pdfast

Pure-Go PDF reader — open, extract text/content, optional security stratum, sanitize rewrite.

CGO_ENABLED=0. Hot path is stdlib + zero-copy slices. Decode kernels (CCITT, LZW, TrueType cmap/hmtx) are sgoiter C→Go 1.27.

Not a document writer. For Markdown → PDF/office, use DoWi55 / DocWrite (hpdf55 + richdoc55).
Public module: github.com/hazyhaar/pdfast.

---

What it does

Capability	API (package root)	Notes
Open PDF	Open / OpenFile	Default = core (no full-file active scan)
Security opt-in	WithSecurity(true), WithActivePolicy(...)	Scan + optional obliterate / reject
Page content streams	ExtractContent	Decompressed operators
Native text	ExtractText	Strict by default (ErrExtractPartial)
Clean rewrite	Saniscribe / SaniscribeFile	Drop hazards, keep layout
Validate flags	Validate / ValidateFile	Full-file scan when used

Encrypt and polyglot payloads fail at open. Contract: V1.md. Engines: docs/ENGINES.md.

---

Quick start

import "github.com/hazyhaar/pdfast"

doc, err := pdfast.OpenFile(path) // core engine
doc, err := pdfast.OpenFile(path, pdfast.WithSecurity(true)) // untrusted

pages, err := pdfast.ExtractContent(ctx, doc)
pages, err := pdfast.ExtractText(ctx, doc)
out, err := pdfast.Saniscribe(ctx, doc)

CGO_ENABLED=0 go test ./...
go run ./cmd/benchcmp -mode engine -dir testdata/corpus_prod   # optional

---

Transpiled engines (sgoiter)

Do not hand-edit gen_*.go. Regenerate with sgoiter -in … -out ….

Package	Role
internal/ccitt55	CCITTFaxDecode (G3/G4)
internal/lzw55	LZWDecode (TIFF/PDF EarlyChange)
internal/tt55	Embedded font cmap + hmtx

---

Architecture

OpenFile → xref + lazy object store → optional security
Extract* → page tree → filter.Decode* → content / font resolver
Saniscribe → rewrite without active catalog hazards

---

Benchmarks

See testdata/BENCH_PUB.md / bench/pub/ when present. Re-run cmd/benchcmp before external claims. Default path (core) and security mode must not be mixed in one headline number.

---

Security

• Default: structural integrity; no mandatory full-file active scan.
• WithSecurity(true): active-content checks; default obliterate catalog hazards in memory.
• Fail-closed on hard tokens per policy.
• Semantic / prompt-injection filtering is the caller’s job.

---

Related

Project	Role
pdfast55 / pdfast	Read, extract, sanitize
hpdf55 / DoWi55	Write PDFs + agent DocWrite

---

Contributors

• Hazyhaar (@hazyhaar) — Architecture, system design & maintainer
• Gemini (Google DeepMind) — Adversarial audits, research & verification
• Grok (xAI) — Low-level robustness, protocol inspection & fuzzing
• Claude (Anthropic) — Go 1.27 SIMD transpiler passes, LZW/CCITT kernels & CUE formal schemas

---

License

MIT for wrappers and Go code. Upstream C retains original licenses (typically PD/MIT for stb and tinyexpr).