qpdf-compress 0.6.1 → 0.6.3

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.6.3] - 2026-04-26
+
+### Changed
+
+- Build TypeScript on `npm install` via `prepare` script (`husky && tsc`) so `dist/` is always rebuilt from `lib/` after install and on `npm pack`/publish, preventing stale `dist/` drift
+
+## [0.6.2] - 2026-04-11
+
+### Fixed
+
+- **Shared FontFile2 corruption**: fonts sharing the same `/FontDescriptor` and `/FontFile2` are now subset with merged glyph IDs across all referencing font objects, preventing glyph removal needed by sibling fonts
+- **Already-subset font corruption**: fonts with `ABCDEF+` subset prefix are now skipped in width zeroing, TrueType/CID subsetting, and `/W` optimization to avoid double-processing
+- **Nested XObject font usage**: font usage collection now recursively scans Form XObjects at all nesting levels instead of only the first level
+- Removed unreliable unused font removal from `optimizeFonts` (already handled by `removeUnusedResources`)
+
 ## [0.6.1] - 2026-04-06
 
 ### Fixed

package/binding.gyp

@@ -6,13 +6,17 @@
         "src/qpdf_addon.cc",
         "src/jpeg.cc",
         "src/images.cc",
-        "src/optimize.cc",
+        "src/fonts.cc",
+        "src/content.cc",
+        "src/strip.cc",
+        "src/structure.cc",
         "src/font_subset.cc"
       ],
       "include_dirs": [
         "<!@(node -p \"require('node-addon-api').include\")",
         "deps/qpdf/include",
         "deps/mozjpeg/include",
+        "deps/harfbuzz/include/harfbuzz",
         "src"
       ],
       "defines": [
@@ -22,7 +26,7 @@
         "-fno-exceptions"
       ],
       "cflags": [
-        "-Os",
+        "-O2",
         "-flto",
         "-ffunction-sections",
         "-fdata-sections"
@@ -31,7 +35,7 @@
         "-fno-exceptions"
       ],
       "cflags_cc": [
-        "-std=c++20",
+        "-std=c++17",
         "-fvisibility=hidden"
       ],
       "conditions": [
@@ -45,18 +49,20 @@
             ],
             "xcode_settings": {
               "GCC_ENABLE_CPP_EXCEPTIONS": "YES",
-              "CLANG_CXX_LANGUAGE_STANDARD": "c++20",
+              "CLANG_CXX_LANGUAGE_STANDARD": "c++17",
               "GCC_SYMBOLS_PRIVATE_EXTERN": "YES",
               "DEAD_CODE_STRIPPING": "YES",
               "LLVM_LTO": "YES",
               "OTHER_CPLUSPLUSFLAGS": [
-                "-Os",
+                "-O2",
                 "-flto",
                 "-ffunction-sections",
                 "-fdata-sections"
               ],
               "OTHER_LDFLAGS": [
                 "<(module_root_dir)/deps/qpdf/lib/libqpdf.a",
+                "<(module_root_dir)/deps/harfbuzz/lib/libharfbuzz-subset.a",
+                "<(module_root_dir)/deps/harfbuzz/lib/libharfbuzz.a",
                 "-L/opt/homebrew/lib",
                 "-L/usr/local/lib",
                 "-lz",
@@ -73,10 +79,13 @@
           {
             "libraries": [
               "<(module_root_dir)/deps/qpdf/lib/libqpdf.a",
+              "<(module_root_dir)/deps/harfbuzz/lib/libharfbuzz-subset.a",
+              "<(module_root_dir)/deps/harfbuzz/lib/libharfbuzz.a",
               "-lz",
               "<(module_root_dir)/deps/mozjpeg/lib/libjpeg.a",
               "-static-libstdc++",
               "-flto",
+              "-Wl,--allow-multiple-definition",
               "-Wl,--gc-sections",
               "-Wl,-S",
               "-lpthread",
@@ -93,21 +102,26 @@
             "msvs_settings": {
               "VCCLCompilerTool": {
                 "ExceptionHandling": 1,
-                "Optimization": 1,
+                "Optimization": 2,
                 "WholeProgramOptimization": "true",
                 "RuntimeLibrary": 0,
                 "AdditionalOptions": [
-                  "/std:c++20"
+                  "/std:c++17"
                 ]
               },
               "VCLinkerTool": {
-                "LinkTimeCodeGeneration": 1
+                "LinkTimeCodeGeneration": 1,
+                "AdditionalOptions": [
+                  "/FORCE:MULTIPLE"
+                ]
               }
             },
             "libraries": [
               "<(module_root_dir)/deps/qpdf/lib/qpdf.lib",
               "<(module_root_dir)/deps/qpdf/lib/zlib.lib",
-              "<(module_root_dir)/deps/mozjpeg/lib/jpeg-static.lib"
+              "<(module_root_dir)/deps/mozjpeg/lib/jpeg-static.lib",
+              "<(module_root_dir)/deps/harfbuzz/lib/harfbuzz-subset.lib",
+              "<(module_root_dir)/deps/harfbuzz/lib/harfbuzz.lib"
             ]
           }
         ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qpdf-compress",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Native PDF compression for Node.js, powered by QPDF",
   "license": "Apache-2.0",
   "type": "module",
@@ -69,15 +69,16 @@
     "build": "node-gyp rebuild && node scripts/bundle-lib.mjs",
     "build:ts": "tsc",
     "prepublishOnly": "tsc",
-    "download": "node scripts/download-mozjpeg.mjs && node scripts/download-qpdf.mjs",
+    "download": "node scripts/download-mozjpeg.mjs && node scripts/download-qpdf.mjs && node scripts/download-harfbuzz.mjs",
     "download:mozjpeg": "node scripts/download-mozjpeg.mjs",
     "download:qpdf": "node scripts/download-qpdf.mjs",
+    "download:harfbuzz": "node scripts/download-harfbuzz.mjs",
     "test": "vitest run",
     "lint": "eslint --fix .",
     "lint:check": "eslint .",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "prepare": "husky"
+    "prepare": "husky && tsc"
   },
   "lint-staged": {
     "*.{ts,js,json,md,yaml,yml}": "prettier --write",

package/scripts/download-harfbuzz.mjs

@@ -0,0 +1,166 @@
+import { execFileSync } from 'node:child_process';
+import { createWriteStream, mkdirSync, existsSync, rmSync, cpSync, readdirSync } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+import { join } from 'node:path';
+
+const HARFBUZZ_VERSION = '14.1.0';
+const BASE_URL = 'https://github.com/harfbuzz/harfbuzz/archive/refs/tags';
+
+const root = join(import.meta.dirname, '..');
+const depsDir = join(root, 'deps', 'harfbuzz');
+
+if (existsSync(join(depsDir, 'include', 'harfbuzz', 'hb-subset.h'))) {
+  console.log('HarfBuzz already built, skipping.');
+  process.exit(0);
+}
+
+// validate version to prevent SSRF
+if (!/^\d+\.\d+\.\d+$/.test(HARFBUZZ_VERSION)) {
+  console.error(`Invalid HarfBuzz version: ${HARFBUZZ_VERSION}`);
+  process.exit(1);
+}
+
+const url = `${BASE_URL}/${HARFBUZZ_VERSION}.tar.gz`;
+const tarball = join(root, `harfbuzz-${HARFBUZZ_VERSION}.tar.gz`);
+const srcDir = join(root, `harfbuzz-${HARFBUZZ_VERSION}`);
+const buildDir = join(root, 'build-harfbuzz');
+
+// step 1: download
+console.log(`Downloading HarfBuzz ${HARFBUZZ_VERSION}...`);
+console.log(`URL: ${url}`);
+
+const response = await fetch(url, { redirect: 'follow' });
+if (!response.ok) {
+  console.error(`Download failed: ${response.status} ${response.statusText}`);
+  process.exit(1);
+}
+
+mkdirSync(join(root, 'deps'), { recursive: true });
+await pipeline(Readable.fromWeb(response.body), createWriteStream(tarball));
+
+console.log('Extracting...');
+execFileSync('tar', ['-xzf', tarball, '-C', root], { stdio: 'inherit' });
+rmSync(tarball);
+
+// GitHub archive tarballs extract to `harfbuzz-{tag}` — find it
+if (!existsSync(srcDir)) {
+  const candidates = readdirSync(root).filter(
+    (d) => d.startsWith('harfbuzz-') && !d.endsWith('.tar.gz'),
+  );
+  const match = candidates.find((d) => d.includes(HARFBUZZ_VERSION));
+  if (match) {
+    const { renameSync } = await import('node:fs');
+    renameSync(join(root, match), srcDir);
+    console.log(`Renamed ${match} → harfbuzz-${HARFBUZZ_VERSION}`);
+  } else {
+    console.error(
+      `Could not find extracted HarfBuzz source directory. Found: ${candidates.join(', ')}`,
+    );
+    process.exit(1);
+  }
+}
+
+// step 2: build with CMake (minimal static build — subset library only)
+console.log('Building HarfBuzz...');
+mkdirSync(buildDir, { recursive: true });
+
+const cmakeArgs = [
+  '-S',
+  srcDir,
+  '-B',
+  buildDir,
+  '-DCMAKE_BUILD_TYPE=Release',
+  '-DCMAKE_POSITION_INDEPENDENT_CODE=ON',
+  '-DBUILD_SHARED_LIBS=OFF',
+  '-DHB_BUILD_SUBSET=ON',
+  '-DHB_BUILD_RASTER=OFF',
+  '-DHB_BUILD_VECTOR=OFF',
+  '-DHB_BUILD_GPU=OFF',
+  '-DHB_HAVE_FREETYPE=OFF',
+  '-DHB_HAVE_GLIB=OFF',
+  '-DHB_HAVE_ICU=OFF',
+  '-DHB_HAVE_GOBJECT=OFF',
+  '-DHB_BUILD_TESTS=OFF',
+  `-DCMAKE_INSTALL_PREFIX=${depsDir}`,
+];
+
+if (process.platform === 'linux') {
+  cmakeArgs.push('-DCMAKE_C_FLAGS=-fPIC', '-DCMAKE_CXX_FLAGS=-fPIC');
+}
+
+if (process.platform === 'win32') {
+  const vcpkgRoot = process.env.VCPKG_ROOT || join(process.env.GITHUB_WORKSPACE || '', 'vcpkg');
+  if (existsSync(join(vcpkgRoot, 'scripts', 'buildsystems', 'vcpkg.cmake'))) {
+    const triplet = process.env.VCPKG_TARGET_TRIPLET || `${process.arch}-windows-static`;
+    cmakeArgs.push(
+      `-DCMAKE_TOOLCHAIN_FILE=${join(vcpkgRoot, 'scripts', 'buildsystems', 'vcpkg.cmake')}`,
+      `-DVCPKG_TARGET_TRIPLET=${triplet}`,
+    );
+  }
+  const targetArch = (process.env.VCPKG_TARGET_TRIPLET || '').split('-')[0] || process.arch;
+  if (targetArch === 'arm64') {
+    cmakeArgs.push('-A', 'arm64');
+  }
+  cmakeArgs.push('-DCMAKE_POLICY_DEFAULT_CMP0091=NEW');
+  cmakeArgs.push('-DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded');
+  cmakeArgs.splice(cmakeArgs.indexOf('-DCMAKE_BUILD_TYPE=Release'), 1);
+}
+
+execFileSync('cmake', cmakeArgs, { stdio: 'inherit' });
+
+const buildArgs = ['--build', buildDir, '--parallel'];
+if (process.platform === 'win32') {
+  buildArgs.push('--config', 'Release');
+}
+execFileSync('cmake', buildArgs, { stdio: 'inherit' });
+
+// step 3: install headers and libraries
+console.log('Installing to deps/harfbuzz...');
+mkdirSync(join(depsDir, 'lib'), { recursive: true });
+mkdirSync(join(depsDir, 'include', 'harfbuzz'), { recursive: true });
+
+// copy public headers from source
+const srcHeaders = join(srcDir, 'src');
+const headerFiles = readdirSync(srcHeaders).filter((f) => f.startsWith('hb') && f.endsWith('.h'));
+for (const h of headerFiles) {
+  cpSync(join(srcHeaders, h), join(depsDir, 'include', 'harfbuzz', h));
+}
+
+// also copy generated config header
+const generatedHeader = join(buildDir, 'src', 'config.h');
+if (existsSync(generatedHeader)) {
+  cpSync(generatedHeader, join(depsDir, 'include', 'harfbuzz', 'config.h'));
+}
+
+// copy static libraries — CMake may place them in the build root or src/
+const isLibFile = (f) => (f.endsWith('.a') || f.endsWith('.lib')) && f.includes('harfbuzz');
+
+let libsCopied = 0;
+const libSearchDirs = [
+  buildDir,
+  join(buildDir, 'src'),
+  join(buildDir, 'Release'),
+  join(buildDir, 'src', 'Release'),
+];
+for (const dir of libSearchDirs) {
+  if (!existsSync(dir)) continue;
+  const libs = readdirSync(dir).filter(isLibFile);
+  for (const lib of libs) {
+    cpSync(join(dir, lib), join(depsDir, 'lib', lib));
+    console.log(`Copied ${lib} from ${dir}`);
+    libsCopied++;
+  }
+}
+if (libsCopied === 0) {
+  console.error('No HarfBuzz static libraries found!');
+  console.error('Searched:', libSearchDirs.join(', '));
+  process.exit(1);
+}
+
+// step 4: cleanup
+console.log('Cleaning up...');
+rmSync(srcDir, { recursive: true, force: true });
+rmSync(buildDir, { recursive: true, force: true });
+
+console.log(`HarfBuzz ${HARFBUZZ_VERSION} installed to deps/harfbuzz.`);

package/scripts/download-mozjpeg.mjs

@@ -93,6 +93,7 @@ if (process.platform === 'darwin') {
 
 // Windows multi-config generator
 if (process.platform === 'win32') {
+  cmakeArgs.push('-DCMAKE_POLICY_DEFAULT_CMP0091=NEW');
   cmakeArgs.push('-DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded');
   cmakeArgs.splice(cmakeArgs.indexOf('-DCMAKE_BUILD_TYPE=Release'), 1);
 

package/scripts/download-qpdf.mjs

@@ -85,7 +85,13 @@ const cmakeArgs = [
 // force -fPIC for static library objects on Linux — CMAKE_POSITION_INDEPENDENT_CODE
 // alone is not always respected by QPDF's CMake targets
 if (process.platform === 'linux') {
-  cmakeArgs.push('-DCMAKE_C_FLAGS=-fPIC', '-DCMAKE_CXX_FLAGS=-fPIC');
+  cmakeArgs.push('-DCMAKE_C_FLAGS=-fPIC', '-DCMAKE_CXX_FLAGS=-fPIC -fvisibility=hidden');
+}
+
+if (process.platform === 'darwin') {
+  // match the addon's -fvisibility=hidden so exception typeinfo pointers are
+  // consistent and catch(std::exception&) works across the static link boundary
+  cmakeArgs.push('-DCMAKE_CXX_VISIBILITY_PRESET=hidden', '-DCMAKE_VISIBILITY_INLINES_HIDDEN=ON');
 }
 
 // point QPDF at vendored mozjpeg
@@ -132,6 +138,7 @@ if (process.platform === 'win32') {
     }
   }
   // force static CRT (/MT) to match node-gyp
+  cmakeArgs.push('-DCMAKE_POLICY_DEFAULT_CMP0091=NEW');
   cmakeArgs.push('-DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded');
   // MSVC uses multi-config generator — specify release at build time instead
   cmakeArgs.splice(cmakeArgs.indexOf('-DCMAKE_BUILD_TYPE=Release'), 1);

package/scripts/install.mjs

@@ -98,6 +98,7 @@ async function buildFromSource() {
   console.log('Building from source...');
   execSync('node scripts/download-mozjpeg.mjs', { stdio: 'inherit', cwd: root });
   execSync('node scripts/download-qpdf.mjs', { stdio: 'inherit', cwd: root });
+  execSync('node scripts/download-harfbuzz.mjs', { stdio: 'inherit', cwd: root });
   execSync('npx node-gyp rebuild', { stdio: 'inherit', cwd: root });
   execSync('node scripts/bundle-lib.mjs', { stdio: 'inherit', cwd: root });
 }

package/src/content.cc

@@ -0,0 +1,291 @@
+#include "content.h"
+
+#include <cctype>
+#include <string>
+
+#include <qpdf/QPDFObjectHandle.hh>
+#include <qpdf/QPDFPageDocumentHelper.hh>
+#include <qpdf/QPDFPageObjectHelper.hh>
+
+// ---------------------------------------------------------------------------
+// Content stream coalescing — merge multiple content streams per page into one
+// ---------------------------------------------------------------------------
+
+void coalesceContentStreams(QPDF &qpdf) {
+  for (auto &page : QPDFPageDocumentHelper(qpdf).getAllPages()) {
+    auto pageObj = page.getObjectHandle();
+    auto contents = pageObj.getKey("/Contents");
+
+    // only coalesce if there are multiple content streams (array)
+    if (contents.isArray() && contents.getArrayNItems() > 1) {
+      page.coalesceContentStreams();
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Content stream minification — normalize whitespace and number formatting
+// to reduce content stream size before Flate compression
+// ---------------------------------------------------------------------------
+
+// trims a numeric string: remove trailing zeros after decimal point,
+// remove the decimal point if it becomes the last char,
+// and strip a leading zero for values between -1 and 1.
+static std::string trimNumber(const std::string &s) {
+  // only process strings that look like decimal numbers
+  if (s.find('.') == std::string::npos)
+    return s;
+
+  std::string result = s;
+
+  // strip trailing zeros after decimal point
+  size_t dot = result.find('.');
+  if (dot != std::string::npos) {
+    size_t last = result.size() - 1;
+    while (last > dot && result[last] == '0')
+      --last;
+    if (last == dot)
+      result.erase(dot); // remove the dot too (e.g. "1." → "1")
+    else
+      result.erase(last + 1);
+  }
+
+  // if trimming left an empty string or bare sign, the value was zero
+  if (result.empty() || result == "-")
+    return "0";
+
+  // strip leading zero for values like "0.5" → ".5" or "-0.5" → "-.5"
+  if (result.size() >= 2 && result[0] == '0' && result[1] == '.')
+    result.erase(0, 1);
+  else if (result.size() >= 3 && result[0] == '-' && result[1] == '0' &&
+           result[2] == '.')
+    result.erase(1, 1);
+
+  return result;
+}
+
+void minifyContentStreams(QPDF &qpdf) {
+  for (auto &page : QPDFPageDocumentHelper(qpdf).getAllPages()) {
+    auto pageObj = page.getObjectHandle();
+    auto contents = pageObj.getKey("/Contents");
+
+    if (!contents.isStream())
+      continue;
+
+    std::string raw;
+    try {
+      auto buf = contents.getStreamData(qpdf_dl_generalized);
+      raw.assign(reinterpret_cast<const char *>(buf->getBuffer()),
+                 buf->getSize());
+    } catch (...) {
+      continue;
+    }
+
+    // tokenize preserving string literals and hex strings intact
+    std::string minified;
+    minified.reserve(raw.size());
+    bool needSpace = false;
+    size_t pos = 0;
+
+    while (pos < raw.size()) {
+      char ch = raw[pos];
+
+      // skip whitespace
+      if (ch == ' ' || ch == '\t' || ch == '\r' || ch == '\n') {
+        if (!minified.empty())
+          needSpace = true;
+        ++pos;
+        continue;
+      }
+
+      // comments — skip to end of line
+      if (ch == '%') {
+        while (pos < raw.size() && raw[pos] != '\n')
+          ++pos;
+        continue;
+      }
+
+      // literal string — copy verbatim
+      if (ch == '(') {
+        if (needSpace) {
+          minified += ' ';
+          needSpace = false;
+        }
+        int depth = 1;
+        minified += '(';
+        ++pos;
+        while (pos < raw.size() && depth > 0) {
+          if (raw[pos] == '\\') {
+            minified += raw[pos++];
+            if (pos < raw.size())
+              minified += raw[pos++];
+          } else {
+            if (raw[pos] == '(')
+              ++depth;
+            else if (raw[pos] == ')')
+              --depth;
+            minified += raw[pos++];
+          }
+        }
+        needSpace = true;
+        continue;
+      }
+
+      // hex string — copy verbatim
+      if (ch == '<' && pos + 1 < raw.size() && raw[pos + 1] != '<') {
+        if (needSpace) {
+          minified += ' ';
+          needSpace = false;
+        }
+        minified += '<';
+        ++pos;
+        while (pos < raw.size() && raw[pos] != '>') {
+          if (!std::isspace(static_cast<unsigned char>(raw[pos])))
+            minified += raw[pos];
+          ++pos;
+        }
+        if (pos < raw.size()) {
+          minified += '>';
+          ++pos;
+        }
+        needSpace = true;
+        continue;
+      }
+
+      // dict delimiters << >> — self-delimiting, no space needed around them
+      if (ch == '<' && pos + 1 < raw.size() && raw[pos + 1] == '<') {
+        if (needSpace) {
+          minified += ' ';
+          needSpace = false;
+        }
+        minified += "<<";
+        pos += 2;
+        continue;
+      }
+      if (ch == '>' && pos + 1 < raw.size() && raw[pos + 1] == '>') {
+        minified += ">>";
+        pos += 2;
+        needSpace = true;
+        continue;
+      }
+
+      // array delimiters — self-delimiting
+      if (ch == '[' || ch == ']') {
+        if (needSpace && ch == '[') {
+          minified += ' ';
+          needSpace = false;
+        }
+        minified += ch;
+        ++pos;
+        if (ch == ']')
+          needSpace = true;
+        continue;
+      }
+
+      // name — starts with /
+      if (ch == '/') {
+        if (needSpace) {
+          minified += ' ';
+          needSpace = false;
+        }
+        size_t start = pos;
+        ++pos;
+        while (pos < raw.size() &&
+               !std::isspace(static_cast<unsigned char>(raw[pos])) &&
+               raw[pos] != '/' && raw[pos] != '[' && raw[pos] != ']' &&
+               raw[pos] != '<' && raw[pos] != '>' && raw[pos] != '(' &&
+               raw[pos] != ')')
+          ++pos;
+        minified.append(raw, start, pos - start);
+        needSpace = true;
+        continue;
+      }
+
+      // regular token (number, operator)
+      {
+        if (needSpace) {
+          minified += ' ';
+          needSpace = false;
+        }
+        size_t start = pos;
+        while (pos < raw.size() &&
+               !std::isspace(static_cast<unsigned char>(raw[pos])) &&
+               raw[pos] != '/' && raw[pos] != '[' && raw[pos] != ']' &&
+               raw[pos] != '<' && raw[pos] != '>' && raw[pos] != '(' &&
+               raw[pos] != ')')
+          ++pos;
+
+        std::string token(raw, start, pos - start);
+
+        // trim numeric formatting
+        if (!token.empty() &&
+            (token[0] == '-' || token[0] == '+' || token[0] == '.' ||
+             (token[0] >= '0' && token[0] <= '9'))) {
+          token = trimNumber(token);
+        }
+
+        minified += token;
+        needSpace = true;
+
+        // handle inline image data (BI <key-value pairs> ID <binary> EI)
+        // the binary data after ID can contain any byte — copy verbatim
+        if (token == "ID") {
+          // copy the required single whitespace delimiter after ID
+          if (pos < raw.size())
+            minified += raw[pos++];
+          // copy binary data verbatim until the EI end marker:
+          // whitespace + "EI" + (whitespace or end-of-stream)
+          // binary image data can contain byte sequences that match this
+          // pattern, so we validate that what follows EI looks like valid
+          // content stream syntax (not more binary data)
+          bool foundEI = false;
+          while (pos + 2 < raw.size()) {
+            if (std::isspace(static_cast<unsigned char>(raw[pos])) &&
+                raw[pos + 1] == 'E' && raw[pos + 2] == 'I' &&
+                (pos + 3 >= raw.size() ||
+                 std::isspace(static_cast<unsigned char>(raw[pos + 3])))) {
+              // validate: after EI + whitespace, the next non-whitespace byte
+              // must be a valid content stream token start character, not
+              // a continuation of binary image data
+              size_t check = pos + 3;
+              while (check < raw.size() &&
+                     std::isspace(static_cast<unsigned char>(raw[check])))
+                check++;
+              bool valid = (check >= raw.size());
+              if (!valid) {
+                unsigned char c = static_cast<unsigned char>(raw[check]);
+                // valid token start: letter (operator), digit/sign (number),
+                // ( (string), < (hex/dict), [ (array), / (name), % (comment)
+                valid = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
+                        (c >= '0' && c <= '9') || c == '+' || c == '-' ||
+                        c == '.' || c == '(' || c == '<' || c == '[' ||
+                        c == '/' || c == '%';
+              }
+              if (valid) {
+                minified += raw[pos]; // whitespace before EI
+                minified += "EI";
+                pos += 3;
+                foundEI = true;
+                break;
+              }
+              // false EI match inside binary data — continue scanning
+            }
+            minified += raw[pos++];
+          }
+          if (!foundEI) {
+            // malformed stream — copy remaining bytes verbatim
+            while (pos < raw.size())
+              minified += raw[pos++];
+          }
+        }
+      }
+    }
+
+    // only replace if we actually reduced the size
+    if (minified.size() >= raw.size())
+      continue;
+
+    contents.replaceStreamData(minified, QPDFObjectHandle::newNull(),
+                               QPDFObjectHandle::newNull());
+  }
+}

package/src/content.h

@@ -0,0 +1,6 @@
+#pragma once
+
+#include <qpdf/QPDF.hh>
+
+void coalesceContentStreams(QPDF &qpdf);
+void minifyContentStreams(QPDF &qpdf);