@sythos/js_barcode_universal 1.5.13 → 1.5.15

package/LICENSE

@@ -104,22 +104,26 @@ excerpt the specification documents.
     ISO/IEC 24778    (Aztec)          ISO/IEC — copyrighted, paywalled
     ISO/IEC 16023    (MaxiCode)       ISO/IEC — copyrighted, paywalled
     ISO/IEC 15417    (Code 128)       ISO/IEC — copyrighted, paywalled
+    Codablock-F / Code 16K            AIM / public descriptions; terms vary
+                                                                  [TO VERIFY]
     ISO/IEC 16388    (Code 39)        ISO/IEC — copyrighted, paywalled
     ISO/IEC 16390    (ITF)            ISO/IEC — copyrighted, paywalled
+    AIM USS Code 25 / 2-of-5 family  AIM Inc. — terms vary    [TO VERIFY]
     ISO/IEC 15420    (EAN/UPC)        ISO/IEC — copyrighted, paywalled
     ISO/IEC 23941    (rMQR)           ISO/IEC — copyrighted, paywalled
     ISO/IEC 24724    (GS1 DataBar)    ISO/IEC — copyrighted, paywalled
     ISO 2108         (ISBN numbering) ISO — copyrighted; the numbering
                                       scheme, not a symbology
-    ISO/IEC 24723-5  (GS1 Composite,
-                      DataBar, DotCode
-                      and related)    ISO/IEC — copyrighted, paywalled
+    ISO/IEC 24723    (GS1 Composite)   ISO/IEC — copyrighted, paywalled
     GS1 General Specifications        GS1 — freely downloadable; redistribution
                                       terms are GS1's own       [TO VERIFY]
     AIM symbology specifications      AIM Inc. — terms vary     [TO VERIFY]
     GB/T 21049       (Han Xin Code)   SAC (China)               [TO VERIFY]
     USPS publications (POSTNET,
       PLANET, Intelligent Mail)       USPS — published openly   [TO VERIFY]
+    Royal Mail RM4SCC, KIX,
+      Australia Post, Japan Post      respective postal operators; public
+                                      material and usage terms vary [TO VERIFY]
 
 
 4. PATENT POSITIONS
@@ -151,11 +155,23 @@ INDEPENDENTLY VERIFIED BY THE AUTHOR. Treat every entry as a research pointer.
                                       public use                   [TO VERIFY]
     DotCode        AIM                open AIM standard            [TO VERIFY]
     Han Xin Code   Chinese nat'l std  status under GB/T 21049      [TO VERIFY]
+    GS1 Composite  GS1 / ISO/IEC 24723  component and patent status require
+                                      current jurisdictional review [TO VERIFY]
     DataBar/GS1    GS1                published for open use       [TO VERIFY]
     Code 128 / 39 /
       93 / Codabar / ITF / MSI /
       Code 11 / Telepen / Pharmacode  originating patents long expired
                                                                    [TO VERIFY]
+    Code 25 / Industrial 2-of-5 /
+      IATA 2-of-5 / Code 32 / PZN     application profiles and
+                                      originating patents require current
+                                      status review                  [TO VERIFY]
+    Postal 4-state family             operator-specific rights and
+                                      indicia/certification terms require
+                                      jurisdictional review           [TO VERIFY]
+    Codablock-F / Code 16K             originating patents and current
+                                      trademark positions require review
+                                                                  [TO VERIFY]
 
 Formats whose status could not be established as clearly redistributable are
 NOT IMPLEMENTED by this project. See section 6.
@@ -179,6 +195,8 @@ names and presents itself.
       GS1 DataMatrix, GS1-128  GS1 AISBL
     Data Matrix              [status TO VERIFY]
     Telepen                  SB Electronic Systems Ltd   [TO VERIFY]
+    Code 32 / PZN             descriptive pharmaceutical identifiers;
+                              no proprietary mark asserted here       [TO VERIFY]
 
 All marks are the property of their respective owners and are used here in a
 purely descriptive, nominative sense — to identify which symbologies this
@@ -221,4 +239,4 @@ change to the dependency set, the oracle tools, or the implemented format list
 MUST update this file in the same commit. A "[TO VERIFY]" marker may only be
 removed together with a citation recorded in NOTICE.md.
 
-Last reviewed: 2026-08-13
+Last reviewed: 2026-08-31

package/NOTICE.md

@@ -105,8 +105,17 @@ date of transcription.
 | FrameQR Code | DENSO WAVE's [FrameQR overview](https://www.qrcode.com/en/codes/frameqr.html), [product page](https://www.denso-wave.com/en/system/qr/product/frame.html) and [public announcement](https://www.denso-wave.com/en/adcd/info/detail__272.html) were consulted on 2026-08-13. The public material is used only to document the proprietary-format boundary; the distributed implementation is the separate non-certified `sythos-canvas-qr/1` profile. ZXing Java 3.5.3 was used only as an independent black-box runtime check: QR Model 2 control passed, `FRAME_QR` native capability was unavailable, and the profile was decoded as ordinary QR. No ZXing source code or tables are copied or shipped; native DENSO interoperability is not claimed. |
 | Aztec Rune and Compact PDF417 | ISO/IEC public technical descriptions and ZXing-C++ 3.1.1 were consulted on 2026-08-13. ZXing-C++ was used exclusively as an independent black-box validation tool; no source code or table is copied or shipped. Aztec Rune values were compared exhaustively; Compact PDF417 geometry and payload vectors were compared independently. |
 | EAN-2 and EAN-5 supplements | ISO/IEC 15420, GS1 public specifications and ZXing-C++ 3.1.1 were consulted on 2026-08-13. The add-on parity, guard and checksum routines are original Sythos code; ZXing-C++ was used only for independent add-on validation. |
-| GS1 DataBar Omnidirectional and Truncated | ISO/IEC 24724 and public GS1 material were consulted on 2026-08-13. The physical encoder/decoder uses original Sythos arithmetic and was compared bit-for-bit with Zint 2.16.0 and read bidirectionally with ZXing-C++ 3.1.1 as black boxes. No Zint or ZXing source code or table is copied or shipped. Limited, stacked and expanded physical variants remain outside this release. |
+| GS1 DataBar physical variants | ISO/IEC 24724 and public GS1 material were consulted on 2026-08-30. The Omnidirectional/Truncated, Limited, Stacked, Stacked Omnidirectional and Expanded encoders/decoders use original Sythos arithmetic and strict geometry checks. The Expanded reader covers the general-purpose path plus the common compressed GTIN-14 method; its detector remains a clean, single-symbol linear profile. Independent implementations were used only as black-box verification; no third-party source code or table is copied or shipped. |
+| MaxiCode | ISO/IEC 16023 public descriptions and independent implementation behavior were consulted on 2026-08-30. The fixed-grid placement, Modes 2–5 primary/secondary handling, ISO-8859-1 Code Sets A–E and Reed–Solomon path are original Sythos code. Independent runtimes were used only for black-box review; no third-party source code or table is copied or shipped. The detector is limited to one clean, prominent 30×33 symbol and does not claim arbitrary perspective or multi-symbol scene support. |
 | Code 11 and MSI Plessey image readers | Published format descriptions and the existing Sythos writer tables were used to implement the scanline readers on 2026-08-13. No third-party source code or table is copied or shipped; checksum and start/stop validation remain original Sythos code. |
+| Telepen Alpha and Numeric | Public Telepen descriptions were consulted on 2026-08-30 for seven-bit parity, narrow/wide glyph rules, Numeric pair compaction and modulo-127 checksum behavior. The implementation generates its glyph mapping algorithmically in original Sythos TypeScript; no third-party table or source is copied or shipped. ZXing-C++ and BWIPP/bwip-js were used solely as independent black-box validation tools. |
+| Code 25 family | Public descriptions of Code 25/Standard 2 of 5, Industrial 2 of 5 and IATA 2 of 5 were consulted on 2026-08-30 for the two-wide-bar digit grammar and guard frames. Original Sythos TypeScript expands the run-width rules algorithmically and validates structure/check digits. BWIPP/bwip-js was used only as a local black-box counter-check; no third-party source or table is copied or shipped. |
+| Code 32 and PZN | Public descriptions and independent format behaviour were consulted on 2026-08-30 for Code 32 base-32/vowel-skipping/check-digit rules and PZN-7/PZN-8 modulo-11 validation. The carrier and arithmetic are original Sythos code. BWIPP/bwip-js was used only as a local black-box counter-check; no third-party source or table is copied or shipped. |
+| Postal 4-state family | Public descriptions of USPS POSTNET/PLANET/IMb, Royal Mail RM4SCC, KIX, Australia Post and Japan Post were consulted on 2026-08-31 for their operator-specific state alphabets, framing, checks and payload envelopes. The shared classifier, check routines, Australia GF(64) parity and IMb combinatorial mapping are original Sythos TypeScript. BWIPP/bwip-js was used exclusively as a local black-box validation tool for all seven formats; no third-party source, table or runtime dependency is copied or shipped. See `licenses/postal.license`. |
+| Codablock-F and Code 16K | Public stacked Code 128 descriptions and the USS Code 16K reference were consulted on 2026-08-31 for row geometry, Code 128 framing and check boundaries. The encoders, readers and detectors are original Sythos TypeScript. Independent implementations, when used, are black-box validation only; no third-party source, table or runtime dependency is copied or shipped. Patent, trademark and specification licensing positions remain subject to legal review. |
+| DotCode | Public AIM/GS1 descriptions, the DotCode overview and Zint's public backend were consulted on 2026-08-31 for the alternating-dot geometry, five-of-nine patterns, masks and correction profile. The encoder, reader and detector are original Sythos TypeScript. Zint, ZXing and other software are independent black-box references only; no third-party source, table or runtime dependency is copied or shipped. Patent, trademark and specification licensing positions remain subject to legal review. |
+| Han Xin Code | Public Han Xin format descriptions and independent implementation behaviour were consulted on 2026-08-31 for the bounded compact versions 1–3 profile. The encoder, reader, detector and GF(256) correction path are original Sythos TypeScript. Independent software is used only as a black-box validation reference; no third-party source, table or runtime dependency is copied or shipped. Version, patent, trademark and specification licensing positions remain subject to legal review. |
+| GS1 DataBar Composite | ISO/IEC 24723 and public GS1 material were consulted on 2026-08-31 for the bounded Sythos profile that links one validated DataBar host to one strict MicroPDF417-derived CC-A or CC-B component. The marker, composition, linkage and detector are original Sythos TypeScript. Independent implementations are black-box validation tools only; no third-party source, table or runtime dependency is copied or shipped. This profile does not claim complete ISO/IEC 24723 conformance or certification; patent, trademark and specification positions remain subject to legal review. |
 | GS1-128 semantic layer | The existing shared GS1 Application Identifier metadata and public GS1 descriptions were reused on 2026-08-13. FNC1 classification and parsing are original Sythos integration code; no third-party decoder is a runtime dependency. |
 
 ## Verification log

package/README.md

@@ -89,18 +89,22 @@ const svg = toSVG(encodeQR('https://example.com', { ecc: 'M' }), { scale: 8 });
 | `@sythos/js_barcode_universal` | The whole surface: `encode`, `decode`, every renderer, every error type |
 | `@sythos/js_barcode_universal/core` | `BitMatrix`, `GaloisField`, Reed–Solomon, the error classes |
 | `@sythos/js_barcode_universal/image` | `LuminanceSource`, the binarizers, grid sampling, `PerspectiveTransform` |
-| `@sythos/js_barcode_universal/oned` | The per-format 1D writers (`encodeEAN13`, `encodeCode128`, …) and `decodeOneD` |
+| `@sythos/js_barcode_universal/oned` | The per-format 1D writers (`encodeEAN13`, `encodeCode128`, `encodeCode32`, `encodePZN`, `encodeTelepen`, `encodePostnet`, `encodePlanet`, `encodeRM4SCC`, `encodeKIX`, `encodeAustraliaPost`, `encodeJapanPost`, `encodeIMB`, …), Code 25 variants and `decodeOneD` |
 | `@sythos/js_barcode_universal/qr` | `encodeQR`, `decodeQR`, `detectQR`, `detectAndDecodeQR` |
 | `@sythos/js_barcode_universal/datamatrix` | `encodeDataMatrix`, `decodeDataMatrix`, `detectDataMatrix`, `detectAndDecodeDataMatrix` |
 | `@sythos/js_barcode_universal/aztec` | `encodeAztec`, `decodeAztec`, `detectAztec`, `detectAndDecodeAztec` |
 | `@sythos/js_barcode_universal/aztecrune` | `encodeAztecRune`, `decodeAztecRune`, `detectAztecRune`, `detectAndDecodeAztecRune` |
 | `@sythos/js_barcode_universal/pdf417` | `encodePDF417`, `decodePDF417`, `detectPDF417`, `detectAndDecodePDF417` |
 | `@sythos/js_barcode_universal/compactpdf417` | `encodeCompactPDF417`, `decodeCompactPDF417`, `detectCompactPDF417`, `detectAndDecodeCompactPDF417` |
-| `@sythos/js_barcode_universal/databar` | GS1 DataBar GTIN/AI codecs plus Omnidirectional/Truncated physical helpers |
+| `@sythos/js_barcode_universal/databar` | GS1 DataBar GTIN/AI codecs plus Omnidirectional/Truncated, Limited, Stacked, Stacked Omnidirectional and Expanded physical helpers |
 | `@sythos/js_barcode_universal/micropdf417` | `encodeMicroPDF417`, `decodeMicroPDF417`, `detectMicroPDF417`, `detectAndDecodeMicroPDF417` |
 | `@sythos/js_barcode_universal/microqr` | `encodeMicroQR`, `decodeMicroQR`, `detectMicroQR`, `detectAndDecodeMicroQR` |
 | `@sythos/js_barcode_universal/rmqr` | `encodeRMQR`, `decodeRMQR`, `detectRMQR`, `detectAndDecodeRMQR` |
 | `@sythos/js_barcode_universal/frameqr` | `encodeFrameQR`, `decodeFrameQR`, `detectFrameQR`, `detectAndDecodeFrameQR` |
+| `@sythos/js_barcode_universal/maxicode` | `encodeMaxiCode`, `decodeMaxiCode`, `detectMaxiCode`, `detectAndDecodeMaxiCode` |
+| `@sythos/js_barcode_universal/dotcode` | `encodeDotCode`, `decodeDotCode`, `detectDotCode`, `detectAndDecodeDotCode` |
+| `@sythos/js_barcode_universal/hanxin` | `encodeHanXin`, `encodeHanXinBytes`, `decodeHanXin`, `detectHanXin`, `detectAndDecodeHanXin` |
+| `@sythos/js_barcode_universal/composite` | `encodeGS1Composite`, `decodeGS1Composite`, `detectGS1Composite`, `detectAndDecodeGS1Composite` |
 | `@sythos/js_barcode_universal/render` | Every renderer plus `isWebGL2Available` / `isWebGPUAvailable` |
 | `@sythos/js_barcode_universal/render/svg` | `toSVG`, `toSVGDataURI` |
 | `@sythos/js_barcode_universal/render/png` | `toPNG`, `toPNGDataURI` |
@@ -112,8 +116,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.13"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.13"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.15"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.15"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -248,10 +252,23 @@ time.
 | Code 93 | `code93` | 1D | ✅ | ✅ |
 | ITF (Interleaved 2 of 5) | `itf` | 1D | ✅ | ✅ |
 | ITF-14 | `itf14` | 1D | ✅ | ✅ [^1] |
+| Code 25 / Standard 2 of 5 | `standard2of5` | 1D | ✅ | ✅ [^4] |
+| Industrial 2 of 5 | `industrial2of5` | 1D | ✅ | ✅ [^4] |
+| IATA 2 of 5 | `iata2of5` | 1D | ✅ | ✅ [^4] |
 | Codabar | `codabar` | 1D | ✅ | ✅ |
 | Code 11 | `code11` | 1D | ✅ | ✅ |
 | MSI Plessey | `msi` | 1D | ✅ | ✅ |
+| Telepen (ASCII and Numeric) | `telepen` | 1D | ✅ | ✅ [^3] |
+| Code 32 (Italian Pharmacode) | `code32` | 1D | ✅ | ✅ |
+| PZN-7 / PZN-8 | `pzn` | 1D | ✅ | ✅ |
 | Pharmacode | `pharmacode` | 1D | ✅ | — |
+| USPS POSTNET | `postnet` | 1D | ✅ | ✅ |
+| USPS PLANET | `planet` | 1D | ✅ | ✅ |
+| Royal Mail 4-State (RM4SCC) | `rm4scc` | 1D | ✅ | ✅ |
+| KIX postal code | `kix` | 1D | ✅ | ✅ |
+| Australia Post 4-State | `auspost` | 1D | ✅ | ✅ |
+| Japan Post 4-State | `japanpost` | 1D | ✅ | ✅ |
+| USPS Intelligent Mail (IMb / OneCode) | `imb` | 1D | ✅ | ✅ |
 | QR Code | `qr` | 2D | ✅ | ✅ |
 | Data Matrix ECC 200 | `datamatrix` | 2D | ✅ | ✅ |
 | Aztec Code | `aztec` | 2D | ✅ | ✅ |
@@ -263,19 +280,144 @@ time.
 | Aztec Rune | `aztecrune` | 2D | ✅ | ✅ |
 | Compact PDF417 | `compactpdf417` | 2D | ✅ | ✅ |
 | GS1 DataBar Omnidirectional / Truncated | `gs1databar14` | 1D | ✅ | ✅ |
+| GS1 DataBar Stacked | `gs1databar-stacked` | 1D | ✅ | ✅ |
+| GS1 DataBar Stacked Omnidirectional | `gs1databar-stacked-omnidirectional` | 1D | ✅ | ✅ |
+| GS1 DataBar Limited | `gs1databar-limited` | 1D | ✅ | ✅ |
+| GS1 DataBar Expanded | `gs1databar-expanded` | 1D | ✅ | ✅ |
+| MaxiCode | `maxicode` | 2D | ✅ | ✅ |
+| Codablock-F | `codablockf` | 2D | ✅ | ✅ |
+| Code 16K | `code16k` | 2D | ✅ | ✅ |
+| DotCode | `dotcode` | 2D | ✅ | ✅ |
+| Han Xin Code | `hanxin` | 2D | ✅ | ✅ |
+| GS1 DataBar Composite (bounded Sythos profile) | `gs1composite` | 2D | ✅ | ✅ |
 | EAN-2 supplement | `ean2` | 1D | ✅ | ✅ [^2] |
 | EAN-5 supplement | `ean5` | 1D | ✅ | ✅ [^2] |
 
-Twenty-eight listed formats are writable and twenty-seven are readable (EAN-2 and EAN-5 are
+Fifty listed formats are writable and forty-nine are readable (EAN-2 and EAN-5 are
 parent-bound supplements). **Pharmacode remains intentionally write-only in the generic image
-pipeline.** Code 11 and MSI Plessey use the scanline reader; GS1 DataBar uses the
-Omnidirectional/Truncated scanline layer over the verified GTIN decoder. PDF417 exposes direct matrix decoding, automatic
+pipeline.** Code 11 and MSI Plessey use the scanline reader. Telepen supports both its full
+seven-bit ASCII mode and explicit Numeric pair mode; Numeric reads must request
+`formats: ['telepennumeric']` so digit pairs are never guessed as ASCII control characters. The
+Code 25 family shares one numeric digit grammar while exposing explicit Standard/Industrial and
+IATA guard profiles; Code 32 and PZN validate their pharmaceutical check digits before a read is
+returned. Postal formats use operator-specific four-state alphabets with strict framing and
+checksum validation; KIX deliberately has no check character, while Australia Post supports
+explicit character or numeric customer-data groups and IMb accepts its four legal payload lengths.
+The
+GS1 DataBar physical variants use
+strict clean-raster readers and variant-specific detectors over the verified GTIN/GS1 element-string
+decoder. Expanded also accepts the common compressed GTIN-14 method on the read path. MaxiCode
+uses a fixed 30×33 matrix and a clean binary-raster detector for one prominent symbol. PDF417 exposes direct matrix decoding, automatic
 camera localization and an assisted quadrilateral sampler through its subpath. Its detector is
 validated on degraded synthetic photographs and real Pixel 10/Chrome and iPhone 17/Safari camera
 tests; external black-box vectors from ZXing 3.5.3 and bwip-js also pass in both directions.
 Text and Numeric vectors are covered bidirectionally; binary byte-for-byte interop remains
 explicitly unclaimed until a dedicated external byte corpus is added.
 
+Codablock-F uses stacked Code 128 rows with per-row modulo-103 checks and two
+overall modulo-86 checks. The writer chooses a compact 2–44 row layout (or
+accepts explicit `rows` and `columns`), while the detector returns a result only
+when every expected row and check agrees:
+
+```js
+import { encodeCodablockF, detectAndDecodeCodablockF } from '@sythos/js_barcode_universal/codablockf';
+
+const matrix = encodeCodablockF('STACKED ORDER 12345', { rows: 3, columns: 12 });
+const hit = detectAndDecodeCodablockF(matrix);
+console.log(hit?.text, hit?.rows, hit?.columns);
+```
+
+The clean integer-scale detector is designed to reject incomplete or damaged
+rows. It does not promise arbitrary perspective, severe occlusion or
+multi-symbol camera scenes. See [`docs/formats/codablockf.md`](docs/formats/codablockf.md)
+and [`licenses/codablockf.license`](licenses/codablockf.license).
+
+Code 16K keeps the Code 128 A/B/C data sets in a compact stacked symbol. The
+writer supports 2–16 rows, five Code 128 symbols per row, optional GS1 modes
+and explicit row or separator heights. The reader validates every row, both
+modulo-107 check characters and the complete geometry before returning text:
+
+```js
+import { encodeCode16K, detectAndDecodeCode16K } from '@sythos/js_barcode_universal/code16k';
+
+const matrix = encodeCode16K('INVENTORY 123456', { mode: 'B', rows: 3 });
+const hit = detectAndDecodeCode16K(matrix);
+console.log(hit?.text, hit?.rows, hit?.mode);
+```
+
+The detector accepts clean integer-scale rasters and orthogonal rotations. It
+rejects missing rows, altered modules, invalid checks and ambiguous geometry;
+arbitrary perspective and multi-symbol camera scenes remain outside the
+validated envelope. See [`docs/formats/code16k.md`](docs/formats/code16k.md)
+and [`licenses/code16k.license`](licenses/code16k.license).
+
+DotCode uses an alternating dot grid rather than a solid finder pattern. The
+writer and reader cover the bounded five-of-nine pattern set, four masks,
+prime-field Reed–Solomon correction, UTF-8 and byte payloads, with optional
+GS1/FNC1 handling:
+
+```js
+import { encodeDotCode, detectAndDecodeDotCode } from '@sythos/js_barcode_universal/dotcode';
+
+const matrix = encodeDotCode('DOTCODE ORDER 123', { width: 29, height: 30, mask: 1 });
+const hits = detectAndDecodeDotCode(matrix.withMargin(3).scale(2), { moduleSize: 2 });
+console.log(hits[0]?.text, hits[0]?.moduleSize);
+```
+
+The detector is intentionally strict: it accepts complete clean binary rasters
+at integer scale, quarter-turn orientations and either polarity, then returns
+only a checksum-validated symbol. Perspective, curved media, severe blur and
+multi-symbol scenes remain outside the supported profile. See
+[`docs/formats/dotcode.md`](docs/formats/dotcode.md) and
+[`licenses/dotcode.license`](licenses/dotcode.license).
+
+Han Xin Code is available as a bounded compact profile covering versions 1–3,
+the four `L1`–`L4` error-correction levels, numeric/text/byte modes, four masks
+and strict Reed–Solomon validation. The root dispatcher accepts both
+`format: 'hanxin'` and the compatibility alias `format: 'han-xin'`; the focused
+subpath is useful when byte payloads or format metadata are needed:
+
+```js
+import {
+  encodeHanXin,
+  detectAndDecodeHanXin,
+} from '@sythos/js_barcode_universal/hanxin';
+
+const matrix = encodeHanXin('HAN XIN 2026', { mode: 'text', ecc: 'L2' });
+const hit = detectAndDecodeHanXin(matrix.withMargin(3).scale(2));
+console.log(hit?.text, hit?.version, hit?.moduleSize);
+```
+
+The Han Xin detector accepts one complete, axis-aligned symbol at an integer
+module scale and either polarity. Versions 4–84, Chinese/GB18030 compaction,
+ECI, perspective correction and multi-symbol camera scenes remain outside this
+profile. See [`docs/formats/hanxin.md`](docs/formats/hanxin.md) and
+[`licenses/hanxin.license`](licenses/hanxin.license).
+
+GS1 DataBar Composite is available as the bounded `gs1composite` profile. It
+links one validated DataBar host to one strict CC-A or CC-B component and
+requires the complete geometry, linkage flag, private profile marker and
+shared integer module scale to validate before returning data:
+
+```js
+import {
+  encodeGS1Composite,
+  detectAndDecodeGS1Composite,
+} from '@sythos/js_barcode_universal/composite';
+
+const matrix = encodeGS1Composite({
+  linear: { format: 'databar14', value: '00012345678905' },
+  data: '(01)09506000134352(17)260101',
+});
+const hit = detectAndDecodeGS1Composite(matrix.withMargin(3).scale(2));
+console.log(hit?.text, hit?.linearFormat, hit?.component);
+```
+
+This is an original Sythos engineering profile, not a claim of complete
+ISO/IEC 24723 certification or universal scanner interoperability. Its full
+limits and legal boundary are in [`docs/formats/gs1-composite.md`](docs/formats/gs1-composite.md)
+and [`licenses/gs1-composite.license`](licenses/gs1-composite.license).
+
 [^1]: `itf14` and `isbn` share a decoder with their base format, so an ITF-14 comes back as `itf`
 and an ISBN as `ean13`. GS1-128 is classified separately as `gs1128` when its leading FNC1 is
 present and exposes `gs1`, `symbologyIdentifier` and parsed `elements` metadata. The payload is
@@ -285,6 +427,14 @@ with a 978/979 prefix.
 [^2]: EAN-2 and EAN-5 are recognized only when attached to a validated EAN-13, EAN-8, UPC-A or
 UPC-E parent; they are not independent generic retail-symbol readers.
 
+[^3]: Telepen Numeric is an explicit mode because its compact digit-pair glyphs share the same
+guards as Telepen Alpha. Use `format: 'telepennumeric'` when encoding or
+`formats: ['telepennumeric']` when reading.
+
+[^4]: Code 25/Standard 2 of 5 and Industrial 2 of 5 use the canonical Industrial frame in this
+SDK; IATA 2 of 5 uses its shorter guard frame. Check digits are optional for ordinary reads and
+are required by the strict camera profile.
+
 ### Code 11 and MSI Plessey image reading
 
 The generic image pipeline now recognizes Code 11 and MSI Plessey through the existing
@@ -294,6 +444,132 @@ preserved for MSI and reliably stripped for Code 11 when its C/K grammar is unam
 reader keeps Pharmacode write-only because its unframed narrow/wide grammar is not safe for
 unrestricted image autodetection.
 
+### Telepen
+
+Telepen is available from the `oned` subpath and the root dispatcher. The default
+`telepen` format carries full seven-bit ASCII with an even parity bit and a modulo-127
+check value. The explicit `telepennumeric` format compacts digit pairs and allows `X`
+only as the second character of a pair. Both writers enforce the format grammar, a
+500-character input limit and complete start/check/stop structure.
+
+```js
+import { encodeTelepen, encodeTelepenNumeric } from '@sythos/js_barcode_universal/oned';
+import { decode, toImageData } from '@sythos/js_barcode_universal';
+
+const alpha = encodeTelepen('TELEPEN-ASCII');
+const numeric = encodeTelepenNumeric('00112738999X');
+const image = toImageData(alpha, { scale: 3, margin: 30, barHeight: 64 });
+const [hit] = decode(image, { formats: ['telepen'] });
+console.log(hit?.text); // TELEPEN-ASCII
+```
+
+For Numeric symbols, select the numeric identifier explicitly:
+
+```js
+const numericImage = toImageData(numeric, { scale: 3, margin: 30, barHeight: 64 });
+const [numericHit] = decode(numericImage, { formats: ['telepennumeric'] });
+console.log(numericHit?.text); // 00112738999X
+```
+
+The scanline reader measures the complete symbol at scale-independent run widths,
+rejects ambiguous candidates, verifies parity and the modulo-127 check value, and
+returns no partial result. A camera-profile read additionally requires a coherent
+quiet-zone-qualified symbol across repeated scan samples.
+
+### Code 25, Industrial 2 of 5 and IATA 2 of 5
+
+The Code 25 family is available from both the root dispatcher and the `oned`
+subpath. `standard2of5` (also `code2of5`) and `industrial2of5` use the same
+canonical two-wide-bar frame here; `iata2of5` uses the shorter IATA guard. The
+optional modulo-10 check digit is appended by the writer and can be required by
+the reader or by the strict camera profile:
+
+```js
+import { decode, encode, toImageData } from '@sythos/js_barcode_universal';
+
+const matrix = encode('01234567', {
+  format: 'industrial2of5',
+  checkDigit: true,
+  wideRatio: 3,
+});
+const [hit] = decode(toImageData(matrix, {
+  scale: 3,
+  margin: 30,
+  barHeight: 64,
+}), {
+  formats: ['industrial2of5'],
+  checkDigit: true,
+});
+console.log(hit?.text); // 01234567
+```
+
+Use `format: 'iata2of5'` for IATA framing. The reader validates the complete
+start/data/stop structure and rejects clipped or ambiguous candidates; a camera
+read additionally requires a quiet zone and a valid check digit.
+
+### Code 32 and PZN
+
+Code 32 (the Italian pharmaceutical code) and PZN-7/PZN-8 are explicit,
+check-digit-validated pharmaceutical formats. Code 32 accepts an eight-digit
+body (or the same body with its validated check digit) and renders the compact
+base-32 payload through the Code 39 carrier. PZN accepts six digits for PZN-7 or
+seven digits with `{ pzn8: true }` for PZN-8; the decoder exposes `pznVariant`.
+
+```js
+import { decode, encode, toImageData } from '@sythos/js_barcode_universal';
+
+const code32 = encode('01234567', { format: 'code32' });
+const pzn8 = encode('1234567', { format: 'pzn8' });
+const image = toImageData(pzn8, { scale: 3, margin: 30, barHeight: 64 });
+const [result] = decode(image, { formats: ['pzn8'] });
+console.log(result?.format, result?.pznVariant, result?.text);
+// pzn pzn8 1234567
+```
+
+Both readers return no value when the carrier or pharmaceutical check digit is
+not valid. The format-specific engineering notes and the independent
+black-box validation boundary are recorded in [`licenses/`](licenses/).
+
+### Postal 4-state formats
+
+The postal family shares a strict height-coded raster classifier while keeping
+each operator's alphabet and checksum separate. The root dispatcher and the
+`oned` subpath expose USPS POSTNET and PLANET, Royal Mail RM4SCC, Dutch KIX,
+Australia Post, Japan Post and USPS Intelligent Mail (IMb/OneCode):
+
+```js
+import { decode, encode, toImageData } from '@sythos/js_barcode_universal';
+
+const matrix = encode('5956439111ABC', {
+  format: 'auspost',
+  customerEncoding: 'character',
+});
+const image = toImageData(matrix, { scale: 3, margin: 24, barHeight: 72 });
+const [result] = decode(image, {
+  formats: ['auspost'],
+  customerEncoding: 'character',
+});
+console.log(result?.format, result?.text, result?.checkDigit);
+// auspost 5956439111ABC true
+```
+
+POSTNET accepts 5/9/11 body digits and PLANET 11/13; both append and verify a
+Mod-10 check digit. RM4SCC generates and verifies its row/column check
+character, while KIX has no check character. Japan Post expands its public
+alphabet into fixed groups and verifies a Mod-19 check. Australia Post starts
+with an FCC and eight-digit DPID, supports `customerEncoding: 'character'` or
+`'numeric'` (also `custinfoenc`) and verifies GF(64) parity. IMb accepts exactly
+20, 25, 29 or 31 digits and verifies its frame check sequence. Convenience
+aliases such as `onecode`, `usps-postnet` and `royal-mail` resolve to the
+canonical ids shown in the format table.
+
+The generic image reader returns an empty array for a clipped, ambiguous or
+checksum-invalid symbol. `profile: 'camera'` additionally requires a measurable
+quiet zone on both sides of the bars; it is intentionally conservative for
+blurred, curved, heavily occluded or multi-symbol photographs. See the
+[postal format guide](https://sythos.github.io/JS_Barcode_Universal/formats/postal/)
+for payload limits, direct subpath functions and the complete provenance note.
+
 ### Data Matrix ECC 200
 
 `datamatrix` writes and reads the 30 classic ECC 200 square and rectangular symbol sizes. The
@@ -447,19 +723,91 @@ the returned `format`; an absent, malformed or unrequested supplement never reje
 
 ### GS1 DataBar
 
-The `databar` subpath exposes original GS1 GTIN/AI codecs plus physical
-Omnidirectional and Truncated writers, scanline readers and clean-matrix decoders. Four GTIN
-vectors were compared bit-for-bit with Zint 2.16.0 as a black box. Limited,
-Stacked, Stacked Omnidirectional and Expanded physical layouts remain planned;
-their data-layer helpers do not imply complete scanner support.
+The `databar` subpath exposes original GS1 GTIN/AI codecs and five physical
+variants: Omnidirectional and Truncated through `encodeDataBar14`, Limited through
+`encodeDataBarLimited`, Stacked through `encodeDataBar14Stacked`, Stacked
+Omnidirectional through `encodeDataBarStackedOmnidirectional`, and linear Expanded
+through `encodeDataBarExpanded`. The physical paths encode the fixed GS1 `(01)`
+GTIN element and can carry the standard composite linkage flag. The complete
+bounded composition is exposed separately through the `composite` subpath.
+
+The clean readers require a complete dark-on-light or inverted binary raster,
+integer module scaling and valid checksum/guard structure. The Limited and
+Stacked readers accept quarter turns; the Stacked Omnidirectional reader accepts
+the same clean integer-scaled geometry. Their detectors intentionally reject
+partial symbols, arbitrary perspective and grayscale input. Use a binarized
+image or call the matrix decoder after an application-owned perspective sample.
+
+The Stacked variant uses a 50-module row with a five-module top row, one-module
+separator and seven-module bottom row. Stacked Omnidirectional uses two 50-module
+rows, a three-module separator and a minimum 33-module row height. Limited uses
+a 79-module row and a minimum 10-module output height; its accepted GTIN
+indicator is 0 or 1. Expanded uses the linear finder sequence and constrained
+17-module data characters defined by GS1 DataBar; its writer emits the general-
+purpose method and its reader also accepts the common compressed GTIN-14 method.
+These geometry constraints are part of the format API, not an interoperability
+claim for arbitrary photographs.
 
-### Not implemented
+```js
+import {
+  encodeDataBarLimited,
+  encodeDataBar14Stacked,
+  encodeDataBarStackedOmnidirectional,
+} from '@sythos/js_barcode_universal/databar';
+
+const limited = encodeDataBarLimited('01234567890128', { moduleScale: 2 });
+const stacked = encodeDataBar14Stacked('01234567890128');
+const stackedOmni = encodeDataBarStackedOmnidirectional('01234567890128');
+```
+
+For a GS1 element string, use the Expanded helper. It returns a clean linear
+symbol without a quiet zone, just like the other DataBar writers:
+
+```js
+import {
+  decodeDataBarExpanded,
+  encodeDataBarExpanded,
+} from '@sythos/js_barcode_universal/databar';
+
+const expanded = encodeDataBarExpanded('(01)09506000134352(10)ABC-123');
+const decoded = decodeDataBarExpanded(expanded);
+console.log(decoded.elements, decoded.linkage);
+```
 
-GS1 DataBar physical support currently covers Omnidirectional and Truncated writing plus
-scanline and clean-matrix decoding; Limited, Stacked and Expanded physical layouts remain planned. MaxiCode is
-not implemented. Data Matrix ECC
-200 is implemented for its classic square and rectangular symbols;
-DMRE remains outside the current scope. See [`PLAN.md`](PLAN.md) for the remaining symbologies.
+Expanded reading accepts a complete dark-on-light or inverted binary raster,
+integer module scaling and a valid finder/checksum structure. The detector is
+deliberately conservative: it handles a single clean linear symbol (including
+quarter turns) and rejects partial, ambiguous, grayscale or arbitrary-perspective
+input instead of returning a guessed GS1 payload.
+
+### MaxiCode
+
+The `maxicode` subpath exposes `encodeMaxiCode`, `decodeMaxiCode`,
+`detectMaxiCode` and `detectAndDecodeMaxiCode`. The implementation uses the
+fixed 30×33-module MaxiCode geometry and supports modes 2–5. Modes 2 and 3
+require structured `primary` data (`postalCode`, `countryCode` and
+`serviceClass`); modes 4 and 5 carry an unstructured secondary message. Text
+and byte input are restricted to ISO-8859-1 (`charset: 'latin1'`).
+
+```js
+import { encodeMaxiCode, decodeMaxiCode } from '@sythos/js_barcode_universal/maxicode';
+
+const symbol = encodeMaxiCode('HELLO FROM SYTHOS', { mode: 4 });
+const result = decodeMaxiCode(symbol);
+console.log(result.text, result.mode);
+```
+
+`decodeMaxiCode` works on a canonical 30×33 matrix and can validate its
+180-degree and inverted forms. `detectMaxiCode` is deliberately a clean binary
+detector for one prominent symbol at integer or near-integer scale. It does not
+promise arbitrary perspective, grayscale thresholding, severe occlusion or
+multi-symbol scene handling.
+
+### Remaining out of scope
+
+Data Matrix ECC 200 is implemented for its classic square and rectangular symbols;
+DMRE remains outside the current scope. See [`PLAN.md`](PLAN.md) for the remaining
+symbologies.
 
 ---
 
@@ -491,6 +839,23 @@ camera loop that decodes continuously from the video stream.
 
 ---
 
+## Documentation
+
+The full, searchable documentation lives on [GitHub Pages](https://sythos.github.io/JS_Barcode_Universal/)
+and is built from the checked-in [`docs/`](docs/) tree with MkDocs Material. It includes the
+[API reference](https://sythos.github.io/JS_Barcode_Universal/api/overview/),
+[format catalogue](https://sythos.github.io/JS_Barcode_Universal/formats/overview/),
+[camera and image guides](https://sythos.github.io/JS_Barcode_Universal/guides/camera-reading/),
+[practical recipes](https://sythos.github.io/JS_Barcode_Universal/examples/create-barcode/),
+[FAQ](https://sythos.github.io/JS_Barcode_Universal/faq/) and
+[troubleshooting](https://sythos.github.io/JS_Barcode_Universal/troubleshooting/).
+
+Every documentation change is checked for local links, navigation coverage and registry drift in
+CI before the Pages build is published. The compact README remains the versioned project
+overview; the Pages site is the place for the longer explanations and copy-ready examples.
+
+---
+
 ## API summary
 
 Two functions carry the whole surface. Everything else is a renderer or a format-specific escape
@@ -540,7 +905,7 @@ and go faster), `tryHarder` (retry inverted, default `true`), `binarizer`
 (`'global' | 'hybrid' | 'auto'`). A `Result` carries at least `text` and `format`; QR results also
 carry `bytes`, `version` and `ecc`.
 
-For larger clean QR Code and PDF417 rasters, `auto` and `hybrid` retain their primary local-threshold pass and retry once with the global threshold only when that pass finds no result. An explicit `binarizer: 'global'` request remains single-pass.
+For larger clean QR Code, PDF417 and MaxiCode rasters, `auto` and `hybrid` retain their primary local-threshold pass and retry once with the global threshold only when that pass finds no result. An explicit `binarizer: 'global'` request remains single-pass.
 
 ```js
 listFormats() → { id, label, canWrite, canRead, kind }[]
@@ -667,6 +1032,33 @@ repository-level default setup.
 references weekly. Updates are repository-development controls only; the published SDK remains
 zero-dependency at runtime.
 
+The read-only quality gate in [`.github/workflows/pr-quality.yml`](.github/workflows/pr-quality.yml)
+runs for pull requests and pushes to `main`. Its Node jobs install the locked development toolchain
+with `npm ci --ignore-scripts --no-audit --no-fund`, then run ESLint, the TypeScript compiler and
+public-type checks, package-surface and zero-runtime-dependency checks, documentation checks and
+the workflow attestation validator. It has no publish credentials and cannot publish a package or
+create a release.
+
+Pull-request dependency changes are checked by GitHub's Dependency Review action with read-only
+permissions. Separate tokenless workflows run OSV Scanner for known dependency vulnerabilities,
+OSSF Scorecard for repository supply-chain posture and `actionlint` for GitHub Actions syntax and
+expression mistakes. The allow-list records Blue Oak 1.0.0 only for the development-only `minimatch`
+transitive dependency; it is not shipped in the SDK package. These checks use repository or
+GitHub-provided permissions only; they do not add runtime dependencies to the SDK.
+
+The same pull-request gate runs a bounded, deterministic `fast-check` property suite across the
+supported 1D and 2D encoders and decoders. It checks matrix invariants and round-trip payloads with
+small, reproducible inputs; the fuzzing harness stays in development-only test files and is excluded
+from the published npm package.
+
+APIsec is intentionally not enabled: this repository is a client-side barcode SDK with no HTTP API
+or OpenAPI service to scan, and the hosted APIsec action requires an account and secrets. OWASP ZAP
+API scanning is likewise outside the current boundary because it needs an authorized live target or
+API specification. `zizmor` is kept out of the mandatory gate while its action remains an early
+development option, and Gitleaks is not made a required check because organization use can require
+an external licence. Those tools may be reconsidered only if the repository boundary changes and
+their no-secret, no-registration requirements can be met.
+
 These security workflows report findings and propose maintenance updates. They do not replace
 review of barcode conformance, licensing, patent status or release attestations.
 
@@ -728,7 +1120,7 @@ attestation confirms build provenance; it is not an ISO barcode-conformance cert
 clearance, or a guarantee that the implementation is vulnerability-free.
 
 Release automation validates the package version against the selected Git tag; it does not invent
-or increment versions by itself. The current release is `1.5.13`.
+or increment versions by itself. The current release is `1.5.15`.
 
 ---
 
@@ -759,9 +1151,11 @@ General Specifications and a leading FNC1. Its engineering provenance, patent an
 research notes are recorded in [`licenses/data-matrix.license`](licenses/data-matrix.license),
 with unresolved claims kept explicitly marked using scoped review labels.
 
-PDF417 and MicroPDF417 provenance and legal review notes are recorded in
+PDF417, MicroPDF417, MaxiCode and GS1 DataBar provenance and legal review notes are recorded in
 [`licenses/pdf417.license`](licenses/pdf417.license),
-[`licenses/micropdf417.license`](licenses/micropdf417.license) and the attribution log in
+[`licenses/micropdf417.license`](licenses/micropdf417.license),
+[`licenses/maxicode.license`](licenses/maxicode.license),
+[`licenses/gs1-databar.license`](licenses/gs1-databar.license) and the attribution log in
 [`NOTICE.md`](NOTICE.md).
 
 Micro QR and rMQR provenance and scoped legal-review notes are recorded in