Struct Document 

pub struct Document<'s, S: RangeSource> { /* private fields */ }

A source-bound immutable index. Reading metadata is distinct from checking signatures or accepting document permissions and certificate trust.

Implementations

impl<'s, S: RangeSource> Document<'s, S>

pub async fn container<'a, W: Work>( &self, signature: Signature<'a, 's, S::Document, S::Generation>, operation: &W, ) -> Result<Container<'a, 's, S::Document, S::Generation>, ErrorOf<S::Error>>

Decodes the actual selected Contents and isolates its DER extent before any crypto callback. EN319142-1 §5.2.1 requires a single DER SignedData; unused signature capacity consists only of zero padding. https://www.etsi.org/deliver/etsi_EN/319100_319199/31914201/01.02.01_60/en_31914201v010201p.pdf

impl<'s, S: RangeSource> Document<'s, S>

pub async fn catalogue<W: Work>( &self, operation: &W, ) -> Result<Catalogue<'s, S::Document, S::Generation>, ReadFailure<S::Error>>

Enumerates physical signature dictionaries, including definitions not selected by the latest xref, and historically indexed compressed values. Stream payload bytes are skipped by their resolved Length, never scanned for apparent obj or signature text inside binary/string content.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn graph<W: Work>( &self, revision: usize, operation: &W, ) -> Result<Graph<'s, S::Document, S::Generation>, ReadFailure<S::Error>>

Resolves one complete historical closure with one cache per object stream.

Panics

Panics if an internally decoded root is not an object-stream member.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn object<W: Work>( &self, revision: usize, number: u64, generation: u16, operation: &W, ) -> Result<Option<Reading<'s, S::Document, S::Generation>>, ReadFailure<S::Error>>

Resolves an indirect identity at a specific revision. Free, unknown, generation-mismatched and absent references are PDF null (None). References, stream lengths and object-stream dependencies use explicit bounded frames; no input-controlled Rust recursion or boxed future.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn read<W: Work>( source: &'s S, session: &'s Session, operation: &W, ) -> Result<Self, ReadFailure<S::Error>>

Follows the declared cross-reference history without reconstructing or repairing offsets. Every await retains current and original execution.

Panics

Panics if internally reassigning a historical ordinal invalidates an already checked decoded extent.

pub fn stamp(&self) -> Stamp<S::Document, S::Generation>

Original immutable document identity used by every revision query.

pub fn revisions(&self) -> usize

Number of chronological incremental revisions.

pub fn revision(&self, ordinal: usize) -> Option<Revision>

Fixed-size revision metadata. The caller must still check the live snapshot when executing a source-dependent verification operation.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn fields<'g, W: Work>( &self, graph: &'g Graph<'s, S::Document, S::Generation>, operation: &W, ) -> Result<Fields<'g, 's, S::Document, S::Generation>, ReadFailure<S::Error>>

Reads the actual AcroForm tree iteratively under current and original funding. PDF text-name decoding is shared with FieldMDP selections.

Panics

Panics if a completed graph loses a resolved field-name owner.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn validation_history<'a, W: Work>( &self, root: Signature<'a, 's, S::Document, S::Generation>, operation: &W, ) -> Result<History<'a, 's, S::Document, S::Generation>, ReadFailure<S::Error>>

Enumerates each actual revision, so a late DSS or replacement cannot silently satisfy a timestamp whose original input lacks those values.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn validation<W: Work>( &self, revision: usize, operation: &W, ) -> Result<Validation<'s, S::Document, S::Generation>, ReadFailure<S::Error>>

Reads the historical catalog’s DSS/VRI and every referenced material stream using the common DER readers. This performs no status selection, authentication, network retrieval or latest-revision substitution.

Panics

Panics if the checked original file extent cannot be retained as a location.

impl<'s, S: RangeSource> Document<'s, S>

pub fn signature_placement<W: Work>( &self, signature: Signature<'_, 's, S::Document, S::Generation>, graph: &Graph<'s, S::Document, S::Generation>, fields: &Fields<'_, 's, S::Document, S::Generation>, transforms: &Transforms, operation: &W, ) -> Result<Placement, ReadFailure<S::Error>>

ISO32000-1 §12.8.2.2.1 requires DocMDP in the first signed field; §12.8.4 makes the catalog reference the prevention mechanism. It is not a prerequisite for a signed transform’s modification detection. https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/PDF32000_2008.pdf

impl<'s, S: RangeSource> Document<'s, S>

pub async fn transforms<W: Work>( &self, signature: Signature<'_, 's, S::Document, S::Generation>, graph: &Graph<'s, S::Document, S::Generation>, operation: &W, ) -> Result<Transforms, ReadFailure<S::Error>>

Reads ISO32000-1 §12.8.2/Tables253,254,256 from the original signature. Parameters are direct signed objects; FieldMDP Data is the specified indirect catalog identity, not a caller-selected replacement graph. https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/PDF32000_2008.pdf

pub async fn inspect_permissions<W: Work>( &self, signature: Signature<'_, 's, S::Document, S::Generation>, before: &Fields<'_, 's, S::Document, S::Generation>, after: &Fields<'_, 's, S::Document, S::Generation>, operation: &W, ) -> Result<Assessment, AssessmentError<S::Error>>

Compares the complete actual historical catalog closures and every selected field value. Unavailable change semantics stay indeterminate; they cannot become permitted by an empty caller-supplied change list.

Panics

Panics if an internally selected original graph node loses its owner.

pub async fn permissions<W: Work>( &self, mathematical: &Mathematical<'_, '_, '_, '_, '_, 's, S::Document, S::Generation>, before: &Fields<'_, 's, S::Document, S::Generation>, after: &Fields<'_, 's, S::Document, S::Generation>, operation: &W, ) -> Result<Assessment, AssessmentError<S::Error>>

ISO32000-1 §12.8.2.2.2 first requires the byte-range digest to be verified. This closed route accepts only this crate’s actual range pass; failed arithmetic/input facts cannot produce a positive permission. Use inspection separately when reporting unauthenticated change facts.

impl<'s, S: RangeSource> Document<'s, S>

pub fn query<'q, W: Work>(&'q self, operation: &'q W) -> Query<'q, 's, S>

Borrows the actual original file and current operation for common LTV queries. No parsing, source copy, allocation or account clone occurs.

impl<'s, S: RangeSource> Document<'s, S>

pub fn covered<'q, W: Work>( &'q self, signature: Signature<'q, 's, S::Document, S::Generation>, operation: &'q W, ) -> Result<Covered<'q, S>, ReadFailure<S::Error>>

Creates the original-range source for the common asynchronous CMS digest/signature driver, without materializing the PDF or its ranges.

pub async fn contents<W: Work>( &self, signature: Signature<'_, 's, S::Document, S::Generation>, operation: &W, ) -> Result<OwnedVec<u8, Memory>, ReadFailure<S::Error>>

Reads signature Contents as decoded bytes with independent actual capacity ownership. This retains padding: VRI names hash the complete decoded value, while CMS parsing separately identifies its DER extent.

impl<'s, S: RangeSource> Document<'s, S>

pub fn timestamp_requirements<'a, 'r, 'v, 'p, 'm, 'd, 'path, W: Work>( &self, basic: &Basic<'r, 'v, 'p, 'm, 'd, 'a, 's, 'path, S::Document, S::Generation>, history: &History<'_, 's, S::Document, S::Generation>, operation: &W, ) -> Result<Requirements<'a, 's, S::Document, S::Generation>, ReadFailure<S::Error>>

Derives all timestamp obligations from the sealed original preparation and the same complete physical signature census as its selected root.

Panics

Panics if an internal candidate ordinal leaves the complete source census.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn timestamp_sources<'r, 'a, W: Work>( &self, required: &'r Requirements<'a, 's, S::Document, S::Generation>, operation: &W, ) -> Result<Sources<'r, 'a, 's, S::Document, S::Generation>, ErrorOf<S::Error>>

Reads ALL original PDF DTS occurrences without success-based filtering. Unreadable syntax remains an entry; source/allocator/work refusal aborts and releases the entire partial result.

Panics

Panics if an internally unreadable source slot loses its retained failure.

impl<'s, S: RangeSource> Document<'s, S>

pub async fn check_timestamp<'q, 'a, 'token, 'certificate, P, PE, RE>( &'q self, container: &'q Container<'a, 's, S::Document, S::Generation>, token: &'q Token<'token>, provider: &'q P, parent: &Reader<'q>, context: &'q CheckContext<'certificate, 'q>, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> Result<DocumentTime<'q, 'a, 's, 'certificate, S::Document, S::Generation>, TimestampError<S::Error, PE, RE>>

where P: for<'scope> SignatureProvider<'scope, Error = PE>, 'token: 'q, 'certificate: 'q, 's: 'q, 'a: 'q,

Applies the original PDF DTS declaration before provider callbacks, then verifies the original carried token over asynchronous file ranges. EN319142-1 §§5.4.3/6.3 requires exact whole-revision coverage and forbids Cert/Reference/Changes/R/authentication metadata on this dictionary. https://www.etsi.org/deliver/etsi_EN/319100_319199/31914201/01.02.01_60/en_31914201v010201p.pdf

Panics

Panics if the inspected timestamp loses its original Contents member.