@sythos/js_barcode_universal 1.5.13 → 1.5.14

package/README.md

@@ -112,8 +112,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.13"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.13"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.14"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.14"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -491,6 +491,23 @@ camera loop that decodes continuously from the video stream.
 
 ---
 
+## Documentation
+
+The full, searchable documentation lives on [GitHub Pages](https://sythos.github.io/JS_Barcode_Universal/)
+and is built from the checked-in [`docs/`](docs/) tree with MkDocs Material. It includes the
+[API reference](https://sythos.github.io/JS_Barcode_Universal/api/overview/),
+[format catalogue](https://sythos.github.io/JS_Barcode_Universal/formats/overview/),
+[camera and image guides](https://sythos.github.io/JS_Barcode_Universal/guides/camera-reading/),
+[practical recipes](https://sythos.github.io/JS_Barcode_Universal/examples/create-barcode/),
+[FAQ](https://sythos.github.io/JS_Barcode_Universal/faq/) and
+[troubleshooting](https://sythos.github.io/JS_Barcode_Universal/troubleshooting/).
+
+Every documentation change is checked for local links, navigation coverage and registry drift in
+CI before the Pages build is published. The compact README remains the versioned project
+overview; the Pages site is the place for the longer explanations and copy-ready examples.
+
+---
+
 ## API summary
 
 Two functions carry the whole surface. Everything else is a renderer or a format-specific escape
@@ -667,6 +684,33 @@ repository-level default setup.
 references weekly. Updates are repository-development controls only; the published SDK remains
 zero-dependency at runtime.
 
+The read-only quality gate in [`.github/workflows/pr-quality.yml`](.github/workflows/pr-quality.yml)
+runs for pull requests and pushes to `main`. Its Node jobs install the locked development toolchain
+with `npm ci --ignore-scripts --no-audit --no-fund`, then run ESLint, the TypeScript compiler and
+public-type checks, package-surface and zero-runtime-dependency checks, documentation checks and
+the workflow attestation validator. It has no publish credentials and cannot publish a package or
+create a release.
+
+Pull-request dependency changes are checked by GitHub's Dependency Review action with read-only
+permissions. Separate tokenless workflows run OSV Scanner for known dependency vulnerabilities,
+OSSF Scorecard for repository supply-chain posture and `actionlint` for GitHub Actions syntax and
+expression mistakes. The allow-list records Blue Oak 1.0.0 only for the development-only `minimatch`
+transitive dependency; it is not shipped in the SDK package. These checks use repository or
+GitHub-provided permissions only; they do not add runtime dependencies to the SDK.
+
+The same pull-request gate runs a bounded, deterministic `fast-check` property suite across the
+supported 1D and 2D encoders and decoders. It checks matrix invariants and round-trip payloads with
+small, reproducible inputs; the fuzzing harness stays in development-only test files and is excluded
+from the published npm package.
+
+APIsec is intentionally not enabled: this repository is a client-side barcode SDK with no HTTP API
+or OpenAPI service to scan, and the hosted APIsec action requires an account and secrets. OWASP ZAP
+API scanning is likewise outside the current boundary because it needs an authorized live target or
+API specification. `zizmor` is kept out of the mandatory gate while its action remains an early
+development option, and Gitleaks is not made a required check because organization use can require
+an external licence. Those tools may be reconsidered only if the repository boundary changes and
+their no-secret, no-registration requirements can be met.
+
 These security workflows report findings and propose maintenance updates. They do not replace
 review of barcode conformance, licensing, patent status or release attestations.
 
@@ -728,7 +772,7 @@ attestation confirms build provenance; it is not an ISO barcode-conformance cert
 clearance, or a guarantee that the implementation is vulnerability-free.
 
 Release automation validates the package version against the selected Git tag; it does not invent
-or increment versions by itself. The current release is `1.5.13`.
+or increment versions by itself. The current release is `1.5.14`.
 
 ---
 

package/bundle/sythos-barcode.esm.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.13
+ * Sythos Barcode Suite v1.5.14
  *
  * MIT License
  *
@@ -17596,7 +17596,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.13';
+const VERSION = '1.5.14';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/bundle/sythos-barcode.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.13
+ * Sythos Barcode Suite v1.5.14
  *
  * MIT License
  *
@@ -17597,7 +17597,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.13';
+const VERSION = '1.5.14';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/llms.txt

@@ -8,13 +8,20 @@
 - Project: Sythos Barcode Universal
 - Publisher and original author: Sythos — https://www.sythos.net
 - npm package: `@sythos/js_barcode_universal`
-- Current repository release: `1.5.13`
+- Current repository release: `1.5.14`
 - License: MIT; copyright and attribution: Sythos
 - Runtime dependencies: none
 - Development tooling: TypeScript is a development-only dependency
 - Repository: https://github.com/Sythos/JS_Barcode_Universal
 - npm: https://www.npmjs.com/package/@sythos/js_barcode_universal
-- Documentation: https://github.com/Sythos/JS_Barcode_Universal#readme
+- Documentation: https://sythos.github.io/JS_Barcode_Universal/
+- Documentation source: https://github.com/Sythos/JS_Barcode_Universal/tree/main/docs
+- API reference: https://sythos.github.io/JS_Barcode_Universal/api/overview/
+- Format catalogue: https://sythos.github.io/JS_Barcode_Universal/formats/overview/
+- Recipes: https://sythos.github.io/JS_Barcode_Universal/examples/create-barcode/
+- FAQ: https://sythos.github.io/JS_Barcode_Universal/faq/
+- Troubleshooting: https://sythos.github.io/JS_Barcode_Universal/troubleshooting/
+- Compact project overview: https://github.com/Sythos/JS_Barcode_Universal#readme
 - Issue tracker: https://github.com/Sythos/JS_Barcode_Universal/issues
 
 ## What this SDK does
@@ -148,6 +155,8 @@ professional review where required.
 ## Canonical project files
 
 - Human documentation: `README.md`
+- Published documentation: https://sythos.github.io/JS_Barcode_Universal/
+- Documentation source tree: `docs/`
 - Roadmap and implementation boundaries: `PLAN.md`
 - MIT terms: `LICENSE`
 - Attribution and provenance: `NOTICE.md`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sythos/js_barcode_universal",
-  "version": "1.5.13",
+  "version": "1.5.14",
   "description": "Open-source MIT-licensed JavaScript/TypeScript barcode generator and barcode reader SDK with zero runtime dependencies for 1D and 2D barcodes in browsers, Web Workers and Node.js: QR, Data Matrix, Aztec, PDF417, GS1, EAN and more.",
   "author": {
     "name": "Sythos",
@@ -198,13 +198,19 @@
   "bugs": {
     "url": "https://github.com/Sythos/JS_Barcode_Universal/issues"
   },
-  "homepage": "https://github.com/Sythos/JS_Barcode_Universal#readme",
+  "homepage": "https://sythos.github.io/JS_Barcode_Universal/",
   "scripts": {
     "build:ts": "node tools/compile-typescript.mjs",
+    "lint": "eslint --max-warnings=0 src/index.js src/js tools .github/ci",
+    "test:docs": "node --test tools/exact-url.test.mjs",
+    "test:fuzz": "node --test test/fuzz/property.test.js",
     "types": "tsc -p tsconfig.json",
     "types:api": "node tools/check-public-types.mjs"
   },
   "devDependencies": {
+    "@eslint/js": "10.0.1",
+    "eslint": "10.9.1",
+    "fast-check": "4.9.0",
     "typescript": "7.0.2"
   }
 }

package/src/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.13";
+export declare const VERSION = "1.5.14";

package/src/index.js

@@ -779,4 +779,4 @@ export function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-export const VERSION = '1.5.13';
+export const VERSION = '1.5.14';

package/src/ts/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.13";
+export declare const VERSION = "1.5.14";

package/src/ts/index.ts

@@ -787,4 +787,4 @@ export function decodeStrict(image, options) {
 }
 
 /** Library version, matching package.json. */
-export const VERSION = '1.5.13';
+export const VERSION = '1.5.14';