@pdfme/common 5.5.9 → 5.5.10-dev.125

package/package.json

@@ -1,51 +1,47 @@
 {
   "name": "@pdfme/common",
-  "version": "5.5.9",
-  "sideEffects": false,
-  "author": "hand-dot",
-  "license": "MIT",
+  "version": "5.5.10-dev.125",
+  "description": "TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license!",
   "keywords": [
     "pdf",
-    "pdf-generation",
     "pdf-designer",
+    "pdf-generation",
     "pdf-viewer",
-    "typescript",
-    "react"
+    "react",
+    "typescript"
   ],
-  "description": "TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license!",
   "homepage": "https://pdfme.com",
+  "bugs": {
+    "url": "https://github.com/pdfme/pdfme/issues"
+  },
+  "license": "MIT",
+  "author": "hand-dot",
   "repository": {
     "type": "git",
     "url": "git@github.com:pdfme/pdfme.git"
   },
-  "bugs": {
-    "url": "https://github.com/pdfme/pdfme/issues"
-  },
-  "main": "dist/cjs/src/index.js",
-  "module": "dist/esm/src/index.js",
-  "types": "dist/types/src/index.d.ts",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": {
-        "node": "./dist/node/src/index.js",
-        "default": "./dist/esm/src/index.js"
-      },
-      "require": "./dist/cjs/src/index.js",
-      "types": "./dist/types/src/index.d.ts"
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
-    "dev": "node set-version.js && tsc -p tsconfig.esm.json -w",
-    "prebuild": "node set-version.js",
-    "build": "run-p build:cjs build:esm build:node",
-    "build:cjs": "tsc -p tsconfig.cjs.json",
-    "build:esm": "tsc -p tsconfig.esm.json",
-    "build:node": "tsc -p tsconfig.node.json",
+    "dev": "node set-version.js && vite build --watch",
+    "build": "node set-version.js && vite build && tsc -p tsconfig.build.json",
     "clean": "rimraf dist",
-    "lint": "eslint --ext .ts src --config eslint.config.mjs",
-    "test": "jest",
-    "prune": "ts-prune src",
-    "prettier": "prettier --write 'src/**/*.ts'"
+    "lint": "vp lint -c ../../.oxlintrc.json src",
+    "fmt": "vp fmt -c ../../.oxfmtrc.json src --write",
+    "test": "vitest run --config ../../vitest.config.ts"
   },
   "dependencies": {
     "@pdfme/pdf-lib": "*",
@@ -53,32 +49,11 @@
     "buffer": "^6.0.3",
     "zod": "^4.3.6"
   },
+  "devDependencies": {
+    "@types/estree": "^1.0.6"
+  },
   "peerDependencies": {
     "antd": "^5.11.2",
     "form-render": "^2.2.20"
-  },
-  "jest": {
-    "resolver": "ts-jest-resolver",
-    "moduleFileExtensions": [
-      "js",
-      "ts"
-    ],
-    "transform": {
-      "^.+\\.ts?$": [
-        "ts-jest",
-        {
-          "tsconfig": "tsconfig.esm.json"
-        }
-      ]
-    },
-    "testMatch": [
-      "**/*.test.ts"
-    ]
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "devDependencies": {
-    "@types/estree": "^1.0.6"
   }
 }

package/set-version.js

@@ -1,6 +1,9 @@
-const fs = require('fs');
-const path = require('path');
-const { execSync } = require('child_process');
+import fs from 'node:fs';
+import path from 'node:path';
+import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const updateVersion = (version) => {
   const filePath = path.join(__dirname, 'src/version.ts');
@@ -23,7 +26,9 @@ const updateVersion = (version) => {
 };
 
 try {
-  const gitTag = execSync('git describe --tags $(git rev-list --tags --max-count=1)', { encoding: 'utf8' }).trim();
+  const gitTag = execSync('git describe --tags $(git rev-list --tags --max-count=1)', {
+    encoding: 'utf8',
+  }).trim();
   updateVersion(gitTag);
 } catch (error) {
   console.error('Error replacing PDFME_VERSION:', error);

package/src/dynamicTemplate.ts

@@ -47,7 +47,9 @@ function normalizePageSchemas(
   const orderMap = new Map<string, number>();
 
   pageSchemas.forEach((schema, index) => {
-    const localY = schema.position.y - paddingTop;
+    // Guard against negative Y position when schema.y < paddingTop
+    // Prevents "Cannot read properties of undefined (reading 'push')" error
+    const localY = Math.max(0, schema.position.y - paddingTop);
     items.push({
       schema: cloneDeep(schema),
       baseY: localY,

package/src/expression.ts

@@ -45,9 +45,9 @@ const safeAssign = (
   if (target == null) {
     throw new TypeError('Cannot convert undefined or null to object');
   }
-  
+
   const to = { ...target };
-  
+
   for (const source of sources) {
     if (source != null) {
       for (const key in source) {
@@ -62,7 +62,7 @@ const safeAssign = (
       }
     }
   }
-  
+
   return to;
 };
 
@@ -134,7 +134,11 @@ const validateAST = (node: AcornNode): void => {
           throw new Error('Access to prohibited property');
         }
         // Block prototype pollution methods
-        if (['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__'].includes(propName)) {
+        if (
+          ['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__'].includes(
+            propName,
+          )
+        ) {
           throw new Error(`Access to prohibited method: ${propName}`);
         }
         const prohibitedMethods = ['toLocaleString', 'valueOf'];
@@ -283,7 +287,12 @@ const evaluateAST = (node: AcornNode, context: Record<string, unknown>): unknown
           throw new Error('Access to prohibited property');
         }
         // Block prototype pollution methods
-        if (typeof prop === 'string' && ['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__'].includes(prop)) {
+        if (
+          typeof prop === 'string' &&
+          ['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__'].includes(
+            prop,
+          )
+        ) {
           throw new Error(`Access to prohibited method: ${prop}`);
         }
         return obj[prop];

package/src/helper.ts

@@ -35,7 +35,10 @@ const uniq = <T>(array: Array<T>) => Array.from(new Set(array));
 export const getFallbackFontName = (font: Font) => {
   const initial = '';
   const fallbackFontName = Object.entries(font).reduce((acc, cur) => {
-    const [fontName, fontValue] = cur as [string, { data: string | ArrayBuffer | Uint8Array; fallback?: boolean; subset?: boolean }];
+    const [fontName, fontValue] = cur as [
+      string,
+      { data: string | ArrayBuffer | Uint8Array; fallback?: boolean; subset?: boolean },
+    ];
 
     return !acc && fontValue.fallback ? fontName : acc;
   }, initial);
@@ -127,6 +130,58 @@ export const getInputFromTemplate = (template: Template): { [key: string]: strin
   return [input];
 };
 
+export const isUrlSafeToFetch = (urlString: string): boolean => {
+  let parsed: URL;
+  try {
+    parsed = new URL(urlString);
+  } catch {
+    return false;
+  }
+
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    return false;
+  }
+
+  const hostname = parsed.hostname.toLowerCase();
+
+  if (
+    hostname === 'localhost' ||
+    hostname === '0.0.0.0' ||
+    hostname === '[::1]' ||
+    hostname === '::1'
+  ) {
+    return false;
+  }
+
+  // Block IPv6 private ranges (link-local, unique-local, IPv4-mapped)
+  const bare = hostname.replace(/^\[|\]$/g, '');
+  if (/^fe80:/i.test(bare)) return false;
+  if (/^f[cd]/i.test(bare)) return false;
+  const ipv4MappedMatch = bare.match(/^::ffff:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/i);
+  if (ipv4MappedMatch) {
+    const a = Number(ipv4MappedMatch[1]);
+    const b = Number(ipv4MappedMatch[2]);
+    if (a === 0 || a === 10 || a === 127) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 168) return false;
+  }
+
+  const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (ipv4Match) {
+    const a = Number(ipv4Match[1]);
+    const b = Number(ipv4Match[2]);
+    if (a === 0) return false;
+    if (a === 10) return false;
+    if (a === 127) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 168) return false;
+  }
+
+  return true;
+};
+
 export const getB64BasePdf = async (
   customPdf: ArrayBuffer | Uint8Array | string,
 ): Promise<string> => {
@@ -135,6 +190,11 @@ export const getB64BasePdf = async (
     !customPdf.startsWith('data:application/pdf;') &&
     typeof window !== 'undefined'
   ) {
+    if (!isUrlSafeToFetch(customPdf)) {
+      throw Error(
+        '[@pdfme/common] Invalid or unsafe URL for basePdf. Only http: and https: URLs pointing to public hosts are allowed.',
+      );
+    }
     const response = await fetch(customPdf);
     const blob = await response.blob();
     return blob2Base64Pdf(blob);
@@ -179,7 +239,10 @@ export const checkFont = (arg: { font: Font; template: Template }) => {
     template: { schemas },
   } = arg;
   const fontValues = Object.values(font);
-  const fallbackFontNum = fontValues.reduce((acc, cur) => (cur.fallback ? acc + 1 : acc), 0 as number);
+  const fallbackFontNum = fontValues.reduce(
+    (acc, cur) => (cur.fallback ? acc + 1 : acc),
+    0 as number,
+  );
   if (fallbackFontNum === 0) {
     throw Error(
       `[@pdfme/common] fallback flag is not found in font. true fallback flag must be only one.
@@ -213,7 +276,7 @@ export const checkPlugins = (arg: { plugins: Plugins; template: Template }) => {
   const allSchemaTypes = uniq(schemas.map((p) => p.map((v) => v.type)).flat());
 
   const pluginsSchemaTypes = Object.values(plugins).map((p) =>
-    p ? (p.propPanel.defaultSchema as Schema).type : undefined,
+    p ? p.propPanel.defaultSchema.type : undefined,
   );
 
   if (allSchemaTypes.some((s) => !pluginsSchemaTypes.includes(s))) {

package/src/index.ts

@@ -62,6 +62,7 @@ import {
   isHexValid,
   getInputFromTemplate,
   isBlankPdf,
+  isUrlSafeToFetch,
 } from './helper.js';
 import { getDynamicTemplate } from './dynamicTemplate.js';
 import { replacePlaceholders } from './expression.js';
@@ -100,6 +101,7 @@ export {
   checkDesignerProps,
   checkGenerateProps,
   pluginRegistry,
+  isUrlSafeToFetch,
 };
 
 export type {

package/src/types.ts

@@ -147,16 +147,15 @@ export interface PropPanel<T extends Schema> {
  * @property {string} [icon] Icon SVG for the plugin.
  * @property {boolean} [uninterruptedEditMode] When editing in the UI, should the field avoid re-rendering while in edit mode?
  */
-export type Plugin<T = Schema> = {
-  pdf: (arg: PDFRenderProps<T & Schema>) => Promise<void> | void;
-  ui: (arg: UIRenderProps<T & Schema>) => Promise<void> | void;
+export interface Plugin<T extends Schema = Schema> {
+  pdf(arg: PDFRenderProps<T & Schema>): Promise<void> | void;
+  ui(arg: UIRenderProps<T & Schema>): Promise<void> | void;
   propPanel: PropPanel<T & Schema>;
   icon?: string;
   uninterruptedEditMode?: boolean;
-};
+}
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export type Plugins = { [key: string]: Plugin<any> };
+export type Plugins = { [key: string]: Plugin };
 
 export interface PluginRegistry {
   plugins: { [key: string]: Plugin };
@@ -189,10 +188,10 @@ export type CustomPdf = z.infer<typeof CustomPdf>;
 export type Template = z.infer<typeof Template>;
 export type CommonOptions = z.infer<typeof CommonOptions>;
 export type GeneratorOptions = z.infer<typeof GeneratorOptions>;
-export type GenerateProps = z.infer<typeof GenerateProps> & { plugins?: Plugins };
+export type GenerateProps = Omit<z.infer<typeof GenerateProps>, 'plugins'> & { plugins?: Plugins };
 export type UIOptions = z.infer<typeof UIOptions> & { theme?: ThemeConfig };
-export type UIProps = z.infer<typeof UIProps> & { plugins?: Plugins };
-export type PreviewProps = z.infer<typeof PreviewProps> & { plugins?: Plugins };
-export type DesignerProps = z.infer<typeof DesignerProps> & { plugins?: Plugins };
+export type UIProps = Omit<z.infer<typeof UIProps>, 'plugins'> & { plugins?: Plugins };
+export type PreviewProps = Omit<z.infer<typeof PreviewProps>, 'plugins'> & { plugins?: Plugins };
+export type DesignerProps = Omit<z.infer<typeof DesignerProps>, 'plugins'> & { plugins?: Plugins };
 export type SchemaPageArray = z.infer<typeof SchemaPageArray>;
 export type LegacySchemaPageArray = z.infer<typeof LegacySchemaPageArray>;

package/src/version.ts

@@ -1 +1 @@
-export const PDFME_VERSION = '5.5.9';
+export const PDFME_VERSION = '5.5.10';

package/tsconfig.build.json

@@ -0,0 +1,14 @@
+{
+  "extends": "../../tsconfig.build.base.json",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationDir": "./dist",
+    "emitDeclarationOnly": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"]
+}

package/tsconfig.json

@@ -1,6 +1,16 @@
 {
-  "extends": "./tsconfig.esm",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "outDir": "./dist",
-  }
-}
+    "composite": true,
+    "declaration": true,
+    "declarationDir": "./dist/typecheck",
+    "emitDeclarationOnly": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "outDir": "./dist/typecheck",
+    "tsBuildInfoFile": "./dist/typecheck/tsconfig.tsbuildinfo",
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"],
+  "references": [{ "path": "../pdf-lib" }]
+}

package/vite.config.mts

@@ -0,0 +1,33 @@
+import { readFileSync } from 'node:fs';
+import { builtinModules } from 'node:module';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { defineConfig } from 'vite';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageJson = JSON.parse(readFileSync(resolve(__dirname, 'package.json'), 'utf8')) as {
+  dependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+};
+
+const external = [
+  ...builtinModules,
+  ...builtinModules.map((moduleName) => `node:${moduleName}`),
+  ...Object.keys(packageJson.dependencies ?? {}),
+  ...Object.keys(packageJson.peerDependencies ?? {}),
+];
+
+export default defineConfig({
+  build: {
+    lib: {
+      entry: resolve(__dirname, 'src/index.ts'),
+      fileName: 'index',
+      formats: ['es'],
+    },
+    minify: false,
+    outDir: 'dist',
+    rollupOptions: { external },
+    sourcemap: true,
+    target: 'es2020',
+  },
+});