@quillmark/quillify 0.0.0-stage → 0.3.0

package/dist/strip.js

@@ -0,0 +1,524 @@
+import { PDFArray, PDFBool, PDFDict, PDFDocument, PDFHexString, PDFName, PDFNull, PDFNumber, PDFRef, PDFStream, PDFString } from 'pdf-lib';
+import { Refused } from './refusal.js';
+/**
+ * What a background's dictionaries keep. A kind of dictionary lists its keys,
+ * and after a colon what a key leads to:
+ *
+ *     Key         a number, a name, a string, a boolean, null, or an array of those
+ *     Key:kind    a dictionary or a stream of that kind
+ *     Key:[kind]  one of them or an array of them
+ *     Key:{kind}  a dictionary of them by name
+ *     Key:^kind   a reference to one the walk reaches as that kind by another key
+ *     Key:[^kind] such a reference, or an array of them and of arrays of them
+ *     Key:*       a value no row reads yet, kept whole
+ *
+ * A reference back can be to one of two kinds, `Key:^kind|kind`. A dictionary
+ * by name can hold one of a kind or an array of them, `Key:{[kind]}`, or values
+ * of the first sort and nothing else, `Key:{}`.
+ *
+ * A value of the first sort also stays where a kind is expected: a mask can be
+ * an array of numbers and a color space a name. A kind `STREAMS` names is a
+ * stream, which keeps the keys of `STREAM` beside its own, and no other kind is
+ * a stream. A kind whose keys are numbers is an array read by position, as a
+ * color space is: it loses every part past the last its row lists, and a part
+ * before that which is not what its position leads to becomes null. A kind
+ * `PICK` names is one of several, told apart by a key of the dictionary or a
+ * position of the array, which holds a name where `PICK` writes one and a
+ * number where it writes a number. Where `PICK` names a last kind, one that is
+ * told as none of the others is of that kind.
+ */
+export const KINDS = {
+    catalog: 'Type Pages:tree OCProperties:layers StructTreeRoot:tags MarkInfo:marks Lang',
+    tree: 'Type Parent:^tree Kids:[node] Count Resources:resources Rotate',
+    page: 'Type Parent:^tree Resources:resources MediaBox Contents:[content] Rotate Group:group ' +
+        'UserUnit StructParents Tabs Annots:[link]',
+    link: 'Type Subtype Rect Border BS:border C H QuadPoints F OC:oc Contents StructParent A:action ' +
+        'Dest:dest',
+    border: 'Type W S D',
+    uri: 'S URI',
+    goto: 'S D:dest',
+    dest: '0:^page 1 2 3 4 5',
+    resources: 'Font:{font} XObject:{xobject} ExtGState:{gstate} ColorSpace:{space} Pattern:{pattern} ' +
+        'Shading:{shading} Properties:{oc} ProcSet',
+    content: '',
+    image: 'Type Subtype Width Height BitsPerComponent ColorSpace:space Decode ImageMask Mask:image ' +
+        'SMask:image SMaskInData Matte Interpolate Intent OC:oc StructParent',
+    form: 'Type Subtype FormType BBox Matrix Resources:resources Group:group OC:oc StructParent StructParents',
+    parms: 'Predictor Colors BitsPerComponent Columns EarlyChange K EndOfLine EncodedByteAlign Rows ' +
+        'EndOfBlock BlackIs1 DamagedRowsBeforeError ColorTransform JBIG2Globals:data',
+    data: '',
+    group: 'Type S CS:space I K',
+    gstate: 'Type LW LC LJ ML D RI OP op OPM Font:fontsize BG:function BG2:function UCR:function ' +
+        'UCR2:function TR:[function] TR2:[function] HT HTO FL SM SA BM SMask:mask CA ca AIS TK ' +
+        'UseBlackPtComp',
+    fontsize: '0:font 1',
+    mask: 'Type S G:form BC TR:function',
+    ICCBased: '0 1:icc',
+    Indexed: '0 1:space 2 3:data',
+    Separation: '0 1 2:space 3:function',
+    DeviceN: '0 1 2:space 3:function',
+    CalRGB: '0 1:cie',
+    CalGray: '0 1:cie',
+    Lab: '0 1:cie',
+    Pattern: '0 1:space',
+    icc: 'N Alternate:space Range',
+    cie: 'WhitePoint BlackPoint Gamma Matrix Range',
+    function0: 'FunctionType Domain Range Size BitsPerSample Order Encode Decode',
+    function2: 'FunctionType Domain Range C0 C1 N',
+    function3: 'FunctionType Domain Range Functions:[function] Bounds Encode',
+    function4: 'FunctionType Domain Range',
+    shaded: 'ShadingType ColorSpace:space Background BBox AntiAlias Domain Matrix Coords Extend ' +
+        'Function:[function]',
+    mesh: 'ShadingType ColorSpace:space Background BBox AntiAlias BitsPerCoordinate BitsPerComponent ' +
+        'BitsPerFlag Decode VerticesPerRow Function:[function]',
+    tiling: 'Type PatternType PaintType TilingType BBox XStep YStep Resources:resources Matrix',
+    shadingpattern: 'Type PatternType Shading:shading Matrix ExtGState:gstate',
+    simple: 'Type Subtype Name BaseFont FirstChar LastChar Widths FontDescriptor:descriptor ' +
+        'Encoding:encoding ToUnicode:cmap',
+    type3: 'Type Subtype Name FontBBox FontMatrix CharProcs:{content} Encoding:encoding FirstChar ' +
+        'LastChar Widths FontDescriptor:descriptor Resources:resources ToUnicode:cmap',
+    type0: 'Type Subtype BaseFont Encoding:cmap DescendantFonts:[font] ToUnicode:cmap',
+    cidfont: 'Type Subtype BaseFont CIDSystemInfo:cidsystem FontDescriptor:descriptor DW W DW2 W2 ' +
+        'CIDToGIDMap:data',
+    cidsystem: 'Registry Ordering Supplement',
+    encoding: 'Type BaseEncoding Differences',
+    cmap: 'Type CMapName CIDSystemInfo:cidsystem WMode UseCMap:cmap',
+    descriptor: 'Type FontName FontFamily FontStretch FontWeight Flags FontBBox ItalicAngle Ascent Descent ' +
+        'Leading CapHeight XHeight StemV StemH AvgWidth MaxWidth MissingWidth CharSet Lang ' +
+        'FontFile:fontfile FontFile2:fontfile FontFile3:fontfile CIDSet:data',
+    fontfile: 'Subtype Length1 Length2 Length3',
+    layers: 'OCGs:[ocg] D:config',
+    config: 'Name BaseState ON:[^ocg] OFF:[^ocg] Intent AS:[auto] Order:[^ocg] ListMode RBGroups:[^ocg] ' +
+        'Locked:[^ocg]',
+    auto: 'Event Category OCGs:[^ocg]',
+    ocg: 'Type Name Intent Usage:usage',
+    usage: 'Print:state View:state Export:state PageElement:state',
+    state: 'Subtype PrintState ViewState ExportState',
+    ocmd: 'Type OCGs:[ocg] P VE:[^ocg]',
+    marked: '',
+    marks: 'Marked Suspects',
+    tags: 'Type K:[kid] IDTree:ids ParentTree:parents ParentTreeNextKey RoleMap:{} ClassMap:{[attributes]}',
+    elem: 'Type S P:^elem|tags ID Pg:^page K:[kid] A:[attributes] C T Lang Alt E ActualText',
+    mcr: 'Type Pg:^page MCID',
+    objr: 'Type Pg:^page Obj:^link',
+    attributes: 'O Headers Scope ColSpan RowSpan Summary BBox Width Height Placement BackgroundColor ' +
+        'BorderColor BorderStyle BorderThickness SpaceBefore SpaceAfter StartIndent EndIndent ' +
+        'TextIndent TextAlign BlockAlign InlineAlign BaselineShift LineHeight TextDecorationColor ' +
+        'TextDecorationThickness TextDecorationType ColumnCount ColumnGap ColumnWidths ' +
+        'ListNumbering Role checked ADBE_MinWidth',
+    parents: 'Kids:[parents] Nums:[^elem] Limits',
+    ids: 'Kids:[ids] Names:[^elem] Limits'
+};
+export const STREAMS = [
+    'content',
+    'image',
+    'form',
+    'data',
+    'icc',
+    'function0',
+    'function4',
+    'mesh',
+    'tiling',
+    'cmap',
+    'fontfile'
+];
+export const STREAM = 'Length Filter DecodeParms:[parms]';
+export const PICK = {
+    node: ['Type', { Pages: 'tree', Page: 'page' }],
+    action: ['S', { URI: 'uri', GoTo: 'goto' }],
+    xobject: ['Subtype', { Image: 'image', Form: 'form' }],
+    font: [
+        'Subtype',
+        {
+            Type1: 'simple',
+            MMType1: 'simple',
+            TrueType: 'simple',
+            Type3: 'type3',
+            Type0: 'type0',
+            CIDFontType0: 'cidfont',
+            CIDFontType2: 'cidfont'
+        }
+    ],
+    space: [
+        '0',
+        {
+            ICCBased: 'ICCBased',
+            Indexed: 'Indexed',
+            Separation: 'Separation',
+            DeviceN: 'DeviceN',
+            CalRGB: 'CalRGB',
+            CalGray: 'CalGray',
+            Lab: 'Lab',
+            Pattern: 'Pattern'
+        }
+    ],
+    function: ['FunctionType', { 0: 'function0', 2: 'function2', 3: 'function3', 4: 'function4' }],
+    shading: [
+        'ShadingType',
+        { 1: 'shaded', 2: 'shaded', 3: 'shaded', 4: 'mesh', 5: 'mesh', 6: 'mesh', 7: 'mesh' }
+    ],
+    pattern: ['PatternType', { 1: 'tiling', 2: 'shadingpattern' }],
+    oc: ['Type', { OCG: 'ocg', OCMD: 'ocmd' }, 'marked'],
+    kid: ['Type', { MCR: 'mcr', OBJR: 'objr' }, 'elem']
+};
+const SHAPES = { '[': 'list', '{': 'map', '^': 'back' };
+const SLOTS = new Map();
+/** The slot a spelling of the table names. One spelling is one object, so the walk compares slots as they are. */
+function slot(text) {
+    let read = SLOTS.get(text);
+    if (!read) {
+        const many = text.startsWith('[^');
+        const shape = many ? 'back' : (SHAPES[text.charAt(0)] ?? 'one');
+        const inner = many ? text.slice(2, -1) : shape === 'back' ? text.slice(1) : text.slice(1, -1);
+        read = { shape, kind: shape === 'one' ? text : inner, many };
+        SLOTS.set(text, read);
+    }
+    return read;
+}
+const WHOLE = slot('*');
+/** A key of a row: a name in a dictionary, or a position in an array. */
+const keyed = (text) => (/^\d+$/.test(text) ? Number(text) : PDFName.of(text));
+/** What a dictionary holds at a name or an array at a position, read through a reference. */
+const under = (held, key) => {
+    if (held instanceof PDFArray)
+        return typeof key === 'number' ? held.lookup(key) : undefined;
+    return typeof key === 'number' ? undefined : held.lookup(key);
+};
+/** Each kind's keys with the slot of each, and what the kind is: a dictionary, a stream or an array. */
+const ROWS = new Map(Object.entries(KINDS).map(([kind, keys]) => {
+    const stream = STREAMS.includes(kind);
+    const entries = (stream ? `${keys} ${STREAM}` : keys).split(' ').filter(Boolean);
+    const row = new Map(entries.map((entry) => {
+        const [key, leads = ''] = entry.split(':');
+        return [keyed(key), slot(leads)];
+    }));
+    return [kind, { body: stream ? 'stream' : row.has(0) ? 'array' : 'dict', keys: row }];
+}));
+const PICKS = new Map(Object.entries(PICK).map(([kind, [key, kinds, other]]) => [
+    kind,
+    {
+        key: keyed(key),
+        kinds: new Map(Object.entries(kinds).map(([told, kind]) => [keyed(told), kind])),
+        other
+    }
+]));
+/**
+ * The `acroform` background: the source file's pages, and of each dictionary
+ * they hold the keys `KINDS` lists for its kind. With the rest of the catalog
+ * go the form (`/AcroForm` with its XFA packet, `/NeedsRendering`), the XMP
+ * metadata, the scripts, attachments, portfolio and bookmarks, and the
+ * usage-rights signature under `/Perms`. The signature goes here because qpdf's
+ * `--remove-restrictions`, which takes it too, also strips `/FT /Sig` from
+ * every signature field. The trailer's `/Info` and `/ID` go too.
+ *
+ * Of a page's annotations a Link stays, when it leads to an http or https
+ * address or to an explicit destination in the file, and leads there one way.
+ * A named destination resolves through the catalog's `/Dests` or `/Names`,
+ * which go, so a link to one goes too, and so does a link with an action
+ * chained after its own. The action a link keeps is a copy, so nothing the file
+ * hangs on the same object is cut with it.
+ *
+ * Each page's MediaBox is set to the box of its entry of `views`, the frame the
+ * inventory measured that page's widgets in. No box of the file is read here. A
+ * file whose pages are not the objects `views` names, in that order, is one
+ * pdf.js and pdf-lib read differently, and is refused as `damaged`.
+ *
+ * A walk from the catalog, level by level, then gives each object one kind, by
+ * the key that reaches it. A dictionary loses every key its kind does not list
+ * and every value that is not what its key leads to, and an object the walk
+ * does not reach is deleted: a saved file carries every object the context
+ * holds, reachable or not. A file in which a key reaches an object as another
+ * kind than it has is refused as `damaged`. A reference back to an object the
+ * walk did not reach as its kind is deleted, or made null in an array: a
+ * destination's page that the page tree does not hold, and a layer the default
+ * configuration names that no other key reaches.
+ *
+ * The structure tree has rows as the rest has. Of what lies outside it, it
+ * names a page of the page tree and a link that stays, each by a reference
+ * back, and nothing else: an element's `/Pg` to any other object is deleted,
+ * and an object reference whose `/Obj` is not such a link is taken out of its
+ * element's `/K`.
+ *
+ * An object that reads as an annotation or as a page, and is neither a page of
+ * `views` nor a link that stays, is deleted outright before the walk. No widget
+ * and no page outside the page tree is then in the file, whatever names one, a
+ * dictionary by name included, and the fields and appearance streams that hung
+ * off it are out of the walk's reach: a background that still carries a form
+ * layer is one the renderer would stamp a second one over.
+ */
+export async function stripAcroForm(bytes, views) {
+    const doc = await PDFDocument.load(bytes, { updateMetadata: false });
+    const { context } = doc;
+    const at = (object, key) => object instanceof PDFDict ? object.lookup(PDFName.of(key)) : undefined;
+    const is = (object, key, name) => at(object, key) === PDFName.of(name);
+    /** An annotation need not say it is one: a `/Rect` or a `/Subtype /Widget` is enough. */
+    const annotation = (object) => is(object, 'Type', 'Annot') ||
+        at(object, 'Rect') !== undefined ||
+        is(object, 'Subtype', 'Widget');
+    /** The action a link that stays keeps, `null` when it holds its destination itself, `false` when it goes. */
+    const leads = (link) => {
+        if (!link.has(PDFName.of('A')))
+            return at(link, 'Dest') instanceof PDFArray ? null : false;
+        const action = at(link, 'A');
+        if (link.has(PDFName.of('Dest')) || at(action, 'Next') !== undefined)
+            return false;
+        if (is(action, 'S', 'GoTo'))
+            return at(action, 'D') instanceof PDFArray && action.clone();
+        if (!is(action, 'S', 'URI'))
+            return false;
+        const uri = at(action, 'URI');
+        // A URI is ASCII, so its start is read off the bytes. Decoded as text, an
+        // address spelled in UTF-16 would pass here and be another one to a reader.
+        const head = uri instanceof PDFString || uri instanceof PDFHexString
+            ? String.fromCharCode(...uri.asBytes().subarray(0, 8))
+            : '';
+        return /^https?:\/\//i.test(head) && action.clone();
+    };
+    const pages = doc.getPages();
+    const differs = pages.some(({ ref }, index) => {
+        const viewed = views[index]?.ref;
+        return viewed?.num !== ref.objectNumber || viewed.gen !== ref.generationNumber;
+    });
+    if (differs || pages.length !== views.length)
+        throw new Refused({ code: 'damaged' });
+    const kept = new Set(pages.map((page) => page.ref));
+    const linked = new Set();
+    for (const [index, page] of pages.entries()) {
+        const listed = at(page.node, 'Annots');
+        const links = (listed instanceof PDFArray ? listed.asArray() : []).filter((entry) => {
+            const link = context.lookup(entry);
+            // An annotation that names its type names /Annot, so a page that lists
+            // itself is no link, whatever else it says.
+            const typed = at(link, 'Type') ?? PDFName.of('Annot');
+            if (!is(link, 'Subtype', 'Link') || typed !== PDFName.of('Annot'))
+                return false;
+            const action = leads(link);
+            if (action === false)
+                return false;
+            if (action)
+                link.set(PDFName.of('A'), action);
+            linked.add(entry);
+            return true;
+        });
+        page.node.set(PDFName.of('MediaBox'), context.obj(views[index].box));
+        page.node.delete(PDFName.of('Annots'));
+        if (links.length > 0)
+            page.node.set(PDFName.of('Annots'), context.obj(links));
+    }
+    context.trailerInfo.Info = undefined;
+    context.trailerInfo.ID = undefined;
+    for (const [ref, object] of context.enumerateIndirectObjects())
+        if (!kept.has(ref) && !linked.has(ref) && (is(object, 'Type', 'Page') || annotation(object)))
+            context.delete(ref);
+    const claimed = new Map();
+    const pending = [];
+    const whole = [];
+    const backs = [];
+    /** Whether what a reference names or an array holds leads nowhere: `false` while it is being read, so an array that holds itself leads somewhere. */
+    const plains = new Map();
+    /** Whether a value leads nowhere. A reference and an array are each read once, whatever reaches them, and a `[reference]` or an `[array]` among the parts marks where its own parts end. */
+    const plain = (value) => {
+        const parts = [value];
+        while (parts.length > 0) {
+            let part = parts.pop();
+            if (Array.isArray(part)) {
+                plains.set(part[0], true);
+                continue;
+            }
+            if (part instanceof PDFRef || part instanceof PDFArray) {
+                const known = plains.get(part);
+                if (known)
+                    continue;
+                if (known === false)
+                    return false;
+                plains.set(part, false);
+                parts.push([part]);
+                if (part instanceof PDFRef)
+                    part = context.lookup(part);
+            }
+            if (part instanceof PDFArray)
+                for (let i = 0; i < part.size(); i++)
+                    parts.push(part.get(i));
+            else if (!(part instanceof PDFNumber ||
+                part instanceof PDFName ||
+                part instanceof PDFString ||
+                part instanceof PDFHexString ||
+                part instanceof PDFBool ||
+                part === PDFNull))
+                return false;
+        }
+        return true;
+    };
+    /**
+     * Gives an object its kind and queues it, where this reach of it is as a kind.
+     * An object that has one is reached as that kind and no other, or the file is
+     * refused as `damaged`: the walk cuts it to the keys of the first, and a second
+     * would read what is left. Whether this reach of it stays.
+     */
+    const claim = (raw, value, as) => {
+        const had = claimed.get(raw);
+        if (had && had !== as)
+            throw new Refused({ code: 'damaged' });
+        if (had || !as)
+            return as !== undefined;
+        if (raw instanceof PDFRef)
+            claimed.set(raw, as);
+        pending.push([value, as]);
+        return true;
+    };
+    /** Whether a value stays where a key leads to `to`. */
+    const reach = (raw, to) => {
+        if (to === WHOLE || plain(raw)) {
+            whole.push(raw);
+            return true;
+        }
+        if (!to.kind && to.shape === 'one')
+            return false;
+        const value = raw instanceof PDFRef ? context.lookup(raw) : raw;
+        if (!(value instanceof PDFDict || value instanceof PDFStream || value instanceof PDFArray))
+            return false;
+        if (to.shape === 'map')
+            return claim(raw, value, value instanceof PDFDict ? to : undefined);
+        if (to.shape === 'list' && value instanceof PDFArray)
+            return claim(raw, value, to);
+        const pick = PICKS.get(to.kind);
+        const told = pick && under(value instanceof PDFStream ? value.dict : value, pick.key);
+        const kind = pick
+            ? (pick.kinds.get(told instanceof PDFNumber ? told.asNumber() : told) ?? pick.other)
+            : to.kind;
+        const body = value instanceof PDFStream ? 'stream' : value instanceof PDFArray ? 'array' : 'dict';
+        // A page is one the loop above framed. pdf-lib reads none in a dictionary
+        // written inside /Kids that names its /Type by reference. An object reference
+        // is one to a link that loop kept.
+        const fits = kind &&
+            ROWS.get(kind).body === body &&
+            (kind !== 'page' || kept.has(raw)) &&
+            (kind !== 'objr' || linked.has(value.get(PDFName.of('Obj'))));
+        return claim(raw, value, fits ? slot(kind) : undefined);
+    };
+    claim(context.trailerInfo.Root, doc.catalog, slot('catalog'));
+    for (let next = 0; next < pending.length; next++) {
+        const [value, as] = pending[next];
+        if (as.shape === 'list' && value instanceof PDFArray) {
+            let stay = 0;
+            for (let i = 0; i < value.size(); i++) {
+                const part = value.get(i);
+                if (reach(part, slot(as.kind)))
+                    value.set(stay++, part);
+            }
+            while (value.size() > stay)
+                value.remove(value.size() - 1);
+        }
+        else if (as.shape === 'map' && value instanceof PDFDict) {
+            for (const [key, part] of value.entries())
+                if (!reach(part, slot(as.kind)))
+                    value.delete(key);
+        }
+        else if (value instanceof PDFArray) {
+            const { keys } = ROWS.get(as.kind);
+            while (value.size() > keys.size)
+                value.remove(value.size() - 1);
+            for (let i = 0; i < value.size(); i++) {
+                const to = keys.get(i);
+                if (to.shape === 'back')
+                    backs.push([value, i, to]);
+                else if (!reach(value.get(i), to))
+                    value.set(i, PDFNull);
+            }
+        }
+        else {
+            const dict = value instanceof PDFStream ? value.dict : value;
+            const { keys } = ROWS.get(as.kind);
+            for (const [key, part] of dict.entries()) {
+                const to = keys.get(key);
+                if (to?.shape === 'back')
+                    backs.push([dict, key, to]);
+                else if (!to || !reach(part, to))
+                    dict.delete(key);
+            }
+        }
+    }
+    // A page tree node that reads as an annotation is deleted above, and the page
+    // tree holds the pages under it no more.
+    if (pages.some(({ ref }) => claimed.get(ref) !== slot('page')))
+        throw new Refused({ code: 'damaged' });
+    // A back reference stays when the walk reached what it names as its kind.
+    // Where the slot takes many, a value that leads nowhere stays too, and an
+    // array is read part by part, and so is each array in it. An array is read
+    // once. One the walk cut to a list of the kind stays wherever it is named.
+    // One that two such keys name by a reference stays under both, and inside an
+    // array a second reference to it does not, so no array is left holding itself.
+    // One that has any other kind gets the file refused.
+    // An array written in place is read here and never by `plain`, which would
+    // hold a note of each.
+    for (const [holder, key, to] of backs) {
+        const ones = to.kind.split('|').map(slot);
+        const list = slot(`[${to.kind}]`);
+        const arrays = [];
+        const stays = (within, part) => {
+            const had = claimed.get(part);
+            if (had && ones.includes(had))
+                return true;
+            if (!to.many)
+                return false;
+            if (had === list)
+                return true;
+            if (had === to)
+                return within instanceof PDFDict;
+            if (!(part instanceof PDFArray) && plain(part)) {
+                whole.push(part);
+                return true;
+            }
+            const value = part instanceof PDFRef ? context.lookup(part) : part;
+            if (!(value instanceof PDFArray))
+                return false;
+            if (had)
+                throw new Refused({ code: 'damaged' });
+            if (part instanceof PDFRef)
+                claimed.set(part, to);
+            arrays.push(value);
+            return true;
+        };
+        if (holder instanceof PDFArray) {
+            if (!stays(holder, holder.get(key)))
+                holder.set(key, PDFNull);
+        }
+        else if (!stays(holder, holder.get(key)))
+            holder.delete(key);
+        for (let array = arrays.pop(); array; array = arrays.pop())
+            for (let i = 0; i < array.size(); i++)
+                if (!stays(array, array.get(i)))
+                    array.set(i, PDFNull);
+    }
+    // What no row reads and what leads nowhere are kept as they are and walked
+    // last, so an object a row reaches has its row whatever else names it.
+    while (whole.length > 0) {
+        let value = whole.pop();
+        if (value instanceof PDFRef) {
+            if (claimed.has(value))
+                continue;
+            claimed.set(value, WHOLE);
+            value = context.lookup(value);
+        }
+        if (value instanceof PDFArray)
+            for (let i = 0; i < value.size(); i++)
+                whole.push(value.get(i));
+        else if (value instanceof PDFDict)
+            for (const part of value.values())
+                whole.push(part);
+        else if (value instanceof PDFStream)
+            for (const part of value.dict.values())
+                whole.push(part);
+    }
+    // The trailer's /Size is the largest object number plus one, and deleting does
+    // not lower it.
+    let largest = 0;
+    for (const [ref] of context.enumerateIndirectObjects()) {
+        if (!claimed.has(ref))
+            context.delete(ref);
+        else if (ref.objectNumber > largest)
+            largest = ref.objectNumber;
+    }
+    context.largestObjectNumber = largest;
+    return doc.save({ useObjectStreams: false });
+}

package/dist/types.d.ts

@@ -0,0 +1,110 @@
+/** Geometry in PDF points, top-left origin, page-relative: the `acroform` backend's `rect`. */
+export interface Rect {
+    x: number;
+    y: number;
+    w: number;
+    h: number;
+}
+/** AcroForm field type codes as pdf.js reports them. */
+export declare const WIDGET_KINDS: readonly ["Tx", "Btn", "Ch", "Sig"];
+export type WidgetKind = (typeof WIDGET_KINDS)[number];
+/** One place a field is painted. */
+export interface WidgetPlace {
+    page: number;
+    rect: Rect;
+}
+export interface InventoryWidget {
+    /** Unique within the inventory: the field name, suffixed when a name repeats. */
+    id: string;
+    name: string;
+    kind: WidgetKind;
+    /**
+     * Everywhere this field is painted. More than one when a form repeats a box:
+     * one name is one value in the file, so typing into any of them fills them
+     * all, and treating them as separate fields asks for the same answer twice.
+     */
+    places: WidgetPlace[];
+    multiLine: boolean;
+    checkBox: boolean;
+    radioButton: boolean;
+    combo: boolean;
+    options: string[];
+    readOnly: boolean;
+    required: boolean;
+    /** `/TU`, the hover text the form's author wrote. */
+    tooltip?: string;
+    /** `/MaxLen`, 0 when the field sets none. */
+    maxLen: number;
+    /** This widget's on-state name, which is how a radio group tells its options apart. */
+    buttonValue?: string;
+}
+export interface FieldInventory {
+    pages: {
+        width: number;
+        height: number;
+    }[];
+    widgets: InventoryWidget[];
+}
+/** A page as pdf.js read it. */
+export interface View {
+    /** The object that is the page, by number and generation: null when pdf.js gives none. */
+    ref: {
+        num: number;
+        gen: number;
+    } | null;
+    /** The page's frame in PDF space, pdf.js's `view` of it, which every rect of the page is measured in. */
+    box: [x0: number, y0: number, x1: number, y1: number];
+}
+export type FieldType = 'string' | 'boolean' | 'enum' | 'array';
+export interface QualifiedField {
+    /** `InventoryWidget.id` */
+    widget: string;
+    /** snake_case schema field name */
+    name: string;
+    label: string;
+    description: string;
+    type: FieldType;
+    multiline: boolean;
+    options?: string[];
+    example?: string;
+    keep: boolean;
+    /** `/Ff` bit 2: the form says this one has to be filled. */
+    required: boolean;
+    /** The radio group this option belongs to, when it is one. */
+    group?: string;
+}
+export interface QualifiedForm {
+    quill: {
+        name: string;
+        title: string;
+        description: string;
+    };
+    fields: QualifiedField[];
+}
+export declare const SNAKE_CASE: RegExp;
+/** A quill as files, the shape `Quill.fromTree` and a quiver both take. */
+export type QuillTree = Map<string, Uint8Array>;
+/** The largest file `sanitize` opens. It bounds the compressed input. */
+export declare const MAX_BYTES: number;
+/**
+ * The most a file may come to once qpdf has it: the file qpdf writes together
+ * with what its Flate streams decode to, and qpdf's own memory. Of 1,423
+ * published files the largest comes to 15,046,490 bytes (DAF 57), and qpdf's
+ * memory is 17,235,968 bytes after each.
+ */
+export declare const MAX_INFLATED_BYTES: number;
+/** The most pages and fields a form has and is taken. The engine takes at most 1,000 fields in a block. */
+export declare const MAX_PAGES = 25;
+export declare const MAX_WIDGETS = 1000;
+/**
+ * The most pixels the pictures of a dynamic form come to, each use counted.
+ * At four bytes a pixel that is 32 MB on a canvas, and as much in the
+ * background when the pictures are noise with an alpha channel. Of the 65 Air
+ * Force forms with a picture the largest comes to 6,958,512 (AF 4035).
+ */
+export declare const MAX_PICTURE_PIXELS = 8000000;
+/**
+ * How long `sanitize` works on a file before it refuses it. Of 59 published
+ * forms the slowest takes 2.7 s (SF 2809).
+ */
+export declare const MAX_SECONDS = 60;

package/dist/types.js

@@ -0,0 +1,27 @@
+/** AcroForm field type codes as pdf.js reports them. */
+export const WIDGET_KINDS = ['Tx', 'Btn', 'Ch', 'Sig'];
+export const SNAKE_CASE = /^[a-z][a-z0-9_]*$/;
+/** The largest file `sanitize` opens. It bounds the compressed input. */
+export const MAX_BYTES = 8 * 1024 * 1024;
+/**
+ * The most a file may come to once qpdf has it: the file qpdf writes together
+ * with what its Flate streams decode to, and qpdf's own memory. Of 1,423
+ * published files the largest comes to 15,046,490 bytes (DAF 57), and qpdf's
+ * memory is 17,235,968 bytes after each.
+ */
+export const MAX_INFLATED_BYTES = 64 * 1024 * 1024;
+/** The most pages and fields a form has and is taken. The engine takes at most 1,000 fields in a block. */
+export const MAX_PAGES = 25;
+export const MAX_WIDGETS = 1000;
+/**
+ * The most pixels the pictures of a dynamic form come to, each use counted.
+ * At four bytes a pixel that is 32 MB on a canvas, and as much in the
+ * background when the pictures are noise with an alpha channel. Of the 65 Air
+ * Force forms with a picture the largest comes to 6,958,512 (AF 4035).
+ */
+export const MAX_PICTURE_PIXELS = 8_000_000;
+/**
+ * How long `sanitize` works on a file before it refuses it. Of 59 published
+ * forms the slowest takes 2.7 s (SF 2809).
+ */
+export const MAX_SECONDS = 60;