@hmlr/govuk-react-components-library 1.0.2 → 1.1.0

package/dist/index.cjs.js

@@ -92,10 +92,10 @@ function ExtractAccordionConfigFromAttributes(remainingAttributes) {
     return accordionConfig;
 }
 
-const Accordion = ({ headingLevel: HeadingLevel = "h2", items, className, id, ...attributes }) => {
+const Accordion = ({ headingLevel: HeadingLevel = "h2", items = [], className, id, ...attributes }) => {
     const remainingAttributes = { ...attributes };
     ExtractAccordionConfigFromAttributes(remainingAttributes);
-    return (jsxRuntime.jsx("div", { ...remainingAttributes, id: id, className: `govuk-accordion ${className || ""}`, "data-module": "govuk-accordion", children: items.filter(Boolean).map((item, index) => (jsxRuntime.jsxs("div", { className: `govuk-accordion__section ${item.expanded ? "govuk-accordion__section--expanded" : ""}`, children: [jsxRuntime.jsxs("div", { className: "govuk-accordion__section-header", children: [jsxRuntime.jsx(HeadingLevel, { className: "govuk-accordion__section-heading", children: jsxRuntime.jsx("span", { className: "govuk-accordion__section-button", id: `${id}-heading-${index + 1}`, children: item.heading.children }) }), item.summary && (jsxRuntime.jsx("div", { className: "govuk-accordion__section-summary govuk-body", id: `${id}-summary-${index + 1}`, children: item.summary.children }))] }), jsxRuntime.jsx("div", { id: `${id}-content-${index + 1}`, className: "govuk-accordion__section-content", "aria-labelledby": `${id}-heading-${index + 1}`, children: item.content.children })] }, item.reactListKey || index))) }));
+    return (jsxRuntime.jsx("div", { ...remainingAttributes, id: id, className: `govuk-accordion ${className || ""}`, "data-module": "govuk-accordion", children: items.filter(Boolean).map((item, index) => (jsxRuntime.jsxs("div", { className: `govuk-accordion__section ${item.expanded ? "govuk-accordion__section--expanded" : ""}`, children: [jsxRuntime.jsxs("div", { className: "govuk-accordion__section-header", children: [jsxRuntime.jsx(HeadingLevel, { className: "govuk-accordion__section-heading", children: jsxRuntime.jsx("span", { className: "govuk-accordion__section-button", id: `${id}-heading-${index + 1}`, children: item.heading?.children }) }), item.summary && (jsxRuntime.jsx("div", { className: "govuk-accordion__section-summary govuk-body", id: `${id}-summary-${index + 1}`, children: item.summary.children }))] }), jsxRuntime.jsx("div", { id: `${id}-content-${index + 1}`, className: "govuk-accordion__section-content", "aria-labelledby": `${id}-heading-${index + 1}`, children: item.content?.children })] }, item.reactListKey || index))) }));
 };
 
 const LinkWithRef = ({ children, to, href, forwardedRef = null, ...attributes }) => {
@@ -831,6 +831,24 @@ function ConfigureOverallErrorSummary($scope, config) {
     govukFrontend.createAll(govukFrontend.ErrorSummary, config, $scope);
 }
 
+const ExitThisPage = ({ children = "Exit this page", className, redirectUrl = "https://www.bbc.co.uk/weather", activatedText, timedOutText, pressTwoMoreTimesText, pressOneMoreTimeText, ...attributes }) => {
+    const i18nProps = {};
+    if (activatedText)
+        i18nProps["data-i18n.activated"] = activatedText;
+    if (timedOutText)
+        i18nProps["data-i18n.timed-out"] = timedOutText;
+    if (pressTwoMoreTimesText)
+        i18nProps["data-i18n.press-two-more-times"] = pressTwoMoreTimesText;
+    if (pressOneMoreTimeText)
+        i18nProps["data-i18n.press-one-more-time"] = pressOneMoreTimeText;
+    return (jsxRuntime.jsx("div", { ...attributes, ...i18nProps, className: `govuk-exit-this-page${className ? ` ${className}` : ""}`, "data-module": "govuk-exit-this-page", children: jsxRuntime.jsxs("a", { href: redirectUrl, role: "button", draggable: false, className: "govuk-button govuk-button--warning govuk-exit-this-page__button govuk-js-exit-this-page-button", "data-module": "govuk-button", rel: "nofollow noreferrer", children: [jsxRuntime.jsx("span", { className: "govuk-visually-hidden", children: "Emergency" }), " ", children] }) }));
+};
+ExitThisPage.displayName = "ExitThisPage";
+
+function ConfigureOverallExitThisPage($scope) {
+    govukFrontend.createAll(govukFrontend.ExitThisPage, {}, $scope);
+}
+
 const FileUpload = (props) => {
     const { className, errorMessage, formGroup, hint, label, "aria-describedby": describedBy, id, ...attributes } = props;
     let hintComponent;
@@ -955,6 +973,17 @@ const NotificationBanner = (props) => {
     return (jsxRuntime.jsxs("div", { className: `govuk-notification-banner ${typeClass} ${className || ""}`, role: roleAttribute, "aria-labelledby": titleId, "data-module": "govuk-notification-banner", ...(disableAutoFocus ? { "data-disable-auto-focus": "true" } : {}), ...attributes, children: [jsxRuntime.jsx("div", { className: "govuk-notification-banner__header", children: jsxRuntime.jsx(HeadingLevel, { className: "govuk-notification-banner__title", id: titleId, children: title }) }), jsxRuntime.jsx("div", { className: "govuk-notification-banner__content", children: typeof children === "string" ? (jsxRuntime.jsx("p", { className: "govuk-notification-banner__heading", children: children })) : (children) })] }));
 };
 
+const SvgIcon = ({ type, ...props }) => (jsxRuntime.jsx("svg", { xmlns: "http://www.w3.org/2000/svg", width: 15, height: 13, "aria-hidden": "true", ...props, children: jsxRuntime.jsx("path", { d: type === "next"
+            ? "M8.107-.008L6.693 1.406 10.986 5.7H-2v2h12.896L6.71 11.676l1.378 1.449 6.744-6.406L8.107-.008z"
+            : "M6.594-.008-.133 6.72l6.744 6.406 1.377-1.449-4.185-3.977h12.896v-2H3.715l4.293-4.293L6.594-.008z" }) }));
+
+const NavigationButton = ({ href, type, children, labelText, }) => {
+    const defaultText = type === "next" ? "Next" : "Previous";
+    const typeClass = type === "next" ? "next" : "prev";
+    const icon = (jsxRuntime.jsx(SvgIcon, { type: type, className: `govuk-pagination__icon govuk-pagination__icon--${typeClass}`, focusable: "false", "aria-hidden": "true" }));
+    return (jsxRuntime.jsxs("a", { className: "govuk-link govuk-pagination__link", href: href, rel: type, children: [type === "previous" && icon, jsxRuntime.jsxs("span", { className: "govuk-pagination__link-title", children: [children ?? defaultText, jsxRuntime.jsx("span", { className: "govuk-visually-hidden", children: " page" })] }), type === "next" && icon, labelText && (jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [jsxRuntime.jsx("span", { className: "govuk-visually-hidden", children: ":" }), jsxRuntime.jsx("span", { className: "govuk-pagination__link-label", children: labelText })] }))] }));
+};
+
 const DOTS = "...";
 const UsePagination = ({ totalCount, pageSize, siblingCount = 1, currentPage, }) => {
     const range = (start, end) => {
@@ -990,29 +1019,13 @@ const UsePagination = ({ totalCount, pageSize, siblingCount = 1, currentPage, })
     return paginationRange;
 };
 
-const SvgIcon = ({ type, ...props }) => (jsxRuntime.jsx("svg", { xmlns: "http://www.w3.org/2000/svg", width: 15, height: 13, "aria-hidden": "true", ...props, children: jsxRuntime.jsx("path", { d: type === "next"
-            ? "M8.107-.008L6.693 1.406 10.986 5.7H-2v2h12.896L6.71 11.676l1.378 1.449 6.744-6.406L8.107-.008z"
-            : "M6.594-.008-.133 6.72l6.744 6.406 1.377-1.449-4.185-3.977h12.896v-2H3.715l4.293-4.293L6.594-.008z" }) }));
-
-const NavigationButton = ({ isDisabled, onClick, children, name, type, }) => {
-    const typeClass = type === "next" ? type : "prev";
-    const Icon = (jsxRuntime.jsx(SvgIcon, { type: type, className: `govuk-pagination__icon govuk-pagination__icon--${typeClass}`, focusable: "false" }));
-    return isDisabled ? (jsxRuntime.jsxs("div", { rel: type, children: [type === "previous" && Icon, jsxRuntime.jsx("span", { className: "govuk-pagination__link-title", children: name }), type === "next" && Icon, children && (jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [type === "previous" && jsxRuntime.jsx(jsxRuntime.Fragment, { children: "\u00A0" }), jsxRuntime.jsx("span", { className: "govuk-visually-hidden", children: ":" }), children, type === "next" && jsxRuntime.jsx(jsxRuntime.Fragment, { children: " \u00A0" })] }))] })) : (jsxRuntime.jsxs("a", { className: "govuk-link govuk-pagination__link", href: "#", rel: type, onClick: onClick, children: [type === "previous" && Icon, jsxRuntime.jsx("span", { className: "govuk-pagination__link-title", children: name }), type === "next" && Icon, children && (jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [type === "previous" && jsxRuntime.jsx(jsxRuntime.Fragment, { children: "\u00A0\u00A0" }), jsxRuntime.jsx("span", { className: "govuk-visually-hidden", children: ":" }), children, type === "next" && jsxRuntime.jsx(jsxRuntime.Fragment, { children: "\u00A0\u00A0" })] }))] }));
-};
-
-const Pagination = ({ onPageChange, totalCount, siblingCount = 1, currentPage, pageSize, className, previousName = "Previous", nextName = "Next", previousChildren, nextChildren, }) => {
-    const paginationRange = UsePagination({
-        currentPage,
-        totalCount,
-        siblingCount,
-        pageSize,
-    });
-    if (!paginationRange || paginationRange.length < 2)
+const Pagination = ({ previous, next, items, className, }) => {
+    if (!previous && !next && (!items || items.length === 0))
         return null;
-    const onNext = () => onPageChange(currentPage + 1);
-    const onPrevious = () => onPageChange(currentPage - 1);
-    const lastPage = paginationRange[paginationRange.length - 1];
-    return (jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [jsxRuntime.jsx("div", { className: "govuk-!-padding-bottom-2" }), jsxRuntime.jsx("div", { className: `govuk-grid-column-full ${className || ""}`, children: jsxRuntime.jsxs("nav", { className: "govuk-pagination", role: "navigation", "aria-label": "Pagination", children: [jsxRuntime.jsx("div", { className: "govuk-pagination__prev", children: jsxRuntime.jsx(NavigationButton, { isDisabled: currentPage === 1, onClick: onPrevious, name: previousName, type: "previous", children: previousChildren }) }), jsxRuntime.jsx("ul", { className: "govuk-pagination__list", children: paginationRange.map((pageNumber, index) => pageNumber === DOTS ? (jsxRuntime.jsx("li", { className: "govuk-pagination__item govuk-pagination__item--ellipses", children: DOTS }, index)) : (jsxRuntime.jsx("li", { className: `govuk-pagination__item ${pageNumber === currentPage ? "govuk-pagination__item--current" : ""}`, children: jsxRuntime.jsx("a", { className: "govuk-link govuk-pagination__link", href: "#", "aria-label": `Page ${pageNumber}`, "aria-current": pageNumber === currentPage ? "page" : undefined, onClick: () => onPageChange(pageNumber), children: pageNumber }) }, index))) }), jsxRuntime.jsx("div", { className: "govuk-pagination__next", children: jsxRuntime.jsx(NavigationButton, { isDisabled: currentPage === lastPage, onClick: onNext, name: nextName, type: "next", children: nextChildren }) })] }) }), jsxRuntime.jsx("div", { className: "govuk-!-padding-bottom-4" })] }));
+    // Block layout is used when there are no numbered page items — govuk renders
+    // the nav with an extra class and the link title with --decorated modifier.
+    const isBlockLayout = !items || items.length === 0;
+    return (jsxRuntime.jsxs("nav", { className: `govuk-pagination${isBlockLayout ? " govuk-pagination--block" : ""}${className ? ` ${className}` : ""}`, role: "navigation", "aria-label": "Pagination", children: [previous && (jsxRuntime.jsx("div", { className: "govuk-pagination__prev", children: jsxRuntime.jsx(NavigationButton, { type: "previous", ...previous }) })), items && items.length > 0 && (jsxRuntime.jsx("ul", { className: "govuk-pagination__list", children: items.map((item, index) => item.ellipsis ? (jsxRuntime.jsx("li", { className: "govuk-pagination__item govuk-pagination__item--ellipses", children: DOTS }, index)) : (jsxRuntime.jsx("li", { className: `govuk-pagination__item${item.current ? " govuk-pagination__item--current" : ""}`, children: jsxRuntime.jsx("a", { className: "govuk-link govuk-pagination__link", href: item.href ?? "#", "aria-label": `Page ${item.number}`, ...(item.current ? { "aria-current": "page" } : {}), children: item.number }) }, index))) })), next && (jsxRuntime.jsx("div", { className: "govuk-pagination__next", children: jsxRuntime.jsx(NavigationButton, { type: "next", ...next }) }))] }));
 };
 
 const Panel = (props) => {
@@ -1021,6 +1034,49 @@ const Panel = (props) => {
     return (jsxRuntime.jsxs("div", { className: `govuk-panel govuk-panel--confirmation ${className || ""}`, ...attributes, children: [jsxRuntime.jsx(HeadingLevel, { className: "govuk-panel__title", children: titleChildren }), innerHtml] }));
 };
 
+const PasswordInput = React.forwardRef((props, ref) => {
+    const { className, "aria-describedby": describedBy, errorMessage, formGroup, hint, label, name, id, autoComplete = "current-password", showPasswordText = "Show", hidePasswordText = "Hide", showPasswordAriaLabelText = "Show password", hidePasswordAriaLabelText = "Hide password", passwordShownAnnouncementText, passwordHiddenAnnouncementText, ...attributes } = props;
+    let describedByValue = describedBy || "";
+    let hintComponent = null;
+    let errorMessageComponent = null;
+    if (hint) {
+        const hintId = `${id}-hint`;
+        describedByValue += ` ${hintId}`;
+        hintComponent = jsxRuntime.jsx(Hint, { ...hint, id: hintId });
+    }
+    if (errorMessage) {
+        const errorId = id ? `${id}-error` : "";
+        describedByValue += ` ${errorId}`;
+        errorMessageComponent = jsxRuntime.jsx(ErrorMessage, { ...errorMessage, id: errorId });
+    }
+    // Build i18n data attributes for the govuk-frontend JS module
+    const i18nProps = {};
+    if (showPasswordText)
+        i18nProps["data-i18n.show-password"] = showPasswordText;
+    if (hidePasswordText)
+        i18nProps["data-i18n.hide-password"] = hidePasswordText;
+    if (showPasswordAriaLabelText)
+        i18nProps["data-i18n.show-password-aria-label"] =
+            showPasswordAriaLabelText;
+    if (hidePasswordAriaLabelText)
+        i18nProps["data-i18n.hide-password-aria-label"] =
+            hidePasswordAriaLabelText;
+    if (passwordShownAnnouncementText)
+        i18nProps["data-i18n.password-shown-announcement"] =
+            passwordShownAnnouncementText;
+    if (passwordHiddenAnnouncementText)
+        i18nProps["data-i18n.password-hidden-announcement"] =
+            passwordHiddenAnnouncementText;
+    // Label handles isPageHeading internally — no extra wrapper needed here
+    const labelEl = jsxRuntime.jsx(Label, { ...label, htmlFor: id });
+    return (jsxRuntime.jsxs("div", { className: `govuk-form-group${formGroup?.className ? ` ${formGroup.className}` : ""}${errorMessage ? " govuk-form-group--error" : ""} govuk-password-input`, "data-module": "govuk-password-input", ...i18nProps, children: [labelEl, hintComponent, errorMessageComponent, jsxRuntime.jsxs("div", { className: "govuk-input__wrapper govuk-password-input__wrapper", children: [jsxRuntime.jsx("input", { ref: ref, id: id, className: `govuk-input govuk-password-input__input govuk-js-password-input-input${className ? ` ${className}` : ""}${errorMessage ? " govuk-input--error" : ""}`, name: name || id, type: "password", spellCheck: false, autoComplete: autoComplete, autoCapitalize: "none", "aria-describedby": describedByValue.trim() || undefined, ...attributes }), jsxRuntime.jsx("button", { type: "button", className: "govuk-button govuk-button--secondary govuk-password-input__toggle govuk-js-password-input-toggle", "data-module": "govuk-button", "aria-controls": id, "aria-label": showPasswordAriaLabelText, hidden: true, children: showPasswordText })] })] }));
+});
+PasswordInput.displayName = "PasswordInput";
+
+function ConfigureOverallPasswordInput($scope) {
+    govukFrontend.createAll(govukFrontend.PasswordInput, {}, $scope);
+}
+
 function Slugify(str) {
     str = str.replace(/^\s+|\s+$/g, ""); // trim leading/trailing white space
     str = str.toLowerCase(); // convert string to lowercase
@@ -1031,28 +1087,281 @@ function Slugify(str) {
     return str;
 }
 
+/**
+ * Convert a base64 string to an ArrayBuffer
+ */
+const _base64ToArrayBuffer = (base64) => {
+    const binaryString = window.atob(base64);
+    const len = binaryString.length;
+    const bytes = new Uint8Array(len);
+    for (let i = 0; i < len; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+    }
+    return bytes.buffer;
+};
+/**
+ * Very small heuristic to detect a plain base64 string
+ */
+const isBase64 = (value) => /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/.test(value);
+/**
+ * ResolvePDFSource
+ *
+ * Accepts a source that may be:
+ *  - a plain base64 string (PDF binary encoded as base64)
+ *  - a data: URL containing base64 (data:application/pdf;base64,...)
+ *  - an existing blob: URL (blob:...)
+ *  - a Blob/File object
+ *  - a regular URL string (http(s) or same-origin path)
+ *
+ * Returns a SourceDeterminer:
+ *  - { isBase64Source: true, source: string } when an object URL was created
+ *  - { isBase64Source: false, source: string } when source can be used directly
+ *
+ * If an object URL is created, callers should revoke it when no longer needed:
+ *  `URL.revokeObjectURL(source)`
+ */
+const ResolvePDFSource = (source) => {
+    // Nothing provided
+    if (source === undefined || source === null || source === "") {
+        return { isBase64Source: false, source: "" };
+    }
+    // If source is already a Blob (File), create an object URL
+    if (typeof source.arrayBuffer === "function" ||
+        source instanceof Blob) {
+        const blob = source;
+        const objectUrl = URL.createObjectURL(blob);
+        return { isBase64Source: true, source: objectUrl };
+    }
+    // If source is a string:
+    if (typeof source === "string") {
+        // If it's already a blob URL, return as-is
+        if (source.startsWith("blob:")) {
+            return { isBase64Source: false, source };
+        }
+        // If it's a data URL (data:application/pdf;base64,....)
+        if (source.startsWith("data:")) {
+            // data:[<mediatype>][;base64],<data>
+            const commaIndex = source.indexOf(",");
+            if (commaIndex > -1) {
+                const meta = source.substring(0, commaIndex);
+                const dataPart = source.substring(commaIndex + 1);
+                // If it contains base64 marker, decode accordingly
+                if (meta.indexOf(";base64") !== -1) {
+                    try {
+                        const arrayBuffer = _base64ToArrayBuffer(dataPart);
+                        const blob = new Blob([arrayBuffer], { type: "application/pdf" });
+                        const objectUrl = URL.createObjectURL(blob);
+                        return { isBase64Source: true, source: objectUrl };
+                    }
+                    catch (err) {
+                        console.error("ResolvePDFSource: failed to convert data: URL to blob", err);
+                        // fallback to returning original data URL
+                        return { isBase64Source: false, source };
+                    }
+                }
+                else {
+                    // Not base64-encoded data URL — return as is
+                    return { isBase64Source: false, source };
+                }
+            }
+        }
+        // If it's a plain base64 string (no data: prefix), convert
+        if (isBase64(source)) {
+            try {
+                const arrayBuffer = _base64ToArrayBuffer(source);
+                const blob = new Blob([arrayBuffer], { type: "application/pdf" });
+                const objectUrl = URL.createObjectURL(blob);
+                return { isBase64Source: true, source: objectUrl };
+            }
+            catch (err) {
+                console.error("ResolvePDFSource: failed to convert base64 to blob", err);
+                return { isBase64Source: false, source };
+            }
+        }
+        // Otherwise treat as a normal URL (http(s) or same-origin path)
+        return { isBase64Source: false, source };
+    }
+    // Fallback: convert to string
+    try {
+        const asString = String(source);
+        return { isBase64Source: false, source: asString };
+    }
+    catch (err) {
+        console.error("ResolvePDFSource: failed to convert source to string", err);
+        return { isBase64Source: false, source: "" };
+    }
+};
+
 const PDFViewer = (props) => {
     const viewerRef = React.useRef(null);
-    const { iframeId, src, viewerLocation, documentName, documentNameColour, backend, toolbar = "minimal", additionalBackendAttributes, ...attributes } = props;
+    const { iframeId, src, viewerLocation, documentName, documentNameColour, backend, toolbar = "minimal", additionalBackendAttributes, 
+    // optional: lets callers skip client-side fetch for remote resources
+    disableClientFetch = false, ...attributes } = props;
     const [loading, setLoading] = React.useState(false);
+    // ref for object URL (either created by ResolvePDFSource or by us after fetching)
+    const objectUrlRef = React.useRef(null);
+    // did ResolvePDFSource create the object URL? (helps understanding where to revoke)
+    const createdByResolveRef = React.useRef(false);
+    // fetch abort controller for cross-origin remote fetches
+    const fetchControllerRef = React.useRef(null);
+    const isRemoteUrl = (url) => {
+        if (!url)
+            return false;
+        // Check if it's an HTTP(S) URL
+        return /^https?:\/\//i.test(url);
+    };
     React.useEffect(() => {
+        let mounted = true;
         setLoading(true);
         const element = viewerRef.current;
-        if (!element)
-            return; // Guard against null
-        const jsProps = {
-            iframeId,
-            source: src,
-            viewerLocation,
-            documentName,
-            documentNameColour,
-            element,
-            toolbar,
-            ...additionalBackendAttributes,
+        if (!element) {
+            setLoading(false);
+            return;
+        }
+        // cleanup previous URL/fetch if any
+        if (fetchControllerRef.current) {
+            try {
+                fetchControllerRef.current.abort();
+            }
+            catch (err) {
+                console.error("PDFViewer: fetch abort error:", err);
+                /* ignore */
+            }
+            fetchControllerRef.current = null;
+        }
+        if (objectUrlRef.current) {
+            try {
+                URL.revokeObjectURL(objectUrlRef.current);
+            }
+            catch (err) {
+                console.error("PDFViewer: revokeObjectURL error:", err);
+            }
+            objectUrlRef.current = null;
+            createdByResolveRef.current = false;
+        }
+        const init = async () => {
+            let sourceToUse = src;
+            // 1) Let ResolvePDFSource handle base64/data/blob inputs synchronously.
+            try {
+                const resolved = ResolvePDFSource(src);
+                if (resolved?.source) {
+                    sourceToUse = resolved.source;
+                    if (resolved.isBase64Source) {
+                        // ResolvePDFSource created an object URL for us (data/blob/base64)
+                        objectUrlRef.current = resolved.source;
+                        createdByResolveRef.current = true;
+                    }
+                }
+            }
+            catch (err) {
+                // If ResolvePDFSource throws, just ignore and fall back to src
+                console.error("PDFViewer: ResolvePDFSource error:", err);
+            }
+            // 2) If ResolvePDFSource didn't create an object URL and the src is cross-origin HTTP(S),
+            //    attempt a client-side fetch to create an object URL (so viewer can load it safely).
+            if (!objectUrlRef.current &&
+                !disableClientFetch &&
+                typeof src === "string" &&
+                /^https?:\/\//i.test(src) &&
+                isRemoteUrl(src)) {
+                const controller = new AbortController();
+                fetchControllerRef.current = controller;
+                try {
+                    const resp = await fetch(src, {
+                        signal: controller.signal,
+                        credentials: "omit",
+                    });
+                    if (resp.ok) {
+                        const blob = await resp.blob();
+                        if (blob && blob.size > 0) {
+                            const obj = URL.createObjectURL(blob);
+                            objectUrlRef.current = obj;
+                            createdByResolveRef.current = false; // we created it via fetch
+                            sourceToUse = obj;
+                        }
+                        else {
+                            console.warn("PDFViewer: fetched blob is empty - falling back to original src");
+                        }
+                    }
+                    else {
+                        console.warn(`PDFViewer: fetch returned ${resp.status} ${resp.statusText} for ${src}`);
+                        // fallback: keep using original src
+                    }
+                }
+                catch (err) {
+                    if (err instanceof Error && err.name === "AbortError") {
+                        // aborted, nothing to do
+                        if (!mounted)
+                            return;
+                    }
+                    else {
+                        console.error("PDFViewer: error fetching cross-origin PDF:", err);
+                    }
+                    // fallback to source as-is (original remote URL)
+                }
+            }
+            // 3) Prepare and call backend
+            if (!mounted)
+                return;
+            const jsProps = {
+                iframeId,
+                source: sourceToUse,
+                viewerLocation,
+                documentName,
+                documentNameColour,
+                element,
+                toolbar,
+                ...additionalBackendAttributes,
+            };
+            try {
+                backend(jsProps);
+            }
+            catch (err) {
+                console.error("PDFViewer: backend threw an error:", err);
+            }
+            finally {
+                if (mounted)
+                    setLoading(false);
+            }
+        }; // end init
+        init();
+        return () => {
+            mounted = false;
+            // cancel any ongoing fetch
+            if (fetchControllerRef.current) {
+                try {
+                    fetchControllerRef.current.abort();
+                }
+                catch (err) {
+                    console.error("PDFViewer: fetch abort error during cleanup:", err);
+                }
+                fetchControllerRef.current = null;
+            }
+            // revoke any object URL we created
+            if (objectUrlRef.current) {
+                try {
+                    URL.revokeObjectURL(objectUrlRef.current);
+                }
+                catch (err) {
+                    console.error("PDFViewer: fetch abort error during cleanup:", err);
+                }
+                objectUrlRef.current = null;
+                createdByResolveRef.current = false;
+            }
+            // Note: PDFViewerBackend also attaches an iframe to the element. If backend does not
+            // remove previous iframes, you might want to clear element.children here.
         };
-        backend(jsProps);
-        setLoading(false);
-    }, []);
+        // re-run when these inputs change
+    }, [
+        src,
+        iframeId,
+        viewerLocation,
+        documentName,
+        documentNameColour,
+        toolbar,
+        backend,
+        disableClientFetch,
+    ]);
     return (jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [loading && jsxRuntime.jsx(Loading, { message: "Loading PDF Document" }), jsxRuntime.jsx("div", { ref: viewerRef, id: `viewer ${documentName ? Slugify(documentName) : ""}`, "data-testid": `viewer ${documentName ? Slugify(documentName) : ""}`, style: { width: "100%", height: "100%" }, ...attributes })] }));
 };
 
@@ -1066,27 +1375,6 @@ const ObjectToQueryString = (queryParameters) => {
         : "";
 };
 
-const _base64ToArrayBuffer = (base64) => {
-    const binaryString = window.atob(base64);
-    const len = binaryString.length;
-    const bytes = new Uint8Array(len);
-    for (let i = 0; i < len; i++) {
-        bytes[i] = binaryString.charCodeAt(i);
-    }
-    return bytes.buffer;
-};
-const isBase64 = (value) => /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/.test(value);
-const ResolvePDFSource = (source) => {
-    const isBase64Source = isBase64(source);
-    if (!isBase64Source) {
-        return { isBase64Source, source };
-    }
-    const blob = new Blob([_base64ToArrayBuffer(source)], {
-        type: "application/pdf",
-    });
-    return { isBase64Source, source: URL.createObjectURL(blob) };
-};
-
 const PDFViewerBackend = ({ iframeId, source, viewerLocation = "/pdfjs-4.4.168-dist/web/viewer.html", documentName, documentNameColour = "black", toolbar = "minimal", element, ...remaining }) => {
     const sourceDeterminer = ResolvePDFSource(source);
     const iframe = document.createElement("iframe");
@@ -1103,6 +1391,8 @@ const PDFViewerBackend = ({ iframeId, source, viewerLocation = "/pdfjs-4.4.168-d
     iframe.src = `${viewerLocation}${queryString}`;
     iframe.style.width = "100%";
     iframe.style.height = "94%";
+    iframe.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms allow-downloads");
+    iframe.setAttribute("allow", "cross-origin-isolated");
     if (sourceDeterminer.isBase64Source) {
         iframe.addEventListener("beforeunload", (event) => {
             event.preventDefault();
@@ -1326,11 +1616,14 @@ exports.ConfigureOverallAccordion = ConfigureOverallAccordion;
 exports.ConfigureOverallButton = ConfigureOverallButton;
 exports.ConfigureOverallCheckboxes = ConfigureOverallCheckboxes;
 exports.ConfigureOverallErrorSummary = ConfigureOverallErrorSummary;
+exports.ConfigureOverallExitThisPage = ConfigureOverallExitThisPage;
 exports.ConfigureOverallHeader = ConfigureOverallHeader;
+exports.ConfigureOverallPasswordInput = ConfigureOverallPasswordInput;
 exports.ConfigureOverallRadios = ConfigureOverallRadios;
 exports.ConfigureOverallSkipLink = ConfigureOverallSkipLink;
 exports.ConfigureOverallTabs = ConfigureOverallTabs;
 exports.CookieBanner = CookieBanner;
+exports.DOTS = DOTS;
 exports.DataNavigation = DataNavigation;
 exports.DateInput = DateInput;
 exports.Details = Details;
@@ -1338,6 +1631,7 @@ exports.DifferenceNavigation = DifferenceNavigation;
 exports.ErrorBoundary = ErrorBoundary;
 exports.ErrorMessage = ErrorMessage;
 exports.ErrorSummary = ErrorSummary;
+exports.ExitThisPage = ExitThisPage;
 exports.ExtractAccordionConfigFromAttributes = ExtractAccordionConfigFromAttributes;
 exports.Fieldset = Fieldset;
 exports.FileUpload = FileUpload;
@@ -1357,6 +1651,7 @@ exports.PDFViewer = PDFViewer;
 exports.PDFViewerBackend = PDFViewerBackend;
 exports.Pagination = Pagination;
 exports.Panel = Panel;
+exports.PasswordInput = PasswordInput;
 exports.PhaseBanner = PhaseBanner;
 exports.ProblemWithService = ProblemWithService;
 exports.Radios = Radios;
@@ -1369,6 +1664,7 @@ exports.Tabs = Tabs;
 exports.Tag = Tag;
 exports.TaskList = TaskList;
 exports.Textarea = Textarea;
+exports.UsePagination = UsePagination;
 exports.WarningInfo = WarningInfo;
 exports.WarningText = WarningText;
 //# sourceMappingURL=index.cjs.js.map