@embedpdf/web 3.0.0-next.0

package/LICENSE

@@ -0,0 +1,192 @@
+Copyright 2026 CloudPDF LTD
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use files in this distribution except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+-----------------------------------------------------------------------
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/dist/index.cjs

@@ -0,0 +1,114 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/file-picker.ts
+/**
+* A one-shot file dialog. Opens a throwaway `<input type=file>`, resolves the
+* chosen `File`, or `null` when the dialog is dismissed. MUST be called
+* synchronously from a user gesture (a click) or the browser refuses to open it.
+*
+* A `File` is a `Blob`, which is a `BinarySource` everywhere in the stack, so the
+* caller can hand the result straight to the engine — this module stays a pure
+* DOM utility with no EmbedPDF types.
+*/
+const IMAGE_ACCEPT = "image/png,image/jpeg,application/pdf";
+/** Open the file dialog; resolve the picked file, or null if cancelled. */
+function pickImageFile(options = {}) {
+	const { accept = IMAGE_ACCEPT, multiple = false } = options;
+	return new Promise((resolve) => {
+		const input = document.createElement("input");
+		input.type = "file";
+		input.accept = accept;
+		input.multiple = multiple;
+		input.style.display = "none";
+		let settled = false;
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			window.removeEventListener("focus", onFocus);
+			input.remove();
+			resolve(value);
+		};
+		const onFocus = () => {
+			setTimeout(() => finish(null), 300);
+		};
+		input.addEventListener("change", () => finish(input.files?.[0] ?? null), { once: true });
+		input.addEventListener("cancel", () => finish(null), { once: true });
+		window.addEventListener("focus", onFocus, { once: true });
+		document.body.appendChild(input);
+		input.click();
+	});
+}
+/** The same dialog with NO type filter — any file (attachments). */
+const pickFile = (options = {}) => pickImageFile({
+	accept: "*/*",
+	...options
+});
+/**
+* Hand bytes to the user as a browser download (a one-shot `<a download>`).
+* The DOM half of "download this attachment" — pair with the annotation
+* capability's `downloadAttachment` or the document `attachments.download`.
+*/
+function saveFile(bytes, name, mimeType) {
+	const blob = bytes instanceof Blob ? bytes : new Blob([bytes], { type: mimeType ?? "application/octet-stream" });
+	const url = URL.createObjectURL(blob);
+	const a = document.createElement("a");
+	a.href = url;
+	a.download = name;
+	a.style.display = "none";
+	document.body.appendChild(a);
+	a.click();
+	a.remove();
+	setTimeout(() => URL.revokeObjectURL(url), 1e3);
+}
+//#endregion
+//#region src/cursor.ts
+/** Build the CSS cursor value: `url("data:image/svg+xml,…") x y, fallback`. */
+function svgCursor({ svg, hotspot, fallback = "crosshair" }) {
+	const tagStart = svg.indexOf("<svg");
+	const tagEnd = tagStart >= 0 ? svg.indexOf(">", tagStart) : -1;
+	const openTag = tagEnd >= 0 ? svg.slice(tagStart, tagEnd + 1) : "";
+	if (!/\swidth\s*=/.test(openTag) || !/\sheight\s*=/.test(openTag)) throw new Error("[web] svgCursor: the <svg> needs explicit width/height attributes — browsers ignore cursor images without an intrinsic size");
+	return `url("${`data:image/svg+xml,${encodeURIComponent(svg)}`}")${hotspot ? ` ${Math.round(hotspot.x)} ${Math.round(hotspot.y)}` : ""}, ${fallback}`;
+}
+//#endregion
+//#region src/external-uri.ts
+/**
+* External-URI hygiene for PDF link annotations — written ONCE here so every
+* framework adapter (react, vue, svelte, angular) shares the same policy.
+*
+* PDFs are untrusted input: a link's `/URI` can carry anything, including
+* `javascript:` payloads. The default allowlist covers what a document link
+* legitimately opens; everything else (javascript:, file:, data:, vbscript:,
+* custom app schemes) resolves to `null` and the adapters render the link
+* WITHOUT an href — activation still reports through the plugin, so an
+* embedder that needs a custom scheme can handle it in `onActivate`.
+*/
+const DEFAULT_ALLOWED_SCHEMES = /* @__PURE__ */ new Set([
+	"http:",
+	"https:",
+	"mailto:",
+	"tel:"
+]);
+/**
+* Validate a link URI for opening in the browser. Returns the URI when its
+* scheme is allowed (scheme-relative and bare URIs resolve as https), else
+* `null`. Never throws — a malformed URI is just an unopenable one.
+*/
+function sanitizeExternalUri(uri, allowedSchemes = DEFAULT_ALLOWED_SCHEMES) {
+	const trimmed = uri.trim();
+	if (!trimmed) return null;
+	const allowed = new Set([...allowedSchemes].map((s) => s.endsWith(":") ? s.toLowerCase() : `${s.toLowerCase()}:`));
+	try {
+		const url = new URL(trimmed, "https://invalid.example/");
+		return allowed.has(url.protocol) ? trimmed : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+exports.pickFile = pickFile;
+exports.pickImageFile = pickImageFile;
+exports.sanitizeExternalUri = sanitizeExternalUri;
+exports.saveFile = saveFile;
+exports.svgCursor = svgCursor;
+
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../src/file-picker.ts","../src/cursor.ts","../src/external-uri.ts"],"sourcesContent":["/**\n * A one-shot file dialog. Opens a throwaway `<input type=file>`, resolves the\n * chosen `File`, or `null` when the dialog is dismissed. MUST be called\n * synchronously from a user gesture (a click) or the browser refuses to open it.\n *\n * A `File` is a `Blob`, which is a `BinarySource` everywhere in the stack, so the\n * caller can hand the result straight to the engine — this module stays a pure\n * DOM utility with no EmbedPDF types.\n */\nconst IMAGE_ACCEPT = 'image/png,image/jpeg,application/pdf';\n\nexport interface PickFileOptions {\n  /** The dialog's `accept` filter. Defaults to PNG / JPEG / PDF. */\n  accept?: string;\n  /** Allow multiple selection (returns the first file). Defaults to false. */\n  multiple?: boolean;\n}\n\n/** Open the file dialog; resolve the picked file, or null if cancelled. */\nexport function pickImageFile(options: PickFileOptions = {}): Promise<File | null> {\n  const { accept = IMAGE_ACCEPT, multiple = false } = options;\n  return new Promise((resolve) => {\n    const input = document.createElement('input');\n    input.type = 'file';\n    input.accept = accept;\n    input.multiple = multiple;\n    input.style.display = 'none';\n\n    let settled = false;\n    const finish = (value: File | null): void => {\n      if (settled) return;\n      settled = true;\n      window.removeEventListener('focus', onFocus);\n      input.remove();\n      resolve(value);\n    };\n\n    // A window refocus means the dialog closed. Give a queued `change` a tick to\n    // win, then treat a bare refocus as a cancel — the fallback for browsers that\n    // predate the `cancel` event.\n    const onFocus = (): void => {\n      setTimeout(() => finish(null), 300);\n    };\n\n    input.addEventListener('change', () => finish(input.files?.[0] ?? null), { once: true });\n    input.addEventListener('cancel', () => finish(null), { once: true });\n    window.addEventListener('focus', onFocus, { once: true });\n\n    document.body.appendChild(input);\n    input.click();\n  });\n}\n\n/** The same dialog with NO type filter — any file (attachments). */\nexport const pickFile = (options: PickFileOptions = {}): Promise<File | null> =>\n  pickImageFile({ accept: '*/*', ...options });\n\n/**\n * Hand bytes to the user as a browser download (a one-shot `<a download>`).\n * The DOM half of \"download this attachment\" — pair with the annotation\n * capability's `downloadAttachment` or the document `attachments.download`.\n */\nexport function saveFile(bytes: Uint8Array | Blob, name: string, mimeType?: string): void {\n  const blob =\n    bytes instanceof Blob\n      ? bytes\n      : new Blob([bytes as BlobPart], { type: mimeType ?? 'application/octet-stream' });\n  const url = URL.createObjectURL(blob);\n  const a = document.createElement('a');\n  a.href = url;\n  a.download = name;\n  a.style.display = 'none';\n  document.body.appendChild(a);\n  a.click();\n  a.remove();\n  setTimeout(() => URL.revokeObjectURL(url), 1000);\n}\n","/**\n * SVG → CSS cursor string. The armed-tool indicator is the CURSOR itself (the\n * only zero-latency pointer-locked pixel the web has — the OS composites it),\n * so an app hands its toolbar icon here and assigns the result via the\n * interaction hub's `setToolCursor`.\n *\n * Browser rules baked into this module:\n *   - The SVG must carry explicit `width`/`height` attributes (not just a\n *     viewBox) or Chromium/WebKit ignore it — enforced here.\n *   - The hard ceiling is 128×128 CSS px (bigger falls back to the keyword).\n *     Above 32×32, Chromium temporarily resets the cursor to default while it\n *     would overlap browser UI (anti-spoofing) — fine mid-viewport, so ~40px\n *     compositions are common; stay ≤128.\n *   - The keyword fallback covers browsers that refuse SVG cursor images.\n *\n * Pure string work with no EmbedPDF types — like the file picker, this module\n * is a plain web utility.\n */\n\nexport interface SvgCursorOptions {\n  /** Complete `<svg>` markup, colors baked in (no `currentColor` — a cursor\n   *  image has no cascade to inherit from). */\n  svg: string;\n  /** The click point inside the image, CSS px from the top-left. Default 0,0\n   *  (arrow-style: the image's corner is the tip). */\n  hotspot?: { x: number; y: number };\n  /** Keyword cursor when the image can't render. Default `'crosshair'`. */\n  fallback?: string;\n}\n\n/** Build the CSS cursor value: `url(\"data:image/svg+xml,…\") x y, fallback`. */\nexport function svgCursor({ svg, hotspot, fallback = 'crosshair' }: SvgCursorOptions): string {\n  // Scan only the opening `<svg …>` tag (bounded slice) rather than running\n  // `/<svg[^>]*\\swidth\\s*=/` over the whole string — the unbounded form is\n  // quadratic on pathological inputs (many `<svg` fragments with no `>`),\n  // while accepting exactly the same markup: `[^>]*` could never cross a\n  // `>` either.\n  const tagStart = svg.indexOf('<svg');\n  const tagEnd = tagStart >= 0 ? svg.indexOf('>', tagStart) : -1;\n  const openTag = tagEnd >= 0 ? svg.slice(tagStart, tagEnd + 1) : '';\n  if (!/\\swidth\\s*=/.test(openTag) || !/\\sheight\\s*=/.test(openTag)) {\n    throw new Error(\n      '[web] svgCursor: the <svg> needs explicit width/height attributes — ' +\n        'browsers ignore cursor images without an intrinsic size',\n    );\n  }\n  const uri = `data:image/svg+xml,${encodeURIComponent(svg)}`;\n  const spot = hotspot ? ` ${Math.round(hotspot.x)} ${Math.round(hotspot.y)}` : '';\n  return `url(\"${uri}\")${spot}, ${fallback}`;\n}\n","/**\n * External-URI hygiene for PDF link annotations — written ONCE here so every\n * framework adapter (react, vue, svelte, angular) shares the same policy.\n *\n * PDFs are untrusted input: a link's `/URI` can carry anything, including\n * `javascript:` payloads. The default allowlist covers what a document link\n * legitimately opens; everything else (javascript:, file:, data:, vbscript:,\n * custom app schemes) resolves to `null` and the adapters render the link\n * WITHOUT an href — activation still reports through the plugin, so an\n * embedder that needs a custom scheme can handle it in `onActivate`.\n */\nconst DEFAULT_ALLOWED_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:']);\n\n/**\n * Validate a link URI for opening in the browser. Returns the URI when its\n * scheme is allowed (scheme-relative and bare URIs resolve as https), else\n * `null`. Never throws — a malformed URI is just an unopenable one.\n */\nexport function sanitizeExternalUri(\n  uri: string,\n  allowedSchemes: Iterable<string> = DEFAULT_ALLOWED_SCHEMES,\n): string | null {\n  const trimmed = uri.trim();\n  if (!trimmed) return null;\n  const allowed = new Set(\n    [...allowedSchemes].map((s) => (s.endsWith(':') ? s.toLowerCase() : `${s.toLowerCase()}:`)),\n  );\n  try {\n    // Base resolves scheme-relative (\"//host\") and bare (\"example.com/x\" is a\n    // relative path → https) forms; an absolute scheme wins over the base.\n    const url = new URL(trimmed, 'https://invalid.example/');\n    return allowed.has(url.protocol) ? trimmed : null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;AASA,MAAM,eAAe;;AAUrB,SAAgB,cAAc,UAA2B,CAAC,GAAyB;CACjF,MAAM,EAAE,SAAS,cAAc,WAAW,UAAU;CACpD,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,QAAQ,SAAS,cAAc,OAAO;EAC5C,MAAM,OAAO;EACb,MAAM,SAAS;EACf,MAAM,WAAW;EACjB,MAAM,MAAM,UAAU;EAEtB,IAAI,UAAU;EACd,MAAM,UAAU,UAA6B;GAC3C,IAAI,SAAS;GACb,UAAU;GACV,OAAO,oBAAoB,SAAS,OAAO;GAC3C,MAAM,OAAO;GACb,QAAQ,KAAK;EACf;EAKA,MAAM,gBAAsB;GAC1B,iBAAiB,OAAO,IAAI,GAAG,GAAG;EACpC;EAEA,MAAM,iBAAiB,gBAAgB,OAAO,MAAM,QAAQ,MAAM,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;EACvF,MAAM,iBAAiB,gBAAgB,OAAO,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;EACnE,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAExD,SAAS,KAAK,YAAY,KAAK;EAC/B,MAAM,MAAM;CACd,CAAC;AACH;;AAGA,MAAa,YAAY,UAA2B,CAAC,MACnD,cAAc;CAAE,QAAQ;CAAO,GAAG;AAAQ,CAAC;;;;;;AAO7C,SAAgB,SAAS,OAA0B,MAAc,UAAyB;CACxF,MAAM,OACJ,iBAAiB,OACb,QACA,IAAI,KAAK,CAAC,KAAiB,GAAG,EAAE,MAAM,YAAY,2BAA2B,CAAC;CACpF,MAAM,MAAM,IAAI,gBAAgB,IAAI;CACpC,MAAM,IAAI,SAAS,cAAc,GAAG;CACpC,EAAE,OAAO;CACT,EAAE,WAAW;CACb,EAAE,MAAM,UAAU;CAClB,SAAS,KAAK,YAAY,CAAC;CAC3B,EAAE,MAAM;CACR,EAAE,OAAO;CACT,iBAAiB,IAAI,gBAAgB,GAAG,GAAG,GAAI;AACjD;;;;AC7CA,SAAgB,UAAU,EAAE,KAAK,SAAS,WAAW,eAAyC;CAM5F,MAAM,WAAW,IAAI,QAAQ,MAAM;CACnC,MAAM,SAAS,YAAY,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI;CAC5D,MAAM,UAAU,UAAU,IAAI,IAAI,MAAM,UAAU,SAAS,CAAC,IAAI;CAChE,IAAI,CAAC,cAAc,KAAK,OAAO,KAAK,CAAC,eAAe,KAAK,OAAO,GAC9D,MAAM,IAAI,MACR,6HAEF;CAIF,OAAO,QAAQ,sBAFmB,mBAAmB,GAAG,IAErC,IADN,UAAU,IAAI,KAAK,MAAM,QAAQ,CAAC,EAAE,GAAG,KAAK,MAAM,QAAQ,CAAC,MAAM,GAClD,IAAI;AAClC;;;;;;;;;;;;;;ACtCA,MAAM,0CAA0B,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;AAAM,CAAC;;;;;;AAO9E,SAAgB,oBACd,KACA,iBAAmC,yBACpB;CACf,MAAM,UAAU,IAAI,KAAK;CACzB,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,UAAU,IAAI,IAClB,CAAC,GAAG,cAAc,CAAC,CAAC,KAAK,MAAO,EAAE,SAAS,GAAG,IAAI,EAAE,YAAY,IAAI,GAAG,EAAE,YAAY,EAAE,EAAG,CAC5F;CACA,IAAI;EAGF,MAAM,MAAM,IAAI,IAAI,SAAS,0BAA0B;EACvD,OAAO,QAAQ,IAAI,IAAI,QAAQ,IAAI,UAAU;CAC/C,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/index.d.cts

@@ -0,0 +1,63 @@
+//#region src/file-picker.d.ts
+interface PickFileOptions {
+  /** The dialog's `accept` filter. Defaults to PNG / JPEG / PDF. */
+  accept?: string;
+  /** Allow multiple selection (returns the first file). Defaults to false. */
+  multiple?: boolean;
+}
+/** Open the file dialog; resolve the picked file, or null if cancelled. */
+declare function pickImageFile(options?: PickFileOptions): Promise<File | null>;
+/** The same dialog with NO type filter — any file (attachments). */
+declare const pickFile: (options?: PickFileOptions) => Promise<File | null>;
+/**
+ * Hand bytes to the user as a browser download (a one-shot `<a download>`).
+ * The DOM half of "download this attachment" — pair with the annotation
+ * capability's `downloadAttachment` or the document `attachments.download`.
+ */
+declare function saveFile(bytes: Uint8Array | Blob, name: string, mimeType?: string): void;
+//#endregion
+//#region src/cursor.d.ts
+/**
+ * SVG → CSS cursor string. The armed-tool indicator is the CURSOR itself (the
+ * only zero-latency pointer-locked pixel the web has — the OS composites it),
+ * so an app hands its toolbar icon here and assigns the result via the
+ * interaction hub's `setToolCursor`.
+ *
+ * Browser rules baked into this module:
+ *   - The SVG must carry explicit `width`/`height` attributes (not just a
+ *     viewBox) or Chromium/WebKit ignore it — enforced here.
+ *   - The hard ceiling is 128×128 CSS px (bigger falls back to the keyword).
+ *     Above 32×32, Chromium temporarily resets the cursor to default while it
+ *     would overlap browser UI (anti-spoofing) — fine mid-viewport, so ~40px
+ *     compositions are common; stay ≤128.
+ *   - The keyword fallback covers browsers that refuse SVG cursor images.
+ *
+ * Pure string work with no EmbedPDF types — like the file picker, this module
+ * is a plain web utility.
+ */
+interface SvgCursorOptions {
+  /** Complete `<svg>` markup, colors baked in (no `currentColor` — a cursor
+   *  image has no cascade to inherit from). */
+  svg: string;
+  /** The click point inside the image, CSS px from the top-left. Default 0,0
+   *  (arrow-style: the image's corner is the tip). */
+  hotspot?: {
+    x: number;
+    y: number;
+  };
+  /** Keyword cursor when the image can't render. Default `'crosshair'`. */
+  fallback?: string;
+}
+/** Build the CSS cursor value: `url("data:image/svg+xml,…") x y, fallback`. */
+declare function svgCursor({ svg, hotspot, fallback }: SvgCursorOptions): string;
+//#endregion
+//#region src/external-uri.d.ts
+/**
+ * Validate a link URI for opening in the browser. Returns the URI when its
+ * scheme is allowed (scheme-relative and bare URIs resolve as https), else
+ * `null`. Never throws — a malformed URI is just an unopenable one.
+ */
+declare function sanitizeExternalUri(uri: string, allowedSchemes?: Iterable<string>): string | null;
+//#endregion
+export { type PickFileOptions, type SvgCursorOptions, pickFile, pickImageFile, sanitizeExternalUri, saveFile, svgCursor };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.ts

@@ -0,0 +1,63 @@
+//#region src/file-picker.d.ts
+interface PickFileOptions {
+  /** The dialog's `accept` filter. Defaults to PNG / JPEG / PDF. */
+  accept?: string;
+  /** Allow multiple selection (returns the first file). Defaults to false. */
+  multiple?: boolean;
+}
+/** Open the file dialog; resolve the picked file, or null if cancelled. */
+declare function pickImageFile(options?: PickFileOptions): Promise<File | null>;
+/** The same dialog with NO type filter — any file (attachments). */
+declare const pickFile: (options?: PickFileOptions) => Promise<File | null>;
+/**
+ * Hand bytes to the user as a browser download (a one-shot `<a download>`).
+ * The DOM half of "download this attachment" — pair with the annotation
+ * capability's `downloadAttachment` or the document `attachments.download`.
+ */
+declare function saveFile(bytes: Uint8Array | Blob, name: string, mimeType?: string): void;
+//#endregion
+//#region src/cursor.d.ts
+/**
+ * SVG → CSS cursor string. The armed-tool indicator is the CURSOR itself (the
+ * only zero-latency pointer-locked pixel the web has — the OS composites it),
+ * so an app hands its toolbar icon here and assigns the result via the
+ * interaction hub's `setToolCursor`.
+ *
+ * Browser rules baked into this module:
+ *   - The SVG must carry explicit `width`/`height` attributes (not just a
+ *     viewBox) or Chromium/WebKit ignore it — enforced here.
+ *   - The hard ceiling is 128×128 CSS px (bigger falls back to the keyword).
+ *     Above 32×32, Chromium temporarily resets the cursor to default while it
+ *     would overlap browser UI (anti-spoofing) — fine mid-viewport, so ~40px
+ *     compositions are common; stay ≤128.
+ *   - The keyword fallback covers browsers that refuse SVG cursor images.
+ *
+ * Pure string work with no EmbedPDF types — like the file picker, this module
+ * is a plain web utility.
+ */
+interface SvgCursorOptions {
+  /** Complete `<svg>` markup, colors baked in (no `currentColor` — a cursor
+   *  image has no cascade to inherit from). */
+  svg: string;
+  /** The click point inside the image, CSS px from the top-left. Default 0,0
+   *  (arrow-style: the image's corner is the tip). */
+  hotspot?: {
+    x: number;
+    y: number;
+  };
+  /** Keyword cursor when the image can't render. Default `'crosshair'`. */
+  fallback?: string;
+}
+/** Build the CSS cursor value: `url("data:image/svg+xml,…") x y, fallback`. */
+declare function svgCursor({ svg, hotspot, fallback }: SvgCursorOptions): string;
+//#endregion
+//#region src/external-uri.d.ts
+/**
+ * Validate a link URI for opening in the browser. Returns the URI when its
+ * scheme is allowed (scheme-relative and bare URIs resolve as https), else
+ * `null`. Never throws — a malformed URI is just an unopenable one.
+ */
+declare function sanitizeExternalUri(uri: string, allowedSchemes?: Iterable<string>): string | null;
+//#endregion
+export { type PickFileOptions, type SvgCursorOptions, pickFile, pickImageFile, sanitizeExternalUri, saveFile, svgCursor };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,109 @@
+//#region src/file-picker.ts
+/**
+* A one-shot file dialog. Opens a throwaway `<input type=file>`, resolves the
+* chosen `File`, or `null` when the dialog is dismissed. MUST be called
+* synchronously from a user gesture (a click) or the browser refuses to open it.
+*
+* A `File` is a `Blob`, which is a `BinarySource` everywhere in the stack, so the
+* caller can hand the result straight to the engine — this module stays a pure
+* DOM utility with no EmbedPDF types.
+*/
+const IMAGE_ACCEPT = "image/png,image/jpeg,application/pdf";
+/** Open the file dialog; resolve the picked file, or null if cancelled. */
+function pickImageFile(options = {}) {
+	const { accept = IMAGE_ACCEPT, multiple = false } = options;
+	return new Promise((resolve) => {
+		const input = document.createElement("input");
+		input.type = "file";
+		input.accept = accept;
+		input.multiple = multiple;
+		input.style.display = "none";
+		let settled = false;
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			window.removeEventListener("focus", onFocus);
+			input.remove();
+			resolve(value);
+		};
+		const onFocus = () => {
+			setTimeout(() => finish(null), 300);
+		};
+		input.addEventListener("change", () => finish(input.files?.[0] ?? null), { once: true });
+		input.addEventListener("cancel", () => finish(null), { once: true });
+		window.addEventListener("focus", onFocus, { once: true });
+		document.body.appendChild(input);
+		input.click();
+	});
+}
+/** The same dialog with NO type filter — any file (attachments). */
+const pickFile = (options = {}) => pickImageFile({
+	accept: "*/*",
+	...options
+});
+/**
+* Hand bytes to the user as a browser download (a one-shot `<a download>`).
+* The DOM half of "download this attachment" — pair with the annotation
+* capability's `downloadAttachment` or the document `attachments.download`.
+*/
+function saveFile(bytes, name, mimeType) {
+	const blob = bytes instanceof Blob ? bytes : new Blob([bytes], { type: mimeType ?? "application/octet-stream" });
+	const url = URL.createObjectURL(blob);
+	const a = document.createElement("a");
+	a.href = url;
+	a.download = name;
+	a.style.display = "none";
+	document.body.appendChild(a);
+	a.click();
+	a.remove();
+	setTimeout(() => URL.revokeObjectURL(url), 1e3);
+}
+//#endregion
+//#region src/cursor.ts
+/** Build the CSS cursor value: `url("data:image/svg+xml,…") x y, fallback`. */
+function svgCursor({ svg, hotspot, fallback = "crosshair" }) {
+	const tagStart = svg.indexOf("<svg");
+	const tagEnd = tagStart >= 0 ? svg.indexOf(">", tagStart) : -1;
+	const openTag = tagEnd >= 0 ? svg.slice(tagStart, tagEnd + 1) : "";
+	if (!/\swidth\s*=/.test(openTag) || !/\sheight\s*=/.test(openTag)) throw new Error("[web] svgCursor: the <svg> needs explicit width/height attributes — browsers ignore cursor images without an intrinsic size");
+	return `url("${`data:image/svg+xml,${encodeURIComponent(svg)}`}")${hotspot ? ` ${Math.round(hotspot.x)} ${Math.round(hotspot.y)}` : ""}, ${fallback}`;
+}
+//#endregion
+//#region src/external-uri.ts
+/**
+* External-URI hygiene for PDF link annotations — written ONCE here so every
+* framework adapter (react, vue, svelte, angular) shares the same policy.
+*
+* PDFs are untrusted input: a link's `/URI` can carry anything, including
+* `javascript:` payloads. The default allowlist covers what a document link
+* legitimately opens; everything else (javascript:, file:, data:, vbscript:,
+* custom app schemes) resolves to `null` and the adapters render the link
+* WITHOUT an href — activation still reports through the plugin, so an
+* embedder that needs a custom scheme can handle it in `onActivate`.
+*/
+const DEFAULT_ALLOWED_SCHEMES = /* @__PURE__ */ new Set([
+	"http:",
+	"https:",
+	"mailto:",
+	"tel:"
+]);
+/**
+* Validate a link URI for opening in the browser. Returns the URI when its
+* scheme is allowed (scheme-relative and bare URIs resolve as https), else
+* `null`. Never throws — a malformed URI is just an unopenable one.
+*/
+function sanitizeExternalUri(uri, allowedSchemes = DEFAULT_ALLOWED_SCHEMES) {
+	const trimmed = uri.trim();
+	if (!trimmed) return null;
+	const allowed = new Set([...allowedSchemes].map((s) => s.endsWith(":") ? s.toLowerCase() : `${s.toLowerCase()}:`));
+	try {
+		const url = new URL(trimmed, "https://invalid.example/");
+		return allowed.has(url.protocol) ? trimmed : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { pickFile, pickImageFile, sanitizeExternalUri, saveFile, svgCursor };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/file-picker.ts","../src/cursor.ts","../src/external-uri.ts"],"sourcesContent":["/**\n * A one-shot file dialog. Opens a throwaway `<input type=file>`, resolves the\n * chosen `File`, or `null` when the dialog is dismissed. MUST be called\n * synchronously from a user gesture (a click) or the browser refuses to open it.\n *\n * A `File` is a `Blob`, which is a `BinarySource` everywhere in the stack, so the\n * caller can hand the result straight to the engine — this module stays a pure\n * DOM utility with no EmbedPDF types.\n */\nconst IMAGE_ACCEPT = 'image/png,image/jpeg,application/pdf';\n\nexport interface PickFileOptions {\n  /** The dialog's `accept` filter. Defaults to PNG / JPEG / PDF. */\n  accept?: string;\n  /** Allow multiple selection (returns the first file). Defaults to false. */\n  multiple?: boolean;\n}\n\n/** Open the file dialog; resolve the picked file, or null if cancelled. */\nexport function pickImageFile(options: PickFileOptions = {}): Promise<File | null> {\n  const { accept = IMAGE_ACCEPT, multiple = false } = options;\n  return new Promise((resolve) => {\n    const input = document.createElement('input');\n    input.type = 'file';\n    input.accept = accept;\n    input.multiple = multiple;\n    input.style.display = 'none';\n\n    let settled = false;\n    const finish = (value: File | null): void => {\n      if (settled) return;\n      settled = true;\n      window.removeEventListener('focus', onFocus);\n      input.remove();\n      resolve(value);\n    };\n\n    // A window refocus means the dialog closed. Give a queued `change` a tick to\n    // win, then treat a bare refocus as a cancel — the fallback for browsers that\n    // predate the `cancel` event.\n    const onFocus = (): void => {\n      setTimeout(() => finish(null), 300);\n    };\n\n    input.addEventListener('change', () => finish(input.files?.[0] ?? null), { once: true });\n    input.addEventListener('cancel', () => finish(null), { once: true });\n    window.addEventListener('focus', onFocus, { once: true });\n\n    document.body.appendChild(input);\n    input.click();\n  });\n}\n\n/** The same dialog with NO type filter — any file (attachments). */\nexport const pickFile = (options: PickFileOptions = {}): Promise<File | null> =>\n  pickImageFile({ accept: '*/*', ...options });\n\n/**\n * Hand bytes to the user as a browser download (a one-shot `<a download>`).\n * The DOM half of \"download this attachment\" — pair with the annotation\n * capability's `downloadAttachment` or the document `attachments.download`.\n */\nexport function saveFile(bytes: Uint8Array | Blob, name: string, mimeType?: string): void {\n  const blob =\n    bytes instanceof Blob\n      ? bytes\n      : new Blob([bytes as BlobPart], { type: mimeType ?? 'application/octet-stream' });\n  const url = URL.createObjectURL(blob);\n  const a = document.createElement('a');\n  a.href = url;\n  a.download = name;\n  a.style.display = 'none';\n  document.body.appendChild(a);\n  a.click();\n  a.remove();\n  setTimeout(() => URL.revokeObjectURL(url), 1000);\n}\n","/**\n * SVG → CSS cursor string. The armed-tool indicator is the CURSOR itself (the\n * only zero-latency pointer-locked pixel the web has — the OS composites it),\n * so an app hands its toolbar icon here and assigns the result via the\n * interaction hub's `setToolCursor`.\n *\n * Browser rules baked into this module:\n *   - The SVG must carry explicit `width`/`height` attributes (not just a\n *     viewBox) or Chromium/WebKit ignore it — enforced here.\n *   - The hard ceiling is 128×128 CSS px (bigger falls back to the keyword).\n *     Above 32×32, Chromium temporarily resets the cursor to default while it\n *     would overlap browser UI (anti-spoofing) — fine mid-viewport, so ~40px\n *     compositions are common; stay ≤128.\n *   - The keyword fallback covers browsers that refuse SVG cursor images.\n *\n * Pure string work with no EmbedPDF types — like the file picker, this module\n * is a plain web utility.\n */\n\nexport interface SvgCursorOptions {\n  /** Complete `<svg>` markup, colors baked in (no `currentColor` — a cursor\n   *  image has no cascade to inherit from). */\n  svg: string;\n  /** The click point inside the image, CSS px from the top-left. Default 0,0\n   *  (arrow-style: the image's corner is the tip). */\n  hotspot?: { x: number; y: number };\n  /** Keyword cursor when the image can't render. Default `'crosshair'`. */\n  fallback?: string;\n}\n\n/** Build the CSS cursor value: `url(\"data:image/svg+xml,…\") x y, fallback`. */\nexport function svgCursor({ svg, hotspot, fallback = 'crosshair' }: SvgCursorOptions): string {\n  // Scan only the opening `<svg …>` tag (bounded slice) rather than running\n  // `/<svg[^>]*\\swidth\\s*=/` over the whole string — the unbounded form is\n  // quadratic on pathological inputs (many `<svg` fragments with no `>`),\n  // while accepting exactly the same markup: `[^>]*` could never cross a\n  // `>` either.\n  const tagStart = svg.indexOf('<svg');\n  const tagEnd = tagStart >= 0 ? svg.indexOf('>', tagStart) : -1;\n  const openTag = tagEnd >= 0 ? svg.slice(tagStart, tagEnd + 1) : '';\n  if (!/\\swidth\\s*=/.test(openTag) || !/\\sheight\\s*=/.test(openTag)) {\n    throw new Error(\n      '[web] svgCursor: the <svg> needs explicit width/height attributes — ' +\n        'browsers ignore cursor images without an intrinsic size',\n    );\n  }\n  const uri = `data:image/svg+xml,${encodeURIComponent(svg)}`;\n  const spot = hotspot ? ` ${Math.round(hotspot.x)} ${Math.round(hotspot.y)}` : '';\n  return `url(\"${uri}\")${spot}, ${fallback}`;\n}\n","/**\n * External-URI hygiene for PDF link annotations — written ONCE here so every\n * framework adapter (react, vue, svelte, angular) shares the same policy.\n *\n * PDFs are untrusted input: a link's `/URI` can carry anything, including\n * `javascript:` payloads. The default allowlist covers what a document link\n * legitimately opens; everything else (javascript:, file:, data:, vbscript:,\n * custom app schemes) resolves to `null` and the adapters render the link\n * WITHOUT an href — activation still reports through the plugin, so an\n * embedder that needs a custom scheme can handle it in `onActivate`.\n */\nconst DEFAULT_ALLOWED_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:']);\n\n/**\n * Validate a link URI for opening in the browser. Returns the URI when its\n * scheme is allowed (scheme-relative and bare URIs resolve as https), else\n * `null`. Never throws — a malformed URI is just an unopenable one.\n */\nexport function sanitizeExternalUri(\n  uri: string,\n  allowedSchemes: Iterable<string> = DEFAULT_ALLOWED_SCHEMES,\n): string | null {\n  const trimmed = uri.trim();\n  if (!trimmed) return null;\n  const allowed = new Set(\n    [...allowedSchemes].map((s) => (s.endsWith(':') ? s.toLowerCase() : `${s.toLowerCase()}:`)),\n  );\n  try {\n    // Base resolves scheme-relative (\"//host\") and bare (\"example.com/x\" is a\n    // relative path → https) forms; an absolute scheme wins over the base.\n    const url = new URL(trimmed, 'https://invalid.example/');\n    return allowed.has(url.protocol) ? trimmed : null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,eAAe;;AAUrB,SAAgB,cAAc,UAA2B,CAAC,GAAyB;CACjF,MAAM,EAAE,SAAS,cAAc,WAAW,UAAU;CACpD,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,QAAQ,SAAS,cAAc,OAAO;EAC5C,MAAM,OAAO;EACb,MAAM,SAAS;EACf,MAAM,WAAW;EACjB,MAAM,MAAM,UAAU;EAEtB,IAAI,UAAU;EACd,MAAM,UAAU,UAA6B;GAC3C,IAAI,SAAS;GACb,UAAU;GACV,OAAO,oBAAoB,SAAS,OAAO;GAC3C,MAAM,OAAO;GACb,QAAQ,KAAK;EACf;EAKA,MAAM,gBAAsB;GAC1B,iBAAiB,OAAO,IAAI,GAAG,GAAG;EACpC;EAEA,MAAM,iBAAiB,gBAAgB,OAAO,MAAM,QAAQ,MAAM,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;EACvF,MAAM,iBAAiB,gBAAgB,OAAO,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;EACnE,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAExD,SAAS,KAAK,YAAY,KAAK;EAC/B,MAAM,MAAM;CACd,CAAC;AACH;;AAGA,MAAa,YAAY,UAA2B,CAAC,MACnD,cAAc;CAAE,QAAQ;CAAO,GAAG;AAAQ,CAAC;;;;;;AAO7C,SAAgB,SAAS,OAA0B,MAAc,UAAyB;CACxF,MAAM,OACJ,iBAAiB,OACb,QACA,IAAI,KAAK,CAAC,KAAiB,GAAG,EAAE,MAAM,YAAY,2BAA2B,CAAC;CACpF,MAAM,MAAM,IAAI,gBAAgB,IAAI;CACpC,MAAM,IAAI,SAAS,cAAc,GAAG;CACpC,EAAE,OAAO;CACT,EAAE,WAAW;CACb,EAAE,MAAM,UAAU;CAClB,SAAS,KAAK,YAAY,CAAC;CAC3B,EAAE,MAAM;CACR,EAAE,OAAO;CACT,iBAAiB,IAAI,gBAAgB,GAAG,GAAG,GAAI;AACjD;;;;AC7CA,SAAgB,UAAU,EAAE,KAAK,SAAS,WAAW,eAAyC;CAM5F,MAAM,WAAW,IAAI,QAAQ,MAAM;CACnC,MAAM,SAAS,YAAY,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI;CAC5D,MAAM,UAAU,UAAU,IAAI,IAAI,MAAM,UAAU,SAAS,CAAC,IAAI;CAChE,IAAI,CAAC,cAAc,KAAK,OAAO,KAAK,CAAC,eAAe,KAAK,OAAO,GAC9D,MAAM,IAAI,MACR,6HAEF;CAIF,OAAO,QAAQ,sBAFmB,mBAAmB,GAAG,IAErC,IADN,UAAU,IAAI,KAAK,MAAM,QAAQ,CAAC,EAAE,GAAG,KAAK,MAAM,QAAQ,CAAC,MAAM,GAClD,IAAI;AAClC;;;;;;;;;;;;;;ACtCA,MAAM,0CAA0B,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;AAAM,CAAC;;;;;;AAO9E,SAAgB,oBACd,KACA,iBAAmC,yBACpB;CACf,MAAM,UAAU,IAAI,KAAK;CACzB,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,UAAU,IAAI,IAClB,CAAC,GAAG,cAAc,CAAC,CAAC,KAAK,MAAO,EAAE,SAAS,GAAG,IAAI,EAAE,YAAY,IAAI,GAAG,EAAE,YAAY,EAAE,EAAG,CAC5F;CACA,IAAI;EAGF,MAAM,MAAM,IAAI,IAAI,SAAS,0BAA0B;EACvD,OAAO,QAAQ,IAAI,IAAI,QAAQ,IAAI,UAAU;CAC/C,QAAQ;EACN,OAAO;CACT;AACF"}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@embedpdf/web",
+  "version": "3.0.0-next.0",
+  "private": false,
+  "description": "Framework-free browser adapters for EmbedPDF v3 — the one home for code that touches window/document (file dialog, clipboard, print…). Imported by the framework layers; never by a plugin or a *-core package, which stay DOM-free.",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "typescript": "^5.0.0",
+    "vitest": "^2.1.9",
+    "@embedpdf/tooling-build": "0.0.0"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+    "directory": "packages/framework/web"
+  },
+  "scripts": {
+    "build": "epdf-build",
+    "clean": "rimraf dist",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}