@chalidade/protect-pdf 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chalid Ade Rahman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,98 @@
-# Temporary Holding Version
+# @chalidade/protect-pdf
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Lock a PDF with a password on any website: one `<script>` tag, one element.
+The PDF is encrypted with **AES-256** (PDF 2.0 security handler, revision 6)
+and can forbid printing, copying text or editing. **Everything runs in the
+visitor's browser** with qpdf compiled to WebAssembly; neither the file nor
+the password leaves the device, and the password is not stored.
+
+This is the [Protect PDF](https://chalidade.github.io/tools/#/protect-pdf) tool from
+[chalidade/tools](https://github.com/chalidade/tools), packaged so you can drop
+it into your own site. Try it there first.
+
+## Install in 10 seconds
+
+Paste this into any HTML page (WordPress, Blogger, Webflow, plain HTML):
+
+```html
+<script type="module" src="https://cdn.jsdelivr.net/npm/@chalidade/protect-pdf@0/dist/element.js"></script>
+
+<protect-pdf></protect-pdf>
+```
+
+`element.js` is 96.10 kB gzipped (React and styles included). The
+heavy libraries are separate files that load only when a visitor uses the
+tool, from the same place as `element.js` (gzipped: qpdf (WebAssembly) ~619 kB).
+The permissions are locked with a random owner password that nobody gets to
+see, so the open password alone cannot lift them in readers that honour them.
+Adobe Reader, browsers and most PDF apps do; some do not.
+
+### Attributes
+
+| Attribute | Value | Default |
+| --- | --- | --- |
+| `theme` | `auto` (follows the system), `light`, `dark` | `auto` |
+| `lang` | `en` or `id`, the UI language | the visitor's browser language |
+
+### Colors
+
+The element uses Shadow DOM, so your site's CSS can't break it (and vice versa).
+Change its accent colors with CSS variables:
+
+```css
+protect-pdf {
+  --sr-brand-1: #0ea5e9; /* accent gradient, light and dark */
+  --sr-brand-2: #6366f1;
+  --radius: 0.5rem;      /* corner radius */
+}
+```
+
+### Content Security Policy
+
+The PDF engines are bundled inside the package as `data:` URLs (no request to
+any other server).
+On a page with a strict CSP, the PDF engines run under this policy (tested in Chrome); add the CDN
+you load `element.js` from to `script-src`:
+
+```
+default-src 'self'; script-src 'self' data: 'wasm-unsafe-eval'; worker-src blob:;
+connect-src 'self' data:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'
+```
+
+## Use with npm
+
+```bash
+npm install @chalidade/protect-pdf
+```
+
+```js
+import '@chalidade/protect-pdf/element' // registers <protect-pdf>
+```
+
+In React, `<protect-pdf theme="light" />` works directly in JSX (React 19
+passes attributes through to custom elements).
+
+## Headless API
+
+No UI: plain async functions for building your own interface. Browser only
+(they use `File`, `Blob` and canvas).
+
+```js
+import { encryptionInfo, protectPdf } from '@chalidade/protect-pdf'
+
+const bytes = new Uint8Array(await file.arrayBuffer())
+const locked = await protectPdf(bytes, 'correct horse', { print: true, copy: false, modify: false })
+await encryptionInfo(locked) // { encrypted: true, needsPassword: true }
+
+// Already encrypted? protectPdf throws AlreadyEncryptedError.
+await protectPdf(locked, 'x', { print: true, copy: true, modify: true }) // throws AlreadyEncryptedError
+```
+
+`pdfinfo` (poppler) on the result: `Encrypted: yes (print:yes copy:no change:no
+addNotes:no algorithm:AES-256)`. The element asks for at least 4 characters;
+`protectPdf` only refuses an empty password, so enforce your own policy.
+
+## License
+
+MIT © Chalid Ade Rahman. The element bundles third-party libraries, see
+[THIRD-PARTY-NOTICES.md](./THIRD-PARTY-NOTICES.md).

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,18 @@
+# Third-party notices
+
+The files in `dist/` bundle the following open-source software, unmodified.
+
+| Package | License | Source |
+| --- | --- | --- |
+| React, React DOM | MIT | https://github.com/facebook/react |
+| lucide-react | ISC | https://github.com/lucide-icons/lucide |
+| Tailwind CSS (compiled styles) | MIT | https://github.com/tailwindlabs/tailwindcss |
+| tw-animate-css | MIT | https://github.com/Wombosvideo/tw-animate-css |
+| clsx | MIT | https://github.com/lukeed/clsx |
+| tailwind-merge | MIT | https://github.com/dcastil/tailwind-merge |
+| class-variance-authority | Apache-2.0 | https://github.com/joe-bell/cva |
+| qpdf, compiled to WebAssembly by @neslinesli93/qpdf-wasm | Apache-2.0 (qpdf), ISC (qpdf-wasm build) | https://github.com/qpdf/qpdf, https://github.com/neslinesli93/qpdf-wasm |
+| libjpeg-turbo (inside the qpdf WebAssembly) | IJG, BSD-3-Clause, Zlib | https://github.com/libjpeg-turbo/libjpeg-turbo |
+| zlib (inside the qpdf WebAssembly) | Zlib | https://zlib.net |
+
+The full license texts are in each project's repository.

package/dist/chunks/protect-Dz2WFVuy.js

@@ -0,0 +1,87 @@
+// \0rolldown/runtime.js
+var e = Object.create, t = Object.defineProperty, n = Object.getOwnPropertyDescriptor, r = Object.getOwnPropertyNames, i = Object.getPrototypeOf, a = Object.prototype.hasOwnProperty, o = (e, t) => () => (t || (e((t = { exports: {} }).exports, t, t.exports), e = null), t.exports), s = (e, i, o, s) => {
+	if (i && typeof i == "object" || typeof i == "function") for (var c = r(i), l = 0, u = c.length, d; l < u; l++) d = c[l], !a.call(e, d) && d !== o && t(e, d, {
+		get: ((e) => i[e]).bind(null, d),
+		enumerable: !(s = n(i, d)) || s.enumerable
+	});
+	return e;
+}, c = (n, r, o) => (o = n == null ? {} : e(i(n)), s(r || !n || !n.__esModule || !a.call(n, "default") ? t(o, "default", {
+	value: n,
+	enumerable: !0
+}) : o, n)), l = "/in", u = "/out";
+async function d(e, t) {
+	let [{ default: n }, { default: r }] = await Promise.all([import("./qpdf-B0sSsX-b.js").then((e) => /* @__PURE__ */ c(e.default, 1)), import("./qpdf-Bycd2-RO.js")]), i = null, a = {
+		log: console.log,
+		error: console.error
+	}, o = (e) => (...t) => i ? i.push(t.map(String).join(" ")) : e(...t);
+	console.log = o(a.log), console.error = o(a.error);
+	let s;
+	try {
+		s = n({
+			locateFile: () => r,
+			noInitialRun: !0
+		});
+	} finally {
+		Object.assign(console, a);
+	}
+	let d = await s;
+	d.FS.writeFile(l, e);
+	let f = [];
+	i = f;
+	let p;
+	try {
+		p = d.callMain(t(l, u));
+	} catch (e) {
+		p = typeof e.status == "number" ? e.status : 2;
+	} finally {
+		i = null;
+	}
+	let m;
+	try {
+		m = d.FS.readFile(u);
+	} catch {}
+	return {
+		code: p,
+		log: f.join("\n"),
+		output: m
+	};
+}
+var f = (e) => /invalid password/i.test(e);
+async function p(e) {
+	let { code: t, log: n } = await d(e, (e) => ["--show-encryption", e]);
+	return f(n) ? {
+		encrypted: !0,
+		needsPassword: !0
+	} : t !== 2 && /not encrypted/i.test(n) ? {
+		encrypted: !1,
+		needsPassword: !1
+	} : {
+		encrypted: t !== 2,
+		needsPassword: !1
+	};
+}
+// ../../src/tools/protect-pdf/protect.ts
+var m = class extends Error {};
+function h() {
+	let e = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(24));
+	return Array.from(e, (e) => e.toString(36).padStart(2, "0")).join("").slice(0, 32);
+}
+async function g(e, t, n) {
+	if (!t) throw Error("password required");
+	if ((await p(e)).encrypted) throw new m();
+	let { code: r, output: i } = await d(e, (e, r) => [
+		e,
+		"--encrypt",
+		`--user-password=${t}`,
+		`--owner-password=${h()}`,
+		"--bits=256",
+		`--print=${n.print ? "full" : "none"}`,
+		`--extract=${n.copy ? "y" : "n"}`,
+		`--modify=${n.modify ? "all" : "none"}`,
+		"--",
+		r
+	]);
+	if (r === 2 || !i) throw Error("qpdf");
+	return i;
+}
+export { c as a, o as i, g as n, p as r, m as t };