pdf-parser.js 3.0.7 → 4.5.1

package/dist/encrypt-write.cjs

@@ -0,0 +1,234 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_objects = require("./objects.cjs");
+const require_bytes_writer = require("./bytes/writer.cjs");
+const require_crypto_aes = require("./crypto/aes.cjs");
+const require_crypto_md5 = require("./crypto/md5.cjs");
+const require_crypto_rc4 = require("./crypto/rc4.cjs");
+const require_encrypt = require("./encrypt.cjs");
+const require_crypto_random = require("./crypto/random.cjs");
+//#region src/encrypt-write.ts
+var PdfEncryptionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PdfEncryptionError";
+	}
+};
+const RC4_128_KEY_BYTES = 16;
+const R6_PASSWORD_MAX_BYTES = 127;
+const RESERVED_BIT_7_AND_8 = 192;
+const DEPRECATED_ALWAYS_ONE_BIT_10 = 512;
+const SCHEME_SPECS = {
+	"rc4-40": {
+		v: 1,
+		r: 2,
+		keyBytes: 5,
+		method: "rc4"
+	},
+	"rc4-128": {
+		v: 2,
+		r: 3,
+		keyBytes: RC4_128_KEY_BYTES,
+		method: "rc4"
+	},
+	"aes-128": {
+		v: 4,
+		r: 4,
+		keyBytes: 16,
+		method: "aes"
+	},
+	"aes-256": {
+		v: 5,
+		r: 6,
+		keyBytes: 32,
+		method: "aes"
+	}
+};
+function legacyPasswordBytes(password) {
+	const bytes = new Uint8Array(password.length);
+	for (let i = 0; i < password.length; i++) {
+		const code = password.charCodeAt(i);
+		if (code > 127) throw new PdfEncryptionError(`password contains character code ${String(code)}, outside the printable-ASCII range this writer supports for the rc4-40/rc4-128/aes-128 schemes; use a plain-ASCII password, or the aes-256 scheme, whose revision-6 passwords are Unicode`);
+		bytes[i] = code;
+	}
+	return bytes;
+}
+function r6PasswordBytes(password) {
+	return new TextEncoder().encode(password.normalize("NFKC")).subarray(0, R6_PASSWORD_MAX_BYTES);
+}
+function permissionsToP(permissions) {
+	let p = 0;
+	if (permissions?.print ?? true) p |= 4;
+	if (permissions?.modifyContents ?? true) p |= 8;
+	if (permissions?.copy ?? true) p |= 16;
+	if (permissions?.annotate ?? true) p |= 32;
+	p |= RESERVED_BIT_7_AND_8;
+	if (permissions?.fillForms ?? true) p |= 256;
+	p |= DEPRECATED_ALWAYS_ONE_BIT_10;
+	if (permissions?.assemble ?? true) p |= 1024;
+	if (permissions?.printHighRes ?? true) p |= 2048;
+	for (let bit = 13; bit <= 32; bit++) p |= 1 << bit - 1;
+	return p;
+}
+function computeLegacyOwnerValue(ownerPassword, userPassword, revision, keyBytes) {
+	let digest = require_crypto_md5.md5(require_encrypt.padOrTruncatePassword(ownerPassword));
+	if (revision >= 3) for (let i = 0; i < 50; i++) digest = require_crypto_md5.md5(digest);
+	const ownerKey = digest.subarray(0, keyBytes);
+	let value = require_crypto_rc4.rc4(ownerKey, require_encrypt.padOrTruncatePassword(userPassword));
+	if (revision >= 3) for (let i = 1; i <= 19; i++) {
+		const roundKey = Uint8Array.from(ownerKey, (byte) => byte ^ i);
+		value = require_crypto_rc4.rc4(roundKey, value);
+	}
+	return value;
+}
+function computeLegacyUserValue(fileKey, fileId, revision) {
+	const core = require_encrypt.legacyUserValueCore(fileKey, fileId, revision);
+	if (revision === 2) return core;
+	return require_bytes_writer.concatBytes([core, require_crypto_random.randomBytes(require_encrypt.PASSWORD_PADDING.length - core.length)]);
+}
+function encryptAes(key, data) {
+	const iv = require_crypto_random.randomBytes(16);
+	const padLength = 16 - data.length % 16;
+	const padded = new Uint8Array(data.length + padLength);
+	padded.set(data);
+	padded.fill(padLength, data.length);
+	return require_bytes_writer.concatBytes([iv, require_crypto_aes.aesCbcEncrypt(key, iv, padded)]);
+}
+function applyEncryptMethod(method, fileKey, perObjectKeys, bytes, num, gen) {
+	if (method === "identity") return bytes;
+	const key = perObjectKeys ? require_encrypt.objectKey(fileKey, num, gen, method) : fileKey;
+	return method === "rc4" ? require_crypto_rc4.rc4(key, bytes) : encryptAes(key, bytes);
+}
+function buildEncryptor(encryptDict, fileKey, method, perObjectKeys, encryptMetadata) {
+	return {
+		encryptDict,
+		encryptString(bytes, num, gen) {
+			return applyEncryptMethod(method, fileKey, perObjectKeys, bytes, num, gen);
+		},
+		encryptStream(bytes, dict, num, gen) {
+			const type = dict.entries.get("Type");
+			if (!encryptMetadata && type?.kind === "name" && type.name === "Metadata") return bytes;
+			return applyEncryptMethod(method, fileKey, perObjectKeys, bytes, num, gen);
+		}
+	};
+}
+function buildLegacyEncryptor(spec, options, fileId) {
+	const userPassword = legacyPasswordBytes(options.userPassword ?? "");
+	const ownerPassword = legacyPasswordBytes(options.ownerPassword ?? options.userPassword ?? "");
+	const encryptMetadata = options.encryptMetadata ?? true;
+	const p = permissionsToP(options.permissions);
+	const owner = computeLegacyOwnerValue(ownerPassword, userPassword, spec.r, spec.keyBytes);
+	const fileKey = require_encrypt.computeLegacyFileKeyFromPaddedPassword(require_encrypt.padOrTruncatePassword(userPassword), owner, p, fileId, spec.r, spec.keyBytes, encryptMetadata);
+	const user = computeLegacyUserValue(fileKey, fileId, spec.r);
+	const entries = /* @__PURE__ */ new Map([
+		["Filter", require_objects.pdfName("Standard")],
+		["V", require_objects.pdfNum(spec.v)],
+		["R", require_objects.pdfNum(spec.r)],
+		["O", require_objects.pdfHexString(owner)],
+		["U", require_objects.pdfHexString(user)],
+		["P", require_objects.pdfNum(p)],
+		["Length", require_objects.pdfNum(spec.keyBytes * 8)]
+	]);
+	if (spec.v === 4) {
+		entries.set("CF", require_objects.pdfDict({ StdCF: require_objects.pdfDict({
+			AuthEvent: require_objects.pdfName("DocOpen"),
+			CFM: require_objects.pdfName("AESV2"),
+			Length: require_objects.pdfNum(spec.keyBytes)
+		}) }));
+		entries.set("StmF", require_objects.pdfName("StdCF"));
+		entries.set("StrF", require_objects.pdfName("StdCF"));
+		entries.set("EncryptMetadata", require_objects.pdfBool(encryptMetadata));
+	}
+	return buildEncryptor(require_objects.pdfDict(entries), fileKey, spec.method, true, encryptMetadata);
+}
+function buildAes256Encryptor(spec, options) {
+	const userPassword = r6PasswordBytes(options.userPassword ?? "");
+	const ownerPassword = r6PasswordBytes(options.ownerPassword ?? options.userPassword ?? "");
+	const encryptMetadata = options.encryptMetadata ?? true;
+	const p = permissionsToP(options.permissions);
+	const fileKey = require_crypto_random.randomBytes(32);
+	const userValidationSalt = require_crypto_random.randomBytes(8);
+	const userKeySalt = require_crypto_random.randomBytes(8);
+	const empty = /* @__PURE__ */ new Uint8Array(0);
+	const userHash = require_encrypt.hardenedHash(userPassword, userValidationSalt, empty, spec.r);
+	const u = require_bytes_writer.concatBytes([
+		userHash,
+		userValidationSalt,
+		userKeySalt
+	]);
+	const userIntermediateKey = require_encrypt.hardenedHash(userPassword, userKeySalt, empty, spec.r);
+	const ue = require_crypto_aes.aesCbcEncrypt(userIntermediateKey, require_encrypt.ZERO_IV, fileKey);
+	const ownerValidationSalt = require_crypto_random.randomBytes(8);
+	const ownerKeySalt = require_crypto_random.randomBytes(8);
+	const ownerHash = require_encrypt.hardenedHash(ownerPassword, ownerValidationSalt, u, spec.r);
+	const o = require_bytes_writer.concatBytes([
+		ownerHash,
+		ownerValidationSalt,
+		ownerKeySalt
+	]);
+	const ownerIntermediateKey = require_encrypt.hardenedHash(ownerPassword, ownerKeySalt, u, spec.r);
+	const oe = require_crypto_aes.aesCbcEncrypt(ownerIntermediateKey, require_encrypt.ZERO_IV, fileKey);
+	const permsBlock = /* @__PURE__ */ new Uint8Array(16);
+	permsBlock.set(require_encrypt.permissionsBytes(p), 0);
+	permsBlock.set([
+		255,
+		255,
+		255,
+		255
+	], 4);
+	permsBlock[8] = encryptMetadata ? 84 : 70;
+	permsBlock.set([
+		97,
+		100,
+		98
+	], 9);
+	permsBlock.set(require_crypto_random.randomBytes(4), 12);
+	const perms = require_crypto_aes.aesCbcEncrypt(fileKey, require_encrypt.ZERO_IV, permsBlock);
+	const entries = /* @__PURE__ */ new Map([
+		["Filter", require_objects.pdfName("Standard")],
+		["V", require_objects.pdfNum(spec.v)],
+		["R", require_objects.pdfNum(spec.r)],
+		["O", require_objects.pdfHexString(o)],
+		["U", require_objects.pdfHexString(u)],
+		["OE", require_objects.pdfHexString(oe)],
+		["UE", require_objects.pdfHexString(ue)],
+		["P", require_objects.pdfNum(p)],
+		["Perms", require_objects.pdfHexString(perms)],
+		["Length", require_objects.pdfNum(spec.keyBytes * 8)],
+		["CF", require_objects.pdfDict({ StdCF: require_objects.pdfDict({
+			AuthEvent: require_objects.pdfName("DocOpen"),
+			CFM: require_objects.pdfName("AESV3"),
+			Length: require_objects.pdfNum(spec.keyBytes)
+		}) })],
+		["StmF", require_objects.pdfName("StdCF")],
+		["StrF", require_objects.pdfName("StdCF")],
+		["EncryptMetadata", require_objects.pdfBool(encryptMetadata)]
+	]);
+	return buildEncryptor(require_objects.pdfDict(entries), fileKey, spec.method, false, encryptMetadata);
+}
+function createStandardEncryptor(options, fileId) {
+	const scheme = options.scheme ?? "aes-256";
+	const spec = SCHEME_SPECS[scheme];
+	return spec.v === 5 ? buildAes256Encryptor(spec, options) : buildLegacyEncryptor(spec, options, fileId);
+}
+function encryptIndirectObject(value, num, gen, encryptor) {
+	if (value.kind === "string") return {
+		kind: "string",
+		bytes: encryptor.encryptString(value.bytes, num, gen),
+		hex: value.hex
+	};
+	if (value.kind === "array") return require_objects.pdfArray(value.items.map((item) => encryptIndirectObject(item, num, gen, encryptor)));
+	if (value.kind === "dict") return encryptDictEntries(value, num, gen, encryptor);
+	if (value.kind === "stream") return {
+		kind: "stream",
+		dict: encryptDictEntries(value.dict, num, gen, encryptor),
+		raw: encryptor.encryptStream(value.raw, value.dict, num, gen)
+	};
+	return value;
+}
+function encryptDictEntries(dict, num, gen, encryptor) {
+	return require_objects.pdfDict(new Map(Array.from(dict.entries, ([key, entry]) => [key, encryptIndirectObject(entry, num, gen, encryptor)])));
+}
+//#endregion
+exports.PdfEncryptionError = PdfEncryptionError;
+exports.createStandardEncryptor = createStandardEncryptor;
+exports.encryptIndirectObject = encryptIndirectObject;

package/dist/encrypt-write.d.cts

@@ -0,0 +1,31 @@
+import { n as PdfDict, r as PdfObject } from "./objects-B7HdMeWS.cjs";
+//#region src/encrypt-write.d.ts
+declare class PdfEncryptionError extends Error {
+  constructor(message: string);
+}
+type PdfEncryptionScheme = "rc4-40" | "rc4-128" | "aes-128" | "aes-256";
+interface PdfEncryptionPermissions {
+  readonly print?: boolean;
+  readonly modifyContents?: boolean;
+  readonly copy?: boolean;
+  readonly annotate?: boolean;
+  readonly fillForms?: boolean;
+  readonly assemble?: boolean;
+  readonly printHighRes?: boolean;
+}
+interface PdfEncryptionOptions {
+  readonly userPassword?: string;
+  readonly ownerPassword?: string;
+  readonly scheme?: PdfEncryptionScheme;
+  readonly permissions?: PdfEncryptionPermissions;
+  readonly encryptMetadata?: boolean;
+}
+interface PdfEncryptor {
+  readonly encryptDict: PdfDict;
+  encryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
+  encryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
+}
+declare function createStandardEncryptor(options: PdfEncryptionOptions, fileId: Uint8Array<ArrayBuffer>): PdfEncryptor;
+declare function encryptIndirectObject(value: PdfObject, num: number, gen: number, encryptor: PdfEncryptor): PdfObject;
+//#endregion
+export { PdfEncryptionError, PdfEncryptionOptions, PdfEncryptionPermissions, PdfEncryptionScheme, PdfEncryptor, createStandardEncryptor, encryptIndirectObject };

package/dist/encrypt-write.d.ts

@@ -0,0 +1,31 @@
+import { n as PdfDict, r as PdfObject } from "./objects-B7HdMeWS.js";
+//#region src/encrypt-write.d.ts
+declare class PdfEncryptionError extends Error {
+  constructor(message: string);
+}
+type PdfEncryptionScheme = "rc4-40" | "rc4-128" | "aes-128" | "aes-256";
+interface PdfEncryptionPermissions {
+  readonly print?: boolean;
+  readonly modifyContents?: boolean;
+  readonly copy?: boolean;
+  readonly annotate?: boolean;
+  readonly fillForms?: boolean;
+  readonly assemble?: boolean;
+  readonly printHighRes?: boolean;
+}
+interface PdfEncryptionOptions {
+  readonly userPassword?: string;
+  readonly ownerPassword?: string;
+  readonly scheme?: PdfEncryptionScheme;
+  readonly permissions?: PdfEncryptionPermissions;
+  readonly encryptMetadata?: boolean;
+}
+interface PdfEncryptor {
+  readonly encryptDict: PdfDict;
+  encryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
+  encryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
+}
+declare function createStandardEncryptor(options: PdfEncryptionOptions, fileId: Uint8Array<ArrayBuffer>): PdfEncryptor;
+declare function encryptIndirectObject(value: PdfObject, num: number, gen: number, encryptor: PdfEncryptor): PdfObject;
+//#endregion
+export { PdfEncryptionError, PdfEncryptionOptions, PdfEncryptionPermissions, PdfEncryptionScheme, PdfEncryptor, createStandardEncryptor, encryptIndirectObject };

package/dist/encrypt-write.js

@@ -0,0 +1,231 @@
+import { pdfArray, pdfBool, pdfDict, pdfHexString, pdfName, pdfNum } from "./objects.js";
+import { concatBytes } from "./bytes/writer.js";
+import { aesCbcEncrypt } from "./crypto/aes.js";
+import { md5 } from "./crypto/md5.js";
+import { rc4 } from "./crypto/rc4.js";
+import { PASSWORD_PADDING, ZERO_IV, computeLegacyFileKeyFromPaddedPassword, hardenedHash, legacyUserValueCore, objectKey, padOrTruncatePassword, permissionsBytes } from "./encrypt.js";
+import { randomBytes } from "./crypto/random.js";
+//#region src/encrypt-write.ts
+var PdfEncryptionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PdfEncryptionError";
+	}
+};
+const RC4_128_KEY_BYTES = 16;
+const R6_PASSWORD_MAX_BYTES = 127;
+const RESERVED_BIT_7_AND_8 = 192;
+const DEPRECATED_ALWAYS_ONE_BIT_10 = 512;
+const SCHEME_SPECS = {
+	"rc4-40": {
+		v: 1,
+		r: 2,
+		keyBytes: 5,
+		method: "rc4"
+	},
+	"rc4-128": {
+		v: 2,
+		r: 3,
+		keyBytes: RC4_128_KEY_BYTES,
+		method: "rc4"
+	},
+	"aes-128": {
+		v: 4,
+		r: 4,
+		keyBytes: 16,
+		method: "aes"
+	},
+	"aes-256": {
+		v: 5,
+		r: 6,
+		keyBytes: 32,
+		method: "aes"
+	}
+};
+function legacyPasswordBytes(password) {
+	const bytes = new Uint8Array(password.length);
+	for (let i = 0; i < password.length; i++) {
+		const code = password.charCodeAt(i);
+		if (code > 127) throw new PdfEncryptionError(`password contains character code ${String(code)}, outside the printable-ASCII range this writer supports for the rc4-40/rc4-128/aes-128 schemes; use a plain-ASCII password, or the aes-256 scheme, whose revision-6 passwords are Unicode`);
+		bytes[i] = code;
+	}
+	return bytes;
+}
+function r6PasswordBytes(password) {
+	return new TextEncoder().encode(password.normalize("NFKC")).subarray(0, R6_PASSWORD_MAX_BYTES);
+}
+function permissionsToP(permissions) {
+	let p = 0;
+	if (permissions?.print ?? true) p |= 4;
+	if (permissions?.modifyContents ?? true) p |= 8;
+	if (permissions?.copy ?? true) p |= 16;
+	if (permissions?.annotate ?? true) p |= 32;
+	p |= RESERVED_BIT_7_AND_8;
+	if (permissions?.fillForms ?? true) p |= 256;
+	p |= DEPRECATED_ALWAYS_ONE_BIT_10;
+	if (permissions?.assemble ?? true) p |= 1024;
+	if (permissions?.printHighRes ?? true) p |= 2048;
+	for (let bit = 13; bit <= 32; bit++) p |= 1 << bit - 1;
+	return p;
+}
+function computeLegacyOwnerValue(ownerPassword, userPassword, revision, keyBytes) {
+	let digest = md5(padOrTruncatePassword(ownerPassword));
+	if (revision >= 3) for (let i = 0; i < 50; i++) digest = md5(digest);
+	const ownerKey = digest.subarray(0, keyBytes);
+	let value = rc4(ownerKey, padOrTruncatePassword(userPassword));
+	if (revision >= 3) for (let i = 1; i <= 19; i++) {
+		const roundKey = Uint8Array.from(ownerKey, (byte) => byte ^ i);
+		value = rc4(roundKey, value);
+	}
+	return value;
+}
+function computeLegacyUserValue(fileKey, fileId, revision) {
+	const core = legacyUserValueCore(fileKey, fileId, revision);
+	if (revision === 2) return core;
+	return concatBytes([core, randomBytes(PASSWORD_PADDING.length - core.length)]);
+}
+function encryptAes(key, data) {
+	const iv = randomBytes(16);
+	const padLength = 16 - data.length % 16;
+	const padded = new Uint8Array(data.length + padLength);
+	padded.set(data);
+	padded.fill(padLength, data.length);
+	return concatBytes([iv, aesCbcEncrypt(key, iv, padded)]);
+}
+function applyEncryptMethod(method, fileKey, perObjectKeys, bytes, num, gen) {
+	if (method === "identity") return bytes;
+	const key = perObjectKeys ? objectKey(fileKey, num, gen, method) : fileKey;
+	return method === "rc4" ? rc4(key, bytes) : encryptAes(key, bytes);
+}
+function buildEncryptor(encryptDict, fileKey, method, perObjectKeys, encryptMetadata) {
+	return {
+		encryptDict,
+		encryptString(bytes, num, gen) {
+			return applyEncryptMethod(method, fileKey, perObjectKeys, bytes, num, gen);
+		},
+		encryptStream(bytes, dict, num, gen) {
+			const type = dict.entries.get("Type");
+			if (!encryptMetadata && type?.kind === "name" && type.name === "Metadata") return bytes;
+			return applyEncryptMethod(method, fileKey, perObjectKeys, bytes, num, gen);
+		}
+	};
+}
+function buildLegacyEncryptor(spec, options, fileId) {
+	const userPassword = legacyPasswordBytes(options.userPassword ?? "");
+	const ownerPassword = legacyPasswordBytes(options.ownerPassword ?? options.userPassword ?? "");
+	const encryptMetadata = options.encryptMetadata ?? true;
+	const p = permissionsToP(options.permissions);
+	const owner = computeLegacyOwnerValue(ownerPassword, userPassword, spec.r, spec.keyBytes);
+	const fileKey = computeLegacyFileKeyFromPaddedPassword(padOrTruncatePassword(userPassword), owner, p, fileId, spec.r, spec.keyBytes, encryptMetadata);
+	const user = computeLegacyUserValue(fileKey, fileId, spec.r);
+	const entries = /* @__PURE__ */ new Map([
+		["Filter", pdfName("Standard")],
+		["V", pdfNum(spec.v)],
+		["R", pdfNum(spec.r)],
+		["O", pdfHexString(owner)],
+		["U", pdfHexString(user)],
+		["P", pdfNum(p)],
+		["Length", pdfNum(spec.keyBytes * 8)]
+	]);
+	if (spec.v === 4) {
+		entries.set("CF", pdfDict({ StdCF: pdfDict({
+			AuthEvent: pdfName("DocOpen"),
+			CFM: pdfName("AESV2"),
+			Length: pdfNum(spec.keyBytes)
+		}) }));
+		entries.set("StmF", pdfName("StdCF"));
+		entries.set("StrF", pdfName("StdCF"));
+		entries.set("EncryptMetadata", pdfBool(encryptMetadata));
+	}
+	return buildEncryptor(pdfDict(entries), fileKey, spec.method, true, encryptMetadata);
+}
+function buildAes256Encryptor(spec, options) {
+	const userPassword = r6PasswordBytes(options.userPassword ?? "");
+	const ownerPassword = r6PasswordBytes(options.ownerPassword ?? options.userPassword ?? "");
+	const encryptMetadata = options.encryptMetadata ?? true;
+	const p = permissionsToP(options.permissions);
+	const fileKey = randomBytes(32);
+	const userValidationSalt = randomBytes(8);
+	const userKeySalt = randomBytes(8);
+	const empty = /* @__PURE__ */ new Uint8Array(0);
+	const userHash = hardenedHash(userPassword, userValidationSalt, empty, spec.r);
+	const u = concatBytes([
+		userHash,
+		userValidationSalt,
+		userKeySalt
+	]);
+	const userIntermediateKey = hardenedHash(userPassword, userKeySalt, empty, spec.r);
+	const ue = aesCbcEncrypt(userIntermediateKey, ZERO_IV, fileKey);
+	const ownerValidationSalt = randomBytes(8);
+	const ownerKeySalt = randomBytes(8);
+	const ownerHash = hardenedHash(ownerPassword, ownerValidationSalt, u, spec.r);
+	const o = concatBytes([
+		ownerHash,
+		ownerValidationSalt,
+		ownerKeySalt
+	]);
+	const ownerIntermediateKey = hardenedHash(ownerPassword, ownerKeySalt, u, spec.r);
+	const oe = aesCbcEncrypt(ownerIntermediateKey, ZERO_IV, fileKey);
+	const permsBlock = /* @__PURE__ */ new Uint8Array(16);
+	permsBlock.set(permissionsBytes(p), 0);
+	permsBlock.set([
+		255,
+		255,
+		255,
+		255
+	], 4);
+	permsBlock[8] = encryptMetadata ? 84 : 70;
+	permsBlock.set([
+		97,
+		100,
+		98
+	], 9);
+	permsBlock.set(randomBytes(4), 12);
+	const perms = aesCbcEncrypt(fileKey, ZERO_IV, permsBlock);
+	const entries = /* @__PURE__ */ new Map([
+		["Filter", pdfName("Standard")],
+		["V", pdfNum(spec.v)],
+		["R", pdfNum(spec.r)],
+		["O", pdfHexString(o)],
+		["U", pdfHexString(u)],
+		["OE", pdfHexString(oe)],
+		["UE", pdfHexString(ue)],
+		["P", pdfNum(p)],
+		["Perms", pdfHexString(perms)],
+		["Length", pdfNum(spec.keyBytes * 8)],
+		["CF", pdfDict({ StdCF: pdfDict({
+			AuthEvent: pdfName("DocOpen"),
+			CFM: pdfName("AESV3"),
+			Length: pdfNum(spec.keyBytes)
+		}) })],
+		["StmF", pdfName("StdCF")],
+		["StrF", pdfName("StdCF")],
+		["EncryptMetadata", pdfBool(encryptMetadata)]
+	]);
+	return buildEncryptor(pdfDict(entries), fileKey, spec.method, false, encryptMetadata);
+}
+function createStandardEncryptor(options, fileId) {
+	const scheme = options.scheme ?? "aes-256";
+	const spec = SCHEME_SPECS[scheme];
+	return spec.v === 5 ? buildAes256Encryptor(spec, options) : buildLegacyEncryptor(spec, options, fileId);
+}
+function encryptIndirectObject(value, num, gen, encryptor) {
+	if (value.kind === "string") return {
+		kind: "string",
+		bytes: encryptor.encryptString(value.bytes, num, gen),
+		hex: value.hex
+	};
+	if (value.kind === "array") return pdfArray(value.items.map((item) => encryptIndirectObject(item, num, gen, encryptor)));
+	if (value.kind === "dict") return encryptDictEntries(value, num, gen, encryptor);
+	if (value.kind === "stream") return {
+		kind: "stream",
+		dict: encryptDictEntries(value.dict, num, gen, encryptor),
+		raw: encryptor.encryptStream(value.raw, value.dict, num, gen)
+	};
+	return value;
+}
+function encryptDictEntries(dict, num, gen, encryptor) {
+	return pdfDict(new Map(Array.from(dict.entries, ([key, entry]) => [key, encryptIndirectObject(entry, num, gen, encryptor)])));
+}
+//#endregion
+export { PdfEncryptionError, createStandardEncryptor, encryptIndirectObject };