pdf-codec 1.4.2 → 1.6.0

package/dist/embedded-font-write.js

@@ -0,0 +1,90 @@
+import { crc32 } from "./bytes/crc32.js";
+import { pdfArray, pdfDict, pdfHexString, pdfName, pdfNum, pdfStream } from "./objects.js";
+import { deflate } from "./bytes/flate.js";
+import { buildToUnicodeCMap } from "./tounicode.js";
+//#region src/embedded-font-write.ts
+const FLAG_SERIF = 2;
+const FLAG_NONSYMBOLIC = 32;
+const FLAG_ITALIC = 64;
+const NOMINAL_STEM_V = 80;
+const DEFAULT_WIDTH = 1e3;
+const SUBSET_TAG_LENGTH = 6;
+const SUBSET_TAG_ALPHABET_SIZE = 26;
+const SUBSET_TAG_CODE_SPACE = SUBSET_TAG_ALPHABET_SIZE ** SUBSET_TAG_LENGTH;
+const UPPERCASE_A_CHAR_CODE = 65;
+function embeddedSubsetTag(postScriptName, glyphIds) {
+	let value = crc32(new TextEncoder().encode(`${postScriptName} ${glyphIds.join(",")}`)) % SUBSET_TAG_CODE_SPACE;
+	let tag = "";
+	for (let i = 0; i < SUBSET_TAG_LENGTH; i++) {
+		tag = String.fromCharCode(UPPERCASE_A_CHAR_CODE + value % SUBSET_TAG_ALPHABET_SIZE) + tag;
+		value = Math.floor(value / SUBSET_TAG_ALPHABET_SIZE);
+	}
+	return tag;
+}
+function computeFlags(face) {
+	let flags = FLAG_NONSYMBOLIC;
+	if (face.metrics.serif) flags |= FLAG_SERIF;
+	if (face.metrics.italicAngleDegrees !== 0) flags |= FLAG_ITALIC;
+	return flags;
+}
+function buildWidthsArray(face, glyphIds) {
+	const entries = [];
+	for (const glyphId of glyphIds) entries.push(pdfNum(glyphId), pdfArray([pdfNum(face.glyphSpaceWidth(glyphId))]));
+	return pdfArray(entries);
+}
+function buildFontDescriptor(face, baseFont, fontFileRef) {
+	const m = face.metrics;
+	const entries = /* @__PURE__ */ new Map([
+		["Type", pdfName("FontDescriptor")],
+		["FontName", pdfName(baseFont)],
+		["Flags", pdfNum(computeFlags(face))],
+		["FontBBox", pdfArray(m.bboxGlyphSpace.map((n) => pdfNum(n)))],
+		["ItalicAngle", pdfNum(m.italicAngleDegrees)],
+		["Ascent", pdfNum(m.ascentGlyphSpace)],
+		["Descent", pdfNum(m.descentGlyphSpace)],
+		["CapHeight", pdfNum(m.capHeightGlyphSpace)],
+		["StemV", pdfNum(NOMINAL_STEM_V)]
+	]);
+	if (m.xHeightGlyphSpace !== void 0) entries.set("XHeight", pdfNum(m.xHeightGlyphSpace));
+	entries.set("FontFile2", fontFileRef);
+	return pdfDict(entries);
+}
+function buildFontFileStream(subsetBytes, compress) {
+	const entries = /* @__PURE__ */ new Map([["Length1", pdfNum(subsetBytes.length)]]);
+	if (compress) entries.set("Filter", pdfName("FlateDecode"));
+	return pdfStream(pdfDict(entries), compress ? deflate(subsetBytes) : subsetBytes);
+}
+function buildEmbeddedFontObjects(face, subset, usedGlyphs, refs, compress) {
+	const baseFont = `${embeddedSubsetTag(face.postScriptName, subset.glyphIds)}+${face.postScriptName}`;
+	const cidFont = pdfDict({
+		Type: pdfName("Font"),
+		Subtype: pdfName("CIDFontType2"),
+		BaseFont: pdfName(baseFont),
+		CIDSystemInfo: pdfDict({
+			Registry: pdfHexString(new TextEncoder().encode("Adobe")),
+			Ordering: pdfHexString(new TextEncoder().encode("Identity")),
+			Supplement: pdfNum(0)
+		}),
+		FontDescriptor: refs.descriptorRef,
+		DW: pdfNum(DEFAULT_WIDTH),
+		W: buildWidthsArray(face, subset.glyphIds),
+		CIDToGIDMap: pdfName("Identity")
+	});
+	return {
+		baseFont,
+		type0: pdfDict({
+			Type: pdfName("Font"),
+			Subtype: pdfName("Type0"),
+			BaseFont: pdfName(baseFont),
+			Encoding: pdfName("Identity-H"),
+			DescendantFonts: pdfArray([refs.cidFontRef]),
+			ToUnicode: refs.toUnicodeRef
+		}),
+		cidFont,
+		descriptor: buildFontDescriptor(face, baseFont, refs.fontFileRef),
+		fontFile: buildFontFileStream(subset.bytes, compress),
+		toUnicode: buildToUnicodeCMap(usedGlyphs)
+	};
+}
+//#endregion
+export { buildEmbeddedFontObjects, embeddedSubsetTag };

package/dist/embedded-font.cjs

@@ -0,0 +1,142 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_sfnt = require("./sfnt.cjs");
+const require_cmap_table = require("./cmap-table.cjs");
+const require_font_tables = require("./font-tables.cjs");
+const require_glyf = require("./glyf.cjs");
+const require_hmtx_table = require("./hmtx-table.cjs");
+//#region src/embedded-font.ts
+const GLYPH_SPACE_UNITS_PER_EM = 1e3;
+const NOTDEF_GLYPH_ID = 0;
+const CAP_HEIGHT_REFERENCE_CODE_POINT = 72;
+const PANOSE_FAMILY_KIND_OFFSET = 0;
+const PANOSE_SERIF_STYLE_OFFSET = 1;
+const PANOSE_FAMILY_KIND_LATIN_TEXT = 2;
+const PANOSE_FIRST_SERIF_STYLE = 2;
+const PANOSE_LAST_SERIF_STYLE = 10;
+const cache = /* @__PURE__ */ new WeakMap();
+function scaleToGlyphSpace(designUnits, unitsPerEm) {
+	return designUnits * GLYPH_SPACE_UNITS_PER_EM / unitsPerEm;
+}
+function resolveCapHeight(font, cmap, declared, ascent) {
+	if (declared !== void 0) return declared;
+	const head = require_font_tables.parseHead(font);
+	const maxp = require_font_tables.parseMaxp(font);
+	const glyphId = cmap(CAP_HEIGHT_REFERENCE_CODE_POINT);
+	if (head === void 0 || maxp === void 0 || glyphId === void 0) return ascent;
+	return require_glyf.parseGlyf(font, {
+		numGlyphs: maxp.numGlyphs,
+		indexToLocFormat: head.indexToLocFormat
+	})?.glyphHeader(glyphId)?.yMax ?? ascent;
+}
+function isSerifByPanose(panose) {
+	if (panose?.[PANOSE_FAMILY_KIND_OFFSET] !== PANOSE_FAMILY_KIND_LATIN_TEXT) return false;
+	const serifStyle = panose[PANOSE_SERIF_STYLE_OFFSET];
+	return serifStyle !== void 0 && serifStyle >= PANOSE_FIRST_SERIF_STYLE && serifStyle <= PANOSE_LAST_SERIF_STYLE;
+}
+function loadEmbeddedFace(font) {
+	const cached = cache.get(font.bytes);
+	if (cached !== void 0 || cache.has(font.bytes)) return cached;
+	const face = readEmbeddedFace(font);
+	cache.set(font.bytes, face);
+	return face;
+}
+function readEmbeddedFace(font) {
+	const head = require_font_tables.parseHead(font);
+	const maxp = require_font_tables.parseMaxp(font);
+	const name = require_font_tables.parseName(font);
+	const cmap = require_cmap_table.buildCmapLookup(font);
+	if (head === void 0 || maxp === void 0 || cmap === void 0 || name?.postScriptName === void 0) return;
+	const hhea = parseHhea(font);
+	const hmtxBytes = require_sfnt.sfntTableBytes(font, "hmtx");
+	if (hhea === void 0 || hmtxBytes === void 0 || !require_sfnt.hasBytes(hmtxBytes, 0, hhea.numberOfHMetrics * LONG_HOR_METRIC_SIZE)) return;
+	const hmtx = require_hmtx_table.parseHmtx(font);
+	const os2 = require_font_tables.parseOs2(font);
+	const post = require_font_tables.parsePost(font);
+	const { unitsPerEm } = head;
+	const scale = (designUnits) => scaleToGlyphSpace(designUnits, unitsPerEm);
+	const capHeight = resolveCapHeight(font, cmap, os2?.sCapHeight, hhea.ascent);
+	return {
+		font,
+		postScriptName: name.postScriptName,
+		numGlyphs: maxp.numGlyphs,
+		metrics: {
+			unitsPerEm,
+			ascentGlyphSpace: scale(hhea.ascent),
+			descentGlyphSpace: scale(hhea.descent),
+			lineGapGlyphSpace: scale(hhea.lineGap),
+			typoAscentGlyphSpace: os2 === void 0 ? void 0 : scale(os2.sTypoAscender),
+			typoDescentGlyphSpace: os2 === void 0 ? void 0 : scale(os2.sTypoDescender),
+			typoLineGapGlyphSpace: os2 === void 0 ? void 0 : scale(os2.sTypoLineGap),
+			winAscentGlyphSpace: os2 === void 0 ? void 0 : scale(os2.usWinAscent),
+			winDescentGlyphSpace: os2 === void 0 ? void 0 : -scale(os2.usWinDescent),
+			capHeightGlyphSpace: scale(capHeight),
+			xHeightGlyphSpace: os2?.sxHeight === void 0 ? void 0 : scale(os2.sxHeight),
+			bboxGlyphSpace: [
+				scale(head.xMin),
+				scale(head.yMin),
+				scale(head.xMax),
+				scale(head.yMax)
+			],
+			italicAngleDegrees: post?.italicAngle ?? 0,
+			underlinePositionGlyphSpace: scale(post?.underlinePosition ?? 0),
+			underlineThicknessGlyphSpace: scale(post?.underlineThickness ?? 0),
+			serif: isSerifByPanose(os2?.panose)
+		},
+		glyphId: (codePoint) => cmap(codePoint),
+		glyphSpaceWidth: (glyphId) => scale(hmtx.advanceWidth(glyphId))
+	};
+}
+const HHEA_TABLE_SIZE = 36;
+const HHEA_ASCENDER_OFFSET = 4;
+const HHEA_DESCENDER_OFFSET = 6;
+const HHEA_LINE_GAP_OFFSET = 8;
+const HHEA_NUMBER_OF_HMETRICS_OFFSET = 34;
+const LONG_HOR_METRIC_SIZE = 4;
+function parseHhea(font) {
+	const bytes = require_sfnt.sfntTableBytes(font, "hhea");
+	if (bytes === void 0 || !require_sfnt.hasBytes(bytes, 0, HHEA_TABLE_SIZE)) return;
+	const numberOfHMetrics = require_sfnt.u16(bytes, HHEA_NUMBER_OF_HMETRICS_OFFSET);
+	if (numberOfHMetrics === 0) return;
+	return {
+		ascent: require_sfnt.i16(bytes, HHEA_ASCENDER_OFFSET),
+		descent: require_sfnt.i16(bytes, HHEA_DESCENDER_OFFSET),
+		lineGap: require_sfnt.i16(bytes, HHEA_LINE_GAP_OFFSET),
+		numberOfHMetrics
+	};
+}
+function encodeForShowEmbedded(text, face) {
+	const glyphIds = [];
+	const substitutions = [];
+	let width1000 = 0;
+	for (const character of text) {
+		const glyphId = face.glyphId(character.codePointAt(0));
+		if (glyphId === void 0) substitutions.push({ from: character });
+		const shown = glyphId ?? 0;
+		glyphIds.push(shown);
+		width1000 += face.glyphSpaceWidth(shown);
+	}
+	const codes = new Uint8Array(glyphIds.length * 2);
+	glyphIds.forEach((glyphId, index) => {
+		codes[index * 2] = glyphId >> 8 & 255;
+		codes[index * 2 + 1] = glyphId & 255;
+	});
+	return {
+		codes,
+		width1000,
+		substitutions
+	};
+}
+function collectEmbeddedGlyphs(texts, face) {
+	const used = /* @__PURE__ */ new Map();
+	for (const text of texts) for (const character of text) {
+		const codePoint = character.codePointAt(0);
+		const glyphId = face.glyphId(codePoint);
+		if (glyphId !== void 0 && !used.has(glyphId)) used.set(glyphId, codePoint);
+	}
+	return used;
+}
+//#endregion
+exports.NOTDEF_GLYPH_ID = NOTDEF_GLYPH_ID;
+exports.collectEmbeddedGlyphs = collectEmbeddedGlyphs;
+exports.encodeForShowEmbedded = encodeForShowEmbedded;
+exports.loadEmbeddedFace = loadEmbeddedFace;

package/dist/embedded-font.d.cts

@@ -0,0 +1,2 @@
+import { a as NOTDEF_GLYPH_ID, c as loadEmbeddedFace, i as EmbeddedShow, n as EmbeddedFaceMetrics, o as collectEmbeddedGlyphs, r as EmbeddedFaceSubstitution, s as encodeForShowEmbedded, t as EmbeddedFace } from "./embedded-font-CLedn-mT.cjs";
+export { EmbeddedFace, EmbeddedFaceMetrics, EmbeddedFaceSubstitution, EmbeddedShow, NOTDEF_GLYPH_ID, collectEmbeddedGlyphs, encodeForShowEmbedded, loadEmbeddedFace };

package/dist/embedded-font.d.ts

@@ -0,0 +1,2 @@
+import { a as NOTDEF_GLYPH_ID, c as loadEmbeddedFace, i as EmbeddedShow, n as EmbeddedFaceMetrics, o as collectEmbeddedGlyphs, r as EmbeddedFaceSubstitution, s as encodeForShowEmbedded, t as EmbeddedFace } from "./embedded-font-CbqkKgBl.js";
+export { EmbeddedFace, EmbeddedFaceMetrics, EmbeddedFaceSubstitution, EmbeddedShow, NOTDEF_GLYPH_ID, collectEmbeddedGlyphs, encodeForShowEmbedded, loadEmbeddedFace };

package/dist/embedded-font.js

@@ -0,0 +1,138 @@
+import { hasBytes, i16, sfntTableBytes, u16 } from "./sfnt.js";
+import { buildCmapLookup } from "./cmap-table.js";
+import { parseHead, parseMaxp, parseName, parseOs2, parsePost } from "./font-tables.js";
+import { parseGlyf } from "./glyf.js";
+import { parseHmtx } from "./hmtx-table.js";
+//#region src/embedded-font.ts
+const GLYPH_SPACE_UNITS_PER_EM = 1e3;
+const NOTDEF_GLYPH_ID = 0;
+const CAP_HEIGHT_REFERENCE_CODE_POINT = 72;
+const PANOSE_FAMILY_KIND_OFFSET = 0;
+const PANOSE_SERIF_STYLE_OFFSET = 1;
+const PANOSE_FAMILY_KIND_LATIN_TEXT = 2;
+const PANOSE_FIRST_SERIF_STYLE = 2;
+const PANOSE_LAST_SERIF_STYLE = 10;
+const cache = /* @__PURE__ */ new WeakMap();
+function scaleToGlyphSpace(designUnits, unitsPerEm) {
+	return designUnits * GLYPH_SPACE_UNITS_PER_EM / unitsPerEm;
+}
+function resolveCapHeight(font, cmap, declared, ascent) {
+	if (declared !== void 0) return declared;
+	const head = parseHead(font);
+	const maxp = parseMaxp(font);
+	const glyphId = cmap(CAP_HEIGHT_REFERENCE_CODE_POINT);
+	if (head === void 0 || maxp === void 0 || glyphId === void 0) return ascent;
+	return parseGlyf(font, {
+		numGlyphs: maxp.numGlyphs,
+		indexToLocFormat: head.indexToLocFormat
+	})?.glyphHeader(glyphId)?.yMax ?? ascent;
+}
+function isSerifByPanose(panose) {
+	if (panose?.[PANOSE_FAMILY_KIND_OFFSET] !== PANOSE_FAMILY_KIND_LATIN_TEXT) return false;
+	const serifStyle = panose[PANOSE_SERIF_STYLE_OFFSET];
+	return serifStyle !== void 0 && serifStyle >= PANOSE_FIRST_SERIF_STYLE && serifStyle <= PANOSE_LAST_SERIF_STYLE;
+}
+function loadEmbeddedFace(font) {
+	const cached = cache.get(font.bytes);
+	if (cached !== void 0 || cache.has(font.bytes)) return cached;
+	const face = readEmbeddedFace(font);
+	cache.set(font.bytes, face);
+	return face;
+}
+function readEmbeddedFace(font) {
+	const head = parseHead(font);
+	const maxp = parseMaxp(font);
+	const name = parseName(font);
+	const cmap = buildCmapLookup(font);
+	if (head === void 0 || maxp === void 0 || cmap === void 0 || name?.postScriptName === void 0) return;
+	const hhea = parseHhea(font);
+	const hmtxBytes = sfntTableBytes(font, "hmtx");
+	if (hhea === void 0 || hmtxBytes === void 0 || !hasBytes(hmtxBytes, 0, hhea.numberOfHMetrics * LONG_HOR_METRIC_SIZE)) return;
+	const hmtx = parseHmtx(font);
+	const os2 = parseOs2(font);
+	const post = parsePost(font);
+	const { unitsPerEm } = head;
+	const scale = (designUnits) => scaleToGlyphSpace(designUnits, unitsPerEm);
+	const capHeight = resolveCapHeight(font, cmap, os2?.sCapHeight, hhea.ascent);
+	return {
+		font,
+		postScriptName: name.postScriptName,
+		numGlyphs: maxp.numGlyphs,
+		metrics: {
+			unitsPerEm,
+			ascentGlyphSpace: scale(hhea.ascent),
+			descentGlyphSpace: scale(hhea.descent),
+			lineGapGlyphSpace: scale(hhea.lineGap),
+			typoAscentGlyphSpace: os2 === void 0 ? void 0 : scale(os2.sTypoAscender),
+			typoDescentGlyphSpace: os2 === void 0 ? void 0 : scale(os2.sTypoDescender),
+			typoLineGapGlyphSpace: os2 === void 0 ? void 0 : scale(os2.sTypoLineGap),
+			winAscentGlyphSpace: os2 === void 0 ? void 0 : scale(os2.usWinAscent),
+			winDescentGlyphSpace: os2 === void 0 ? void 0 : -scale(os2.usWinDescent),
+			capHeightGlyphSpace: scale(capHeight),
+			xHeightGlyphSpace: os2?.sxHeight === void 0 ? void 0 : scale(os2.sxHeight),
+			bboxGlyphSpace: [
+				scale(head.xMin),
+				scale(head.yMin),
+				scale(head.xMax),
+				scale(head.yMax)
+			],
+			italicAngleDegrees: post?.italicAngle ?? 0,
+			underlinePositionGlyphSpace: scale(post?.underlinePosition ?? 0),
+			underlineThicknessGlyphSpace: scale(post?.underlineThickness ?? 0),
+			serif: isSerifByPanose(os2?.panose)
+		},
+		glyphId: (codePoint) => cmap(codePoint),
+		glyphSpaceWidth: (glyphId) => scale(hmtx.advanceWidth(glyphId))
+	};
+}
+const HHEA_TABLE_SIZE = 36;
+const HHEA_ASCENDER_OFFSET = 4;
+const HHEA_DESCENDER_OFFSET = 6;
+const HHEA_LINE_GAP_OFFSET = 8;
+const HHEA_NUMBER_OF_HMETRICS_OFFSET = 34;
+const LONG_HOR_METRIC_SIZE = 4;
+function parseHhea(font) {
+	const bytes = sfntTableBytes(font, "hhea");
+	if (bytes === void 0 || !hasBytes(bytes, 0, HHEA_TABLE_SIZE)) return;
+	const numberOfHMetrics = u16(bytes, HHEA_NUMBER_OF_HMETRICS_OFFSET);
+	if (numberOfHMetrics === 0) return;
+	return {
+		ascent: i16(bytes, HHEA_ASCENDER_OFFSET),
+		descent: i16(bytes, HHEA_DESCENDER_OFFSET),
+		lineGap: i16(bytes, HHEA_LINE_GAP_OFFSET),
+		numberOfHMetrics
+	};
+}
+function encodeForShowEmbedded(text, face) {
+	const glyphIds = [];
+	const substitutions = [];
+	let width1000 = 0;
+	for (const character of text) {
+		const glyphId = face.glyphId(character.codePointAt(0));
+		if (glyphId === void 0) substitutions.push({ from: character });
+		const shown = glyphId ?? 0;
+		glyphIds.push(shown);
+		width1000 += face.glyphSpaceWidth(shown);
+	}
+	const codes = new Uint8Array(glyphIds.length * 2);
+	glyphIds.forEach((glyphId, index) => {
+		codes[index * 2] = glyphId >> 8 & 255;
+		codes[index * 2 + 1] = glyphId & 255;
+	});
+	return {
+		codes,
+		width1000,
+		substitutions
+	};
+}
+function collectEmbeddedGlyphs(texts, face) {
+	const used = /* @__PURE__ */ new Map();
+	for (const text of texts) for (const character of text) {
+		const codePoint = character.codePointAt(0);
+		const glyphId = face.glyphId(codePoint);
+		if (glyphId !== void 0 && !used.has(glyphId)) used.set(glyphId, codePoint);
+	}
+	return used;
+}
+//#endregion
+export { NOTDEF_GLYPH_ID, collectEmbeddedGlyphs, encodeForShowEmbedded, loadEmbeddedFace };

package/dist/encrypt.cjs

@@ -0,0 +1,264 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_bytes_writer = require("./bytes/writer.cjs");
+const require_diagnostics = require("./diagnostics.cjs");
+const require_crypto_aes = require("./crypto/aes.cjs");
+const require_crypto_md5 = require("./crypto/md5.cjs");
+const require_crypto_rc4 = require("./crypto/rc4.cjs");
+const require_crypto_sha2 = require("./crypto/sha2.cjs");
+const require_objects = require("./objects.cjs");
+//#region src/encrypt.ts
+const PASSWORD_PADDING = new Uint8Array([
+	40,
+	191,
+	78,
+	94,
+	78,
+	117,
+	138,
+	65,
+	100,
+	0,
+	78,
+	86,
+	255,
+	250,
+	1,
+	8,
+	46,
+	46,
+	0,
+	182,
+	208,
+	104,
+	62,
+	128,
+	47,
+	12,
+	169,
+	254,
+	100,
+	83,
+	105,
+	122
+]);
+const AES_OBJECT_KEY_SALT = new Uint8Array([
+	115,
+	65,
+	108,
+	84
+]);
+const MD5_DIGEST_BYTES = 16;
+const OBJECT_KEY_EXTRA_BYTES = 5;
+const LEGACY_KEY_ITERATIONS = 50;
+const ALGORITHM_5_ITERATIONS = 19;
+const R6_MINIMUM_ROUNDS = 64;
+const R6_ROUND_REPEATS = 64;
+const R6_TERMINATION_MARGIN = 32;
+const AESV3_KEY_BYTES = 32;
+const RC4_40_KEY_BYTES = 5;
+const AESV2_KEY_BYTES = 16;
+const DEFAULT_KEY_BITS = 40;
+const BITS_PER_BYTE = 8;
+const MAX_RC4_KEY_BYTES = 16;
+const ZERO_IV = /* @__PURE__ */ new Uint8Array(16);
+function requireStringBytes(dict, key) {
+	const value = require_objects.dictGet(dict, key);
+	if (value?.kind !== "string") throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /${key} entry is missing or is not a direct string; this file's encryption cannot be read`);
+	return value.bytes;
+}
+function bytesEqual(a, b, length) {
+	if (a.length < length || b.length < length) return false;
+	for (let i = 0; i < length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+function permissionsBytes(p) {
+	const unsigned = Math.trunc(p) >>> 0;
+	return new Uint8Array([
+		unsigned & 255,
+		unsigned >>> 8 & 255,
+		unsigned >>> 16 & 255,
+		unsigned >>> 24 & 255
+	]);
+}
+function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
+	const owner = requireStringBytes(encryptDict, "O");
+	const permissions = require_objects.asNumber(require_objects.dictGet(encryptDict, "P")) ?? 0;
+	const parts = [
+		PASSWORD_PADDING,
+		owner.subarray(0, PASSWORD_PADDING.length),
+		permissionsBytes(permissions),
+		fileId
+	];
+	if (revision >= 4 && !encryptMetadata) parts.push(new Uint8Array([
+		255,
+		255,
+		255,
+		255
+	]));
+	let digest = require_crypto_md5.md5(require_bytes_writer.concatBytes(parts));
+	if (revision >= 3) for (let i = 0; i < LEGACY_KEY_ITERATIONS; i++) digest = require_crypto_md5.md5(digest.subarray(0, keyBytes));
+	return digest.subarray(0, keyBytes);
+}
+function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	if (revision === 2) return bytesEqual(require_crypto_rc4.rc4(fileKey, PASSWORD_PADDING), storedUser, PASSWORD_PADDING.length);
+	let value = require_crypto_rc4.rc4(fileKey, require_crypto_md5.md5(require_bytes_writer.concatBytes([PASSWORD_PADDING, fileId])));
+	for (let i = 1; i <= ALGORITHM_5_ITERATIONS; i++) {
+		const roundKey = Uint8Array.from(fileKey, (byte) => byte ^ i);
+		value = require_crypto_rc4.rc4(roundKey, value);
+	}
+	return bytesEqual(value, storedUser, MD5_DIGEST_BYTES);
+}
+function hardenedHash(password, salt, userData, revision) {
+	let k = require_crypto_sha2.sha256(require_bytes_writer.concatBytes([
+		password,
+		salt,
+		userData
+	]));
+	if (revision === 5) return k;
+	let e = new Uint8Array([0]);
+	let round = 0;
+	while (round < R6_MINIMUM_ROUNDS || e[e.length - 1] > round - R6_TERMINATION_MARGIN) {
+		const roundInput = require_bytes_writer.concatBytes([
+			password,
+			k,
+			userData
+		]);
+		const k1 = new Uint8Array(roundInput.length * R6_ROUND_REPEATS);
+		for (let i = 0; i < R6_ROUND_REPEATS; i++) k1.set(roundInput, i * roundInput.length);
+		e = require_crypto_aes.aesCbcEncrypt(k.subarray(0, 16), k.subarray(16, 32), k1);
+		let sum = 0;
+		for (let i = 0; i < 16; i++) sum += e[i];
+		const selector = sum % 3;
+		k = selector === 0 ? require_crypto_sha2.sha256(e) : selector === 1 ? require_crypto_sha2.sha384(e) : require_crypto_sha2.sha512(e);
+		round++;
+	}
+	return k.subarray(0, AESV3_KEY_BYTES);
+}
+function computeAesV3FileKey(encryptDict, revision) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	const expectedLength = 48;
+	if (storedUser.length < expectedLength) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /U entry is ${String(storedUser.length)} bytes; revision ${String(revision)} requires ${String(expectedLength)}`);
+	const empty = /* @__PURE__ */ new Uint8Array(0);
+	const validationSalt = storedUser.subarray(AESV3_KEY_BYTES, 40);
+	const keySalt = storedUser.subarray(40, expectedLength);
+	if (!bytesEqual(hardenedHash(empty, validationSalt, empty, revision), storedUser, AESV3_KEY_BYTES)) throw new require_diagnostics.PdfPasswordRequiredError();
+	const intermediateKey = hardenedHash(empty, keySalt, empty, revision);
+	const wrappedKey = requireStringBytes(encryptDict, "UE");
+	if (wrappedKey.length < AESV3_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /UE entry is ${String(wrappedKey.length)} bytes; revision ${String(revision)} requires ${String(AESV3_KEY_BYTES)}`);
+	return require_crypto_aes.aesCbcDecrypt(intermediateKey, ZERO_IV, wrappedKey.subarray(0, AESV3_KEY_BYTES));
+}
+function methodFromCryptFilterName(encryptDict, entryKey) {
+	const name = require_objects.asName(require_objects.dictGet(encryptDict, entryKey)) ?? "Identity";
+	if (name === "Identity") return "identity";
+	const filters = require_objects.asDict(require_objects.dictGet(encryptDict, "CF"));
+	const filter = filters !== void 0 ? require_objects.asDict(require_objects.dictGet(filters, name)) : void 0;
+	if (filter === void 0) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary names a crypt filter /${name} for /${entryKey} that its own /CF dictionary does not define`);
+	const method = require_objects.asName(require_objects.dictGet(filter, "CFM"));
+	if (method === "None") return "identity";
+	if (method === "V2") return "rc4";
+	if (method === "AESV2" || method === "AESV3") return "aes";
+	throw new require_diagnostics.PdfEncryptedError(`crypt filter /${name} uses an unsupported /CFM ${method === void 0 ? "(absent)" : `/${method}`}`);
+}
+function cryptFilterKeyBytes(encryptDict, declaredBits) {
+	const streamFilterName = require_objects.asName(require_objects.dictGet(encryptDict, "StmF")) ?? "Identity";
+	const filters = require_objects.asDict(require_objects.dictGet(encryptDict, "CF"));
+	const filter = filters !== void 0 ? require_objects.asDict(require_objects.dictGet(filters, streamFilterName)) : void 0;
+	if ((filter !== void 0 ? require_objects.asName(require_objects.dictGet(filter, "CFM")) : void 0) === "AESV2") return AESV2_KEY_BYTES;
+	const declared = filter !== void 0 ? require_objects.asNumber(require_objects.dictGet(filter, "Length")) : void 0;
+	if (declared === void 0) return Math.floor(declaredBits / BITS_PER_BYTE);
+	return declared >= DEFAULT_KEY_BITS ? Math.floor(declared / BITS_PER_BYTE) : declared;
+}
+function setUpHandler(encryptDict, fileId) {
+	const version = require_objects.asNumber(require_objects.dictGet(encryptDict, "V")) ?? 0;
+	const revision = require_objects.asNumber(require_objects.dictGet(encryptDict, "R")) ?? 0;
+	const declaredBits = require_objects.asNumber(require_objects.dictGet(encryptDict, "Length")) ?? DEFAULT_KEY_BITS;
+	const encryptMetadataEntry = require_objects.dictGet(encryptDict, "EncryptMetadata");
+	const encryptMetadata = encryptMetadataEntry?.kind === "bool" ? encryptMetadataEntry.value : true;
+	if (version === 5) {
+		if (revision !== 5 && revision !== 6) throw new require_diagnostics.PdfEncryptedError(`/V 5 encryption with an unsupported revision /R ${String(revision)}`);
+		return {
+			fileKey: computeAesV3FileKey(encryptDict, revision),
+			streamMethod: methodFromCryptFilterName(encryptDict, "StmF"),
+			stringMethod: methodFromCryptFilterName(encryptDict, "StrF"),
+			perObjectKeys: false,
+			encryptMetadata
+		};
+	}
+	if (version !== 1 && version !== 2 && version !== 4) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler version /V ${String(version)}`);
+	if (revision < 2 || revision > 4) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
+	const streamMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
+	const stringMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
+	const keyBytes = version === 1 ? RC4_40_KEY_BYTES : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
+	if (keyBytes < RC4_40_KEY_BYTES || keyBytes > MAX_RC4_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
+	const fileKey = computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata);
+	if (!legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey)) throw new require_diagnostics.PdfPasswordRequiredError();
+	return {
+		fileKey,
+		streamMethod,
+		stringMethod,
+		perObjectKeys: true,
+		encryptMetadata
+	};
+}
+function objectKey(fileKey, num, gen, method) {
+	const extra = new Uint8Array(OBJECT_KEY_EXTRA_BYTES);
+	extra[0] = num & 255;
+	extra[1] = num >>> 8 & 255;
+	extra[2] = num >>> 16 & 255;
+	extra[3] = gen & 255;
+	extra[4] = gen >>> 8 & 255;
+	return require_crypto_md5.md5(require_bytes_writer.concatBytes(method === "aes" ? [
+		fileKey,
+		extra,
+		AES_OBJECT_KEY_SALT
+	] : [fileKey, extra])).subarray(0, Math.min(fileKey.length + OBJECT_KEY_EXTRA_BYTES, MD5_DIGEST_BYTES));
+}
+function decryptAes(key, data, sink) {
+	if (data.length <= 16) {
+		if (data.length !== 0 && data.length !== 16) sink({
+			code: "pdf/decrypt-truncated",
+			severity: "warning",
+			message: `an AES-encrypted value is ${String(data.length)} bytes, too short to carry even its own initialisation vector; treating it as empty`
+		});
+		return /* @__PURE__ */ new Uint8Array(0);
+	}
+	const body = data.subarray(16);
+	if (body.length % 16 !== 0) sink({
+		code: "pdf/decrypt-truncated",
+		severity: "warning",
+		message: `an AES-encrypted value's ciphertext is ${String(body.length)} bytes, not a whole number of 16-byte blocks; the trailing partial block is being dropped`
+	});
+	const plain = require_crypto_aes.aesCbcDecrypt(key, data.subarray(0, 16), body);
+	const padLength = plain[plain.length - 1] ?? 0;
+	if (padLength < 1 || padLength > 16 || padLength > plain.length) {
+		sink({
+			code: "pdf/decrypt-bad-padding",
+			severity: "warning",
+			message: "an AES-encrypted value did not end in valid PKCS#7 padding; keeping the decrypted bytes unstripped"
+		});
+		return plain;
+	}
+	return plain.subarray(0, plain.length - padLength);
+}
+function applyMethod(method, fileKey, perObjectKeys, bytes, num, gen, sink) {
+	if (method === "identity") return bytes;
+	const key = perObjectKeys ? objectKey(fileKey, num, gen, method) : fileKey;
+	return method === "rc4" ? require_crypto_rc4.rc4(key, bytes) : decryptAes(key, bytes, sink);
+}
+function createStandardDecryptor(encryptDict, fileId, sink) {
+	const filter = require_objects.asName(require_objects.dictGet(encryptDict, "Filter"));
+	if (filter !== "Standard") throw new require_diagnostics.PdfEncryptedError(`this PDF uses the ${filter === void 0 ? "unnamed" : `/${filter}`} security handler; only the standard security handler is supported`);
+	const setup = setUpHandler(encryptDict, fileId);
+	return {
+		decryptString(bytes, num, gen) {
+			return applyMethod(setup.stringMethod, setup.fileKey, setup.perObjectKeys, bytes, num, gen, sink);
+		},
+		decryptStream(bytes, dict, num, gen) {
+			if (!setup.encryptMetadata && require_objects.asName(require_objects.dictGet(dict, "Type")) === "Metadata") return bytes;
+			return applyMethod(setup.streamMethod, setup.fileKey, setup.perObjectKeys, bytes, num, gen, sink);
+		}
+	};
+}
+//#endregion
+exports.createStandardDecryptor = createStandardDecryptor;

package/dist/encrypt.d.cts

@@ -0,0 +1,11 @@
+import { PdfDiagnosticSink } from "./diagnostics.cjs";
+import { PdfDict } from "./objects.cjs";
+//#region src/encrypt.d.ts
+type CipherMethod = 'identity' | 'rc4' | 'aes';
+interface PdfDecryptor {
+  decryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
+  decryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
+}
+declare function createStandardDecryptor(encryptDict: PdfDict, fileId: Uint8Array<ArrayBuffer>, sink: PdfDiagnosticSink): PdfDecryptor;
+//#endregion
+export { CipherMethod, PdfDecryptor, createStandardDecryptor };

package/dist/encrypt.d.ts

@@ -0,0 +1,11 @@
+import { PdfDiagnosticSink } from "./diagnostics.js";
+import { PdfDict } from "./objects.js";
+//#region src/encrypt.d.ts
+type CipherMethod = 'identity' | 'rc4' | 'aes';
+interface PdfDecryptor {
+  decryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
+  decryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
+}
+declare function createStandardDecryptor(encryptDict: PdfDict, fileId: Uint8Array<ArrayBuffer>, sink: PdfDiagnosticSink): PdfDecryptor;
+//#endregion
+export { CipherMethod, PdfDecryptor, createStandardDecryptor };