@quillmark/quillify 0.3.0 → 0.3.1

package/README.md

@@ -4,7 +4,7 @@ Turn a published PDF form into a [Quillmark](https://github.com/borb-sh/quillmar
 
 Published forms rarely come as a clean fillable PDF. Most are encrypted with an empty password, and many are dynamic XFA, which only Acrobat lays out. quillify reads either kind and returns the page as a background with its form layer stripped, and every field with its place.
 
-57 of 59 federal forms and 1,143 of 1,354 Air Force forms convert, with every field read back at its place.
+57 of 59 federal forms and 1,147 of 1,354 Air Force forms convert, with every field read back at its place.
 
 ## Install
 
@@ -45,6 +45,7 @@ The file is treated as hostile. The background comes back without its form layer
 
 ## Documentation
 
+- [Example](examples/): a page that takes a PDF, lists its fields under the names `suggest` gives and renders a filled copy. In a clone: `npm ci`, `npm run build`, `npx vite examples`.
 - [API](docs/api.md): what goes in, what comes back, every refusal and problem.
 - [Guide](docs/guide.md): bundlers, content security policy, the engine, from a quill to a filled PDF.
 - [Limits](docs/limits.md): what converts, what is refused, how a redrawn form can differ.

package/assets/qpdf.worker.js

@@ -126,14 +126,19 @@ onmessage = async ({ data: { bytes, flags, wasm, limit } }) => {
 	}
 	let out;
 	let written = 0;
+	let said = '';
 	try {
 		qpdf.FS.writeFile('/in.pdf', bytes);
 		// Nothing in qpdf bounds the file it writes: streams that lie inside one
 		// another are each written whole. The write that passes the limit ends
 		// the run.
 		const { write } = qpdf.FS;
+		const text = new TextDecoder();
 		qpdf.FS.write = (stream, buffer, offset, length, ...rest) => {
 			if ((written += length) > limit) throw new Error('qpdf wrote past the limit');
+			// Its error stream. A qpdf that ends by itself says last why it writes no file, so the end is kept.
+			if (stream.fd === 2)
+				said = (said + text.decode(buffer.subarray(offset, offset + length))).slice(-1024);
 			return write(stream, buffer, offset, length, ...rest);
 		};
 		// qpdf ends with 0, or with 3 when it warned. After an error the file is
@@ -141,8 +146,10 @@ onmessage = async ({ data: { bytes, flags, wasm, limit } }) => {
 		if ([0, 3].includes(qpdf.callMain(['/in.pdf', ...flags, '/out.pdf'])))
 			out = qpdf.FS.readFile('/out.pdf');
 	} catch {
-		// qpdf wrote nothing it could stand behind.
+		// qpdf wrote nothing it could stand behind. It did not end by itself, so
+		// its last line is no error of its own: a warning carries the file's words.
+		said = '';
 	}
 	const size = Math.max(written, qpdf.HEAPU8.byteLength);
-	postMessage({ loaded: true, out, size }, out ? [out.buffer] : []);
+	postMessage({ loaded: true, out, size, said }, out ? [out.buffer] : []);
 };

package/dist/display-list.d.ts

@@ -14,7 +14,10 @@ export interface Box {
     fill: Colour | null;
     /** Top, right, bottom, left. A null edge is not drawn. */
     edges: [Edge | null, Edge | null, Edge | null, Edge | null];
-    /** The radius of an SVG rect's corners, along the middle of its border. */
+    /**
+     * The radius of an SVG rect's corners, along the middle of its border. An
+     * ellipse has one that reaches the middle of its longer side.
+     */
     radius?: number;
 }
 /** A picture, at the box the browser paints its pixels in. */
@@ -45,16 +48,15 @@ export interface Run {
     italic: boolean;
     colour: Colour;
     letterSpacing: number;
-    /** What the browser measured, which `drawRuns` scales the run to. */
+    /** What the browser measured, which `drawRun` scales the run to. */
     width: number;
     /** Quarter turns counter-clockwise about the start of the baseline, when the run is turned. */
     turn?: number;
 }
+export type Drawn = Box | Picture | Line | Run;
 export interface DisplayList {
-    boxes: Box[];
-    pictures: Picture[];
-    lines: Line[];
-    runs: Run[];
+    /** What the page shows, in the order the browser paints it. */
+    drawn: Drawn[];
     width: number;
     height: number;
 }
@@ -63,20 +65,21 @@ export interface DisplayList {
  * the layout, and the rects here are read off it.
  *
  * What it can express is text, CSS backgrounds and borders, pictures, and
- * inline SVG `line` and `rect`. A picture that did not load, a background
- * image, a `rect` filled with a gradient or a pattern, another SVG shape, a
- * border style it cannot draw and a transform it cannot carry are refused with
- * the construct named: a background that is silently incomplete is worse than
- * not taking the form. An element hidden by its own style, an SVG `line` with
- * no stroke, a `rect` with neither stroke nor fill and an HTML element under
- * 0.3 pt on a side are passed over.
+ * inline SVG `line`, `rect`, `ellipse` and `circle`. A picture that did not
+ * load, a background image, a shape filled with a gradient or a pattern,
+ * another SVG shape, a border style it cannot draw and a transform it cannot
+ * carry are refused with the construct named: a background that is silently
+ * incomplete is worse than not taking the form. An element hidden by its own
+ * style, an SVG `line` with no stroke, a shape with neither stroke nor fill
+ * or of no width or height, and an HTML element under 0.3 pt on a side are
+ * passed over.
  */
 export declare function displayList(page: XfaPage, pageNumber: number): DisplayList;
 /**
  * True for a transform a run's box cannot carry. XFA offsets caption
  * wrappers with a translation, which the rects already hold. A positive
  * horizontal scale is carried too: `getClientRects` reports the scaled width and
- * `drawRuns` puts it back as `Tz`, which is how LiveCycle's
+ * `drawRun` puts it back as `Tz`, which is how LiveCycle's
  * `xfa-font-horizontal-scale` reaches the page. A rotation, a skew, a mirror or
  * a vertical scale changes glyph shape or height, and a run carries neither. A
  * quarter turn is read apart, by `quarterTurns`.

package/dist/display-list.js

@@ -23,21 +23,19 @@ function stroked(style) {
  * the layout, and the rects here are read off it.
  *
  * What it can express is text, CSS backgrounds and borders, pictures, and
- * inline SVG `line` and `rect`. A picture that did not load, a background
- * image, a `rect` filled with a gradient or a pattern, another SVG shape, a
- * border style it cannot draw and a transform it cannot carry are refused with
- * the construct named: a background that is silently incomplete is worse than
- * not taking the form. An element hidden by its own style, an SVG `line` with
- * no stroke, a `rect` with neither stroke nor fill and an HTML element under
- * 0.3 pt on a side are passed over.
+ * inline SVG `line`, `rect`, `ellipse` and `circle`. A picture that did not
+ * load, a background image, a shape filled with a gradient or a pattern,
+ * another SVG shape, a border style it cannot draw and a transform it cannot
+ * carry are refused with the construct named: a background that is silently
+ * incomplete is worse than not taking the form. An element hidden by its own
+ * style, an SVG `line` with no stroke, a shape with neither stroke nor fill
+ * or of no width or height, and an HTML element under 0.3 pt on a side are
+ * passed over.
  */
 export function displayList(page, pageNumber) {
     const { layer, origin } = page;
     const view = layer.ownerDocument.defaultView;
-    const boxes = [];
-    const pictures = [];
-    const lines = [];
-    const runs = [];
+    const drawn = [];
     // The quarter turns each element is laid out under, its own and its ancestors'.
     const turns = new Map([[layer, 0]]);
     const X = (v) => +(v - origin.left).toFixed(2);
@@ -45,7 +43,43 @@ export function displayList(page, pageNumber) {
     const refuse = (construct, detail) => {
         throw new Refused({ code: 'unpaintable', page: pageNumber - 1, construct, detail });
     };
-    for (const el of layer.querySelectorAll('*')) {
+    // CSS paints the boxes of what is in the flow under a positioned element,
+    // then its text, pictures and SVG shapes, then the positioned elements
+    // under it in tree order, each the same way.
+    const order = [];
+    const under = (root) => {
+        const front = [];
+        const positioned = [];
+        const flow = (parent) => {
+            for (const node of parent.childNodes) {
+                if (node.nodeType === Node.TEXT_NODE)
+                    front.push(node);
+                if (node.nodeType !== Node.ELEMENT_NODE)
+                    continue;
+                const el = node;
+                if (view.getComputedStyle(el).position !== 'static')
+                    positioned.push(el);
+                else {
+                    (/^(img|line|rect|ellipse|circle|input)$/i.test(el.tagName) ? front : order).push(el);
+                    flow(el);
+                }
+            }
+        };
+        flow(root);
+        for (const node of front)
+            order.push(node);
+        for (const el of positioned) {
+            order.push(el);
+            under(el);
+        }
+    };
+    under(layer);
+    for (const node of order) {
+        if (node.nodeType === Node.TEXT_NODE) {
+            collectText(node, X, Y, drawn, turns);
+            continue;
+        }
+        const el = node;
         const tag = el.tagName.toLowerCase();
         const style = view.getComputedStyle(el);
         const own = quarterTurns(style.transform);
@@ -70,7 +104,7 @@ export function displayList(page, pageNumber) {
             const fit = style.objectFit === 'contain'
                 ? Math.min(rect.width / image.naturalWidth, rect.height / image.naturalHeight)
                 : 0;
-            pictures.push({
+            drawn.push({
                 x: X(rect.x),
                 y: Y(rect.y),
                 w: +(fit ? image.naturalWidth * fit : rect.width).toFixed(2),
@@ -79,7 +113,7 @@ export function displayList(page, pageNumber) {
             });
             continue;
         }
-        if (tag === 'line' || tag === 'rect') {
+        if (tag === 'line' || tag === 'rect' || tag === 'ellipse' || tag === 'circle') {
             const svg = el.ownerSVGElement;
             if (!svg)
                 continue;
@@ -98,7 +132,7 @@ export function displayList(page, pageNumber) {
                         return 0;
                     return raw.trim().endsWith('%') ? (span * value) / 100 : value;
                 };
-                lines.push({
+                drawn.push({
                     x1: X(svgRect.x + at('x1', svgRect.width)),
                     y1: Y(svgRect.y + at('y1', svgRect.height)),
                     x2: X(svgRect.x + at('x2', svgRect.width)),
@@ -108,22 +142,26 @@ export function displayList(page, pageNumber) {
                 });
             }
             else {
-                // pdf.js writes every rectangle a fill, and the browser drops one that is
-                // no color: a gradient or a pattern. What is left computes to black.
+                // pdf.js writes every shape a fill, and the browser drops one that is no
+                // color: a gradient or a pattern. What is left computes to black.
                 if (!el.style.fill && !el.hasAttribute('fill'))
                     refuse('background_image');
-                // A rectangle whose edge is hidden has a stroke of no width.
+                // A shape whose edge is hidden has a stroke of no width.
                 const fill = style.fill !== 'none' && opaque(style.fill) ? rgb(style.fill) : null;
                 if (!edge && !fill)
                     continue;
-                // SVG centers a stroke on the rectangle's edge, and a box's border is
+                // SVG centers a stroke on the shape's edge, and a box's border is
                 // drawn inside it, so the box is half a stroke larger all round. What
                 // that adds to the fill lies under the stroke.
                 const half = (edge?.width ?? 0) / 2;
                 const r = el.getBoundingClientRect();
-                // The browser draws a rect square when its rx is below zero.
-                const radius = parseFloat(style.rx);
-                boxes.push({
+                // The browser paints no shape of no width or height, whatever its stroke.
+                if (!r.width || !r.height)
+                    continue;
+                // The browser draws a rect square when its rx is below zero. An ellipse
+                // is a rect whose corners meet.
+                const radius = tag === 'rect' ? parseFloat(style.rx) : Math.max(r.width, r.height) / 2;
+                drawn.push({
                     x: X(r.x - half),
                     y: Y(r.y - half),
                     w: +(r.width + 2 * half).toFixed(2),
@@ -152,7 +190,7 @@ export function displayList(page, pageNumber) {
             if (type === 'checkbox' || type === 'radio') {
                 const painted = square(rect);
                 const hair = { width: 1, colour: [0, 0, 0] };
-                boxes.push({
+                drawn.push({
                     x: X(painted.left),
                     y: Y(painted.top),
                     w: +painted.width.toFixed(2),
@@ -188,7 +226,7 @@ export function displayList(page, pageNumber) {
             edges.push(edges.shift());
         const fill = opaque(style.backgroundColor) ? rgb(style.backgroundColor) : null;
         if (fill || edges.some(Boolean))
-            boxes.push({
+            drawn.push({
                 x: X(rect.x),
                 y: Y(rect.y),
                 w: +rect.width.toFixed(2),
@@ -197,8 +235,7 @@ export function displayList(page, pageNumber) {
                 edges
             });
     }
-    collectText(layer, X, Y, runs, turns);
-    return { boxes, pictures, lines, runs, width: page.width, height: page.height };
+    return { drawn, width: page.width, height: page.height };
 }
 /**
  * How many quarter turns counter-clockwise a transform is, and 0 for any
@@ -215,7 +252,7 @@ function quarterTurns(transform) {
  * True for a transform a run's box cannot carry. XFA offsets caption
  * wrappers with a translation, which the rects already hold. A positive
  * horizontal scale is carried too: `getClientRects` reports the scaled width and
- * `drawRuns` puts it back as `Tz`, which is how LiveCycle's
+ * `drawRun` puts it back as `Tz`, which is how LiveCycle's
  * `xfa-font-horizontal-scale` reaches the page. A rotation, a skew, a mirror or
  * a vertical scale changes glyph shape or height, and a run carries neither. A
  * quarter turn is read apart, by `quarterTurns`.
@@ -231,7 +268,7 @@ export function unrepresentable(transform) {
 }
 /** SVG shapes pdf.js can emit that the primitives above have no form for. */
 function svgOnly(tag) {
-    return ['path', 'polygon', 'polyline', 'circle', 'ellipse', 'image', 'use', 'text'].includes(tag);
+    return ['path', 'polygon', 'polyline', 'image', 'use', 'text'].includes(tag);
 }
 /**
  * One run per visual line, with the box the browser measured it into. Splitting
@@ -239,101 +276,97 @@ function svgOnly(tag) {
  * its own baseline. A tab ends a run too and is in none: the text after it
  * starts a run at the box the layout moved it to.
  */
-function collectText(layer, X, Y, runs, turns) {
-    const owner = layer.ownerDocument;
-    const view = owner.defaultView;
+function collectText(node, X, Y, drawn, turns) {
+    const text = node.nodeValue;
+    const parent = node.parentElement;
+    if (!text || !text.trim() || !parent)
+        return;
+    // A <select> is de-chromed above; only the option the form shows is drawn.
+    if (parent.tagName === 'OPTION' && !parent.selected)
+        return;
+    const owner = node.ownerDocument;
+    const style = owner.defaultView.getComputedStyle(parent);
+    if (style.visibility === 'hidden' || style.display === 'none')
+        return;
     const measure = owner.createElement('canvas').getContext('2d');
-    const walker = owner.createTreeWalker(layer, NodeFilter.SHOW_TEXT);
     const range = owner.createRange();
-    for (let node = walker.nextNode(); node; node = walker.nextNode()) {
-        const text = node.nodeValue;
-        const parent = node.parentElement;
-        if (!text || !text.trim() || !parent)
-            continue;
-        // A <select> is de-chromed above; only the option the form shows is drawn.
-        if (parent.tagName === 'OPTION' && !parent.selected)
+    const size = parseFloat(style.fontSize);
+    measure.font = `${style.fontStyle} ${style.fontWeight} ${size}px ${style.fontFamily}`;
+    const descent = measure.measureText('Hg').fontBoundingBoxDescent ?? size * 0.21;
+    const common = {
+        size: +size.toFixed(2),
+        family: style.fontFamily,
+        bold: parseInt(style.fontWeight, 10) >= 600 || style.fontWeight === 'bold',
+        italic: style.fontStyle === 'italic' || style.fontStyle === 'oblique',
+        colour: rgb(style.color),
+        letterSpacing: parseFloat(style.letterSpacing) || 0
+    };
+    // Under a turn each rect is read in the frame the text is upright in, and
+    // the start of each line's baseline is turned back to the page.
+    const turn = turns.get(parent);
+    const [cos, sin] = [
+        [1, 0],
+        [0, -1],
+        [-1, 0],
+        [0, 1]
+    ][turn];
+    const upright = ({ left, right, top, bottom }) => {
+        const [x1, x2] = [cos * left + sin * top, cos * right + sin * bottom];
+        const [y1, y2] = [cos * top - sin * left, cos * bottom - sin * right];
+        return {
+            x: Math.min(x1, x2),
+            right: Math.max(x1, x2),
+            top: Math.min(y1, y2),
+            bottom: Math.max(y1, y2)
+        };
+    };
+    let start = 0;
+    let top = null;
+    let box = null;
+    const flush = (end) => {
+        const slice = text.slice(start, end);
+        if (end <= start || !box || !slice.trim())
+            return;
+        const base = box.bottom - descent;
+        drawn.push({
+            text: slice,
+            x: X(cos * box.x - sin * base),
+            baseline: Y(sin * box.x + cos * base),
+            width: +(box.right - box.x).toFixed(2),
+            turn: turn || undefined,
+            ...common
+        });
+    };
+    for (let i = 0; i < text.length; i++) {
+        if (text[i] === '\t') {
+            flush(i);
+            start = i + 1;
+            top = null;
+            box = null;
             continue;
-        const style = view.getComputedStyle(parent);
-        if (style.visibility === 'hidden' || style.display === 'none')
+        }
+        range.setStart(node, i);
+        range.setEnd(node, i + 1);
+        const rect = range.getClientRects()[0];
+        if (!rect)
             continue;
-        const size = parseFloat(style.fontSize);
-        measure.font = `${style.fontStyle} ${style.fontWeight} ${size}px ${style.fontFamily}`;
-        const descent = measure.measureText('Hg').fontBoundingBoxDescent ?? size * 0.21;
-        const common = {
-            size: +size.toFixed(2),
-            family: style.fontFamily,
-            bold: parseInt(style.fontWeight, 10) >= 600 || style.fontWeight === 'bold',
-            italic: style.fontStyle === 'italic' || style.fontStyle === 'oblique',
-            colour: rgb(style.color),
-            letterSpacing: parseFloat(style.letterSpacing) || 0
-        };
-        // Under a turn each rect is read in the frame the text is upright in, and
-        // the start of each line's baseline is turned back to the page.
-        const turn = turns.get(parent);
-        const [cos, sin] = [
-            [1, 0],
-            [0, -1],
-            [-1, 0],
-            [0, 1]
-        ][turn];
-        const upright = ({ left, right, top, bottom }) => {
-            const [x1, x2] = [cos * left + sin * top, cos * right + sin * bottom];
-            const [y1, y2] = [cos * top - sin * left, cos * bottom - sin * right];
-            return {
-                x: Math.min(x1, x2),
-                right: Math.max(x1, x2),
-                top: Math.min(y1, y2),
-                bottom: Math.max(y1, y2)
-            };
-        };
-        let start = 0;
-        let top = null;
-        let box = null;
-        const flush = (end) => {
-            const slice = text.slice(start, end);
-            if (end <= start || !box || !slice.trim())
-                return;
-            const base = box.bottom - descent;
-            runs.push({
-                text: slice,
-                x: X(cos * box.x - sin * base),
-                baseline: Y(sin * box.x + cos * base),
-                width: +(box.right - box.x).toFixed(2),
-                turn: turn || undefined,
-                ...common
-            });
-        };
-        for (let i = 0; i < text.length; i++) {
-            if (text[i] === '\t') {
-                flush(i);
-                start = i + 1;
-                top = null;
-                box = null;
-                continue;
-            }
-            range.setStart(node, i);
-            range.setEnd(node, i + 1);
-            const rect = range.getClientRects()[0];
-            if (!rect)
-                continue;
-            const glyph = upright(rect);
-            if (top === null || Math.abs(glyph.top - top) < 0.6) {
-                top ??= glyph.top;
-                box = box
-                    ? {
-                        x: Math.min(box.x, glyph.x),
-                        bottom: Math.max(box.bottom, glyph.bottom),
-                        right: Math.max(box.right, glyph.right)
-                    }
-                    : { x: glyph.x, bottom: glyph.bottom, right: glyph.right };
-            }
-            else {
-                flush(i);
-                start = i;
-                top = glyph.top;
-                box = { x: glyph.x, bottom: glyph.bottom, right: glyph.right };
-            }
+        const glyph = upright(rect);
+        if (top === null || Math.abs(glyph.top - top) < 0.6) {
+            top ??= glyph.top;
+            box = box
+                ? {
+                    x: Math.min(box.x, glyph.x),
+                    bottom: Math.max(box.bottom, glyph.bottom),
+                    right: Math.max(box.right, glyph.right)
+                }
+                : { x: glyph.x, bottom: glyph.bottom, right: glyph.right };
+        }
+        else {
+            flush(i);
+            start = i;
+            top = glyph.top;
+            box = { x: glyph.x, bottom: glyph.bottom, right: glyph.right };
         }
-        flush(text.length);
     }
+    flush(text.length);
 }

package/dist/index.d.ts

@@ -3,4 +3,4 @@ export { quillify, type Quillified } from './quillify.js';
 export { sanitize, type Sanitized } from './sanitize.js';
 export type { Field, FieldNaming, Form, Naming, Place, Problem, Size } from './api.js';
 export type { Refusal } from './refusal.js';
-export type { Rect } from './types.js';
+export { limits, type Rect } from './types.js';

package/dist/index.js

@@ -1,3 +1,4 @@
 export { check, suggest } from './naming.js';
 export { quillify } from './quillify.js';
 export { sanitize } from './sanitize.js';
+export { limits } from './types.js';

package/dist/inventory.js

@@ -2,7 +2,7 @@ import { PDFArray, PDFDict, PDFDocument, PDFHexString, PDFName, PDFString, pdfDo
 import { toTopLeftRect } from './coords.js';
 import { openPdf } from './pdfjs.js';
 import { Refused } from './refusal.js';
-import { MAX_PAGES, MAX_WIDGETS, WIDGET_KINDS } from './types.js';
+import { MAX_PAGES, MAX_SIDE, MAX_WIDGETS, WIDGET_KINDS } from './types.js';
 /** pdf.js passes on whatever name a file gives `/FT`. */
 const isWidgetKind = (type) => WIDGET_KINDS.includes(type);
 export async function inventoryPdf(bytes, signal) {
@@ -49,7 +49,11 @@ export async function inventoryPdf(bytes, signal) {
                 throw new Refused({ code: 'rotated', page: index });
             const view = page.view;
             views.push({ ref: page.ref, box: view });
-            dims.push({ width: view[2] - view[0], height: view[3] - view[1] });
+            const size = { width: view[2] - view[0], height: view[3] - view[1] };
+            if (page.userUnit !== 1 ||
+                Math.max(size.width, size.height, ...view.map(Math.abs)) > MAX_SIDE)
+                throw new Refused({ code: 'damaged' });
+            dims.push(size);
             const annotations = (await within(page.getAnnotations()));
             for (const a of annotations) {
                 // A push button runs an action; it holds no value, so it is no field.

package/dist/normalize.js

@@ -27,8 +27,7 @@
  * is ended at the write that passes it, and then in what qpdf wrote, on the
  * page's thread and before any other reader opens it.
  */
-import { ParseSpeeds, PDFArray, PDFDocument, PDFName, PDFRawStream } from 'pdf-lib';
-import { openPdf } from './pdfjs.js';
+import { ParseSpeeds, PDFArray, PDFBool, PDFDict, PDFDocument, PDFInvalidObject, PDFName, PDFNumber, PDFRawStream, PDFStream } from 'pdf-lib';
 import { Refused } from './refusal.js';
 import { MAX_BYTES, MAX_INFLATED_BYTES } from './types.js';
 // Held in a constant so that Vite copies the worker byte for byte. Written
@@ -52,14 +51,141 @@ const TYPED = new RegExp(`/(?:${spelled('ObjStm')}|${spelled('XRef')})`);
  * 1 MB handed over whole.
  */
 const SLICE = 1024;
-/** What qpdf leaves a stream under, alone or after one Flate layer. Each gives pixels, which are not counted. */
+/** What qpdf leaves a stream under, alone or after one Flate layer. Each gives pixels. */
 const CODECS = ['DCTDecode', 'JPXDecode', 'CCITTFaxDecode', 'JBIG2Decode'];
+/** The components of a pixel in a color space that is this name or an array that begins with it. */
+const COMPONENTS = new Map([
+    ['DeviceGray', 1],
+    ['CalGray', 1],
+    ['Indexed', 1],
+    ['Separation', 1],
+    ['DeviceRGB', 3],
+    ['CalRGB', 3],
+    ['Lab', 3],
+    ['DeviceCMYK', 4]
+]);
 /**
- * The size of the file qpdf wrote and of what its Flate streams decode to,
- * added up no further than the bound. pdf-lib lists the streams and the
- * browser inflates each, keeping nothing. A stream the browser's decoder
- * rejects, or one under a filter qpdf has not taken off, is a stream two
- * readers can read two ways, and the file is refused as `damaged`.
+ * The bytes an image's pixels come to as its dictionary declares them: rows
+ * of whole bytes, at its bits to a component and the components of its color
+ * space, or at a bit to the pixel for a mask. A halftone's threshold array
+ * says a width and a height too, and neither bits nor a color space: a stream
+ * with a `/HalftoneType` and neither comes to two bytes to the pixel, the most
+ * such an array holds. A stream with no `/Width` and no `/Height` is no image
+ * and comes to none. One with either whose dictionary does not say what it
+ * comes to, in a component or more of a bit or more and in a number short of
+ * infinity, is refused as `damaged`.
+ *
+ * JPEG 2000 data says its own color space and bits, so an image under
+ * `JPXDecode` may leave either out, and counts at four components for the
+ * one and eight bits for the other, what a painter makes of a pixel. A
+ * CCITT decoder goes by the `/Columns` and `/Rows` of its `/DecodeParms`,
+ * so each counts where it is written and more than the image's own.
+ * `chain` is the stream's filters.
+ */
+function declared(dict, chain) {
+    if (!dict.has(PDFName.of('Width')) && !dict.has(PDFName.of('Height')))
+        return 0;
+    const number = (from, key) => {
+        const value = from.lookup(PDFName.of(key));
+        return value instanceof PDFNumber ? value.asNumber() : NaN;
+    };
+    const codec = chain.at(-1);
+    const jpx = codec === 'JPXDecode';
+    const parms = codec === 'CCITTFaxDecode' && dict.lookup(PDFName.of('DecodeParms'));
+    const fax = parms instanceof PDFArray ? parms.lookup(chain.length - 1) : parms;
+    const side = (key, said) => {
+        const own = number(dict, key);
+        const more = fax instanceof PDFDict ? number(fax, said) : NaN;
+        return more > own ? more : own;
+    };
+    const mask = dict.lookup(PDFName.of('ImageMask')) === PDFBool.True;
+    const space = dict.lookup(PDFName.of('ColorSpace'));
+    const threshold = dict.has(PDFName.of('HalftoneType')) && !space && !dict.has(PDFName.of('BitsPerComponent'));
+    const [family, part] = space instanceof PDFArray ? [space.lookup(0), space.lookup(1)] : [space];
+    const name = family instanceof PDFName ? family.decodeText() : '';
+    const components = mask || threshold
+        ? 1
+        : name === 'ICCBased' && part instanceof PDFStream
+            ? number(part.dict, 'N')
+            : name === 'DeviceN' && part instanceof PDFArray
+                ? part.size()
+                : jpx && !space
+                    ? 4
+                    : (COMPONENTS.get(name) ?? NaN);
+    const bits = mask
+        ? 1
+        : threshold
+            ? 16
+            : jpx && !dict.has(PDFName.of('BitsPerComponent'))
+                ? 8
+                : number(dict, 'BitsPerComponent');
+    const bytes = Math.ceil((side('Width', 'Columns') * components * bits) / 8) * side('Height', 'Rows');
+    if (!(components >= 1 && bits >= 1 && bytes >= 0 && bytes < Infinity))
+        throw new Refused({ code: 'damaged' });
+    return bytes;
+}
+/**
+ * The bytes an image's pixels come to as its codec's own header says them,
+ * which is what a decoder that goes by the stream makes: the first frame
+ * header of a JPEG, or the SIZ segment of a JPEG 2000 codestream, bare or in
+ * the `jp2c` box of a JP2 file. None under any other codec, and none where the
+ * header is not there or is cut short, which is where the view throws.
+ */
+function headed(codec, data) {
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    const bytes = (width, height, components, bits) => Math.ceil((width * components * bits) / 8) * height;
+    try {
+        if (codec === 'DCTDecode') {
+            // From the first start of an image, where a reader that looks for one begins.
+            let at = 0;
+            while (view.getUint16(at) !== 0xffd8)
+                at += 1;
+            // As libjpeg finds a marker: past a byte that is none, a fill byte and a marker of no length.
+            for (at += 2;;) {
+                const marker = view.getUint8(at) === 0xff ? view.getUint8(at + 1) : 0xff;
+                if (marker === 0xff)
+                    at += 1;
+                else if (marker >> 4 === 0xc && ![0xc4, 0xc8, 0xcc].includes(marker))
+                    // A height of 0 is left to a DNL marker after the scan, which can say 65,535.
+                    return bytes(view.getUint16(at + 7), view.getUint16(at + 5) || 0xffff, view.getUint8(at + 9), view.getUint8(at + 4));
+                else
+                    at += marker <= 1 || (marker >= 0xd0 && marker <= 0xd9) ? 2 : 2 + view.getUint16(at + 2);
+            }
+        }
+        if (codec === 'JPXDecode') {
+            let at = 0;
+            // A JP2 file is boxes: a length and a type, or a 1, a type and a length of eight bytes.
+            if (view.getUint32(4) === 0x6a502020) {
+                const wide = () => view.getUint32(at) === 1;
+                while (view.getUint32(at + 4) !== 0x6a703263)
+                    at += (wide() ? Number(view.getBigUint64(at + 8)) : view.getUint32(at)) || Infinity;
+                at += wide() ? 16 : 8;
+            }
+            // The image is its grid less where it starts in it, at the most bits any component says.
+            if (view.getUint32(at) === 0xff4fff51) {
+                const components = view.getUint16(at + 40);
+                let bits = 0;
+                for (let each = 0; each < components; each++)
+                    bits = Math.max(bits, (view.getUint8(at + 42 + 3 * each) & 127) + 1);
+                return bytes(view.getUint32(at + 8) - view.getUint32(at + 16), view.getUint32(at + 12) - view.getUint32(at + 20), components, bits);
+            }
+        }
+    }
+    catch {
+        // No header to go by.
+    }
+    return 0;
+}
+/**
+ * The size of the file qpdf wrote and of what its streams decode to, added up
+ * no further than the bound. pdf-lib lists the streams and the browser
+ * inflates each Flate one, keeping only what lies under a JPEG or JPEG 2000
+ * codec. An image comes to the most of what its dictionary declares, what
+ * its codec's own header says and what its Flate layer gives. An object
+ * pdf-lib cannot read, as a number of 400 digits, is one it would not count.
+ * Such an object, a stream the browser's decoder rejects, or one under a
+ * filter qpdf has not taken off, is one two readers can read two ways, and
+ * the file is refused as `damaged`.
  */
 async function inflated(pdf) {
     let total = pdf.byteLength;
@@ -72,6 +198,8 @@ async function inflated(pdf) {
         parseSpeed: ParseSpeeds.Fastest
     });
     for (const [, object] of context.enumerateIndirectObjects()) {
+        if (object instanceof PDFInvalidObject)
+            throw new Refused({ code: 'damaged' });
         if (!(object instanceof PDFRawStream))
             continue;
         const { dict, contents } = object;
@@ -85,10 +213,16 @@ async function inflated(pdf) {
         const rest = chain.slice(flate ? 1 : 0);
         if (rest.length > 1 || rest.some((name) => !CODECS.includes(name)))
             throw new Refused({ code: 'damaged' });
+        const before = total;
+        const said = declared(dict, chain);
         // An empty stream is one to every reader, and to the decoder a stream cut short.
-        if (!flate || !contents.length)
+        if (!flate || !contents.length) {
+            total += Math.max(said, headed(rest[0], contents));
             continue;
+        }
         let at = 0;
+        const keep = rest[0] === 'DCTDecode' || rest[0] === 'JPXDecode';
+        const under = [];
         const reader = new ReadableStream({
             pull(controller) {
                 if (at < contents.length)
@@ -104,6 +238,8 @@ async function inflated(pdf) {
                 total += read.value.byteLength;
                 if (total > MAX_INFLATED_BYTES)
                     return total;
+                if (keep)
+                    under.push(read.value);
             }
         }
         catch {
@@ -112,6 +248,8 @@ async function inflated(pdf) {
         finally {
             void reader.cancel().catch(() => { });
         }
+        const own = keep ? headed(rest[0], new Uint8Array(await new Blob(under).arrayBuffer())) : 0;
+        total = Math.max(total, before + Math.max(said, own));
     }
     return total;
 }
@@ -145,15 +283,21 @@ export async function normalizePdf(bytes, signal) {
     });
     if (!answer.loaded)
         throw new Error(`qpdf.wasm did not load from ${WASM}`);
-    const { out, size } = answer;
+    const { out, size, said } = answer;
     // A file that came to more than the bound in qpdf is past it, whatever qpdf then wrote.
     const total = size > MAX_INFLATED_BYTES ? size : out?.byteLength ? await inflated(out) : 0;
     if (total > MAX_INFLATED_BYTES)
         throw new Refused({ code: 'too_large', bytes: total, limit: MAX_INFLATED_BYTES });
     if (out?.byteLength)
         return out;
-    // qpdf gives its reason on stderr alone. A file pdf.js cannot open is refused
-    // there, under its own code. One it opens is a file only qpdf rejects.
-    await (await openPdf(bytes, {}, signal)).close();
-    throw new Refused({ code: 'damaged' });
+    // A qpdf that ends by itself ends at its first error, and its last line says
+    // when that is the password or the encryption. No other reader opens the
+    // file, which the bound does not hold: a PDF has its header in its first
+    // 1,024 bytes.
+    if (/invalid password\n$/.test(said))
+        throw new Refused({ code: 'password' });
+    if (/encryption.*\n$/.test(said))
+        throw new Refused({ code: 'encryption' });
+    const head = new TextDecoder('latin1').decode(bytes.subarray(0, 1024));
+    throw new Refused({ code: head.includes('%PDF-') ? 'damaged' : 'not_pdf' });
 }

package/dist/pdfjs.js

@@ -2,8 +2,9 @@ import { Refused } from './refusal.js';
 // Held in a constant so that Vite copies the worker byte for byte. Written
 // inside `new Worker(...)`, the URL makes it bundle the file again.
 const WORKER = new URL('../assets/pdf.worker.js', import.meta.url);
-// The faces pdf.js lays a dynamic form's Arial, Helvetica, Myriad Pro, Calibri
-// and Segoe UI out in, each named so that a bundler copies it.
+// The faces pdf.js lays a dynamic form's Arial, Helvetica, Myriad Pro and
+// Calibri out in, and any face the form's font list lacks, each named so that
+// a bundler copies it.
 const FACES = {
     'LiberationSans-Regular.ttf': new URL('../assets/LiberationSans-Regular.ttf', import.meta.url),
     'LiberationSans-Bold.ttf': new URL('../assets/LiberationSans-Bold.ttf', import.meta.url),

package/dist/strip.d.ts

@@ -67,11 +67,16 @@ export declare const PICK: Record<string, [key: string, kinds: Record<string, st
  * and an object reference whose `/Obj` is not such a link is taken out of its
  * element's `/K`.
  *
- * An object that reads as an annotation or as a page, and is neither a page of
- * `views` nor a link that stays, is deleted outright before the walk. No widget
- * and no page outside the page tree is then in the file, whatever names one, a
- * dictionary by name included, and the fields and appearance streams that hung
- * off it are out of the walk's reach: a background that still carries a form
- * layer is one the renderer would stamp a second one over.
+ * An object that says `/Type /Annot`, `/Subtype /Widget` or `/Type /Page`, and
+ * is neither a page of `views` nor a link that stays, has no kind. A file in
+ * which a key reaches one as a kind is refused as `damaged`, the catalog itself
+ * included, and so is a file whose catalog or page tree pdf-lib cannot read. A
+ * marked-content property list may say `/Type /Page`, and a `/Rect` says
+ * nothing: a kept object loses the keys its row does not list. So no object of
+ * a background is a widget or a page outside the page tree, and the fields and
+ * appearance streams that hung off one are out of the walk's reach: a
+ * background that still carries a form layer is one the renderer would stamp a
+ * second one over. A dictionary written in place is not an object: one by name
+ * keeps the plain values a file writes in it, a widget's among them.
  */
 export declare function stripAcroForm(bytes: Uint8Array, views: View[]): Promise<Uint8Array>;

package/dist/strip.js

@@ -31,7 +31,7 @@ export const KINDS = {
     catalog: 'Type Pages:tree OCProperties:layers StructTreeRoot:tags MarkInfo:marks Lang',
     tree: 'Type Parent:^tree Kids:[node] Count Resources:resources Rotate',
     page: 'Type Parent:^tree Resources:resources MediaBox Contents:[content] Rotate Group:group ' +
-        'UserUnit StructParents Tabs Annots:[link]',
+        'StructParents Tabs Annots:[link]',
     link: 'Type Subtype Rect Border BS:border C H QuadPoints F OC:oc Contents StructParent A:action ' +
         'Dest:dest',
     border: 'Type W S D',
@@ -239,22 +239,23 @@ const PICKS = new Map(Object.entries(PICK).map(([kind, [key, kinds, other]]) =>
  * and an object reference whose `/Obj` is not such a link is taken out of its
  * element's `/K`.
  *
- * An object that reads as an annotation or as a page, and is neither a page of
- * `views` nor a link that stays, is deleted outright before the walk. No widget
- * and no page outside the page tree is then in the file, whatever names one, a
- * dictionary by name included, and the fields and appearance streams that hung
- * off it are out of the walk's reach: a background that still carries a form
- * layer is one the renderer would stamp a second one over.
+ * An object that says `/Type /Annot`, `/Subtype /Widget` or `/Type /Page`, and
+ * is neither a page of `views` nor a link that stays, has no kind. A file in
+ * which a key reaches one as a kind is refused as `damaged`, the catalog itself
+ * included, and so is a file whose catalog or page tree pdf-lib cannot read. A
+ * marked-content property list may say `/Type /Page`, and a `/Rect` says
+ * nothing: a kept object loses the keys its row does not list. So no object of
+ * a background is a widget or a page outside the page tree, and the fields and
+ * appearance streams that hung off one are out of the walk's reach: a
+ * background that still carries a form layer is one the renderer would stamp a
+ * second one over. A dictionary written in place is not an object: one by name
+ * keeps the plain values a file writes in it, a widget's among them.
  */
 export async function stripAcroForm(bytes, views) {
     const doc = await PDFDocument.load(bytes, { updateMetadata: false });
     const { context } = doc;
     const at = (object, key) => object instanceof PDFDict ? object.lookup(PDFName.of(key)) : undefined;
     const is = (object, key, name) => at(object, key) === PDFName.of(name);
-    /** An annotation need not say it is one: a `/Rect` or a `/Subtype /Widget` is enough. */
-    const annotation = (object) => is(object, 'Type', 'Annot') ||
-        at(object, 'Rect') !== undefined ||
-        is(object, 'Subtype', 'Widget');
     /** The action a link that stays keeps, `null` when it holds its destination itself, `false` when it goes. */
     const leads = (link) => {
         if (!link.has(PDFName.of('A')))
@@ -274,7 +275,14 @@ export async function stripAcroForm(bytes, views) {
             : '';
         return /^https?:\/\//i.test(head) && action.clone();
     };
-    const pages = doc.getPages();
+    // pdf-lib throws at a catalog or a page tree it does not read as one.
+    let pages;
+    try {
+        pages = doc.getPages();
+    }
+    catch {
+        throw new Refused({ code: 'damaged' });
+    }
     const differs = pages.some(({ ref }, index) => {
         const viewed = views[index]?.ref;
         return viewed?.num !== ref.objectNumber || viewed.gen !== ref.generationNumber;
@@ -307,9 +315,6 @@ export async function stripAcroForm(bytes, views) {
     }
     context.trailerInfo.Info = undefined;
     context.trailerInfo.ID = undefined;
-    for (const [ref, object] of context.enumerateIndirectObjects())
-        if (!kept.has(ref) && !linked.has(ref) && (is(object, 'Type', 'Page') || annotation(object)))
-            context.delete(ref);
     const claimed = new Map();
     const pending = [];
     const whole = [];
@@ -353,11 +358,19 @@ export async function stripAcroForm(bytes, views) {
      * Gives an object its kind and queues it, where this reach of it is as a kind.
      * An object that has one is reached as that kind and no other, or the file is
      * refused as `damaged`: the walk cuts it to the keys of the first, and a second
-     * would read what is left. Whether this reach of it stays.
+     * would read what is left. So is a file that reaches as a kind an object that
+     * says it is an annotation or a page, and is neither a page of `views` nor a
+     * link that stays. Whether this reach of it stays.
      */
     const claim = (raw, value, as) => {
         const had = claimed.get(raw);
-        if (had && had !== as)
+        const posed = raw instanceof PDFRef &&
+            !kept.has(raw) &&
+            !linked.has(raw) &&
+            (is(value, 'Type', 'Annot') ||
+                is(value, 'Subtype', 'Widget') ||
+                (as !== slot('marked') && is(value, 'Type', 'Page')));
+        if ((had && had !== as) || (as && posed))
             throw new Refused({ code: 'damaged' });
         if (had || !as)
             return as !== undefined;
@@ -438,10 +451,6 @@ export async function stripAcroForm(bytes, views) {
             }
         }
     }
-    // A page tree node that reads as an annotation is deleted above, and the page
-    // tree holds the pages under it no more.
-    if (pages.some(({ ref }) => claimed.get(ref) !== slot('page')))
-        throw new Refused({ code: 'damaged' });
     // A back reference stays when the walk reached what it names as its kind.
     // Where the slot takes many, a value that leads nowhere stays too, and an
     // array is read part by part, and so is each array in it. An array is read

package/dist/types.d.ts

@@ -88,14 +88,29 @@ export type QuillTree = Map<string, Uint8Array>;
 export declare const MAX_BYTES: number;
 /**
  * The most a file may come to once qpdf has it: the file qpdf writes together
- * with what its Flate streams decode to, and qpdf's own memory. Of 1,423
- * published files the largest comes to 15,046,490 bytes (DAF 57), and qpdf's
- * memory is 17,235,968 bytes after each.
+ * with what its Flate streams decode to and what its images declare, and
+ * qpdf's own memory. Of 1,423 published files the largest comes to
+ * 48,477,587 bytes (AF 4101), and qpdf's memory is 17,235,968 bytes after
+ * each. Their largest image is 6,026 by 4,523 pixels at a bit each, 3,410,342
+ * bytes (AF 1520), and the one that declares the most bytes is 2,322 by 2,916
+ * at three bytes each, 20,312,856 (AF 4101).
  */
 export declare const MAX_INFLATED_BYTES: number;
 /** The most pages and fields a form has and is taken. The engine takes at most 1,000 fields in a block. */
 export declare const MAX_PAGES = 25;
 export declare const MAX_WIDGETS = 1000;
+/** The limits a consumer prints before a read. A refusal's own `limit` is the one to print after it: `too_large` carries `MAX_INFLATED_BYTES` for the decoded bound. */
+export declare const limits: Readonly<{
+    bytes: number;
+    pages: number;
+    fields: number;
+}>;
+/**
+ * The longest side a page has and is taken, in points, and the farthest its
+ * box reaches from the origin: the PDF specification's limit for a side (ISO
+ * 32000-1, Annex C). Of 2,127 published pages the longest is 3,456 (AFMC 1656).
+ */
+export declare const MAX_SIDE = 14400;
 /**
  * The most pixels the pictures of a dynamic form come to, each use counted.
  * At four bytes a pixel that is 32 MB on a canvas, and as much in the

package/dist/types.js

@@ -5,14 +5,29 @@ export const SNAKE_CASE = /^[a-z][a-z0-9_]*$/;
 export const MAX_BYTES = 8 * 1024 * 1024;
 /**
  * The most a file may come to once qpdf has it: the file qpdf writes together
- * with what its Flate streams decode to, and qpdf's own memory. Of 1,423
- * published files the largest comes to 15,046,490 bytes (DAF 57), and qpdf's
- * memory is 17,235,968 bytes after each.
+ * with what its Flate streams decode to and what its images declare, and
+ * qpdf's own memory. Of 1,423 published files the largest comes to
+ * 48,477,587 bytes (AF 4101), and qpdf's memory is 17,235,968 bytes after
+ * each. Their largest image is 6,026 by 4,523 pixels at a bit each, 3,410,342
+ * bytes (AF 1520), and the one that declares the most bytes is 2,322 by 2,916
+ * at three bytes each, 20,312,856 (AF 4101).
  */
 export const MAX_INFLATED_BYTES = 64 * 1024 * 1024;
 /** The most pages and fields a form has and is taken. The engine takes at most 1,000 fields in a block. */
 export const MAX_PAGES = 25;
 export const MAX_WIDGETS = 1000;
+/** The limits a consumer prints before a read. A refusal's own `limit` is the one to print after it: `too_large` carries `MAX_INFLATED_BYTES` for the decoded bound. */
+export const limits = Object.freeze({
+    bytes: MAX_BYTES,
+    pages: MAX_PAGES,
+    fields: MAX_WIDGETS
+});
+/**
+ * The longest side a page has and is taken, in points, and the farthest its
+ * box reaches from the origin: the PDF specification's limit for a side (ISO
+ * 32000-1, Annex C). Of 2,127 published pages the longest is 3,456 (AFMC 1656).
+ */
+export const MAX_SIDE = 14_400;
 /**
  * The most pixels the pictures of a dynamic form come to, each use counted.
  * At four bytes a pixel that is 32 MB on a canvas, and as much in the

package/dist/xfa-layer.d.ts

@@ -19,10 +19,10 @@ export interface XfaPage {
  * can zoom the frame, which the frame undoes, or `lay` throws.
  *
  * The frame runs no script, and its policy lets its document load only an
- * image from `blob:` or `data:`, which is how pdf.js hands it a form's images
- * and the stylesheet its field background. A face of the form is not the
- * document's to load: pdf.js makes it in the host page's realm, from the
- * file's bytes, a `local()` name or a face the package ships.
+ * image from `blob:`, which is how pdf.js hands it a form's images, or from
+ * `data:`. A face of the form is not the document's to load: pdf.js makes it
+ * in the host page's realm, from the file's bytes, a `local()` name or a face
+ * the package ships.
  */
 export declare class XfaStage {
     #private;

package/dist/xfa-layer.js

@@ -21,10 +21,10 @@ const SHELL = `<meta http-equiv="Content-Security-Policy" content="default-src '
  * can zoom the frame, which the frame undoes, or `lay` throws.
  *
  * The frame runs no script, and its policy lets its document load only an
- * image from `blob:` or `data:`, which is how pdf.js hands it a form's images
- * and the stylesheet its field background. A face of the form is not the
- * document's to load: pdf.js makes it in the host page's realm, from the
- * file's bytes, a `local()` name or a face the package ships.
+ * image from `blob:`, which is how pdf.js hands it a form's images, or from
+ * `data:`. A face of the form is not the document's to load: pdf.js makes it
+ * in the host page's realm, from the file's bytes, a `local()` name or a face
+ * the package ships.
  */
 export class XfaStage {
     #frame = document.createElement('iframe');
@@ -61,6 +61,10 @@ export class XfaStage {
             const view = frameDocument.defaultView;
             const sheet = new view.CSSStyleSheet();
             sheet.replaceSync(css);
+            // pdf.js's sheet gives a field out of focus a background from a data: URL,
+            // which nothing here reads and a host's policy may refuse, a logged error
+            // for each field.
+            sheet.insertRule(':root { --xfa-unfocused-field-background: none; }', sheet.cssRules.length);
             frameDocument.adoptedStyleSheets = [sheet];
             // A sheet that did not apply leaves every field at its content size,
             // and the rects read off it are wrong with no error.

package/dist/xfa-widgets.js

@@ -68,6 +68,9 @@ export function harvestWidgets(page, pageNumber) {
         const y = +(rect.top - origin.top).toFixed(2);
         const w = +rect.width.toFixed(2);
         const h = +rect.height.toFixed(2);
+        // pdf.js gives a control the place its layout comes to, on the page or not.
+        if (x >= page.width || y >= page.height || x + w <= 0 || y + h <= 0)
+            throw new Refused({ code: 'layout', detail: 'a field is off its page' });
         const tooltip = tooltipOf(el);
         const options = tag === 'select'
             ? [...el.options]

package/dist/xfa.js

@@ -44,8 +44,9 @@ export async function xfaToAcroForm(bytes, signal) {
             for (const span of laid.layer.querySelectorAll('.xfaPageCount'))
                 span.textContent = String(pdf.numPages);
             const list = displayList(laid, number);
-            for (const { image } of list.pictures)
-                pixels += image.naturalWidth * image.naturalHeight;
+            for (const item of list.drawn)
+                if ('image' in item)
+                    pixels += item.image.naturalWidth * item.image.naturalHeight;
             if (pixels > MAX_PICTURE_PIXELS)
                 throw new Refused({
                     code: 'unpaintable',
@@ -73,7 +74,36 @@ export async function xfaToAcroForm(bytes, signal) {
 /** PDF's origin is bottom-left; every primitive arrives top-left. */
 async function paint(page, pageNumber, list, font) {
     const H = list.height;
-    for (let box of list.boxes) {
+    for (const item of list.drawn) {
+        if ('text' in item) {
+            await drawRun(page, pageNumber, item, H, font);
+            continue;
+        }
+        if ('image' in item) {
+            const { x, y, w, h, image } = item;
+            // The pixels are read off a canvas of the host page's. The frame's policy
+            // governs what its document loads, and the picture is of the page's origin.
+            const canvas = document.createElement('canvas');
+            canvas.width = image.naturalWidth;
+            canvas.height = image.naturalHeight;
+            canvas.getContext('2d').drawImage(image, 0, 0);
+            const png = canvas.toDataURL('image/png');
+            // What a canvas with a side the browser will not make gives.
+            if (png === 'data:,')
+                throw new Refused({ code: 'unpaintable', page: pageNumber - 1, construct: 'image' });
+            page.drawImage(await page.doc.embedPng(png), { x, y: H - y - h, width: w, height: h });
+            continue;
+        }
+        if ('x1' in item) {
+            page.drawLine({
+                start: { x: item.x1, y: H - item.y1 },
+                end: { x: item.x2, y: H - item.y2 },
+                thickness: item.width,
+                color: rgb(...item.colour)
+            });
+            continue;
+        }
+        let box = item;
         if (box.radius) {
             // An SVG rect's outline runs along the middle of its stroke, and each
             // radius stops at half the side it lies along.
@@ -125,27 +155,6 @@ async function paint(page, pageNumber, list, font) {
         if (right)
             seg(box.x + box.w - right.width / 2, box.y, box.x + box.w - right.width / 2, box.y + box.h, right);
     }
-    for (const { x, y, w, h, image } of list.pictures) {
-        // The pixels are read off a canvas of the host page's. The frame's policy
-        // governs what its document loads, and the picture is of the page's origin.
-        const canvas = document.createElement('canvas');
-        canvas.width = image.naturalWidth;
-        canvas.height = image.naturalHeight;
-        canvas.getContext('2d').drawImage(image, 0, 0);
-        const png = canvas.toDataURL('image/png');
-        // What a canvas with a side the browser will not make gives.
-        if (png === 'data:,')
-            throw new Refused({ code: 'unpaintable', page: pageNumber - 1, construct: 'image' });
-        page.drawImage(await page.doc.embedPng(png), { x, y: H - y - h, width: w, height: h });
-    }
-    for (const line of list.lines)
-        page.drawLine({
-            start: { x: line.x1, y: H - line.y1 },
-            end: { x: line.x2, y: H - line.y2 },
-            thickness: line.width,
-            color: rgb(...line.colour)
-        });
-    return drawRuns(page, pageNumber, list.runs, H, font);
 }
 /**
  * The dash and the gap the browser paints along a dashed edge, or nothing for
@@ -168,53 +177,70 @@ function dashes(width, length) {
     const [wide, narrow] = [fit(count), fit(count + 1)];
     return [dash, narrow <= 0 || Math.abs(wide - gap) < Math.abs(narrow - gap) ? wide : narrow];
 }
-async function drawRuns(page, pageNumber, runs, H, get) {
-    for (const run of runs) {
-        const font = await get(standard14(run));
-        // The standard-14 fonts encode WinAnsi alone. Dropping the run would lose a
-        // line of the form without anything reporting it.
-        const encodable = font.getCharacterSet();
-        if ([...run.text].some((char) => !encodable.includes(char.codePointAt(0))))
+/** The standard fonts that hold what the text fonts lack, in the order a character is looked for. */
+const SYMBOLS = [StandardFonts.Symbol, StandardFonts.ZapfDingbats];
+async function drawRun(page, pageNumber, run, H, get) {
+    const font = await get(standard14(run));
+    // The standard-14 text fonts encode WinAnsi alone. U+2010 and U+2011 are
+    // drawn as its hyphen, and any other character outside it in the first of
+    // SYMBOLS that holds it. A soft hyphen is left out: WinAnsi has it as a
+    // hyphen, and the browser lays it out at no width and shows nothing.
+    // Dropping the run would lose a line of the form without anything
+    // reporting it.
+    // pdf-lib kerns the width it measures and writes no kerning, so the width
+    // it draws a run at is the sum of the widths of its characters.
+    const parts = [];
+    let natural = 0;
+    for (const char of run.text.replaceAll('\u00ad', '').replace(/[\u2010\u2011]/g, '-')) {
+        const code = char.codePointAt(0);
+        let face = font;
+        for (const name of SYMBOLS)
+            if (!face.getCharacterSet().includes(code))
+                face = await get(name);
+        if (!face.getCharacterSet().includes(code))
             throw new Refused({
                 code: 'unpaintable',
                 page: pageNumber - 1,
                 construct: 'glyph',
                 detail: run.text.slice(0, 40)
             });
-        // The standard-14 substitute's advances differ from the embedded face's.
-        // Letter spacing goes in first, since it is a real property of the run;
-        // horizontal scaling then pins the whole run to the width the browser
-        // measured, so the error stays inside the run instead of drifting across
-        // the line.
-        // pdf-lib kerns the width it measures and writes no kerning, so the width
-        // it draws a run at is the sum of the widths of its characters.
-        let natural = 0;
-        for (const char of run.text)
-            natural += font.widthOfTextAtSize(char, run.size);
-        const spaced = natural + run.letterSpacing * Math.max(0, run.text.length - 1);
-        const scale = spaced > 0 && run.width > 0 ? Math.max(50, Math.min(200, (100 * run.width) / spaced)) : 100;
-        const scaled = Math.abs(scale - 100) > 3;
-        // Both are text-state parameters, so they persist across drawText's own
-        // BT/ET and have to be put back.
-        if (run.letterSpacing)
-            page.pushOperators(PDFOperator.of(PDFOperatorNames.SetCharacterSpacing, [
-                String(+run.letterSpacing.toFixed(4))
-            ]));
-        if (scaled)
-            page.pushOperators(PDFOperator.of(PDFOperatorNames.SetTextHorizontalScaling, [String(+scale.toFixed(3))]));
-        page.drawText(run.text, {
-            x: run.x,
-            y: H - run.baseline,
+        const last = parts.at(-1);
+        if (last?.font === face)
+            last.text += char;
+        else
+            parts.push({ font: face, text: char, at: natural });
+        natural += face.widthOfTextAtSize(char, run.size) + run.letterSpacing;
+    }
+    // The standard-14 substitute's advances differ from the embedded face's.
+    // Letter spacing goes in first, since it is a real property of the run;
+    // horizontal scaling then pins the whole run to the width the browser
+    // measured, so the error stays inside the run instead of drifting across
+    // the line.
+    const spaced = natural - run.letterSpacing;
+    const scale = spaced > 0 && run.width > 0 ? Math.max(50, Math.min(200, (100 * run.width) / spaced)) : 100;
+    const scaled = Math.abs(scale - 100) > 3;
+    // Both are text-state parameters, so they persist across drawText's own
+    // BT/ET and have to be put back.
+    if (run.letterSpacing)
+        page.pushOperators(PDFOperator.of(PDFOperatorNames.SetCharacterSpacing, [String(+run.letterSpacing.toFixed(4))]));
+    if (scaled)
+        page.pushOperators(PDFOperator.of(PDFOperatorNames.SetTextHorizontalScaling, [String(+scale.toFixed(3))]));
+    const angle = (Math.PI / 2) * (run.turn ?? 0);
+    for (const part of parts) {
+        const along = scaled ? (part.at * scale) / 100 : part.at;
+        page.drawText(part.text, {
+            x: run.x + along * Math.cos(angle),
+            y: H - run.baseline + along * Math.sin(angle),
             size: run.size,
-            font,
+            font: part.font,
             color: rgb(...run.colour),
             rotate: degrees(90 * (run.turn ?? 0))
         });
-        if (scaled)
-            page.pushOperators(PDFOperator.of(PDFOperatorNames.SetTextHorizontalScaling, ['100']));
-        if (run.letterSpacing)
-            page.pushOperators(PDFOperator.of(PDFOperatorNames.SetCharacterSpacing, ['0']));
     }
+    if (scaled)
+        page.pushOperators(PDFOperator.of(PDFOperatorNames.SetTextHorizontalScaling, ['100']));
+    if (run.letterSpacing)
+        page.pushOperators(PDFOperator.of(PDFOperatorNames.SetCharacterSpacing, ['0']));
 }
 function standard14(run) {
     const family = run.family.toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@quillmark/quillify",
-	"version": "0.3.0",
+	"version": "0.3.1",
 	"description": "Turn a published PDF form (AcroForm or XFA) into a Quillmark quill, in the browser.",
 	"type": "module",
 	"license": "Apache-2.0",
@@ -51,6 +51,7 @@
 		"@quillmark/wasm": "0.124.0",
 		"@types/node": "24.19.0",
 		"@vitest/browser-playwright": "5.0.2",
+		"fast-check": "4.10.2",
 		"playwright": "1.63.0",
 		"prettier": "3.9.9",
 		"typescript": "6.0.3",