Action-graph validation detects cycles and reused actions by final identity even when separate /Next aliases conceal the same action dictionary.
Document security-store pools and VRI membership compare final validation-stream identities across aliases.
Rich-media asset, configuration, view, instance, and activation registrations compare final identities across alias chains.
Imported article-thread bead rings validate thread membership, cycles, and reciprocal next/previous links by final identity.
Document-part hierarchy traversal resolves root, child, and reciprocal parent alias chains and detects reused final nodes.
Collection folder traversal resolves root, child, sibling, and reciprocal parent aliases while detecting cycles and reused final folders.
Page-navigation graphs bound traversal by final node identity so alias cycles and shared nodes terminate deterministically.
Selected-page form discovery resolves indirect widget subtype chains before pruning the partial AcroForm hierarchy.
AcroForm procedure sets and optional-content dependency scanning resolve indirect name chains, including Form, Pattern, OCG, and OCMD types; optional-content group and usage-application scalars follow the same rule.
Tagged page removal resolves indirect MCR and OBJR type names before pruning removed-page structure references.
Direct tagged-root normalization follows aliased child parent links to their final structure-root identity.
Full rewrites resolve indirect structural-stream type names before discarding obsolete cross-reference and object streams.
Selected tagged-page pruning retains IDTree entries whose structure elements are reached through indirect aliases.
Tagged page removal resolves indirect page structure-parent keys before pruning ParentTree mappings.
Optional-content merges resolve indirect default and alternate configuration base-state names.
AcroForm qualified-name collection resolves indirect field partial-name strings during complete and selected-page merges.
Combined tagged page removal and document merging reads rewritten top-level structure elements by final identity, preserving outer aliases without reviving pruned children.
Signature discovery detects reused AcroForm fields by final identity when separate aliases target the same field dictionary.
Tagged-annotation traversal updates final top-level structure-element identities and validates reciprocal parent links after bounded alias resolution.
Stream parsing now resolves bounded multi-hop indirect /Length chains and reports reference cycles or excessive depth deterministically before consuming payload bytes.
Compressed-object loading now resolves bounded indirect object-stream /Type, /N, and /First scalars after cross-reference bootstrap, while cross-reference stream fields remain deliberately direct because no document resolver exists yet.
Added a standalone, UI-free .NET 10 document-engine project and test project that will replace KillerPDF's PdfSharpCore document pipeline without replacing PDFium rendering.
Complete-document imports validate PDF 2.0 requirement penalties, version descriptors, signature constraints, and encryption constraints while preserving extensible registered requirement and requirement-handler subtype names.
Catalog extension merging no longer restores namespace entries whose values resolve to null after the extension merge deliberately skips them.
Complete-document imports validate PDF 2.0 document security stores, including typed DSS and VRI dictionaries, uppercase signature digests, indirect certificate and revocation streams, VRI membership in document-wide validation pools, creation dates, and timestamp exclusivity.
Imported Web Capture commands reject reserved flag bits while retaining converter-specific command settings as extensible dictionaries.
Shared PDF date validation now requires timezone information to follow complete date and time components and requires the apostrophe separator before numeric timezone minutes across imports, full rewrites, and incremental updates.
Full and incremental writer tests now cover every legal PDF date precision, leap days, UTC, and signed timezone offsets so strict metadata validation remains compatible with valid partial dates.
Canonical object serialization now rejects indirect declarations and references using reserved object number zero instead of emitting syntax that conflicts with the cross-reference free-list head.
Imported page-level output intents now receive the same identity, subtype, profile, reference, and mixing-hint validation as catalog output intents.
Imported annotation language identifiers now require decodable string values and valid BCP 47 syntax.
Imported annotation replies now require indirect, typed annotation targets instead of accepting arbitrary direct dictionaries.
PDF text decoding now consistently supports UTF-16BE and PDF 2.0 UTF-8 signatures with strict malformed-input rejection across language tags, annotation states, structure namespaces, and signature metadata.
Signature discovery now has explicit coverage for PDF 2.0 UTF-8 field names in existing AcroForm trees.
Tagged incremental annotation editing now validates every indirect typed namespace entry and optional schema, resolves indirect UTF-8 namespace URI strings, and rejects duplicate PDF 2.0 namespace registrations.
Tagged incremental annotation editing now validates every retained ParentTree value as a role-bearing structure element or a legal array of indirect structure elements with explicit null gaps before rebuilding the tree.
Tagged incremental annotation editing now requires every top-level structure element to carry a name-valued role and resolves indirect role names when locating the document container.
Tagged incremental annotation editing now verifies reciprocal parent links from every indirect top-level structure element to the actual structure-tree root.
Tagged incremental annotation editing now requires /StructTreeRoot to resolve to a dictionary with /Type /StructTreeRoot before any structural update.
Tagged incremental annotation editing now resolves legal indirect /ParentTreeNextKey integers while retaining negative-value and overflow protection.
Tagged incremental annotation editing now rejects stale or semantically empty existing document-element kids, retaining only nonnegative MCIDs, role-bearing elements, marked-content references, and object references before appending annotations.
Incremental annotation editing now validates retained page annotation entries as indirect typed dictionaries with subtype names and finite four-number rectangles before rewriting /Annots arrays.
Incremental annotation editing now rejects retained annotations whose /P entry identifies a different page before appending to that page's /Annots array.
Incremental annotation editing now rejects duplicate indirect annotation identities within a retained page /Annots array.
Imported page annotation arrays now reject duplicate indirect annotation identities before remapping their object graphs.
Imported annotations with /P ownership links now must identify the page being imported, preventing unrelated page dictionaries from entering the remapped annotation graph.
Imported markup /Popup links now require the popup's reciprocal /Parent reference to identify the same markup annotation.
Imported popup /Parent links now require the markup annotation's reciprocal /Popup reference to identify the same popup.
Imported reply, popup, and popup-parent references now must identify annotations registered in the imported page's own /Annots array.
Imported page annotations now strictly decode /NM text and reject duplicate annotation names on the same page.
Imported annotation contents, names, authors, and subjects now use strict PDF text decoding and reject malformed UTF-16BE or PDF 2.0 UTF-8 payloads.
Incremental annotation editing now strictly decodes retained /NM text and rejects duplicate annotation names before appending.
Incremental annotation editing now checks generated KillerPDF annotation names against retained /NM values before writing, preventing object-number-based name collisions.
Incremental annotation editing now strictly decodes retained contents, authors, and subjects before extending page annotation arrays.
Incremental annotation editing now validates retained modification and creation dates, nonnegative flags, and bounded opacity before extending page annotation arrays.
Incremental annotation editing now validates retained structure-parent keys, appearance dictionaries, nonempty appearance-state maps, and /AS selection consistency before appending.
Incremental annotation editing now validates retained color arrays, legacy borders, border-style dictionaries, dash patterns, and quadrilateral geometry before appending.
Incremental annotation editing now validates retained BCP 47 language tags and requires reply targets to be typed annotations registered on the same page.
Incremental annotation editing now requires retained popup and markup annotations to be registered on the same page with reciprocal /Popup and /Parent links.
Incremental annotation editing now validates retained rich text containers, intent names, reply types, and paired text-annotation state models and values.
Incremental annotation editing now requires retained appearance streams to be Form XObjects with finite bounding boxes and matrices and dictionary-valued resources.
Incremental annotation editing now detaches shared indirect /Annots arrays before appending page-specific annotations so other pages retain their original arrays.
PDF strings now reject undefined lexical-form enum values instead of silently serializing them as literal strings.
PDF arrays and dictionaries now reject null object references at construction and direct callers to use the explicit PDF null object.
Full and incremental writers now traverse complete custom document-information graphs and reject stale nested references instead of validating only the standard metadata fields.
Unrelated low-level incremental updates preserve malformed inherited standard information fields byte-for-byte while still validating graph liveness; strict field semantics apply when callers replace /Info or perform a full rewrite.
Full and incremental writers now preserve extension-defined trailer entries inherited from older revisions by using the merged trailer view with newest-value precedence, while keeping cross-reference-stream keys revision-local.
Full and incremental writer coverage now explicitly verifies newest-value precedence when an extension-defined trailer key is redefined across revisions.
Merged-trailer coverage now verifies that a hybrid revision's primary trailer wins over its companion cross-reference stream for duplicate application keys.
Cross-reference traversal coverage now verifies that revision chains beyond the configured 1,024-revision bound fail before unbounded parsing.
Cross-reference traversal coverage now verifies that hybrid /XRefStm pointers cannot reuse an already visited primary-section offset.
Cross-reference streams now reject /XRefStm; hybrid companion pointers remain confined to classic trailers.
Hybrid companion cross-reference streams now reject their own /Prev chain so revision history remains owned by the primary classic trailer.
Object-stream resolution now verifies every declared object number and index against a matching compressed cross-reference entry for the same object stream.
Classic and stream cross-reference sections now require object 0 to remain free at generation 65,535.
Free cross-reference entries now require next-free pointers below trailer /Size, preventing impossible inherited free-list heads.
Merged cross-reference tables now reject reachable free-list cycles and heads that identify active or missing objects.
Merged revision history must define object 0 as the generation-65,535 free-list head even when newer sparse sections omit it.
Valid trailer /ID pairs retain the same first, permanent identifier across incremental revision history while allowing the second revision identifier to change.
Every declared trailer /ID value must be an array of exactly two strings instead of allowing malformed identifier state to bypass revision-history validation.
Incremental revision history cannot introduce encryption after unencrypted bytes already exist; existing encryption bootstrap references may still redirect through bounded clear aliases to the same dictionary.
Full rewrites now traverse the bounded, post-policy catalog object graph and reject stale generations instead of emitting dangling structural references, while the low-level incremental builder remains available for forensic revisions.
Imported printer-mark and trap-network annotations now validate their required flags and appearances, optional identifiers and tracking state, font dependencies, printer-mark styles and Separation colorants, and trap-network process models, spot colorants, indirect regions, and descriptions.
Imported image and form XObjects now validate OPI 1.3 and 2.0 version dictionaries, external file specifications, required legacy geometry, paired modern crop geometry, bounded crop regions, color and tint operands, included-image dimensions and quality, and defined ink declarations.
Imported image and form XObjects now also validate external reference-page dictionaries, alternate images, metadata, optional-content membership, associated files, geospatial measurements and point tuples, identifiers, names, modification dates, and the defined form type.
Imported PostScript XObjects validate optional LanguageLevel 1 fallback streams and support the standard legacy /Subtype /Form plus /Subtype2 /PS representation.
Imported viewport and XObject point-data collections now share full cloud identity, column-name, tuple-width, and predefined numeric-coordinate validation.
Imported geospatial measures now require typed EPSG or ASCII WKT coordinate systems, correctly treat bounds and local points as optional, match local and global point counts, and validate display-unit triples and projected-coordinate matrices.
Imported rectilinear number formats now validate object identity, fractional display and label ordering names, decimal precision or fractional denominators, fixed-denominator flags, separators, and label spacing, including the final-unit restriction on fractional controls.
Imported 3D annotations now validate activation and deactivation lifecycle controls, referenced 3D streams, instantiation scripts, preset and default view selectors, named views, camera matrix sources, transformation matrices, and U3D view-node paths.
Imported 3D animation styles now validate object identity, name-valued subtypes, integer play counts, and positive finite time multipliers while preserving forward-compatible unknown animation styles.
Imported 3D views now validate perspective and orthographic projections, clipping and scaling controls, RGB backgrounds, render modes, lighting schemes, cross-section geometry and colors, and per-node opacity, visibility, and transformation state.
Imported RichMedia graphs now validate content and settings identities, asset name trees, registered indirect file specifications, indirect configurations and instances, defined media subtypes, animation controls, presentation styles and flags, floating-window dimensions, and aligned window positions.
RichMedia Flash parameters now validate binding modes, required material names, state payloads, cue-point identities, names, timing, and event actions; activation configuration, view, and script references must belong to the content's registered collections.
Imported external-data dictionaries now validate defined 3D markup and measurement-association subtypes, required annotation and view targets, 16-byte artwork checksums, projection-only measurement links, and indirect measurement references.
Imported sound objects now distinguish inline sample data from external self-describing files, require positive inline sampling rates, and validate external file specifications; redaction overlay text requires a default appearance unless a replacement appearance is supplied.
Imported movie annotations now validate image-XObject posters, time and time-scale operands, floating-window magnification and screen positions; popup links require indirect popup and markup-parent dictionaries.
Imported text annotations now validate text-string state models, state values, and icon names; links reject conflicting action and destination targets and validate previous-view actions; free-text annotations validate defined intents and require callout geometry for callout intent.
Imported caret, square, circle, and free-text rectangle differences now must preserve a non-collapsed inner annotation rectangle.
Imported 3D view validation now continues past string-valued U3D node paths and bounds indexed default-view selectors to the declared view array. RichMedia instances must match their containing configuration subtype, and windowed presentations require complete width and height bounds.
Imported page viewports now require finite, non-collapsed bounding rectangles before their geospatial or point-data graphs are imported.
Imported geospatial measures now require local unit-square control points matching their global coordinate count. Viewport and point-data collections reject empty arrays, duplicate point-data columns, and non-finite predefined coordinates.
Imported page separation metadata now requires indirect page memberships and a Separation or DeviceN color space containing the declared device colorant.
Imported page and Form XObject transparency groups now reject Lab and special color spaces prohibited as blending spaces. Page bead arrays are nonempty and repeated ring entries share bounded identity-aware validation.
Imported production page boxes now reject collapsed rectangles.
Imported Form XObject bounds and matrices and extended graphics-state line, opacity, dash, font, and soft-mask values now require finite numbers. Soft-mask transfer functions and backdrop component counts are validated against their transparency groups.
Imported extended graphics-state halftones now validate defined type identities, dictionary-versus-stream forms, type 1 frequency, angle, and spot functions, type 5 component graphs, type 6, 10, and 16 dimensions, transfer functions, names, depth, and cycles while allowing legal shared sub-halftones.
Imported tiling-pattern steps and matrices and Type 3 font bounds and matrices now reject non-finite numeric values.
Root and nested page resources now share one recursive validator. Name-valued color-space resources are limited to direct device spaces or Pattern, shading background, function, and mesh-decode dimensions match their color spaces, and tint or shading function input and output dimensions match their callers.
Imported DeviceN spaces now reject duplicate or prohibited colorants and inconsistent NChannel or process-component declarations. Image color-key masks use bounded integer pairs matching the image color components and sample depth.
Imported image soft masks now require DeviceGray color spaces, alternate-image collections are nonempty, and Form transparency groups use the shared page-group validator.
Imported Indexed, uncolored Pattern, Separation, and DeviceN spaces now require device or CIE-based base and alternate spaces instead of recursively accepting special color spaces.
Added from-scratch PDF 2.0 catalogs, page trees, arbitrary finite page sizes, content streams, graphics-state operations, transforms, paths, Bézier curves, rectangles, rounded rectangles, circles, ellipses, colors, fills, and strokes.
Added new-document page rotation, crop, bleed, trim, and artwork boxes constrained to the media box, plus bounded user-unit scaling for unusually large or small page formats.
Completed PDF path construction and painting with both cubic Bézier shorthand forms, close-and-stroke, even-odd fill-and-stroke, and closed nonzero or even-odd fill-and-stroke operators.
Added complete stroke styling with butt, round, and projecting-square caps; miter, round, and bevel joins; validated miter limits; reusable dash sequences and phases; and solid-stroke reset.
Added native DeviceCMYK fill and stroke authoring plus validated CMYK base colors for uncolored stencil patterns, complementing existing grayscale and RGB graphics support.
Added reusable ICCBased Gray, RGB, and CMYK fill, stroke, and uncolored-pattern base colors with embedded profiles, device alternates, strict component validation, scoped page/form/pattern resources, deterministic sharing across pages, and safe output-intent object reuse.
ICCBased authoring and output intents now accept every standard ICC three-component profile signature allowed by PDF's /N 3 model, including XYZ, Lab, Luv, YCbCr, Yxy, HSV, HLS, CMY, and 3CLR, plus four-component 4CLR profiles.
Added reusable named Separation spot colors with process-CMYK alternates, tint-transform functions, validated fill and stroke tint values, and scoped page, form, and pattern resources.
Added reusable CIE Lab* fill and stroke color spaces with explicit white and black points, configurable a*/b* ranges, strict component validation, and scoped page, form, and pattern resources.
Added reusable Indexed Gray, RGB, and CMYK palette color spaces with compact binary lookup tables, one-byte palette indices, strict entry bounds, and scoped page, form, and pattern resources.
Added reusable CalGray and CalRGB fill, stroke, and uncolored-pattern base colors with explicit white and black points, calibrated gamma and matrices, strict component validation, and scoped page, form, and pattern resources.
Added all four standard color-rendering intents and validated curve-flatness tolerance controls for predictable screen and print painting behavior.
Added reusable extended graphics-state resources with independent fill and stroke opacity, all sixteen standard separable and non-separable PDF blend modes, alpha and luminosity soft masks backed by explicitly color-managed transparency-group forms with optional backdrop colors, fill and stroke overprint with both overprint modes, alpha-source selection, text-knockout control, and deterministic sharing within and across pages.
Added reusable axial and radial gradient shadings with clipping, optional evaluation bounds and matching background colors, antialiasing control, arbitrary strictly ordered Gray, RGB, or CMYK color stops, two-color interpolation, multi-stop stitching functions, extension controls, consistent color-space validation, and deterministic sharing across pages.
Public value-type inputs now revalidate constructor invariants at their point of use, rejecting default collapsed text quads, gradient stops, shading bounds, pattern matrices, and PDF versions before they can produce invalid output or headers.
Authored UTF-16BE and UTF-8 strings now use strict encoders across metadata, annotations, forms, links, spot colors, embedded-font mappings, and signatures. Unpaired surrogates are rejected instead of being replaced, and malformed signature, destination, or TrueType name strings fail closed or fall back without identity collisions.
Catalog language metadata now validates the complete BCP 47 tag structure, including extlangs, scripts, regions, unique variants, unique extensions, grandfathered registrations, and private-use subtags, before writing /Lang.
Catalog language is now mirrored into the XMP Dublin Core language bag, and typed prepress trapping status is written consistently to the information dictionary and XMP.
Added typed page keyboard-tab ordering for row, column, structure, and annotation-array traversal. PDF/UA-2 pages default to structure order and reject incompatible overrides.
Incremental page editing can replace keyboard tab order across existing, inserted, and imported pages, with effective-version upgrades to PDF 1.5 or PDF 2.0 as required.
Incremental page editing can attach typed image thumbnails across existing, inserted, and imported pages, including recursively allocated alpha soft masks and the required PDF 1.4 effective-version upgrade.
Authored RGBA page thumbnails now participate in feature-version validation, preventing PDF 1.3 output from containing a PDF 1.4 image soft mask.
Incremental page editing sets typed catalog page layouts and initial page modes with effective-version upgrades for PDF 1.5 two-page and optional-content modes and PDF 1.6 attachment mode.
New-document authoring now rejects those layout and page-mode values when the selected PDF version predates their specification introduction.
Viewer preferences share one canonical typed serializer between authoring and incremental editing. Both paths enforce the PDF 1.2 base dictionary, PDF 1.3 reading direction, PDF 1.4 document title, PDF 1.6 print scaling, and PDF 1.7 duplex and tray-selection boundaries.
Page destinations share one canonical serializer between authoring and incremental editing.
Incremental editing adds page or Unicode named document-open actions, retaining page identity through reordering and rejecting removed targets or unknown names.
Incremental editing adds Unicode named destinations for existing or newly inserted pages, preserving existing destination and name-tree state and allowing a new destination to become the open action in the same update.
Incremental editing adds typed decimal, Roman, alphabetic, or prefix-only page-label ranges for existing and inserted pages, preserving effective labels through page operations and authorizing the PDF 1.3 feature through the catalog version when necessary.
Incremental editing replaces document information, catalog language, and descriptive XMP metadata in one revision. Existing XMP packets retain PDF/A, PDF/UA, and private schemas while standard element-form or RDF-attribute properties are updated consistently; new packets share authoring's canonical serializer.
Metadata replacement composes with page reordering and encrypted incremental revisions.
Explicit incremental catalog presentation and metadata edits take precedence over catalog properties transplanted by a complete-document import in the same revision.
Attachment validation and object construction are shared between authoring and incremental editing.
Incremental editing embeds new associated files into existing documents, preserving embedded-files name-tree categories and catalog associations, rejecting case-insensitive name collisions, and raising the effective version to PDF 2.0.
Incremental attachments preserve conformance boundaries: general PDF/A-4 rejects them, PDF/A-4f and PDF/A-4e allow them, and PDF/UA-2 requires descriptive file-specification metadata.
Incremental editing authors hierarchical page or named-destination bookmarks with open and collapsed state, RGB color, bold and italic styling, and page-identity tracking through reorder operations.
New bookmark trees, existing outline lists, and complete imported outline segments share one merged root with reciprocal boundary links, validated counts, and automatic outline-view mode when no explicit page mode exists.
ICC profile and output-intent validation and object construction are shared between authoring and incremental editing.
Incremental editing installs a typed destination output profile and PDF/A output-intent dictionary, replacing imported intent state when explicitly requested and authorizing the feature through PDF 1.4 catalog versioning.
Incremental thumbnail edits reuse one indirect image and soft-mask graph when the same typed image instance is assigned to multiple pages.
PDF/UA-2 URI and direct-page links now receive descriptive contents, structure-parent keys, ParentTree mappings, standard Link structure elements, and OBJR back-references. A real smoke file passes qpdf and veraPDF UA-2.
PDF/UA-2 form widgets now require tooltips and embedded fonts for text-bearing appearances, and receive descriptive contents, structure-parent keys, ParentTree mappings, standard Form structure elements, and OBJR back-references. A mixed hierarchical form smoke file passes qpdf and veraPDF UA-2.
PDF/UA-2 text notes and text-markup annotations now require descriptive contents and receive structure-parent keys, ParentTree mappings, standard Annot structure elements, and OBJR back-references. A combined annotation smoke file passes qpdf and veraPDF UA-2.
PDF/UA-2 free text, image stamps, visual, caret, redaction, and file-attachment annotations now receive accessible Annot associations, embedded files require descriptions, and internal navigation uses page-associated structure destinations while rejecting unstructured targets. A combined navigation and annotation smoke file passes qpdf and veraPDF UA-2.
Incremental annotation editing now preserves tagged and PDF/UA structure through new structure-parent keys, Annot elements, OBJR references, rebuilt ParentTrees, and advanced next-key state. A compressed incremental smoke file passes qpdf and veraPDF UA-2.
PDF/UA-2 encryption now requires accessibility extraction, Formula roles serialize correctly with required descriptions, legacy Note maps to FENote, and legacy inline roles use the PDF 1.7 namespace under validated hierarchy. Mixed-namespace authored and incrementally edited smoke files pass qpdf and veraPDF UA-2.
Tagged lists now support typed standard numbering attributes. PDF/UA-2 places legacy Art, Quote, Note, Reference, and Code roles in the PDF 1.7 namespace, enforces a sole root-level Document, numbering for labeled lists, list-item body wrapping, numbered-heading parent and child models, high-level grouping boundaries for inline spans, grouping-container content rules, forbidden list, table, and legacy inline nesting, and regular table rows while rejecting the generic heading role. The combined role smoke exercises both standard namespaces and passes veraPDF. Encrypted compressed incremental annotation edits retain tagged mappings without exposing appended text.
New-document authoring now enforces feature minimum versions for XMP, structure trees, forms, signatures, annotations, reusable resources, embedded CID fonts, color spaces, transparency, optional content, page geometry and presentation, navigation, viewer state, associated files, revision-6 AES-256 encryption, tab-order generations, PDF/A-4, and PDF/UA-2 instead of emitting invalid down-version files without developer extensions.
Added reusable Form XObjects for vector artwork, text, images, gradients, nested compositions, and isolated or knockout transparency groups. Forms keep their resources scoped, can be placed repeatedly at natural or scaled sizes, and are stored only once even when reused across pages.
Added reusable colored and uncolored stencil tiling patterns for fills and strokes, with DeviceGray, DeviceRGB, DeviceCMYK, ICCBased, calibrated, CIE Lab*, Separation spot, or Indexed stencil base colors, configurable cells, horizontal and vertical spacing, tiling behavior, pattern-space transforms, nested resources, and deterministic sharing across pages.
Added PDF optional-content layers with Unicode names, deterministic viewer ordering, initial visibility controls, shared page-property resources, and complete layer-configuration preservation when whole documents are imported into empty destinations. Unsafe partial or combined layer imports now fail explicitly instead of leaving content tied to a missing catalog configuration.
A sole complete layered document can now be added to an occupied unlayered destination: existing content remains always visible, imported page resources retain their optional-content references, and the source configuration is installed intact.
Page editing can now import an explicitly selected page subset as one ordered batch. Direct links among selected pages are remapped even when the selection is reordered, self-links remain intact, duplicate selections are rejected, and dependencies on omitted pages continue to fail closed. Authenticated AES-256 subsets are decrypted with the source key and re-encrypted with a distinct destination key without exposing page content.
Selected-page AcroForm and structure pruning maps now preserve complete indirect identity end to end, including generation numbers, so stale references cannot receive rewritten dictionaries belonging to the active generation.
Page, name, and number tree cycle and reuse detection now tracks object generations as well as numbers, so stale self-references are diagnosed as null references instead of false cycles.
Partial AcroForm imports match selected widgets, field-tree nodes, retained fields, and calculation-order entries by object number and generation, removing stale /CO references instead of importing null entries.
Complete AcroForm merges also validate /CO as indirect references to fields reachable from each form’s /Fields tree, removing stale source generations and rejecting invalid destination or out-of-tree entries.
Selected-page graph import, tagged structure pruning, IDTree filtering, optional-content configuration pruning, and named-destination traversal now compare complete indirect identities. Stale generations resolve as null or are removed instead of being mistaken for omitted pages, retained structure elements, layers, or destinations.
Imported page /Annots and /AF arrays are rebuilt from resolved dictionaries, removing stale or explicit null entries and rejecting invalid value types. Complete catalog /AF merges apply the same validation and omit empty stale-only registrations.
Tagged merges validate structure-root /Namespaces, /AF, and /PronunciationLexicon collections as dictionary arrays, removing stale source entries and rejecting invalid destination state instead of serializing null elements.
Embedded-files name-tree merges require file-specification dictionaries and omit stale-only source trees. Tagged ParentTree values must resolve to arrays or structure dictionaries, while IDTree values must be indirect structure-element references; stale required mappings fail before remapping instead of becoming null.
Name-tree and legacy catalog named-destination merges require destination arrays or dictionaries with defined fit modes, exact operand counts, numeric coordinates, and valid page references; stale source values are removed before collision handling and stale-only containers are omitted.
Selected tagged conformance imports validate metadata streams, language strings, viewer-preference dictionaries, output-intent dictionary arrays, and catalog version names while omitting stale optional values. Catalog extension merges require developer-extension dictionaries and omit stale-only namespaces.
Complete AcroForm merges and sole-form transplants validate field arrays, scalar form properties, reachable calculation-order references, resource categories, procedure sets, default-resource entries, XFA stream or packet-array structure, and the catalog /NeedsRendering flag, rejecting stale dependencies that resolve to null. Ordinary sole forms use the full merge pipeline while the XFA-only transplant path retains valid rendering state. Imported page contents, inheritance, resources, metadata, thumbnails, article bead dictionaries and geometry, transitions, actions, piece-information application dictionaries and required modification dates, separation pages, colorants, and color spaces, viewport data, timing, units, structure keys, tab order, and modification dates likewise validate their required PDF object types, while private extension keys remain compatible.
Sole complete-document transplants validate standard catalog names, strings, streams, arrays, booleans, dictionaries, and open actions before importing them, preventing stale standard properties from becoming null while retaining unknown extension entries.
Sole complete-document transplants require trailer /Info to resolve to a dictionary, validate every standard text field and defined /Trapped state, and preserve custom entries.
Tagged merges validate private structure-root references, role-map names, and class-map attribute dictionaries or arrays before importing them, rejecting stale extension and mapping values without restricting valid direct extension data.
Tagged merges require every top-level structure-root kid to resolve to a structure-element dictionary, rejecting scalar and mistyped /K entries before graph remapping.
Tagged merges validate an explicit structure-root /Type as /StructTreeRoot for both source and destination trees.
Tagged Document element merges validate child MCIDs, structure-element role names, MCR identifiers and pages, and OBJR object and page dictionaries before combining their /K arrays.
Tagged merges require namespace dictionaries to declare /Type /Namespace, a text /NS identifier, and a dictionary /Schema when present.
Tagged ParentTree arrays preserve legal explicit null gaps while rejecting stale indirect entries, and every retained mapping dictionary must be a role-bearing structure element.
Tagged IDTree entries must point indirectly to role-bearing structure elements whose /ID bytes match the registered name-tree key.
Catalog developer-extension namespaces require a /BaseVersion name, a nonnegative /ExtensionLevel integer, and a string /URL when present.
Imported output intents validate /Type, the required /S subtype, descriptive strings, and destination ICC profile streams with defined component counts, color-space alternates, and ordered range bounds for both selected tagged imports and sole complete transplants.
Referenced output profiles validate mutual exclusivity with embedded profiles, 16-byte checksums, ICC version, profile color-space and name strings, nonempty URL arrays, URL file-system identities, address strings, and colorant-table containers.
PDF 2.0 output-intent mixing hints validate printing-order names and bounded solidity values while rejecting obsolete dot-gain data. Spectral-data dictionaries require stream values and cannot redefine a colorant already present in solidities.
Imported viewer preferences validate boolean display flags, defined page modes, reading directions, page-boundary areas, print-scaling and duplex values, ordered nonnegative print-page ranges, positive copy counts, and name-only enforcement arrays.
Imported catalog metadata streams validate /Type /Metadata and /Subtype /XML when those entries are present.
Imported catalog /Lang strings must decode cleanly and satisfy the same complete BCP 47 validation used by new-document authoring.
Imported catalog /Version names must use defined PDF version syntax rather than merely being name objects.
Imported catalog /PageMode and /PageLayout names must use defined standard values, including the bookmark-merge path.
Complete catalog transplants validate URI base strings and every standard MarkInfo boolean, including /UserProperties, for tagged and untagged sources.
Complete catalog transplants validate open destinations, catalog additional actions, recursive action dictionaries, and required local, remote, or embedded navigation, launch, URI, named, JavaScript, form submission, form reset, data import, hide, sound, movie, transition, thread, rendition, 3D-view, rich-media, and optional-content-state action operands, rejecting empty destinations, stale next actions, mistyped options, and cyclic or reused action graphs.
Action graphs now reject undefined subtype names and validate PDF 2.0 /GoToDp actions as indirect references to typed document-part dictionaries.
Launch actions validate window behavior and platform dictionaries, including required Windows file strings and optional directory, operation, and parameter strings. Embedded go-to actions recursively validate parent or child relationships, child names, page selectors, annotation names, and nested targets.
Named actions accept only the four defined page-navigation names. Movie actions support either title strings or typed Movie annotation targets and reject missing, mistyped, or wrong-subtype targets.
PDF 2.0 local go-to actions validate optional structure destinations with the same fit-mode and operand grammar as page destinations while requiring an indirect typed structure-element target.
Rich-media-execute actions require indirect RichMedia annotations, typed indirect instances when present, typed command dictionaries, text command names, and scalar or array arguments limited to strings, integers, reals, and booleans.
Imported page /AA dictionaries use the same recursive action validation as catalog and bookmark actions instead of accepting arbitrary dictionary values.
Imported page boxes require four finite numeric coordinates, rotations require supported multiples of 90 degrees, and duration, user-unit scale, preferred zoom, page identifiers, template-instantiation names, structure-parent keys, tab order, transition dictionaries, viewport arrays, production-box colors, and transparency groups validate their required types, bounds, modes, directions, dimensions, scaling, background flags, measures, and graph structure instead of accepting type-compatible invalid values.
Incremental page editing can set crop, bleed, trim, and art boundaries through the same typed page-box API used by new-document authoring.
Production-box edits on pre-PDF-1.3 inputs add a catalog version override, preserving the original header while declaring a version that supports bleed, trim, and art boundaries.
Incremental page editing can set bounded /UserUnit scaling on existing, new, and imported pages and raises the effective catalog version to PDF 1.6 when required.
Incremental page editing can set automatic display duration and every standard transition on existing, new, and imported pages, sharing canonical transition serialization with new-document authoring and raising the effective version for advanced PDF 1.5 transitions.
Imported page metadata requires a typed XML metadata stream, while thumbnails require image XObject streams with positive dimensions.
Imported page resources enforce defined procedure-set names and category-specific object types for graphics states, fonts, properties, color spaces, patterns, shadings, and XObjects. Property lists validate OCG and OCMD dictionaries, policies, group operands, and recursive visibility expressions; color spaces recursively validate calibrated, ICCBased, Indexed, Pattern, Separation, and DeviceN families, ICC alternates, ranges, and metadata, and sampled, exponential, stitching, or calculator functions; graphics states validate line geometry, dash patterns, opacity, overprint, rendering intent, defined blend modes, font pairs, and transparency-group soft masks; fonts validate defined subtypes, encodings, ToUnicode streams, Type 0 descendants, and Type 3 geometry and character procedures; tiling and shading patterns validate modes, geometry, resources, matrices, shadings, and graphics states; shadings validate type, color space, coordinates, bounds, backgrounds, extension flags, antialiasing, and required functions; image and form XObjects validate subtypes, dimensions, component depth, bounds, matrices, resources, and groups.
Imported calibrated color spaces validate white and black points, scalar or component gamma, calibration matrices, and ordered Lab ranges before resource graphs are imported.
Imported Indexed color spaces decode bounded lookup streams and require lookup bytes to match the palette size and base-space component count exactly.
Imported DeviceN color spaces validate NChannel attributes, registered colorant Separation spaces, process components, printing order, solidities, and dot-gain functions.
Imported image XObjects validate exclusive explicit and soft masks, mask kind, grayscale soft-mask color, matching mask dimensions, component-matched decode arrays, interpolation, rendering intent, embedded soft-mask modes, structure-parent keys, and image-mask color restrictions in addition to dimensions, color spaces, and component depth.
Imported Form XObjects recursively validate nested resource categories and entries, plus transparency-group identity, group color spaces, isolation and knockout flags, structure-parent keys, typed XML metadata, piece information, and optional-content dictionaries.
Imported fonts require subtype-appropriate base names and composite CMaps, and validate consistent character ranges and widths, encoding dictionaries and differences, complete finite font-descriptor metrics, mutually exclusive embedded font programs, plus recursive descendant-font and CID system information.
Imported Type 3 fonts require encodings, complete width ranges, numeric bounding and transformation arrays, stream character procedures, and dictionary resources.
Imported CID fonts validate finite default widths, horizontal and vertical metric-table grammar, CID ranges, and CID-to-GID mappings.
Imported extended graphics states validate flatness, smoothness, stroke adjustment, transfer functions, black generation, undercolor removal, halftone objects, and halftone phase arrays.
Imported mesh shadings require stream form, supported coordinate, component, and flag widths, bounded decode arrays, valid optional functions, and lattice row geometry.
Imported tiling patterns recursively validate every nested resource category and entry through a bounded resource graph.
Optional-content group usage validates creator, language, export, print, view, zoom, user, and page-element criteria, including defined visibility states and ordered zoom bounds.
Imported annotation subtype data validates markup authorship, rich text, reply relationships, required quadrilaterals, free-text appearance and callout data, line endpoints, defined line endings and caption geometry, polygon and polyline vertices, ink paths, popup parents, icon names, sound streams and parameters, redaction presentation, movie file specifications and geometry, 3D payloads, rich-media content, caret symbols, rectangle differences, watermark placement, projection measures, and required print appearances.
Imported annotation appearance characteristics validate rotation, border and background colors, captions, icon streams, icon-fit scaling and alignment, and text-position modes.
Imported annotations validate border effects, interior colors, marked and review state-model combinations, line measurement dictionaries, and finite leader-line geometry.
Imported free-text annotations validate default styles, callout endings, and rectangle differences; sound streams validate object identity; 3D annotations distinguish typed U3D or PRC streams from 3D-reference dictionaries and validate default views and activation bounds.
Imported rich-media annotations validate asset-tree, defined configuration subtypes, instance assets and parameters, view arrays, settings, and defined activation or deactivation condition structures.
Imported annotation /OC values use the complete optional-content membership validator, and page /PresSteps graphs validate typed navigation nodes, durations, actions, and bounded next or previous traversal.
Imported PDF 2.0 document-part page links require indirect typed /DPart dictionaries. Complete-document transplants validate the full indirect /DPartRootNode hierarchy, including node names, child arrays, reciprocal parents, page ranges, associated files, document-part metadata value types, cycle and reuse bounds, and prohibited XMP /Metadata entries.
Selected-page imports now reject document-part membership because importing a page without its catalog-level hierarchy would leave an orphaned /DPart graph.
Movie annotation activation dictionaries are validated using their own rate, volume, mode, and control semantics instead of being misclassified as generic action dictionaries.
Imported viewport measures validate rectilinear scale ratios and number formats, geospatial bounds and point arrays, coordinate-system dictionaries, conversion factors, and supported measure subtypes.
Imported annotation appearances use the full Form XObject validator, including bounded recursive validation of every appearance resource category and entry.
Imported page, annotation, piece-information, embedded-file, and document-information dates validate PDF date prefixes, calendar components, and timezone offsets instead of accepting arbitrary strings.
Imported embedded-file streams validate MIME subtype token syntax and require 16-byte checksum strings when checksums are declared.
Imported AcroForms validate defined field types, nonnegative flags and limits, bounded quadding, choice-option structure, widget rectangles, defined top-level signature flags, and recursively validated default resources before merging or transplanting fields.
Complete catalog transplants validate requirement dictionaries and handlers, article-thread roots and metadata, and collection identity, views, schema field definitions, sorting keys and directions, and initial-document values.
Collection schemas and sort dictionaries validate their own optional object identities instead of misclassifying /Type as a user field. PDF 2.0 collection colors validate five RGB triplets, split dictionaries validate defined orientations and positions from 0 through 100, and navigator dictionaries validate identity and layout names.
PDF 2.0 collection folders require an indirect single-root hierarchy with typed nodes, unique nonnegative IDs, names, reciprocal parents, indirect child and sibling chains, bounded traversal, valid metadata dates, image thumbnails, root-only free-ID ranges, and typed collection-item dictionaries.
Complete catalog transplants validate Web Capture version 1.0 information, indirect command dictionaries, URLs, levels, flags, posted data, HTTP metadata, and conversion settings. Requirement-handler dictionaries now require defined JS or no-op semantics and subtype-compatible scripts.
Imported article threads and page bead arrays now require indirect identities, typed thread and bead objects, one owning thread, valid page targets and rectangles, reciprocal next and previous links, bounded traversal, and a ring that closes at its first bead.
Standard catalog name-tree merges now validate JavaScript action dictionaries, visible and template page references, Form appearance streams, Web Capture page and image content sets, embedded alternate-presentation slideshows, and rendition dictionaries with media viability criteria while retaining unknown extension categories.
Web Capture content-set source information now validates required source URLs, URL-alias destinations and redirect chains, timestamps and expirations, page-set submission modes, and indirect retrieval-command dictionaries with typed request data.
Named rendition objects now validate bounded selector trees and media-rendition payloads, including required clips or play parameters, typed media clips, media data, content types, permissions, alternate descriptions, screen parameters, and section parent clips.
Media rendition play and screen parameters now validate object identity, player containers, volume, controller and autoplay flags, fit modes, repeat counts, duration dictionaries, window modes, RGB backgrounds, opacity, monitor selectors, and required floating-window parameters.
Media duration, timespan, and clip-section offset dictionaries now validate defined object and subtype names, finite nonnegative seconds, nonnegative frame numbers, marker strings, and begin or end offset structures.
Media player collections now validate typed player records, required player identifiers, version arrays, and operating-system names. Media permissions validate their typed dictionaries and defined temporary-access modes.
Media-clip payloads now validate file specifications or XObject streams through their complete object rules, and alternate descriptions require complete language and text string pairs.
Complete catalog transplants validate catalog piece-information dates and legal-attestation identity, text, modification dates, and defined feature declarations.
Imported annotations validate their type, required subtype and finite four-number rectangle, common text and nonnegative flag fields, bounded device colors and opacity, numeric quadrilaterals, legacy borders, typed border styles, link highlighting, text-open state, page links, nonnegative structure-parent keys, file-attachment specifications, associated files, and normal, rollover, down, and state-selected appearance Form XObjects with valid bounds, matrices, resources, and groups, plus actions, additional actions, and destinations before their page annotation arrays are rebuilt.
Page and catalog associated files, embedded-file name trees, structure-root associated files, and pronunciation lexicons share validation for file-specification types, file names, embedded-file dictionaries and streams, stream subtypes and parameters, descriptions, file systems, supplemental dictionaries, and relationship names.
Tagged merges require catalog /MarkInfo dictionaries with boolean /Marked and /Suspects flags instead of copying stale or mistyped marking state.
Complete outline imports require source catalog /PageMode to resolve to a name before installing it in a destination that has no existing page mode.
Complete outline imports recursively validate child lists, item reuse, titles, exact explicit-destination syntax, recursive action graphs, associated structure elements, counts, flags, and colors before importing bookmark graphs.
Additional catalog name-tree categories reject stale indirect values while retaining valid extension-defined direct objects and complete graphs.
Selected optional-content imports now remove stale indirect references from recursively pruned default and alternate configurations instead of preserving literal null entries in layer-order and usage arrays.
Optional-content configuration merges reject duplicate source or destination /OCGs registrations by complete indirect identity instead of emitting ambiguous layer catalogs.
Optional-content group registrations must resolve to dictionaries with string names, valid /OCG types, dictionary usage data, and name-valued intents; stale or mistyped registrations fail before import.
Optional-content default and alternate configurations validate their text labels, creator strings, defined list modes, and name-valued intents before merging.
Optional-content /ON and /OFF arrays reject duplicate references and groups not registered in /OCGs.
Optional-content configurations validate locked groups, radio-button groups, recursive display order, and usage-application dictionaries against the registered /OCGs; selected-page pruning still removes stale order entries safely.
Selected-page imports preserve name-tree and legacy named destinations that target retained pages, ignore unrelated registrations belonging only to omitted pages, and reject selected-page links whose named target was omitted.
Added positioned and escaped Latin-1 text with automatic resources for all 14 built-in Type 1 fonts.
Added text matrices, line leading and next-line movement, character and word spacing, horizontal scaling, baseline rise, and all eight PDF text rendering and clipping modes.
Added positioned text arrays for built-in Latin-1 and embedded Unicode fonts, enabling deterministic kerning and per-run glyph advances while retaining Unicode mappings.
Added bounded TrueType/OpenType inspection for names, metrics, embedding permissions, widths, Unicode cmap formats 4 and 12, deterministic glyf/loca subsetting with composite dependencies, full-file CFF-flavoured OpenType embedding, CIDFontType0 and CIDFontType2 descendants, and ToUnicode maps.
TrueType/OpenType inspection now also reads Unicode cmap formats 0, 2, 6, 8, 10, and 13 with bounded byte, subheader, trimmed, or mixed UTF-16/32-bit mappings, ordered groups, supplementary-plane support, is32 validation, glyph-range validation, and deterministic subtable priority.
Added supplemental cmap format 14 variation-sequence lookup with default base-glyph fallback, non-default glyph mappings, ordered variation selectors, bounded UVS offsets and ranges, and binary-search resolution.
Embedded-font authoring now maps supported Unicode variation sequences to a single glyph across page content, forms, visual annotations, and incremental annotation appearances, and preserves the complete sequence in ToUnicode maps for extraction and accessibility.
Embedded fonts now use explicit encoding CMaps and independent character codes when multiple Unicode sequences share one rendered glyph, preserving accurate ToUnicode extraction without duplicating or changing the glyph. Text-field appearances use the same encoding, including one-cell handling for variation sequences in comb fields.
Added image XObjects with bounded 8-bit JPEG frame, component, scan, and termination inspection plus lossless DCT passthrough for grayscale, RGB, and CMYK images; deterministic Flate compression for raw grayscale, grayscale-alpha, RGB, RGBA, CMYK, and CMYK-alpha pixels; overflow-safe exact pixel-length validation; reusable resources; mirroring; and alpha soft masks.
Added authored page thumbnails with JPEG, grayscale, RGB, RGBA, or CMYK image reuse, including shared indirect objects and alpha soft masks when the same artwork also appears on a page.
Added Unicode metadata in both the information dictionary and XMP, document language, timezone-preserving dates, and stable content-derived trailer identifiers.
Added new-document page layouts, initial navigation modes, reading direction, window chrome preferences, document-title display, print scaling, duplex selection, and PDF-size paper-tray selection, while retaining mandatory PDF/UA title display.
Added typed page transitions for replace, split, blinds, box, wipe, dissolve, glitter, fly, push, cover, uncover, and fade effects, plus automatic-presentation page durations and strict direction, motion, scale, and timing validation.
Added tagged PDF and PDF/UA-2 authoring with semantic marked content, artifact sequences, nested standard structure elements, PDF 2.0 namespaces, alternate descriptions, replacement text, page structure-parent keys, deterministic parent-tree mappings across multiple pages, accessibility identification metadata, and guarded conformance checks that reject unsupported or untagged content instead of making a false compliance claim.
Added safe external HTTP, HTTPS, and email links plus direct internal page links, with validated rectangles and rejection of executable or local-file actions.
Added link appearances with solid, dashed, beveled, inset, and underline borders; configurable widths, dash arrays, and horizontal or vertical corner radii; RGB colors; and none, invert, outline, or push activation highlights across external, page, and named links.
Added precise destination views to direct page links and multi-run or rotated /QuadPoints hit geometry for URI, direct-page, and named-destination links, with tight union rectangles and shared geometry validation. Links now also carry stable names, page back-references, Unicode descriptions, shared author/subject/date metadata, and typed annotation flags.
Added Unicode outline authoring with internal destinations, arbitrary nested bookmark levels, linked parent/child/sibling relationships, accurate visible-descendant counts, and automatic catalog outline mode.
Added bookmark presentation and viewer state with bold and italic styles, RGB title colors, precise page destinations using every supported view mode, shared Unicode named-destination targets for bookmarks and document open actions, explicit open or collapsed branches, signed branch counts, and root counts that reflect only currently visible outline items.
Added embedded files with strictly encoded portable file names, structurally validated two-token MIME types, descriptions, dates, associated-file relationships, catalog registration, and a sorted embedded-files name tree. File-name safety is platform-independent rather than relying on host-specific path rules.
Complete document merges now resolve embedded-file registration-name collisions with deterministic suffixes while preserving each imported file specification, payload, and associated-file relationship.
Selected-page imports now preserve page-local file-attachment annotations without copying the source catalog's global embedded-file or associated-file registrations, and omitted pages no longer bring along unrelated attachment payloads.
Ordinary pages can now be selected from AcroForm documents without transplanting unrelated document-level form state; selected pages containing widgets still require a complete import so their field hierarchy cannot be orphaned.
Selected-page imports now leave source-global bookmark trees behind while preserving the destination bookmark tree; complete-document imports continue to merge and remap bookmark hierarchies.
Selected-page imports now leave source-global additional name-tree categories, such as JavaScript registrations, behind while preserving the destination categories; complete imports retain deterministic merging and duplicate-key rejection.
Selected-page imports now preserve only destination developer-extension namespaces; complete imports still merge distinct source namespaces and reject collisions.
Untagged pages can now be selected from otherwise tagged documents without copying the source structure tree or marking state, while pages carrying /StructParents still require complete tagged-document import.
Selected pages from optional-content documents now receive bounded dependency analysis across resources, object graphs, form and pattern streams, and content tokens, with inline-image payloads excluded from lexical matching. Genuinely unlayered pages import without source /OCProperties; pages using OCG or OCMD state still require complete layered-document import.
Added a selected-page corpus gate that imports and reopens the first page of every openable input while separating intentional document-level dependency boundaries from source syntax damage and output failures.
Selected tagged pages can now be imported individually or as reordered subsets. The source structure tree, ParentTree, IDTree, page references, and document element hierarchy are pruned and remapped through a non-mutating source overlay; subsets merge into tagged destinations or combine in empty destinations, preserve PDF/UA conformance context, and remain isolated across distinct AES-256 keys. Tagged content is still rejected beside existing or newly added untagged pages.
Selected form pages now import only widget fields reachable from the selected annotations, retaining hierarchical ancestors while pruning /Kids, calculation order, omitted fields, and unrelated form extensions. Pruned forms merge with destination forms using existing field-name and resource-collision guards, preserve deterministic legacy /ProcSet unions, and work across distinct AES-256 keys without exposing field values.
Selected layered pages now collect OCG dependencies from their bounded page graphs, prune unreferenced groups from /OCProperties, recursively filter default and alternate configuration structures, preserve selected visibility, and merge multiple layered sources or existing destination configurations. Nested form dependencies and distinct AES-256 keys are supported without copying omitted layer names.
Complete document merges now preserve additional catalog name-tree categories and their reachable object graphs, while partial imports and duplicate cross-document keys fail explicitly when generic rename semantics would be unsafe.
Complete document merges now combine distinct catalog developer-extension namespaces and their indirect graphs; partial imports and conflicting namespace definitions fail explicitly.
Sole complete AcroForm transplants preserve XFA packets and their catalog /NeedsRendering state when the destination has no form; combining XFA with another form remains fail-closed.
Sole complete-document imports into an empty destination now preserve the source catalog's remaining standard and extension-defined entries, remap catalog back-references and page targets, and discard /Perms signature state that cannot remain valid after reconstruction.
Incremental updates can explicitly replace or remove the trailer document-information dictionary. Sole complete-document transplants use this to keep source /Info metadata aligned with the imported XMP and catalog metadata while retaining the target file's permanent identifier.
Incremental object freeing removes inherited trailer /Info only when the freed active generation is the exact registered information object; stale registrations are not silently rewritten merely because their object number was reused.
Tagged editing now composes removal of existing tagged pages with complete tagged-document merges in one incremental revision, including direct or indirect parent trees, pruned structure children, remapped parent keys, and updated next-key state.
Multiple transformations can compose replacements for the same existing indirect object in one incremental update; the final replacement is emitted once with the original generation.
Added AcroForm text and comb fields, checkboxes, multi-page radio groups, and editable or fixed combo boxes with stable names, values, widget links, appearances, resources, and matching on/off states. Checkbox and radio export values cannot collide with the reserved /Off appearance state.
Added Unicode AcroForm tooltips and mapping names for accessible field descriptions and stable export mappings, plus read-only, required, and no-export behavior across text fields, checkboxes, radio groups, and combo boxes.
Added single-select AcroForm list boxes with validated options and selections, Unicode font support, visible row appearances and selection highlighting, accessibility metadata, and shared field behavior.
Added multi-select AcroForm list boxes with option-ordered value arrays, matching selection indices, multiple highlighted appearance rows, and validation against duplicate or unknown selections.
Added validated list-box top indices with matching /TI serialization and appearance viewports for long option lists.
Added AcroForm push buttons with safe HTTP, HTTPS, or email URI actions, Latin-1 or embedded Unicode labels, generated appearances, accessibility metadata, and shared field behavior.
Added internal-page push buttons using the shared precise destination serializer for fit, coordinate, rectangle, and bounded-zoom views.
Added push buttons targeting shared Unicode named destinations, with definition-order validation and compact GoTo actions.
Added reset-form push buttons for all fields or validated named subsets, including PDF exclusion semantics for resetting every field except the listed set.
Added default values matching authored initial values across text, checkbox, radio, combo, and list fields so reset actions restore deterministic initial state.
Added independent text-field default values so reset actions can restore a value other than the initially displayed one, with matching Unicode, line-break, and maximum-length validation.
Added independent checkbox and radio-group default states while preserving current widget appearance states, enabling reset actions to restore intentionally different selections.
Added independent combo-box and list-box default selections, including option-ordered multi-select defaults and export-value validation, so resets can restore a different choice state.
Added typed file-selection text fields with the PDF file-select flag and validation against incompatible multiline, password, or comb behavior.
Added XHTML rich-text values for text fields with secure XML parsing, required XHTML body roots, the matching rich-text field flag, and rejection of password, file-selection, or comb combinations.
Added reusable text-field visual styles with optional backgrounds and borders, RGB text colors, finite nonnegative border widths, matching widget appearance characteristics, and generated appearances for single-line, multiline, password, and comb fields.
Extended reusable visual styles to combo boxes and list boxes, including default appearances, widget background and border characteristics, and styled generated text and selection-list appearances.
Extended reusable visual styles to every push-button action and visible unsigned-signature prompt, keeping action highlighting and embedded-font behavior while synchronizing widget characteristics and generated appearances.
Extended reusable visual styles to checkbox and radio-button widgets, applying configurable backgrounds, borders, widths, and mark colors consistently to widget characteristics and every on/off appearance state.
Added typed rollover and pressed captions to every push-button action, with Unicode font validation, matching widget characteristics, and independently generated normal, rollover, and down appearance streams.
Added measured left, center, or right push-button caption alignment across normal, rollover, and down appearances, using actual embedded-font advances when available.
Added all five standard widget border styles with matching solid, validated dashed, beveled, inset, or underline /BS dictionaries and generated appearances across rectangular and radio-button widgets.
Added reusable RGB or RGBA push-button icons with all seven standard caption positions, proportional or independent scaling, always/never/too-large/too-small scale policies, normalized alignment anchors, fit-to-bounds behavior, matching icon-fit dictionaries, and generated icon artwork across normal, rollover, and down states.
Added independent rollover and pressed push-button icons with /RI and /IX widget characteristics, shared image deduplication, and state appearances generated even when only the icon changes.
Added measured left, center, or right visible signature-prompt alignment plus typed optional or required Adobe.PPKLite signing-handler seed constraints with the correct filter flag.
Added typed PDF 1.5, PDF 1.7, or PDF 2.0 signature seed-parser capability constraints, written as the specification-required real number with an independently enforceable required flag.
Added signature seed constraints for RFC 3161 timestamp servers and legal attestations, including independent required timestamp and attestation controls with strict URL and list validation.
Added complete typed X.509 signing-certificate seed constraints for acceptable signer and issuer certificates, certificate-policy object identifiers, subject distinguished names, all nine standard key-usage bits, and credential-enrollment or signature-service URLs, with independent required enforcement and strict validation.
Added PDF 2.0 document-change permissions to signature field locks, covering no changes, continued form filling and signing, or annotation changes, and corrected both field-lock and seed-value dictionaries to use their required indirect-object form.
Completed standard PDF 2.0 signature seed-value authoring with typed automatic, required-lock, or required-unlocked document intent and named signing-appearance constraints, including their independent required flags and validation.
Detached approval signing now fills an existing named unsigned signature field in place, preserving its widget appearance, geometry, field lock, seed constraints, hierarchy, and annotation placement while adding only the signature value and required signature flags.
Detached approval signing now analyzes existing DocMDP certification permissions, permits signing through pre-authored fields at permission levels 2 and 3, rejects no-change certification, refuses to add fields to certified documents, and fails closed on malformed or ambiguous certification transforms.
Added detached certification signatures with all three DocMDP permission levels, catalog permission registration, direct standard transform dictionaries, first-signature enforcement, and safe composition with newly created or existing signature fields.
Signing a field with an authored lock now binds its action, field list, and document-change permission into the signature through a standard FieldMDP transform, so the preserved lock participates in signature validation instead of remaining descriptive metadata.
Detached signing now enforces required seed-value constraints for the signing handler, parser capability, encoding, digest declaration, reason, legal attestation, revocation declaration, approval or certification mode, document-lock intent, named appearance, RFC 3161 timestamp token, and timestamp server.
Signature inspection now requires the byte-range gap to be exactly the literal or hexadecimal /Contents string. A range that excludes any additional document byte is reported as structurally invalid before CMS verification.
Certification inspection now matches the complete /Perms /DocMDP object number and generation and resolves that target before trusting it, so stale certification references fail closed.
Signature discovery, field-name validation, existing-field lookup, and signed-field detection now use complete indirect identities for AcroForm traversal, preventing stale generations from being misreported as cycles or duplicate fields.
DocMDP and FieldMDP inspection now validates optional transform-parameter /Type and /V entries when present, honoring the standard /1.2 default while rejecting contradictory explicit values.
Added signer-certificate enforcement for exact acceptable certificates, linked issuer evidence, certificate-policy OIDs, subject distinguished names, all nine key-usage constraints, and acquisition URLs. Required signer certificates must also be embedded in the returned CMS and selected by its signer identifier.
Added structural signature inspection for unsigned and signed AcroForm fields, including hierarchical field names, approval or certification identity, filter and encoding names, bounded byte-range validation, whole-document coverage, raw placeholder contents, padding-free bounded CMS values, and exact reconstruction of the bytes supplied to detached-signature verification.
Added detached CMS cryptographic verification with separate mathematical-integrity and certificate-chain-trust results, using the platform PKCS implementation and reconstructed signed bytes without conflating an untrusted signer certificate with a broken signature.
Added signed-revision analysis that reopens the exact signed PDF prefix, counts later incremental revisions, and identifies indirect objects added, updated, or freed after the signature, including hybrid cross-reference entries.
Added conservative DocMDP assessment to signed-revision analysis: unchanged certification signatures are reported cleanly, later changes under no-change certification are reported as prohibited, and permission levels requiring object-level semantic interpretation are explicitly sent for review rather than falsely marked valid.
Detached signing now rewrites direct signature-field dictionaries at the AcroForm root or inside nested field trees while preserving indirect ancestors, and it signs pre-authored fields in tagged PDFs without changing their structure trees.
Creating a signature field while signing a tagged PDF now adds a page-linked /Form structure element, annotation object reference, parent-tree mapping, widget structure-parent key, and accessible alternate description. Direct structure roots are safely indirected with repaired top-level parents.
Bookmark-tree merging now accepts direct destination outline roots by indirecting the root and repairing existing top-level parent and sibling links before imported bookmark segments are attached.
Added optional or required signature revocation-information inclusion constraints with validated required-state semantics and the matching seed-value flag.
Added full-PDF submit buttons restricted to HTTP or HTTPS endpoints, with URL file specifications and validated include or exclude field lists.
Added typed push-button highlighting for none, invert, outline, push, and toggle interaction modes.
Added typed checkbox marks with matching appearance characteristics and generated check, cross, circle, diamond, square, or star artwork.
Added clipped multiline text-field appearances with normalized line endings, explicit baselines and leading, plus rejection of line breaks in single-line fields.
Added masked password-field appearances that never paint the original value, with embedded-font mask-glyph validation and rejection of incompatible multiline password fields.
Added comb-field appearances with evenly divided cells and independently positioned glyphs matching the declared maximum length.
Added left, centered, and right text-field alignment with matching /Q values and measured appearance positioning for embedded fonts.
Added width-aware multiline wrapping with preserved paragraph breaks and hard wrapping for individual words wider than the field.
Added initial-value fit validation for no-scroll single-line and multiline fields so authored content is not inaccessible from the outset.
Added combo-box and list-box options with separate export and display values, preserving compact scalar options when both values are identical.
Added left, centered, and right choice-field alignment with matching /Q values and measured combo or list appearance positioning.
Added typed signature-field locks for all fields or validated include and exclude subsets, ready to take effect when the field is signed.
Added typed signature seed values for detached PKCS#7 or CAdES encodings, validated SHA-256, SHA-384, or SHA-512 digest constraints, permitted signing reasons, and approval or certification-signature permissions, with independently enforceable required flags.
Added unsigned digital-signature fields with page-linked widgets, document signature flags, accessibility and mapping metadata, shared field behavior, and collision-safe names.
Added optional visible unsigned-signature prompts with generated border and text appearances, Latin-1 or embedded Unicode fonts, and PDF/A-safe embedded-font enforcement.
Added typed radio-group behavior for preventing toggle-to-off and selecting identically named controls in unison, serialized alongside common field flags.
Added typed choice-field behavior for sorted option arrays, spell-check suppression, and immediate commit on selection changes across combo and list fields.
Added typed text-field behavior for spell-check suppression and preventing scrolling beyond the visible field bounds.
Added embedded Unicode TrueType fonts to text-field and combo-box values and appearances, sharing deterministic subsets through the AcroForm default resources.
Added bounded Gray, RGB, and CMYK ICC profile loading with mandatory tag-table presence, unique tag signatures, aligned in-range tag data, and trailing-byte trimming, plus PDF/A-4, PDF/A-4e, and PDF/A-4f authoring with required metadata, output intents, flavour-specific identification schemas, and associated embedded files.
Added editable PDF 2.0 text notes with all seven standard icon names, marked or review workflow states, named direct or grouped reply relationships, and linked popup windows; highlights, underlines, strikeouts, and squiggles over multiple axis-aligned or rotated text runs; left-, center-, or right-aligned multiline free-text boxes with solid or dashed borders; solid or dashed lines and polylines with all ten standard PDF line-ending styles and optional interior colors; solid or dashed polygons, rectangles and ellipses; solid or dashed multi-stroke ink; and image stamps with all standard semantic stamp identities, Unicode contents, optional author, subject, creation and modification metadata, typed print and interaction flags, and deterministic appearances.
Added standard intent semantics for ordinary, callout, and typewriter free text; arrow and dimension lines; polyline and polygon dimensions; and polygon clouds. Free-text callouts include validated two- or three-point geometry, standard line endings, expanded annotation bounds, and matching explicit appearances.
Added visible file-attachment annotations with graph, paperclip, push-pin, and tag identities, page-linked appearances, shared embedded-file specifications, Unicode contents, and annotation metadata, including PDF/A-4f associated-file authoring.
Added editorial caret annotations with optional paragraph symbols and scalable vector appearances, plus multi-run and rotated redaction marks with explicit review appearances, distinct post-redaction fill colors, and optional aligned or repeated replacement text. Redaction marks identify content for later removal and do not falsely report that page content has already been sanitized.
Added image-stamp annotations for pictures and scanned signatures. JPEG payloads remain untouched, repeated stamps share image resources, and RGBA stamps preserve transparency through shared soft masks.
Added deterministic incremental updates that append without changing any source byte, preserve generations and trailer inheritance, retain permanent identifiers, advance revision identifiers, and work across classic, hybrid, cross-reference-stream, and compressed-object sources.
Incremental updates can now explicitly emit sparse PDF 1.5+ cross-reference streams with optional deterministic Flate compression, correct /Prev chaining, and encryption exemption, while classic tables remain the default.
Added an incremental cross-reference-stream smoke generator whose compressed output passes qpdf structural validation.
Incremental cross-reference-stream revisions can now pack eligible generation-zero updates into deterministic object streams bounded at 100 objects each, with optional Flate compression and authenticated encryption of the containing stream. qpdf recognizes and validates the emitted compressed entries.
Existing generation-zero objects can be superseded by deterministic compressed entries in an incremental revision, including catalog replacements.
Incremental structural output now honors valid catalog /Version overrides when checking whether PDF 1.5 cross-reference and object streams are permitted.
Incremental structural output uses a pending catalog /Version override only when the replacement matches the trailer /Root object number and generation; a stale root cannot borrow an unrelated active replacement to authorize newer syntax.
Full cross-reference-stream rewrites now apply the same effective-version rule, allowing a PDF 1.4 header with a valid catalog /Version /1.5 override to retain its header while using PDF 1.5 structures.
Incremental updates can now free existing direct or compressed objects with advanced generations and complete object-0 free-chain updates in classic tables or cross-reference streams. Freeing and replacing the same object composes to the final requested action, and a two-revision smoke output passes qpdf.
Prior compressed-object entries can be freed directly and are superseded by generation-one free entries without resolving the obsolete packed value.
Incremental freeing now protects the catalog and encryption dictionary from becoming dangling trailer roots and automatically removes inherited /Info when its backing object is freed, while final-action composition still permits free-then-replace workflows.
Newly freed objects now link to the inherited free-list head, and canonical free actions contribute to revision-identifier derivation so distinct free-only revisions receive distinct updated /ID values.
Incremental page and annotation editors now accept structural write options and can emit compressed cross-reference and object-stream revisions. The compressed annotation-editor smoke output passes qpdf.
Compressed page editing works across independently encrypted AES-256 source and destination documents, and a dedicated AES-256 compressed incremental smoke output authenticates and passes qpdf without syntax or stream errors.
Detached signatures now accept compressed cross-reference and object-stream policies while keeping only the patchable signature dictionary direct. A real certification CMS revision contains compressed field updates and passes OpenSSL, KillerPDF verification, and qpdf.
AES-256 encrypted documents can receive cryptographically verified signatures with compressed cross-reference and object streams while retaining destination-password authentication and a direct signature dictionary.
Signed-revision analysis now has explicit coverage for added compressed objects, updated objects, and freed objects in later structural revisions.
Signed-revision analysis now reports malformed filtered cross-reference data, unsupported historical syntax, and numeric overflow in a signed prefix as an invalid historical revision instead of throwing.
AES-256 encrypted annotation editing can emit compressed object streams, reopen annotation text with the destination password, and keep that text out of clear file bytes.
Incremental page and annotation editors now enforce catalog DocMDP certification permissions before writing. Page-tree changes are rejected under every certification level, while annotation changes require permission level 3; malformed certification structures fail closed.
Full rewrites now reject documents containing signed signature fields by default because rewriting necessarily invalidates their byte ranges. Callers performing deliberate archival or forensic rewrites must explicitly opt in to signature invalidation.
Added a source-preserving incremental corpus mode. It appends, reopens, and resolves a marker across 2,235 of 2,236 normalized fixtures; only the intentionally undefined PDF 1.9 header is rejected.
Added password-authenticated Standard Security reading for revisions 2 through 6, including user and owner passwords, RC4, AES-128, AES-256, independent string, stream, and embedded-file crypt filters, cleartext metadata, encrypted object streams, and unencrypted cross-reference streams.
Encrypted documents can now receive incremental updates, full rewrites, and detached signatures without exposing new strings or streams. Encryption dictionaries and permanent identifiers are preserved, signature contents remain verifiable, and outputs interoperate with qpdf across every supported security revision.
New PDF 2.0 documents can now be authored with AES-256 revision 6 password protection, distinct user and owner credentials, encrypted strings, streams, metadata, and embedded files, authenticated typed controls for printing, modification, copying, annotations, form filling, accessibility extraction, and assembly, and explicit rejection of encryption combined with PDF/A conformance.
Revision 5 and 6 password encoding now rejects unpaired UTF-16 surrogates instead of silently replacing them during UTF-8 conversion, preventing invalid passwords from collapsing to identical authentication bytes.
Revision 6 password preparation now removes every RFC 3454 table B.1 character before compatibility normalization. User and owner passwords containing soft hyphens or BOMs authenticate through their mapped forms in KillerPDF and qpdf.
Revision 6 password preparation now rejects SASLprep-prohibited controls, formatting and direction controls, private-use scalars, noncharacters, inappropriate plain-text and canonical characters, and tagging characters.
Revision 6 password preparation now enforces generated Unicode 3.2 A.1, D.1, and D.2 tables, including unassigned-code-point rejection and complete RandALCat/LCat endpoint and mixing rules. Non-ASCII spaces and compatibility characters map to qpdf-compatible forms.
AES-256 authentication now validates the permission block's required reserved bytes. Revisions 2 through 6 reject a non-boolean /EncryptMetadata value rather than silently treating malformed state as false, and named crypt filters validate method-specific lengths and authentication-event values.
Standard Security crypt-filter selectors now honor the specified /Identity default when /StmF or /StrF is omitted, and crypt-filter dictionaries honor the specified /None method default when /CFM is omitted. Explicit malformed selector and method values remain rejected.
Password-authenticated documents now expose whether the user or owner password succeeded plus a typed view of every declared operation permission. High-level page, annotation, signing, import, and full-rewrite operations enforce user-password assembly, rotation, page-box, annotation, form-filling, content-copying, and general-modification restrictions, while owner authentication retains unrestricted access and the low-level incremental builder remains available for deliberate forensic revisions. Legacy authentication prefers a valid owner path so an identical owner and user password is not downgraded to user privileges.
Typed encryption options reject the contradictory combination of high-quality printing with printing disabled, and authenticated permission views only grant high-quality printing when the base printing permission is also present.
Standard Security revisions 2 through 6 now validate every required zero and one bit reserved by /P, preventing malformed permission words from being accepted or exposed as authorization state.
Legacy Standard security now rejects non-byte-aligned 40-bit through 128-bit key lengths instead of truncating malformed bit counts during byte conversion.
Legacy Standard security now honors the specified 40-bit default when the optional global /Length entry is omitted.
Revision 2 through 4 passwords now use complete, strict PDFDocEncoding rather than lossy Latin-1 replacement. Euro-sign user and owner passwords authenticate against an independently generated qpdf AES-128 fixture, and unrepresentable Unicode fails explicitly.
Legacy Standard-security dictionaries now require a defined V=1/R=2, V=2/R=3, or V=4/R=4 algorithm and revision pair.
Structural inspection now distinguishes missing or incorrect encryption credentials from document damage: unauthenticated files request authentication without requiring repair, while password-aware inspection resolves encrypted compressed objects and reports incorrect credentials without throwing.
Authenticated structural inspection now reports corrupted AES ciphertext in an indirect stream as object damage rather than throwing or misclassifying it as a credential failure.
Password rejection now has a dedicated internal failure type, allowing inspection to distinguish incorrect credentials from authenticated encryption-integrity damage such as a corrupted AES-256 permission block.
Authenticated round-trip validation now verifies two clean rewrites with equivalent decrypted logical object graphs while preserving fresh randomized AES IVs instead of requiring byte-identical ciphertext, and reports incorrect credentials without throwing.
Explicit stream crypt-filter selection now rejects malformed /Filter and /DecodeParms arrays, and /EFOpen authentication events cannot be assigned to /StrF or /StmF document-open filters.
Added explicit stream /Crypt filter support with required first-filter ordering, /Identity cleartext selection, named RC4 or AES crypt-filter selection, decoder integration, and faithful incremental and full-rewrite preservation.
Authenticated pages from password-protected PDFs can now be imported into plain or encrypted destinations, with decrypted source objects re-encrypted under the destination security handler while unauthenticated sources remain fail-closed.
Existing optional-content documents now permit safe page removal, addition of unlayered pages, and complete layered-document merges. OCG arrays, default visibility, display order, locked groups, radio groups, usage applications, alternate configurations, and imported page-property references are combined while ambiguous /Unchanged source states remain fail-closed.
Existing tagged documents now permit complete page reordering, insertion of truly blank pages, and page removal. Removed-page marked-content and object-reference items are pruned recursively, affected structure elements retain their object identities, and direct or indirect ParentTrees are rebuilt without removed page keys.
Complete tagged documents can now be merged into an existing tagged destination with collision-free structure-parent keys and IDs, combined ParentTrees, IDTrees, namespaces, associated files, and pronunciation lexicons, one retained PDF/UA Document root, repaired top-level parents, direct-root normalization, and collision-safe RoleMap and ClassMap renaming. Unknown source root extensions remain fail-closed instead of being silently discarded.
Complete tagged-document merges now preserve distinct extension-defined structure-root entries and their reachable object graphs. Colliding extension keys and selected-page imports with unknown extension dependencies remain fail-closed.
Selected tagged-page imports no longer copy source-global developer-extension namespaces through the PDF/UA conformance-property path. Complete imports still preserve and merge distinct namespaces.
Tagged complete-document merges seed the shared structure root and top-level Document identities before importing catalog and structure-root extension graphs, so extension-defined back-references resolve to the merged objects instead of cloning or double-mapping the source structure tree.
Incremental annotation editing now normalizes a direct catalog structure-tree root through the unambiguous indirect parent referenced by its top-level elements. A direct top-level Document element is promoted in place with a repaired parent link, preserving tagged/PDF/UA structure instead of rejecting or misattaching the update. Ambiguous direct roots remain fail-closed.
Tagged incremental annotation updates resolve indirect structure-root /Namespaces arrays, indirect root-kids arrays, and indirect Document-kids arrays. Namespace selection still chooses the PDF 2.0 standard namespace, and appended annotation elements remain flat siblings instead of nesting an array reference as a child.
Incremental annotation normalization reuses the indirect top-level Document identity referenced by existing children, so old and appended structure elements share one parent and IDTree or extension references cannot remain attached to a duplicate. Ambiguous child parent identities fail closed.
PDF/UA-2 authoring rejects the generic H structure type as required by the UA-2 validation profile and directs callers to H1 through H6; ordinary tagged-PDF authoring continues to support generic headings.
Tagged document merging and incremental annotation editing use checked structure-parent key allocation. An exhausted long key space now fails before writing instead of wrapping /ParentTreeNextKey and new /StructParent values negative.
Structure-specific ParentTree handling rejects negative existing keys and negative declared /ParentTreeNextKey values in tagged merge and incremental annotation paths, while the generic number-tree reader remains available for signed-key trees outside structure semantics.
Complete tagged-document merges and selected-page structure pruning flatten indirect structure-root and top-level Document kids arrays, retaining one Document root and a valid sibling sequence instead of nesting array objects as structure children. Reused indirect kids arrays remain malformed shared structure and fail closed.
PDF/UA authoring assigns page and annotation ParentTree keys through one checked monotonic allocator across links, widgets, notes, markup, editorial annotations, and attachments. /ParentTreeNextKey is taken from the allocator's final state rather than recomputed through unchecked count sums.
Tagged complete-document merging promotes a direct destination Document by reusing the unambiguous indirect identity referenced by its children, retaining child parent links, IDTree targets, and extension references on one object. Direct source Document elements use the same identity rule; ambiguous child parent references remain fail-closed.
AcroForm merging now preserves distinct catalog-level extension entries and their imported object graphs, reports extension-key collisions explicitly, and keeps XFA merges fail-closed because independent template and dataset packets cannot be combined safely without XFA-specific semantics.
Added bounded ASCIIHex, ASCII85, RunLength, and LZW stream decoding with abbreviations, chained pipelines, malformed-data rejection, LZW table resets and PDF EarlyChange, and predictor processing after each decoded stage. Safety limits also cover unfiltered data and Crypt pass-through stages. TIFF and PNG predictors support all standard 1, 2, 4, 8, and 16-bit component depths; fixed PNG predictors enforce their declared row filter while predictor 15 permits mixed optimum filters.
Added byte-preserving PDF 2.0 approval signing with invisible AcroForm signature fields, exact fixed-width byte ranges, bounded detached CMS placeholders, ETSI.CAdES.detached signature dictionaries, Unicode signer details, existing-form preservation, and a dependency-free callback boundary for software certificates, cloud keys, and hardware tokens.
Added byte-preserving annotation editing for existing PDFs, including shared embedded-font free-text resources and direct or indirect annotation arrays in nested page trees.
Added byte-preserving blank-page insertion, rotation, reordering, deletion, resizing, and cropping. Retained page identities, contents, inherited resources, boxes, and rotations remain intact when page trees are rebuilt.
Added cross-document page import for merge and split workflows with deterministic reference remapping for encoded streams, content, fonts, images, resources, ordinary annotations, direct links among imported pages, and independent repeated copies of the same source page.
Added document metadata, language, viewer-preference, and output-intent preservation when one complete source is transferred into an empty destination, retaining its archival and accessibility declarations instead of silently dropping them.
Added complete tagged-PDF structure transfer into empty destinations, preserving the structure tree and parent mappings. Partial or combined tagged imports and page-set changes that would leave stale structure data now fail explicitly, while complete tagged page sets can still be reordered safely.
Added complete AcroForm preservation when all pages of a form document are imported, including merges into destinations that already contain forms and merges from multiple form documents. Field arrays, hierarchical field identities, signature flags, calculation order, default quadding, and default resources are reconciled deterministically; imported default appearances receive collision-free resource names even when the source uses escaped PDF names, while true duplicate field names and unsafe partial imports fail explicitly.
Added named destinations, stable named links, and page-label ranges with decimal, Roman-numeral, alphabetic, prefix, and custom starting-number options.
Added initial document views and rich named destinations with explicit coordinates, zoom, page, width, height, bounding-box, and rectangular fitting modes.
Added modern name-tree and legacy catalog named-destination preservation during document imports while retaining the destination document's other name-tree categories. Complete imports retain every destination, colliding modern and legacy names are deterministically renamed together with their links, and split workflows retain navigation whose targets remain inside the selected pages while references outside the split fail explicitly.
Added page-label preservation across insertion, deletion, reordering, merge, and split operations, keeping each retained page's effective prefix, numbering style, and number while rebuilding compact ranges for the new page order.
Added bookmark-tree, embedded-file, and associated-file preservation during complete document imports, including bookmark-tree merging across the destination and multiple sources, repaired parent and sibling links, remapped targets, merged attachment name trees, retained outline display mode, and explicit collision or unsafe-partial-import failures.
Added byte-accurate tokenization and a typed object model for numbers, names, strings, arrays, dictionaries, indirect references, object records, and binary-safe stream payloads. Source-aware errors enforce nesting, numeric, truncation, and stream-boundary rules, while stream openings accept all three PDF line endings without consuming payload bytes.
Added bounded Flate/zlib decoding with 8-bit TIFF and PNG predictor reversal for compressed cross-reference streams and object streams without unbounded decompression.
Added final startxref discovery plus classic, hybrid, and cross-reference-stream parsing. Incremental /Prev revisions merge newest-first, inherited trailer values remain available, and malformed offsets and cycles are rejected.
Added a lazy document loader for ordinary and compressed objects, indirect stream lengths, generation validation, object-stream boundaries, decoding caches, and resolution-cycle rejection.
Added bounded structural inspection reports that retain byte offsets and object numbers while distinguishing header, cross-reference, indirect-object, and catalog failures for repair decisions.
Structural inspection now converts invalid trailer offsets and other structural argument or state failures into repair diagnostics instead of allowing them to escape.
Added deterministic serialization for every object-model type, including invariant numbers, decoded-byte dictionary ordering, canonical escaping, stable LF output, exact stream lengths, and nesting limits.
Added deterministic full-file rewriting from the merged document view. Rewrites expand compressed objects, remove obsolete cross-reference containers, sanitize the trailer, preserve requested metadata and identifiers, and preserve authenticated document encryption.
Added an explicit deterministic cross-reference-stream rewrite format for PDF 1.5 and later, including the stream's own in-use entry, encryption exemption, reopen validation, and byte-stable repeated output.
Added optional deterministic object-stream packing during cross-reference-stream rewrites. Eligible generation-zero objects receive compressed cross-reference entries, stream objects and encryption dictionaries remain direct, and encrypted output reopens without exposing packed object data.
Object-stream packing is split into deterministic groups of at most 100 objects, keeping decoder memory bounded and compressed-object lookup granular on very large documents.
Added optional deterministic Flate compression for emitted cross-reference and object streams, including encrypted object-stream rewrites and byte-stable repeated output.
Full rewrites now remove obsolete linearization parameter dictionaries together with prior cross-reference and object-stream containers, preventing stale fast-web-view metadata from surviving non-linearized output.
Classic and stream-based full rewrites now emit complete linked free-object chains across object-number gaps instead of leaving sparse entries unspecified.
Full rewrites now preserve inherited free-object generations and retired object-number high-water marks in classic tables and cross-reference streams, preventing later incremental updates from reviving permanently retired objects while retaining byte-stable structural rewrites.
Full rewrites now also retain sparse object-number reservations expressed only through trailer /Size, so later incremental updates cannot reuse implicitly reserved numbers.
Removing document information during a full rewrite now physically omits a dedicated indirect /Info object and its text, retires its object number with an advanced generation, and fails closed if another object shares that reference.
Full rewrites can now remove both standard document-level metadata stores, physically deleting trailer /Info and dedicated catalog XMP stream objects in classic-table or compressed-stream output. AES-256 protection and password authentication remain intact, while shared XMP objects fail closed instead of leaving dangling references or private bytes behind.
Full-rewrite metadata removal matches /Info and catalog /Metadata by object number and generation, so stale registrations are removed without deleting the active object that happens to reuse their object number.
Full and incremental writers now reject undefined metadata-policy and cross-reference-format enum values instead of allowing cast values to fall through to an unintended output policy.
Full rewrites now retain nonstructural application trailer entries in classic and stream output while removing revision-only cross-reference fields and invalidated document checksums.
Full rewrites require a live indirect catalog root, a live indirect document-information dictionary when preserved, valid two-string document identifiers, and identifiers for encrypted output before catalog-dependent inspection or serialization begins.
Preserved application trailer graphs are traversed through bounded arrays, dictionaries, streams, and indirect references, rejecting stale object generations instead of serializing dangling references.
Incremental classic-table and cross-reference-stream revisions now retain application trailer state while removing an invalidated /DocChecksum from the new revision.
Incremental updates recursively validate preserved application trailer graphs against both current and pending object generations, rejecting dangling references and references to objects freed by the new revision.
Incremental-update preflight requires a live catalog root, live inherited or replacement document information, valid two-string identifiers, and a live encryption dictionary before appending bytes.
Full and incremental writers resolve indirect catalog type and version names while retaining strict catalog identity and defined-version checks.
Catalog version syntax is validated for classic-table output as well as cross-reference streams, preventing malformed version overrides from surviving either write format.
Preserved and replacement document-information dictionaries validate every standard text field, calendar and timezone syntax for PDF dates, and the defined /Trapped states at both full and incremental write boundaries.
Writer document-information validation resolves valid indirect standard fields while stale or mistyped values remain fail-closed.
Added rewrite policy for preserving or upgrading the PDF header, retaining or removing document information, and independently retaining document identifiers, plus reusable round-trip and corpus validation.
Accepted the complete PDF 2.x header declaration range through %PDF-2.9 and corrected classic cross-reference /Size handling for free boundary entries found in PDF/A-4 fixtures.
Header parsing requires CR or LF immediately after the single-digit major and minor version, rejecting truncated declarations and longer strings that merely begin with a defined version.