qpdf-compress 0.7.1 → 0.8.1

package/CHANGELOG.md

@@ -6,6 +6,27 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ## [Unreleased]
 
+## [0.8.1] - 2026-09-23
+
+### Fixed
+
+- **The release workflow published releases without their prebuilt binaries.** `gh release create <tag> <assets>` publishes the release and then uploads, and GitHub's immutable releases reject an upload to a published release — with a 422 that `gh` does not surface, so the step went green with nothing attached. `install.mjs` reads the prebuilts off the release, so every consumer of such a version is sent to a source build. The release is now created as a draft with the tarballs attached and published afterwards, and a following step fails the job unless every artifact made it onto the release. **0.8.0 is affected and should be skipped** — it installs only where a C++ toolchain is present. It is deprecated on npm in favour of this release.
+
+### Added
+
+- `npm run verify:pdfa` — a PDF/A conformance harness. It validates `compress()` output against veraPDF, the reference validator, over a real ZUGFeRD PDF/A-3a invoice, and compares the failing clauses to a recorded baseline (`scripts/pdfa-baseline.json`), failing on any difference in either direction so that neither a regression nor an improvement passes unnoticed. CI runs it on Linux / Node 22. veraPDF is GPL-3.0 / MPL-2.0 and is run as an external container pinned by digest — never vendored or linked. Groundwork for [#35](https://github.com/xonaman/nodejs-qpdf-compress/issues/35).
+
+## [0.8.0] - 2026-09-23
+
+### Fixed
+
+- **Embedded file stripping removed the lookup path but not the file.** Only the `/EmbeddedFiles` name tree was cleared, while the `/AF` associated-files array (PDF/A-3, PDF 2.0) and `/FileAttachment` annotations kept their own reference to the same file specification. The attachment therefore stayed in the output and was recoverable in full, while readers that resolve attachments by name — pdfium among them — no longer found it: the removal did not remove, and a legitimate consumer lost access. All three paths are now cleared, so the writer drops the file specification and its stream as unreferenced. ([#34](https://github.com/xonaman/nodejs-qpdf-compress/issues/34))
+
+### Added
+
+- `stripAttachments` option (default `true`, matching previous behaviour) to keep embedded file attachments. Hybrid invoices (ZUGFeRD / Factur-X) carry the invoice itself as an attachment, so `compress(pdf, { stripAttachments: false })` is what keeps such a document machine-readable. Note that the output is still not a conforming PDF/A-3: output intents and structure information are dropped in every mode.
+- A `with-attachment.pdf` fixture whose attachment is reachable through all three paths, and tests that search decompressed stream contents rather than raw bytes — with object streams on, a byte search can miss an attachment that is entirely intact.
+
 ## [0.7.1] - 2026-07-15
 
 ### Security

package/README.md

@@ -71,7 +71,7 @@ const smaller = await compress(pdfBuffer, { lossy: true });
 | Form flattening           | ✅ Automatic          | ❌                | ❌                |
 | Stream deduplication      | ✅ Automatic          | ❌                | ❌                |
 | Content minification      | ✅ Automatic          | ❌                | ❌                |
-| JS/embedded file removal  | ✅ Automatic          | ❌                | ❌                |
+| JS/embedded file removal  | ✅ Default on         | ❌                | ❌                |
 | Metadata stripping        | ✅ Default on         | ✅ Manual flag    | ✅                |
 | PDF repair                | ✅ Automatic          | ✅ Manual flag    | ⚠️ Partial        |
 | License                   | Apache-2.0            | Apache-2.0        | AGPL-3.0 ⚠️       |
@@ -131,6 +131,9 @@ const smaller = await compress(pdfBuffer, { lossy: true });
 // keep metadata (stripped by default)
 const withMeta = await compress(pdfBuffer, { stripMetadata: false });
 
+// keep embedded file attachments (stripped by default)
+const withAttachments = await compress(pdfBuffer, { stripAttachments: false });
+
 // file path input (avoids copying into memory twice)
 const result = await compress('/path/to/file.pdf');
 
@@ -149,12 +152,15 @@ const fixed = await compress(damagedBuffer);
 
 Compresses a PDF document. Automatically repairs damaged PDFs.
 
-| Parameter               | Type               | Description                                                         |
-| ----------------------- | ------------------ | ------------------------------------------------------------------- |
-| `input`                 | `Buffer \| string` | PDF data or file path                                               |
-| `options.lossy`         | `boolean`          | Enable lossy compression. Default: `false`                          |
-| `options.stripMetadata` | `boolean`          | Remove XMP metadata, document info, and thumbnails. Default: `true` |
-| `options.output`        | `string`           | Write to file path instead of returning a `Buffer`                  |
+| Parameter                  | Type               | Description                                                         |
+| -------------------------- | ------------------ | ------------------------------------------------------------------- |
+| `input`                    | `Buffer \| string` | PDF data or file path                                               |
+| `options.lossy`            | `boolean`          | Enable lossy compression. Default: `false`                          |
+| `options.stripMetadata`    | `boolean`          | Remove XMP metadata, document info, and thumbnails. Default: `true` |
+| `options.stripAttachments` | `boolean`          | Remove embedded file attachments. Default: `true`                   |
+| `options.output`           | `string`           | Write to file path instead of returning a `Buffer`                  |
+
+> **Hybrid invoices (ZUGFeRD / Factur-X)**: the invoice XML rides along as an attachment, so the defaults remove it. Pass `stripAttachments: false` to keep the attachment and every path readers look it up through. The result is still not a conforming PDF/A-3 — output intents and structure information are dropped in every mode, and XMP metadata too unless `stripMetadata: false` — so a file that has to stay conformant should not be compressed at all. That is measured, not assumed: `npm run verify:pdfa` validates the output against veraPDF over a real PDF/A-3a invoice, and `scripts/pdfa-baseline.json` records exactly which clauses fail.
 
 **Both modes:**
 
@@ -170,7 +176,8 @@ Compresses a PDF document. Automatically repairs damaged PDFs.
 - Flattens page tree (pushes inherited attributes to pages)
 - Coalesces multiple content streams per page into one
 - Minifies content streams (whitespace normalization, numeric formatting)
-- Strips embedded files and JavaScript actions
+- Strips embedded file attachments and every path to them — the `/EmbeddedFiles` name tree, `/AF` associated-file arrays, and `/FileAttachment` annotations (default: on)
+- Strips JavaScript actions
 - Recompresses all decodable streams with Flate level 9
 - Generates object streams for smaller metadata overhead
 - Removes unreferenced objects
@@ -231,9 +238,10 @@ All operations run in a background thread via `Napi::AsyncWorker`, so the event
 13. Coalesce multiple content streams per page
 14. Minify content streams
 15. Deduplicate identical non-image streams
-16. Strip embedded files and JavaScript
-17. _(optional)_ Strip metadata
-18. QPDFWriter: Flate 9, object streams, unreferenced object removal
+16. _(optional)_ Strip embedded file attachments
+17. Strip JavaScript
+18. _(optional)_ Strip metadata
+19. QPDFWriter: Flate 9, object streams, unreferenced object removal
 
 ## License
 

package/THIRD-PARTY-NOTICES.md

@@ -42,3 +42,15 @@ Copyright Jean-loup Gailly and Mark Adler. Licensed under the zlib License.
 zlib provides DEFLATE compression and is statically linked into the Windows
 build (via vcpkg); on macOS and Linux the system zlib is used at build time.
 See <https://github.com/madler/zlib/blob/master/LICENSE>.
+
+## Development and test material
+
+Neither of the following is distributed in the npm package: the fixture lives under `test/`, which is excluded from the package `files` list, and veraPDF is invoked as an external tool in its own container rather than vendored or linked.
+
+### `test/fixtures/pdfa3-invoice.pdf`
+
+A real ZUGFeRD 2.1 (EN 16931) PDF/A-3a invoice, used by `npm run verify:pdfa` to measure the PDF/A conformance of compression output. Taken unmodified from the [ZUGFeRD/corpus](https://github.com/ZUGFeRD/corpus) project (Apache-2.0), path `ZUGFeRDv2/correct/symtrax/Beispiele/EN16931/zugferd_2p1_EN16931_AbweichenderZahlungsempf.pdf`, SHA-256 `a4b903d4e508a80d65276f030d0fbeab5081d62c2c2b19ffd2f13bcdae37c564`.
+
+### veraPDF
+
+Copyright the veraPDF Consortium. Licensed under the GNU General Public License v3 or the Mozilla Public License v2. The reference PDF/A validator, run by `npm run verify:pdfa` from the `verapdf/cli` container image, pinned by digest in `scripts/pdfa-baseline.json`. See <https://github.com/veraPDF/veraPDF-apps>.

package/dist/index.d.ts

@@ -8,6 +8,11 @@ type PdfInput = Buffer | string;
  * JPEG Huffman tables, recompresses all streams with Flate level 9,
  * generates object streams, and removes unreferenced objects.
  *
+ * Embedded file attachments are removed by default, along with every path
+ * they are reachable through. Pass `stripAttachments: false` to keep them —
+ * needed for hybrid invoices (ZUGFeRD / Factur-X), where the attachment is
+ * the document's payload rather than a rider on it.
+ *
  * With `lossy: true`, uses more aggressive image re-encoding (skips JPEGs
  * at q65 or below, re-encodes the rest at q75) and downscales to 72 DPI.
  * Text, vectors, and fonts are preserved.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,YAAY,CAAC;AAc/D,KAAK,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;AACjB,wBAAgB,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AA2BtF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,YAAY,CAAC;AAc/D,KAAK,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;AACjB,wBAAgB,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AA6BtF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -27,10 +27,12 @@ export async function compress(input, options) {
         throw new TypeError('Input must be a Buffer or file path string');
     }
     const stripMetadata = options?.stripMetadata ?? true;
+    const stripAttachments = options?.stripAttachments ?? true;
     try {
         return await withConcurrency(() => addon.compress(input, {
             ...(options?.lossy ? { lossy: true } : {}),
             ...(stripMetadata ? { stripMetadata: true } : {}),
+            ...(stripAttachments ? { stripAttachments: true } : {}),
             ...(options?.output ? { output: options.output } : {}),
         }));
     }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,MAAM,KAAK,GAAG,OAAO,CAAC,qCAAqC,CAAgB,CAAC;AAqB5E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAe,EAAE,OAAyB;IACvE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE;YACpB,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,MAAM,KAAK,GAAG,OAAO,CAAC,qCAAqC,CAAgB,CAAC;AA0B5E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAe,EAAE,OAAyB;IACvE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;IACrD,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,GAAG,EAAE,CAChC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE;YACpB,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}

package/dist/types.d.ts

@@ -3,6 +3,8 @@ export interface CompressOptions {
     readonly lossy?: boolean;
     /** Remove XMP metadata, document info, and thumbnails. Default: true. */
     readonly stripMetadata?: boolean;
+    /** Remove embedded file attachments. Default: true. */
+    readonly stripAttachments?: boolean;
     /** Write to this file path instead of returning a Buffer. */
     readonly output?: string;
 }
@@ -10,6 +12,7 @@ export interface NativeAddon {
     compress(input: Buffer | string, options: {
         lossy?: boolean;
         stripMetadata?: boolean;
+        stripAttachments?: boolean;
         output?: string;
     }): Promise<Buffer | undefined>;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../lib/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CACN,KAAK,EAAE,MAAM,GAAG,MAAM,EACtB,OAAO,EAAE;QACP,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GACA,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../lib/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CACN,KAAK,EAAE,MAAM,GAAG,MAAM,EACtB,OAAO,EAAE;QACP,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GACA,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChC"}

package/lib/index.ts

@@ -27,6 +27,11 @@ type PdfInput = Buffer | string;
  * JPEG Huffman tables, recompresses all streams with Flate level 9,
  * generates object streams, and removes unreferenced objects.
  *
+ * Embedded file attachments are removed by default, along with every path
+ * they are reachable through. Pass `stripAttachments: false` to keep them —
+ * needed for hybrid invoices (ZUGFeRD / Factur-X), where the attachment is
+ * the document's payload rather than a rider on it.
+ *
  * With `lossy: true`, uses more aggressive image re-encoding (skips JPEGs
  * at q65 or below, re-encodes the rest at q75) and downscales to 72 DPI.
  * Text, vectors, and fonts are preserved.
@@ -49,11 +54,13 @@ export async function compress(input: PdfInput, options?: CompressOptions): Prom
     throw new TypeError('Input must be a Buffer or file path string');
   }
   const stripMetadata = options?.stripMetadata ?? true;
+  const stripAttachments = options?.stripAttachments ?? true;
   try {
     return await withConcurrency(() =>
       addon.compress(input, {
         ...(options?.lossy ? { lossy: true } : {}),
         ...(stripMetadata ? { stripMetadata: true } : {}),
+        ...(stripAttachments ? { stripAttachments: true } : {}),
         ...(options?.output ? { output: options.output } : {}),
       }),
     );

package/lib/types.ts

@@ -3,6 +3,8 @@ export interface CompressOptions {
   readonly lossy?: boolean;
   /** Remove XMP metadata, document info, and thumbnails. Default: true. */
   readonly stripMetadata?: boolean;
+  /** Remove embedded file attachments. Default: true. */
+  readonly stripAttachments?: boolean;
   /** Write to this file path instead of returning a Buffer. */
   readonly output?: string;
 }
@@ -13,6 +15,7 @@ export interface NativeAddon {
     options: {
       lossy?: boolean;
       stripMetadata?: boolean;
+      stripAttachments?: boolean;
       output?: string;
     },
   ): Promise<Buffer | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qpdf-compress",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "description": "Native PDF compression for Node.js, powered by QPDF",
   "license": "Apache-2.0",
   "type": "module",
@@ -77,6 +77,7 @@
     "download:qpdf": "node scripts/download-qpdf.mjs",
     "download:harfbuzz": "node scripts/download-harfbuzz.mjs",
     "verify:checksums": "node scripts/verify-checksums.mjs",
+    "verify:pdfa": "tsc && node scripts/verify-pdfa.mjs",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit",

package/scripts/pdfa-baseline.json

@@ -0,0 +1,23 @@
+{
+  "image": "verapdf/cli@sha256:d5ee329657cf9bc4b2400392dd54c7d0a0ce9980ff6fa2da5590eebeec007cdb",
+  "flavour": "3a",
+  "fixture": "pdfa3-invoice.pdf",
+  "variants": {
+    "original": {
+      "compliant": true,
+      "failedRules": []
+    },
+    "default": {
+      "compliant": false,
+      "failedRules": ["6.1.7.1-2", "6.2.4.3-2", "6.2.4.3-4", "6.6.2.1-1", "6.7.2.2-1", "6.7.3.3-1"]
+    },
+    "keep-attachments": {
+      "compliant": false,
+      "failedRules": ["6.1.7.1-2", "6.2.4.3-2", "6.2.4.3-4", "6.6.2.1-1", "6.7.2.2-1", "6.7.3.3-1"]
+    },
+    "keep-both": {
+      "compliant": false,
+      "failedRules": ["6.1.7.1-2", "6.2.4.3-2", "6.2.4.3-4", "6.7.3.3-1"]
+    }
+  }
+}

package/scripts/prebuilds.json

@@ -1,11 +1,11 @@
 {
-  "darwin-arm64": "2af510fe83270db0874eef4accafe24a8aefa37af4e5f7d621eb2bb4702491ed",
-  "darwin-x64": "5b55c91245c220ad287bc20a02a72c34edc11765ed1f71630fb174554c402251",
-  "linux-arm": "302480ffb46576cc009386a3621099946bc1435387afe680a07c8d4abe90920b",
-  "linux-arm64": "ae3ae7629a6ead5e61b0f67167ef4ad6bc3309f84bcae70d0e30cd3690246161",
-  "linux-musl-arm64": "075a23fae7a2cc3d4b01fde42aa09e9d52d024cdb003236adfa4d1b1b5435d81",
-  "linux-musl-x64": "2aa7f761de96acbf604ef2ed7d9f45068257ca12ac735fa0c5529a64b9e9c34b",
-  "linux-x64": "85743113468dcdc2f676e9def2dba2f8edca8fd3084fb4ea032542a5ce1b3ce2",
-  "win32-arm64": "ce651ad9d9e1e4b57e549ef1379aeef44f013a5912b0890bcc8605050e531328",
-  "win32-x64": "d7ccbcb0b089996f116100fcaf0b0554c8b9c1a423f43955be2c16b9ce499906"
+  "darwin-arm64": "6835d46768f1fc7366bbc60818dff396ca03c8ffb59b80e94454ca9dd5104fbf",
+  "darwin-x64": "dc222533f2ece1d5295f40f354a7fdd0846c2141a94ece211151cee6ceb45f70",
+  "linux-arm": "a0458de5782d4f900fba4de00cad8a678eb0a416d6cfbb153e82002446e941aa",
+  "linux-arm64": "ee25a8cd3ec974e6055206ecdfa96a5e5d4bc218885640b5739b149b734fe022",
+  "linux-musl-arm64": "f95653c36036947378834fa5715a55dd4ab8b0b6245a8bee95b91b280d3dda2b",
+  "linux-musl-x64": "7fdc5b849c9d4c8c7518490c274a1814c612b999e5752521f56b9e2253a9f37f",
+  "linux-x64": "a75e4213e1309ee49ed91d0c1e5aa591954db2c84fae0768fb1ec718a65b4a11",
+  "win32-arm64": "30d895806eec45f194c89b3fc1b521de164b1a2dd91adb8a7a939254baa0100d",
+  "win32-x64": "9b294de489115c6f8cb5733db260c12904f956e1ec30275776fc29cfcab600dc"
 }

package/scripts/verify-pdfa.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/**
+ * Validates the PDF/A conformance of compress() output against a recorded baseline.
+ *
+ * veraPDF is the reference PDF/A validator. It is GPL-3.0 / MPL-2.0, so it is neither
+ * vendored nor linked — it runs as an external tool in its own container, pinned by
+ * digest so a verdict cannot drift under us when the image is rebuilt.
+ *
+ * The baseline records which clauses each variant fails today. Any difference, in
+ * either direction, fails the run: a regression and an improvement both need the
+ * baseline updated deliberately (`--update`) rather than silently absorbed.
+ *
+ * Usage: npm run verify:pdfa [-- --update]
+ */
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { compress } from '../dist/index.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = resolve(__dirname, '..');
+const baselinePath = join(__dirname, 'pdfa-baseline.json');
+const baseline = JSON.parse(readFileSync(baselinePath, 'utf8'));
+const update = process.argv.includes('--update');
+
+// the work directory must sit inside the repo: Docker Desktop shares the user's
+// own tree, not every host temp path
+const workDir = join(root, '.cache', 'pdfa');
+
+const variants = {
+  original: null,
+  default: {},
+  'keep-attachments': { stripAttachments: false },
+  'keep-both': { stripAttachments: false, stripMetadata: false },
+};
+
+function veraPdf(name) {
+  const args = [
+    'run',
+    '--rm',
+    '--platform',
+    'linux/amd64',
+    '-v',
+    `${workDir}:/data`,
+    baseline.image,
+    '--flavour',
+    baseline.flavour,
+    '--format',
+    'mrr',
+    `/data/${name}.pdf`,
+  ];
+  let xml;
+  try {
+    xml = execFileSync('docker', args, { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+  } catch (err) {
+    // veraPDF exits non-zero for a non-compliant file; the report is still on stdout
+    if (typeof err.stdout !== 'string' || !err.stdout.includes('<validationReport')) throw err;
+    xml = err.stdout;
+  }
+  const compliant = /<validationReport[^>]*isCompliant="true"/.test(xml);
+  const failed = [
+    ...new Set(
+      [
+        ...xml.matchAll(
+          /<rule\b[^>]*\bclause="([^"]+)"[^>]*\btestNumber="([^"]+)"[^>]*\bstatus="failed"/g,
+        ),
+      ].map((m) => `${m[1]}-${m[2]}`),
+    ),
+  ].sort();
+  return { compliant, failedRules: failed };
+}
+
+try {
+  execFileSync('docker', ['version', '--format', '{{.Server.Version}}'], { stdio: 'ignore' });
+} catch {
+  console.error('Docker is required to run veraPDF. Start Docker and try again.');
+  process.exit(1);
+}
+
+rmSync(workDir, { recursive: true, force: true });
+mkdirSync(workDir, { recursive: true });
+
+const fixture = readFileSync(join(root, 'test', 'fixtures', baseline.fixture));
+writeFileSync(join(workDir, 'original.pdf'), fixture);
+for (const [name, options] of Object.entries(variants)) {
+  if (!options) continue;
+  await compress(fixture, { ...options, output: join(workDir, `${name}.pdf`) });
+}
+
+const results = {};
+let failures = 0;
+
+for (const name of Object.keys(variants)) {
+  const actual = veraPdf(name);
+  results[name] = actual;
+
+  const expected = baseline.variants[name];
+  const same =
+    expected &&
+    expected.compliant === actual.compliant &&
+    expected.failedRules.join() === actual.failedRules.join();
+
+  const verdict = actual.compliant ? 'PASS' : `FAIL (${actual.failedRules.length})`;
+  console.log(
+    `${same || update ? ' ok ' : 'DIFF'}  ${name.padEnd(17)} ${verdict.padEnd(9)} ${actual.failedRules.join(' ')}`,
+  );
+
+  if (!same && !update) {
+    failures++;
+    console.log(
+      `      expected: ${expected ? `${expected.compliant ? 'PASS' : 'FAIL'} ${expected.failedRules.join(' ')}` : '(no baseline entry)'}`,
+    );
+  }
+}
+
+if (update) {
+  writeFileSync(baselinePath, `${JSON.stringify({ ...baseline, variants: results }, null, 2)}\n`);
+  // keep the committed file canonical so the pre-commit hook has nothing to say
+  try {
+    execFileSync('npx', ['prettier', '--write', baselinePath], { stdio: 'ignore' });
+  } catch {
+    // prettier is a devDependency; a missing one is not worth failing the run over
+  }
+  console.log(`\nBaseline updated: ${baselinePath}`);
+  process.exit(0);
+}
+
+if (failures) {
+  console.error(
+    `\n${failures} variant(s) differ from the baseline. Re-run with --update once the change is intended.`,
+  );
+  process.exit(1);
+}
+console.log('\nAll variants match the recorded baseline.');

package/src/qpdf_addon.cc

@@ -101,18 +101,18 @@ class CompressWorker : public Napi::AsyncWorker {
 public:
   // buffer variant
   CompressWorker(Napi::Env env, std::vector<uint8_t> data, bool lossy,
-                 bool stripMeta, std::string outputPath)
+                 bool stripMeta, bool stripAttach, std::string outputPath)
       : Napi::AsyncWorker(env), deferred_(Napi::Promise::Deferred::New(env)),
         envAlive_(GetEnvAlive(env)), bufferData_(std::move(data)),
-        lossy_(lossy), stripMeta_(stripMeta), useFile_(false),
-        outputPath_(std::move(outputPath)) {}
+        lossy_(lossy), stripMeta_(stripMeta), stripAttach_(stripAttach),
+        useFile_(false), outputPath_(std::move(outputPath)) {}
 
   // file path variant
   CompressWorker(Napi::Env env, std::string path, bool lossy, bool stripMeta,
-                 std::string outputPath)
+                 bool stripAttach, std::string outputPath)
       : Napi::AsyncWorker(env), deferred_(Napi::Promise::Deferred::New(env)),
         envAlive_(GetEnvAlive(env)), filePath_(std::move(path)), lossy_(lossy),
-        stripMeta_(stripMeta), useFile_(true),
+        stripMeta_(stripMeta), stripAttach_(stripAttach), useFile_(true),
         outputPath_(std::move(outputPath)) {}
 
   Napi::Promise Promise() { return deferred_.Promise(); }
@@ -187,7 +187,8 @@ protected:
       coalesceContentStreams(*qpdf);
       minifyContentStreams(*qpdf);
       deduplicateStreams(*qpdf);
-      stripEmbeddedFiles(*qpdf);
+      if (stripAttach_)
+        stripEmbeddedFiles(*qpdf);
       stripJavaScript(*qpdf);
       if (stripMeta_)
         stripMetadata(*qpdf);
@@ -267,6 +268,7 @@ private:
   std::string filePath_;
   bool lossy_;
   bool stripMeta_;
+  bool stripAttach_;
   bool useFile_;
   std::string outputPath_;
   std::shared_ptr<Buffer> writerBuf_;
@@ -287,6 +289,7 @@ static Napi::Value Compress(const Napi::CallbackInfo &info) {
 
   bool lossy = false;
   bool stripMeta = false;
+  bool stripAttach = false;
   std::string outputPath;
 
   if (info.Length() >= 2 && info[1].IsObject()) {
@@ -298,6 +301,9 @@ static Napi::Value Compress(const Napi::CallbackInfo &info) {
     if (options.Has("stripMetadata"))
       stripMeta = options.Get("stripMetadata").As<Napi::Boolean>().Value();
 
+    if (options.Has("stripAttachments"))
+      stripAttach = options.Get("stripAttachments").As<Napi::Boolean>().Value();
+
     if (options.Has("output"))
       outputPath = options.Get("output").As<Napi::String>().Utf8Value();
   }
@@ -306,7 +312,7 @@ static Napi::Value Compress(const Napi::CallbackInfo &info) {
     auto buf = info[0].As<Napi::Buffer<uint8_t>>();
     std::vector<uint8_t> data(buf.Data(), buf.Data() + buf.Length());
     auto *worker = new CompressWorker(env, std::move(data), lossy, stripMeta,
-                                      std::move(outputPath));
+                                      stripAttach, std::move(outputPath));
     worker->Queue();
     return worker->Promise();
   }
@@ -314,7 +320,7 @@ static Napi::Value Compress(const Napi::CallbackInfo &info) {
   if (info[0].IsString()) {
     auto path = info[0].As<Napi::String>().Utf8Value();
     auto *worker = new CompressWorker(env, std::move(path), lossy, stripMeta,
-                                      std::move(outputPath));
+                                      stripAttach, std::move(outputPath));
     worker->Queue();
     return worker->Promise();
   }

package/src/strip.cc

@@ -2,6 +2,7 @@
 
 #include <set>
 #include <string>
+#include <vector>
 
 #include <qpdf/QPDFObjectHandle.hh>
 #include <qpdf/QPDFPageDocumentHelper.hh>
@@ -45,24 +46,69 @@ void stripMetadata(QPDF &qpdf) {
 }
 
 // ---------------------------------------------------------------------------
-// Embedded file stripping — remove /EmbeddedFiles from the name tree
+// Embedded file stripping — remove every path an attachment is reachable
+// through
 // ---------------------------------------------------------------------------
 
+static void removeAssociatedFiles(QPDFObjectHandle obj) {
+  auto dict = obj.isStream() ? obj.getDict() : obj;
+  if (dict.isDictionary() && dict.hasKey("/AF"))
+    dict.removeKey("/AF");
+}
+
+// an embedded file stream is reachable three ways: the /EmbeddedFiles name
+// tree, an /AF associated-files array (PDF/A-3 and PDF 2.0), and a
+// /FileAttachment annotation. Dropping only the name tree leaves the payload
+// in the file and fully recoverable while hiding it from readers that look
+// attachments up by name, so all three have to go — once nothing references
+// the file specification, the writer drops it and its stream as unreferenced.
 void stripEmbeddedFiles(QPDF &qpdf) {
   auto root = qpdf.getRoot();
-  if (!root.hasKey("/Names"))
-    return;
 
-  auto names = root.getKey("/Names");
-  if (!names.isDictionary())
-    return;
+  if (root.hasKey("/Names")) {
+    auto names = root.getKey("/Names");
+    if (names.isDictionary()) {
+      if (names.hasKey("/EmbeddedFiles"))
+        names.removeKey("/EmbeddedFiles");
+
+      // if /Names is now empty, remove it too
+      if (names.getKeys().empty())
+        root.removeKey("/Names");
+    }
+  }
+
+  // /AF may hang off the catalog, a page, an XObject, or an annotation
+  for (auto &obj : qpdf.getAllObjects())
+    removeAssociatedFiles(obj);
+
+  for (auto &page : QPDFPageDocumentHelper(qpdf).getAllPages()) {
+    auto pageObj = page.getObjectHandle();
+    auto annots = pageObj.getKey("/Annots");
+    if (!annots.isArray())
+      continue;
+
+    std::vector<QPDFObjectHandle> kept;
+    for (int i = 0; i < annots.getArrayNItems(); ++i) {
+      auto annot = annots.getArrayItem(i);
+      // a directly embedded annotation dictionary is not an object of its own,
+      // so the sweep above does not reach it
+      removeAssociatedFiles(annot);
+      if (annot.isDictionary()) {
+        auto subtype = annot.getKey("/Subtype");
+        if (subtype.isName() && subtype.getName() == "/FileAttachment")
+          continue;
+      }
+      kept.push_back(annot);
+    }
 
-  if (names.hasKey("/EmbeddedFiles"))
-    names.removeKey("/EmbeddedFiles");
+    if (static_cast<int>(kept.size()) == annots.getArrayNItems())
+      continue;
 
-  // if /Names is now empty, remove it too
-  if (names.getKeys().empty())
-    root.removeKey("/Names");
+    if (kept.empty())
+      pageObj.removeKey("/Annots");
+    else
+      pageObj.replaceKey("/Annots", QPDFObjectHandle::newArray(kept));
+  }
 }
 
 // ---------------------------------------------------------------------------