@quillmark/quillify 0.3.0 → 0.4.0

package/dist/normalize.js

@@ -27,8 +27,7 @@
  * is ended at the write that passes it, and then in what qpdf wrote, on the
  * page's thread and before any other reader opens it.
  */
-import { ParseSpeeds, PDFArray, PDFDocument, PDFName, PDFRawStream } from 'pdf-lib';
-import { openPdf } from './pdfjs.js';
+import { ParseSpeeds, PDFArray, PDFBool, PDFDict, PDFDocument, PDFInvalidObject, PDFName, PDFNumber, PDFRawStream, PDFStream } from 'pdf-lib';
 import { Refused } from './refusal.js';
 import { MAX_BYTES, MAX_INFLATED_BYTES } from './types.js';
 // Held in a constant so that Vite copies the worker byte for byte. Written
@@ -52,14 +51,141 @@ const TYPED = new RegExp(`/(?:${spelled('ObjStm')}|${spelled('XRef')})`);
  * 1 MB handed over whole.
  */
 const SLICE = 1024;
-/** What qpdf leaves a stream under, alone or after one Flate layer. Each gives pixels, which are not counted. */
+/** What qpdf leaves a stream under, alone or after one Flate layer. Each gives pixels. */
 const CODECS = ['DCTDecode', 'JPXDecode', 'CCITTFaxDecode', 'JBIG2Decode'];
+/** The components of a pixel in a color space that is this name or an array that begins with it. */
+const COMPONENTS = new Map([
+    ['DeviceGray', 1],
+    ['CalGray', 1],
+    ['Indexed', 1],
+    ['Separation', 1],
+    ['DeviceRGB', 3],
+    ['CalRGB', 3],
+    ['Lab', 3],
+    ['DeviceCMYK', 4]
+]);
 /**
- * The size of the file qpdf wrote and of what its Flate streams decode to,
- * added up no further than the bound. pdf-lib lists the streams and the
- * browser inflates each, keeping nothing. A stream the browser's decoder
- * rejects, or one under a filter qpdf has not taken off, is a stream two
- * readers can read two ways, and the file is refused as `damaged`.
+ * The bytes an image's pixels come to as its dictionary declares them: rows
+ * of whole bytes, at its bits to a component and the components of its color
+ * space, or at a bit to the pixel for a mask. A halftone's threshold array
+ * says a width and a height too, and neither bits nor a color space: a stream
+ * with a `/HalftoneType` and neither comes to two bytes to the pixel, the most
+ * such an array holds. A stream with no `/Width` and no `/Height` is no image
+ * and comes to none. One with either whose dictionary does not say what it
+ * comes to, in a component or more of a bit or more and in a number short of
+ * infinity, is refused as `damaged`.
+ *
+ * JPEG 2000 data says its own color space and bits, so an image under
+ * `JPXDecode` may leave either out, and counts at four components for the
+ * one and eight bits for the other, what a painter makes of a pixel. A
+ * CCITT decoder goes by the `/Columns` and `/Rows` of its `/DecodeParms`,
+ * so each counts where it is written and more than the image's own.
+ * `chain` is the stream's filters.
+ */
+function declared(dict, chain) {
+    if (!dict.has(PDFName.of('Width')) && !dict.has(PDFName.of('Height')))
+        return 0;
+    const number = (from, key) => {
+        const value = from.lookup(PDFName.of(key));
+        return value instanceof PDFNumber ? value.asNumber() : NaN;
+    };
+    const codec = chain.at(-1);
+    const jpx = codec === 'JPXDecode';
+    const parms = codec === 'CCITTFaxDecode' && dict.lookup(PDFName.of('DecodeParms'));
+    const fax = parms instanceof PDFArray ? parms.lookup(chain.length - 1) : parms;
+    const side = (key, said) => {
+        const own = number(dict, key);
+        const more = fax instanceof PDFDict ? number(fax, said) : NaN;
+        return more > own ? more : own;
+    };
+    const mask = dict.lookup(PDFName.of('ImageMask')) === PDFBool.True;
+    const space = dict.lookup(PDFName.of('ColorSpace'));
+    const threshold = dict.has(PDFName.of('HalftoneType')) && !space && !dict.has(PDFName.of('BitsPerComponent'));
+    const [family, part] = space instanceof PDFArray ? [space.lookup(0), space.lookup(1)] : [space];
+    const name = family instanceof PDFName ? family.decodeText() : '';
+    const components = mask || threshold
+        ? 1
+        : name === 'ICCBased' && part instanceof PDFStream
+            ? number(part.dict, 'N')
+            : name === 'DeviceN' && part instanceof PDFArray
+                ? part.size()
+                : jpx && !space
+                    ? 4
+                    : (COMPONENTS.get(name) ?? NaN);
+    const bits = mask
+        ? 1
+        : threshold
+            ? 16
+            : jpx && !dict.has(PDFName.of('BitsPerComponent'))
+                ? 8
+                : number(dict, 'BitsPerComponent');
+    const bytes = Math.ceil((side('Width', 'Columns') * components * bits) / 8) * side('Height', 'Rows');
+    if (!(components >= 1 && bits >= 1 && bytes >= 0 && bytes < Infinity))
+        throw new Refused({ code: 'damaged' });
+    return bytes;
+}
+/**
+ * The bytes an image's pixels come to as its codec's own header says them,
+ * which is what a decoder that goes by the stream makes: the first frame
+ * header of a JPEG, or the SIZ segment of a JPEG 2000 codestream, bare or in
+ * the `jp2c` box of a JP2 file. None under any other codec, and none where the
+ * header is not there or is cut short, which is where the view throws.
+ */
+function headed(codec, data) {
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    const bytes = (width, height, components, bits) => Math.ceil((width * components * bits) / 8) * height;
+    try {
+        if (codec === 'DCTDecode') {
+            // From the first start of an image, where a reader that looks for one begins.
+            let at = 0;
+            while (view.getUint16(at) !== 0xffd8)
+                at += 1;
+            // As libjpeg finds a marker: past a byte that is none, a fill byte and a marker of no length.
+            for (at += 2;;) {
+                const marker = view.getUint8(at) === 0xff ? view.getUint8(at + 1) : 0xff;
+                if (marker === 0xff)
+                    at += 1;
+                else if (marker >> 4 === 0xc && ![0xc4, 0xc8, 0xcc].includes(marker))
+                    // A height of 0 is left to a DNL marker after the scan, which can say 65,535.
+                    return bytes(view.getUint16(at + 7), view.getUint16(at + 5) || 0xffff, view.getUint8(at + 9), view.getUint8(at + 4));
+                else
+                    at += marker <= 1 || (marker >= 0xd0 && marker <= 0xd9) ? 2 : 2 + view.getUint16(at + 2);
+            }
+        }
+        if (codec === 'JPXDecode') {
+            let at = 0;
+            // A JP2 file is boxes: a length and a type, or a 1, a type and a length of eight bytes.
+            if (view.getUint32(4) === 0x6a502020) {
+                const wide = () => view.getUint32(at) === 1;
+                while (view.getUint32(at + 4) !== 0x6a703263)
+                    at += (wide() ? Number(view.getBigUint64(at + 8)) : view.getUint32(at)) || Infinity;
+                at += wide() ? 16 : 8;
+            }
+            // The image is its grid less where it starts in it, at the most bits any component says.
+            if (view.getUint32(at) === 0xff4fff51) {
+                const components = view.getUint16(at + 40);
+                let bits = 0;
+                for (let each = 0; each < components; each++)
+                    bits = Math.max(bits, (view.getUint8(at + 42 + 3 * each) & 127) + 1);
+                return bytes(view.getUint32(at + 8) - view.getUint32(at + 16), view.getUint32(at + 12) - view.getUint32(at + 20), components, bits);
+            }
+        }
+    }
+    catch {
+        // No header to go by.
+    }
+    return 0;
+}
+/**
+ * The size of the file qpdf wrote and of what its streams decode to, added up
+ * no further than the bound. pdf-lib lists the streams and the browser
+ * inflates each Flate one, keeping only what lies under a JPEG or JPEG 2000
+ * codec. An image comes to the most of what its dictionary declares, what
+ * its codec's own header says and what its Flate layer gives. An object
+ * pdf-lib cannot read, as a number of 400 digits, is one it would not count.
+ * Such an object, a stream the browser's decoder rejects, or one under a
+ * filter qpdf has not taken off, is one two readers can read two ways, and
+ * the file is refused as `damaged`.
  */
 async function inflated(pdf) {
     let total = pdf.byteLength;
@@ -72,6 +198,8 @@ async function inflated(pdf) {
         parseSpeed: ParseSpeeds.Fastest
     });
     for (const [, object] of context.enumerateIndirectObjects()) {
+        if (object instanceof PDFInvalidObject)
+            throw new Refused({ code: 'damaged' });
         if (!(object instanceof PDFRawStream))
             continue;
         const { dict, contents } = object;
@@ -85,10 +213,16 @@ async function inflated(pdf) {
         const rest = chain.slice(flate ? 1 : 0);
         if (rest.length > 1 || rest.some((name) => !CODECS.includes(name)))
             throw new Refused({ code: 'damaged' });
+        const before = total;
+        const said = declared(dict, chain);
         // An empty stream is one to every reader, and to the decoder a stream cut short.
-        if (!flate || !contents.length)
+        if (!flate || !contents.length) {
+            total += Math.max(said, headed(rest[0], contents));
             continue;
+        }
         let at = 0;
+        const keep = rest[0] === 'DCTDecode' || rest[0] === 'JPXDecode';
+        const under = [];
         const reader = new ReadableStream({
             pull(controller) {
                 if (at < contents.length)
@@ -104,6 +238,8 @@ async function inflated(pdf) {
                 total += read.value.byteLength;
                 if (total > MAX_INFLATED_BYTES)
                     return total;
+                if (keep)
+                    under.push(read.value);
             }
         }
         catch {
@@ -112,6 +248,8 @@ async function inflated(pdf) {
         finally {
             void reader.cancel().catch(() => { });
         }
+        const own = keep ? headed(rest[0], new Uint8Array(await new Blob(under).arrayBuffer())) : 0;
+        total = Math.max(total, before + Math.max(said, own));
     }
     return total;
 }
@@ -145,15 +283,21 @@ export async function normalizePdf(bytes, signal) {
     });
     if (!answer.loaded)
         throw new Error(`qpdf.wasm did not load from ${WASM}`);
-    const { out, size } = answer;
+    const { out, size, said } = answer;
     // A file that came to more than the bound in qpdf is past it, whatever qpdf then wrote.
     const total = size > MAX_INFLATED_BYTES ? size : out?.byteLength ? await inflated(out) : 0;
     if (total > MAX_INFLATED_BYTES)
         throw new Refused({ code: 'too_large', bytes: total, limit: MAX_INFLATED_BYTES });
     if (out?.byteLength)
         return out;
-    // qpdf gives its reason on stderr alone. A file pdf.js cannot open is refused
-    // there, under its own code. One it opens is a file only qpdf rejects.
-    await (await openPdf(bytes, {}, signal)).close();
-    throw new Refused({ code: 'damaged' });
+    // A qpdf that ends by itself ends at its first error, and its last line says
+    // when that is the password or the encryption. No other reader opens the
+    // file, which the bound does not hold: a PDF has its header in its first
+    // 1,024 bytes.
+    if (/invalid password\n$/.test(said))
+        throw new Refused({ code: 'password' });
+    if (/encryption.*\n$/.test(said))
+        throw new Refused({ code: 'encryption' });
+    const head = new TextDecoder('latin1').decode(bytes.subarray(0, 1024));
+    throw new Refused({ code: head.includes('%PDF-') ? 'damaged' : 'not_pdf' });
 }

package/dist/pdfjs.js

@@ -2,8 +2,9 @@ import { Refused } from './refusal.js';
 // Held in a constant so that Vite copies the worker byte for byte. Written
 // inside `new Worker(...)`, the URL makes it bundle the file again.
 const WORKER = new URL('../assets/pdf.worker.js', import.meta.url);
-// The faces pdf.js lays a dynamic form's Arial, Helvetica, Myriad Pro, Calibri
-// and Segoe UI out in, each named so that a bundler copies it.
+// The faces pdf.js lays a dynamic form's Arial, Helvetica, Myriad Pro and
+// Calibri out in, and any face the form's font list lacks, each named so that
+// a bundler copies it.
 const FACES = {
     'LiberationSans-Regular.ttf': new URL('../assets/LiberationSans-Regular.ttf', import.meta.url),
     'LiberationSans-Bold.ttf': new URL('../assets/LiberationSans-Bold.ttf', import.meta.url),

package/dist/quillify.js

@@ -50,12 +50,12 @@ export async function quillify(form, naming) {
             return {
                 widget: entry.id,
                 name: entry.name,
+                ...(entry.title === undefined ? {} : { title: entry.title }),
                 description: entry.description,
                 ...typed(field, entry.text),
                 ...(example === undefined ? {} : { example }),
                 keep: entry.keep && !field.readOnly,
-                required: field.required,
-                ...(field.kind === 'radio' ? { group: field.group } : {})
+                required: field.required
             };
         })
     }, {

package/dist/strip.d.ts

@@ -67,11 +67,16 @@ export declare const PICK: Record<string, [key: string, kinds: Record<string, st
  * and an object reference whose `/Obj` is not such a link is taken out of its
  * element's `/K`.
  *
- * An object that reads as an annotation or as a page, and is neither a page of
- * `views` nor a link that stays, is deleted outright before the walk. No widget
- * and no page outside the page tree is then in the file, whatever names one, a
- * dictionary by name included, and the fields and appearance streams that hung
- * off it are out of the walk's reach: a background that still carries a form
- * layer is one the renderer would stamp a second one over.
+ * An object that says `/Type /Annot`, `/Subtype /Widget` or `/Type /Page`, and
+ * is neither a page of `views` nor a link that stays, has no kind. A file in
+ * which a key reaches one as a kind is refused as `damaged`, the catalog itself
+ * included, and so is a file whose catalog or page tree pdf-lib cannot read. A
+ * marked-content property list may say `/Type /Page`, and a `/Rect` says
+ * nothing: a kept object loses the keys its row does not list. So no object of
+ * a background is a widget or a page outside the page tree, and the fields and
+ * appearance streams that hung off one are out of the walk's reach: a
+ * background that still carries a form layer is one the renderer would stamp a
+ * second one over. A dictionary written in place is not an object: one by name
+ * keeps the plain values a file writes in it, a widget's among them.
  */
 export declare function stripAcroForm(bytes: Uint8Array, views: View[]): Promise<Uint8Array>;

package/dist/strip.js

@@ -31,7 +31,7 @@ export const KINDS = {
     catalog: 'Type Pages:tree OCProperties:layers StructTreeRoot:tags MarkInfo:marks Lang',
     tree: 'Type Parent:^tree Kids:[node] Count Resources:resources Rotate',
     page: 'Type Parent:^tree Resources:resources MediaBox Contents:[content] Rotate Group:group ' +
-        'UserUnit StructParents Tabs Annots:[link]',
+        'StructParents Tabs Annots:[link]',
     link: 'Type Subtype Rect Border BS:border C H QuadPoints F OC:oc Contents StructParent A:action ' +
         'Dest:dest',
     border: 'Type W S D',
@@ -239,22 +239,23 @@ const PICKS = new Map(Object.entries(PICK).map(([kind, [key, kinds, other]]) =>
  * and an object reference whose `/Obj` is not such a link is taken out of its
  * element's `/K`.
  *
- * An object that reads as an annotation or as a page, and is neither a page of
- * `views` nor a link that stays, is deleted outright before the walk. No widget
- * and no page outside the page tree is then in the file, whatever names one, a
- * dictionary by name included, and the fields and appearance streams that hung
- * off it are out of the walk's reach: a background that still carries a form
- * layer is one the renderer would stamp a second one over.
+ * An object that says `/Type /Annot`, `/Subtype /Widget` or `/Type /Page`, and
+ * is neither a page of `views` nor a link that stays, has no kind. A file in
+ * which a key reaches one as a kind is refused as `damaged`, the catalog itself
+ * included, and so is a file whose catalog or page tree pdf-lib cannot read. A
+ * marked-content property list may say `/Type /Page`, and a `/Rect` says
+ * nothing: a kept object loses the keys its row does not list. So no object of
+ * a background is a widget or a page outside the page tree, and the fields and
+ * appearance streams that hung off one are out of the walk's reach: a
+ * background that still carries a form layer is one the renderer would stamp a
+ * second one over. A dictionary written in place is not an object: one by name
+ * keeps the plain values a file writes in it, a widget's among them.
  */
 export async function stripAcroForm(bytes, views) {
     const doc = await PDFDocument.load(bytes, { updateMetadata: false });
     const { context } = doc;
     const at = (object, key) => object instanceof PDFDict ? object.lookup(PDFName.of(key)) : undefined;
     const is = (object, key, name) => at(object, key) === PDFName.of(name);
-    /** An annotation need not say it is one: a `/Rect` or a `/Subtype /Widget` is enough. */
-    const annotation = (object) => is(object, 'Type', 'Annot') ||
-        at(object, 'Rect') !== undefined ||
-        is(object, 'Subtype', 'Widget');
     /** The action a link that stays keeps, `null` when it holds its destination itself, `false` when it goes. */
     const leads = (link) => {
         if (!link.has(PDFName.of('A')))
@@ -274,7 +275,14 @@ export async function stripAcroForm(bytes, views) {
             : '';
         return /^https?:\/\//i.test(head) && action.clone();
     };
-    const pages = doc.getPages();
+    // pdf-lib throws at a catalog or a page tree it does not read as one.
+    let pages;
+    try {
+        pages = doc.getPages();
+    }
+    catch {
+        throw new Refused({ code: 'damaged' });
+    }
     const differs = pages.some(({ ref }, index) => {
         const viewed = views[index]?.ref;
         return viewed?.num !== ref.objectNumber || viewed.gen !== ref.generationNumber;
@@ -307,9 +315,6 @@ export async function stripAcroForm(bytes, views) {
     }
     context.trailerInfo.Info = undefined;
     context.trailerInfo.ID = undefined;
-    for (const [ref, object] of context.enumerateIndirectObjects())
-        if (!kept.has(ref) && !linked.has(ref) && (is(object, 'Type', 'Page') || annotation(object)))
-            context.delete(ref);
     const claimed = new Map();
     const pending = [];
     const whole = [];
@@ -353,11 +358,19 @@ export async function stripAcroForm(bytes, views) {
      * Gives an object its kind and queues it, where this reach of it is as a kind.
      * An object that has one is reached as that kind and no other, or the file is
      * refused as `damaged`: the walk cuts it to the keys of the first, and a second
-     * would read what is left. Whether this reach of it stays.
+     * would read what is left. So is a file that reaches as a kind an object that
+     * says it is an annotation or a page, and is neither a page of `views` nor a
+     * link that stays. Whether this reach of it stays.
      */
     const claim = (raw, value, as) => {
         const had = claimed.get(raw);
-        if (had && had !== as)
+        const posed = raw instanceof PDFRef &&
+            !kept.has(raw) &&
+            !linked.has(raw) &&
+            (is(value, 'Type', 'Annot') ||
+                is(value, 'Subtype', 'Widget') ||
+                (as !== slot('marked') && is(value, 'Type', 'Page')));
+        if ((had && had !== as) || (as && posed))
             throw new Refused({ code: 'damaged' });
         if (had || !as)
             return as !== undefined;
@@ -438,10 +451,6 @@ export async function stripAcroForm(bytes, views) {
             }
         }
     }
-    // A page tree node that reads as an annotation is deleted above, and the page
-    // tree holds the pages under it no more.
-    if (pages.some(({ ref }) => claimed.get(ref) !== slot('page')))
-        throw new Refused({ code: 'damaged' });
     // A back reference stays when the walk reached what it names as its kind.
     // Where the slot takes many, a value that leads nowhere stays too, and an
     // array is read part by part, and so is each array in it. An array is read

package/dist/types.d.ts

@@ -62,6 +62,7 @@ export interface QualifiedField {
     /** snake_case schema field name */
     name: string;
     label: string;
+    title?: string;
     description: string;
     type: FieldType;
     multiline: boolean;
@@ -70,8 +71,6 @@ export interface QualifiedField {
     keep: boolean;
     /** `/Ff` bit 2: the form says this one has to be filled. */
     required: boolean;
-    /** The radio group this option belongs to, when it is one. */
-    group?: string;
 }
 export interface QualifiedForm {
     quill: {
@@ -82,20 +81,35 @@ export interface QualifiedForm {
     fields: QualifiedField[];
 }
 export declare const SNAKE_CASE: RegExp;
-/** A quill as files, the shape `Quill.fromTree` and a quiver both take. */
+/** A quill as files, the shape `Quill.fromTree` takes. */
 export type QuillTree = Map<string, Uint8Array>;
 /** The largest file `sanitize` opens. It bounds the compressed input. */
 export declare const MAX_BYTES: number;
 /**
  * The most a file may come to once qpdf has it: the file qpdf writes together
- * with what its Flate streams decode to, and qpdf's own memory. Of 1,423
- * published files the largest comes to 15,046,490 bytes (DAF 57), and qpdf's
- * memory is 17,235,968 bytes after each.
+ * with what its Flate streams decode to and what its images declare, and
+ * qpdf's own memory. Of 1,423 published files the largest comes to
+ * 48,477,587 bytes (AF 4101), and qpdf's memory is 17,235,968 bytes after
+ * each. Their largest image is 6,026 by 4,523 pixels at a bit each, 3,410,342
+ * bytes (AF 1520), and the one that declares the most bytes is 2,322 by 2,916
+ * at three bytes each, 20,312,856 (AF 4101).
  */
 export declare const MAX_INFLATED_BYTES: number;
 /** The most pages and fields a form has and is taken. The engine takes at most 1,000 fields in a block. */
 export declare const MAX_PAGES = 25;
 export declare const MAX_WIDGETS = 1000;
+/** The limits a consumer prints before a read. A refusal's own `limit` is the one to print after it: `too_large` carries `MAX_INFLATED_BYTES` for the decoded bound. */
+export declare const limits: Readonly<{
+    bytes: number;
+    pages: number;
+    fields: number;
+}>;
+/**
+ * The longest side a page has and is taken, in points, and the farthest its
+ * box reaches from the origin: the PDF specification's limit for a side (ISO
+ * 32000-1, Annex C). Of 2,127 published pages the longest is 3,456 (AFMC 1656).
+ */
+export declare const MAX_SIDE = 14400;
 /**
  * The most pixels the pictures of a dynamic form come to, each use counted.
  * At four bytes a pixel that is 32 MB on a canvas, and as much in the

package/dist/types.js

@@ -5,14 +5,29 @@ export const SNAKE_CASE = /^[a-z][a-z0-9_]*$/;
 export const MAX_BYTES = 8 * 1024 * 1024;
 /**
  * The most a file may come to once qpdf has it: the file qpdf writes together
- * with what its Flate streams decode to, and qpdf's own memory. Of 1,423
- * published files the largest comes to 15,046,490 bytes (DAF 57), and qpdf's
- * memory is 17,235,968 bytes after each.
+ * with what its Flate streams decode to and what its images declare, and
+ * qpdf's own memory. Of 1,423 published files the largest comes to
+ * 48,477,587 bytes (AF 4101), and qpdf's memory is 17,235,968 bytes after
+ * each. Their largest image is 6,026 by 4,523 pixels at a bit each, 3,410,342
+ * bytes (AF 1520), and the one that declares the most bytes is 2,322 by 2,916
+ * at three bytes each, 20,312,856 (AF 4101).
  */
 export const MAX_INFLATED_BYTES = 64 * 1024 * 1024;
 /** The most pages and fields a form has and is taken. The engine takes at most 1,000 fields in a block. */
 export const MAX_PAGES = 25;
 export const MAX_WIDGETS = 1000;
+/** The limits a consumer prints before a read. A refusal's own `limit` is the one to print after it: `too_large` carries `MAX_INFLATED_BYTES` for the decoded bound. */
+export const limits = Object.freeze({
+    bytes: MAX_BYTES,
+    pages: MAX_PAGES,
+    fields: MAX_WIDGETS
+});
+/**
+ * The longest side a page has and is taken, in points, and the farthest its
+ * box reaches from the origin: the PDF specification's limit for a side (ISO
+ * 32000-1, Annex C). Of 2,127 published pages the longest is 3,456 (AFMC 1656).
+ */
+export const MAX_SIDE = 14_400;
 /**
  * The most pixels the pictures of a dynamic form come to, each use counted.
  * At four bytes a pixel that is 32 MB on a canvas, and as much in the

package/dist/xfa-layer.d.ts

@@ -19,10 +19,10 @@ export interface XfaPage {
  * can zoom the frame, which the frame undoes, or `lay` throws.
  *
  * The frame runs no script, and its policy lets its document load only an
- * image from `blob:` or `data:`, which is how pdf.js hands it a form's images
- * and the stylesheet its field background. A face of the form is not the
- * document's to load: pdf.js makes it in the host page's realm, from the
- * file's bytes, a `local()` name or a face the package ships.
+ * image from `blob:`, which is how pdf.js hands it a form's images, or from
+ * `data:`. A face of the form is not the document's to load: pdf.js makes it
+ * in the host page's realm, from the file's bytes, a `local()` name or a face
+ * the package ships.
  */
 export declare class XfaStage {
     #private;

package/dist/xfa-layer.js

@@ -21,10 +21,10 @@ const SHELL = `<meta http-equiv="Content-Security-Policy" content="default-src '
  * can zoom the frame, which the frame undoes, or `lay` throws.
  *
  * The frame runs no script, and its policy lets its document load only an
- * image from `blob:` or `data:`, which is how pdf.js hands it a form's images
- * and the stylesheet its field background. A face of the form is not the
- * document's to load: pdf.js makes it in the host page's realm, from the
- * file's bytes, a `local()` name or a face the package ships.
+ * image from `blob:`, which is how pdf.js hands it a form's images, or from
+ * `data:`. A face of the form is not the document's to load: pdf.js makes it
+ * in the host page's realm, from the file's bytes, a `local()` name or a face
+ * the package ships.
  */
 export class XfaStage {
     #frame = document.createElement('iframe');
@@ -61,6 +61,10 @@ export class XfaStage {
             const view = frameDocument.defaultView;
             const sheet = new view.CSSStyleSheet();
             sheet.replaceSync(css);
+            // pdf.js's sheet gives a field out of focus a background from a data: URL,
+            // which nothing here reads and a host's policy may refuse, a logged error
+            // for each field.
+            sheet.insertRule(':root { --xfa-unfocused-field-background: none; }', sheet.cssRules.length);
             frameDocument.adoptedStyleSheets = [sheet];
             // A sheet that did not apply leaves every field at its content size,
             // and the rects read off it are wrong with no error.

package/dist/xfa-widgets.js

@@ -68,6 +68,9 @@ export function harvestWidgets(page, pageNumber) {
         const y = +(rect.top - origin.top).toFixed(2);
         const w = +rect.width.toFixed(2);
         const h = +rect.height.toFixed(2);
+        // pdf.js gives a control the place its layout comes to, on the page or not.
+        if (x >= page.width || y >= page.height || x + w <= 0 || y + h <= 0)
+            throw new Refused({ code: 'layout', detail: 'a field is off its page' });
         const tooltip = tooltipOf(el);
         const options = tag === 'select'
             ? [...el.options]