@awacloud/pdf 0.0.0-stage → 1.0.0

package/src/content/ops.js

@@ -0,0 +1,137 @@
+// Copyright (c) 2026 AwaCloud SAS
+// Author: Matthieu Bouilloux
+// SPDX-License-Identifier: AGPL-3.0-only
+// Dual-licensed; see the NOTICE file for licensing and any additional terms.
+
+/**
+ * @fileoverview Catalogue exhaustif des opérateurs de content stream
+ * PDF per ISO 32000-2:2020 §8.2 / §9.4.
+ *
+ * Chaque entrée décrit :
+ * - `op`        — le mnémonique exact (string).
+ * - `category`  — `'gstate'|'path'|'clip'|'paint'|'color'|'text'|'shading'|'xobject'|'marked'|'image'`.
+ * - `arity`     — nombre d'opérandes attendus, ou `'var'` pour TJ.
+ * - `desc`      — courte description (anglais, mots-clés OK).
+ *
+ * @module pdf/content/ops
+ */
+
+/**
+ * Module factory — worker-safe, self-contained.
+ */
+export const pdfContentOps = {
+    name: 'pdfContentOps',
+    dependencies: [],
+    factory() {
+        const OPS = Object.freeze({
+            // --- Graphics state (§8.4) ---
+            q:    { op: 'q',    category: 'gstate',  arity: 0,  desc: 'push graphics state' },
+            Q:    { op: 'Q',    category: 'gstate',  arity: 0,  desc: 'pop graphics state' },
+            cm:   { op: 'cm',   category: 'gstate',  arity: 6,  desc: 'concatenate CTM (a b c d e f)' },
+            w:    { op: 'w',    category: 'gstate',  arity: 1,  desc: 'set line width' },
+            J:    { op: 'J',    category: 'gstate',  arity: 1,  desc: 'set line cap style' },
+            j:    { op: 'j',    category: 'gstate',  arity: 1,  desc: 'set line join style' },
+            M:    { op: 'M',    category: 'gstate',  arity: 1,  desc: 'set miter limit' },
+            d:    { op: 'd',    category: 'gstate',  arity: 2,  desc: 'set dash pattern' },
+            ri:   { op: 'ri',   category: 'gstate',  arity: 1,  desc: 'set rendering intent' },
+            i:    { op: 'i',    category: 'gstate',  arity: 1,  desc: 'set flatness tolerance' },
+            gs:   { op: 'gs',   category: 'gstate',  arity: 1,  desc: 'set parameters from /ExtGState' },
+
+            // --- Path construction (§8.5.2) ---
+            m:    { op: 'm',    category: 'path',    arity: 2,  desc: 'moveto' },
+            l:    { op: 'l',    category: 'path',    arity: 2,  desc: 'lineto' },
+            c:    { op: 'c',    category: 'path',    arity: 6,  desc: 'cubic Bézier (x1 y1 x2 y2 x3 y3)' },
+            v:    { op: 'v',    category: 'path',    arity: 4,  desc: 'cubic Bézier (current to x2 y2 x3 y3)' },
+            y:    { op: 'y',    category: 'path',    arity: 4,  desc: 'cubic Bézier (x1 y1 to x3 y3)' },
+            h:    { op: 'h',    category: 'path',    arity: 0,  desc: 'close subpath' },
+            re:   { op: 're',   category: 'path',    arity: 4,  desc: 'append rectangle' },
+
+            // --- Path painting (§8.5.3) ---
+            S:    { op: 'S',    category: 'paint',   arity: 0,  desc: 'stroke' },
+            s:    { op: 's',    category: 'paint',   arity: 0,  desc: 'close + stroke' },
+            f:    { op: 'f',    category: 'paint',   arity: 0,  desc: 'fill (non-zero)' },
+            F:    { op: 'F',    category: 'paint',   arity: 0,  desc: 'fill (non-zero, deprecated alias)' },
+            'f*': { op: 'f*',   category: 'paint',   arity: 0,  desc: 'fill (even-odd)' },
+            B:    { op: 'B',    category: 'paint',   arity: 0,  desc: 'fill + stroke (non-zero)' },
+            'B*': { op: 'B*',   category: 'paint',   arity: 0,  desc: 'fill + stroke (even-odd)' },
+            b:    { op: 'b',    category: 'paint',   arity: 0,  desc: 'close + fill + stroke (non-zero)' },
+            'b*': { op: 'b*',   category: 'paint',   arity: 0,  desc: 'close + fill + stroke (even-odd)' },
+            n:    { op: 'n',    category: 'paint',   arity: 0,  desc: 'end path (no paint, no clip)' },
+
+            // --- Clipping paths (§8.5.4) ---
+            W:    { op: 'W',    category: 'clip',    arity: 0,  desc: 'modify clipping (non-zero)' },
+            'W*': { op: 'W*',   category: 'clip',    arity: 0,  desc: 'modify clipping (even-odd)' },
+
+            // --- Color (§8.6) ---
+            CS:   { op: 'CS',   category: 'color',   arity: 1,  desc: 'set stroking color space' },
+            cs:   { op: 'cs',   category: 'color',   arity: 1,  desc: 'set non-stroking color space' },
+            SC:   { op: 'SC',   category: 'color',   arity: 'var', desc: 'set stroking color (no name)' },
+            sc:   { op: 'sc',   category: 'color',   arity: 'var', desc: 'set non-stroking color (no name)' },
+            SCN:  { op: 'SCN',  category: 'color',   arity: 'var', desc: 'set stroking color (with name for pattern/separation)' },
+            scn:  { op: 'scn',  category: 'color',   arity: 'var', desc: 'set non-stroking color (with name)' },
+            G:    { op: 'G',    category: 'color',   arity: 1,  desc: 'set stroking DeviceGray' },
+            g:    { op: 'g',    category: 'color',   arity: 1,  desc: 'set non-stroking DeviceGray' },
+            RG:   { op: 'RG',   category: 'color',   arity: 3,  desc: 'set stroking DeviceRGB' },
+            rg:   { op: 'rg',   category: 'color',   arity: 3,  desc: 'set non-stroking DeviceRGB' },
+            K:    { op: 'K',    category: 'color',   arity: 4,  desc: 'set stroking DeviceCMYK' },
+            k:    { op: 'k',    category: 'color',   arity: 4,  desc: 'set non-stroking DeviceCMYK' },
+
+            // --- Shading (§8.7) ---
+            sh:   { op: 'sh',   category: 'shading', arity: 1,  desc: 'paint shading pattern' },
+
+            // --- Inline images (§8.9.7) ---
+            BI:   { op: 'BI',   category: 'image',   arity: 0,  desc: 'begin inline image' },
+            ID:   { op: 'ID',   category: 'image',   arity: 0,  desc: 'inline image data marker' },
+            EI:   { op: 'EI',   category: 'image',   arity: 0,  desc: 'end inline image' },
+
+            // --- XObject (§8.10) ---
+            Do:   { op: 'Do',   category: 'xobject', arity: 1,  desc: 'invoke XObject' },
+
+            // --- Marked content (§14.6) ---
+            MP:   { op: 'MP',   category: 'marked',  arity: 1,  desc: 'marked content point' },
+            DP:   { op: 'DP',   category: 'marked',  arity: 2,  desc: 'marked content point with property list' },
+            BMC:  { op: 'BMC',  category: 'marked',  arity: 1,  desc: 'begin marked content' },
+            BDC:  { op: 'BDC',  category: 'marked',  arity: 2,  desc: 'begin marked content with property list' },
+            EMC:  { op: 'EMC',  category: 'marked',  arity: 0,  desc: 'end marked content' },
+
+            // --- Text objects + state (§9.3 / §9.4) ---
+            BT:   { op: 'BT',   category: 'text',    arity: 0,  desc: 'begin text object' },
+            ET:   { op: 'ET',   category: 'text',    arity: 0,  desc: 'end text object' },
+            Tc:   { op: 'Tc',   category: 'text',    arity: 1,  desc: 'set character spacing' },
+            Tw:   { op: 'Tw',   category: 'text',    arity: 1,  desc: 'set word spacing' },
+            Tz:   { op: 'Tz',   category: 'text',    arity: 1,  desc: 'set horizontal scaling (percent)' },
+            TL:   { op: 'TL',   category: 'text',    arity: 1,  desc: 'set leading' },
+            Tf:   { op: 'Tf',   category: 'text',    arity: 2,  desc: 'set text font + size' },
+            Tr:   { op: 'Tr',   category: 'text',    arity: 1,  desc: 'set text rendering mode' },
+            Ts:   { op: 'Ts',   category: 'text',    arity: 1,  desc: 'set text rise' },
+
+            // --- Text positioning ---
+            Td:   { op: 'Td',   category: 'text',    arity: 2,  desc: 'move text position' },
+            TD:   { op: 'TD',   category: 'text',    arity: 2,  desc: 'move + set leading' },
+            Tm:   { op: 'Tm',   category: 'text',    arity: 6,  desc: 'set text matrix' },
+            'T*': { op: 'T*',   category: 'text',    arity: 0,  desc: 'move to next line' },
+
+            // --- Text showing ---
+            Tj:   { op: 'Tj',   category: 'text',    arity: 1,  desc: 'show text' },
+            "'":  { op: "'",    category: 'text',    arity: 1,  desc: 'next-line + show' },
+            '"':  { op: '"',    category: 'text',    arity: 3,  desc: 'aw ac string : set spacing + next line + show' },
+            TJ:   { op: 'TJ',   category: 'text',    arity: 1,  desc: 'show text with positioning array' },
+
+            // --- Type3 font glyph metrics ---
+            d0:   { op: 'd0',   category: 'gstate',  arity: 2,  desc: 'Type3: set glyph width (no bbox)' },
+            d1:   { op: 'd1',   category: 'gstate',  arity: 6,  desc: 'Type3: set glyph width + bbox' }
+        });
+
+        const OP_NAMES = Object.freeze(Object.keys(OPS).sort());
+
+        function lookupOp(mnemonic) {
+            return OPS[mnemonic];
+        }
+
+        function isOp(mnemonic) {
+            return Object.prototype.hasOwnProperty.call(OPS, mnemonic);
+        }
+
+        return { OPS, OP_NAMES, lookupOp, isOp };
+    }
+};

package/src/content/stream.js

@@ -0,0 +1,154 @@
+// Copyright (c) 2026 AwaCloud SAS
+// Author: Matthieu Bouilloux
+// SPDX-License-Identifier: AGPL-3.0-only
+// Dual-licensed; see the NOTICE file for licensing and any additional terms.
+
+/**
+ * @fileoverview Content stream parser per ISO 32000-2:2020 §7.8 + §8.2.
+ *
+ * Reads a `Uint8Array` of content-stream bytes (the result of decoding
+ * any `/Filter` chain on a page's `/Contents` stream) and produces an
+ * ordered list of operations.
+ *
+ * Inline images (`BI ... ID ... EI`) are captured as one synthetic
+ * operation `{ op: 'BI', args: [{type:'dict', entries}], data: Uint8Array }`.
+ *
+ * @module pdf/content/stream
+ */
+
+/**
+ * Module factory — worker-safe, self-contained.
+ *
+ * Note: `pdfParser` and `pdfContentOps` are declared as dependencies for
+ * forward-looking DI; the current shim materialises a tokenizer+parser
+ * directly. When called via the runtime with empty-stub deps, the shim
+ * fallbacks are used.
+ */
+import { pdfErrors } from '../errors.js';
+import { pdfParser } from '../syntax/parser.js';
+import { pdfContentOps } from './ops.js';
+
+export const pdfContentStream = {
+    name: 'pdfContentStream',
+    dependencies: ['pdfErrors', 'pdfParser', 'pdfContentOps'],
+    deps: [pdfErrors, pdfParser, pdfContentOps],
+    factory(errors, parserMod, opsMod) {
+        const { ParseError } = errors;
+
+        const SP = 0x20, HT = 0x09, LF = 0x0A, CR = 0x0D;
+        const E = 0x45, I = 0x49;
+
+        // `parserMod` must expose `tokenize` + `parseObject` (the shim
+        // below materialises a compound object that satisfies this).
+        // `opsMod` must expose `isOp`.
+        const tokenize    = parserMod && parserMod.tokenize;
+        const parseObject = parserMod && parserMod.parseObject;
+        const isOp        = opsMod    && opsMod.isOp;
+
+        function isWsByte(b) {
+            return b === SP || b === HT || b === LF || b === CR || b === 0x0C || b === 0x00;
+        }
+
+        function findInlineImageEnd(bytes, from) {
+            for (let i = from; i < bytes.length - 1; i++) {
+                if (bytes[i] === E && bytes[i + 1] === I) {
+                    const prev = i > 0 ? bytes[i - 1] : SP;
+                    const next = i + 2 < bytes.length ? bytes[i + 2] : SP;
+                    if (isWsByte(prev) && (isWsByte(next) || i + 2 === bytes.length)) {
+                        let end = i;
+                        if (end > from && isWsByte(bytes[end - 1])) end--;
+                        return { dataEnd: end, eiEnd: i + 2 };
+                    }
+                }
+            }
+            return null;
+        }
+
+        function readInlineImage(tok, bytes) {
+            const entries = {};
+            for (;;) {
+                const t = tok.peek();
+                if (!t) {
+                    throw new ParseError('pdf/content/inline-image/no-ID',
+                        'inline image missing ID marker');
+                }
+                if (t.kind === 'kw' && t.value === 'ID') {
+                    tok.next();
+                    break;
+                }
+                if (t.kind !== 'name') {
+                    throw new ParseError('pdf/content/inline-image/bad-key',
+                        'inline image dict keys must be names',
+                        { context: { offset: t.offset, kind: t.kind } });
+                }
+                const key = tok.next().value;
+                entries[key] = parseObject(tok);
+            }
+            let p = tok.pos();
+            if (p < bytes.length && (bytes[p] === SP || bytes[p] === HT
+                                      || bytes[p] === LF || bytes[p] === CR)) {
+                p++;
+            }
+            const dataStart = p;
+            const located = findInlineImageEnd(bytes, dataStart);
+            if (!located) {
+                throw new ParseError('pdf/content/inline-image/no-EI',
+                    'inline image missing EI marker',
+                    { context: { dataStart } });
+            }
+            tok.seek(located.eiEnd);
+            return {
+                op: 'BI',
+                args: [{ type: 'dict', entries }],
+                data: bytes.subarray(dataStart, located.dataEnd)
+            };
+        }
+
+        function parseContentStream(bytes) {
+            if (!(bytes instanceof Uint8Array)) {
+                throw new ParseError('pdf/content/bad-input',
+                    'parseContentStream expects Uint8Array',
+                    { context: { typeof: typeof bytes } });
+            }
+            const tok = tokenize(bytes);
+            const out = [];
+            let argStack = [];
+
+            for (;;) {
+                const t = tok.peek();
+                if (!t) break;
+                if (t.kind === 'kw') {
+                    if (t.value === 'true' || t.value === 'false' || t.value === 'null') {
+                        argStack.push(parseObject(tok));
+                        continue;
+                    }
+                    if (t.value === 'BI') {
+                        tok.next();
+                        const inline = readInlineImage(tok, bytes);
+                        argStack = [];
+                        out.push(inline);
+                        continue;
+                    }
+                    if (!isOp(t.value)) {
+                        throw new ParseError('pdf/content/unknown-op',
+                            `unknown content-stream operator "${t.value}"`,
+                            { context: { offset: t.offset, op: t.value } });
+                    }
+                    tok.next();
+                    out.push({ op: t.value, args: argStack });
+                    argStack = [];
+                    continue;
+                }
+                argStack.push(parseObject(tok));
+            }
+
+            if (argStack.length > 0) {
+                out.push({ op: '__trailing__', args: argStack });
+            }
+
+            return out;
+        }
+
+        return { parseContentStream };
+    }
+};

package/src/content/text.js

@@ -0,0 +1,125 @@
+// Copyright (c) 2026 AwaCloud SAS
+// Author: Matthieu Bouilloux
+// SPDX-License-Identifier: AGPL-3.0-only
+// Dual-licensed; see the NOTICE file for licensing and any additional terms.
+
+/**
+ * @fileoverview Text state + positioning per ISO 32000-2:2020 §9.3 / §9.4.
+ *
+ * Provides operators that mutate `gstate.text` and helpers for the
+ * text-object matrices Tm + Tlm (text matrix + text line matrix).
+ *
+ * Text-showing operators (`Tj`, `TJ`, `'`, `"`) **do not** decode the
+ * glyph stream into Unicode here — that requires the font's ToUnicode
+ * CMap, which lives in `@awacloud/fonts/cmap-to-unicode`. The high-level
+ * `extractText` helper takes a resolved `Font` + a ToUnicode mapping
+ * function and produces a `string`.
+ *
+ * @module pdf/content/text
+ */
+
+/**
+ * Module factory — worker-safe, self-contained.
+ */
+import { pdfErrors } from '../errors.js';
+
+export const pdfText = {
+    name: 'pdfText',
+    dependencies: ['pdfErrors'],
+    deps: [pdfErrors],
+    factory(errors) {
+        const { ContractError } = errors;
+
+        function mul(a, b) {
+            return [
+                a[0] * b[0] + a[1] * b[2],
+                a[0] * b[1] + a[1] * b[3],
+                a[2] * b[0] + a[3] * b[2],
+                a[2] * b[1] + a[3] * b[3],
+                a[4] * b[0] + a[5] * b[2] + b[4],
+                a[4] * b[1] + a[5] * b[3] + b[5]
+            ];
+        }
+
+        function setFont(gstate, fontResource, size) {
+            gstate.text.font     = fontResource;
+            gstate.text.fontSize = size;
+        }
+
+        function beginTextObject() {
+            return {
+                Tm:  [1, 0, 0, 1, 0, 0],
+                Tlm: [1, 0, 0, 1, 0, 0]
+            };
+        }
+
+        function td(state, tx, ty) {
+            state.Tlm = mul([1, 0, 0, 1, tx, ty], state.Tlm);
+            state.Tm  = state.Tlm.slice();
+        }
+
+        function tdSetLeading(gstate, state, tx, ty) {
+            gstate.text.leading = -ty;
+            td(state, tx, ty);
+        }
+
+        function setTextMatrix(state, m) {
+            if (!Array.isArray(m) || m.length !== 6) {
+                throw new ContractError('pdf/text/bad-matrix',
+                    'Tm matrix must have 6 elements');
+            }
+            state.Tm  = m.slice();
+            state.Tlm = m.slice();
+        }
+
+        function nextLine(gstate, state) {
+            td(state, 0, -gstate.text.leading);
+        }
+
+        function rawStringBytes(stringObj) {
+            if (!stringObj || stringObj.type !== 'string') {
+                throw new ContractError('pdf/text/bad-string',
+                    'expected typed string operand',
+                    { context: { type: stringObj && stringObj.type } });
+            }
+            return stringObj.value;
+        }
+
+        function extractText(op, font, cidToUnicode) {
+            const cidBytes = (font && font.subtype === 'Type0') ? 2 : 1;
+            let text = '';
+            const collect = (strObj) => {
+                const bytes = rawStringBytes(strObj);
+                for (let i = 0; i + cidBytes <= bytes.length; i += cidBytes) {
+                    let cid = 0;
+                    for (let k = 0; k < cidBytes; k++) cid = (cid << 8) | bytes[i + k];
+                    const u = cidToUnicode(cid);
+                    text += (typeof u === 'string') ? u : '�';
+                }
+            };
+            if (op.op === 'Tj' || op.op === "'") {
+                collect(op.args[0]);
+            } else if (op.op === '"') {
+                collect(op.args[2]);
+            } else if (op.op === 'TJ') {
+                const arr = op.args[0];
+                if (!arr || arr.type !== 'array') return '';
+                for (const it of arr.items) {
+                    if (it.type === 'string') collect(it);
+                }
+            }
+            return text;
+        }
+
+        return {
+            setFont,
+            beginTextObject,
+            td,
+            tdSetLeading,
+            setTextMatrix,
+            nextLine,
+            rawStringBytes,
+            extractText
+        };
+    }
+};

package/src/crypto/aesGcm.js

@@ -0,0 +1,123 @@
+// Copyright (c) 2026 AwaCloud SAS
+// Author: Matthieu Bouilloux
+// SPDX-License-Identifier: AGPL-3.0-only
+// Dual-licensed; see the NOTICE file for licensing and any additional terms.
+
+/**
+ * @fileoverview ISO/TS 32003 AES-GCM wrapper for PDF object encryption.
+ *
+ * TS 32003 amends ISO 32000-2 to permit AES-GCM (CFM = `AESV4`) as an
+ * alternative cipher to AES-CBC in the Standard Security Handler v6.
+ * Wire format:
+ *     IV (12 bytes) ‖ ciphertext (n bytes) ‖ tag (16 bytes)
+ *
+ * @module pdf/crypto/aesGcm
+ */
+
+/**
+ * Module factory — worker-safe, self-contained.
+ */
+import { pdfErrors } from '../errors.js';
+import { aes } from '@awacloud/fw/crypto/cipher/aes.js';
+import { gcm } from '@awacloud/fw/crypto/mode/gcm.js';
+import { bitArray } from '@awacloud/fw/crypto/utils/bitArray.js';
+
+export const pdfAesGcm = {
+    name: 'pdfAesGcm',
+    dependencies: ['pdfErrors', 'aes', 'gcm', 'bitArray'],
+    deps: [pdfErrors, aes, gcm, bitArray],
+    factory(errors, aes, gcm, bitArray) {
+        const { EncryptionError } = errors;
+
+        function bytesToWords(b, off, len) {
+            const n = len >>> 2;
+            const out = new Array(n);
+            for (let i = 0; i < n; i++) {
+                const j = off + (i << 2);
+                out[i] = ((b[j] << 24) | (b[j + 1] << 16) | (b[j + 2] << 8) | b[j + 3]) | 0;
+            }
+            return out;
+        }
+
+        if (!aes || !gcm || !bitArray) {
+            throw new EncryptionError('pdf/crypto/gcm/missing-fw',
+                'pdfAesGcm requires aes, gcm, bitArray fw modules');
+        }
+
+        function buildCipher(fek) {
+            if (!(fek instanceof Uint8Array) || fek.length !== 32) {
+                throw new EncryptionError('pdf/crypto/gcm/bad-fek',
+                    'File Encryption Key must be 32 bytes (AES-256)',
+                    { context: { length: fek && fek.length } });
+            }
+            const c = aes.fn(bytesToWords(fek, 0, 32), false);
+            if (c === false) {
+                throw new EncryptionError('pdf/crypto/gcm/aes-schedule-failed',
+                    'AES-256 key schedule failed');
+            }
+            return c;
+        }
+
+        function decryptObjectGcm(fek, framed) {
+            if (!(framed instanceof Uint8Array) || framed.length < 12 + 16) {
+                throw new EncryptionError('pdf/crypto/gcm/bad-input',
+                    'AES-GCM framed input must be at least 28 bytes (IV + tag)');
+            }
+            const cipher = buildCipher(fek);
+            const iv = framed.subarray(0, 12);
+            const tag = framed.subarray(framed.length - 16);
+            const ct  = framed.subarray(12, framed.length - 16);
+            const pt = gcm.decrypt(
+                cipher,
+                bitArray.ui8_to_ba(ct),
+                bitArray.ui8_to_ba(iv),
+                [],
+                bitArray.ui8_to_ba(tag),
+                128
+            );
+            if (pt === false) {
+                throw new EncryptionError('pdf/crypto/gcm/tag-mismatch',
+                    'AES-GCM authentication tag mismatch');
+            }
+            return bitArray.ba_to_ui8(pt);
+        }
+
+        function encryptObjectGcm(fek, plaintext, ivProvider) {
+            if (!(plaintext instanceof Uint8Array)) {
+                throw new EncryptionError('pdf/crypto/gcm/bad-plaintext',
+                    'plaintext must be Uint8Array');
+            }
+            if (typeof ivProvider !== 'function') {
+                throw new EncryptionError('pdf/crypto/gcm/bad-iv-provider',
+                    'ivProvider must be a function returning 12 bytes');
+            }
+            const iv = ivProvider();
+            if (!(iv instanceof Uint8Array) || iv.length !== 12) {
+                throw new EncryptionError('pdf/crypto/gcm/bad-iv',
+                    'ivProvider must return exactly 12 bytes (96-bit nonce)',
+                    { context: { length: iv && iv.length } });
+            }
+            const cipher = buildCipher(fek);
+            const res = gcm.encrypt(
+                cipher,
+                bitArray.ui8_to_ba(plaintext),
+                bitArray.ui8_to_ba(iv),
+                [],
+                128
+            );
+            if (res === false) {
+                throw new EncryptionError('pdf/crypto/gcm/encrypt-failed',
+                    'AES-GCM encryption failed');
+            }
+            const ct = bitArray.ba_to_ui8(res.ct);
+            const tag = bitArray.ba_to_ui8(res.tag);
+            const out = new Uint8Array(12 + ct.length + 16);
+            out.set(iv, 0);
+            out.set(ct, 12);
+            out.set(tag, 12 + ct.length);
+            return out;
+        }
+
+        return { encryptObjectGcm, decryptObjectGcm };
+    }
+};

package/src/crypto/permissions.js

@@ -0,0 +1,112 @@
+// Copyright (c) 2026 AwaCloud SAS
+// Author: Matthieu Bouilloux
+// SPDX-License-Identifier: AGPL-3.0-only
+// Dual-licensed; see the NOTICE file for licensing and any additional terms.
+
+/**
+ * @fileoverview PDF permission flag decoding + /Perms field validation.
+ *
+ * Per ISO 32000-2:2020 Table 24, the /P value in the /Encrypt dictionary is
+ * a signed 32-bit integer whose individual bits convey user access
+ * permissions. For Security Handler v5/v6 the /Perms field (16 bytes,
+ * AES-256-ECB single block, no IV) is decrypted with the File Encryption
+ * Key and validated against /P (Algorithm 13, ISO 32000-2 §7.6.4.5).
+ *
+ * @module pdf/crypto/permissions
+ */
+
+/**
+ * Module factory — worker-safe, self-contained.
+ */
+import { pdfErrors } from '../errors.js';
+import { aes } from '@awacloud/fw/crypto/cipher/aes.js';
+
+export const pdfPermissions = {
+    name: 'pdfPermissions',
+    dependencies: ['pdfErrors', 'aes'],
+    deps: [pdfErrors, aes],
+    factory(errors, aesFw) {
+        const { EncryptionError } = errors;
+
+        function bytesToWords(b, off, len) {
+            const n = len >>> 2;
+            const out = new Array(n);
+            for (let i = 0; i < n; i++) {
+                const j = off + (i << 2);
+                out[i] = ((b[j] << 24) | (b[j + 1] << 16) | (b[j + 2] << 8) | b[j + 3]) | 0;
+            }
+            return out;
+        }
+
+        function wordsToBytes(w, into, off) {
+            for (let i = 0; i < w.length; i++) {
+                const j = off + (i << 2);
+                into[j]     = (w[i] >>> 24) & 0xff;
+                into[j + 1] = (w[i] >>> 16) & 0xff;
+                into[j + 2] = (w[i] >>>  8) & 0xff;
+                into[j + 3] =  w[i]         & 0xff;
+            }
+        }
+
+        function decodePermissions(p) {
+            if (typeof p !== 'number' || !Number.isInteger(p)) {
+                throw new EncryptionError('pdf/crypto/permissions/bad-input',
+                    '/P must be a 32-bit integer',
+                    { context: { p } });
+            }
+            const v = p | 0;
+            return {
+                raw: v,
+                print:            (v & 0x004) !== 0,
+                modify:           (v & 0x008) !== 0,
+                copy:             (v & 0x010) !== 0,
+                annot:            (v & 0x020) !== 0,
+                formFill:         (v & 0x100) !== 0,
+                accessible:       (v & 0x200) !== 0,
+                assemble:         (v & 0x400) !== 0,
+                printHighQuality: (v & 0x800) !== 0
+            };
+        }
+
+        if (!aesFw || typeof aesFw.fn !== 'function') {
+            throw new EncryptionError('pdf/crypto/permissions/missing-fw',
+                'pdfPermissions requires the fw aes factory');
+        }
+
+        function verifyPermsField(typedEncrypt, fek) {
+            if (!typedEncrypt || !typedEncrypt.Perms) {
+                throw new EncryptionError('pdf/crypto/permissions/missing-perms',
+                    '/Perms entry absent in /Encrypt dictionary');
+            }
+            const perms = typedEncrypt.Perms;
+            if (!(perms instanceof Uint8Array) || perms.length !== 16) {
+                throw new EncryptionError('pdf/crypto/permissions/bad-perms-length',
+                    '/Perms must be a 16-byte string',
+                    { context: { length: perms && perms.length } });
+            }
+            if (!(fek instanceof Uint8Array) || fek.length !== 32) {
+                throw new EncryptionError('pdf/crypto/permissions/bad-fek',
+                    'File Encryption Key must be 32 bytes for AES-256',
+                    { context: { length: fek && fek.length } });
+            }
+            const cipher = aesFw.fn(bytesToWords(fek, 0, 32), true);
+            if (cipher === false || typeof cipher.decrypt !== 'function') {
+                throw new EncryptionError('pdf/crypto/permissions/aes-schedule-failed',
+                    'AES-256 key schedule failed for /Perms verification');
+            }
+            const blk = cipher.decrypt(bytesToWords(perms, 0, 16));
+            if (blk === false) {
+                throw new EncryptionError('pdf/crypto/permissions/aes-decrypt-failed',
+                    'AES-256 block decryption failed for /Perms');
+            }
+            const out = new Uint8Array(16);
+            wordsToBytes(blk, out, 0);
+            const ok = out[9] === 0x61 && out[10] === 0x64 && out[11] === 0x62;
+            const p = ((out[0]) | (out[1] << 8) | (out[2] << 16) | (out[3] << 24)) | 0;
+            const encryptMetadata = out[8] === 0x54;
+            return { ok, p, encryptMetadata };
+        }
+
+        return { decodePermissions, verifyPermsField };
+    }
+};