@quillmark/quillify 0.0.0-stage → 0.3.1

package/dist/naming.js

@@ -0,0 +1,116 @@
+import { SNAKE_CASE } from './types.js';
+const MAX_LENGTH = 40;
+const snake = (text) => text
+    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+    .replace(/[^A-Za-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+    .toLowerCase();
+/** The last segment of the LiveCycle id `form1[0].page1[0].Header[0].dateReq[0]` is `dateReq`. */
+const lastSegment = (path) => path.slice(path.lastIndexOf('.') + 1).replace(/\[\d+\]$/, '');
+const squeeze = (text) => text.trim().replace(/\s+/g, ' ');
+const lead = (words) => (/^[a-z]/.test(words) ? words : words ? `field_${words}` : 'field');
+/** The whole words of `words` that fit in `limit`, or nothing when no whole word does. */
+function whole(words, limit) {
+    if (words.length <= limit)
+        return words;
+    const head = words.slice(0, Math.max(0, words.lastIndexOf('_', limit)));
+    return head === 'field' ? '' : head;
+}
+/** `words` cut to `limit`: the whole words that fit, or its first `limit` characters when no whole word does. */
+const fit = (words, limit) => whole(words, limit) || words.slice(0, limit);
+export function suggest(fields) {
+    // Options of one group whose tooltips read alike are told apart by their on-states.
+    const tooltips = fields.map((field) => snake(field.tooltip ?? ''));
+    const keys = fields.map((field, at) => field.kind === 'radio' && tooltips[at] ? `${tooltips[at]}\0${field.group}` : '');
+    const once = new Set();
+    const alike = new Set();
+    for (const key of keys)
+        if (key)
+            (once.has(key) ? alike : once).add(key);
+    const taken = new Set();
+    return fields.map((field, at) => {
+        const radio = field.kind === 'radio' ? field : undefined;
+        const said = radio && alike.has(keys[at]) ? squeeze(radio.on ?? '') : '';
+        const on = snake(said);
+        const head = on && whole(lead(tooltips[at]), MAX_LENGTH - 1 - on.length);
+        const words = on ||
+            tooltips[at] ||
+            snake(radio ? `${lastSegment(radio.group)} ${radio.on ?? ''}` : lastSegment(field.id));
+        const base = head ? `${head}_${on}` : fit(lead(words), MAX_LENGTH);
+        let name = base;
+        for (let n = 2; taken.has(name); n++)
+            name = `${base}_${n}`;
+        taken.add(name);
+        const tooltip = squeeze(field.tooltip ?? '');
+        const description = said ? `${tooltip} (${said})` : tooltip;
+        return { id: field.id, keep: !field.readOnly, name, description };
+    });
+}
+const TEXT = new Set(['line', 'paragraph', 'lines']);
+/**
+ * A naming can be a model's JSON, which TypeScript never saw. A slot of the
+ * wrong type is a mistake in the call and no fault of a name, so it throws: a
+ * pattern reads `null` as the word, and the word is a name.
+ */
+function shaped({ name, description, fields }) {
+    const not = (slot, kind) => {
+        throw new TypeError(`naming.${slot} is not ${kind}.`);
+    };
+    if (typeof name !== 'string')
+        not('name', 'a string');
+    if (typeof description !== 'string')
+        not('description', 'a string');
+    if (!Array.isArray(fields))
+        not('fields', 'an array');
+    fields.forEach((entry, at) => {
+        const slot = `fields[${at}]`;
+        if (typeof entry !== 'object' || entry === null)
+            return not(slot, 'an object');
+        if (typeof entry.id !== 'string')
+            not(`${slot}.id`, 'a string');
+        if (typeof entry.keep !== 'boolean')
+            not(`${slot}.keep`, 'a boolean');
+        if (typeof entry.name !== 'string')
+            not(`${slot}.name`, 'a string');
+        if (typeof entry.description !== 'string')
+            not(`${slot}.description`, 'a string');
+        if (entry.example !== undefined && typeof entry.example !== 'string')
+            not(`${slot}.example`, 'a string');
+        if (entry.text !== undefined && !TEXT.has(entry.text))
+            not(`${slot}.text`, "'line', 'paragraph' or 'lines'");
+    });
+}
+export function check(fields, naming) {
+    shaped(naming);
+    const problems = [];
+    if (!SNAKE_CASE.test(naming.name))
+        problems.push({ code: 'quill_name' });
+    if (/^\p{White_Space}*$/u.test(naming.description))
+        problems.push({ code: 'quill_description' });
+    const ids = new Set(fields.map((field) => field.id));
+    const entries = Map.groupBy(naming.fields, (entry) => entry.id);
+    for (const id of entries.keys())
+        if (!ids.has(id))
+            problems.push({ code: 'unknown_field', id });
+    for (const [id, sharing] of entries)
+        if (sharing.length > 1)
+            problems.push({ code: 'repeated_field', id });
+    for (const id of ids)
+        if (!entries.has(id))
+            problems.push({ code: 'unnamed_field', id });
+    // A read-only field is left out whatever its entry says, so it counts as dropped.
+    const fillable = new Set(fields.filter((field) => !field.readOnly).map((field) => field.id));
+    const kept = naming.fields.filter((entry) => entry.keep && fillable.has(entry.id));
+    if (kept.length === 0)
+        problems.push({ code: 'nothing_kept' });
+    for (const { id, name } of kept)
+        if (!SNAKE_CASE.test(name))
+            problems.push({ code: 'field_name', id });
+    for (const [name, sharing] of Map.groupBy(kept, (entry) => entry.name))
+        if (sharing.length > 1)
+            problems.push({ code: 'duplicate_name', name });
+    for (const { id, kind } of fields)
+        if (kind !== 'text' && entries.get(id)?.some((entry) => entry.text))
+            problems.push({ code: 'text_on_non_text', id });
+    return problems;
+}

package/dist/normalize.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Every PDF the library reads goes through qpdf first. Published forms arrive
+ * locked (a permissions wrapper with an empty user password), and pdf-lib
+ * carries no decryption code at all: it would either throw or, with
+ * `ignoreEncryption`, write plaintext into a file that still declares itself
+ * encrypted.
+ *
+ * `--flatten-rotation` folds a page's own quarter turn into its content, since
+ * the engine rejects a page that carries `/Rotate`
+ * (`rotation.browser.test.ts`). `--object-streams=disable` writes every object
+ * in the open, so pdf.js and pdf-lib, which read what qpdf wrote, inflate no
+ * object stream. `--recompress-flate` has qpdf decode every stream under
+ * Flate, LZW, ASCII85 or ASCIIHex and write it back as one Flate stream of its
+ * own, so the readers after it have nothing to disagree on: a stream that
+ * ends in a wrong check is no longer one. A page's content streams stay
+ * apart, as the engine paints them (`background.browser.test.ts`).
+ *
+ * Unconditional, so there is one path and no guessing about which files need
+ * it. On a file that needs nothing it is a rewrite.
+ *
+ * qpdf runs in a worker of its own for each file: `assets/qpdf.worker.js`,
+ * which is qpdf-wasm's script with `qpdf-handler.js` after it. The worker ends
+ * with the call, so a trap, a grown heap and whatever qpdf's `main` leaves
+ * behind end with it, and the page's thread is free while qpdf runs.
+ *
+ * The file is held to `MAX_INFLATED_BYTES` twice: in the worker, where qpdf
+ * is ended at the write that passes it, and then in what qpdf wrote, on the
+ * page's thread and before any other reader opens it.
+ */
+/**
+ * The same PDF with its encryption removed and a page's own quarter turn folded
+ * into the page. The worker answers with qpdf's file only when qpdf ended
+ * well, with or without warnings, since an error leaves the file cut short. A
+ * file it answers nothing for is refused: every later step reads these bytes
+ * as decrypted. So is a file that comes to more than `MAX_INFLATED_BYTES`, in
+ * qpdf or in what qpdf wrote. The worker is ended when it answers, or when
+ * `signal` fires before it has.
+ */
+export declare function normalizePdf(bytes: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;

package/dist/normalize.js

@@ -0,0 +1,303 @@
+/**
+ * Every PDF the library reads goes through qpdf first. Published forms arrive
+ * locked (a permissions wrapper with an empty user password), and pdf-lib
+ * carries no decryption code at all: it would either throw or, with
+ * `ignoreEncryption`, write plaintext into a file that still declares itself
+ * encrypted.
+ *
+ * `--flatten-rotation` folds a page's own quarter turn into its content, since
+ * the engine rejects a page that carries `/Rotate`
+ * (`rotation.browser.test.ts`). `--object-streams=disable` writes every object
+ * in the open, so pdf.js and pdf-lib, which read what qpdf wrote, inflate no
+ * object stream. `--recompress-flate` has qpdf decode every stream under
+ * Flate, LZW, ASCII85 or ASCIIHex and write it back as one Flate stream of its
+ * own, so the readers after it have nothing to disagree on: a stream that
+ * ends in a wrong check is no longer one. A page's content streams stay
+ * apart, as the engine paints them (`background.browser.test.ts`).
+ *
+ * Unconditional, so there is one path and no guessing about which files need
+ * it. On a file that needs nothing it is a rewrite.
+ *
+ * qpdf runs in a worker of its own for each file: `assets/qpdf.worker.js`,
+ * which is qpdf-wasm's script with `qpdf-handler.js` after it. The worker ends
+ * with the call, so a trap, a grown heap and whatever qpdf's `main` leaves
+ * behind end with it, and the page's thread is free while qpdf runs.
+ *
+ * The file is held to `MAX_INFLATED_BYTES` twice: in the worker, where qpdf
+ * is ended at the write that passes it, and then in what qpdf wrote, on the
+ * page's thread and before any other reader opens it.
+ */
+import { ParseSpeeds, PDFArray, PDFBool, PDFDict, PDFDocument, PDFInvalidObject, PDFName, PDFNumber, PDFRawStream, PDFStream } from 'pdf-lib';
+import { Refused } from './refusal.js';
+import { MAX_BYTES, MAX_INFLATED_BYTES } from './types.js';
+// Held in a constant so that Vite copies the worker byte for byte. Written
+// inside `new Worker(...)`, the URL makes it bundle the file again.
+const WORKER = new URL('../assets/qpdf.worker.js', import.meta.url);
+// A bundler renames both files, so the worker is told where the binary is.
+const WASM = new URL('../assets/qpdf.wasm', import.meta.url);
+const FLAGS = ['--decrypt', '--flatten-rotation', '--object-streams=disable', '--recompress-flate'];
+/**
+ * The two types of stream pdf-lib inflates whole as it parses a file, in every
+ * spelling it reads as their names: each letter as it is, or as `#` and its
+ * code.
+ */
+const spelled = (name) => [...name]
+    .map((letter) => `(?:${letter}|#${letter.charCodeAt(0).toString(16).toUpperCase()})`)
+    .join('');
+const TYPED = new RegExp(`/(?:${spelled('ObjStm')}|${spelled('XRef')})`);
+/**
+ * A Flate stream goes to the decoder this much at a time. The decoder inflates
+ * all of what it is handed before it gives any of it: 1 GiB, for a stream of
+ * 1 MB handed over whole.
+ */
+const SLICE = 1024;
+/** What qpdf leaves a stream under, alone or after one Flate layer. Each gives pixels. */
+const CODECS = ['DCTDecode', 'JPXDecode', 'CCITTFaxDecode', 'JBIG2Decode'];
+/** The components of a pixel in a color space that is this name or an array that begins with it. */
+const COMPONENTS = new Map([
+    ['DeviceGray', 1],
+    ['CalGray', 1],
+    ['Indexed', 1],
+    ['Separation', 1],
+    ['DeviceRGB', 3],
+    ['CalRGB', 3],
+    ['Lab', 3],
+    ['DeviceCMYK', 4]
+]);
+/**
+ * The bytes an image's pixels come to as its dictionary declares them: rows
+ * of whole bytes, at its bits to a component and the components of its color
+ * space, or at a bit to the pixel for a mask. A halftone's threshold array
+ * says a width and a height too, and neither bits nor a color space: a stream
+ * with a `/HalftoneType` and neither comes to two bytes to the pixel, the most
+ * such an array holds. A stream with no `/Width` and no `/Height` is no image
+ * and comes to none. One with either whose dictionary does not say what it
+ * comes to, in a component or more of a bit or more and in a number short of
+ * infinity, is refused as `damaged`.
+ *
+ * JPEG 2000 data says its own color space and bits, so an image under
+ * `JPXDecode` may leave either out, and counts at four components for the
+ * one and eight bits for the other, what a painter makes of a pixel. A
+ * CCITT decoder goes by the `/Columns` and `/Rows` of its `/DecodeParms`,
+ * so each counts where it is written and more than the image's own.
+ * `chain` is the stream's filters.
+ */
+function declared(dict, chain) {
+    if (!dict.has(PDFName.of('Width')) && !dict.has(PDFName.of('Height')))
+        return 0;
+    const number = (from, key) => {
+        const value = from.lookup(PDFName.of(key));
+        return value instanceof PDFNumber ? value.asNumber() : NaN;
+    };
+    const codec = chain.at(-1);
+    const jpx = codec === 'JPXDecode';
+    const parms = codec === 'CCITTFaxDecode' && dict.lookup(PDFName.of('DecodeParms'));
+    const fax = parms instanceof PDFArray ? parms.lookup(chain.length - 1) : parms;
+    const side = (key, said) => {
+        const own = number(dict, key);
+        const more = fax instanceof PDFDict ? number(fax, said) : NaN;
+        return more > own ? more : own;
+    };
+    const mask = dict.lookup(PDFName.of('ImageMask')) === PDFBool.True;
+    const space = dict.lookup(PDFName.of('ColorSpace'));
+    const threshold = dict.has(PDFName.of('HalftoneType')) && !space && !dict.has(PDFName.of('BitsPerComponent'));
+    const [family, part] = space instanceof PDFArray ? [space.lookup(0), space.lookup(1)] : [space];
+    const name = family instanceof PDFName ? family.decodeText() : '';
+    const components = mask || threshold
+        ? 1
+        : name === 'ICCBased' && part instanceof PDFStream
+            ? number(part.dict, 'N')
+            : name === 'DeviceN' && part instanceof PDFArray
+                ? part.size()
+                : jpx && !space
+                    ? 4
+                    : (COMPONENTS.get(name) ?? NaN);
+    const bits = mask
+        ? 1
+        : threshold
+            ? 16
+            : jpx && !dict.has(PDFName.of('BitsPerComponent'))
+                ? 8
+                : number(dict, 'BitsPerComponent');
+    const bytes = Math.ceil((side('Width', 'Columns') * components * bits) / 8) * side('Height', 'Rows');
+    if (!(components >= 1 && bits >= 1 && bytes >= 0 && bytes < Infinity))
+        throw new Refused({ code: 'damaged' });
+    return bytes;
+}
+/**
+ * The bytes an image's pixels come to as its codec's own header says them,
+ * which is what a decoder that goes by the stream makes: the first frame
+ * header of a JPEG, or the SIZ segment of a JPEG 2000 codestream, bare or in
+ * the `jp2c` box of a JP2 file. None under any other codec, and none where the
+ * header is not there or is cut short, which is where the view throws.
+ */
+function headed(codec, data) {
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    const bytes = (width, height, components, bits) => Math.ceil((width * components * bits) / 8) * height;
+    try {
+        if (codec === 'DCTDecode') {
+            // From the first start of an image, where a reader that looks for one begins.
+            let at = 0;
+            while (view.getUint16(at) !== 0xffd8)
+                at += 1;
+            // As libjpeg finds a marker: past a byte that is none, a fill byte and a marker of no length.
+            for (at += 2;;) {
+                const marker = view.getUint8(at) === 0xff ? view.getUint8(at + 1) : 0xff;
+                if (marker === 0xff)
+                    at += 1;
+                else if (marker >> 4 === 0xc && ![0xc4, 0xc8, 0xcc].includes(marker))
+                    // A height of 0 is left to a DNL marker after the scan, which can say 65,535.
+                    return bytes(view.getUint16(at + 7), view.getUint16(at + 5) || 0xffff, view.getUint8(at + 9), view.getUint8(at + 4));
+                else
+                    at += marker <= 1 || (marker >= 0xd0 && marker <= 0xd9) ? 2 : 2 + view.getUint16(at + 2);
+            }
+        }
+        if (codec === 'JPXDecode') {
+            let at = 0;
+            // A JP2 file is boxes: a length and a type, or a 1, a type and a length of eight bytes.
+            if (view.getUint32(4) === 0x6a502020) {
+                const wide = () => view.getUint32(at) === 1;
+                while (view.getUint32(at + 4) !== 0x6a703263)
+                    at += (wide() ? Number(view.getBigUint64(at + 8)) : view.getUint32(at)) || Infinity;
+                at += wide() ? 16 : 8;
+            }
+            // The image is its grid less where it starts in it, at the most bits any component says.
+            if (view.getUint32(at) === 0xff4fff51) {
+                const components = view.getUint16(at + 40);
+                let bits = 0;
+                for (let each = 0; each < components; each++)
+                    bits = Math.max(bits, (view.getUint8(at + 42 + 3 * each) & 127) + 1);
+                return bytes(view.getUint32(at + 8) - view.getUint32(at + 16), view.getUint32(at + 12) - view.getUint32(at + 20), components, bits);
+            }
+        }
+    }
+    catch {
+        // No header to go by.
+    }
+    return 0;
+}
+/**
+ * The size of the file qpdf wrote and of what its streams decode to, added up
+ * no further than the bound. pdf-lib lists the streams and the browser
+ * inflates each Flate one, keeping only what lies under a JPEG or JPEG 2000
+ * codec. An image comes to the most of what its dictionary declares, what
+ * its codec's own header says and what its Flate layer gives. An object
+ * pdf-lib cannot read, as a number of 400 digits, is one it would not count.
+ * Such an object, a stream the browser's decoder rejects, or one under a
+ * filter qpdf has not taken off, is one two readers can read two ways, and
+ * the file is refused as `damaged`.
+ */
+async function inflated(pdf) {
+    let total = pdf.byteLength;
+    // qpdf has written no stream of either type, so one that is here came with the file.
+    if (TYPED.test(new TextDecoder('latin1').decode(pdf)))
+        throw new Refused({ code: 'damaged' });
+    // pdf-lib waits on a timer between batches of objects unless it is told not to.
+    const { context } = await PDFDocument.load(pdf, {
+        updateMetadata: false,
+        parseSpeed: ParseSpeeds.Fastest
+    });
+    for (const [, object] of context.enumerateIndirectObjects()) {
+        if (object instanceof PDFInvalidObject)
+            throw new Refused({ code: 'damaged' });
+        if (!(object instanceof PDFRawStream))
+            continue;
+        const { dict, contents } = object;
+        const filter = dict.lookup(PDFName.of('Filter'));
+        const chain = (filter instanceof PDFArray
+            ? filter.asArray().map((entry) => context.lookup(entry))
+            : filter
+                ? [filter]
+                : []).map((entry) => (entry instanceof PDFName ? entry.decodeText() : ''));
+        const flate = chain[0] === 'FlateDecode';
+        const rest = chain.slice(flate ? 1 : 0);
+        if (rest.length > 1 || rest.some((name) => !CODECS.includes(name)))
+            throw new Refused({ code: 'damaged' });
+        const before = total;
+        const said = declared(dict, chain);
+        // An empty stream is one to every reader, and to the decoder a stream cut short.
+        if (!flate || !contents.length) {
+            total += Math.max(said, headed(rest[0], contents));
+            continue;
+        }
+        let at = 0;
+        const keep = rest[0] === 'DCTDecode' || rest[0] === 'JPXDecode';
+        const under = [];
+        const reader = new ReadableStream({
+            pull(controller) {
+                if (at < contents.length)
+                    controller.enqueue(contents.slice(at, (at += SLICE)));
+                else
+                    controller.close();
+            }
+        })
+            .pipeThrough(new DecompressionStream('deflate'))
+            .getReader();
+        try {
+            for (let read = await reader.read(); !read.done; read = await reader.read()) {
+                total += read.value.byteLength;
+                if (total > MAX_INFLATED_BYTES)
+                    return total;
+                if (keep)
+                    under.push(read.value);
+            }
+        }
+        catch {
+            throw new Refused({ code: 'damaged' });
+        }
+        finally {
+            void reader.cancel().catch(() => { });
+        }
+        const own = keep ? headed(rest[0], new Uint8Array(await new Blob(under).arrayBuffer())) : 0;
+        total = Math.max(total, before + Math.max(said, own));
+    }
+    return total;
+}
+/**
+ * The same PDF with its encryption removed and a page's own quarter turn folded
+ * into the page. The worker answers with qpdf's file only when qpdf ended
+ * well, with or without warnings, since an error leaves the file cut short. A
+ * file it answers nothing for is refused: every later step reads these bytes
+ * as decrypted. So is a file that comes to more than `MAX_INFLATED_BYTES`, in
+ * qpdf or in what qpdf wrote. The worker is ended when it answers, or when
+ * `signal` fires before it has.
+ */
+export async function normalizePdf(bytes, signal) {
+    // Before a worker starts, because qpdf is the step that allocates.
+    if (bytes.byteLength > MAX_BYTES)
+        throw new Refused({ code: 'too_large', bytes: bytes.byteLength, limit: MAX_BYTES });
+    const worker = new Worker(WORKER);
+    // A copy, moved to the worker. A view posted as it is takes its whole buffer along.
+    const copy = bytes.slice();
+    const { promise, resolve, reject } = Promise.withResolvers();
+    const late = () => reject(signal?.reason);
+    signal?.addEventListener('abort', late);
+    worker.onmessage = ({ data }) => resolve(data);
+    worker.onerror = () => reject(new Error(`qpdf.worker.js did not load from ${WORKER}`));
+    worker.postMessage({ bytes: copy, flags: FLAGS, wasm: WASM.href, limit: MAX_INFLATED_BYTES }, [
+        copy.buffer
+    ]);
+    const answer = await promise.finally(() => {
+        signal?.removeEventListener('abort', late);
+        worker.terminate();
+    });
+    if (!answer.loaded)
+        throw new Error(`qpdf.wasm did not load from ${WASM}`);
+    const { out, size, said } = answer;
+    // A file that came to more than the bound in qpdf is past it, whatever qpdf then wrote.
+    const total = size > MAX_INFLATED_BYTES ? size : out?.byteLength ? await inflated(out) : 0;
+    if (total > MAX_INFLATED_BYTES)
+        throw new Refused({ code: 'too_large', bytes: total, limit: MAX_INFLATED_BYTES });
+    if (out?.byteLength)
+        return out;
+    // A qpdf that ends by itself ends at its first error, and its last line says
+    // when that is the password or the encryption. No other reader opens the
+    // file, which the bound does not hold: a PDF has its header in its first
+    // 1,024 bytes.
+    if (/invalid password\n$/.test(said))
+        throw new Refused({ code: 'password' });
+    if (/encryption.*\n$/.test(said))
+        throw new Refused({ code: 'encryption' });
+    const head = new TextDecoder('latin1').decode(bytes.subarray(0, 1024));
+    throw new Refused({ code: head.includes('%PDF-') ? 'damaged' : 'not_pdf' });
+}

package/dist/pdfjs.d.ts

@@ -0,0 +1,17 @@
+import type { PDFDocumentProxy } from 'pdfjs-dist';
+/**
+ * A document on a worker of its own, which `close` ends. A file pdf.js rejects
+ * is refused here, so it carries the same code whichever stage opens it.
+ *
+ * A worker that is busy when `signal` fires answers nothing more, so a
+ * question put to the document is awaited through `within`, which rejects
+ * with the signal's reason then.
+ */
+export declare function openPdf(bytes: Uint8Array, options?: {
+    enableXfa?: boolean;
+    ownerDocument?: Document;
+}, signal?: AbortSignal): Promise<{
+    pdf: PDFDocumentProxy;
+    close(): Promise<void>;
+    within<T>(asked: Promise<T>): Promise<T>;
+}>;

package/dist/pdfjs.js

@@ -0,0 +1,96 @@
+import { Refused } from './refusal.js';
+// Held in a constant so that Vite copies the worker byte for byte. Written
+// inside `new Worker(...)`, the URL makes it bundle the file again.
+const WORKER = new URL('../assets/pdf.worker.js', import.meta.url);
+// The faces pdf.js lays a dynamic form's Arial, Helvetica, Myriad Pro and
+// Calibri out in, and any face the form's font list lacks, each named so that
+// a bundler copies it.
+const FACES = {
+    'LiberationSans-Regular.ttf': new URL('../assets/LiberationSans-Regular.ttf', import.meta.url),
+    'LiberationSans-Bold.ttf': new URL('../assets/LiberationSans-Bold.ttf', import.meta.url),
+    'LiberationSans-Italic.ttf': new URL('../assets/LiberationSans-Italic.ttf', import.meta.url),
+    'LiberationSans-BoldItalic.ttf': new URL('../assets/LiberationSans-BoldItalic.ttf', import.meta.url)
+};
+// The shipped worker rejects an open with what pdf.js's XFA layout threw, under
+// this prefix.
+const LAYOUT = 'XFA layout: ';
+/**
+ * A document on a worker of its own, which `close` ends. A file pdf.js rejects
+ * is refused here, so it carries the same code whichever stage opens it.
+ *
+ * A worker that is busy when `signal` fires answers nothing more, so a
+ * question put to the document is awaited through `within`, which rejects
+ * with the signal's reason then.
+ */
+export async function openPdf(bytes, options = {}, signal) {
+    const pdfjs = await import('pdfjs-dist');
+    signal?.throwIfAborted();
+    const port = new Worker(WORKER, { type: 'module' });
+    const worker = pdfjs.PDFWorker.create({ port });
+    const task = pdfjs.getDocument({
+        data: bytes.slice(),
+        ...options,
+        // What pdf.js asks the page for on its worker's behalf: a face of the
+        // package, and nothing else. pdf.js lays a form out without a face it did
+        // not get, so one that did not load ends the open: a request or a body
+        // that fails, and a status that is not ok.
+        BinaryDataFactory: class {
+            async fetch({ filename }) {
+                if (!Object.hasOwn(FACES, filename))
+                    throw new Error(`The package ships no ${filename}.`);
+                try {
+                    const response = await fetch(FACES[filename]);
+                    if (response.ok)
+                        return new Uint8Array(await response.arrayBuffer());
+                }
+                catch {
+                    // Ends the open below, as a status that is not ok does.
+                }
+                const failed = new Error(`${filename} did not load from ${FACES[filename]}`);
+                give(failed);
+                throw failed;
+            }
+        },
+        worker
+    });
+    // A worker script that fails to load answers nothing, and neither does one
+    // that is busy when the signal fires. `task.destroy()` waits on an answer,
+    // and `close` ends the worker whatever that wait comes to.
+    let answers = true;
+    const silent = Promise.withResolvers();
+    const give = (reason) => {
+        answers = false;
+        silent.reject(reason);
+    };
+    port.onerror = () => give(new Error(`pdf.worker.js did not load from ${WORKER}`));
+    const late = () => give(signal?.reason);
+    signal?.addEventListener('abort', late);
+    const within = (asked) => Promise.race([asked, silent.promise]);
+    const close = async () => {
+        const destroyed = task.destroy();
+        if (answers)
+            await within(destroyed).catch(() => { });
+        signal?.removeEventListener('abort', late);
+        worker.destroy();
+        port.terminate();
+    };
+    try {
+        return { pdf: await within(task.promise), close, within };
+    }
+    catch (err) {
+        await close();
+        if (!answers)
+            throw err;
+        if (err instanceof pdfjs.PasswordException)
+            throw new Refused({ code: 'password' });
+        if (err instanceof pdfjs.InvalidPDFException)
+            throw new Refused({ code: 'not_pdf' });
+        if (err instanceof Error && err.message.startsWith(LAYOUT))
+            throw new Refused({ code: 'layout', detail: err.message.slice(LAYOUT.length) });
+        // pdf.js raises a plain Error for an encryption it does not know, which is
+        // what a certificate-based PubSec file looks like.
+        if (err instanceof Error && /encryp/i.test(err.message))
+            throw new Refused({ code: 'encryption' });
+        throw err;
+    }
+}

package/dist/quillify.d.ts

@@ -0,0 +1,13 @@
+import type { Form, Naming, Problem } from './api.js';
+export type Quillified = {
+    ok: true;
+    tree: Map<string, Uint8Array>;
+} | {
+    ok: false;
+    problems: readonly Problem[];
+};
+/**
+ * A quill's files from a sanitized form and a naming of its fields, or the
+ * problems that stop one being built: `check`'s, and then the engine's.
+ */
+export declare function quillify(form: Form, naming: Naming): Promise<Quillified>;

package/dist/quillify.js

@@ -0,0 +1,86 @@
+import { init, isQuillmarkError } from '@quillmark/wasm';
+import { assembleQuill } from './assemble.js';
+import { check } from './naming.js';
+/** The inventory's code for each kind, which is how the assembly tells a signature from a field. */
+const WIDGET = {
+    text: 'Tx',
+    checkbox: 'Btn',
+    radio: 'Btn',
+    choice: 'Ch',
+    signature: 'Sig'
+};
+function typed(field, text) {
+    switch (field.kind) {
+        case 'text':
+            if (text === 'lines')
+                return { type: 'array', multiline: true };
+            return { type: 'string', multiline: text ? text === 'paragraph' : field.multiline };
+        case 'choice':
+            return { type: 'enum', multiline: false, options: [...field.options] };
+        case 'checkbox':
+        case 'radio':
+            return { type: 'boolean', multiline: false };
+        case 'signature':
+            return { type: 'string', multiline: false };
+    }
+}
+/** A choice shows one of its options even when the naming gives none, so its list is seen in the example. */
+function shown(field, suggested) {
+    const value = suggested?.trim() || undefined;
+    if (field.kind === 'choice')
+        return value !== undefined && field.options.includes(value) ? value : field.options[0];
+    if (field.kind !== 'text')
+        return undefined;
+    return value && field.maxLength ? [...value].slice(0, field.maxLength).join('') : value;
+}
+/**
+ * A quill's files from a sanitized form and a naming of its fields, or the
+ * problems that stop one being built: `check`'s, and then the engine's.
+ */
+export async function quillify(form, naming) {
+    const problems = check(form.fields, naming);
+    if (problems.length > 0)
+        return { ok: false, problems };
+    const byId = new Map(form.fields.map((field) => [field.id, field]));
+    const tree = assembleQuill({
+        quill: { name: naming.name, description: naming.description },
+        fields: naming.fields.map((entry) => {
+            const field = byId.get(entry.id);
+            const example = shown(field, entry.example);
+            return {
+                widget: entry.id,
+                name: entry.name,
+                description: entry.description,
+                ...typed(field, entry.text),
+                ...(example === undefined ? {} : { example }),
+                keep: entry.keep && !field.readOnly,
+                required: field.required,
+                ...(field.kind === 'radio' ? { group: field.group } : {})
+            };
+        })
+    }, {
+        widgets: form.fields.map(({ id, kind, places, tooltip }) => ({
+            id,
+            kind: WIDGET[kind],
+            places: [...places],
+            tooltip
+        }))
+    }, form.pdf);
+    const { Quill } = await init();
+    try {
+        Quill.fromTree(tree).free();
+    }
+    catch (err) {
+        if (!isQuillmarkError(err))
+            throw err;
+        return {
+            ok: false,
+            problems: err.diagnostics.map(({ code, message }) => ({
+                code: 'engine',
+                diagnostic: code,
+                message
+            }))
+        };
+    }
+    return { ok: true, tree };
+}