qpdf-compress 0.1.0

package/package.json

@@ -0,0 +1,91 @@
+{
+  "name": "qpdf-compress",
+  "version": "0.1.0",
+  "description": "Native PDF compression for Node.js, powered by QPDF",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "pdf",
+    "qpdf",
+    "native",
+    "compress",
+    "compression",
+    "optimize",
+    "node-addon",
+    "napi",
+    "pdf-compress",
+    "pdf-optimize",
+    "pdf-repair",
+    "pdf-processing",
+    "pdf-tools",
+    "stream-optimization",
+    "lossless",
+    "lossy"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "lib",
+    "scripts",
+    "binding.gyp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xonaman/nodejs-qpdf-compress.git"
+  },
+  "homepage": "https://github.com/xonaman/nodejs-qpdf-compress#readme",
+  "bugs": {
+    "url": "https://github.com/xonaman/nodejs-qpdf-compress/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64",
+    "arm"
+  ],
+  "scripts": {
+    "install": "node scripts/install.mjs",
+    "build": "node-gyp rebuild && node scripts/bundle-lib.mjs",
+    "build:ts": "tsc",
+    "prepublishOnly": "tsc",
+    "download": "node scripts/download-qpdf.mjs",
+    "test": "vitest run",
+    "lint": "eslint --fix .",
+    "lint:check": "eslint .",
+    "format": "prettier --write .",
+    "format:check": "prettier --check ."
+  },
+  "dependencies": {
+    "node-addon-api": "^8.0.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.5.0",
+    "eslint": "^10.1.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.5",
+    "node-gyp": "^11.0.0",
+    "prettier": "^3.8.1",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.57.2",
+    "vitest": "^4.1.2"
+  }
+}

package/scripts/bundle-lib.mjs

@@ -0,0 +1,35 @@
+import { existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+
+const root = join(import.meta.dirname, '..');
+const outDir = join(root, 'build', 'Release');
+const nodeFile = join(outDir, 'qpdf_compress.node');
+
+if (!existsSync(nodeFile)) {
+  console.error('qpdf_compress.node not found — run node-gyp rebuild first');
+  process.exit(1);
+}
+
+/** Strip debug symbols from a binary. */
+function strip(file) {
+  if (process.platform === 'darwin') {
+    // macOS strip can corrupt .node binaries — skip
+    console.log(`Skipping strip on macOS (known compatibility issue)`);
+    return;
+  }
+  if (process.platform === 'win32') {
+    // MSVC handles stripping via /LTCG and Release config
+    console.log('Skipping strip on Windows (handled by MSVC linker).');
+    return;
+  }
+  try {
+    execFileSync('strip', ['-s', file], { stdio: 'inherit' });
+    console.log(`Stripped ${file.split('/').pop()}`);
+  } catch {
+    console.warn(`strip failed for ${file.split('/').pop()} — continuing`);
+  }
+}
+
+strip(nodeFile);
+console.log('Bundle complete.');

package/scripts/download-qpdf.mjs

@@ -0,0 +1,205 @@
+import { execFileSync } from 'node:child_process';
+import { createWriteStream, mkdirSync, existsSync, rmSync, cpSync, readdirSync } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+import { join } from 'node:path';
+
+const QPDF_VERSION = '12.3.2';
+const BASE_URL = 'https://github.com/qpdf/qpdf/archive/refs/tags';
+
+const root = join(import.meta.dirname, '..');
+const depsDir = join(root, 'deps', 'qpdf');
+
+if (existsSync(join(depsDir, 'include', 'qpdf', 'QPDF.hh'))) {
+  console.log('QPDF already built, skipping.');
+  process.exit(0);
+}
+
+// validate version to prevent SSRF
+if (!/^\d+\.\d+\.\d+$/.test(QPDF_VERSION)) {
+  console.error(`Invalid QPDF version: ${QPDF_VERSION}`);
+  process.exit(1);
+}
+
+const url = `${BASE_URL}/v${QPDF_VERSION}.tar.gz`;
+const tarball = join(root, `qpdf-${QPDF_VERSION}.tar.gz`);
+const srcDir = join(root, `qpdf-${QPDF_VERSION}`);
+const buildDir = join(root, 'build-qpdf');
+
+// step 1: download
+console.log(`Downloading QPDF ${QPDF_VERSION}...`);
+console.log(`URL: ${url}`);
+
+const response = await fetch(url, { redirect: 'follow' });
+if (!response.ok) {
+  console.error(`Download failed: ${response.status} ${response.statusText}`);
+  process.exit(1);
+}
+
+mkdirSync(join(root, 'deps'), { recursive: true });
+await pipeline(Readable.fromWeb(response.body), createWriteStream(tarball));
+
+console.log('Extracting...');
+execFileSync('tar', ['-xzf', tarball, '-C', root], { stdio: 'inherit' });
+rmSync(tarball);
+
+// GitHub archive tarballs extract to `qpdf-{tag}` (without 'v' prefix)
+// but may also be `qpdf-qpdf-{ver}` depending on repo naming — find it
+if (!existsSync(srcDir)) {
+  // try common GitHub archive naming patterns
+  const candidates = readdirSync(root).filter(
+    (d) => d.startsWith('qpdf-') && !d.endsWith('.tar.gz'),
+  );
+  const match = candidates.find((d) => d.includes(QPDF_VERSION));
+  if (match) {
+    const { renameSync } = await import('node:fs');
+    renameSync(join(root, match), srcDir);
+    console.log(`Renamed ${match} → qpdf-${QPDF_VERSION}`);
+  } else {
+    console.error(
+      `Could not find extracted QPDF source directory. Found: ${candidates.join(', ')}`,
+    );
+    process.exit(1);
+  }
+}
+
+// step 2: build with CMake
+console.log('Building QPDF...');
+mkdirSync(buildDir, { recursive: true });
+
+const cmakeArgs = [
+  '-S',
+  srcDir,
+  '-B',
+  buildDir,
+  '-DCMAKE_BUILD_TYPE=Release',
+  '-DCMAKE_POSITION_INDEPENDENT_CODE=ON',
+  '-DBUILD_SHARED_LIBS=OFF',
+  '-DBUILD_STATIC_LIBS=ON',
+  '-DREQUIRE_CRYPTO_NATIVE=ON',
+  '-DUSE_IMPLICIT_CRYPTO=OFF',
+  '-DBUILD_DOC=OFF',
+  `-DCMAKE_INSTALL_PREFIX=${depsDir}`,
+];
+
+// force -fPIC for static library objects on Linux — CMAKE_POSITION_INDEPENDENT_CODE
+// alone is not always respected by QPDF's CMake targets
+if (process.platform === 'linux') {
+  cmakeArgs.push('-DCMAKE_C_FLAGS=-fPIC', '-DCMAKE_CXX_FLAGS=-fPIC');
+}
+
+// on macOS, help CMake find Homebrew libjpeg-turbo
+if (process.platform === 'darwin') {
+  const brewPrefixes = ['/opt/homebrew', '/usr/local'];
+  for (const prefix of brewPrefixes) {
+    const jpegDir = join(prefix, 'opt', 'jpeg-turbo');
+    if (existsSync(jpegDir)) {
+      cmakeArgs.push(`-DCMAKE_PREFIX_PATH=${jpegDir}`);
+      break;
+    }
+    const jpegDir2 = join(prefix, 'opt', 'jpeg');
+    if (existsSync(jpegDir2)) {
+      cmakeArgs.push(`-DCMAKE_PREFIX_PATH=${jpegDir2}`);
+      break;
+    }
+  }
+}
+
+// on Windows, use vcpkg for zlib and libjpeg-turbo
+if (process.platform === 'win32') {
+  const vcpkgRoot = process.env.VCPKG_ROOT || join(process.env.GITHUB_WORKSPACE || '', 'vcpkg');
+  if (existsSync(join(vcpkgRoot, 'scripts', 'buildsystems', 'vcpkg.cmake'))) {
+    const triplet = process.env.VCPKG_TARGET_TRIPLET || `${process.arch}-windows-static`;
+    cmakeArgs.push(
+      `-DCMAKE_TOOLCHAIN_FILE=${join(vcpkgRoot, 'scripts', 'buildsystems', 'vcpkg.cmake')}`,
+      `-DVCPKG_TARGET_TRIPLET=${triplet}`,
+    );
+  }
+  // force static CRT (/MT) to match node-gyp
+  cmakeArgs.push('-DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded');
+  // MSVC uses multi-config generator — specify release at build time instead
+  cmakeArgs.splice(cmakeArgs.indexOf('-DCMAKE_BUILD_TYPE=Release'), 1);
+}
+
+execFileSync('cmake', cmakeArgs, { stdio: 'inherit' });
+const buildArgs = ['--build', buildDir, '--parallel', '--target', 'libqpdf'];
+if (process.platform === 'win32') {
+  buildArgs.push('--config', 'Release');
+}
+execFileSync('cmake', buildArgs, { stdio: 'inherit' });
+
+// step 3: install headers and library
+console.log('Installing to deps/qpdf...');
+mkdirSync(join(depsDir, 'lib'), { recursive: true });
+mkdirSync(join(depsDir, 'include'), { recursive: true });
+
+// copy headers
+cpSync(join(srcDir, 'include', 'qpdf'), join(depsDir, 'include', 'qpdf'), { recursive: true });
+
+// also copy generated config header
+const generatedInclude = join(buildDir, 'include', 'qpdf');
+if (existsSync(generatedInclude)) {
+  cpSync(generatedInclude, join(depsDir, 'include', 'qpdf'), { recursive: true, force: true });
+}
+
+// copy static library
+const libqpdfDir = join(buildDir, 'libqpdf');
+const isLibFile = (f) =>
+  (f.endsWith('.a') || f.endsWith('.lib')) && (f.startsWith('libqpdf') || f.startsWith('qpdf'));
+const staticLibs = readdirSync(libqpdfDir).filter(isLibFile);
+
+if (staticLibs.length === 0) {
+  // try Release subdirectory (multi-config generators)
+  const releaseDir = join(libqpdfDir, 'Release');
+  if (existsSync(releaseDir)) {
+    const releaseLibs = readdirSync(releaseDir).filter(isLibFile);
+    for (const lib of releaseLibs) {
+      cpSync(join(releaseDir, lib), join(depsDir, 'lib', lib));
+      console.log(`Copied ${lib}`);
+    }
+  }
+} else {
+  for (const lib of staticLibs) {
+    cpSync(join(libqpdfDir, lib), join(depsDir, 'lib', lib));
+    console.log(`Copied ${lib}`);
+  }
+}
+
+// step 4: on Windows, copy vcpkg zlib/jpeg static libs and headers for binding.gyp
+if (process.platform === 'win32') {
+  const triplet = process.env.VCPKG_TARGET_TRIPLET || `${process.arch}-windows-static`;
+  const vcpkgRoot = process.env.VCPKG_ROOT || '';
+
+  // vcpkg packages may be in the CMake build dir or the global vcpkg root
+  const candidateLibDirs = [
+    join(buildDir, 'vcpkg_installed', triplet, 'lib'),
+    join(vcpkgRoot, 'installed', triplet, 'lib'),
+  ];
+  const candidateIncludeDirs = [
+    join(buildDir, 'vcpkg_installed', triplet, 'include'),
+    join(vcpkgRoot, 'installed', triplet, 'include'),
+  ];
+
+  const vcpkgLibDir = candidateLibDirs.find((d) => existsSync(d));
+  if (vcpkgLibDir) {
+    for (const lib of ['zlib.lib', 'jpeg.lib', 'turbojpeg.lib']) {
+      const src = join(vcpkgLibDir, lib);
+      if (existsSync(src)) {
+        cpSync(src, join(depsDir, 'lib', lib));
+        console.log(`Copied vcpkg ${lib}`);
+      }
+    }
+  }
+
+  const vcpkgIncludeDir = candidateIncludeDirs.find((d) => existsSync(d));
+  if (vcpkgIncludeDir) {
+    cpSync(vcpkgIncludeDir, join(depsDir, 'include'), { recursive: true, force: true });
+    console.log(`Copied vcpkg headers from ${vcpkgIncludeDir}`);
+  }
+}
+
+// step 5: clean up source and build dirs
+rmSync(srcDir, { recursive: true, force: true });
+rmSync(buildDir, { recursive: true, force: true });
+
+console.log(`QPDF ${QPDF_VERSION} installed to ${depsDir}`);

package/scripts/install.mjs

@@ -0,0 +1,112 @@
+/**
+ * Try to download a prebuilt binary from GitHub releases.
+ * Falls back to compiling from source if no prebuilt is available.
+ *
+ * Prebuilt tarball naming: qpdf-compress-v{version}-{platform}-{arch}.tar.gz
+ * Musl (Alpine) naming:    qpdf-compress-v{version}-linux-musl-{arch}.tar.gz
+ * Contents: build/Release/qpdf_compress.node
+ */
+import { existsSync, mkdirSync, createWriteStream, readFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { execSync, execFileSync } from 'node:child_process';
+import { pipeline } from 'node:stream/promises';
+
+const root = join(import.meta.dirname, '..');
+const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+const version = pkg.version;
+
+// validate version to prevent SSRF via malicious package.json
+if (!/^\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?$/.test(version)) {
+  console.error(`Invalid version format: ${version}`);
+  process.exit(1);
+}
+
+// detect musl libc (Alpine, Void, etc.)
+function isMusl() {
+  if (process.platform !== 'linux') return false;
+  try {
+    const ldd = execSync('ldd --version 2>&1 || true', { encoding: 'utf8' });
+    return ldd.toLowerCase().includes('musl');
+  } catch {
+    return (
+      existsSync('/lib/ld-musl-x86_64.so.1') ||
+      existsSync('/lib/ld-musl-aarch64.so.1') ||
+      existsSync('/lib/ld-musl-armhf.so.1')
+    );
+  }
+}
+
+const platform = process.platform;
+const arch = process.arch;
+const musl = isMusl();
+const platformKey = musl ? `${platform}-musl` : platform;
+const tarName = `qpdf-compress-v${version}-${platformKey}-${arch}.tar.gz`;
+
+// hardcoded origin ensures the URL can never point to an attacker-controlled host
+const releaseOrigin = 'https://github.com';
+const releasePath = `/xonaman/nodejs-qpdf-compress/releases/download/v${version}/${tarName}`;
+const releaseUrl = new URL(releasePath, releaseOrigin);
+
+const outDir = join(root, 'build', 'Release');
+
+async function tryDownload() {
+  console.log(`Checking for prebuilt binary: ${tarName}`);
+
+  try {
+    if (releaseUrl.origin !== releaseOrigin) {
+      throw new Error(`Unexpected URL origin: ${releaseUrl.origin}`);
+    }
+    const res = await fetch(releaseUrl, { redirect: 'follow' });
+    if (!res.ok) {
+      console.log(`No prebuilt binary found (HTTP ${res.status}), will compile from source.`);
+      return false;
+    }
+
+    mkdirSync(outDir, { recursive: true });
+    const tmpTar = join(root, tarName);
+
+    // download to temp file
+    const fileStream = createWriteStream(tmpTar);
+    const body = res.body;
+    if (!body) return false;
+
+    await pipeline(body, fileStream);
+
+    // extract tar.gz into project root
+    execFileSync('tar', ['xzf', tmpTar, '-C', root], { stdio: 'inherit' });
+    unlinkSync(tmpTar);
+
+    // verify the .node file exists
+    const nodeFile = join(outDir, 'qpdf_compress.node');
+    if (existsSync(nodeFile)) {
+      console.log('Prebuilt binary installed successfully.');
+      return true;
+    }
+
+    console.log(
+      'Prebuilt archive extracted but qpdf_compress.node not found, will compile from source.',
+    );
+    return false;
+  } catch (err) {
+    console.log(`Failed to download prebuilt binary: ${err.message}`);
+    return false;
+  }
+}
+
+async function buildFromSource() {
+  console.log('Building from source...');
+  execSync('node scripts/download-qpdf.mjs', { stdio: 'inherit', cwd: root });
+  execSync('npx node-gyp rebuild', { stdio: 'inherit', cwd: root });
+  execSync('node scripts/bundle-lib.mjs', { stdio: 'inherit', cwd: root });
+}
+
+const nodeFile = join(outDir, 'qpdf_compress.node');
+if (existsSync(nodeFile)) {
+  console.log('qpdf_compress.node already exists, skipping install.');
+  process.exit(0);
+}
+
+const downloaded = await tryDownload();
+if (!downloaded) {
+  await buildFromSource();
+}