pdf-codec 1.4.2 → 1.5.0

package/dist/crypto/sha2.cjs

@@ -0,0 +1,261 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/crypto/sha2.ts
+const SHA256_BLOCK_BYTES = 64;
+const SHA256_ROUNDS = 64;
+const SHA512_BLOCK_BYTES = 128;
+const SHA512_ROUNDS = 80;
+const WORDS_PER_BLOCK = 16;
+const MASK64 = 18446744073709551615n;
+const K512 = [
+	4794697086780616226n,
+	8158064640168781261n,
+	13096744586834688815n,
+	16840607885511220156n,
+	4131703408338449720n,
+	6480981068601479193n,
+	10538285296894168987n,
+	12329834152419229976n,
+	15566598209576043074n,
+	1334009975649890238n,
+	2608012711638119052n,
+	6128411473006802146n,
+	8268148722764581231n,
+	9286055187155687089n,
+	11230858885718282805n,
+	13951009754708518548n,
+	16472876342353939154n,
+	17275323862435702243n,
+	1135362057144423861n,
+	2597628984639134821n,
+	3308224258029322869n,
+	5365058923640841347n,
+	6679025012923562964n,
+	8573033837759648693n,
+	10970295158949994411n,
+	12119686244451234320n,
+	12683024718118986047n,
+	13788192230050041572n,
+	14330467153632333762n,
+	15395433587784984357n,
+	489312712824947311n,
+	1452737877330783856n,
+	2861767655752347644n,
+	3322285676063803686n,
+	5560940570517711597n,
+	5996557281743188959n,
+	7280758554555802590n,
+	8532644243296465576n,
+	9350256976987008742n,
+	10552545826968843579n,
+	11727347734174303076n,
+	12113106623233404929n,
+	14000437183269869457n,
+	14369950271660146224n,
+	15101387698204529176n,
+	15463397548674623760n,
+	17586052441742319658n,
+	1182934255886127544n,
+	1847814050463011016n,
+	2177327727835720531n,
+	2830643537854262169n,
+	3796741975233480872n,
+	4115178125766777443n,
+	5681478168544905931n,
+	6601373596472566643n,
+	7507060721942968483n,
+	8399075790359081724n,
+	8693463985226723168n,
+	9568029438360202098n,
+	10144078919501101548n,
+	10430055236837252648n,
+	11840083180663258601n,
+	13761210420658862357n,
+	14299343276471374635n,
+	14566680578165727644n,
+	15097957966210449927n,
+	16922976911328602910n,
+	17689382322260857208n,
+	500013540394364858n,
+	748580250866718886n,
+	1242879168328830382n,
+	1977374033974150939n,
+	2944078676154940804n,
+	3659926193048069267n,
+	4368137639120453308n,
+	4836135668995329356n,
+	5532061633213252278n,
+	6448918945643986474n,
+	6902733635092675308n,
+	7801388544844847127n
+];
+const H512 = [
+	7640891576956012808n,
+	13503953896175478587n,
+	4354685564936845355n,
+	11912009170470909681n,
+	5840696475078001361n,
+	11170449401992604703n,
+	2270897969802886507n,
+	6620516959819538809n
+];
+const H384 = [
+	14680500436340154072n,
+	7105036623409894663n,
+	10473403895298186519n,
+	1526699215303891257n,
+	7436329637833083697n,
+	10282925794625328401n,
+	15784041429090275239n,
+	5167115440072839076n
+];
+const K256 = Uint32Array.from(K512.slice(0, SHA256_ROUNDS), (k) => Number(k >> 32n));
+const H256 = Uint32Array.from(H512, (h) => Number(h >> 32n));
+function padBigEndian(bytes, blockBytes, lengthBytes) {
+	const paddedLength = (Math.floor((bytes.length + lengthBytes) / blockBytes) + 1) * blockBytes;
+	const padded = new Uint8Array(paddedLength);
+	padded.set(bytes);
+	padded[bytes.length] = 128;
+	let bitLength = bytes.length * 8;
+	for (let i = 0; i < lengthBytes && bitLength > 0; i++) {
+		padded[paddedLength - 1 - i] = bitLength % 256;
+		bitLength = Math.floor(bitLength / 256);
+	}
+	return padded;
+}
+function rotr32(value, bits) {
+	return (value >>> bits | value << 32 - bits) >>> 0;
+}
+function sha256(bytes) {
+	const padded = padBigEndian(bytes, SHA256_BLOCK_BYTES, 8);
+	const state = Uint32Array.from(H256);
+	const w = new Uint32Array(SHA256_ROUNDS);
+	for (let offset = 0; offset < padded.length; offset += SHA256_BLOCK_BYTES) {
+		for (let t = 0; t < WORDS_PER_BLOCK; t++) {
+			const at = offset + t * 4;
+			w[t] = (padded[at] << 24 | padded[at + 1] << 16 | padded[at + 2] << 8 | padded[at + 3]) >>> 0;
+		}
+		for (let t = WORDS_PER_BLOCK; t < SHA256_ROUNDS; t++) {
+			const x = w[t - 15];
+			const y = w[t - 2];
+			const s0 = rotr32(x, 7) ^ rotr32(x, 18) ^ x >>> 3;
+			const s1 = rotr32(y, 17) ^ rotr32(y, 19) ^ y >>> 10;
+			w[t] = w[t - 16] + s0 + w[t - 7] + s1 >>> 0;
+		}
+		let a = state[0];
+		let b = state[1];
+		let c = state[2];
+		let d = state[3];
+		let e = state[4];
+		let f = state[5];
+		let g = state[6];
+		let h = state[7];
+		for (let t = 0; t < SHA256_ROUNDS; t++) {
+			const bigS1 = rotr32(e, 6) ^ rotr32(e, 11) ^ rotr32(e, 25);
+			const ch = e & f ^ ~e & g;
+			const t1 = h + bigS1 + (ch >>> 0) + K256[t] + w[t] >>> 0;
+			const t2 = (rotr32(a, 2) ^ rotr32(a, 13) ^ rotr32(a, 22)) + ((a & b ^ a & c ^ b & c) >>> 0) >>> 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2 >>> 0;
+		}
+		const next = [
+			a,
+			b,
+			c,
+			d,
+			e,
+			f,
+			g,
+			h
+		];
+		for (let i = 0; i < state.length; i++) state[i] = state[i] + next[i] >>> 0;
+	}
+	const digest = new Uint8Array(state.length * 4);
+	for (let i = 0; i < state.length; i++) {
+		const word = state[i];
+		digest[i * 4] = word >>> 24 & 255;
+		digest[i * 4 + 1] = word >>> 16 & 255;
+		digest[i * 4 + 2] = word >>> 8 & 255;
+		digest[i * 4 + 3] = word & 255;
+	}
+	return digest;
+}
+function rotr64(value, bits) {
+	return (value >> bits | value << 64n - bits) & MASK64;
+}
+function sha512Core(bytes, initialState, outputWords) {
+	const padded = padBigEndian(bytes, SHA512_BLOCK_BYTES, 16);
+	const state = Array.from(initialState);
+	const w = new Array(SHA512_ROUNDS).fill(0n);
+	for (let offset = 0; offset < padded.length; offset += SHA512_BLOCK_BYTES) {
+		for (let t = 0; t < WORDS_PER_BLOCK; t++) {
+			let word = 0n;
+			for (let i = 0; i < 8; i++) word = word << 8n | BigInt(padded[offset + t * 8 + i]);
+			w[t] = word;
+		}
+		for (let t = WORDS_PER_BLOCK; t < SHA512_ROUNDS; t++) {
+			const x = w[t - 15];
+			const y = w[t - 2];
+			const s0 = rotr64(x, 1n) ^ rotr64(x, 8n) ^ x >> 7n;
+			const s1 = rotr64(y, 19n) ^ rotr64(y, 61n) ^ y >> 6n;
+			w[t] = w[t - 16] + s0 + w[t - 7] + s1 & MASK64;
+		}
+		let a = state[0];
+		let b = state[1];
+		let c = state[2];
+		let d = state[3];
+		let e = state[4];
+		let f = state[5];
+		let g = state[6];
+		let h = state[7];
+		for (let t = 0; t < SHA512_ROUNDS; t++) {
+			const bigS1 = rotr64(e, 14n) ^ rotr64(e, 18n) ^ rotr64(e, 41n);
+			const ch = e & f ^ ~e & MASK64 & g;
+			const t1 = h + bigS1 + ch + K512[t] + w[t] & MASK64;
+			const t2 = (rotr64(a, 28n) ^ rotr64(a, 34n) ^ rotr64(a, 39n)) + (a & b ^ a & c ^ b & c) & MASK64;
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1 & MASK64;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2 & MASK64;
+		}
+		const next = [
+			a,
+			b,
+			c,
+			d,
+			e,
+			f,
+			g,
+			h
+		];
+		for (let i = 0; i < state.length; i++) state[i] = state[i] + next[i] & MASK64;
+	}
+	const digest = new Uint8Array(outputWords * 8);
+	for (let i = 0; i < outputWords; i++) {
+		let word = state[i];
+		for (let j = 7; j >= 0; j--) {
+			digest[i * 8 + j] = Number(word & 255n);
+			word >>= 8n;
+		}
+	}
+	return digest;
+}
+function sha512(bytes) {
+	return sha512Core(bytes, H512, 8);
+}
+function sha384(bytes) {
+	return sha512Core(bytes, H384, 6);
+}
+//#endregion
+exports.sha256 = sha256;
+exports.sha384 = sha384;
+exports.sha512 = sha512;

package/dist/crypto/sha2.d.cts

@@ -0,0 +1,6 @@
+//#region src/crypto/sha2.d.ts
+declare function sha256(bytes: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+declare function sha512(bytes: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+declare function sha384(bytes: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+//#endregion
+export { sha256, sha384, sha512 };

package/dist/crypto/sha2.d.ts

@@ -0,0 +1,6 @@
+//#region src/crypto/sha2.d.ts
+declare function sha256(bytes: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+declare function sha512(bytes: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+declare function sha384(bytes: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+//#endregion
+export { sha256, sha384, sha512 };

package/dist/crypto/sha2.js

@@ -0,0 +1,258 @@
+//#region src/crypto/sha2.ts
+const SHA256_BLOCK_BYTES = 64;
+const SHA256_ROUNDS = 64;
+const SHA512_BLOCK_BYTES = 128;
+const SHA512_ROUNDS = 80;
+const WORDS_PER_BLOCK = 16;
+const MASK64 = 18446744073709551615n;
+const K512 = [
+	4794697086780616226n,
+	8158064640168781261n,
+	13096744586834688815n,
+	16840607885511220156n,
+	4131703408338449720n,
+	6480981068601479193n,
+	10538285296894168987n,
+	12329834152419229976n,
+	15566598209576043074n,
+	1334009975649890238n,
+	2608012711638119052n,
+	6128411473006802146n,
+	8268148722764581231n,
+	9286055187155687089n,
+	11230858885718282805n,
+	13951009754708518548n,
+	16472876342353939154n,
+	17275323862435702243n,
+	1135362057144423861n,
+	2597628984639134821n,
+	3308224258029322869n,
+	5365058923640841347n,
+	6679025012923562964n,
+	8573033837759648693n,
+	10970295158949994411n,
+	12119686244451234320n,
+	12683024718118986047n,
+	13788192230050041572n,
+	14330467153632333762n,
+	15395433587784984357n,
+	489312712824947311n,
+	1452737877330783856n,
+	2861767655752347644n,
+	3322285676063803686n,
+	5560940570517711597n,
+	5996557281743188959n,
+	7280758554555802590n,
+	8532644243296465576n,
+	9350256976987008742n,
+	10552545826968843579n,
+	11727347734174303076n,
+	12113106623233404929n,
+	14000437183269869457n,
+	14369950271660146224n,
+	15101387698204529176n,
+	15463397548674623760n,
+	17586052441742319658n,
+	1182934255886127544n,
+	1847814050463011016n,
+	2177327727835720531n,
+	2830643537854262169n,
+	3796741975233480872n,
+	4115178125766777443n,
+	5681478168544905931n,
+	6601373596472566643n,
+	7507060721942968483n,
+	8399075790359081724n,
+	8693463985226723168n,
+	9568029438360202098n,
+	10144078919501101548n,
+	10430055236837252648n,
+	11840083180663258601n,
+	13761210420658862357n,
+	14299343276471374635n,
+	14566680578165727644n,
+	15097957966210449927n,
+	16922976911328602910n,
+	17689382322260857208n,
+	500013540394364858n,
+	748580250866718886n,
+	1242879168328830382n,
+	1977374033974150939n,
+	2944078676154940804n,
+	3659926193048069267n,
+	4368137639120453308n,
+	4836135668995329356n,
+	5532061633213252278n,
+	6448918945643986474n,
+	6902733635092675308n,
+	7801388544844847127n
+];
+const H512 = [
+	7640891576956012808n,
+	13503953896175478587n,
+	4354685564936845355n,
+	11912009170470909681n,
+	5840696475078001361n,
+	11170449401992604703n,
+	2270897969802886507n,
+	6620516959819538809n
+];
+const H384 = [
+	14680500436340154072n,
+	7105036623409894663n,
+	10473403895298186519n,
+	1526699215303891257n,
+	7436329637833083697n,
+	10282925794625328401n,
+	15784041429090275239n,
+	5167115440072839076n
+];
+const K256 = Uint32Array.from(K512.slice(0, SHA256_ROUNDS), (k) => Number(k >> 32n));
+const H256 = Uint32Array.from(H512, (h) => Number(h >> 32n));
+function padBigEndian(bytes, blockBytes, lengthBytes) {
+	const paddedLength = (Math.floor((bytes.length + lengthBytes) / blockBytes) + 1) * blockBytes;
+	const padded = new Uint8Array(paddedLength);
+	padded.set(bytes);
+	padded[bytes.length] = 128;
+	let bitLength = bytes.length * 8;
+	for (let i = 0; i < lengthBytes && bitLength > 0; i++) {
+		padded[paddedLength - 1 - i] = bitLength % 256;
+		bitLength = Math.floor(bitLength / 256);
+	}
+	return padded;
+}
+function rotr32(value, bits) {
+	return (value >>> bits | value << 32 - bits) >>> 0;
+}
+function sha256(bytes) {
+	const padded = padBigEndian(bytes, SHA256_BLOCK_BYTES, 8);
+	const state = Uint32Array.from(H256);
+	const w = new Uint32Array(SHA256_ROUNDS);
+	for (let offset = 0; offset < padded.length; offset += SHA256_BLOCK_BYTES) {
+		for (let t = 0; t < WORDS_PER_BLOCK; t++) {
+			const at = offset + t * 4;
+			w[t] = (padded[at] << 24 | padded[at + 1] << 16 | padded[at + 2] << 8 | padded[at + 3]) >>> 0;
+		}
+		for (let t = WORDS_PER_BLOCK; t < SHA256_ROUNDS; t++) {
+			const x = w[t - 15];
+			const y = w[t - 2];
+			const s0 = rotr32(x, 7) ^ rotr32(x, 18) ^ x >>> 3;
+			const s1 = rotr32(y, 17) ^ rotr32(y, 19) ^ y >>> 10;
+			w[t] = w[t - 16] + s0 + w[t - 7] + s1 >>> 0;
+		}
+		let a = state[0];
+		let b = state[1];
+		let c = state[2];
+		let d = state[3];
+		let e = state[4];
+		let f = state[5];
+		let g = state[6];
+		let h = state[7];
+		for (let t = 0; t < SHA256_ROUNDS; t++) {
+			const bigS1 = rotr32(e, 6) ^ rotr32(e, 11) ^ rotr32(e, 25);
+			const ch = e & f ^ ~e & g;
+			const t1 = h + bigS1 + (ch >>> 0) + K256[t] + w[t] >>> 0;
+			const t2 = (rotr32(a, 2) ^ rotr32(a, 13) ^ rotr32(a, 22)) + ((a & b ^ a & c ^ b & c) >>> 0) >>> 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2 >>> 0;
+		}
+		const next = [
+			a,
+			b,
+			c,
+			d,
+			e,
+			f,
+			g,
+			h
+		];
+		for (let i = 0; i < state.length; i++) state[i] = state[i] + next[i] >>> 0;
+	}
+	const digest = new Uint8Array(state.length * 4);
+	for (let i = 0; i < state.length; i++) {
+		const word = state[i];
+		digest[i * 4] = word >>> 24 & 255;
+		digest[i * 4 + 1] = word >>> 16 & 255;
+		digest[i * 4 + 2] = word >>> 8 & 255;
+		digest[i * 4 + 3] = word & 255;
+	}
+	return digest;
+}
+function rotr64(value, bits) {
+	return (value >> bits | value << 64n - bits) & MASK64;
+}
+function sha512Core(bytes, initialState, outputWords) {
+	const padded = padBigEndian(bytes, SHA512_BLOCK_BYTES, 16);
+	const state = Array.from(initialState);
+	const w = new Array(SHA512_ROUNDS).fill(0n);
+	for (let offset = 0; offset < padded.length; offset += SHA512_BLOCK_BYTES) {
+		for (let t = 0; t < WORDS_PER_BLOCK; t++) {
+			let word = 0n;
+			for (let i = 0; i < 8; i++) word = word << 8n | BigInt(padded[offset + t * 8 + i]);
+			w[t] = word;
+		}
+		for (let t = WORDS_PER_BLOCK; t < SHA512_ROUNDS; t++) {
+			const x = w[t - 15];
+			const y = w[t - 2];
+			const s0 = rotr64(x, 1n) ^ rotr64(x, 8n) ^ x >> 7n;
+			const s1 = rotr64(y, 19n) ^ rotr64(y, 61n) ^ y >> 6n;
+			w[t] = w[t - 16] + s0 + w[t - 7] + s1 & MASK64;
+		}
+		let a = state[0];
+		let b = state[1];
+		let c = state[2];
+		let d = state[3];
+		let e = state[4];
+		let f = state[5];
+		let g = state[6];
+		let h = state[7];
+		for (let t = 0; t < SHA512_ROUNDS; t++) {
+			const bigS1 = rotr64(e, 14n) ^ rotr64(e, 18n) ^ rotr64(e, 41n);
+			const ch = e & f ^ ~e & MASK64 & g;
+			const t1 = h + bigS1 + ch + K512[t] + w[t] & MASK64;
+			const t2 = (rotr64(a, 28n) ^ rotr64(a, 34n) ^ rotr64(a, 39n)) + (a & b ^ a & c ^ b & c) & MASK64;
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1 & MASK64;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2 & MASK64;
+		}
+		const next = [
+			a,
+			b,
+			c,
+			d,
+			e,
+			f,
+			g,
+			h
+		];
+		for (let i = 0; i < state.length; i++) state[i] = state[i] + next[i] & MASK64;
+	}
+	const digest = new Uint8Array(outputWords * 8);
+	for (let i = 0; i < outputWords; i++) {
+		let word = state[i];
+		for (let j = 7; j >= 0; j--) {
+			digest[i * 8 + j] = Number(word & 255n);
+			word >>= 8n;
+		}
+	}
+	return digest;
+}
+function sha512(bytes) {
+	return sha512Core(bytes, H512, 8);
+}
+function sha384(bytes) {
+	return sha512Core(bytes, H384, 6);
+}
+//#endregion
+export { sha256, sha384, sha512 };

package/dist/diagnostics.cjs

@@ -15,7 +15,14 @@ var PdfEncryptedError = class extends PdfParseError {
 		this.name = "PdfEncryptedError";
 	}
 };
+var PdfPasswordRequiredError = class extends PdfParseError {
+	constructor(message = "this PDF is protected by a user password, which this codec does not accept; only PDFs that open without a password (the common permissions-only case) can be read") {
+		super("pdf/password-required", message);
+		this.name = "PdfPasswordRequiredError";
+	}
+};
 //#endregion
 exports.NOOP_DIAGNOSTIC_SINK = NOOP_DIAGNOSTIC_SINK;
 exports.PdfEncryptedError = PdfEncryptedError;
 exports.PdfParseError = PdfParseError;
+exports.PdfPasswordRequiredError = PdfPasswordRequiredError;

package/dist/diagnostics.d.cts

@@ -15,5 +15,8 @@ declare class PdfParseError extends Error {
 declare class PdfEncryptedError extends PdfParseError {
   constructor(message?: string);
 }
+declare class PdfPasswordRequiredError extends PdfParseError {
+  constructor(message?: string);
+}
 //#endregion
-export { NOOP_DIAGNOSTIC_SINK, PdfDiagnostic, PdfDiagnosticSeverity, PdfDiagnosticSink, PdfEncryptedError, PdfParseError };
+export { NOOP_DIAGNOSTIC_SINK, PdfDiagnostic, PdfDiagnosticSeverity, PdfDiagnosticSink, PdfEncryptedError, PdfParseError, PdfPasswordRequiredError };

package/dist/diagnostics.d.ts

@@ -15,5 +15,8 @@ declare class PdfParseError extends Error {
 declare class PdfEncryptedError extends PdfParseError {
   constructor(message?: string);
 }
+declare class PdfPasswordRequiredError extends PdfParseError {
+  constructor(message?: string);
+}
 //#endregion
-export { NOOP_DIAGNOSTIC_SINK, PdfDiagnostic, PdfDiagnosticSeverity, PdfDiagnosticSink, PdfEncryptedError, PdfParseError };
+export { NOOP_DIAGNOSTIC_SINK, PdfDiagnostic, PdfDiagnosticSeverity, PdfDiagnosticSink, PdfEncryptedError, PdfParseError, PdfPasswordRequiredError };

package/dist/diagnostics.js

@@ -14,5 +14,11 @@ var PdfEncryptedError = class extends PdfParseError {
 		this.name = "PdfEncryptedError";
 	}
 };
+var PdfPasswordRequiredError = class extends PdfParseError {
+	constructor(message = "this PDF is protected by a user password, which this codec does not accept; only PDFs that open without a password (the common permissions-only case) can be read") {
+		super("pdf/password-required", message);
+		this.name = "PdfPasswordRequiredError";
+	}
+};
 //#endregion
-export { NOOP_DIAGNOSTIC_SINK, PdfEncryptedError, PdfParseError };
+export { NOOP_DIAGNOSTIC_SINK, PdfEncryptedError, PdfParseError, PdfPasswordRequiredError };

package/dist/document.cjs

@@ -3,6 +3,7 @@ const require_bytes_reader = require("./bytes/reader.cjs");
 const require_lexer = require("./lexer.cjs");
 const require_diagnostics = require("./diagnostics.cjs");
 const require_objects = require("./objects.cjs");
+const require_encrypt = require("./encrypt.cjs");
 const require_filters = require("./filters.cjs");
 const require_parse = require("./parse.cjs");
 const require_xref = require("./xref.cjs");
@@ -14,11 +15,39 @@ const INHERITABLE_PAGE_KEYS = [
 	"CropBox",
 	"Rotate"
 ];
+function firstFileId(trailer) {
+	const first = require_objects.asArray(require_objects.dictGet(trailer, "ID"))?.[0];
+	return first?.kind === "string" ? first.bytes : /* @__PURE__ */ new Uint8Array(0);
+}
+function decryptDict(dict, num, gen, decryptor) {
+	return {
+		kind: "dict",
+		entries: new Map(Array.from(dict.entries, ([key, entry]) => [key, decryptObject(entry, num, gen, decryptor)]))
+	};
+}
+function decryptObject(value, num, gen, decryptor) {
+	if (value.kind === "string") return {
+		kind: "string",
+		bytes: decryptor.decryptString(value.bytes, num, gen),
+		hex: value.hex
+	};
+	if (value.kind === "array") return {
+		kind: "array",
+		items: value.items.map((item) => decryptObject(item, num, gen, decryptor))
+	};
+	if (value.kind === "dict") return decryptDict(value, num, gen, decryptor);
+	if (value.kind === "stream") return {
+		kind: "stream",
+		dict: decryptDict(value.dict, num, gen, decryptor),
+		raw: decryptor.decryptStream(value.raw, value.dict, num, gen)
+	};
+	return value;
+}
 function openPdfDocument(bytes, sink) {
 	const xref = require_xref.readXref(bytes, sink);
-	if (require_objects.dictGet(xref.trailer, "Encrypt") !== void 0) throw new require_diagnostics.PdfEncryptedError();
 	const objectCache = /* @__PURE__ */ new Map();
 	const objStmCache = /* @__PURE__ */ new Map();
+	let decryptor;
 	function fetchDirect(num, entry) {
 		const reader = new require_bytes_reader.ByteReader(bytes);
 		reader.seek(entry.offset);
@@ -31,7 +60,8 @@ function openPdfDocument(bytes, sink) {
 			});
 			return require_objects.pdfNull();
 		}
-		return indirect.value;
+		if (decryptor === void 0) return indirect.value;
+		return decryptObject(indirect.value, num, indirect.gen, decryptor);
 	}
 	function decodeObjectStream(streamObjNum) {
 		const cached = objStmCache.get(streamObjNum);
@@ -113,6 +143,12 @@ function openPdfDocument(bytes, sink) {
 		if (dict === void 0 || !require_objects.isName(require_objects.dictGet(dict, "Type"), "Catalog")) throw new require_diagnostics.PdfParseError("pdf/no-root", "no resolvable /Root catalog was found, even after cross-reference recovery");
 		return dict;
 	}
+	const encryptEntry = require_objects.dictGet(xref.trailer, "Encrypt");
+	if (encryptEntry !== void 0) {
+		const encryptDict = resolveDict(encryptEntry);
+		if (encryptDict === void 0) throw new require_diagnostics.PdfEncryptedError("the trailer names an /Encrypt dictionary that does not resolve to a dictionary at all");
+		decryptor = require_encrypt.createStandardDecryptor(encryptDict, firstFileId(xref.trailer), sink);
+	}
 	const catalog = requireCatalog(resolveDict(require_objects.dictGet(xref.trailer, "Root")));
 	function pages() {
 		const pagesRoot = resolveDict(require_objects.dictGet(catalog, "Pages"));