@t4h.framework/pdf 0.1.1 → 0.2.0

package/.ai/skills/framework-pdf/SKILL.md

@@ -3,10 +3,11 @@ name: framework-pdf
 description: >-
   Guides correct use of @t4h.framework/pdf in T4H Framework workflows: the
   `render()` helper, PDF marker components (Document, Page, View, Text, Link,
-  Image, PageNumber), custom fonts, Binary image sources, styling, and the
-  FileSystemClaim the render activity requires. Use when generating PDFs in
-  workflows, building PDF templates with JSX, registering fonts, or working
-  in packages/pdf.
+  Image, PageNumber), custom fonts, Binary image sources, styling,
+  password-protected PDFs via the `encrypt` option, and the FileSystemClaim
+  the render activity requires. Use when generating PDFs in workflows,
+  building PDF templates with JSX, registering fonts, encrypting PDFs, or
+  working in packages/pdf.
 ---
 
 # @t4h.framework/pdf
@@ -29,8 +30,11 @@ import {
   Image,
   PageNumber,
   RenderPDFActivity,
+  ProtectionFlags,
+  ProtectionPresets,
   type RenderPDFOptions,
   type RenderPDFInput,
+  type EncryptPDFOptions,
   type DocumentProps,
   type PageProps,
   type ViewProps,
@@ -44,9 +48,11 @@ import {
 } from '@t4h.framework/pdf'
 ```
 
-> Workflows use **`render()`**. The package also exports the underlying
-> `RenderPDFActivity`, but workflow code never imports, instantiates, or
-> extends it.
+> Workflows use **`render()`** — for everything, including encryption. The
+> package also exports the underlying `RenderPDFActivity`, but workflow code
+> never imports, instantiates, or extends it. The `encryptPDF` tool in
+> `src/tools/` is internal and not exported — encryption always goes through
+> `render`'s `encrypt` option.
 
 ## Architecture
 
@@ -60,9 +66,13 @@ import {
 2. **`run`** (activity side): fonts are registered, the `DocumentNode` tree is
    converted back into real `@react-pdf/renderer` elements (`Binary` image
    sources become `data:` URIs), rendered to a buffer, and written through
-   **`FileSystemClaim`** at `pdf/${activityId}.pdf`.
+   **`FileSystemClaim`** at `pdf/${activityId}.pdf`. With the `encrypt`
+   option, a password-protected copy is also written at
+   `pdf/${activityId}-encrypted.pdf`.
 3. The activity returns the **`Binary`** the claim produced — a reference to
-   the stored file, not in-memory bytes. Replay-safe by construction.
+   the stored file, not in-memory bytes. Replay-safe by construction. With
+   `encrypt`, it returns the `[original, encrypted]` pair instead, and the
+   `render` return type narrows automatically based on the options.
 
 ---
 
@@ -232,6 +242,36 @@ Rules of thumb:
 
 ---
 
+## Encryption
+
+`render(element, { encrypt })` also persists a password-protected copy and
+resolves with an `[original, encrypted]` tuple — the return type narrows
+automatically:
+
+```tsx
+const [original, encrypted] = await render(<Invoice />, {
+  encrypt: {
+    password: customer.documentNumber,
+    protection: ProtectionPresets.ReadOnly,
+  },
+})
+```
+
+- `password`: a bare string (same password opens and owns the file) or
+  `{ user, owner }` for a distinct owner password that bypasses permission
+  restrictions.
+- `protection`: a `ProtectionFlags` bitmask granted to whoever opens with the
+  user password. Combine flags with `|` (`Print`, `Modify`, `CopyAndExtract`,
+  `AnnotateAndFill`, `FillForms`, `ExtractForAccessibility`, `Assemble`,
+  `PrintHighResolution`) or use a preset: `ProtectionPresets.ReadOnly`
+  (view + print only — invoices, statements) or `ProtectionPresets.All`.
+- Permission flags are honored by PDF viewers, **not enforced
+  cryptographically** — the open password is the only real protection.
+- Encryption is **only** available through `render`'s `encrypt` option. Never
+  import from `src/tools/encrypt-pdf.js` — it is internal and not exported.
+
+---
+
 ## Testing
 
 Test the **workflow** with `TestWorkflowEnvironment` from
@@ -300,10 +340,13 @@ react-pdf element trees without rendering.
    strings); put inheritable text defaults on `Page`.
 8. Use `fixed` + absolute positioning for running headers/footers and
    `PageNumber` for pagination stamps.
-9. Test workflows with **`TestWorkflowEnvironment`** + **`mockClaim`**,
-   asserting the `%PDF-` magic bytes on the `fs.write` call.
-10. Do not document or import APIs not exported from `@t4h.framework/pdf`
-    (the `helpers/` modules are internal).
+9. Password-protect PDFs **only** via `render`'s `encrypt` option — it
+   returns `[original, encrypted]`. Never import the internal `encryptPDF`
+   tool. Remember permission flags are viewer-honored, not cryptographic.
+10. Test workflows with **`TestWorkflowEnvironment`** + **`mockClaim`**,
+    asserting the `%PDF-` magic bytes on the `fs.write` call.
+11. Do not document or import APIs not exported from `@t4h.framework/pdf`
+    (the `helpers/` and `tools/` modules are internal).
 
 See also: **framework-workflow-testing** for the test harness;
 **framework-fs** for `FileSystemClaim`; **framework-http** for fetching

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @t4h.framework/pdf
 
+## 0.2.0
+
+### Minor Changes
+
+- [`389e0b7`](https://github.com/tech4humans-brasil/framework/commit/389e0b72b5025dc85f33b371c320a3821314d41e) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds encryption option
+
 ## 0.1.1
 
 ### Patch Changes

package/README.md

@@ -131,6 +131,18 @@ const pdf = await render(<Doc />, {
 
 Select variants in styles with `fontFamily`, `fontWeight` (`100–900`), and `fontStyle` (`'normal' | 'italic'`).
 
+## Encryption
+
+Pass `encrypt` to also persist a password-protected copy — `render` then resolves with an `[original, encrypted]` pair (the return type narrows automatically). `password` is a bare string or `{ user, owner }`; `protection` is a `ProtectionFlags` bitmask (defaults follow the viewer; use `ProtectionPresets.ReadOnly` for view-and-print documents). Permission flags are honored by viewers, not enforced cryptographically.
+
+```tsx
+import { ProtectionPresets, render } from '@t4h.framework/pdf'
+
+const [original, encrypted] = await render(<Invoice />, {
+  encrypt: { password: '12345678900', protection: ProtectionPresets.ReadOnly },
+})
+```
+
 ## Page numbers
 
 `PageNumber` resolves at layout time. The `format` string may reference `{pageNumber}` and `{totalPages}`; combine with `fixed` and absolute positioning for running footers.

package/dist/activities/RenderPDFActivity.d.ts

@@ -1,19 +1,26 @@
 import { Binary, SyncActivity } from '@t4h.framework/core';
 import type { ReactElement } from 'react';
 import { type Fonts } from '../helpers/register-fonts.js';
+import { type EncryptPDFOptions } from '../tools/encrypt-pdf.js';
 import type { DocumentNode } from '../typings/pdf.js';
 export type RenderPDFOptions = {
     fonts?: Fonts;
+    encrypt?: EncryptPDFOptions;
 };
 export type RenderPDFInput = {
     document: DocumentNode;
-    fonts?: Fonts;
-};
-export declare class RenderPDFActivity extends SyncActivity<readonly [element: ReactElement, options?: RenderPDFOptions], RenderPDFInput, Binary, Binary> {
+} & RenderPDFOptions;
+export declare class RenderPDFActivity extends SyncActivity<readonly [element: ReactElement, options?: RenderPDFOptions], RenderPDFInput, Binary | [Binary, Binary], Binary | [Binary, Binary]> {
     private readonly claims;
     toInput(element: ReactElement, options?: RenderPDFOptions): RenderPDFInput;
-    run(input: RenderPDFInput): Promise<Binary>;
-    toOutput(output: Binary): Binary;
+    run(input: RenderPDFInput): Promise<Binary | [Binary, Binary]>;
+    toOutput(output: Binary | [Binary, Binary]): Binary | [Binary, Binary];
 }
-export declare function render(element: ReactElement, options?: RenderPDFOptions): Promise<Binary>;
+export declare function render(element: ReactElement, options: RenderPDFOptions & {
+    encrypt: EncryptPDFOptions;
+}): Promise<[original: Binary, encrypted: Binary]>;
+export declare function render(element: ReactElement, options?: RenderPDFOptions & {
+    encrypt?: undefined;
+}): Promise<Binary>;
+export declare function render(element: ReactElement, options?: RenderPDFOptions): Promise<Binary | [Binary, Binary]>;
 //# sourceMappingURL=RenderPDFActivity.d.ts.map

package/dist/activities/RenderPDFActivity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RenderPDFActivity.d.ts","sourceRoot":"","sources":["../../src/activities/RenderPDFActivity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAkB,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAA;AAIzC,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,YAAY,CAAA;IACtB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,iBAAkB,SAAQ,YAAY,CACjD,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,EAC5D,cAAc,EACd,MAAM,EACN,MAAM,CACP;IACC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAErD,OAAO,CACZ,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,cAAc;IAOJ,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAUjD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAGxC;AAED,wBAAsB,MAAM,CAC1B,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CAEjB"}
+{"version":3,"file":"RenderPDFActivity.d.ts","sourceRoot":"","sources":["../../src/activities/RenderPDFActivity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAkB,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAA;AAIzC,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,YAAY,CAAA;CACvB,GAAG,gBAAgB,CAAA;AAEpB,qBAAa,iBAAkB,SAAQ,YAAY,CACjD,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,EAC5D,cAAc,EACd,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACzB,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAC1B;IACC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAErD,OAAO,CACZ,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,cAAc;IAQJ,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAmBpE,QAAQ,CACb,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAG7B;AAED,wBAAsB,MAAM,CAC1B,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,gBAAgB,GAAG;IAAE,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACzD,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;AACjD,wBAAsB,MAAM,CAC1B,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,CAAC,CAAA;AAClB,wBAAsB,MAAM,CAC1B,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA"}

package/dist/activities/RenderPDFActivity.js

@@ -4,12 +4,14 @@ import { FileSystemClaim } from '@t4h.framework/fs';
 import { documentToElement } from '../helpers/document-to-element.js';
 import { elementToDocument } from '../helpers/element-to-document.js';
 import { registerFonts } from '../helpers/register-fonts.js';
+import { encryptPDF } from '../tools/encrypt-pdf.js';
 export class RenderPDFActivity extends SyncActivity {
     claims = new Claim({ fs: FileSystemClaim });
     toInput(element, options) {
         return {
             document: elementToDocument(element),
-            ...(options?.fonts ? { fonts: options.fonts } : {}),
+            fonts: options?.fonts,
+            encrypt: options?.encrypt,
         };
     }
     async run(input) {
@@ -17,7 +19,11 @@ export class RenderPDFActivity extends SyncActivity {
             await registerFonts(input.fonts);
         const element = await documentToElement(input.document);
         const pdf = await renderToBuffer(element);
-        return await this.claims.fs.write(`pdf/${this.id}.pdf`, pdf);
+        const original = await this.claims.fs.write(`pdf/${this.id}.pdf`, pdf);
+        if (!input.encrypt)
+            return original;
+        const encrypted = await this.claims.fs.write(`pdf/${this.id}-encrypted.pdf`, encryptPDF(pdf, input.encrypt));
+        return [original, encrypted];
     }
     toOutput(output) {
         return output;

package/dist/activities/RenderPDFActivity.js.map

@@ -1 +1 @@
-{"version":3,"file":"RenderPDFActivity.js","sourceRoot":"","sources":["../../src/activities/RenderPDFActivity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AACrE,OAAO,EAAE,aAAa,EAAc,MAAM,8BAA8B,CAAA;AAYxE,MAAM,OAAO,iBAAkB,SAAQ,YAKtC;IACkB,MAAM,GAAG,IAAI,KAAK,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAA;IAErD,OAAO,CACZ,OAAqB,EACrB,OAA0B;QAE1B,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACpC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,KAAqB;QACpC,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAEjD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAEvD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;QAEzC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAEM,QAAQ,CAAC,MAAc;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAqB,EACrB,OAA0B;IAE1B,OAAO,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC"}
+{"version":3,"file":"RenderPDFActivity.js","sourceRoot":"","sources":["../../src/activities/RenderPDFActivity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AACrE,OAAO,EAAE,aAAa,EAAc,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAE,UAAU,EAA0B,MAAM,yBAAyB,CAAA;AAY5E,MAAM,OAAO,iBAAkB,SAAQ,YAKtC;IACkB,MAAM,GAAG,IAAI,KAAK,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAA;IAErD,OAAO,CACZ,OAAqB,EACrB,OAA0B;QAE1B,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACpC,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,OAAO,EAAE,OAAO,EAAE,OAAO;SAC1B,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,KAAqB;QACpC,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAEjD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAEvD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;QAEzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QAEtE,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAA;QAEnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAC1C,OAAO,IAAI,CAAC,EAAE,gBAAgB,EAC9B,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAC/B,CAAA;QAED,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC9B,CAAC;IAEM,QAAQ,CACb,MAAiC;QAEjC,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAcD,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAqB,EACrB,OAA0B;IAE1B,OAAO,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC"}

package/dist/pdf.d.ts

@@ -1,4 +1,5 @@
 export * from './activities/RenderPDFActivity.js';
 export * from './components.js';
+export { ProtectionFlags, ProtectionPresets, type EncryptPDFOptions, } from './tools/encrypt-pdf.js';
 export * from './typings/pdf.js';
 //# sourceMappingURL=pdf.d.ts.map

package/dist/pdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pdf.d.ts","sourceRoot":"","sources":["../src/pdf.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAA;AACjD,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"pdf.d.ts","sourceRoot":"","sources":["../src/pdf.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAA;AACjD,cAAc,iBAAiB,CAAA;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/pdf.js

@@ -1,4 +1,5 @@
 export * from './activities/RenderPDFActivity.js';
 export * from './components.js';
+export { ProtectionFlags, ProtectionPresets, } from './tools/encrypt-pdf.js';
 export * from './typings/pdf.js';
 //# sourceMappingURL=pdf.js.map

package/dist/pdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"pdf.js","sourceRoot":"","sources":["../src/pdf.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAA;AACjD,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"pdf.js","sourceRoot":"","sources":["../src/pdf.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAA;AACjD,cAAc,iBAAiB,CAAA;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,wBAAwB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/tools/encrypt-pdf.d.ts

@@ -0,0 +1,25 @@
+export declare enum ProtectionFlags {
+    Print = 4,
+    Modify = 8,
+    CopyAndExtract = 16,
+    AnnotateAndFill = 32,
+    FillForms = 256,
+    ExtractForAccessibility = 512,
+    Assemble = 1024,
+    PrintHighResolution = 2048
+}
+export declare const ProtectionPresets: {
+    readonly ReadOnly: number;
+    readonly All: number;
+};
+type Password = string | {
+    user: string;
+    owner: string;
+};
+export type EncryptPDFOptions = {
+    password: Password;
+    protection?: ProtectionFlags;
+};
+export declare function encryptPDF(input: Buffer, options: EncryptPDFOptions): Buffer;
+export {};
+//# sourceMappingURL=encrypt-pdf.d.ts.map

package/dist/tools/encrypt-pdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt-pdf.d.ts","sourceRoot":"","sources":["../../src/tools/encrypt-pdf.ts"],"names":[],"mappings":"AAGA,oBAAY,eAAe;IACzB,KAAK,IAAI;IACT,MAAM,IAAI;IACV,cAAc,KAAK;IACnB,eAAe,KAAK;IACpB,SAAS,MAAM;IACf,uBAAuB,MAAM;IAC7B,QAAQ,OAAO;IACf,mBAAmB,OAAO;CAC3B;AAED,eAAO,MAAM,iBAAiB;;;CAcpB,CAAA;AAEV,KAAK,QAAQ,GACT,MAAM,GACN;IACE,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAEL,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,CAAC,EAAE,eAAe,CAAA;CAC7B,CAAA;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAmB5E"}

package/dist/tools/encrypt-pdf.js

@@ -0,0 +1,42 @@
+/* eslint-disable cspell/spellchecker */
+import muhammara from 'muhammara';
+export var ProtectionFlags;
+(function (ProtectionFlags) {
+    ProtectionFlags[ProtectionFlags["Print"] = 4] = "Print";
+    ProtectionFlags[ProtectionFlags["Modify"] = 8] = "Modify";
+    ProtectionFlags[ProtectionFlags["CopyAndExtract"] = 16] = "CopyAndExtract";
+    ProtectionFlags[ProtectionFlags["AnnotateAndFill"] = 32] = "AnnotateAndFill";
+    ProtectionFlags[ProtectionFlags["FillForms"] = 256] = "FillForms";
+    ProtectionFlags[ProtectionFlags["ExtractForAccessibility"] = 512] = "ExtractForAccessibility";
+    ProtectionFlags[ProtectionFlags["Assemble"] = 1024] = "Assemble";
+    ProtectionFlags[ProtectionFlags["PrintHighResolution"] = 2048] = "PrintHighResolution";
+})(ProtectionFlags || (ProtectionFlags = {}));
+export const ProtectionPresets = {
+    ReadOnly: ProtectionFlags.Print |
+        ProtectionFlags.PrintHighResolution |
+        ProtectionFlags.ExtractForAccessibility,
+    All: ProtectionFlags.Print |
+        ProtectionFlags.Modify |
+        ProtectionFlags.CopyAndExtract |
+        ProtectionFlags.AnnotateAndFill |
+        ProtectionFlags.FillForms |
+        ProtectionFlags.ExtractForAccessibility |
+        ProtectionFlags.Assemble |
+        ProtectionFlags.PrintHighResolution,
+};
+export function encryptPDF(input, options) {
+    const output = new muhammara.PDFWStreamForBuffer();
+    const pdfPassword = {};
+    if (typeof options.password === 'string')
+        pdfPassword.userPassword = options.password;
+    if (typeof options.password === 'object') {
+        pdfPassword.userPassword = options.password.user;
+        pdfPassword.ownerPassword = options.password.owner;
+    }
+    muhammara.recrypt(new muhammara.PDFRStreamForBuffer(input), output, {
+        ...pdfPassword,
+        userProtectionFlag: options.protection,
+    });
+    return output.buffer;
+}
+//# sourceMappingURL=encrypt-pdf.js.map

package/dist/tools/encrypt-pdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt-pdf.js","sourceRoot":"","sources":["../../src/tools/encrypt-pdf.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,OAAO,SAAS,MAAM,WAAW,CAAA;AAEjC,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,uDAAS,CAAA;IACT,yDAAU,CAAA;IACV,0EAAmB,CAAA;IACnB,4EAAoB,CAAA;IACpB,iEAAe,CAAA;IACf,6FAA6B,CAAA;IAC7B,gEAAe,CAAA;IACf,sFAA0B,CAAA;AAC5B,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EACN,eAAe,CAAC,KAAK;QACrB,eAAe,CAAC,mBAAmB;QACnC,eAAe,CAAC,uBAAuB;IACzC,GAAG,EACD,eAAe,CAAC,KAAK;QACrB,eAAe,CAAC,MAAM;QACtB,eAAe,CAAC,cAAc;QAC9B,eAAe,CAAC,eAAe;QAC/B,eAAe,CAAC,SAAS;QACzB,eAAe,CAAC,uBAAuB;QACvC,eAAe,CAAC,QAAQ;QACxB,eAAe,CAAC,mBAAmB;CAC7B,CAAA;AAcV,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,OAA0B;IAClE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAA;IAElD,MAAM,WAAW,GAA2B,EAAE,CAAA;IAE9C,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACtC,WAAW,CAAC,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE7C,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,WAAW,CAAC,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAA;QAChD,WAAW,CAAC,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpD,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE;QAClE,GAAG,WAAW;QACd,kBAAkB,EAAE,OAAO,CAAC,UAAU;KACvC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/pdf",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Declarative PDF rendering module for the T4H Framework",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/pdf",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -48,6 +48,7 @@
   },
   "dependencies": {
     "@react-pdf/renderer": "^4.5.1",
+    "muhammara": "^6.0.5",
     "react": "^19.2.8"
   }
 }