The engines

Orifold composes several local engines behind protocol seams, each doing the job it’s best at — none of them a remote service.

PDFKit — composition

Apple’s native framework owns PDFView, PDFDocument, PDFPage, PDFAnnotation, selection, search, printing, and workspace page ownership. It’s the UI and document engine everything else supports.

PDFium — page inspection, object editing, compression & text geometry

A supplemental local backend vendored at Packages/PDFiumBinary as a prebuilt XCFramework (MIT, built from Chromium’s PDFium). It does five jobs:

Shared page inspection — one retained snapshot per admitted PageRef/canonical-member revision derives text render modes, thin-rule graphics, and editable image/shape/object metadata. Per-revision and process-wide page/cost ceilings fail closed instead of evicting and rescanning accepted snapshots.
Structural object editing — moving, resizing, restacking, and deleting page objects by mutating the real content stream, followed by a color-preserving regenerate/save pass.
Image compression — downsampling and re-encoding embedded images during a compression pass.
Import validation — a non-blocking smoke check; if PDFium is unavailable or rejects a file PDFKit can open, the PDFKit import path still proceeds. PDFium never blocks an import PDFKit is willing to handle.
Glyph geometry — reporting the raw affine transforms of text runs so in-place text editing lands in exactly the right place.

Committed text and object operations are materialized by WorkspaceEditReplayEngine from one canonical member base. PDFium applies the object lane; CoreGraphics emits transparent text-only overlay pages that PDFium imports as Form XObjects; qpdf copies live annotations and form state without touching page contents; and a final PDFium SaveAsCopy writes rotations plus combined per-page stamps. PDFKit-serialized live bytes may source annotations and form values, but they never become the replay destination’s page-content base.

qpdf — repair, encryption, sanitize, validation

Apache-2.0, statically linked, vendored as a universal arm64/x86_64 library at Packages/QPDFBinary — no external process, no network call. qpdf powers:

Repairing corrupt PDFs on import (reconstructing cross-reference tables).
Real AES-256 (PDF 2.0 / R6) password protection.
A lossless structural compression pass (object-stream repacking).
Sanitize-for-sharing (stripping auto-run actions, embedded JavaScript, embedded files).
The structural check gating every export.

Vision — OCR

Apple’s Vision framework recognizes text in scanned pages entirely on-device, writing it back as searchable text validated before it enters the workspace.

Signing — digital signatures

Not a third-party engine but Orifold’s own pipeline (Signing/): it resolves a Digital ID (imported .p12, Keychain, or self-signed), then constructs a detached CMS/PAdES signature (ETSI.CAdES.detached, SHA-256) as an append-only incremental update, optionally embedding an RFC-3161 timestamp from a TSA. Certificate trust and revocation are evaluated locally. See the Developer FAQ for the byte-level detail.