@quillmark/quillify 0.0.0-stage → 0.3.0

package/dist/normalize.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Every PDF the library reads goes through qpdf first. Published forms arrive
+ * locked (a permissions wrapper with an empty user password), and pdf-lib
+ * carries no decryption code at all: it would either throw or, with
+ * `ignoreEncryption`, write plaintext into a file that still declares itself
+ * encrypted.
+ *
+ * `--flatten-rotation` folds a page's own quarter turn into its content, since
+ * the engine rejects a page that carries `/Rotate`
+ * (`rotation.browser.test.ts`). `--object-streams=disable` writes every object
+ * in the open, so pdf.js and pdf-lib, which read what qpdf wrote, inflate no
+ * object stream. `--recompress-flate` has qpdf decode every stream under
+ * Flate, LZW, ASCII85 or ASCIIHex and write it back as one Flate stream of its
+ * own, so the readers after it have nothing to disagree on: a stream that
+ * ends in a wrong check is no longer one. A page's content streams stay
+ * apart, as the engine paints them (`background.browser.test.ts`).
+ *
+ * Unconditional, so there is one path and no guessing about which files need
+ * it. On a file that needs nothing it is a rewrite.
+ *
+ * qpdf runs in a worker of its own for each file: `assets/qpdf.worker.js`,
+ * which is qpdf-wasm's script with `qpdf-handler.js` after it. The worker ends
+ * with the call, so a trap, a grown heap and whatever qpdf's `main` leaves
+ * behind end with it, and the page's thread is free while qpdf runs.
+ *
+ * The file is held to `MAX_INFLATED_BYTES` twice: in the worker, where qpdf
+ * is ended at the write that passes it, and then in what qpdf wrote, on the
+ * page's thread and before any other reader opens it.
+ */
+/**
+ * The same PDF with its encryption removed and a page's own quarter turn folded
+ * into the page. The worker answers with qpdf's file only when qpdf ended
+ * well, with or without warnings, since an error leaves the file cut short. A
+ * file it answers nothing for is refused: every later step reads these bytes
+ * as decrypted. So is a file that comes to more than `MAX_INFLATED_BYTES`, in
+ * qpdf or in what qpdf wrote. The worker is ended when it answers, or when
+ * `signal` fires before it has.
+ */
+export declare function normalizePdf(bytes: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;

package/dist/normalize.js

@@ -0,0 +1,159 @@
+/**
+ * Every PDF the library reads goes through qpdf first. Published forms arrive
+ * locked (a permissions wrapper with an empty user password), and pdf-lib
+ * carries no decryption code at all: it would either throw or, with
+ * `ignoreEncryption`, write plaintext into a file that still declares itself
+ * encrypted.
+ *
+ * `--flatten-rotation` folds a page's own quarter turn into its content, since
+ * the engine rejects a page that carries `/Rotate`
+ * (`rotation.browser.test.ts`). `--object-streams=disable` writes every object
+ * in the open, so pdf.js and pdf-lib, which read what qpdf wrote, inflate no
+ * object stream. `--recompress-flate` has qpdf decode every stream under
+ * Flate, LZW, ASCII85 or ASCIIHex and write it back as one Flate stream of its
+ * own, so the readers after it have nothing to disagree on: a stream that
+ * ends in a wrong check is no longer one. A page's content streams stay
+ * apart, as the engine paints them (`background.browser.test.ts`).
+ *
+ * Unconditional, so there is one path and no guessing about which files need
+ * it. On a file that needs nothing it is a rewrite.
+ *
+ * qpdf runs in a worker of its own for each file: `assets/qpdf.worker.js`,
+ * which is qpdf-wasm's script with `qpdf-handler.js` after it. The worker ends
+ * with the call, so a trap, a grown heap and whatever qpdf's `main` leaves
+ * behind end with it, and the page's thread is free while qpdf runs.
+ *
+ * The file is held to `MAX_INFLATED_BYTES` twice: in the worker, where qpdf
+ * is ended at the write that passes it, and then in what qpdf wrote, on the
+ * page's thread and before any other reader opens it.
+ */
+import { ParseSpeeds, PDFArray, PDFDocument, PDFName, PDFRawStream } from 'pdf-lib';
+import { openPdf } from './pdfjs.js';
+import { Refused } from './refusal.js';
+import { MAX_BYTES, MAX_INFLATED_BYTES } from './types.js';
+// Held in a constant so that Vite copies the worker byte for byte. Written
+// inside `new Worker(...)`, the URL makes it bundle the file again.
+const WORKER = new URL('../assets/qpdf.worker.js', import.meta.url);
+// A bundler renames both files, so the worker is told where the binary is.
+const WASM = new URL('../assets/qpdf.wasm', import.meta.url);
+const FLAGS = ['--decrypt', '--flatten-rotation', '--object-streams=disable', '--recompress-flate'];
+/**
+ * The two types of stream pdf-lib inflates whole as it parses a file, in every
+ * spelling it reads as their names: each letter as it is, or as `#` and its
+ * code.
+ */
+const spelled = (name) => [...name]
+    .map((letter) => `(?:${letter}|#${letter.charCodeAt(0).toString(16).toUpperCase()})`)
+    .join('');
+const TYPED = new RegExp(`/(?:${spelled('ObjStm')}|${spelled('XRef')})`);
+/**
+ * A Flate stream goes to the decoder this much at a time. The decoder inflates
+ * all of what it is handed before it gives any of it: 1 GiB, for a stream of
+ * 1 MB handed over whole.
+ */
+const SLICE = 1024;
+/** What qpdf leaves a stream under, alone or after one Flate layer. Each gives pixels, which are not counted. */
+const CODECS = ['DCTDecode', 'JPXDecode', 'CCITTFaxDecode', 'JBIG2Decode'];
+/**
+ * The size of the file qpdf wrote and of what its Flate streams decode to,
+ * added up no further than the bound. pdf-lib lists the streams and the
+ * browser inflates each, keeping nothing. A stream the browser's decoder
+ * rejects, or one under a filter qpdf has not taken off, is a stream two
+ * readers can read two ways, and the file is refused as `damaged`.
+ */
+async function inflated(pdf) {
+    let total = pdf.byteLength;
+    // qpdf has written no stream of either type, so one that is here came with the file.
+    if (TYPED.test(new TextDecoder('latin1').decode(pdf)))
+        throw new Refused({ code: 'damaged' });
+    // pdf-lib waits on a timer between batches of objects unless it is told not to.
+    const { context } = await PDFDocument.load(pdf, {
+        updateMetadata: false,
+        parseSpeed: ParseSpeeds.Fastest
+    });
+    for (const [, object] of context.enumerateIndirectObjects()) {
+        if (!(object instanceof PDFRawStream))
+            continue;
+        const { dict, contents } = object;
+        const filter = dict.lookup(PDFName.of('Filter'));
+        const chain = (filter instanceof PDFArray
+            ? filter.asArray().map((entry) => context.lookup(entry))
+            : filter
+                ? [filter]
+                : []).map((entry) => (entry instanceof PDFName ? entry.decodeText() : ''));
+        const flate = chain[0] === 'FlateDecode';
+        const rest = chain.slice(flate ? 1 : 0);
+        if (rest.length > 1 || rest.some((name) => !CODECS.includes(name)))
+            throw new Refused({ code: 'damaged' });
+        // An empty stream is one to every reader, and to the decoder a stream cut short.
+        if (!flate || !contents.length)
+            continue;
+        let at = 0;
+        const reader = new ReadableStream({
+            pull(controller) {
+                if (at < contents.length)
+                    controller.enqueue(contents.slice(at, (at += SLICE)));
+                else
+                    controller.close();
+            }
+        })
+            .pipeThrough(new DecompressionStream('deflate'))
+            .getReader();
+        try {
+            for (let read = await reader.read(); !read.done; read = await reader.read()) {
+                total += read.value.byteLength;
+                if (total > MAX_INFLATED_BYTES)
+                    return total;
+            }
+        }
+        catch {
+            throw new Refused({ code: 'damaged' });
+        }
+        finally {
+            void reader.cancel().catch(() => { });
+        }
+    }
+    return total;
+}
+/**
+ * The same PDF with its encryption removed and a page's own quarter turn folded
+ * into the page. The worker answers with qpdf's file only when qpdf ended
+ * well, with or without warnings, since an error leaves the file cut short. A
+ * file it answers nothing for is refused: every later step reads these bytes
+ * as decrypted. So is a file that comes to more than `MAX_INFLATED_BYTES`, in
+ * qpdf or in what qpdf wrote. The worker is ended when it answers, or when
+ * `signal` fires before it has.
+ */
+export async function normalizePdf(bytes, signal) {
+    // Before a worker starts, because qpdf is the step that allocates.
+    if (bytes.byteLength > MAX_BYTES)
+        throw new Refused({ code: 'too_large', bytes: bytes.byteLength, limit: MAX_BYTES });
+    const worker = new Worker(WORKER);
+    // A copy, moved to the worker. A view posted as it is takes its whole buffer along.
+    const copy = bytes.slice();
+    const { promise, resolve, reject } = Promise.withResolvers();
+    const late = () => reject(signal?.reason);
+    signal?.addEventListener('abort', late);
+    worker.onmessage = ({ data }) => resolve(data);
+    worker.onerror = () => reject(new Error(`qpdf.worker.js did not load from ${WORKER}`));
+    worker.postMessage({ bytes: copy, flags: FLAGS, wasm: WASM.href, limit: MAX_INFLATED_BYTES }, [
+        copy.buffer
+    ]);
+    const answer = await promise.finally(() => {
+        signal?.removeEventListener('abort', late);
+        worker.terminate();
+    });
+    if (!answer.loaded)
+        throw new Error(`qpdf.wasm did not load from ${WASM}`);
+    const { out, size } = answer;
+    // A file that came to more than the bound in qpdf is past it, whatever qpdf then wrote.
+    const total = size > MAX_INFLATED_BYTES ? size : out?.byteLength ? await inflated(out) : 0;
+    if (total > MAX_INFLATED_BYTES)
+        throw new Refused({ code: 'too_large', bytes: total, limit: MAX_INFLATED_BYTES });
+    if (out?.byteLength)
+        return out;
+    // qpdf gives its reason on stderr alone. A file pdf.js cannot open is refused
+    // there, under its own code. One it opens is a file only qpdf rejects.
+    await (await openPdf(bytes, {}, signal)).close();
+    throw new Refused({ code: 'damaged' });
+}

package/dist/pdfjs.d.ts

@@ -0,0 +1,17 @@
+import type { PDFDocumentProxy } from 'pdfjs-dist';
+/**
+ * A document on a worker of its own, which `close` ends. A file pdf.js rejects
+ * is refused here, so it carries the same code whichever stage opens it.
+ *
+ * A worker that is busy when `signal` fires answers nothing more, so a
+ * question put to the document is awaited through `within`, which rejects
+ * with the signal's reason then.
+ */
+export declare function openPdf(bytes: Uint8Array, options?: {
+    enableXfa?: boolean;
+    ownerDocument?: Document;
+}, signal?: AbortSignal): Promise<{
+    pdf: PDFDocumentProxy;
+    close(): Promise<void>;
+    within<T>(asked: Promise<T>): Promise<T>;
+}>;

package/dist/pdfjs.js

@@ -0,0 +1,95 @@
+import { Refused } from './refusal.js';
+// Held in a constant so that Vite copies the worker byte for byte. Written
+// inside `new Worker(...)`, the URL makes it bundle the file again.
+const WORKER = new URL('../assets/pdf.worker.js', import.meta.url);
+// The faces pdf.js lays a dynamic form's Arial, Helvetica, Myriad Pro, Calibri
+// and Segoe UI out in, each named so that a bundler copies it.
+const FACES = {
+    'LiberationSans-Regular.ttf': new URL('../assets/LiberationSans-Regular.ttf', import.meta.url),
+    'LiberationSans-Bold.ttf': new URL('../assets/LiberationSans-Bold.ttf', import.meta.url),
+    'LiberationSans-Italic.ttf': new URL('../assets/LiberationSans-Italic.ttf', import.meta.url),
+    'LiberationSans-BoldItalic.ttf': new URL('../assets/LiberationSans-BoldItalic.ttf', import.meta.url)
+};
+// The shipped worker rejects an open with what pdf.js's XFA layout threw, under
+// this prefix.
+const LAYOUT = 'XFA layout: ';
+/**
+ * A document on a worker of its own, which `close` ends. A file pdf.js rejects
+ * is refused here, so it carries the same code whichever stage opens it.
+ *
+ * A worker that is busy when `signal` fires answers nothing more, so a
+ * question put to the document is awaited through `within`, which rejects
+ * with the signal's reason then.
+ */
+export async function openPdf(bytes, options = {}, signal) {
+    const pdfjs = await import('pdfjs-dist');
+    signal?.throwIfAborted();
+    const port = new Worker(WORKER, { type: 'module' });
+    const worker = pdfjs.PDFWorker.create({ port });
+    const task = pdfjs.getDocument({
+        data: bytes.slice(),
+        ...options,
+        // What pdf.js asks the page for on its worker's behalf: a face of the
+        // package, and nothing else. pdf.js lays a form out without a face it did
+        // not get, so one that did not load ends the open: a request or a body
+        // that fails, and a status that is not ok.
+        BinaryDataFactory: class {
+            async fetch({ filename }) {
+                if (!Object.hasOwn(FACES, filename))
+                    throw new Error(`The package ships no ${filename}.`);
+                try {
+                    const response = await fetch(FACES[filename]);
+                    if (response.ok)
+                        return new Uint8Array(await response.arrayBuffer());
+                }
+                catch {
+                    // Ends the open below, as a status that is not ok does.
+                }
+                const failed = new Error(`${filename} did not load from ${FACES[filename]}`);
+                give(failed);
+                throw failed;
+            }
+        },
+        worker
+    });
+    // A worker script that fails to load answers nothing, and neither does one
+    // that is busy when the signal fires. `task.destroy()` waits on an answer,
+    // and `close` ends the worker whatever that wait comes to.
+    let answers = true;
+    const silent = Promise.withResolvers();
+    const give = (reason) => {
+        answers = false;
+        silent.reject(reason);
+    };
+    port.onerror = () => give(new Error(`pdf.worker.js did not load from ${WORKER}`));
+    const late = () => give(signal?.reason);
+    signal?.addEventListener('abort', late);
+    const within = (asked) => Promise.race([asked, silent.promise]);
+    const close = async () => {
+        const destroyed = task.destroy();
+        if (answers)
+            await within(destroyed).catch(() => { });
+        signal?.removeEventListener('abort', late);
+        worker.destroy();
+        port.terminate();
+    };
+    try {
+        return { pdf: await within(task.promise), close, within };
+    }
+    catch (err) {
+        await close();
+        if (!answers)
+            throw err;
+        if (err instanceof pdfjs.PasswordException)
+            throw new Refused({ code: 'password' });
+        if (err instanceof pdfjs.InvalidPDFException)
+            throw new Refused({ code: 'not_pdf' });
+        if (err instanceof Error && err.message.startsWith(LAYOUT))
+            throw new Refused({ code: 'layout', detail: err.message.slice(LAYOUT.length) });
+        // pdf.js raises a plain Error for an encryption it does not know, which is
+        // what a certificate-based PubSec file looks like.
+        if (err instanceof Error && /encryp/i.test(err.message))
+            throw new Refused({ code: 'encryption' });
+        throw err;
+    }
+}

package/dist/quillify.d.ts

@@ -0,0 +1,13 @@
+import type { Form, Naming, Problem } from './api.js';
+export type Quillified = {
+    ok: true;
+    tree: Map<string, Uint8Array>;
+} | {
+    ok: false;
+    problems: readonly Problem[];
+};
+/**
+ * A quill's files from a sanitized form and a naming of its fields, or the
+ * problems that stop one being built: `check`'s, and then the engine's.
+ */
+export declare function quillify(form: Form, naming: Naming): Promise<Quillified>;

package/dist/quillify.js

@@ -0,0 +1,86 @@
+import { init, isQuillmarkError } from '@quillmark/wasm';
+import { assembleQuill } from './assemble.js';
+import { check } from './naming.js';
+/** The inventory's code for each kind, which is how the assembly tells a signature from a field. */
+const WIDGET = {
+    text: 'Tx',
+    checkbox: 'Btn',
+    radio: 'Btn',
+    choice: 'Ch',
+    signature: 'Sig'
+};
+function typed(field, text) {
+    switch (field.kind) {
+        case 'text':
+            if (text === 'lines')
+                return { type: 'array', multiline: true };
+            return { type: 'string', multiline: text ? text === 'paragraph' : field.multiline };
+        case 'choice':
+            return { type: 'enum', multiline: false, options: [...field.options] };
+        case 'checkbox':
+        case 'radio':
+            return { type: 'boolean', multiline: false };
+        case 'signature':
+            return { type: 'string', multiline: false };
+    }
+}
+/** A choice shows one of its options even when the naming gives none, so its list is seen in the example. */
+function shown(field, suggested) {
+    const value = suggested?.trim() || undefined;
+    if (field.kind === 'choice')
+        return value !== undefined && field.options.includes(value) ? value : field.options[0];
+    if (field.kind !== 'text')
+        return undefined;
+    return value && field.maxLength ? [...value].slice(0, field.maxLength).join('') : value;
+}
+/**
+ * A quill's files from a sanitized form and a naming of its fields, or the
+ * problems that stop one being built: `check`'s, and then the engine's.
+ */
+export async function quillify(form, naming) {
+    const problems = check(form.fields, naming);
+    if (problems.length > 0)
+        return { ok: false, problems };
+    const byId = new Map(form.fields.map((field) => [field.id, field]));
+    const tree = assembleQuill({
+        quill: { name: naming.name, description: naming.description },
+        fields: naming.fields.map((entry) => {
+            const field = byId.get(entry.id);
+            const example = shown(field, entry.example);
+            return {
+                widget: entry.id,
+                name: entry.name,
+                description: entry.description,
+                ...typed(field, entry.text),
+                ...(example === undefined ? {} : { example }),
+                keep: entry.keep && !field.readOnly,
+                required: field.required,
+                ...(field.kind === 'radio' ? { group: field.group } : {})
+            };
+        })
+    }, {
+        widgets: form.fields.map(({ id, kind, places, tooltip }) => ({
+            id,
+            kind: WIDGET[kind],
+            places: [...places],
+            tooltip
+        }))
+    }, form.pdf);
+    const { Quill } = await init();
+    try {
+        Quill.fromTree(tree).free();
+    }
+    catch (err) {
+        if (!isQuillmarkError(err))
+            throw err;
+        return {
+            ok: false,
+            problems: err.diagnostics.map(({ code, message }) => ({
+                code: 'engine',
+                diagnostic: code,
+                message
+            }))
+        };
+    }
+    return { ok: true, tree };
+}

package/dist/refusal.d.ts

@@ -0,0 +1,47 @@
+/** Why a PDF is not taken. A `page` is zero-based, as a `Place`'s is. */
+export type Refusal = {
+    code: 'too_large';
+    bytes: number;
+    limit: number;
+} | {
+    code: 'not_pdf';
+} | {
+    code: 'password';
+} | {
+    code: 'encryption';
+} | {
+    code: 'damaged';
+} | {
+    code: 'rotated';
+    page: number;
+} | {
+    code: 'portfolio';
+    attachment?: string;
+} | {
+    code: 'no_fields';
+    xfa: boolean;
+} | {
+    code: 'too_many_pages';
+    pages: number;
+    limit: number;
+} | {
+    code: 'too_many_fields';
+    fields: number;
+    limit: number;
+} | {
+    code: 'layout';
+    detail: string;
+} | {
+    code: 'too_slow';
+    limit: number;
+} | {
+    code: 'unpaintable';
+    page: number;
+    construct: 'image' | 'background_image' | 'svg' | 'border' | 'transform' | 'glyph' | 'barcode' | 'password';
+    detail?: string;
+};
+/** Thrown where a stage declines a PDF. */
+export declare class Refused extends Error {
+    readonly refusal: Refusal;
+    constructor(refusal: Refusal);
+}

package/dist/refusal.js

@@ -0,0 +1,8 @@
+/** Thrown where a stage declines a PDF. */
+export class Refused extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal.code);
+        this.refusal = refusal;
+    }
+}

package/dist/sanitize.d.ts

@@ -0,0 +1,20 @@
+import { type Refusal } from './refusal.js';
+import type { Form } from './api.js';
+export type Sanitized = {
+    ok: true;
+    form: Form;
+} | {
+    ok: false;
+    refusal: Refusal;
+};
+/**
+ * A PDF form as its fields and a background with no form layer, or the reason
+ * the file is not taken. Nothing else in the package reads the file.
+ *
+ * One signal fires `MAX_SECONDS` after the call starts. A stage that is
+ * waiting on a worker then ends the worker and throws the signal's reason,
+ * as does an open that begins after it, and that reason is the refusal
+ * `too_slow`. Work on this thread is not interrupted and not timed: the
+ * strip starts no worker, so a call that has reached it returns its form.
+ */
+export declare function sanitize(pdf: Uint8Array): Promise<Sanitized>;

package/dist/sanitize.js

@@ -0,0 +1,72 @@
+import { inventoryPdf } from './inventory.js';
+import { normalizePdf } from './normalize.js';
+import { Refused } from './refusal.js';
+import { stripAcroForm } from './strip.js';
+import { xfaToAcroForm } from './xfa.js';
+import { MAX_SECONDS } from './types.js';
+function field(widget) {
+    const [place, ...more] = widget.places;
+    const { id, required, readOnly, tooltip } = widget;
+    const common = {
+        id,
+        places: [place, ...more],
+        ...(tooltip === undefined ? {} : { tooltip }),
+        required,
+        readOnly
+    };
+    switch (widget.kind) {
+        case 'Tx':
+            return {
+                ...common,
+                kind: 'text',
+                multiline: widget.multiLine,
+                ...(widget.maxLen > 0 ? { maxLength: widget.maxLen } : {})
+            };
+        case 'Btn':
+            // The inventory keeps no push button, so a button that is no radio is a checkbox.
+            if (!widget.radioButton)
+                return { ...common, kind: 'checkbox' };
+            return {
+                ...common,
+                kind: 'radio',
+                group: widget.name,
+                ...(widget.buttonValue === undefined ? {} : { on: widget.buttonValue })
+            };
+        case 'Ch':
+            return { ...common, kind: 'choice', options: widget.options };
+        case 'Sig':
+            return { ...common, kind: 'signature' };
+    }
+}
+/**
+ * A PDF form as its fields and a background with no form layer, or the reason
+ * the file is not taken. Nothing else in the package reads the file.
+ *
+ * One signal fires `MAX_SECONDS` after the call starts. A stage that is
+ * waiting on a worker then ends the worker and throws the signal's reason,
+ * as does an open that begins after it, and that reason is the refusal
+ * `too_slow`. Work on this thread is not interrupted and not timed: the
+ * strip starts no worker, so a call that has reached it returns its form.
+ */
+export async function sanitize(pdf) {
+    // Handing it anything but a Uint8Array is a mistake in the call and no fault of a file, so the call throws.
+    // The tag, not instanceof, so that a Uint8Array made in another window is taken.
+    if (Object.prototype.toString.call(pdf) !== '[object Uint8Array]')
+        throw new TypeError('sanitize takes a Uint8Array.');
+    const deadline = AbortSignal.timeout(MAX_SECONDS * 1000);
+    try {
+        const bytes = await xfaToAcroForm(await normalizePdf(pdf, deadline), deadline);
+        const { pages, widgets, views } = await inventoryPdf(bytes, deadline);
+        return {
+            ok: true,
+            form: { pdf: await stripAcroForm(bytes, views), pages, fields: widgets.map(field) }
+        };
+    }
+    catch (err) {
+        if (deadline.aborted && err === deadline.reason)
+            return { ok: false, refusal: { code: 'too_slow', limit: MAX_SECONDS } };
+        if (err instanceof Refused)
+            return { ok: false, refusal: err.refusal };
+        throw err;
+    }
+}

package/dist/strip.d.ts

@@ -0,0 +1,77 @@
+import type { View } from './types.js';
+/**
+ * What a background's dictionaries keep. A kind of dictionary lists its keys,
+ * and after a colon what a key leads to:
+ *
+ *     Key         a number, a name, a string, a boolean, null, or an array of those
+ *     Key:kind    a dictionary or a stream of that kind
+ *     Key:[kind]  one of them or an array of them
+ *     Key:{kind}  a dictionary of them by name
+ *     Key:^kind   a reference to one the walk reaches as that kind by another key
+ *     Key:[^kind] such a reference, or an array of them and of arrays of them
+ *     Key:*       a value no row reads yet, kept whole
+ *
+ * A reference back can be to one of two kinds, `Key:^kind|kind`. A dictionary
+ * by name can hold one of a kind or an array of them, `Key:{[kind]}`, or values
+ * of the first sort and nothing else, `Key:{}`.
+ *
+ * A value of the first sort also stays where a kind is expected: a mask can be
+ * an array of numbers and a color space a name. A kind `STREAMS` names is a
+ * stream, which keeps the keys of `STREAM` beside its own, and no other kind is
+ * a stream. A kind whose keys are numbers is an array read by position, as a
+ * color space is: it loses every part past the last its row lists, and a part
+ * before that which is not what its position leads to becomes null. A kind
+ * `PICK` names is one of several, told apart by a key of the dictionary or a
+ * position of the array, which holds a name where `PICK` writes one and a
+ * number where it writes a number. Where `PICK` names a last kind, one that is
+ * told as none of the others is of that kind.
+ */
+export declare const KINDS: Record<string, string>;
+export declare const STREAMS: string[];
+export declare const STREAM = "Length Filter DecodeParms:[parms]";
+export declare const PICK: Record<string, [key: string, kinds: Record<string, string>, other?: string]>;
+/**
+ * The `acroform` background: the source file's pages, and of each dictionary
+ * they hold the keys `KINDS` lists for its kind. With the rest of the catalog
+ * go the form (`/AcroForm` with its XFA packet, `/NeedsRendering`), the XMP
+ * metadata, the scripts, attachments, portfolio and bookmarks, and the
+ * usage-rights signature under `/Perms`. The signature goes here because qpdf's
+ * `--remove-restrictions`, which takes it too, also strips `/FT /Sig` from
+ * every signature field. The trailer's `/Info` and `/ID` go too.
+ *
+ * Of a page's annotations a Link stays, when it leads to an http or https
+ * address or to an explicit destination in the file, and leads there one way.
+ * A named destination resolves through the catalog's `/Dests` or `/Names`,
+ * which go, so a link to one goes too, and so does a link with an action
+ * chained after its own. The action a link keeps is a copy, so nothing the file
+ * hangs on the same object is cut with it.
+ *
+ * Each page's MediaBox is set to the box of its entry of `views`, the frame the
+ * inventory measured that page's widgets in. No box of the file is read here. A
+ * file whose pages are not the objects `views` names, in that order, is one
+ * pdf.js and pdf-lib read differently, and is refused as `damaged`.
+ *
+ * A walk from the catalog, level by level, then gives each object one kind, by
+ * the key that reaches it. A dictionary loses every key its kind does not list
+ * and every value that is not what its key leads to, and an object the walk
+ * does not reach is deleted: a saved file carries every object the context
+ * holds, reachable or not. A file in which a key reaches an object as another
+ * kind than it has is refused as `damaged`. A reference back to an object the
+ * walk did not reach as its kind is deleted, or made null in an array: a
+ * destination's page that the page tree does not hold, and a layer the default
+ * configuration names that no other key reaches.
+ *
+ * The structure tree has rows as the rest has. Of what lies outside it, it
+ * names a page of the page tree and a link that stays, each by a reference
+ * back, and nothing else: an element's `/Pg` to any other object is deleted,
+ * and an object reference whose `/Obj` is not such a link is taken out of its
+ * element's `/K`.
+ *
+ * An object that reads as an annotation or as a page, and is neither a page of
+ * `views` nor a link that stays, is deleted outright before the walk. No widget
+ * and no page outside the page tree is then in the file, whatever names one, a
+ * dictionary by name included, and the fields and appearance streams that hung
+ * off it are out of the walk's reach: a background that still carries a form
+ * layer is one the renderer would stamp a second one over.
+ */
+export declare function stripAcroForm(bytes: Uint8Array, views: View[]): Promise<Uint8Array>;