@quillmark/quillify 0.0.0-stage → 0.3.1

package/dist/refusal.d.ts

@@ -0,0 +1,47 @@
+/** Why a PDF is not taken. A `page` is zero-based, as a `Place`'s is. */
+export type Refusal = {
+    code: 'too_large';
+    bytes: number;
+    limit: number;
+} | {
+    code: 'not_pdf';
+} | {
+    code: 'password';
+} | {
+    code: 'encryption';
+} | {
+    code: 'damaged';
+} | {
+    code: 'rotated';
+    page: number;
+} | {
+    code: 'portfolio';
+    attachment?: string;
+} | {
+    code: 'no_fields';
+    xfa: boolean;
+} | {
+    code: 'too_many_pages';
+    pages: number;
+    limit: number;
+} | {
+    code: 'too_many_fields';
+    fields: number;
+    limit: number;
+} | {
+    code: 'layout';
+    detail: string;
+} | {
+    code: 'too_slow';
+    limit: number;
+} | {
+    code: 'unpaintable';
+    page: number;
+    construct: 'image' | 'background_image' | 'svg' | 'border' | 'transform' | 'glyph' | 'barcode' | 'password';
+    detail?: string;
+};
+/** Thrown where a stage declines a PDF. */
+export declare class Refused extends Error {
+    readonly refusal: Refusal;
+    constructor(refusal: Refusal);
+}

package/dist/refusal.js

@@ -0,0 +1,8 @@
+/** Thrown where a stage declines a PDF. */
+export class Refused extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal.code);
+        this.refusal = refusal;
+    }
+}

package/dist/sanitize.d.ts

@@ -0,0 +1,20 @@
+import { type Refusal } from './refusal.js';
+import type { Form } from './api.js';
+export type Sanitized = {
+    ok: true;
+    form: Form;
+} | {
+    ok: false;
+    refusal: Refusal;
+};
+/**
+ * A PDF form as its fields and a background with no form layer, or the reason
+ * the file is not taken. Nothing else in the package reads the file.
+ *
+ * One signal fires `MAX_SECONDS` after the call starts. A stage that is
+ * waiting on a worker then ends the worker and throws the signal's reason,
+ * as does an open that begins after it, and that reason is the refusal
+ * `too_slow`. Work on this thread is not interrupted and not timed: the
+ * strip starts no worker, so a call that has reached it returns its form.
+ */
+export declare function sanitize(pdf: Uint8Array): Promise<Sanitized>;

package/dist/sanitize.js

@@ -0,0 +1,72 @@
+import { inventoryPdf } from './inventory.js';
+import { normalizePdf } from './normalize.js';
+import { Refused } from './refusal.js';
+import { stripAcroForm } from './strip.js';
+import { xfaToAcroForm } from './xfa.js';
+import { MAX_SECONDS } from './types.js';
+function field(widget) {
+    const [place, ...more] = widget.places;
+    const { id, required, readOnly, tooltip } = widget;
+    const common = {
+        id,
+        places: [place, ...more],
+        ...(tooltip === undefined ? {} : { tooltip }),
+        required,
+        readOnly
+    };
+    switch (widget.kind) {
+        case 'Tx':
+            return {
+                ...common,
+                kind: 'text',
+                multiline: widget.multiLine,
+                ...(widget.maxLen > 0 ? { maxLength: widget.maxLen } : {})
+            };
+        case 'Btn':
+            // The inventory keeps no push button, so a button that is no radio is a checkbox.
+            if (!widget.radioButton)
+                return { ...common, kind: 'checkbox' };
+            return {
+                ...common,
+                kind: 'radio',
+                group: widget.name,
+                ...(widget.buttonValue === undefined ? {} : { on: widget.buttonValue })
+            };
+        case 'Ch':
+            return { ...common, kind: 'choice', options: widget.options };
+        case 'Sig':
+            return { ...common, kind: 'signature' };
+    }
+}
+/**
+ * A PDF form as its fields and a background with no form layer, or the reason
+ * the file is not taken. Nothing else in the package reads the file.
+ *
+ * One signal fires `MAX_SECONDS` after the call starts. A stage that is
+ * waiting on a worker then ends the worker and throws the signal's reason,
+ * as does an open that begins after it, and that reason is the refusal
+ * `too_slow`. Work on this thread is not interrupted and not timed: the
+ * strip starts no worker, so a call that has reached it returns its form.
+ */
+export async function sanitize(pdf) {
+    // Handing it anything but a Uint8Array is a mistake in the call and no fault of a file, so the call throws.
+    // The tag, not instanceof, so that a Uint8Array made in another window is taken.
+    if (Object.prototype.toString.call(pdf) !== '[object Uint8Array]')
+        throw new TypeError('sanitize takes a Uint8Array.');
+    const deadline = AbortSignal.timeout(MAX_SECONDS * 1000);
+    try {
+        const bytes = await xfaToAcroForm(await normalizePdf(pdf, deadline), deadline);
+        const { pages, widgets, views } = await inventoryPdf(bytes, deadline);
+        return {
+            ok: true,
+            form: { pdf: await stripAcroForm(bytes, views), pages, fields: widgets.map(field) }
+        };
+    }
+    catch (err) {
+        if (deadline.aborted && err === deadline.reason)
+            return { ok: false, refusal: { code: 'too_slow', limit: MAX_SECONDS } };
+        if (err instanceof Refused)
+            return { ok: false, refusal: err.refusal };
+        throw err;
+    }
+}

package/dist/strip.d.ts

@@ -0,0 +1,82 @@
+import type { View } from './types.js';
+/**
+ * What a background's dictionaries keep. A kind of dictionary lists its keys,
+ * and after a colon what a key leads to:
+ *
+ *     Key         a number, a name, a string, a boolean, null, or an array of those
+ *     Key:kind    a dictionary or a stream of that kind
+ *     Key:[kind]  one of them or an array of them
+ *     Key:{kind}  a dictionary of them by name
+ *     Key:^kind   a reference to one the walk reaches as that kind by another key
+ *     Key:[^kind] such a reference, or an array of them and of arrays of them
+ *     Key:*       a value no row reads yet, kept whole
+ *
+ * A reference back can be to one of two kinds, `Key:^kind|kind`. A dictionary
+ * by name can hold one of a kind or an array of them, `Key:{[kind]}`, or values
+ * of the first sort and nothing else, `Key:{}`.
+ *
+ * A value of the first sort also stays where a kind is expected: a mask can be
+ * an array of numbers and a color space a name. A kind `STREAMS` names is a
+ * stream, which keeps the keys of `STREAM` beside its own, and no other kind is
+ * a stream. A kind whose keys are numbers is an array read by position, as a
+ * color space is: it loses every part past the last its row lists, and a part
+ * before that which is not what its position leads to becomes null. A kind
+ * `PICK` names is one of several, told apart by a key of the dictionary or a
+ * position of the array, which holds a name where `PICK` writes one and a
+ * number where it writes a number. Where `PICK` names a last kind, one that is
+ * told as none of the others is of that kind.
+ */
+export declare const KINDS: Record<string, string>;
+export declare const STREAMS: string[];
+export declare const STREAM = "Length Filter DecodeParms:[parms]";
+export declare const PICK: Record<string, [key: string, kinds: Record<string, string>, other?: string]>;
+/**
+ * The `acroform` background: the source file's pages, and of each dictionary
+ * they hold the keys `KINDS` lists for its kind. With the rest of the catalog
+ * go the form (`/AcroForm` with its XFA packet, `/NeedsRendering`), the XMP
+ * metadata, the scripts, attachments, portfolio and bookmarks, and the
+ * usage-rights signature under `/Perms`. The signature goes here because qpdf's
+ * `--remove-restrictions`, which takes it too, also strips `/FT /Sig` from
+ * every signature field. The trailer's `/Info` and `/ID` go too.
+ *
+ * Of a page's annotations a Link stays, when it leads to an http or https
+ * address or to an explicit destination in the file, and leads there one way.
+ * A named destination resolves through the catalog's `/Dests` or `/Names`,
+ * which go, so a link to one goes too, and so does a link with an action
+ * chained after its own. The action a link keeps is a copy, so nothing the file
+ * hangs on the same object is cut with it.
+ *
+ * Each page's MediaBox is set to the box of its entry of `views`, the frame the
+ * inventory measured that page's widgets in. No box of the file is read here. A
+ * file whose pages are not the objects `views` names, in that order, is one
+ * pdf.js and pdf-lib read differently, and is refused as `damaged`.
+ *
+ * A walk from the catalog, level by level, then gives each object one kind, by
+ * the key that reaches it. A dictionary loses every key its kind does not list
+ * and every value that is not what its key leads to, and an object the walk
+ * does not reach is deleted: a saved file carries every object the context
+ * holds, reachable or not. A file in which a key reaches an object as another
+ * kind than it has is refused as `damaged`. A reference back to an object the
+ * walk did not reach as its kind is deleted, or made null in an array: a
+ * destination's page that the page tree does not hold, and a layer the default
+ * configuration names that no other key reaches.
+ *
+ * The structure tree has rows as the rest has. Of what lies outside it, it
+ * names a page of the page tree and a link that stays, each by a reference
+ * back, and nothing else: an element's `/Pg` to any other object is deleted,
+ * and an object reference whose `/Obj` is not such a link is taken out of its
+ * element's `/K`.
+ *
+ * An object that says `/Type /Annot`, `/Subtype /Widget` or `/Type /Page`, and
+ * is neither a page of `views` nor a link that stays, has no kind. A file in
+ * which a key reaches one as a kind is refused as `damaged`, the catalog itself
+ * included, and so is a file whose catalog or page tree pdf-lib cannot read. A
+ * marked-content property list may say `/Type /Page`, and a `/Rect` says
+ * nothing: a kept object loses the keys its row does not list. So no object of
+ * a background is a widget or a page outside the page tree, and the fields and
+ * appearance streams that hung off one are out of the walk's reach: a
+ * background that still carries a form layer is one the renderer would stamp a
+ * second one over. A dictionary written in place is not an object: one by name
+ * keeps the plain values a file writes in it, a widget's among them.
+ */
+export declare function stripAcroForm(bytes: Uint8Array, views: View[]): Promise<Uint8Array>;