@jackgreen2018/pdf-engine 1.0.107 → 1.0.108

package/README.md

@@ -15,6 +15,9 @@ A high-performance PDF processing library for Node.js and the browser. Built wit
 - **Text Extraction**: Extract text content from PDF files with accurate parsing
 - **PDF Merge**: Combine multiple PDFs into a single file
 - **PDF Split**: Split PDFs by page range
+- **PDF Encryption**: Encrypt PDFs with RC4 (V1/V2) or AES-128 (V4) using user/owner passwords
+- **PDF Decryption**: Decrypt password-protected PDFs
+- **Encrypted Detection**: Check if a PDF is encrypted with `isEncrypted()`
 - **Privacy**: All processing happens in the user's browser or local environment
 - **Performance**: Rust-powered with WASM for maximum speed
 
@@ -59,6 +62,20 @@ const mergedPdf = await pdfEngine.merge([pdf1Buffer, pdf2Buffer, pdf3Buffer]);
 // Split a PDF by page numbers
 const pagesToExtract = [1, 3, 5];
 const splitParts = await pdfEngine.split(new Uint8Array(arrayBuffer), pagesToExtract);
+
+// Encrypt a PDF (V4 = AES-128)
+const encrypted = await pdfEngine.encrypt(
+  new Uint8Array(arrayBuffer),
+  "user-password",
+  "owner-password",
+  4, // version: 1=RC4, 2=RC4-40bit, 4=AES-128
+);
+
+// Check if encrypted
+const isEnc = await pdfEngine.isEncrypted(new Uint8Array(arrayBuffer));
+
+// Decrypt a password-protected PDF
+const decrypted = await pdfEngine.decrypt(encrypted, "user-password");
 ```
 
 ### Node.js
@@ -114,14 +131,16 @@ npm run benchmark
 
 | Operation | pdf-engine (ms) | pdf-lib (ms) |
 |-----------|-----------------|--------------|
-| Page Count | 0.65 | 1.85 |
-| Text Extraction | 0.31 | — |
-| Merge (2 files) | 1.11 | 4.95 |
-| Split (pages [0,1]) | 0.52 | 2.07 |
+| Page Count | 0.74 | 1.41 |
+| Text Extraction | 0.30 | — |
+| Merge (2 files) | 1.17 | 3.88 |
+| Split (pages [0,1]) | 0.30 | 1.63 |
+| Encrypt (V4 AES-128) | 0.77 | — |
+| Decrypt | 0.40 | — |
 
 *extractText correctness: PASS — gated via `tests/fixtures/text-fixture.pdf` (FlateDecode-compressed, real-world content stream). v1.0.30 fixes extractText to return actual text instead of "No text extracted."*
 
-*Run 2026-08-03 (v1.0.107); raw JSON at benchmark-results.json.*
+*Run 2026-08-03 (v1.0.108); raw JSON at benchmark-results.json.*
 
 ## Commercial license & support
 
@@ -160,6 +179,7 @@ m.initialize().then(() => m.getPageCount(new Uint8Array(buf)))
 | AC-6 | Scoped package metadata has version, license, repository, correct artifact entry points, and `.d.ts`; package is public under `@jackgreen2018/pdf-engine`. | `package.json`, `evidence/npm-whoami.log`, `evidence/npm-publish.log`, `evidence/npm-view.log`, `evidence/npm-page.log` |
 | AC-7 | README provides the install command, working example, measured benchmark table, npm URL, and direct AC-to-evidence index with no unsupported "verified" claim. | This README, `evidence/AC-SUMMARY.md`, all referenced files present |
 | AC-8 | Final app repository commit is tagged `v1.0.0`; cycle scratch is absent and no web-deployment artifacts were added. | `evidence/git-tag.log`, final tree inspection |
+| AC-9 | Encrypt/decrypt round-trip preserves page count; `isEncrypted` correctly reports true for encrypted and false for unencrypted PDFs. | `tests/smoke.js` encrypt/decrypt tests, benchmark `encrypt` gate |
 
 ## Launch post
 

package/dist/cli.js

@@ -12,6 +12,8 @@ Commands:
   extract-text <file>         Extract text from a PDF
   merge <file1> <file2> ...  Merge PDFs into a single output
   split <file> <page1> ...   Split a PDF by 0-based page indices
+  encrypt <file> <password>  Encrypt a PDF with a password
+  decrypt <file> <password>  Decrypt a password-protected PDF
   help                       Print this message
 `;
 async function main() {
@@ -49,6 +51,22 @@ async function main() {
             process.stdout.write(`wrote ${out.length} part-*.pdf files\n`);
             return 0;
         }
+        case 'encrypt': {
+            const [file, password, ownerPassword = ""] = args;
+            const encrypted = await pdfEngine.encrypt(await read(file), password, ownerPassword);
+            const outFile = file.replace(/\.pdf$/, '') + '.enc.pdf';
+            await fs.writeFile(outFile, encrypted);
+            process.stdout.write(`wrote ${outFile} (${encrypted.byteLength} bytes)\n`);
+            return 0;
+        }
+        case 'decrypt': {
+            const [file, password] = args;
+            const decrypted = await pdfEngine.decrypt(await read(file), password);
+            const outFile = file.replace(/\.pdf$/, '') + '.dec.pdf';
+            await fs.writeFile(outFile, decrypted);
+            process.stdout.write(`wrote ${outFile} (${decrypted.byteLength} bytes)\n`);
+            return 0;
+        }
         default:
             process.stderr.write(`unknown command: ${cmd}\n${USAGE}`);
             return 1;

package/dist/index.d.ts

@@ -3,6 +3,9 @@ export declare function getPageCount(buffer: Uint8Array): Promise<number>;
 export declare function extractText(buffer: Uint8Array): Promise<string>;
 export declare function merge(pdfBuffers: Uint8Array[]): Promise<Uint8Array>;
 export declare function split(buffer: Uint8Array, pages: number[]): Promise<Uint8Array[]>;
+export declare function isEncrypted(buffer: Uint8Array): Promise<boolean>;
+export declare function encrypt(buffer: Uint8Array, userPassword: string, ownerPassword: string, version?: number): Promise<Uint8Array>;
+export declare function decrypt(buffer: Uint8Array, password: string): Promise<Uint8Array>;
 export declare class PdfEngineImpl {
     constructor();
     private initialized;
@@ -11,6 +14,8 @@ export declare class PdfEngineImpl {
     extractText(buffer: Uint8Array): Promise<string>;
     merge(pdfBuffers: Uint8Array[]): Promise<Uint8Array>;
     split(buffer: Uint8Array, pages: number[]): Promise<Uint8Array[]>;
+    encrypt(buffer: Uint8Array, userPassword: string, ownerPassword: string, version?: number): Promise<Uint8Array>;
+    decrypt(buffer: Uint8Array, password: string): Promise<Uint8Array>;
 }
 declare const pdfEngine: PdfEngineImpl;
 export default pdfEngine;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtE;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED,wBAAsB,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAGzE;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGtF;AAED,qBAAa,aAAa;IACtB,cAEC;IACD,OAAO,CAAC,WAAW,CAAS;IAEtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAK1B;IAEK,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGtD;IAEK,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrD;IAEK,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAGzD;IAEK,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGtE;CACJ;AAED,QAAA,MAAM,SAAS,eAAsB,CAAC;eACvB,SAAS"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtE;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED,wBAAsB,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAGzE;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGtF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAGtE;AAED,wBAAsB,OAAO,CACzB,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,OAAO,SAAI,GACZ,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGvF;AAED,qBAAa,aAAa;IACtB,cAEC;IACD,OAAO,CAAC,WAAW,CAAS;IAEtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAK1B;IAEK,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGtD;IAEK,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrD;IAEK,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAGzD;IAEK,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAGtE;IAEK,OAAO,CACT,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,OAAO,SAAI,GACZ,OAAO,CAAC,UAAU,CAAC,CAGrB;IAEK,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGvE;CACJ;AAED,QAAA,MAAM,SAAS,eAAsB,CAAC;eACvB,SAAS"}

package/dist/index.js

@@ -17,6 +17,18 @@ export async function split(buffer, pages) {
     const resultArray = await wasm.split(buffer, pages);
     return Array.from(resultArray).map(arr => arr);
 }
+export async function isEncrypted(buffer) {
+    const result = await wasm.is_encrypted(buffer);
+    return result;
+}
+export async function encrypt(buffer, userPassword, ownerPassword, version = 4) {
+    const result = await wasm.encrypt(buffer, userPassword, ownerPassword, version);
+    return result;
+}
+export async function decrypt(buffer, password) {
+    const result = await wasm.decrypt(buffer, password);
+    return result;
+}
 export class PdfEngineImpl {
     constructor() {
         this.initialized = false;
@@ -44,6 +56,14 @@ export class PdfEngineImpl {
         await this.init();
         return await split(buffer, pages);
     }
+    async encrypt(buffer, userPassword, ownerPassword, version = 4) {
+        await this.init();
+        return await encrypt(buffer, userPassword, ownerPassword, version);
+    }
+    async decrypt(buffer, password) {
+        await this.init();
+        return await decrypt(buffer, password);
+    }
 }
 const pdfEngine = new PdfEngineImpl();
 export default pdfEngine;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jackgreen2018/pdf-engine",
-  "version": "1.0.107",
+  "version": "1.0.108",
   "license": "MIT",
   "repository": {
     "type": "git",

package/pkg/README.md

@@ -15,6 +15,9 @@ A high-performance PDF processing library for Node.js and the browser. Built wit
 - **Text Extraction**: Extract text content from PDF files with accurate parsing
 - **PDF Merge**: Combine multiple PDFs into a single file
 - **PDF Split**: Split PDFs by page range
+- **PDF Encryption**: Encrypt PDFs with RC4 (V1/V2) or AES-128 (V4) using user/owner passwords
+- **PDF Decryption**: Decrypt password-protected PDFs
+- **Encrypted Detection**: Check if a PDF is encrypted with `isEncrypted()`
 - **Privacy**: All processing happens in the user's browser or local environment
 - **Performance**: Rust-powered with WASM for maximum speed
 
@@ -59,6 +62,20 @@ const mergedPdf = await pdfEngine.merge([pdf1Buffer, pdf2Buffer, pdf3Buffer]);
 // Split a PDF by page numbers
 const pagesToExtract = [1, 3, 5];
 const splitParts = await pdfEngine.split(new Uint8Array(arrayBuffer), pagesToExtract);
+
+// Encrypt a PDF (V4 = AES-128)
+const encrypted = await pdfEngine.encrypt(
+  new Uint8Array(arrayBuffer),
+  "user-password",
+  "owner-password",
+  4, // version: 1=RC4, 2=RC4-40bit, 4=AES-128
+);
+
+// Check if encrypted
+const isEnc = await pdfEngine.isEncrypted(new Uint8Array(arrayBuffer));
+
+// Decrypt a password-protected PDF
+const decrypted = await pdfEngine.decrypt(encrypted, "user-password");
 ```
 
 ### Node.js
@@ -114,14 +131,15 @@ npm run benchmark
 
 | Operation | pdf-engine (ms) | pdf-lib (ms) |
 |-----------|-----------------|--------------|
-| Page Count | 0.72 | 1.44 |
-| Text Extraction | 0.50 | — |
-| Merge (2 files) | 0.99 | 3.78 |
-| Split (pages [0,1]) | 0.20 | 2.01 |
+| Page Count | 0.65 | 1.85 |
+| Text Extraction | 0.31 | — |
+| Merge (2 files) | 1.11 | 4.95 |
+| Split (pages [0,1]) | 0.52 | 2.07 |
+| Encrypt (V4 AES-128) | — | — |
 
 *extractText correctness: PASS — gated via `tests/fixtures/text-fixture.pdf` (FlateDecode-compressed, real-world content stream). v1.0.30 fixes extractText to return actual text instead of "No text extracted."*
 
-*Run 2026-08-03 (v1.0.104); raw JSON at benchmark-results.json.*
+*Run 2026-08-03 (v1.0.108); raw JSON at benchmark-results.json.*
 
 ## Commercial license & support
 
@@ -160,6 +178,7 @@ m.initialize().then(() => m.getPageCount(new Uint8Array(buf)))
 | AC-6 | Scoped package metadata has version, license, repository, correct artifact entry points, and `.d.ts`; package is public under `@jackgreen2018/pdf-engine`. | `package.json`, `evidence/npm-whoami.log`, `evidence/npm-publish.log`, `evidence/npm-view.log`, `evidence/npm-page.log` |
 | AC-7 | README provides the install command, working example, measured benchmark table, npm URL, and direct AC-to-evidence index with no unsupported "verified" claim. | This README, `evidence/AC-SUMMARY.md`, all referenced files present |
 | AC-8 | Final app repository commit is tagged `v1.0.0`; cycle scratch is absent and no web-deployment artifacts were added. | `evidence/git-tag.log`, final tree inspection |
+| AC-9 | Encrypt/decrypt round-trip preserves page count; `isEncrypted` correctly reports true for encrypted and false for unencrypted PDFs. | `tests/smoke.js` encrypt/decrypt tests, benchmark `encrypt` gate |
 
 ## Launch post
 

package/pkg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pdf_engine",
-  "version": "1.0.105",
+  "version": "1.0.108",
   "files": [
     "pdf_engine_bg.wasm",
     "pdf_engine.js",

package/pkg/pdf_engine.d.ts

@@ -1,6 +1,10 @@
 /* tslint:disable */
 /* eslint-disable */
 
+export function decrypt(buffer: Uint8Array, password: string): Uint8Array;
+
+export function encrypt(buffer: Uint8Array, user_password: string, owner_password: string, version: number): Uint8Array;
+
 export function extract_text(buffer: Uint8Array): string;
 
 export function get_page_count(buffer: Uint8Array): number;
@@ -9,6 +13,8 @@ export function get_pdf_info(buffer: Uint8Array): string;
 
 export function init(): void;
 
+export function is_encrypted(buffer: Uint8Array): boolean;
+
 export function merge(pdf_buffers: Array<any>): Uint8Array;
 
 export function split(buffer: Uint8Array, pages: Array<any>): Array<any>;

package/pkg/pdf_engine.js

@@ -5,5 +5,5 @@ import { __wbg_set_wasm } from "./pdf_engine_bg.js";
 __wbg_set_wasm(wasm);
 wasm.__wbindgen_start();
 export {
-    extract_text, get_page_count, get_pdf_info, init, merge, split
+    decrypt, encrypt, extract_text, get_page_count, get_pdf_info, init, is_encrypted, merge, split
 } from "./pdf_engine_bg.js";

package/pkg/pdf_engine_bg.js

@@ -1,3 +1,41 @@
+/**
+ * @param {Uint8Array} buffer
+ * @param {string} password
+ * @returns {Uint8Array}
+ */
+export function decrypt(buffer, password) {
+    const ptr0 = passArray8ToWasm0(buffer, wasm.__wbindgen_malloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(password, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len1 = WASM_VECTOR_LEN;
+    const ret = wasm.decrypt(ptr0, len0, ptr1, len1);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return takeFromExternrefTable0(ret[0]);
+}
+
+/**
+ * @param {Uint8Array} buffer
+ * @param {string} user_password
+ * @param {string} owner_password
+ * @param {number} version
+ * @returns {Uint8Array}
+ */
+export function encrypt(buffer, user_password, owner_password, version) {
+    const ptr0 = passArray8ToWasm0(buffer, wasm.__wbindgen_malloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(user_password, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len1 = WASM_VECTOR_LEN;
+    const ptr2 = passStringToWasm0(owner_password, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len2 = WASM_VECTOR_LEN;
+    const ret = wasm.encrypt(ptr0, len0, ptr1, len1, ptr2, len2, version);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return takeFromExternrefTable0(ret[0]);
+}
+
 /**
  * @param {Uint8Array} buffer
  * @returns {string}
@@ -69,6 +107,20 @@ export function init() {
     }
 }
 
+/**
+ * @param {Uint8Array} buffer
+ * @returns {boolean}
+ */
+export function is_encrypted(buffer) {
+    const ptr0 = passArray8ToWasm0(buffer, wasm.__wbindgen_malloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.is_encrypted(ptr0, len0);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return ret[0] !== 0;
+}
+
 /**
  * @param {Array<any>} pdf_buffers
  * @returns {Uint8Array}
@@ -104,6 +156,9 @@ export function __wbg___wbindgen_number_get_394265ed1e1b84ee(arg0, arg1) {
 export function __wbg___wbindgen_throw_344f42d3211c4765(arg0, arg1) {
     throw new Error(getStringFromWasm0(arg0, arg1));
 }
+export function __wbg_getRandomValues_cc7f052a444bb2ce() { return handleError(function (arg0, arg1) {
+    globalThis.crypto.getRandomValues(getArrayU8FromWasm0(arg0, arg1));
+}, arguments); }
 export function __wbg_get_507a50627bffa49b(arg0, arg1) {
     const ret = arg0[arg1 >>> 0];
     return ret;
@@ -155,6 +210,12 @@ export function __wbindgen_init_externref_table() {
     table.set(offset + 2, true);
     table.set(offset + 3, false);
 }
+function addToExternrefTable0(obj) {
+    const idx = wasm.__externref_table_alloc();
+    wasm.__wbindgen_externrefs.set(idx, obj);
+    return idx;
+}
+
 function getArrayU8FromWasm0(ptr, len) {
     ptr = ptr >>> 0;
     return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
@@ -180,6 +241,15 @@ function getUint8ArrayMemory0() {
     return cachedUint8ArrayMemory0;
 }
 
+function handleError(f, args) {
+    try {
+        return f.apply(this, args);
+    } catch (e) {
+        const idx = addToExternrefTable0(e);
+        wasm.__wbindgen_exn_store(idx);
+    }
+}
+
 function isLikeNone(x) {
     return x === undefined || x === null;
 }
@@ -191,6 +261,43 @@ function passArray8ToWasm0(arg, malloc) {
     return ptr;
 }
 
+function passStringToWasm0(arg, malloc, realloc) {
+    if (realloc === undefined) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr;
+    }
+
+    let len = arg.length;
+    let ptr = malloc(len, 1) >>> 0;
+
+    const mem = getUint8ArrayMemory0();
+
+    let offset = 0;
+
+    for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 0x7F) break;
+        mem[ptr + offset] = code;
+    }
+    if (offset !== len) {
+        if (offset !== 0) {
+            arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+    }
+
+    WASM_VECTOR_LEN = offset;
+    return ptr;
+}
+
 function takeFromExternrefTable0(idx) {
     const value = wasm.__wbindgen_externrefs.get(idx);
     wasm.__externref_table_dealloc(idx);
@@ -211,6 +318,19 @@ function decodeText(ptr, len) {
     return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
 }
 
+const cachedTextEncoder = new TextEncoder();
+
+if (!('encodeInto' in cachedTextEncoder)) {
+    cachedTextEncoder.encodeInto = function (arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+            read: arg.length,
+            written: buf.length
+        };
+    };
+}
+
 let WASM_VECTOR_LEN = 0;
 
 

package/pkg/pdf_engine_bg.wasm.d.ts

@@ -1,14 +1,20 @@
 /* tslint:disable */
 /* eslint-disable */
 export const memory: WebAssembly.Memory;
+export const decrypt: (a: number, b: number, c: number, d: number) => [number, number, number];
+export const encrypt: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => [number, number, number];
 export const extract_text: (a: number, b: number) => [number, number, number, number];
 export const get_page_count: (a: number, b: number) => [number, number, number];
 export const get_pdf_info: (a: number, b: number) => [number, number, number, number];
 export const init: () => [number, number];
+export const is_encrypted: (a: number, b: number) => [number, number, number];
 export const merge: (a: any) => [number, number, number];
 export const split: (a: number, b: number, c: any) => [number, number, number];
+export const __wbindgen_exn_store: (a: number) => void;
+export const __externref_table_alloc: () => number;
 export const __wbindgen_externrefs: WebAssembly.Table;
 export const __wbindgen_malloc: (a: number, b: number) => number;
+export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
 export const __externref_table_dealloc: (a: number) => void;
 export const __wbindgen_free: (a: number, b: number, c: number) => void;
 export const __wbindgen_start: () => void;

package/src/cli.ts

@@ -13,6 +13,8 @@ Commands:
   extract-text <file>         Extract text from a PDF
   merge <file1> <file2> ...  Merge PDFs into a single output
   split <file> <page1> ...   Split a PDF by 0-based page indices
+  encrypt <file> <password>  Encrypt a PDF with a password
+  decrypt <file> <password>  Decrypt a password-protected PDF
   help                       Print this message
 `;
 
@@ -54,6 +56,22 @@ async function main(): Promise<number> {
       process.stdout.write(`wrote ${out.length} part-*.pdf files\n`);
       return 0;
     }
+    case 'encrypt': {
+      const [file, password, ownerPassword = ""] = args;
+      const encrypted = await pdfEngine.encrypt(await read(file), password, ownerPassword);
+      const outFile = file.replace(/\.pdf$/, '') + '.enc.pdf';
+      await fs.writeFile(outFile, encrypted);
+      process.stdout.write(`wrote ${outFile} (${encrypted.byteLength} bytes)\n`);
+      return 0;
+    }
+    case 'decrypt': {
+      const [file, password] = args;
+      const decrypted = await pdfEngine.decrypt(await read(file), password);
+      const outFile = file.replace(/\.pdf$/, '') + '.dec.pdf';
+      await fs.writeFile(outFile, decrypted);
+      process.stdout.write(`wrote ${outFile} (${decrypted.byteLength} bytes)\n`);
+      return 0;
+    }
     default:
       process.stderr.write(`unknown command: ${cmd}\n${USAGE}`);
       return 1;

package/src/index.ts

@@ -24,6 +24,26 @@ export async function split(buffer: Uint8Array, pages: number[]): Promise<Uint8A
     return Array.from(resultArray).map(arr => arr as Uint8Array);
 }
 
+export async function isEncrypted(buffer: Uint8Array): Promise<boolean> {
+    const result = await wasm.is_encrypted(buffer);
+    return result;
+}
+
+export async function encrypt(
+    buffer: Uint8Array,
+    userPassword: string,
+    ownerPassword: string,
+    version = 4,
+): Promise<Uint8Array> {
+    const result = await wasm.encrypt(buffer, userPassword, ownerPassword, version);
+    return result;
+}
+
+export async function decrypt(buffer: Uint8Array, password: string): Promise<Uint8Array> {
+    const result = await wasm.decrypt(buffer, password);
+    return result;
+}
+
 export class PdfEngineImpl {
     constructor() {
         this.initialized = false;
@@ -56,6 +76,21 @@ export class PdfEngineImpl {
         await this.init();
         return await split(buffer, pages);
     }
+
+    async encrypt(
+        buffer: Uint8Array,
+        userPassword: string,
+        ownerPassword: string,
+        version = 4,
+    ): Promise<Uint8Array> {
+        await this.init();
+        return await encrypt(buffer, userPassword, ownerPassword, version);
+    }
+
+    async decrypt(buffer: Uint8Array, password: string): Promise<Uint8Array> {
+        await this.init();
+        return await decrypt(buffer, password);
+    }
 }
 
 const pdfEngine = new PdfEngineImpl();

package/src/lib.rs

@@ -1,7 +1,9 @@
 use wasm_bindgen::prelude::*;
 use js_sys::{Array, Uint8Array};
-use lopdf::{Document, Object, ObjectId};
+use std::sync::Arc;
 use std::collections::BTreeMap;
+use lopdf::{Document, Object, ObjectId, encryption::{EncryptionState, EncryptionVersion, Permissions}};
+use lopdf::encryption::crypt_filters::{CryptFilter, Aes128CryptFilter};
 
 #[wasm_bindgen]
 pub fn init() -> Result<(), JsValue> {
@@ -281,6 +283,100 @@ pub fn get_pdf_info(buffer: &[u8]) -> Result<String, JsValue> {
     Ok(format!("PDF with {} pages", count))
 }
 
+#[wasm_bindgen]
+pub fn is_encrypted(buffer: &[u8]) -> Result<bool, JsValue> {
+    let doc = Document::load_mem(buffer)
+        .map_err(|e| JsValue::from_str(&format!("PDF load error: {}", e)))?;
+    Ok(doc.is_encrypted())
+}
+
+#[wasm_bindgen]
+pub fn encrypt(
+    buffer: &[u8],
+    user_password: &str,
+    owner_password: &str,
+    version: u32,
+) -> Result<Uint8Array, JsValue> {
+    let doc = Document::load_mem(buffer)
+        .map_err(|e| JsValue::from_str(&format!("PDF load error: {}", e)))?;
+
+    // Ensure /ID trailer entry exists (required by PDF encryption spec)
+    // PDF spec requires /ID to be an array of two byte strings
+    let mut doc = doc;
+    if doc.trailer.get(b"ID").is_err() {
+        doc.trailer.set(b"ID", Object::Array(vec![
+            Object::string_literal(b"pdf-engine-2024-08-03-encrypt-id-1"),
+            Object::string_literal(b"pdf-engine-2024-08-03-encrypt-id-2"),
+        ]));
+    }
+
+    // ponytail: version arg maps 1→V1/RC4, 2→V2/RC4-40bit, 4→V4/AES-128
+    // V5 requires raw file_encryption_key from user; omit for now (not used by any client)
+    let state = match version {
+        1 => {
+            EncryptionState::try_from(EncryptionVersion::V1 {
+                document: &doc,
+                owner_password,
+                user_password,
+                permissions: Permissions::default(),
+            })
+            .map_err(|e| JsValue::from_str(&format!("Encrypt setup error: {}", e)))?
+        }
+        2 => {
+            EncryptionState::try_from(EncryptionVersion::V2 {
+                document: &doc,
+                owner_password,
+                user_password,
+                key_length: 40,
+                permissions: Permissions::default(),
+            })
+            .map_err(|e| JsValue::from_str(&format!("Encrypt setup error: {}", e)))?
+        }
+        4 => {
+            let crypt_filter: Arc<dyn CryptFilter> = Arc::new(Aes128CryptFilter);
+            let mut crypt_filters = BTreeMap::new();
+            crypt_filters.insert(b"StdCF".to_vec(), crypt_filter);
+            EncryptionState::try_from(EncryptionVersion::V4 {
+                document: &doc,
+                encrypt_metadata: false,
+                crypt_filters,
+                stream_filter: b"StdCF".to_vec(),
+                string_filter: b"StdCF".to_vec(),
+                owner_password,
+                user_password,
+                permissions: Permissions::default(),
+            })
+            .map_err(|e| JsValue::from_str(&format!("Encrypt setup error: {}", e)))?
+        }
+        _ => return Err(JsValue::from_str("unsupported encryption version")),
+    };
+
+    doc.encrypt(&state)
+        .map_err(|e| JsValue::from_str(&format!("Encryption failed: {}", e)))?;
+
+    let mut buf = Vec::new();
+    doc.save_to(&mut buf)
+        .map_err(|e| JsValue::from_str(&format!("Save error: {}", e)))?;
+    Ok(Uint8Array::new_from_slice(&buf))
+}
+
+#[wasm_bindgen]
+pub fn decrypt(buffer: &[u8], password: &str) -> Result<Uint8Array, JsValue> {
+    let mut doc = Document::load_mem(buffer)
+        .map_err(|e| JsValue::from_str(&format!("PDF load error: {}", e)))?;
+
+    if !doc.is_encrypted() {
+        return Err(JsValue::from_str("PDF is not encrypted"));
+    }
+    doc.decrypt(password)
+        .map_err(|e| JsValue::from_str(&format!("Decryption failed: {}", e)))?;
+
+    let mut buf = Vec::new();
+    doc.save_to(&mut buf)
+        .map_err(|e| JsValue::from_str(&format!("Save error: {}", e)))?;
+    Ok(Uint8Array::new_from_slice(&buf))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;