Index password-protected PDFs with operator-supplied passwords

The situation

Banks, payroll providers, labs and tax agents commonly email statements and results as password-protected PDFs. The password is something the recipient already knows, and one recipient usually needs only a few. In my archive, 131 of ~5,950 documents are password-protected; 130 open with one of three passwords I have.

What works today, and why it is not enough

Format detection rejects encrypted PDFs, so they never reach the provider and end terminal as invalid_local_source, the same reason as a corrupt file. These are often the documents most worth searching, and there is no way to get them indexed short of decrypting copies by hand outside msgvault.

Ask

Let an operator supply PDF passwords, for example a file reference in [attachments.documents]. msgvault tries them locally, decrypts in memory, and uploads the decrypted bytes as a derived representation of the original; docbank's derived_upload input kind looks like the fit. The original attachment stays unchanged, and neither the decrypted copy nor the password is stored. Encrypted files no password opens get their own terminal reason, so they can be counted and retried after the list changes.