reamkit 1.19.0 → 1.20.0

package/dist/esm/core/converter/ream.d.ts

@@ -14,8 +14,10 @@ export interface ReamParseOptions {
     /** Reader registry override; defaults to the built-in docx + xlsx readers. */
     readonly readers?: ReadonlyArray<DocumentReader<SourceDoc>>;
     /**
-     * The user password for an encrypted PDF source (ISO 32000 §7.6). Defaults to
-     * the empty string, which opens the common permissions-only encryption (EP14).
+     * The password an encrypted source is opened with: a PDF's user password
+     * (ISO 32000 §7.6) or an OOXML package's (ECMA-376 §2.3, MS-OFFCRYPTO).
+     * Defaults to the empty string, which opens a PDF's common permissions-only
+     * encryption (EP14); an encrypted OOXML package always names a password.
      */
     readonly password?: string;
 }

package/dist/esm/core/converter/ream.js

@@ -13,8 +13,8 @@ import { writeXlsx } from "../../excel/xlsx-writer.js";
 import { writeHtml } from "../../html/html-writer.js";
 import { writeSvg } from "../../svg/svg-writer.js";
 import { resolveDocxAutoFonts } from "../../word/docx-to-pdf.js";
-import { isCfb, openCfb } from "../ole/cfb.js";
 import { DEFAULT_READERS, resolveFontsViaChain, toFlowDoc } from "./facade.js";
+import { decryptPackage, isEncryptedPackage } from "../crypto/offcrypto.js";
 //#region src/core/converter/ream.ts
 /**
 * The point size Excel's column-width unit is quoted at — its default theme
@@ -77,12 +77,14 @@ var Ream = class Ream {
 	*/
 	static parse(bytes, options = {}) {
 		const readers = options.readers ?? DEFAULT_READERS;
-		const reader = readers.find((r) => r.sniff(bytes));
-		if (!reader) {
-			if (isEncryptedOoxml(bytes)) throw new Error("Password-protected OOXML document (ECMA-376 §2.3 EncryptedPackage) — re-save it without a password");
-			throw new Error(`Unrecognized document format (readers: ${readers.map((r) => r.id).join(", ")})`);
+		let source = bytes;
+		if (isEncryptedPackage(bytes)) {
+			if (options.password === void 0) throw new Error("Password-protected OOXML document (ECMA-376 §2.3 EncryptedPackage) — pass the password as `password`");
+			source = decryptPackage(bytes, options.password);
 		}
-		const { doc, losses } = reader.read(bytes, { password: options.password });
+		const reader = readers.find((r) => r.sniff(source));
+		if (!reader) throw new Error(`Unrecognized document format (readers: ${readers.map((r) => r.id).join(", ")})`);
+		const { doc, losses } = reader.read(source, { password: options.password });
 		const sheet = doc.kind === "sheet" ? doc : void 0;
 		return new Ream(toFlowDoc(doc), sheet, losses, bytes, reader.id);
 	}
@@ -232,13 +234,5 @@ var Ream = class Ream {
 		if (options.strict && losses.length > 0) throw new ConversionLossError(losses[0]);
 	}
 };
-function isEncryptedOoxml(bytes) {
-	if (!isCfb(bytes)) return false;
-	try {
-		return openCfb(bytes).hasStream("EncryptedPackage");
-	} catch {
-		return false;
-	}
-}
 //#endregion
 export { Ream };

package/dist/esm/core/crypto/offcrypto.d.ts

@@ -0,0 +1,16 @@
+/** Thrown when the bytes are encrypted and the password does not open them. */
+export declare class WrongPasswordError extends Error {
+    constructor(message?: string);
+}
+/** Whether the bytes are an OOXML package encrypted per ECMA-376 §2.3. */
+export declare function isEncryptedPackage(bytes: Uint8Array): boolean;
+/**
+ * Decrypt an encrypted OOXML package into the plain OPC zip inside it.
+ *
+ * @param bytes    The compound file (`EncryptionInfo` + `EncryptedPackage`).
+ * @param password The password to open it with.
+ * @returns The decrypted package bytes — an ordinary `.docx`/`.xlsx` zip.
+ * @throws WrongPasswordError when the password fails the document's own
+ * verifier, and Error when the encryption is one this reader does not know.
+ */
+export declare function decryptPackage(bytes: Uint8Array, password: string): Uint8Array;

package/dist/esm/core/crypto/offcrypto.js

@@ -0,0 +1,222 @@
+import { openCfb } from "../ole/cfb.js";
+import { aesCbcDecrypt, aesEcbDecrypt, sha1, sha256, sha384, sha512 } from "./primitives.js";
+//#region src/core/crypto/offcrypto.ts
+/** Thrown when the bytes are encrypted and the password does not open them. */
+var WrongPasswordError = class extends Error {
+	constructor(message = "Wrong password for this document") {
+		super(message);
+		this.name = "WrongPasswordError";
+	}
+};
+/** Whether the bytes are an OOXML package encrypted per ECMA-376 §2.3. */
+function isEncryptedPackage(bytes) {
+	try {
+		const cfb = openCfb(bytes);
+		return cfb.hasStream("EncryptedPackage") && cfb.hasStream("EncryptionInfo");
+	} catch {
+		return false;
+	}
+}
+/**
+* Decrypt an encrypted OOXML package into the plain OPC zip inside it.
+*
+* @param bytes    The compound file (`EncryptionInfo` + `EncryptedPackage`).
+* @param password The password to open it with.
+* @returns The decrypted package bytes — an ordinary `.docx`/`.xlsx` zip.
+* @throws WrongPasswordError when the password fails the document's own
+* verifier, and Error when the encryption is one this reader does not know.
+*/
+function decryptPackage(bytes, password) {
+	const cfb = openCfb(bytes);
+	const info = cfb.readStream("EncryptionInfo");
+	const payload = cfb.readStream("EncryptedPackage");
+	if (!info || !payload) throw new Error("Not an encrypted OOXML package");
+	const v = new DataView(info.buffer, info.byteOffset, info.byteLength);
+	const major = v.getUint16(0, true);
+	const minor = v.getUint16(2, true);
+	if (major === 4 && minor === 4) return agile(info, payload, password);
+	if ((major === 3 || major === 4) && minor === 2) return standard(info, payload, password);
+	throw new Error(`Unsupported OOXML encryption (version ${String(major)}.${String(minor)})`);
+}
+function packageSize(payload) {
+	const v = new DataView(payload.buffer, payload.byteOffset, payload.byteLength);
+	const lo = v.getUint32(0, true);
+	return v.getUint32(4, true) * 4294967296 + lo;
+}
+function standard(info, payload, password) {
+	const v = new DataView(info.buffer, info.byteOffset, info.byteLength);
+	const headerSize = v.getUint32(8, true);
+	const algId = v.getUint32(20, true);
+	const keyBits = v.getUint32(28, true);
+	let at = 12 + headerSize;
+	const saltSize = v.getUint32(at, true);
+	at += 4;
+	const salt = info.subarray(at, at + saltSize);
+	at += saltSize;
+	const encryptedVerifier = info.subarray(at, at + 16);
+	at += 16;
+	const verifierHashSize = v.getUint32(at, true);
+	at += 4;
+	const encryptedVerifierHash = info.subarray(at, at + (verifierHashSize <= 20 ? 32 : 32));
+	if (algId !== 0 && (algId < 26126 || algId > 26128)) throw new Error(`Unsupported OOXML cipher (algId 0x${algId.toString(16)})`);
+	const key = standardKey(password, salt, Math.max(16, Math.floor((keyBits || 128) / 8)));
+	const verifier = aesEcbDecrypt(key, encryptedVerifier);
+	const expected = aesEcbDecrypt(key, encryptedVerifierHash).subarray(0, 20);
+	if (!sameBytes(sha1(verifier), expected)) throw new WrongPasswordError();
+	const plain = aesEcbDecrypt(key, payload.subarray(8));
+	return plain.subarray(0, Math.min(packageSize(payload), plain.length));
+}
+function standardKey(password, salt, keyLength) {
+	let h = sha1(concat(salt, utf16le(password)));
+	const counter = new Uint8Array(4);
+	for (let i = 0; i < 5e4; i++) {
+		new DataView(counter.buffer).setUint32(0, i, true);
+		h = sha1(concat(counter, h));
+	}
+	h = sha1(concat(h, new Uint8Array(4)));
+	return concat(sha1(padded(h, 54)), sha1(padded(h, 92))).subarray(0, keyLength);
+}
+function padded(h, byte) {
+	const buf = new Uint8Array(64).fill(byte);
+	for (let i = 0; i < h.length && i < 64; i++) buf[i] = buf[i] ^ h[i];
+	return buf;
+}
+var BLOCK_VERIFIER_INPUT = Uint8Array.of(254, 167, 210, 118, 59, 75, 158, 121);
+var BLOCK_VERIFIER_VALUE = Uint8Array.of(215, 170, 15, 109, 48, 97, 52, 78);
+var BLOCK_KEY_VALUE = Uint8Array.of(20, 110, 11, 231, 171, 172, 208, 214);
+var SEGMENT = 4096;
+function agile(info, payload, password) {
+	const xml = new TextDecoder().decode(info.subarray(8));
+	const keyData = agileKeyData(attrsOf(xml, "keyData"));
+	const encAttrs = passwordKeyEncryptor(xml);
+	const enc = agileKeyData(encAttrs);
+	const spinCount = Number(encAttrs["spinCount"] ?? "0");
+	const encryptedKeyValue = b64(encAttrs["encryptedKeyValue"] ?? "");
+	const encryptedVerifierHashInput = b64(encAttrs["encryptedVerifierHashInput"] ?? "");
+	const encryptedVerifierHashValue = b64(encAttrs["encryptedVerifierHashValue"] ?? "");
+	const spun = agileSpin(password, enc, spinCount);
+	const keyFor = (block) => agileBlockKey(spun, enc, block);
+	const verifier = decryptAgile(keyFor(BLOCK_VERIFIER_INPUT), enc.saltValue, encryptedVerifierHashInput, enc.cbc);
+	const expected = decryptAgile(keyFor(BLOCK_VERIFIER_VALUE), enc.saltValue, encryptedVerifierHashValue, enc.cbc);
+	const actual = enc.hash(verifier.subarray(0, enc.saltValue.length));
+	if (!sameBytes(actual, expected.subarray(0, actual.length))) throw new WrongPasswordError();
+	const packageKey = decryptAgile(keyFor(BLOCK_KEY_VALUE), enc.saltValue, encryptedKeyValue, enc.cbc).subarray(0, keyData.keyBits / 8);
+	const cipher = payload.subarray(8);
+	const out = new Uint8Array(cipher.length);
+	const counter = new Uint8Array(4);
+	for (let i = 0; i * SEGMENT < cipher.length; i++) {
+		new DataView(counter.buffer).setUint32(0, i, true);
+		const iv = keyData.hash(concat(keyData.saltValue, counter)).subarray(0, keyData.blockSize || 16);
+		const block = cipher.subarray(i * SEGMENT, Math.min((i + 1) * SEGMENT, cipher.length));
+		out.set(decryptAgile(packageKey, iv, block, keyData.cbc), i * SEGMENT);
+	}
+	return out.subarray(0, Math.min(packageSize(payload), out.length));
+}
+function agileSpin(password, enc, spinCount) {
+	let h = enc.hash(concat(enc.saltValue, utf16le(password)));
+	const counter = new Uint8Array(4);
+	for (let i = 0; i < spinCount; i++) {
+		new DataView(counter.buffer).setUint32(0, i, true);
+		h = enc.hash(concat(counter, h));
+	}
+	return h;
+}
+function agileBlockKey(spun, enc, block) {
+	const keyLength = enc.keyBits / 8;
+	const derived = enc.hash(concat(spun, block));
+	if (derived.length >= keyLength) return derived.subarray(0, keyLength);
+	const out = new Uint8Array(keyLength).fill(54);
+	out.set(derived);
+	return out;
+}
+function decryptAgile(key, iv, data, cbc) {
+	if (!cbc) return aesEcbDecrypt(key, data);
+	return aesCbcDecrypt(key, iv.length >= 16 ? iv.subarray(0, 16) : concat(iv, new Uint8Array(16 - iv.length)), data, false);
+}
+var HASHES = new Map([
+	["sha1", sha1],
+	["sha-1", sha1],
+	["sha256", sha256],
+	["sha-256", sha256],
+	["sha384", sha384],
+	["sha-384", sha384],
+	["sha512", sha512],
+	["sha-512", sha512]
+]);
+function agileKeyData(attrs) {
+	const name = (attrs["hashAlgorithm"] ?? "sha512").toLowerCase();
+	const hash = HASHES.get(name);
+	if (!hash) throw new Error(`Unsupported OOXML hash (${name})`);
+	const cipher = (attrs["cipherAlgorithm"] ?? "AES").toUpperCase();
+	if (!cipher.startsWith("AES")) throw new Error(`Unsupported OOXML cipher (${cipher})`);
+	return {
+		saltValue: b64(attrs["saltValue"] ?? ""),
+		blockSize: Number(attrs["blockSize"] ?? "16"),
+		keyBits: Number(attrs["keyBits"] ?? "256"),
+		hash,
+		cbc: (attrs["cipherChaining"] ?? "ChainingModeCBC") !== "ChainingModeECB"
+	};
+}
+function passwordKeyEncryptor(xml) {
+	const re = /<[A-Za-z0-9]*:?encryptedKey\b([^>]*)\/?>/gu;
+	let m = re.exec(xml);
+	while (m) {
+		const attrs = parseAttrs(m[1] ?? "");
+		if (attrs["spinCount"] !== void 0) return attrs;
+		m = re.exec(xml);
+	}
+	throw new Error("No password key encryptor in the encryption descriptor");
+}
+function attrsOf(xml, tag) {
+	const m = new RegExp(`<[A-Za-z0-9]*:?${tag}\\b([^>]*)/?>`, "u").exec(xml);
+	return m ? parseAttrs(m[1] ?? "") : {};
+}
+function parseAttrs(raw) {
+	const out = {};
+	const re = /([A-Za-z0-9_:]+)\s*=\s*"([^"]*)"/gu;
+	let m = re.exec(raw);
+	while (m) {
+		out[m[1].replace(/^.*:/u, "")] = m[2];
+		m = re.exec(raw);
+	}
+	return out;
+}
+function utf16le(s) {
+	const out = new Uint8Array(s.length * 2);
+	const v = new DataView(out.buffer);
+	for (let i = 0; i < s.length; i++) v.setUint16(i * 2, s.charCodeAt(i), true);
+	return out;
+}
+function concat(a, b) {
+	const out = new Uint8Array(a.length + b.length);
+	out.set(a);
+	out.set(b, a.length);
+	return out;
+}
+function sameBytes(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function b64(s) {
+	const clean = s.replace(/[^A-Za-z0-9+/]/gu, "");
+	const out = new Uint8Array(Math.floor(clean.length * 3 / 4));
+	let acc = 0;
+	let bits = 0;
+	let at = 0;
+	for (const ch of clean) {
+		const v = B64.indexOf(ch);
+		if (v < 0) continue;
+		acc = acc << 6 | v;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			out[at++] = acc >> bits & 255;
+		}
+	}
+	return out.subarray(0, at);
+}
+//#endregion
+export { decryptPackage, isEncryptedPackage };

package/dist/esm/{pdf-reader/crypto.d.ts → core/crypto/primitives.d.ts}

@@ -5,8 +5,18 @@
 export declare function rc4(key: Uint8Array, data: Uint8Array): Uint8Array;
 /** MD5 digest (RFC 1321) → 16 bytes; the key-derivation hash for V1/V2/V4. */
 export declare function md5(input: Uint8Array): Uint8Array;
+/**
+ * SHA-1. Used by MS-OFFCRYPTO's standard encryption for its key derivation and
+ * password verifier, and by agile encryption when the descriptor names it.
+ */
+export declare function sha1(input: Uint8Array): Uint8Array;
 export declare function sha256(input: Uint8Array): Uint8Array;
 export declare function sha512(input: Uint8Array): Uint8Array;
 export declare function sha384(input: Uint8Array): Uint8Array;
 export declare function aesCbcDecrypt(key: Uint8Array, iv: Uint8Array, data: Uint8Array, stripPad: boolean): Uint8Array;
+/**
+ * AES-ECB decrypt — every block on its own key, no chaining. MS-OFFCRYPTO's
+ * standard encryption uses it for both the verifier and the package.
+ */
+export declare function aesEcbDecrypt(key: Uint8Array, data: Uint8Array): Uint8Array;
 export declare function aesCbcEncrypt(key: Uint8Array, iv: Uint8Array, data: Uint8Array): Uint8Array;

package/dist/esm/{pdf-reader/crypto.js → core/crypto/primitives.js}

@@ -1,4 +1,4 @@
-//#region src/pdf-reader/crypto.ts
+//#region src/core/crypto/primitives.ts
 /**
 * RC4 stream cipher (§7.6.2). Symmetric, so the same call both encrypts and
 * decrypts; used by the legacy V1/V2/V4 Standard security handlers.
@@ -217,6 +217,58 @@ var SHA256_K = [
 	3204031479,
 	3329325298
 ];
+/**
+* SHA-1. Used by MS-OFFCRYPTO's standard encryption for its key derivation and
+* password verifier, and by agile encryption when the descriptor names it.
+*/
+function sha1(input) {
+	const ml = input.length * 8;
+	const withPad = new Uint8Array((input.length + 8 >> 6 << 6) + 64);
+	withPad.set(input);
+	withPad[input.length] = 128;
+	const view = new DataView(withPad.buffer);
+	view.setUint32(withPad.length - 4, ml >>> 0, false);
+	view.setUint32(withPad.length - 8, Math.floor(ml / 4294967296), false);
+	let h0 = 1732584193;
+	let h1 = 4023233417;
+	let h2 = 2562383102;
+	let h3 = 271733878;
+	let h4 = 3285377520;
+	const w = new Uint32Array(80);
+	for (let off = 0; off < withPad.length; off += 64) {
+		for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4, false);
+		for (let i = 16; i < 80; i++) {
+			const x = w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16];
+			w[i] = x << 1 | x >>> 31;
+		}
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		for (let i = 0; i < 80; i++) {
+			const [f, k] = i < 20 ? [b & c | ~b & d, 1518500249] : i < 40 ? [b ^ c ^ d, 1859775393] : i < 60 ? [b & c | b & d | c & d, 2400959708] : [b ^ c ^ d, 3395469782];
+			const t = (a << 5 | a >>> 27) + f + e + k + w[i] >>> 0;
+			e = d;
+			d = c;
+			c = (b << 30 | b >>> 2) >>> 0;
+			b = a;
+			a = t;
+		}
+		h0 = h0 + a >>> 0;
+		h1 = h1 + b >>> 0;
+		h2 = h2 + c >>> 0;
+		h3 = h3 + d >>> 0;
+		h4 = h4 + e >>> 0;
+	}
+	const out = new Uint8Array(20);
+	new DataView(out.buffer).setUint32(0, h0, false);
+	new DataView(out.buffer).setUint32(4, h1, false);
+	new DataView(out.buffer).setUint32(8, h2, false);
+	new DataView(out.buffer).setUint32(12, h3, false);
+	new DataView(out.buffer).setUint32(16, h4, false);
+	return out;
+}
 function sha256(input) {
 	const h = [
 		1779033703,
@@ -275,7 +327,6 @@ function sha256(input) {
 	for (let i = 0; i < 8; i++) new DataView(out.buffer).setUint32(i * 4, h[i] >>> 0);
 	return out;
 }
-var MASK64 = (1n << 64n) - 1n;
 var SHA512_K = [
 	4794697086780616226n,
 	8158064640168781261n,
@@ -358,62 +409,130 @@ var SHA512_K = [
 	6902733635092675308n,
 	7801388544844847127n
 ];
+var SHA512_KH = new Int32Array(80);
+var SHA512_KL = new Int32Array(80);
+for (let i = 0; i < 80; i++) {
+	SHA512_KH[i] = Number(SHA512_K[i] >> 32n & 4294967295n) | 0;
+	SHA512_KL[i] = Number(SHA512_K[i] & 4294967295n) | 0;
+}
 function sha512Core(iv, input, outLen) {
-	const rotr = (x, n) => (x >> n | x << 64n - n) & MASK64;
-	const h = [...iv];
+	const hh = new Int32Array(8);
+	const hl = new Int32Array(8);
+	for (let i = 0; i < 8; i++) {
+		hh[i] = Number(iv[i] >> 32n & 4294967295n) | 0;
+		hl[i] = Number(iv[i] & 4294967295n) | 0;
+	}
 	const len = input.length;
 	const blocks = (len + 16 >> 7) + 1;
 	const msg = new Uint8Array(blocks * 128);
 	msg.set(input);
 	msg[len] = 128;
-	let bitLen = BigInt(len) * 8n;
-	for (let i = 0; i < 16; i++) {
-		msg[msg.length - 1 - i] = Number(bitLen & 255n);
-		bitLen >>= 8n;
-	}
-	const w = new Array(80);
+	const view = new DataView(msg.buffer);
+	const bits = len * 8;
+	view.setUint32(msg.length - 4, bits >>> 0, false);
+	view.setUint32(msg.length - 8, Math.floor(bits / 4294967296), false);
+	const wh = new Int32Array(80);
+	const wl = new Int32Array(80);
 	for (let off = 0; off < msg.length; off += 128) {
 		for (let i = 0; i < 16; i++) {
-			let v = 0n;
-			for (let b = 0; b < 8; b++) v = v << 8n | BigInt(msg[off + i * 8 + b]);
-			w[i] = v;
+			wh[i] = view.getInt32(off + i * 8, false);
+			wl[i] = view.getInt32(off + i * 8 + 4, false);
 		}
 		for (let i = 16; i < 80; i++) {
-			const s0 = rotr(w[i - 15], 1n) ^ rotr(w[i - 15], 8n) ^ w[i - 15] >> 7n;
-			const s1 = rotr(w[i - 2], 19n) ^ rotr(w[i - 2], 61n) ^ w[i - 2] >> 6n;
-			w[i] = w[i - 16] + s0 + w[i - 7] + s1 & MASK64;
+			const x15h = wh[i - 15];
+			const x15l = wl[i - 15];
+			const s0h = (x15h >>> 1 | x15l << 31) ^ (x15h >>> 8 | x15l << 24) ^ x15h >>> 7;
+			const s0l = (x15l >>> 1 | x15h << 31) ^ (x15l >>> 8 | x15h << 24) ^ (x15l >>> 7 | x15h << 25);
+			const x2h = wh[i - 2];
+			const x2l = wl[i - 2];
+			const s1h = (x2h >>> 19 | x2l << 13) ^ (x2l >>> 29 | x2h << 3) ^ x2h >>> 6;
+			const s1l = (x2l >>> 19 | x2h << 13) ^ (x2h >>> 29 | x2l << 3) ^ (x2l >>> 6 | x2h << 26);
+			let lo = (wl[i - 16] >>> 0) + (s0l >>> 0);
+			let hi = (wh[i - 16] >>> 0) + (s0h >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (wl[i - 7] >>> 0);
+			hi = hi + (wh[i - 7] >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (s1l >>> 0);
+			hi = hi + (s1h >>> 0) + (lo > 4294967295 ? 1 : 0);
+			wh[i] = hi | 0;
+			wl[i] = lo | 0;
 		}
-		let [a, b, c, d, e, f, g, hh] = h;
+		let ah = hh[0];
+		let al = hl[0];
+		let bh = hh[1];
+		let bl = hl[1];
+		let ch = hh[2];
+		let cl = hl[2];
+		let dh = hh[3];
+		let dl = hl[3];
+		let eh = hh[4];
+		let el = hl[4];
+		let fh = hh[5];
+		let fl = hl[5];
+		let gh = hh[6];
+		let gl = hl[6];
+		let xh = hh[7];
+		let xl = hl[7];
 		for (let i = 0; i < 80; i++) {
-			const S1 = rotr(e, 14n) ^ rotr(e, 18n) ^ rotr(e, 41n);
-			const ch = e & f ^ ~e & MASK64 & g;
-			const t1 = hh + S1 + ch + SHA512_K[i] + w[i] & MASK64;
-			const t2 = (rotr(a, 28n) ^ rotr(a, 34n) ^ rotr(a, 39n)) + (a & b ^ a & c ^ b & c) & MASK64;
-			hh = g;
-			g = f;
-			f = e;
-			e = d + t1 & MASK64;
-			d = c;
-			c = b;
-			b = a;
-			a = t1 + t2 & MASK64;
+			const S1h = (eh >>> 14 | el << 18) ^ (eh >>> 18 | el << 14) ^ (el >>> 9 | eh << 23);
+			const S1l = (el >>> 14 | eh << 18) ^ (el >>> 18 | eh << 14) ^ (eh >>> 9 | el << 23);
+			const chh = eh & fh ^ ~eh & gh;
+			const chl = el & fl ^ ~el & gl;
+			const S0h = (ah >>> 28 | al << 4) ^ (al >>> 2 | ah << 30) ^ (al >>> 7 | ah << 25);
+			const S0l = (al >>> 28 | ah << 4) ^ (ah >>> 2 | al << 30) ^ (ah >>> 7 | al << 25);
+			const majh = ah & bh ^ ah & ch ^ bh & ch;
+			const majl = al & bl ^ al & cl ^ bl & cl;
+			let lo = (xl >>> 0) + (S1l >>> 0);
+			let hi = (xh >>> 0) + (S1h >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (chl >>> 0);
+			hi = hi + (chh >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (SHA512_KL[i] >>> 0);
+			hi = hi + (SHA512_KH[i] >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (wl[i] >>> 0);
+			hi = hi + (wh[i] >>> 0) + (lo > 4294967295 ? 1 : 0);
+			const t1h = hi | 0;
+			const t1l = lo | 0;
+			const lo2 = (S0l >>> 0) + (majl >>> 0);
+			const t2h = (S0h >>> 0) + (majh >>> 0) + (lo2 > 4294967295 ? 1 : 0) | 0;
+			const t2l = lo2 | 0;
+			xh = gh;
+			xl = gl;
+			gh = fh;
+			gl = fl;
+			fh = eh;
+			fl = el;
+			lo = (dl >>> 0) + (t1l >>> 0);
+			eh = (dh >>> 0) + (t1h >>> 0) + (lo > 4294967295 ? 1 : 0) | 0;
+			el = lo | 0;
+			dh = ch;
+			dl = cl;
+			ch = bh;
+			cl = bl;
+			bh = ah;
+			bl = al;
+			lo = (t1l >>> 0) + (t2l >>> 0);
+			ah = (t1h >>> 0) + (t2h >>> 0) + (lo > 4294967295 ? 1 : 0) | 0;
+			al = lo | 0;
 		}
-		h[0] = h[0] + a & MASK64;
-		h[1] = h[1] + b & MASK64;
-		h[2] = h[2] + c & MASK64;
-		h[3] = h[3] + d & MASK64;
-		h[4] = h[4] + e & MASK64;
-		h[5] = h[5] + f & MASK64;
-		h[6] = h[6] + g & MASK64;
-		h[7] = h[7] + hh & MASK64;
+		const add = (i, addH, addL) => {
+			const lo = (hl[i] >>> 0) + (addL >>> 0);
+			hh[i] = (hh[i] >>> 0) + (addH >>> 0) + (lo > 4294967295 ? 1 : 0) | 0;
+			hl[i] = lo | 0;
+		};
+		add(0, ah, al);
+		add(1, bh, bl);
+		add(2, ch, cl);
+		add(3, dh, dl);
+		add(4, eh, el);
+		add(5, fh, fl);
+		add(6, gh, gl);
+		add(7, xh, xl);
+	}
+	const out = new Uint8Array(64);
+	const ov = new DataView(out.buffer);
+	for (let i = 0; i < 8; i++) {
+		ov.setInt32(i * 8, hh[i], false);
+		ov.setInt32(i * 8 + 4, hl[i], false);
 	}
-	const out = new Uint8Array(h.length * 8);
-	h.forEach((v, i) => {
-		for (let b = 7; b >= 0; b--) {
-			out[i * 8 + b] = Number(v & 255n);
-			v >>= 8n;
-		}
-	});
 	return out.slice(0, outLen);
 }
 function sha512(input) {
@@ -559,6 +678,18 @@ function aesCbcDecrypt(key, iv, data, stripPad) {
 	const pad = out[out.length - 1];
 	return pad >= 1 && pad <= 16 && pad <= out.length ? out.subarray(0, out.length - pad) : out;
 }
+/**
+* AES-ECB decrypt — every block on its own key, no chaining. MS-OFFCRYPTO's
+* standard encryption uses it for both the verifier and the package.
+*/
+function aesEcbDecrypt(key, data) {
+	const w = expandKey(key);
+	const nr = key.length / 4 + 6;
+	const blocks = Math.floor(data.length / 16);
+	const out = new Uint8Array(blocks * 16);
+	for (let i = 0; i < blocks; i++) decryptBlock(data.subarray(i * 16, i * 16 + 16), w, nr, out, i * 16);
+	return out;
+}
 function aesCbcEncrypt(key, iv, data) {
 	const w = expandKey(key);
 	const nr = key.length / 4 + 6;
@@ -611,4 +742,4 @@ function mixColumns(s) {
 	}
 }
 //#endregion
-export { aesCbcDecrypt, aesCbcEncrypt, md5, rc4, sha256, sha384, sha512 };
+export { aesCbcDecrypt, aesCbcEncrypt, aesEcbDecrypt, md5, rc4, sha1, sha256, sha384, sha512 };

package/dist/esm/pdf-reader/decrypt.js

@@ -1,5 +1,5 @@
 import { PdfHexString, PdfName, PdfStream } from "../pdf/objects.js";
-import { aesCbcDecrypt, aesCbcEncrypt, md5, rc4, sha256, sha384, sha512 } from "./crypto.js";
+import { aesCbcDecrypt, aesCbcEncrypt, md5, rc4, sha256, sha384, sha512 } from "../core/crypto/primitives.js";
 //#region src/pdf-reader/decrypt.ts
 var PAD = Uint8Array.from([
 	40,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reamkit",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Ream — convert DOCX, XLSX, PPTX and PDF to PDF, SVG, HTML, DOCX and XLSX, built from scratch on the ECMA-376 and ISO 32000 specifications. Parse once, convert anywhere.",
   "license": "MIT",
   "author": "Alex Krassavin <info@reamkit.dev>",