pdf-parser.js 3.0.8 → 4.5.2

package/dist/encrypt.cjs

@@ -1,11 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_objects = require("./objects.cjs");
 const require_bytes_writer = require("./bytes/writer.cjs");
 const require_diagnostics = require("./diagnostics.cjs");
 const require_crypto_aes = require("./crypto/aes.cjs");
 const require_crypto_md5 = require("./crypto/md5.cjs");
 const require_crypto_rc4 = require("./crypto/rc4.cjs");
 const require_crypto_sha2 = require("./crypto/sha2.cjs");
-const require_objects = require("./objects.cjs");
 //#region src/encrypt.ts
 const PASSWORD_PADDING = new Uint8Array([
 	40,
@@ -50,11 +50,12 @@ const AES_OBJECT_KEY_SALT = new Uint8Array([
 const MD5_DIGEST_BYTES = 16;
 const OBJECT_KEY_EXTRA_BYTES = 5;
 const LEGACY_KEY_ITERATIONS = 50;
-const ALGORITHM_5_ITERATIONS = 19;
+const RC4_OBFUSCATION_ROUNDS = 19;
 const R6_MINIMUM_ROUNDS = 64;
 const R6_ROUND_REPEATS = 64;
 const R6_TERMINATION_MARGIN = 32;
 const AESV3_KEY_BYTES = 32;
+const AESV3_SALT_BYTES = 8;
 const RC4_40_KEY_BYTES = 5;
 const AESV2_KEY_BYTES = 16;
 const DEFAULT_KEY_BITS = 40;
@@ -80,11 +81,16 @@ function permissionsBytes(p) {
 		unsigned >>> 24 & 255
 	]);
 }
-function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
-	const owner = requireStringBytes(encryptDict, "O");
-	const permissions = require_objects.asNumber(require_objects.dictGet(encryptDict, "P")) ?? 0;
+function padOrTruncatePassword(password) {
+	if (password.length >= PASSWORD_PADDING.length) return password.subarray(0, PASSWORD_PADDING.length);
+	const padded = new Uint8Array(PASSWORD_PADDING.length);
+	padded.set(password);
+	padded.set(PASSWORD_PADDING.subarray(0, PASSWORD_PADDING.length - password.length), password.length);
+	return padded;
+}
+function computeLegacyFileKeyFromPaddedPassword(paddedPassword, owner, permissions, fileId, revision, keyBytes, encryptMetadata) {
 	const parts = [
-		PASSWORD_PADDING,
+		paddedPassword,
 		owner.subarray(0, PASSWORD_PADDING.length),
 		permissionsBytes(permissions),
 		fileId
@@ -96,18 +102,26 @@ function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMe
 		255
 	]));
 	let digest = require_crypto_md5.md5(require_bytes_writer.concatBytes(parts));
-	if (revision >= 3) for (let i = 0; i < LEGACY_KEY_ITERATIONS; i++) digest = require_crypto_md5.md5(digest.subarray(0, keyBytes));
+	if (revision >= 3) for (let i = 0; i < 50; i++) digest = require_crypto_md5.md5(digest.subarray(0, keyBytes));
 	return digest.subarray(0, keyBytes);
 }
-function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
-	const storedUser = requireStringBytes(encryptDict, "U");
-	if (revision === 2) return bytesEqual(require_crypto_rc4.rc4(fileKey, PASSWORD_PADDING), storedUser, PASSWORD_PADDING.length);
+function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
+	const owner = requireStringBytes(encryptDict, "O");
+	const permissions = require_objects.asNumber(require_objects.dictGet(encryptDict, "P")) ?? 0;
+	return computeLegacyFileKeyFromPaddedPassword(PASSWORD_PADDING, owner, permissions, fileId, revision, keyBytes, encryptMetadata);
+}
+function legacyUserValueCore(fileKey, fileId, revision) {
+	if (revision === 2) return require_crypto_rc4.rc4(fileKey, PASSWORD_PADDING);
 	let value = require_crypto_rc4.rc4(fileKey, require_crypto_md5.md5(require_bytes_writer.concatBytes([PASSWORD_PADDING, fileId])));
-	for (let i = 1; i <= ALGORITHM_5_ITERATIONS; i++) {
+	for (let i = 1; i <= 19; i++) {
 		const roundKey = Uint8Array.from(fileKey, (byte) => byte ^ i);
 		value = require_crypto_rc4.rc4(roundKey, value);
 	}
-	return bytesEqual(value, storedUser, MD5_DIGEST_BYTES);
+	return value;
+}
+function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	return bytesEqual(legacyUserValueCore(fileKey, fileId, revision), storedUser, revision === 2 ? PASSWORD_PADDING.length : 16);
 }
 function hardenedHash(password, salt, userData, revision) {
 	let k = require_crypto_sha2.sha256(require_bytes_writer.concatBytes([
@@ -133,20 +147,20 @@ function hardenedHash(password, salt, userData, revision) {
 		k = selector === 0 ? require_crypto_sha2.sha256(e) : selector === 1 ? require_crypto_sha2.sha384(e) : require_crypto_sha2.sha512(e);
 		round++;
 	}
-	return k.subarray(0, AESV3_KEY_BYTES);
+	return k.subarray(0, 32);
 }
 function computeAesV3FileKey(encryptDict, revision) {
 	const storedUser = requireStringBytes(encryptDict, "U");
 	const expectedLength = 48;
 	if (storedUser.length < expectedLength) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /U entry is ${String(storedUser.length)} bytes; revision ${String(revision)} requires ${String(expectedLength)}`);
 	const empty = /* @__PURE__ */ new Uint8Array(0);
-	const validationSalt = storedUser.subarray(AESV3_KEY_BYTES, 40);
+	const validationSalt = storedUser.subarray(32, 40);
 	const keySalt = storedUser.subarray(40, expectedLength);
-	if (!bytesEqual(hardenedHash(empty, validationSalt, empty, revision), storedUser, AESV3_KEY_BYTES)) throw new require_diagnostics.PdfPasswordRequiredError();
+	if (!bytesEqual(hardenedHash(empty, validationSalt, empty, revision), storedUser, 32)) throw new require_diagnostics.PdfPasswordRequiredError();
 	const intermediateKey = hardenedHash(empty, keySalt, empty, revision);
 	const wrappedKey = requireStringBytes(encryptDict, "UE");
-	if (wrappedKey.length < AESV3_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /UE entry is ${String(wrappedKey.length)} bytes; revision ${String(revision)} requires ${String(AESV3_KEY_BYTES)}`);
-	return require_crypto_aes.aesCbcDecrypt(intermediateKey, ZERO_IV, wrappedKey.subarray(0, AESV3_KEY_BYTES));
+	if (wrappedKey.length < 32) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary's /UE entry is ${String(wrappedKey.length)} bytes; revision ${String(revision)} requires ${String(32)}`);
+	return require_crypto_aes.aesCbcDecrypt(intermediateKey, ZERO_IV, wrappedKey.subarray(0, 32));
 }
 function methodFromCryptFilterName(encryptDict, entryKey) {
 	const name = require_objects.asName(require_objects.dictGet(encryptDict, entryKey)) ?? "Identity";
@@ -164,7 +178,7 @@ function cryptFilterKeyBytes(encryptDict, declaredBits) {
 	const streamFilterName = require_objects.asName(require_objects.dictGet(encryptDict, "StmF")) ?? "Identity";
 	const filters = require_objects.asDict(require_objects.dictGet(encryptDict, "CF"));
 	const filter = filters !== void 0 ? require_objects.asDict(require_objects.dictGet(filters, streamFilterName)) : void 0;
-	if ((filter !== void 0 ? require_objects.asName(require_objects.dictGet(filter, "CFM")) : void 0) === "AESV2") return AESV2_KEY_BYTES;
+	if ((filter !== void 0 ? require_objects.asName(require_objects.dictGet(filter, "CFM")) : void 0) === "AESV2") return 16;
 	const declared = filter !== void 0 ? require_objects.asNumber(require_objects.dictGet(filter, "Length")) : void 0;
 	if (declared === void 0) return Math.floor(declaredBits / BITS_PER_BYTE);
 	return declared >= DEFAULT_KEY_BITS ? Math.floor(declared / BITS_PER_BYTE) : declared;
@@ -189,8 +203,8 @@ function setUpHandler(encryptDict, fileId) {
 	if (revision < 2 || revision > 4) throw new require_diagnostics.PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
 	const streamMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
 	const stringMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
-	const keyBytes = version === 1 ? RC4_40_KEY_BYTES : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
-	if (keyBytes < RC4_40_KEY_BYTES || keyBytes > MAX_RC4_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
+	const keyBytes = version === 1 ? 5 : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
+	if (keyBytes < 5 || keyBytes > MAX_RC4_KEY_BYTES) throw new require_diagnostics.PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
 	const fileKey = computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata);
 	if (!legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey)) throw new require_diagnostics.PdfPasswordRequiredError();
 	return {
@@ -212,7 +226,7 @@ function objectKey(fileKey, num, gen, method) {
 		fileKey,
 		extra,
 		AES_OBJECT_KEY_SALT
-	] : [fileKey, extra])).subarray(0, Math.min(fileKey.length + OBJECT_KEY_EXTRA_BYTES, MD5_DIGEST_BYTES));
+	] : [fileKey, extra])).subarray(0, Math.min(fileKey.length + OBJECT_KEY_EXTRA_BYTES, 16));
 }
 function decryptAes(key, data, sink) {
 	if (data.length <= 16) {
@@ -261,4 +275,20 @@ function createStandardDecryptor(encryptDict, fileId, sink) {
 	};
 }
 //#endregion
+exports.AESV2_KEY_BYTES = AESV2_KEY_BYTES;
+exports.AESV3_KEY_BYTES = AESV3_KEY_BYTES;
+exports.AESV3_SALT_BYTES = AESV3_SALT_BYTES;
+exports.AES_OBJECT_KEY_SALT = AES_OBJECT_KEY_SALT;
+exports.LEGACY_KEY_ITERATIONS = LEGACY_KEY_ITERATIONS;
+exports.MD5_DIGEST_BYTES = MD5_DIGEST_BYTES;
+exports.PASSWORD_PADDING = PASSWORD_PADDING;
+exports.RC4_40_KEY_BYTES = RC4_40_KEY_BYTES;
+exports.RC4_OBFUSCATION_ROUNDS = RC4_OBFUSCATION_ROUNDS;
+exports.ZERO_IV = ZERO_IV;
+exports.computeLegacyFileKeyFromPaddedPassword = computeLegacyFileKeyFromPaddedPassword;
 exports.createStandardDecryptor = createStandardDecryptor;
+exports.hardenedHash = hardenedHash;
+exports.legacyUserValueCore = legacyUserValueCore;
+exports.objectKey = objectKey;
+exports.padOrTruncatePassword = padOrTruncatePassword;
+exports.permissionsBytes = permissionsBytes;

package/dist/encrypt.d.cts

@@ -1,11 +1,27 @@
 import { PdfDiagnosticSink } from "./diagnostics.cjs";
-import { PdfDict } from "./objects.cjs";
+import { n as PdfDict } from "./objects-B7HdMeWS.cjs";
 //#region src/encrypt.d.ts
-type CipherMethod = 'identity' | 'rc4' | 'aes';
+type CipherMethod = "identity" | "rc4" | "aes";
 interface PdfDecryptor {
   decryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
   decryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
 }
+declare const PASSWORD_PADDING: Uint8Array<ArrayBuffer>;
+declare const AES_OBJECT_KEY_SALT: Uint8Array<ArrayBuffer>;
+declare const MD5_DIGEST_BYTES = 16;
+declare const LEGACY_KEY_ITERATIONS = 50;
+declare const RC4_OBFUSCATION_ROUNDS = 19;
+declare const AESV3_KEY_BYTES = 32;
+declare const AESV3_SALT_BYTES = 8;
+declare const RC4_40_KEY_BYTES = 5;
+declare const AESV2_KEY_BYTES = 16;
+declare const ZERO_IV: Uint8Array<ArrayBuffer>;
+declare function permissionsBytes(p: number): Uint8Array<ArrayBuffer>;
+declare function padOrTruncatePassword(password: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+declare function computeLegacyFileKeyFromPaddedPassword(paddedPassword: Uint8Array<ArrayBuffer>, owner: Uint8Array<ArrayBuffer>, permissions: number, fileId: Uint8Array<ArrayBuffer>, revision: number, keyBytes: number, encryptMetadata: boolean): Uint8Array<ArrayBuffer>;
+declare function legacyUserValueCore(fileKey: Uint8Array<ArrayBuffer>, fileId: Uint8Array<ArrayBuffer>, revision: number): Uint8Array<ArrayBuffer>;
+declare function hardenedHash(password: Uint8Array<ArrayBuffer>, salt: Uint8Array<ArrayBuffer>, userData: Uint8Array<ArrayBuffer>, revision: number): Uint8Array<ArrayBuffer>;
+declare function objectKey(fileKey: Uint8Array<ArrayBuffer>, num: number, gen: number, method: CipherMethod): Uint8Array<ArrayBuffer>;
 declare function createStandardDecryptor(encryptDict: PdfDict, fileId: Uint8Array<ArrayBuffer>, sink: PdfDiagnosticSink): PdfDecryptor;
 //#endregion
-export { CipherMethod, PdfDecryptor, createStandardDecryptor };
+export { AESV2_KEY_BYTES, AESV3_KEY_BYTES, AESV3_SALT_BYTES, AES_OBJECT_KEY_SALT, CipherMethod, LEGACY_KEY_ITERATIONS, MD5_DIGEST_BYTES, PASSWORD_PADDING, PdfDecryptor, RC4_40_KEY_BYTES, RC4_OBFUSCATION_ROUNDS, ZERO_IV, computeLegacyFileKeyFromPaddedPassword, createStandardDecryptor, hardenedHash, legacyUserValueCore, objectKey, padOrTruncatePassword, permissionsBytes };

package/dist/encrypt.d.ts

@@ -1,11 +1,27 @@
 import { PdfDiagnosticSink } from "./diagnostics.js";
-import { PdfDict } from "./objects.js";
+import { n as PdfDict } from "./objects-B7HdMeWS.js";
 //#region src/encrypt.d.ts
-type CipherMethod = 'identity' | 'rc4' | 'aes';
+type CipherMethod = "identity" | "rc4" | "aes";
 interface PdfDecryptor {
   decryptString(bytes: Uint8Array<ArrayBuffer>, num: number, gen: number): Uint8Array<ArrayBuffer>;
   decryptStream(bytes: Uint8Array<ArrayBuffer>, dict: PdfDict, num: number, gen: number): Uint8Array<ArrayBuffer>;
 }
+declare const PASSWORD_PADDING: Uint8Array<ArrayBuffer>;
+declare const AES_OBJECT_KEY_SALT: Uint8Array<ArrayBuffer>;
+declare const MD5_DIGEST_BYTES = 16;
+declare const LEGACY_KEY_ITERATIONS = 50;
+declare const RC4_OBFUSCATION_ROUNDS = 19;
+declare const AESV3_KEY_BYTES = 32;
+declare const AESV3_SALT_BYTES = 8;
+declare const RC4_40_KEY_BYTES = 5;
+declare const AESV2_KEY_BYTES = 16;
+declare const ZERO_IV: Uint8Array<ArrayBuffer>;
+declare function permissionsBytes(p: number): Uint8Array<ArrayBuffer>;
+declare function padOrTruncatePassword(password: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+declare function computeLegacyFileKeyFromPaddedPassword(paddedPassword: Uint8Array<ArrayBuffer>, owner: Uint8Array<ArrayBuffer>, permissions: number, fileId: Uint8Array<ArrayBuffer>, revision: number, keyBytes: number, encryptMetadata: boolean): Uint8Array<ArrayBuffer>;
+declare function legacyUserValueCore(fileKey: Uint8Array<ArrayBuffer>, fileId: Uint8Array<ArrayBuffer>, revision: number): Uint8Array<ArrayBuffer>;
+declare function hardenedHash(password: Uint8Array<ArrayBuffer>, salt: Uint8Array<ArrayBuffer>, userData: Uint8Array<ArrayBuffer>, revision: number): Uint8Array<ArrayBuffer>;
+declare function objectKey(fileKey: Uint8Array<ArrayBuffer>, num: number, gen: number, method: CipherMethod): Uint8Array<ArrayBuffer>;
 declare function createStandardDecryptor(encryptDict: PdfDict, fileId: Uint8Array<ArrayBuffer>, sink: PdfDiagnosticSink): PdfDecryptor;
 //#endregion
-export { CipherMethod, PdfDecryptor, createStandardDecryptor };
+export { AESV2_KEY_BYTES, AESV3_KEY_BYTES, AESV3_SALT_BYTES, AES_OBJECT_KEY_SALT, CipherMethod, LEGACY_KEY_ITERATIONS, MD5_DIGEST_BYTES, PASSWORD_PADDING, PdfDecryptor, RC4_40_KEY_BYTES, RC4_OBFUSCATION_ROUNDS, ZERO_IV, computeLegacyFileKeyFromPaddedPassword, createStandardDecryptor, hardenedHash, legacyUserValueCore, objectKey, padOrTruncatePassword, permissionsBytes };

package/dist/encrypt.js

@@ -1,10 +1,10 @@
+import { asDict, asName, asNumber, dictGet } from "./objects.js";
 import { concatBytes } from "./bytes/writer.js";
 import { PdfEncryptedError, PdfPasswordRequiredError } from "./diagnostics.js";
 import { aesCbcDecrypt, aesCbcEncrypt } from "./crypto/aes.js";
 import { md5 } from "./crypto/md5.js";
 import { rc4 } from "./crypto/rc4.js";
 import { sha256, sha384, sha512 } from "./crypto/sha2.js";
-import { asDict, asName, asNumber, dictGet } from "./objects.js";
 //#region src/encrypt.ts
 const PASSWORD_PADDING = new Uint8Array([
 	40,
@@ -49,11 +49,12 @@ const AES_OBJECT_KEY_SALT = new Uint8Array([
 const MD5_DIGEST_BYTES = 16;
 const OBJECT_KEY_EXTRA_BYTES = 5;
 const LEGACY_KEY_ITERATIONS = 50;
-const ALGORITHM_5_ITERATIONS = 19;
+const RC4_OBFUSCATION_ROUNDS = 19;
 const R6_MINIMUM_ROUNDS = 64;
 const R6_ROUND_REPEATS = 64;
 const R6_TERMINATION_MARGIN = 32;
 const AESV3_KEY_BYTES = 32;
+const AESV3_SALT_BYTES = 8;
 const RC4_40_KEY_BYTES = 5;
 const AESV2_KEY_BYTES = 16;
 const DEFAULT_KEY_BITS = 40;
@@ -79,11 +80,16 @@ function permissionsBytes(p) {
 		unsigned >>> 24 & 255
 	]);
 }
-function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
-	const owner = requireStringBytes(encryptDict, "O");
-	const permissions = asNumber(dictGet(encryptDict, "P")) ?? 0;
+function padOrTruncatePassword(password) {
+	if (password.length >= PASSWORD_PADDING.length) return password.subarray(0, PASSWORD_PADDING.length);
+	const padded = new Uint8Array(PASSWORD_PADDING.length);
+	padded.set(password);
+	padded.set(PASSWORD_PADDING.subarray(0, PASSWORD_PADDING.length - password.length), password.length);
+	return padded;
+}
+function computeLegacyFileKeyFromPaddedPassword(paddedPassword, owner, permissions, fileId, revision, keyBytes, encryptMetadata) {
 	const parts = [
-		PASSWORD_PADDING,
+		paddedPassword,
 		owner.subarray(0, PASSWORD_PADDING.length),
 		permissionsBytes(permissions),
 		fileId
@@ -95,18 +101,26 @@ function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMe
 		255
 	]));
 	let digest = md5(concatBytes(parts));
-	if (revision >= 3) for (let i = 0; i < LEGACY_KEY_ITERATIONS; i++) digest = md5(digest.subarray(0, keyBytes));
+	if (revision >= 3) for (let i = 0; i < 50; i++) digest = md5(digest.subarray(0, keyBytes));
 	return digest.subarray(0, keyBytes);
 }
-function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
-	const storedUser = requireStringBytes(encryptDict, "U");
-	if (revision === 2) return bytesEqual(rc4(fileKey, PASSWORD_PADDING), storedUser, PASSWORD_PADDING.length);
+function computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata) {
+	const owner = requireStringBytes(encryptDict, "O");
+	const permissions = asNumber(dictGet(encryptDict, "P")) ?? 0;
+	return computeLegacyFileKeyFromPaddedPassword(PASSWORD_PADDING, owner, permissions, fileId, revision, keyBytes, encryptMetadata);
+}
+function legacyUserValueCore(fileKey, fileId, revision) {
+	if (revision === 2) return rc4(fileKey, PASSWORD_PADDING);
 	let value = rc4(fileKey, md5(concatBytes([PASSWORD_PADDING, fileId])));
-	for (let i = 1; i <= ALGORITHM_5_ITERATIONS; i++) {
+	for (let i = 1; i <= 19; i++) {
 		const roundKey = Uint8Array.from(fileKey, (byte) => byte ^ i);
 		value = rc4(roundKey, value);
 	}
-	return bytesEqual(value, storedUser, MD5_DIGEST_BYTES);
+	return value;
+}
+function legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey) {
+	const storedUser = requireStringBytes(encryptDict, "U");
+	return bytesEqual(legacyUserValueCore(fileKey, fileId, revision), storedUser, revision === 2 ? PASSWORD_PADDING.length : 16);
 }
 function hardenedHash(password, salt, userData, revision) {
 	let k = sha256(concatBytes([
@@ -132,20 +146,20 @@ function hardenedHash(password, salt, userData, revision) {
 		k = selector === 0 ? sha256(e) : selector === 1 ? sha384(e) : sha512(e);
 		round++;
 	}
-	return k.subarray(0, AESV3_KEY_BYTES);
+	return k.subarray(0, 32);
 }
 function computeAesV3FileKey(encryptDict, revision) {
 	const storedUser = requireStringBytes(encryptDict, "U");
 	const expectedLength = 48;
 	if (storedUser.length < expectedLength) throw new PdfEncryptedError(`the /Encrypt dictionary's /U entry is ${String(storedUser.length)} bytes; revision ${String(revision)} requires ${String(expectedLength)}`);
 	const empty = /* @__PURE__ */ new Uint8Array(0);
-	const validationSalt = storedUser.subarray(AESV3_KEY_BYTES, 40);
+	const validationSalt = storedUser.subarray(32, 40);
 	const keySalt = storedUser.subarray(40, expectedLength);
-	if (!bytesEqual(hardenedHash(empty, validationSalt, empty, revision), storedUser, AESV3_KEY_BYTES)) throw new PdfPasswordRequiredError();
+	if (!bytesEqual(hardenedHash(empty, validationSalt, empty, revision), storedUser, 32)) throw new PdfPasswordRequiredError();
 	const intermediateKey = hardenedHash(empty, keySalt, empty, revision);
 	const wrappedKey = requireStringBytes(encryptDict, "UE");
-	if (wrappedKey.length < AESV3_KEY_BYTES) throw new PdfEncryptedError(`the /Encrypt dictionary's /UE entry is ${String(wrappedKey.length)} bytes; revision ${String(revision)} requires ${String(AESV3_KEY_BYTES)}`);
-	return aesCbcDecrypt(intermediateKey, ZERO_IV, wrappedKey.subarray(0, AESV3_KEY_BYTES));
+	if (wrappedKey.length < 32) throw new PdfEncryptedError(`the /Encrypt dictionary's /UE entry is ${String(wrappedKey.length)} bytes; revision ${String(revision)} requires ${String(32)}`);
+	return aesCbcDecrypt(intermediateKey, ZERO_IV, wrappedKey.subarray(0, 32));
 }
 function methodFromCryptFilterName(encryptDict, entryKey) {
 	const name = asName(dictGet(encryptDict, entryKey)) ?? "Identity";
@@ -163,7 +177,7 @@ function cryptFilterKeyBytes(encryptDict, declaredBits) {
 	const streamFilterName = asName(dictGet(encryptDict, "StmF")) ?? "Identity";
 	const filters = asDict(dictGet(encryptDict, "CF"));
 	const filter = filters !== void 0 ? asDict(dictGet(filters, streamFilterName)) : void 0;
-	if ((filter !== void 0 ? asName(dictGet(filter, "CFM")) : void 0) === "AESV2") return AESV2_KEY_BYTES;
+	if ((filter !== void 0 ? asName(dictGet(filter, "CFM")) : void 0) === "AESV2") return 16;
 	const declared = filter !== void 0 ? asNumber(dictGet(filter, "Length")) : void 0;
 	if (declared === void 0) return Math.floor(declaredBits / BITS_PER_BYTE);
 	return declared >= DEFAULT_KEY_BITS ? Math.floor(declared / BITS_PER_BYTE) : declared;
@@ -188,8 +202,8 @@ function setUpHandler(encryptDict, fileId) {
 	if (revision < 2 || revision > 4) throw new PdfEncryptedError(`unsupported standard security handler revision /R ${String(revision)}`);
 	const streamMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StmF") : "rc4";
 	const stringMethod = version === 4 ? methodFromCryptFilterName(encryptDict, "StrF") : "rc4";
-	const keyBytes = version === 1 ? RC4_40_KEY_BYTES : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
-	if (keyBytes < RC4_40_KEY_BYTES || keyBytes > MAX_RC4_KEY_BYTES) throw new PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
+	const keyBytes = version === 1 ? 5 : version === 2 ? Math.floor(declaredBits / BITS_PER_BYTE) : cryptFilterKeyBytes(encryptDict, declaredBits);
+	if (keyBytes < 5 || keyBytes > MAX_RC4_KEY_BYTES) throw new PdfEncryptedError(`the /Encrypt dictionary declares a ${String(keyBytes * BITS_PER_BYTE)}-bit file key, outside the 40-128 bit range /V ${String(version)} permits`);
 	const fileKey = computeLegacyFileKey(encryptDict, fileId, revision, keyBytes, encryptMetadata);
 	if (!legacyUserPasswordVerifies(encryptDict, fileId, revision, fileKey)) throw new PdfPasswordRequiredError();
 	return {
@@ -211,7 +225,7 @@ function objectKey(fileKey, num, gen, method) {
 		fileKey,
 		extra,
 		AES_OBJECT_KEY_SALT
-	] : [fileKey, extra])).subarray(0, Math.min(fileKey.length + OBJECT_KEY_EXTRA_BYTES, MD5_DIGEST_BYTES));
+	] : [fileKey, extra])).subarray(0, Math.min(fileKey.length + OBJECT_KEY_EXTRA_BYTES, 16));
 }
 function decryptAes(key, data, sink) {
 	if (data.length <= 16) {
@@ -260,4 +274,4 @@ function createStandardDecryptor(encryptDict, fileId, sink) {
 	};
 }
 //#endregion
-export { createStandardDecryptor };
+export { AESV2_KEY_BYTES, AESV3_KEY_BYTES, AESV3_SALT_BYTES, AES_OBJECT_KEY_SALT, LEGACY_KEY_ITERATIONS, MD5_DIGEST_BYTES, PASSWORD_PADDING, RC4_40_KEY_BYTES, RC4_OBFUSCATION_ROUNDS, ZERO_IV, computeLegacyFileKeyFromPaddedPassword, createStandardDecryptor, hardenedHash, legacyUserValueCore, objectKey, padOrTruncatePassword, permissionsBytes };

package/dist/filters.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_bytes_reader = require("./bytes/reader.cjs");
 const require_objects = require("./objects.cjs");
+const require_bytes_reader = require("./bytes/reader.cjs");
 const require_bytes_flate = require("./bytes/flate.cjs");
 const require_image_ccitt = require("./image/ccitt.cjs");
 const require_image_jbig2 = require("./image/jbig2.cjs");
@@ -62,11 +62,13 @@ function ccittFaxDecode(data, parm, dict, sink) {
 		rows,
 		blackIs1: require_objects.asBool(parmGet("BlackIs1")),
 		encodedByteAlign: require_objects.asBool(parmGet("EncodedByteAlign")),
-		onWarning: (message) => sink({
-			code: "pdf/ccitt-fax-degraded",
-			severity: "warning",
-			message
-		})
+		onWarning: (message) => {
+			sink({
+				code: "pdf/ccitt-fax-degraded",
+				severity: "warning",
+				message
+			});
+		}
 	}).bytes;
 }
 function jbig2Decode(data, parm, dict, sink, resolve) {
@@ -84,11 +86,13 @@ function jbig2Decode(data, parm, dict, sink, resolve) {
 			globals,
 			width: require_objects.asNumber(require_objects.dictGet(dict, "Width") ?? require_objects.dictGet(dict, "W")),
 			height: require_objects.asNumber(require_objects.dictGet(dict, "Height") ?? require_objects.dictGet(dict, "H")),
-			onWarning: (message) => sink({
-				code: "pdf/jbig2-degraded",
-				severity: "warning",
-				message
-			})
+			onWarning: (message) => {
+				sink({
+					code: "pdf/jbig2-degraded",
+					severity: "warning",
+					message
+				});
+			}
 		});
 		return Uint8Array.from(image.bytes, (byte) => byte ^ 255);
 	} catch (error) {
@@ -188,9 +192,9 @@ function lzwDecode(data, earlyChange, sink) {
 		if (prevEntry !== void 0) {
 			dict[nextCode] = concatTwo(prevEntry, new Uint8Array([entry[0] ?? 0]));
 			nextCode++;
-			if (nextCode + bias === 2 ** 9) codeWidth = 10;
-			else if (nextCode + bias === 2 ** 10) codeWidth = 11;
-			else if (nextCode + bias === 2 ** 11) codeWidth = 12;
+			if (nextCode + bias === 512) codeWidth = 10;
+			else if (nextCode + bias === 1024) codeWidth = 11;
+			else if (nextCode + bias === 2048) codeWidth = 12;
 		}
 		prevEntry = entry;
 	}

package/dist/filters.d.cts

@@ -1,5 +1,5 @@
 import { PdfDiagnosticSink } from "./diagnostics.cjs";
-import { PdfDict, PdfObject } from "./objects.cjs";
+import { n as PdfDict, r as PdfObject } from "./objects-B7HdMeWS.cjs";
 //#region src/filters.d.ts
 interface DecodedStream {
   readonly bytes: Uint8Array<ArrayBuffer>;

package/dist/filters.d.ts

@@ -1,5 +1,5 @@
 import { PdfDiagnosticSink } from "./diagnostics.js";
-import { PdfDict, PdfObject } from "./objects.js";
+import { n as PdfDict, r as PdfObject } from "./objects-B7HdMeWS.js";
 //#region src/filters.d.ts
 interface DecodedStream {
   readonly bytes: Uint8Array<ArrayBuffer>;

package/dist/filters.js

@@ -1,5 +1,5 @@
-import { isAsciiWhitespace } from "./bytes/reader.js";
 import { asArray, asBool, asDict, asName, asNumber, dictGet } from "./objects.js";
+import { isAsciiWhitespace } from "./bytes/reader.js";
 import { inflateTolerant } from "./bytes/flate.js";
 import { decodeCcittFax } from "./image/ccitt.js";
 import { decodeJbig2Embedded } from "./image/jbig2.js";
@@ -61,11 +61,13 @@ function ccittFaxDecode(data, parm, dict, sink) {
 		rows,
 		blackIs1: asBool(parmGet("BlackIs1")),
 		encodedByteAlign: asBool(parmGet("EncodedByteAlign")),
-		onWarning: (message) => sink({
-			code: "pdf/ccitt-fax-degraded",
-			severity: "warning",
-			message
-		})
+		onWarning: (message) => {
+			sink({
+				code: "pdf/ccitt-fax-degraded",
+				severity: "warning",
+				message
+			});
+		}
 	}).bytes;
 }
 function jbig2Decode(data, parm, dict, sink, resolve) {
@@ -83,11 +85,13 @@ function jbig2Decode(data, parm, dict, sink, resolve) {
 			globals,
 			width: asNumber(dictGet(dict, "Width") ?? dictGet(dict, "W")),
 			height: asNumber(dictGet(dict, "Height") ?? dictGet(dict, "H")),
-			onWarning: (message) => sink({
-				code: "pdf/jbig2-degraded",
-				severity: "warning",
-				message
-			})
+			onWarning: (message) => {
+				sink({
+					code: "pdf/jbig2-degraded",
+					severity: "warning",
+					message
+				});
+			}
 		});
 		return Uint8Array.from(image.bytes, (byte) => byte ^ 255);
 	} catch (error) {
@@ -187,9 +191,9 @@ function lzwDecode(data, earlyChange, sink) {
 		if (prevEntry !== void 0) {
 			dict[nextCode] = concatTwo(prevEntry, new Uint8Array([entry[0] ?? 0]));
 			nextCode++;
-			if (nextCode + bias === 2 ** 9) codeWidth = 10;
-			else if (nextCode + bias === 2 ** 10) codeWidth = 11;
-			else if (nextCode + bias === 2 ** 11) codeWidth = 12;
+			if (nextCode + bias === 512) codeWidth = 10;
+			else if (nextCode + bias === 1024) codeWidth = 11;
+			else if (nextCode + bias === 2048) codeWidth = 12;
 		}
 		prevEntry = entry;
 	}

package/dist/font-read.cjs

@@ -1,11 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_afm_widths = require("./afm-widths-BoeTOK2r.cjs");
-const require_cmap = require("./cmap.cjs");
+const require_afm_widths = require("./afm-widths-BTu0IDp2.cjs");
 const require_objects = require("./objects.cjs");
 const require_filters = require("./filters.cjs");
+const require_builtin_encoding = require("./builtin-encoding.cjs");
+const require_cmap = require("./cmap.cjs");
 const require_fonts = require("./fonts.cjs");
 const require_font_style = require("./font-style.cjs");
 //#region src/font-read.ts
+const SYMBOLIC_FLAG_BIT = 4;
 const ITALIC_FLAG_BIT = 64;
 const FORCE_BOLD_FLAG_BIT = 1 << 18;
 const REPLACEMENT_CHARACTER = "�";
@@ -14,14 +16,34 @@ function styleFlagsFromDescriptor(descriptor) {
 	return {
 		forceBold: flags !== void 0 ? (flags & FORCE_BOLD_FLAG_BIT) !== 0 : void 0,
 		italicFlag: flags !== void 0 ? (flags & ITALIC_FLAG_BIT) !== 0 : void 0,
-		italicAngle: descriptor !== void 0 ? require_objects.asNumber(require_objects.dictGet(descriptor, "ItalicAngle")) : void 0
+		italicAngle: descriptor !== void 0 ? require_objects.asNumber(require_objects.dictGet(descriptor, "ItalicAngle")) : void 0,
+		symbolic: flags !== void 0 ? (flags & SYMBOLIC_FLAG_BIT) !== 0 : void 0
 	};
 }
-function glyphNameToUnicodeWithUniFallback(name) {
-	const direct = require_afm_widths.glyphNameToUnicode(name);
-	if (direct !== void 0) return direct;
-	const uniMatch = /^uni([0-9A-Fa-f]{4,6})$/.exec(name);
-	return uniMatch?.[1] !== void 0 ? Number.parseInt(uniMatch[1], 16) : void 0;
+function builtinSymbolGlyphNameLookup(baseFamily) {
+	if (baseFamily === "Symbol") return require_afm_widths.symbolGlyphName;
+	if (baseFamily === "ZapfDingbats") return require_afm_widths.zapfDingbatsGlyphName;
+}
+function readFontProgram(descriptor, context) {
+	if (descriptor === void 0) return;
+	for (const key of [
+		"FontFile2",
+		"FontFile3",
+		"FontFile"
+	]) {
+		const stream = context.resolver.resolve(require_objects.dictGet(descriptor, key));
+		if (stream?.kind !== "stream") continue;
+		const decoded = require_filters.decodeStream(stream.raw, stream.dict, context.sink);
+		const encoding = require_builtin_encoding.readFontProgramEncoding(decoded.bytes);
+		if (encoding !== void 0) return encoding;
+	}
+}
+function lazyFontProgram(descriptor, context) {
+	let read;
+	return () => {
+		read ??= { encoding: readFontProgram(descriptor, context) };
+		return read.encoding;
+	};
 }
 function readDifferencesMap(differences) {
 	const map = /* @__PURE__ */ new Map();
@@ -43,7 +65,10 @@ function readToUnicodeCMap(fontDict, context) {
 function buildSimpleFont(fontDict, context) {
 	const baseFont = require_objects.asName(require_objects.dictGet(fontDict, "BaseFont")) ?? "Helvetica";
 	const descriptor = context.resolver.resolveDict(require_objects.dictGet(fontDict, "FontDescriptor"));
-	const { baseFamily, bold, italic } = require_font_style.styleFromBaseFontName(baseFont, styleFlagsFromDescriptor(descriptor));
+	const styleFlags = styleFlagsFromDescriptor(descriptor);
+	const { baseFamily, bold, italic } = require_font_style.styleFromBaseFontName(baseFont, styleFlags);
+	const symbolic = styleFlags.symbolic ?? false;
+	const builtinGlyphName = builtinSymbolGlyphNameLookup(baseFamily);
 	const widthsArr = require_objects.asArray(require_objects.dictGet(fontDict, "Widths"));
 	const firstChar = require_objects.asNumber(require_objects.dictGet(fontDict, "FirstChar")) ?? 0;
 	const missingWidth = (descriptor !== void 0 ? require_objects.asNumber(require_objects.dictGet(descriptor, "MissingWidth")) : void 0) ?? 0;
@@ -62,12 +87,36 @@ function buildSimpleFont(fontDict, context) {
 	const encodingObj = require_objects.dictGet(fontDict, "Encoding");
 	const encodingDict = context.resolver.resolveDict(encodingObj);
 	const baseEncodingName = require_objects.asName(encodingDict !== void 0 ? require_objects.dictGet(encodingDict, "BaseEncoding") : encodingObj);
-	if (baseEncodingName !== void 0 && baseEncodingName !== "WinAnsiEncoding") context.sink({
+	const namedBaseGlyphName = baseEncodingName !== void 0 ? require_afm_widths.namedEncodingGlyphName(baseEncodingName) : void 0;
+	if (baseEncodingName !== void 0 && namedBaseGlyphName === void 0) context.sink({
 		code: "char/encoding-approximated",
 		severity: "info",
 		message: `base encoding "${baseEncodingName}" has no dedicated table here and is approximated as WinAnsiEncoding`
 	});
 	const differencesMap = readDifferencesMap(encodingDict !== void 0 ? require_objects.asArray(require_objects.dictGet(encodingDict, "Differences")) : void 0);
+	const programEncoding = lazyFontProgram(descriptor, context);
+	const symbolEncoded = symbolic || builtinGlyphName !== void 0;
+	const byGlyphName = (source) => (code) => {
+		const name = source(code);
+		return name === void 0 ? void 0 : require_afm_widths.glyphNameToUnicode(name);
+	};
+	const fromProgram = (code) => programEncoding()?.codeToUnicode(code);
+	const namedBase = namedBaseGlyphName === void 0 ? void 0 : byGlyphName(namedBaseGlyphName);
+	const resolvers = [byGlyphName((code) => differencesMap.get(code)), ...symbolEncoded ? [
+		fromProgram,
+		builtinGlyphName === void 0 ? void 0 : byGlyphName(builtinGlyphName),
+		namedBase
+	] : [
+		namedBase,
+		fromProgram,
+		byGlyphName(require_afm_widths.winAnsiGlyphName)
+	]].filter((resolver) => resolver !== void 0);
+	const unicodeForCode = (code) => {
+		for (const resolve of resolvers) {
+			const unicode = resolve(code);
+			if (unicode !== void 0) return unicode;
+		}
+	};
 	const decodeToUnicode = (codes) => {
 		let out = "";
 		let unmapped = 0;
@@ -77,10 +126,9 @@ function buildSimpleFont(fontDict, context) {
 				out += viaToUnicode;
 				continue;
 			}
-			const name = differencesMap.get(code) ?? require_afm_widths.winAnsiGlyphName(code);
-			const unicode = name !== void 0 ? glyphNameToUnicodeWithUniFallback(name) : void 0;
+			const unicode = unicodeForCode(code);
 			if (unicode !== void 0) {
-				out += String.fromCharCode(unicode);
+				out += String.fromCodePoint(unicode);
 				continue;
 			}
 			unmapped++;
@@ -139,6 +187,8 @@ function buildCompositeFont(fontDict, context) {
 	const widthMap = readCidWidths(descendantDict !== void 0 ? require_objects.asArray(require_objects.dictGet(descendantDict, "W")) : void 0);
 	const widthOf = (cid) => widthMap.get(cid) ?? dw;
 	const toUnicode = readToUnicodeCMap(fontDict, context);
+	const cidToGidMap = descendantDict !== void 0 ? require_objects.dictGet(descendantDict, "CIDToGIDMap") : void 0;
+	const programEncoding = require_objects.isName(require_objects.dictGet(fontDict, "Encoding"), "Identity-H") && (cidToGidMap === void 0 || require_objects.isName(cidToGidMap, "Identity")) ? lazyFontProgram(descriptor, context) : void 0;
 	const decodeToUnicode = (codes) => {
 		let out = "";
 		let glyphCount = 0;
@@ -151,6 +201,11 @@ function buildCompositeFont(fontDict, context) {
 				out += mapped;
 				continue;
 			}
+			const fromProgram = programEncoding?.()?.glyphIdToUnicode(cid);
+			if (fromProgram !== void 0) {
+				out += String.fromCodePoint(fromProgram);
+				continue;
+			}
 			unmapped++;
 			out += REPLACEMENT_CHARACTER;
 		}

package/dist/font-read.d.cts

@@ -1,5 +1,5 @@
 import { PdfDiagnosticSink } from "./diagnostics.cjs";
-import { PdfDict } from "./objects.cjs";
+import { n as PdfDict } from "./objects-B7HdMeWS.cjs";
 import { FontMetricsPort, PdfObjectResolver } from "./interpret.cjs";
 //#region src/font-read.d.ts
 interface PdfFont {