reamkit 1.2.0 → 1.4.0

package/dist/esm/pdf/encryption.d.ts

@@ -0,0 +1,34 @@
+import { PdfValue } from './objects.js';
+export interface PdfPermissions {
+    /** Bit 3 — print the document (default true). */
+    readonly printing?: boolean;
+    /** Bit 4 — modify contents (default true). */
+    readonly modifying?: boolean;
+    /** Bit 5 — copy text and graphics (default true). */
+    readonly copying?: boolean;
+    /** Bit 6 — add/modify annotations (default true). */
+    readonly annotating?: boolean;
+    /** Bit 9 — fill in form fields (default true). */
+    readonly fillingForms?: boolean;
+    /** Bit 10 — extraction for accessibility (default true; forced by PDF/UA). */
+    readonly contentAccessibility?: boolean;
+    /** Bit 11 — assemble (insert/rotate/delete pages) (default true). */
+    readonly documentAssembly?: boolean;
+}
+export interface PdfEncryptOptions {
+    /** Required to OPEN the document. Empty string = opens without a prompt. */
+    readonly userPassword?: string;
+    /** Overrides the permission restrictions. Defaults to the user password. */
+    readonly ownerPassword?: string;
+    readonly permissions?: PdfPermissions;
+}
+export interface PreparedEncryption {
+    readonly fileKey: Uint8Array;
+    readonly encryptDict: PdfValue;
+}
+export declare function permissionBits(p: PdfPermissions | undefined): number;
+export declare function aesCbcNoPadDecrypt(key: Uint8Array, iv: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+export declare function hardHash(password: Uint8Array, salt: Uint8Array, userData: Uint8Array): Promise<Uint8Array>;
+export declare function preparePdfEncryption(options: PdfEncryptOptions): Promise<PreparedEncryption>;
+export declare function decryptBytes(fileKey: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+export declare function encryptObjectGraph(value: PdfValue, fileKey: Uint8Array): Promise<PdfValue>;

package/dist/esm/pdf/encryption.js

@@ -0,0 +1,143 @@
+import { PdfHexString, PdfStream, dict, name } from "./objects.js";
+//#region src/pdf/encryption.ts
+var encoder = new TextEncoder();
+var subtle = globalThis.crypto.subtle;
+function permissionBits(p) {
+	let bits = -4;
+	const off = (bit) => bits &= ~(1 << bit - 1);
+	if (p?.printing === false) {
+		off(3);
+		off(12);
+	}
+	if (p?.modifying === false) off(4);
+	if (p?.copying === false) off(5);
+	if (p?.annotating === false) off(6);
+	if (p?.fillingForms === false) off(9);
+	if (p?.contentAccessibility === false) off(10);
+	if (p?.documentAssembly === false) off(11);
+	return bits | 0;
+}
+function passwordBytes(password) {
+	return encoder.encode(password).slice(0, 127);
+}
+function concat(...parts) {
+	const out = new Uint8Array(parts.reduce((s, p) => s + p.length, 0));
+	let off = 0;
+	for (const p of parts) {
+		out.set(p, off);
+		off += p.length;
+	}
+	return out;
+}
+async function sha(algo, data) {
+	return new Uint8Array(await subtle.digest(algo, data));
+}
+async function aesCbcNoPad(key, iv, data) {
+	const k = await subtle.importKey("raw", key, "AES-CBC", false, ["encrypt"]);
+	return new Uint8Array(await subtle.encrypt({
+		name: "AES-CBC",
+		iv
+	}, k, data)).slice(0, data.length);
+}
+async function hardHash(password, salt, userData) {
+	let k = await sha("SHA-256", concat(password, salt, userData));
+	for (let round = 0;; round++) {
+		const block = concat(password, k, userData);
+		const k1 = new Uint8Array(block.length * 64);
+		for (let i = 0; i < 64; i++) k1.set(block, i * block.length);
+		const e = await aesCbcNoPad(k.slice(0, 16), k.slice(16, 32), k1);
+		let mod = 0;
+		for (let i = 0; i < 16; i++) mod = (mod + e[i]) % 3;
+		k = (await sha(mod === 0 ? "SHA-256" : mod === 1 ? "SHA-384" : "SHA-512", e)).slice(0, 64);
+		if (round >= 63 && e[e.length - 1] <= round - 31) break;
+	}
+	return k.slice(0, 32);
+}
+async function preparePdfEncryption(options) {
+	const user = passwordBytes(options.userPassword ?? "");
+	const owner = passwordBytes(options.ownerPassword ?? options.userPassword ?? "");
+	const fileKey = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(fileKey);
+	const salts = new Uint8Array(36);
+	globalThis.crypto.getRandomValues(salts);
+	const uvs = salts.slice(0, 8);
+	const uks = salts.slice(8, 16);
+	const ovs = salts.slice(16, 24);
+	const oks = salts.slice(24, 32);
+	const U = concat(await hardHash(user, uvs, new Uint8Array(0)), uvs, uks);
+	const UE = await aesCbcNoPad(await hardHash(user, uks, new Uint8Array(0)), new Uint8Array(16), fileKey);
+	const O = concat(await hardHash(owner, ovs, U), ovs, oks);
+	const OE = await aesCbcNoPad(await hardHash(owner, oks, U), new Uint8Array(16), fileKey);
+	const p = permissionBits(options.permissions);
+	const permsPlain = new Uint8Array(16);
+	new DataView(permsPlain.buffer).setInt32(0, p, true);
+	permsPlain.set([
+		255,
+		255,
+		255,
+		255
+	], 4);
+	permsPlain.set([
+		84,
+		97,
+		100,
+		98
+	], 8);
+	permsPlain.set(salts.slice(32, 36), 12);
+	const perms = await aesCbcNoPad(fileKey, new Uint8Array(16), permsPlain);
+	return {
+		fileKey,
+		encryptDict: dict({
+			Filter: name("Standard"),
+			V: 5,
+			R: 6,
+			Length: 256,
+			CF: dict({ StdCF: dict({
+				CFM: name("AESV3"),
+				AuthEvent: name("DocOpen"),
+				Length: 32
+			}) }),
+			StmF: name("StdCF"),
+			StrF: name("StdCF"),
+			U: new PdfHexString(U),
+			UE: new PdfHexString(UE),
+			O: new PdfHexString(O),
+			OE: new PdfHexString(OE),
+			P: p,
+			Perms: new PdfHexString(perms),
+			EncryptMetadata: true
+		})
+	};
+}
+async function encryptBytes(fileKey, data) {
+	const iv = new Uint8Array(16);
+	globalThis.crypto.getRandomValues(iv);
+	const k = await subtle.importKey("raw", fileKey, "AES-CBC", false, ["encrypt"]);
+	return concat(iv, new Uint8Array(await subtle.encrypt({
+		name: "AES-CBC",
+		iv
+	}, k, data)));
+}
+async function encryptObjectGraph(value, fileKey) {
+	if (typeof value === "string") return new PdfHexString(await encryptBytes(fileKey, encoder.encode(value)));
+	if (value instanceof PdfHexString) return new PdfHexString(await encryptBytes(fileKey, value.bytes));
+	if (value instanceof PdfStream) {
+		const data = await encryptBytes(fileKey, value.data);
+		const d = new Map(value.dict);
+		d.set("Length", data.length);
+		return new PdfStream(d, data);
+	}
+	if (Array.isArray(value)) {
+		const out = [];
+		for (const v of value) out.push(await encryptObjectGraph(v, fileKey));
+		return out;
+	}
+	if (value instanceof Map) {
+		const out = /* @__PURE__ */ new Map();
+		for (const [k, v] of value) out.set(k, await encryptObjectGraph(v, fileKey));
+		return out;
+	}
+	return value;
+}
+//#endregion
+export { encryptObjectGraph, preparePdfEncryption };

package/dist/esm/pdf/index.d.ts

@@ -1,6 +1,7 @@
 export { renderPlainTextPdf } from './text-page-renderer.js';
 export type { TextRenderOptions, FontInput } from './text-page-renderer.js';
-export { renderStyledPdf } from './styled-page-renderer.js';
+export { renderStyledPdf, renderStyledPdfEncrypted } from './styled-page-renderer.js';
+export type { PdfEncryptOptions, PdfPermissions } from './encryption.js';
 export type { DocumentInfo, StyledRenderOptions, PdfALevel } from './styled-page-renderer.js';
 export { signPdf } from './signature.js';
 export type { SignaturePlaceholder, SignerCredentials, SignatureOptions } from './signature.js';

package/dist/esm/pdf/styled-page-emitter.d.ts

@@ -1,7 +1,9 @@
 import { LaidOutPdfDocument, StyledRenderOptions } from '../layout/styled-layout.js';
 import { PdfDocument } from './writer.js';
+import { PdfEncryptOptions } from './encryption.js';
 type EmitOptions = Pick<StyledRenderOptions, 'attachments' | 'info' | 'language' | 'pdfUA' | 'signaturePlaceholder'>;
 export declare function emitStyledPdf(laid: LaidOutPdfDocument, options: EmitOptions, doc: PdfDocument): Uint8Array;
+export declare function emitStyledPdfEncrypted(laid: LaidOutPdfDocument, options: EmitOptions, doc: PdfDocument, encrypt: PdfEncryptOptions): Promise<Uint8Array>;
 export interface PageTagging {
     next: number;
     assigned: boolean;

package/dist/esm/pdf/styled-page-emitter.js

@@ -1,5 +1,6 @@
 import { dict, name, ref, stream, unicodeString } from "./objects.js";
 import { embedTtfFont } from "./cid-font.js";
+import { preparePdfEncryption } from "./encryption.js";
 import { reorderVisual } from "../core/bidi/algorithm.js";
 import { reverseByCodePoint } from "../core/bidi/index.js";
 import "../layout/styled-layout.js";
@@ -14,6 +15,21 @@ import { buildXmpPacket } from "./xmp.js";
 //#region src/pdf/styled-page-emitter.ts
 var encoder = new TextEncoder();
 function emitStyledPdf(laid, options, doc) {
+	const a = assembleStyledPdf(laid, options, doc);
+	return doc.build(a.catalogRef, a.infoRef, a.buildOptions);
+}
+async function emitStyledPdfEncrypted(laid, options, doc, encrypt) {
+	const a = assembleStyledPdf(laid, options, doc);
+	const prepared = await preparePdfEncryption(encrypt);
+	await doc.encryptAll(prepared.fileKey);
+	const encryptRef = doc.add(prepared.encryptDict);
+	return doc.build(a.catalogRef, a.infoRef, {
+		...a.buildOptions,
+		id: true,
+		encrypt: encryptRef
+	});
+}
+function assembleStyledPdf(laid, options, doc) {
 	const { pages: renderedPages } = laid;
 	const { structBuilder, sectionCtxs, pdfaProfile, tagged } = laid.pdf;
 	const docInfo = options.pdfUA && !options.info?.title ? {
@@ -210,12 +226,14 @@ function emitStyledPdf(laid, options, doc) {
 		else firstPageDict.set("Annots", [ref(fieldRef.id)]);
 		catalogEntries["AcroForm"] = acroForm;
 	}
-	const catalogRef = doc.add(dict(catalogEntries));
-	const infoRef = buildInfoDict(doc, docInfo);
-	return doc.build(catalogRef, infoRef, { ...pdfaProfile ? {
-		version: pdfaProfile.version,
-		id: true
-	} : {} });
+	return {
+		catalogRef: doc.add(dict(catalogEntries)),
+		infoRef: buildInfoDict(doc, docInfo),
+		buildOptions: { ...pdfaProfile ? {
+			version: pdfaProfile.version,
+			id: true
+		} : {} }
+	};
 }
 var DEFAULT_PRODUCER = "Ream";
 function xmpFromInfo(info, p, pdfUA = false) {
@@ -686,4 +704,4 @@ function formatNumber(n) {
 	return n.toFixed(3).replace(/0+$/, "").replace(/\.$/, "");
 }
 //#endregion
-export { emitStyledPdf };
+export { emitStyledPdf, emitStyledPdfEncrypted };

package/dist/esm/pdf/styled-page-renderer.d.ts

@@ -1,5 +1,6 @@
 import { BodyElement } from '../core/document-model/index.js';
 import { StyledRenderOptions } from '../layout/styled-layout.js';
 export declare function renderStyledPdf(body: ReadonlyArray<BodyElement>, options: StyledRenderOptions): Uint8Array;
+export declare function renderStyledPdfEncrypted(body: ReadonlyArray<BodyElement>, options: StyledRenderOptions): Promise<Uint8Array>;
 export * from '../layout/page-doc.js';
 export * from '../layout/styled-layout.js';

package/dist/esm/pdf/styled-page-renderer.js

@@ -1,10 +1,25 @@
 import { PdfDocument } from "./writer.js";
 import { layoutStyledDocument } from "../layout/styled-layout.js";
 import "../layout/page-doc.js";
-import { emitStyledPdf } from "./styled-page-emitter.js";
+import { emitStyledPdf, emitStyledPdfEncrypted } from "./styled-page-emitter.js";
 //#region src/pdf/styled-page-renderer.ts
 function renderStyledPdf(body, options) {
+	if (options.encrypt) throw new Error("PDF encryption requires the async conversion path (WebCrypto)");
 	return emitStyledPdf(layoutStyledDocument(body, options), options, new PdfDocument());
 }
+async function renderStyledPdfEncrypted(body, options) {
+	const encrypt = options.encrypt;
+	if (!encrypt) return renderStyledPdf(body, options);
+	if (options.pdfA) throw new Error("PDF/A forbids encryption (ISO 19005)");
+	if (options.signaturePlaceholder) throw new Error("encryption combined with a digital signature is not supported (v1)");
+	const effective = options.pdfUA === true ? {
+		...encrypt,
+		permissions: {
+			...encrypt.permissions,
+			contentAccessibility: true
+		}
+	} : encrypt;
+	return emitStyledPdfEncrypted(layoutStyledDocument(body, options), options, new PdfDocument(), effective);
+}
 //#endregion
-export { renderStyledPdf };
+export { renderStyledPdf, renderStyledPdfEncrypted };

package/dist/esm/pdf/writer.d.ts

@@ -2,9 +2,11 @@ import { PdfValue, PdfRef } from './objects.js';
 export interface BuildOptions {
     readonly version?: string;
     readonly id?: boolean;
+    readonly encrypt?: PdfRef;
 }
 export declare class PdfDocument {
     private readonly objects;
     add(value: PdfValue): PdfRef;
+    encryptAll(fileKey: Uint8Array): Promise<void>;
     build(root: PdfRef, info?: PdfRef, options?: BuildOptions): Uint8Array;
 }

package/dist/esm/pdf/writer.js

@@ -1,4 +1,5 @@
 import { PdfRef } from "./objects.js";
+import { encryptObjectGraph } from "./encryption.js";
 import { serializeIndirectObject } from "./serialize.js";
 //#region src/pdf/writer.ts
 var encoder = new TextEncoder();
@@ -20,6 +21,9 @@ var PdfDocument = class {
 		});
 		return new PdfRef(id);
 	}
+	async encryptAll(fileKey) {
+		for (const obj of this.objects) obj.value = await encryptObjectGraph(obj.value, fileKey);
+	}
 	build(root, info, options = {}) {
 		const parts = [];
 		const offsets = new Array(this.objects.length + 1).fill(0);
@@ -43,12 +47,13 @@ var PdfDocument = class {
 		}
 		push(encoder.encode(xref));
 		const infoEntry = info ? ` /Info ${info.id} ${info.generation} R` : "";
+		const encryptEntry = options.encrypt ? ` /Encrypt ${options.encrypt.id} ${options.encrypt.generation} R` : "";
 		let idEntry = "";
 		if (options.id) {
 			const hashHex = hash128Hex(parts);
 			idEntry = ` /ID [<${hashHex}> <${hashHex}>]`;
 		}
-		const trailer = `trailer\n<</Size ${totalObjects} /Root ${root.id} ${root.generation} R${infoEntry}${idEntry}>>\nstartxref\n${xrefOffset}\n%%EOF\n`;
+		const trailer = `trailer\n<</Size ${totalObjects} /Root ${root.id} ${root.generation} R${infoEntry}${encryptEntry}${idEntry}>>\nstartxref\n${xrefOffset}\n%%EOF\n`;
 		push(encoder.encode(trailer));
 		const out = new Uint8Array(pos);
 		let off = 0;

package/dist/esm/word/document-parser.js

@@ -1,8 +1,8 @@
 import { twipsToPt } from "../core/ir/units.js";
-import { poAttr, poChildren, poFindByPath, poIntAttr, poIs, poText } from "../core/po-helpers.js";
+import { poAttr, poChildren, poFindByPath, poFindDescendant, poIntAttr, poIs, poText } from "../core/po-helpers.js";
 import { defaultColorResolver } from "../core/drawingml/colors.js";
 import { parseOMath } from "./omml-parser.js";
-import { expandMcChildren, parseDrawing } from "./drawing-parser.js";
+import { expandMcChildren, parseDrawing, parseVmlPicture } from "./drawing-parser.js";
 import { parseRunProperties } from "./run-properties.js";
 import { parseParagraphProperties } from "./paragraph-properties.js";
 import { poElementToFlat } from "./po-to-flat.js";
@@ -172,22 +172,50 @@ function parseBodyElements(children, ctx = DEFAULT_PARSE_CONTEXT) {
 		kind: "table",
 		table: parseTable(child, ctx)
 	});
+	else if (poIs(child, "w:sdt")) {
+		const content = poChildren(child).find((c) => poIs(c, "w:sdtContent"));
+		if (content) out.push(...parseBodyElements(poChildren(content), ctx));
+	}
 	return out;
 }
-function tryExtractDrawingFromParagraph(p, ctx) {
-	let drawing;
-	let hasText = false;
-	for (const child of poChildren(p)) {
-		if (!poIs(child, "w:r")) continue;
-		for (const runChild of expandMcChildren(poChildren(child))) if (poIs(runChild, "w:drawing")) {
-			if (!drawing) drawing = runChild;
-		} else if (poIs(runChild, "w:t") && poText(runChild).length > 0) hasText = true;
-		else if (poIs(runChild, "w:tab") || poIs(runChild, "w:br") || poIs(runChild, "w:noBreakHyphen")) hasText = true;
+var COLLAPSE_TRANSPARENT_TAGS = new Set([
+	"w:ins",
+	"w:moveTo",
+	"w:sdt",
+	"w:sdtContent",
+	"w:smartTag"
+]);
+function scanForLoneDrawing(container, acc) {
+	for (const child of expandMcChildren(poChildren(container))) {
+		if (poIs(child, "w:pPr")) continue;
+		if (poIs(child, "w:r")) {
+			for (const rc of expandMcChildren(poChildren(child))) if (poIs(rc, "w:drawing")) {
+				if (!acc.drawing) acc.drawing = rc;
+			} else if (poIs(rc, "w:pict") || poIs(rc, "w:object")) {
+				if (!acc.vml && poFindDescendant(rc, "v:imagedata") !== void 0) acc.vml = rc;
+			} else if (poIs(rc, "w:t") && poText(rc).length > 0) acc.hasOther = true;
+			else if (poIs(rc, "w:tab") || poIs(rc, "w:br") || poIs(rc, "w:noBreakHyphen")) acc.hasOther = true;
+			continue;
+		}
+		if (poIs(child, "m:oMath") || poIs(child, "m:oMathPara")) {
+			acc.hasOther = true;
+			continue;
+		}
+		const tag = elementTag(child);
+		if (tag && COLLAPSE_TRANSPARENT_TAGS.has(tag)) scanForLoneDrawing(child, acc);
+		else if (tag && RUN_CONTAINER_TAGS.has(tag)) acc.hasOther = true;
 	}
-	if (!drawing || hasText) return null;
+}
+function tryExtractDrawingFromParagraph(p, ctx) {
+	const scan = { hasOther: false };
+	scanForLoneDrawing(p, scan);
+	const { drawing, vml } = scan;
+	if (scan.hasOther || !drawing && !vml) return null;
+	const fromVml = drawing === void 0;
 	const parseBody = (children) => parseBodyElements(children, ctx);
-	const content = parseDrawing(drawing, ctx.resolveColor, parseBody);
+	const content = fromVml ? parseVmlPicture(vml) : parseDrawing(drawing, ctx.resolveColor, parseBody);
 	if (!content) return null;
+	if (fromVml && content.kind === "image" && ctx.resolveImage?.(content.imageId) === void 0) return null;
 	const pPrNode = poChildren(p).find((c) => poIs(c, "w:pPr"));
 	const paragraphProperties = pPrNode ? parseParagraphProperties(poElementToFlat(pPrNode)) : {};
 	if (content.kind === "image") {
@@ -431,6 +459,16 @@ function parseRun(r, ctx) {
 					height: content.height
 				};
 			}
+		} else if (poIs(child, "w:pict") || poIs(child, "w:object")) {
+			const content = parseVmlPicture(child);
+			if (content && content.kind === "image") {
+				const resource = ctx.resolveImage?.(content.imageId);
+				if (resource) inlineImage = {
+					resource,
+					width: content.width,
+					height: content.height
+				};
+			}
 		}
 	}
 	return {

package/dist/esm/word/docx-reader.js

@@ -6,8 +6,9 @@ import { resolveTableStyles } from "../core/style-cascade/table.js";
 import "../core/style-cascade/index.js";
 import { bytesInclude } from "../core/bytes.js";
 import { DEFAULT_THEME_PALETTE, makeColorResolver } from "../core/drawingml/colors.js";
-import { parseChart } from "../core/drawingml/chart-parser.js";
+import { parseChart, withChartColorStyle } from "../core/drawingml/chart-parser.js";
 import { parseTheme } from "../core/drawingml/theme-parser.js";
+import { isOoxmlRel } from "../core/opc/relationship-types.js";
 import { OpcPackage } from "../core/opc/package.js";
 import { parseCoreProperties } from "../core/opc/core-properties.js";
 import "../core/opc/index.js";
@@ -25,12 +26,7 @@ var NUMBERING_PART = "word/numbering.xml";
 var SETTINGS_PART = "word/settings.xml";
 var CORE_PROPS_PART = "docProps/core.xml";
 var MAIN_DOCUMENT_PART = "word/document.xml";
-var REL_IMAGE = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image";
 var REL_HYPERLINK = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink";
-var REL_CHART = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/chart";
-var REL_THEME = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme";
-var REL_HEADER = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/header";
-var REL_FOOTER = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/footer";
 var THEME_PART = "word/theme/theme1.xml";
 function readDocx(docx) {
 	const pkg = OpcPackage.open(docx);
@@ -132,7 +128,7 @@ function infoFromCore(core) {
 function makeImageResolver(pkg, store, partName = MAIN_DOCUMENT_PART) {
 	const byRelId = /* @__PURE__ */ new Map();
 	for (const rel of pkg.getPartRelationships(partName)) {
-		if (rel.type !== REL_IMAGE) continue;
+		if (!isOoxmlRel(rel.type, "image")) continue;
 		const resolved = pkg.resolveRelatedPart(partName, rel);
 		if (resolved) byRelId.set(rel.id, resolved.data);
 	}
@@ -157,11 +153,11 @@ function makeHyperlinkResolver(pkg, partName = MAIN_DOCUMENT_PART) {
 function loadCharts(pkg, resolveColor) {
 	const out = /* @__PURE__ */ new Map();
 	for (const rel of pkg.getPartRelationships(MAIN_DOCUMENT_PART)) {
-		if (rel.type !== REL_CHART) continue;
+		if (!isOoxmlRel(rel.type, "chart")) continue;
 		const resolved = pkg.resolveRelatedPart(MAIN_DOCUMENT_PART, rel);
 		if (!resolved) continue;
 		const chart = parseChart(resolved.data, resolveColor);
-		if (chart) out.set(rel.id, chart);
+		if (chart) out.set(rel.id, withChartColorStyle(chart, pkg, resolved.path, resolveColor));
 	}
 	return out;
 }
@@ -174,7 +170,7 @@ function buildColorResolver(pkg) {
 }
 function loadTheme(pkg) {
 	for (const rel of pkg.getPartRelationships(MAIN_DOCUMENT_PART)) {
-		if (rel.type !== REL_THEME) continue;
+		if (!isOoxmlRel(rel.type, "theme")) continue;
 		const resolved = pkg.resolveRelatedPart(MAIN_DOCUMENT_PART, rel);
 		if (resolved) return resolved.data;
 	}
@@ -192,7 +188,7 @@ function loadHeadersFootersForSections(pkg, sections, ctx, store) {
 	const out = /* @__PURE__ */ new Map();
 	for (const rel of rels) {
 		if (!wanted.has(rel.id)) continue;
-		if (rel.type !== REL_HEADER && rel.type !== REL_FOOTER) continue;
+		if (!isOoxmlRel(rel.type, "header") && !isOoxmlRel(rel.type, "footer")) continue;
 		const resolved = pkg.resolveRelatedPart(MAIN_DOCUMENT_PART, rel);
 		if (!resolved) continue;
 		const hfCtx = {

package/dist/esm/word/docx-to-pdf.js

@@ -1,7 +1,7 @@
 import { fetchFontSet, resolveFamilyKey } from "../core/fonts/remote-fonts.js";
 import { FontRegistry } from "../core/font/font-registry.js";
 import { signPdf } from "../pdf/signature.js";
-import { renderStyledPdf } from "../pdf/styled-page-renderer.js";
+import { renderStyledPdf, renderStyledPdfEncrypted } from "../pdf/styled-page-renderer.js";
 import "../pdf/index.js";
 import { OpcPackage } from "../core/opc/package.js";
 import "../core/opc/index.js";
@@ -16,6 +16,10 @@ var MAIN_DOCUMENT_PART = "word/document.xml";
 * Internal since 1.0 — see the async variant above.
 */
 function convertDocxToPdfSync(docx, options) {
+	const args = prepareDocxStyledRender(docx, options);
+	return renderStyledPdf(args.body, args.styled);
+}
+function prepareDocxStyledRender(docx, options) {
 	const fonts = options.fonts ?? (options.fontBytes ? { regular: options.fontBytes } : void 0);
 	if (!fonts) throw new Error("convertDocxToPdfSync requires options.fonts or options.fontBytes");
 	const registry = FontRegistry.fromBytes(fonts);
@@ -33,13 +37,16 @@ function convertDocxToPdfSync(docx, options) {
 		relationship: "Source",
 		description: "Source Word document"
 	});
-	return renderStyledPdf(flow.body, {
-		registry,
-		...flowRenderOptions(flow),
-		...info ? { info } : {},
-		...attachments.length > 0 ? { attachments } : {},
-		...renderOptions
-	});
+	return {
+		body: flow.body,
+		styled: {
+			registry,
+			...flowRenderOptions(flow),
+			...info ? { info } : {},
+			...attachments.length > 0 ? { attachments } : {},
+			...renderOptions
+		}
+	};
 }
 function detectDocxFamilyKeys(docx) {
 	const keys = new Set(["roboto"]);
@@ -76,12 +83,15 @@ async function convertDocxToPdf(docx, options = {}) {
 	return signature ? signPdf(pdf, signature) : pdf;
 }
 async function buildUnsignedDocxPdf(docx, options) {
-	if (options.fonts ?? options.fontBytes) return convertDocxToPdfSync(docx, options);
-	const auto = await resolveDocxAutoFonts(docx, options);
-	return convertDocxToPdfSync(docx, {
+	const withFonts = options.fonts ?? options.fontBytes ? options : {
 		...options,
-		...auto
-	});
+		...await resolveDocxAutoFonts(docx, options)
+	};
+	if (withFonts.encrypt) {
+		const args = prepareDocxStyledRender(docx, withFonts);
+		return renderStyledPdfEncrypted(args.body, args.styled);
+	}
+	return convertDocxToPdfSync(docx, withFonts);
 }
 async function resolveDocxAutoFonts(docx, options = {}) {
 	const fetchOpt = options.fontFetch ? { fetch: options.fontFetch } : {};

package/dist/esm/word/docx-writer.d.ts

@@ -0,0 +1,4 @@
+import { DocumentWriter, WriteResult } from '../core/ir/adapters.js';
+import { FlowDoc } from '../core/ir/flow.js';
+export declare function writeDocx(flow: FlowDoc): WriteResult;
+export declare const docxWriter: DocumentWriter<FlowDoc>;