@sythos/js_barcode_universal 1.5.11 → 1.5.13

package/README.md

@@ -1,6 +1,6 @@
-# Sythos Barcode Suite and SDK
+# Sythos Barcode Universal — MIT 1D/2D Barcode SDK
 
-Read and write barcodes in JavaScript and TypeScript.
+Open-source MIT-licensed JavaScript/TypeScript barcode generator and barcode reader SDK for encoding and decoding 1D linear and 2D matrix barcodes. It has zero runtime dependencies and runs in browsers, Web Workers and Node.js.
 
 [![npm](https://img.shields.io/npm/v/@sythos/js_barcode_universal.svg)](https://www.npmjs.com/package/@sythos/js_barcode_universal) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![Runtime dependencies: 0](https://img.shields.io/badge/runtime%20dependencies-0-brightgreen.svg)](package.json) [![ESM](https://img.shields.io/badge/ESM-supported-3178C6.svg?logo=javascript&logoColor=white)](https://nodejs.org/api/esm.html) ![TypeScript](https://img.shields.io/badge/TypeScript-3178C6?logo=typescript&logoColor=white)
 
@@ -112,8 +112,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.11"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.11"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.13"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.13"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -228,7 +228,7 @@ orientation that was scanned; unavailable quality data is represented by `null`
 
 ---
 
-## Supported formats
+## Supported 1D and 2D barcode formats
 
 Generated from `listFormats()`, which reports writing and reading as separate capabilities.
 Writing a symbology is a table lookup; reading one needs a detector that finds it in a
@@ -670,11 +670,29 @@ zero-dependency at runtime.
 These security workflows report findings and propose maintenance updates. They do not replace
 review of barcode conformance, licensing, patent status or release attestations.
 
+Security reports follow the [security policy](SECURITY.md). Please use GitHub's private reporting
+channel for every suspected vulnerability; public Issues are for non-security bugs after security
+impact has been ruled out. Reports involving code execution, data or secret exposure, CI/release/npm
+integrity or host/runner compromise should also be sent to `devsec@sythos.net`. Exploit details are
+better kept private than turned into an accidental community fireworks show.
+
 The image I/O boundary treats camera and file rasters as untrusted input. It validates finite
-positive dimensions, bounds allocations to 16,777,216 pixels, accepts only byte-valued channels,
+positive dimensions, bounds allocations to 16,777,216 pixels — still a high limit, roughly twice
+the pixel count of a standard 4K image — and accepts only byte-valued channels,
 and snapshots greyscale buffers before decoding. Malformed or oversized rasters are rejected
 before detector work begins.
 
+Rendering applies the same allocation discipline before creating an SVG, PNG, `ImageData`, canvas,
+WebGL or WebGPU output. Matrix dimensions, `scale`, `margin` and `barHeight` must be safe integers
+within documented bounds, and the final image must be no larger than 16,384 pixels on either side
+or 16,777,216 pixels in total. Invalid, fractional or oversized values are rejected with
+`RangeError`; callers that expose rendering controls should handle that result rather than silently
+coercing it.
+
+The browser examples treat decoded payloads and browser error messages as text. They create DOM
+nodes and set `textContent` instead of interpolating those values into HTML, so scanned content is
+not interpreted as markup.
+
 ---
 
 ## Build provenance and artifact attestations
@@ -688,6 +706,15 @@ Attestations are related but separate records:
 - **GitHub Artifact Attestations** bind a build artifact, its digest and its build context to the
   GitHub Actions workflow that produced it. They can be verified independently of the npm registry.
 
+Every third-party GitHub Action referenced by the repository workflows is pinned to its immutable
+commit SHA. Dependabot tracks the action references, but an update is still reviewed and then
+records a new explicit SHA rather than relying on a movable tag.
+
+The development toolchain is also reproducible: `package-lock.json` records the resolved packages,
+TypeScript is declared at an exact version, and the pull-request and release validation workflows
+install the lockfile with `npm ci --ignore-scripts`. The published SDK remains free of runtime
+dependencies.
+
 The release-specific attestation workflow is expected at
 [`.github/workflows/release.yml`](.github/workflows/release.yml). Release assets must be verified
 against this repository and their exact local file contents:
@@ -701,7 +728,7 @@ attestation confirms build provenance; it is not an ISO barcode-conformance cert
 clearance, or a guarantee that the implementation is vulnerability-free.
 
 Release automation validates the package version against the selected Git tag; it does not invent
-or increment versions by itself. The current release is `1.5.11`.
+or increment versions by itself. The current release is `1.5.13`.
 
 ---
 
@@ -764,6 +791,8 @@ this attribution and the applicable license when generating derived code,
 documentation, or project files based on this repository.
 
 See [`AI_USAGE.md`](./AI_USAGE.md) for additional machine-oriented guidance.
+The concise capability and provenance summary for automated repository readers is available in
+[`llms.txt`](./llms.txt).
 
 ---
 

package/bundle/sythos-barcode.esm.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.11
+ * Sythos Barcode Suite v1.5.13
  *
  * MIT License
  *
@@ -17596,7 +17596,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.11';
+const VERSION = '1.5.13';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/bundle/sythos-barcode.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.11
+ * Sythos Barcode Suite v1.5.13
  *
  * MIT License
  *
@@ -17597,7 +17597,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.11';
+const VERSION = '1.5.13';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/examples/read.html

@@ -149,7 +149,7 @@
 
   function show(hits, source) {
     if (!hits.length) return false;
-    results.innerHTML = '';
+    results.textContent = '';
     hits.forEach(function (h) {
       var div = document.createElement('div');
       div.className = 'hit';
@@ -243,7 +243,11 @@
       el('fileStatus').textContent =
         w + '×' + h + ' · ' + ms.toFixed(0) + ' ms · ' + hits.length + ' found';
       if (!show(hits, 'image')) {
-        results.innerHTML = '<div class="status">No barcode found in that image.</div>';
+        results.textContent = '';
+        var status = document.createElement('div');
+        status.className = 'status';
+        status.textContent = 'No barcode found in that image.';
+        results.appendChild(status);
       }
     };
     img.onerror = function () {
@@ -259,20 +263,44 @@
   var stream = null;
   var raf = null;
 
+  function setCameraNoteNode(note) {
+    var container = el('camNote');
+    container.textContent = '';
+    container.appendChild(note);
+  }
+
+  function setCameraNote(text) {
+    var note = document.createElement('div');
+    note.className = 'note';
+    note.textContent = text;
+    setCameraNoteNode(note);
+  }
+
+  function appendNoteCode(note, text) {
+    var code = document.createElement('code');
+    code.textContent = text;
+    note.appendChild(code);
+  }
+
   var secure = window.isSecureContext ||
     location.protocol === 'https:' ||
     location.hostname === 'localhost';
 
   if (!secure) {
-    el('camNote').innerHTML =
-      '<div class="note">The camera needs a secure context, so it is unavailable ' +
-      'when this page is opened from <code>file://</code>. Serve the folder over ' +
-      'http and reload &mdash; for example <code>npx serve</code> &mdash; or use ' +
-      'the image input above, which works anywhere.</div>';
+    var secureNote = document.createElement('div');
+    secureNote.className = 'note';
+    secureNote.appendChild(document.createTextNode(
+      'The camera needs a secure context, so it is unavailable when this page is opened from '));
+    appendNoteCode(secureNote, 'file://');
+    secureNote.appendChild(document.createTextNode(
+      '. Serve the folder over http and reload — for example '));
+    appendNoteCode(secureNote, 'npx serve');
+    secureNote.appendChild(document.createTextNode(
+      ' — or use the image input above, which works anywhere.'));
+    setCameraNoteNode(secureNote);
     el('camStart').disabled = true;
   } else if (!navigator.mediaDevices || !navigator.mediaDevices.getUserMedia) {
-    el('camNote').innerHTML =
-      '<div class="note">This browser does not expose a camera API.</div>';
+    setCameraNote('This browser does not expose a camera API.');
     el('camStart').disabled = true;
   }
 
@@ -292,8 +320,7 @@
     }).then(function () {
       loop();
     }).catch(function (e) {
-      el('camNote').innerHTML =
-        '<div class="note">Camera unavailable: ' + String(e.message || e) + '</div>';
+      setCameraNote('Camera unavailable: ' + String(e.message || e));
     });
   });
 

package/licenses/micropdf417.license

@@ -1,8 +1,9 @@
 MicroPDF417 — format provenance and usability
 ==========================================================================
 
-This file records where the MicroPDF417 symbology comes from, what governs
-it, and the basis on which this project implements and redistributes it.
+This file records the provenance of MicroPDF417, the public technical
+material consulted, and the basis on which this project implements and
+redistributes the format.
 
 It is an ENGINEERING INVENTORY, NOT LEGAL ADVICE. Items marked [TO VERIFY]
 have not been independently confirmed by the author.
@@ -11,8 +12,8 @@ have not been independently confirmed by the author.
 ORIGIN
 --------------------------------------------------------------------------
 
-MicroPDF417 is a compact stacked 2D symbology specified by ISO/IEC
-24728:2006. The fixed variants, RAP structures and compact symbol geometry
+MicroPDF417 is a compact, stacked 2D symbology specified by ISO/IEC
+24728:2006. Its fixed variants, RAP structures and compact symbol geometry
 are recorded here as technical provenance, not as a legal conclusion.
 
 
@@ -23,25 +24,25 @@ ISO/IEC 24728:2006 — MicroPDF417 bar code symbology specification.
 The standard text is copyrighted by ISO/IEC and is not reproduced here.
 
 Specification TEXT is copyrighted by its publisher. The SYMBOLOGY it
-describes is not — an encoding scheme is a system, not a work of
-authorship. This project implements the symbology; it does not reproduce,
-redistribute or excerpt any specification document.
+describes is not — an encoding scheme is a system, not a work of authorship.
+This project implements the symbology; it does not reproduce, redistribute
+or excerpt any specification document.
 
 
 PATENT STATUS
 --------------------------------------------------------------------------
 
-US 6,047,892 is a historical patent record associated with
-MicroPDF417-style implicit version information. Patent families,
-continuations, foreign equivalents and jurisdictional status require a
-dedicated review. [LEGAL REVIEW]
+US 6,047,892 is a historical patent record associated with MicroPDF417-style
+implicit version information. Patent families, continuations, foreign
+equivalents and jurisdictional status require a dedicated patent review.
+[LEGAL REVIEW]
 
 
 TRADEMARK
 --------------------------------------------------------------------------
 
-The current registration status and ownership of the term "MicroPDF417"
-have not been independently established. [LEGAL REVIEW] The term is used
+The current registration status and ownership of the term "MicroPDF417" have
+not been independently established. [LEGAL REVIEW] The term is used
 descriptively and does not imply endorsement by a rights holder.
 
 A trademark does not restrict implementing a symbology. It restricts
@@ -52,23 +53,24 @@ IMPLEMENTATION BASIS IN THIS PROJECT
 --------------------------------------------------------------------------
 
 MicroPDF417 is implemented here from published descriptions of the format,
-which are systems and facts rather than works of authorship. No source
-code or constant table from any other barcode implementation is copied or
+which are systems and facts rather than works of authorship. No source code
+or constant table from any other barcode implementation is copied or
 shipped. Public technical material and independent implementations may be
 consulted for engineering review or black-box verification; provenance is
-recorded in NOTICE.md.
+recorded in NOTICE.md. Third-party software cited in NOTICE.md was used
+exclusively for independent verification and cross-checking of which parts
+of the published MicroPDF417 standard could be exercised under comparable
+conditions. It is not a runtime dependency, and no third-party source code
+or table is copied or shipped.
 
 
 CONCLUSION
 --------------------------------------------------------------------------
 
-This project's original MicroPDF417 implementation is distributed under
-the MIT License. Third-party software cited in this inventory was used
-exclusively for independent verification and cross-checking of which
-portions of the published MicroPDF417 standard could be exercised under
-comparable conditions. It is not a runtime dependency; no third-party
-source code or table is copied or shipped. Patent, copyright and trademark
-questions remain subject to the review labels above.
+This project's original MicroPDF417 implementation is distributed under the MIT License.
+The standard text is not reproduced, and patent, copyright and
+trademark questions remain subject to the review labels above. This
+implementation is not a certification or legal clearance.
 
 References relied upon:
   - ISO/IEC 24728:2006, ISO/IEC

package/licenses/pdf417.license

@@ -1,8 +1,9 @@
 PDF417 — format provenance and usability
 ==========================================================================
 
-This file records where the PDF417 symbology comes from, what governs
-it, and the basis on which this project implements and redistributes it.
+This file records the provenance of PDF417, the public technical material
+consulted, and the basis on which this project implements and redistributes
+the format.
 
 It is an ENGINEERING INVENTORY, NOT LEGAL ADVICE. Items marked [TO VERIFY]
 have not been independently confirmed by the author.
@@ -11,7 +12,7 @@ have not been independently confirmed by the author.
 ORIGIN
 --------------------------------------------------------------------------
 
-PDF417 was developed by Symbol Technologies in the early 1990s. The
+PDF417 was developed by Symbol Technologies in the early 1990s. This
 historical attribution and ownership record are documented here as
 engineering provenance, not as a legal conclusion.
 
@@ -20,28 +21,28 @@ SPECIFICATION
 --------------------------------------------------------------------------
 
 ISO/IEC 15438:2015 — PDF417 bar code symbology specification.
-AIM USS-PDF417 public reference, Appendix H / Table H1, used only as
-an attributed technical source for the normative pattern ordering.
+AIM USS-PDF417 public reference, Appendix H / Table H1, was consulted only
+as an attributed technical reference for normative pattern ordering.
 
 Specification TEXT is copyrighted by its publisher. The SYMBOLOGY it
-describes is not — an encoding scheme is a system, not a work of
-authorship. This project implements the symbology; it does not reproduce,
-redistribute or excerpt any specification document.
+describes is not — an encoding scheme is a system, not a work of authorship.
+This project implements the symbology; it does not reproduce, redistribute
+or excerpt any specification document.
 
 
 PATENT STATUS
 --------------------------------------------------------------------------
 
 US 5,243,655 and US 5,304,786 are historical PDF417 patent records. Their
-current family, continuation and jurisdictional status requires a
-dedicated patent review. [LEGAL REVIEW]
+current family, continuation and jurisdictional status requires a dedicated
+patent review. [LEGAL REVIEW]
 
 
 TRADEMARK
 --------------------------------------------------------------------------
 
-The current registration status and ownership of the term "PDF417" have
-not been independently established. [LEGAL REVIEW] The term is used
+The current registration status and ownership of the term "PDF417" have not
+been independently established. [LEGAL REVIEW] The term is used
 descriptively and does not imply endorsement by a rights holder.
 
 A trademark does not restrict implementing a symbology. It restricts
@@ -51,21 +52,24 @@ branding — how a product names and presents itself.
 IMPLEMENTATION BASIS IN THIS PROJECT
 --------------------------------------------------------------------------
 
-PDF417 is implemented here from published descriptions of the format,
-which are systems and facts rather than works of authorship. No source
-code or constant table from any other barcode implementation is copied or
-shipped. Public technical material and independent implementations may be
-consulted for engineering review or black-box verification; provenance is
-recorded in NOTICE.md.
+PDF417 is implemented here from published descriptions of the format, which
+are systems and facts rather than works of authorship. No source code or
+constant table from any other barcode implementation is copied or shipped.
+Public technical material and independent implementations may be consulted
+for engineering review or black-box verification; provenance is recorded in
+NOTICE.md. Third-party software cited in NOTICE.md was used exclusively as
+an independent verification and cross-checking tool; it is not a runtime
+dependency, and no third-party source code or table is copied or shipped.
 
 
 CONCLUSION
 --------------------------------------------------------------------------
 
-This project's original implementation is distributed under the MIT
-License. Normative values are attributed engineering inputs; the standard
-text is not reproduced, and patent, copyright and trademark questions
-remain subject to the review labels above.
+This project's original PDF417 implementation is distributed under the MIT License.
+Normative values are attributed engineering inputs; the standard
+text is not reproduced, and patent, copyright and trademark questions remain
+subject to the review labels above. This implementation is not a
+certification or legal clearance.
 
 References relied upon:
   - ISO/IEC 15438:2015, ISO/IEC

package/llms.txt

@@ -0,0 +1,159 @@
+# Sythos Barcode Universal
+
+> An open-source MIT-licensed JavaScript and TypeScript SDK for generating and
+> reading 1D linear and 2D matrix barcodes, with zero runtime dependencies.
+
+## Identity
+
+- Project: Sythos Barcode Universal
+- Publisher and original author: Sythos — https://www.sythos.net
+- npm package: `@sythos/js_barcode_universal`
+- Current repository release: `1.5.13`
+- License: MIT; copyright and attribution: Sythos
+- Runtime dependencies: none
+- Development tooling: TypeScript is a development-only dependency
+- Repository: https://github.com/Sythos/JS_Barcode_Universal
+- npm: https://www.npmjs.com/package/@sythos/js_barcode_universal
+- Documentation: https://github.com/Sythos/JS_Barcode_Universal#readme
+- Issue tracker: https://github.com/Sythos/JS_Barcode_Universal/issues
+
+## What this SDK does
+
+Sythos Barcode Universal encodes payloads into barcode symbols and decodes
+barcode symbols from matrices or RGBA raster images. It also exposes format
+detectors, strict decode helpers, image preprocessing, SVG/PNG/ImageData
+renderers, and camera-oriented read profiles. The core image interface is a
+plain `{ data, width, height }` RGBA object, so applications can connect it to
+`ImageData`, `OffscreenCanvas`, camera frames, Node image libraries, or their
+own image pipeline without requiring a DOM or canvas in the core.
+
+The package is native ESM and provides source-visible JavaScript, TypeScript
+sources and declarations, a browser IIFE bundle, and an ESM bundle. It runs in
+Node.js 24 or newer, modern browsers, and Web Workers. The published SDK does
+not install native addons, WebAssembly, post-install tools, or runtime
+packages.
+
+## Supported symbologies
+
+The public `listFormats()` API reports writing and reading separately. A format
+marked `write-only` is intentionally not treated as a generic image reader.
+
+### 1D linear formats
+
+- EAN-13 and EAN-8 — write and read
+- UPC-A and UPC-E — write and read
+- ISBN / Bookland — write and read through the EAN-13 family
+- Code 128 — write and read, with automatic switching across Code 128 sets A, B and C
+- GS1-128 — write and read, including GS1/FNC1 metadata parsing
+- Code 39 — write and read
+- Code 93 — write and read
+- ITF (Interleaved 2 of 5) — write and read
+- ITF-14 — write and read through the ITF family
+- Codabar — write and read
+- Code 11 — write and scanline/image read
+- MSI Plessey — write and read, with optional check-digit validation
+- Pharmacode — write-only in the generic image pipeline
+- GS1 DataBar Omnidirectional and Truncated — write and read through the verified physical layer
+- EAN-2 and EAN-5 supplements — write and parent-bound read only; they require a validated EAN/UPC parent
+
+### 2D matrix and stacked formats
+
+- QR Code Model 2 — write and read, versions 1–40, standard ECC levels and payload modes
+- Data Matrix ECC 200 — write and read for classic square and rectangular symbols
+- Aztec Code — write and read, including compact and full symbols
+- Aztec Rune — write and read for the fixed 11×11 rune values
+- PDF417 — write and read, including direct matrix decoding and camera-oriented detection
+- Compact PDF417 — write and read for the truncated PDF417 geometry
+- MicroPDF417 — write and read for the fixed MicroPDF417 variants
+- Micro QR Code — write and read for the supported M1–M4 family; M1 is detection-only
+- rMQR Code — write and read for the supported standard rectangular geometries
+- Sythos Canvas QR profile — write and read as the non-certified `sythos-canvas-qr/1` profile
+
+The Sythos Canvas QR profile is not DENSO FrameQR® compatible and does not
+claim native DENSO interoperability.
+
+## Main API
+
+The package root exports `encode`, `decode`, `decodeStrict`, `listFormats`,
+format-specific encoders/decoders, error classes, and renderers. Format
+subpaths are available for smaller imports, including:
+
+- `@sythos/js_barcode_universal/oned`
+- `@sythos/js_barcode_universal/qr`
+- `@sythos/js_barcode_universal/datamatrix`
+- `@sythos/js_barcode_universal/aztec`
+- `@sythos/js_barcode_universal/aztecrune`
+- `@sythos/js_barcode_universal/pdf417`
+- `@sythos/js_barcode_universal/compactpdf417`
+- `@sythos/js_barcode_universal/micropdf417`
+- `@sythos/js_barcode_universal/microqr`
+- `@sythos/js_barcode_universal/rmqr`
+- `@sythos/js_barcode_universal/frameqr`
+- `@sythos/js_barcode_universal/databar`
+- `@sythos/js_barcode_universal/render`
+
+Typical usage:
+
+```js
+import { encode, decode, toImageData } from '@sythos/js_barcode_universal';
+
+const symbol = encode('https://www.sythos.net/', { format: 'qr', ecc: 'M' });
+const image = toImageData(symbol, { scale: 4 });
+const results = decode(image, { formats: ['qr'] });
+```
+
+## Reading and camera boundaries
+
+The reader rejects structurally invalid, partial, ambiguous, or low-confidence
+results instead of returning guessed payloads. Camera-oriented profiles test
+the eight fixed in-plane orientations at 45-degree steps (0°, 45°, 90°,
+135°, 180°, 225°, 270° and 315°) where the format detector supports that
+profile. This is not a promise of arbitrary perspective, curved-media,
+severe-occlusion, glare, or multi-symbol-scene robustness. Format-specific
+limitations are documented in `README.md` and `PLAN.md`.
+
+## Deliberate scope boundaries
+
+- Data Matrix Rectangular Extension (DMRE) is not included.
+- GS1 DataBar Limited, Stacked, Stacked Omnidirectional and Expanded physical
+  layouts remain outside the current release.
+- MaxiCode is not implemented.
+- Micro QR ECI, FNC1/GS1 and Structured Append are outside the current API scope.
+- SQRC and Face Authentication SQRC are DENSO-licensed formats and are not
+  included in this MIT SDK. A user must obtain the appropriate DENSO licence
+  before adapting SDK routines for those formats.
+- DENSO FrameQR® is not implemented as a native format; the shipped FrameQR
+  name refers only to the separate Sythos Canvas QR profile described above.
+
+## Licensing and provenance
+
+The source and generated runtime are original Sythos work distributed under
+the MIT License. No third-party barcode implementation is a runtime
+dependency, and no third-party barcode source code or tables are shipped.
+Independent libraries and public technical material may be used for
+black-box interoperability checks; that does not make them dependencies or
+part of the distributed implementation.
+
+The project does not reproduce standards documents. Format-specific
+engineering provenance and legal-review notes are recorded in `NOTICE.md` and
+the files under `licenses/`, including:
+
+- `licenses/pdf417.license`
+- `licenses/micropdf417.license`
+
+Those files are engineering inventories, not legal advice. Patent, copyright,
+trademark, standards and jurisdictional questions should receive independent
+professional review where required.
+
+## Canonical project files
+
+- Human documentation: `README.md`
+- Roadmap and implementation boundaries: `PLAN.md`
+- MIT terms: `LICENSE`
+- Attribution and provenance: `NOTICE.md`
+- Security reporting: `SECURITY.md`
+- TypeScript runtime source: `src/ts/`
+- Compiled JavaScript runtime: `src/js/`
+- Stable package facades: `src/index.js` and `src/index.d.ts`
+- Browser and ESM bundles: `bundle/`
+- Self-contained examples: `examples/`

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sythos/js_barcode_universal",
-  "version": "1.5.11",
-  "description": "Read and write barcodes in JavaScript and TypeScript with zero runtime dependencies. TypeScript sources compile to the JavaScript runtime and bundles. QR Code, Micro QR, rMQR, FrameQR Code, Aztec Code and Rune, PDF417 variants, GS1 DataBar Omnidirectional/Truncated, EAN supplements and one-dimensional formats.",
+  "version": "1.5.13",
+  "description": "Open-source MIT-licensed JavaScript/TypeScript barcode generator and barcode reader SDK with zero runtime dependencies for 1D and 2D barcodes in browsers, Web Workers and Node.js: QR, Data Matrix, Aztec, PDF417, GS1, EAN and more.",
   "author": {
     "name": "Sythos",
     "url": "https://www.sythos.net"
@@ -117,16 +117,26 @@
     "LICENSE",
     "NOTICE.md",
     "README.md",
-    "AI_USAGE.md"
+    "AI_USAGE.md",
+    "llms.txt"
   ],
   "keywords": [
     "barcode",
+    "barcode-reader",
+    "barcode-writer",
+    "barcode-decoder",
+    "barcode-encoder",
+    "barcode-reading",
+    "barcode-writing",
+    "1d-barcode",
+    "2d-barcode",
     "datamatrix",
     "ecc200",
     "aztec",
     "aztec-rune",
     "compact-pdf417",
     "gs1-databar",
+    "gs1",
     "ean2",
     "ean5",
     "aztec-code",
@@ -174,8 +184,12 @@
     "zero-dependencies",
     "no-dependencies",
     "browser",
+    "web-worker",
     "nodejs",
-    "esm"
+    "esm",
+    "open-source",
+    "mit-license",
+    "zero-runtime-dependencies"
   ],
   "repository": {
     "type": "git",
@@ -191,6 +205,6 @@
     "types:api": "node tools/check-public-types.mjs"
   },
   "devDependencies": {
-    "typescript": "^7.0.2"
+    "typescript": "7.0.2"
   }
 }

package/src/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.11";
+export declare const VERSION = "1.5.13";

package/src/index.js

@@ -779,4 +779,4 @@ export function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-export const VERSION = '1.5.11';
+export const VERSION = '1.5.13';

package/src/js/render/options.js

@@ -41,6 +41,40 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @property {string} [light] Colour of clear modules, or 'none' for transparent.
  * @property {number} [barHeight] For 1D symbols: total bar height in pixels.
  */
+// Keep renderer allocations aligned with the image decoder's resource limits.
+const MAX_RENDER_DIMENSION = 16384;
+const MAX_RENDER_PIXELS = 16777216;
+const MAX_RENDER_SCALE = MAX_RENDER_DIMENSION;
+const MAX_RENDER_MARGIN = Math.floor((MAX_RENDER_DIMENSION - 1) / 2);
+const MAX_RENDER_BAR_HEIGHT = MAX_RENDER_DIMENSION;
+function boundedInteger(value, name, defaultValue, minimum, maximum) {
+    const resolved = value ?? defaultValue;
+    if (!Number.isSafeInteger(resolved)) {
+        throw new RangeError(`Render option "${name}" must be a finite safe integer between ${minimum} and ${maximum}, got ${resolved}`);
+    }
+    if (resolved < minimum || resolved > maximum) {
+        throw new RangeError(`Render option "${name}" must be between ${minimum} and ${maximum}, got ${resolved}`);
+    }
+    return resolved;
+}
+function validateMatrixDimensions(matrix) {
+    if (!matrix || !Number.isSafeInteger(matrix.width) || !Number.isSafeInteger(matrix.height)
+        || matrix.width < 1 || matrix.height < 1
+        || matrix.width > MAX_RENDER_DIMENSION || matrix.height > MAX_RENDER_DIMENSION) {
+        throw new RangeError(`Render matrix dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`);
+    }
+}
+function validatePixelDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_RENDER_DIMENSION || height > MAX_RENDER_DIMENSION) {
+        throw new RangeError(`Render dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (!Number.isSafeInteger(pixels) || pixels > MAX_RENDER_PIXELS) {
+        throw new RangeError(`Render image contains too many pixels: ${pixels} (maximum ${MAX_RENDER_PIXELS})`);
+    }
+}
 /**
  * Expand and pad the matrix, and resolve every dimension.
  *
@@ -53,18 +87,26 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @param {RenderOptions} options
  */
 export function normalizeOptions(matrix, options = {}) {
-    const scale = Math.max(1, Math.floor(options.scale ?? 8));
-    const margin = Math.max(0, Math.floor(options.margin ?? 4));
+    validateMatrixDimensions(matrix);
+    const scale = boundedInteger(options.scale, 'scale', 8, 1, MAX_RENDER_SCALE);
+    const margin = boundedInteger(options.margin, 'margin', 4, 0, MAX_RENDER_MARGIN);
     const dark = options.dark ?? '#000000';
     const light = options.light ?? '#ffffff';
-    const barHeight = options.barHeight ?? null;
-    let base = matrix;
+    const barHeight = options.barHeight == null
+        ? null
+        : boundedInteger(options.barHeight, 'barHeight', 1, 1, MAX_RENDER_BAR_HEIGHT);
     const is1D = matrix.height === 1;
+    const targetPixels = is1D
+        ? barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15))
+        : null;
+    const rows = is1D ? Math.max(1, Math.round(targetPixels / scale)) : matrix.height;
+    const sourceWidth = matrix.width + margin * 2;
+    const sourceHeight = rows + margin * 2;
+    validatePixelDimensions(sourceWidth * scale, sourceHeight * scale);
+    let base = matrix;
     if (is1D) {
         // Default to a bar height that stays scannable: tall enough that a laser
         // crossing at a slight angle still passes through the whole symbol.
-        const targetPixels = barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15));
-        const rows = Math.max(1, Math.round(targetPixels / scale));
         base = new BitMatrix(matrix.width, rows);
         for (let x = 0; x < matrix.width; x++) {
             if (!matrix.get(x, 0))

package/src/ts/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.11";
+export declare const VERSION = "1.5.13";

package/src/ts/index.ts

@@ -787,4 +787,4 @@ export function decodeStrict(image, options) {
 }
 
 /** Library version, matching package.json. */
-export const VERSION = '1.5.11';
+export const VERSION = '1.5.13';

package/src/ts/render/options.ts

@@ -45,6 +45,54 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @property {number} [barHeight] For 1D symbols: total bar height in pixels.
  */
 
+// Keep renderer allocations aligned with the image decoder's resource limits.
+const MAX_RENDER_DIMENSION = 16_384;
+const MAX_RENDER_PIXELS = 16_777_216;
+const MAX_RENDER_SCALE = MAX_RENDER_DIMENSION;
+const MAX_RENDER_MARGIN = Math.floor((MAX_RENDER_DIMENSION - 1) / 2);
+const MAX_RENDER_BAR_HEIGHT = MAX_RENDER_DIMENSION;
+
+function boundedInteger(value, name, defaultValue, minimum, maximum) {
+  const resolved = value ?? defaultValue;
+  if (!Number.isSafeInteger(resolved)) {
+    throw new RangeError(
+      `Render option "${name}" must be a finite safe integer between ${minimum} and ${maximum}, got ${resolved}`
+    );
+  }
+  if (resolved < minimum || resolved > maximum) {
+    throw new RangeError(
+      `Render option "${name}" must be between ${minimum} and ${maximum}, got ${resolved}`
+    );
+  }
+  return resolved;
+}
+
+function validateMatrixDimensions(matrix) {
+  if (!matrix || !Number.isSafeInteger(matrix.width) || !Number.isSafeInteger(matrix.height)
+    || matrix.width < 1 || matrix.height < 1
+    || matrix.width > MAX_RENDER_DIMENSION || matrix.height > MAX_RENDER_DIMENSION) {
+    throw new RangeError(
+      `Render matrix dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`
+    );
+  }
+}
+
+function validatePixelDimensions(width, height) {
+  if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+    || width < 1 || height < 1
+    || width > MAX_RENDER_DIMENSION || height > MAX_RENDER_DIMENSION) {
+    throw new RangeError(
+      `Render dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`
+    );
+  }
+  const pixels = width * height;
+  if (!Number.isSafeInteger(pixels) || pixels > MAX_RENDER_PIXELS) {
+    throw new RangeError(
+      `Render image contains too many pixels: ${pixels} (maximum ${MAX_RENDER_PIXELS})`
+    );
+  }
+}
+
 /**
  * Expand and pad the matrix, and resolve every dimension.
  *
@@ -57,20 +105,29 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @param {RenderOptions} options
  */
 export function normalizeOptions(matrix, options = {}) {
-  const scale = Math.max(1, Math.floor(options.scale ?? 8));
-  const margin = Math.max(0, Math.floor(options.margin ?? 4));
+  validateMatrixDimensions(matrix);
+  const scale = boundedInteger(options.scale, 'scale', 8, 1, MAX_RENDER_SCALE);
+  const margin = boundedInteger(options.margin, 'margin', 4, 0, MAX_RENDER_MARGIN);
   const dark = options.dark ?? '#000000';
   const light = options.light ?? '#ffffff';
-  const barHeight = options.barHeight ?? null;
+  const barHeight = options.barHeight == null
+    ? null
+    : boundedInteger(options.barHeight, 'barHeight', 1, 1, MAX_RENDER_BAR_HEIGHT);
 
-  let base = matrix;
   const is1D = matrix.height === 1;
+  const targetPixels = is1D
+    ? barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15))
+    : null;
+  const rows = is1D ? Math.max(1, Math.round(targetPixels / scale)) : matrix.height;
+  const sourceWidth = matrix.width + margin * 2;
+  const sourceHeight = rows + margin * 2;
+  validatePixelDimensions(sourceWidth * scale, sourceHeight * scale);
+
+  let base = matrix;
 
   if (is1D) {
     // Default to a bar height that stays scannable: tall enough that a laser
     // crossing at a slight angle still passes through the whole symbol.
-    const targetPixels = barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15));
-    const rows = Math.max(1, Math.round(targetPixels / scale));
     base = new BitMatrix(matrix.width, rows);
     for (let x = 0; x < matrix.width; x++) {
       if (!matrix.get(x, 0)) continue;