modern-pdf-lib 0.40.0 → 0.40.2

package/dist/{src-aDYhSnal.cjs → src-DFojMRwY.cjs}

@@ -1,7 +1,7 @@
-const require_pdfDocument = require("./pdfDocument-D5qz7duP.cjs");
+const require_pdfDocument = require("./pdfDocument-CnVPQ_Cm.cjs");
 const require_pdfObjects = require("./pdfObjects-BcPlSI0a.cjs");
 const require_streamDecode = require("./streamDecode-kQ-REV7v.cjs");
-const require_pdfForm = require("./pdfForm-BVS_do95.cjs");
+const require_pdfForm = require("./pdfForm-Dym3PFT3.cjs");
 const require_compressionAnalysis = require("./compressionAnalysis-DwxVCe4E.cjs");
 const require_bridge = require("./bridge-ByvzPu5h.cjs");
 const require_loader = require("./loader-DR7H0XOf.cjs");
@@ -277,7 +277,7 @@ function compressStream(stream, level) {
 * @returns              The incremental save result.
 */
 async function saveDocumentIncremental(originalBytes, doc, options) {
-	const { buildDocumentStructure } = await Promise.resolve().then(() => require("./pdfDocument-D5qz7duP.cjs")).then((n) => n.pdfCatalog_exports);
+	const { buildDocumentStructure } = await Promise.resolve().then(() => require("./pdfDocument-CnVPQ_Cm.cjs")).then((n) => n.pdfCatalog_exports);
 	const registry = doc.getRegistry();
 	const structure = buildDocumentStructure(doc.getInternalPages().map((p) => p.finalize()), {
 		producer: doc.getProducer(),
@@ -28156,16 +28156,40 @@ const EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
 	"pl",
 	"php"
 ]);
-/** Read a `PdfName` value (without the leading `/`) from a dict entry. */
-function nameValue$1(obj) {
-	if (obj !== void 0 && obj.kind === "name") {
-		const v = obj.value;
+/**
+* Resolve a {@link PdfObject} that may be an indirect reference to its
+* underlying value using the registry. Non-refs are returned as-is; an
+* unresolvable ref yields `undefined`. (Mirrors `resolve()` in
+* `./sanitize.ts`.)
+*
+* This is security-critical: a hostile PDF can write a dangerous value
+* indirectly — e.g. `/S 99 0 R` where object 99 is the name `/JavaScript` — and
+* a conforming viewer treats that exactly like `/S /JavaScript`. Classifying
+* `/S`, `/Type`, `/Subtype`, `/UF`, `/F`, and `/URI` without resolving the ref
+* first would let that one indirection evade detection entirely.
+*/
+function resolveRef(obj, registry) {
+	if (obj instanceof require_pdfObjects.PdfRef) return registry.resolve(obj);
+	return obj;
+}
+/**
+* Read a `PdfName` value (without the leading `/`) from a dict entry, resolving
+* an indirect reference through the registry first.
+*/
+function nameValue$1(obj, registry) {
+	const resolved = resolveRef(obj, registry);
+	if (resolved !== void 0 && resolved.kind === "name") {
+		const v = resolved.value;
 		return v.startsWith("/") ? v.slice(1) : v;
 	}
 }
-/** Read a `PdfString` value from a dict entry. */
-function stringValue(obj) {
-	if (obj !== void 0 && obj.kind === "string") return obj.value;
+/**
+* Read a `PdfString` value from a dict entry, resolving an indirect reference
+* through the registry first.
+*/
+function stringValue(obj, registry) {
+	const resolved = resolveRef(obj, registry);
+	if (resolved !== void 0 && resolved.kind === "string") return resolved.value;
 }
 /** Format a `PdfRef` as the canonical `"N G R"` string, if available. */
 function refString(ref) {
@@ -28220,7 +28244,7 @@ function scanObjectGraph(registry, findings) {
 		if (obj.kind === "dict") dict = obj;
 		else if (obj.kind === "stream") dict = obj.dict;
 		if (dict === void 0) continue;
-		inspectDict(dict, refStr, findings);
+		inspectDict(dict, refStr, findings, registry);
 	}
 }
 /**
@@ -28229,8 +28253,10 @@ function scanObjectGraph(registry, findings) {
 * @param dict     The dictionary (or stream dictionary).
 * @param refStr   The owning object's `"N G R"` string, if known.
 * @param findings Accumulator.
+* @param registry Object registry, used to resolve indirectly-referenced
+*                 name/string values (e.g. an `/S` that is a `PdfRef`).
 */
-function inspectDict(dict, refStr, findings) {
+function inspectDict(dict, refStr, findings, registry) {
 	if (dict.has("/OpenAction")) findings.push({
 		category: "OpenAction",
 		severity: "medium",
@@ -28249,15 +28275,15 @@ function inspectDict(dict, refStr, findings) {
 		detail: "A /JavaScript name tree (catalog /Names → /JavaScript) is present; these scripts execute automatically on open (ISO 32000 §12.6.4.16, §7.7.4).",
 		objectRef: refStr
 	});
-	const subtype = nameValue$1(dict.get("/S"));
-	if (subtype !== void 0) inspectActionSubtype(subtype, dict, refStr, findings);
+	const subtype = nameValue$1(dict.get("/S"), registry);
+	if (subtype !== void 0) inspectActionSubtype(subtype, dict, refStr, findings, registry);
 	if (dict.has("/XFA")) findings.push({
 		category: "XFA",
 		severity: "low",
 		detail: "Document contains an XFA form (/AcroForm → /XFA, ISO 32000 §12.7.8); XFA carries its own scripting and data-binding model.",
 		objectRef: refStr
 	});
-	const annotSubtype = nameValue$1(dict.get("/Subtype"));
+	const annotSubtype = nameValue$1(dict.get("/Subtype"), registry);
 	if (annotSubtype === "RichMedia") findings.push({
 		category: "RichMedia",
 		severity: "low",
@@ -28294,8 +28320,8 @@ function inspectDict(dict, refStr, findings) {
 		detail: "Object references sound content via a /Sound entry (ISO 32000 §13.3).",
 		objectRef: refStr
 	});
-	if (nameValue$1(dict.get("/Type")) === "Filespec" || dict.has("/EF")) {
-		const fileName = stringValue(dict.get("/UF")) ?? stringValue(dict.get("/F"));
+	if (nameValue$1(dict.get("/Type"), registry) === "Filespec" || dict.has("/EF")) {
+		const fileName = stringValue(dict.get("/UF"), registry) ?? stringValue(dict.get("/F"), registry);
 		if (fileName !== void 0) {
 			const ext = extensionOf(fileName);
 			if (ext !== "" && EXECUTABLE_EXTENSIONS.has(ext)) findings.push({
@@ -28311,7 +28337,7 @@ function inspectDict(dict, refStr, findings) {
 * Flag a dangerous action `/S` subtype. Subtypes are ISO 32000 §12.6.4 /
 * §12.7.5 action types.
 */
-function inspectActionSubtype(subtype, dict, refStr, findings) {
+function inspectActionSubtype(subtype, dict, refStr, findings, registry) {
 	switch (subtype) {
 		case "JavaScript":
 			findings.push({
@@ -28333,7 +28359,7 @@ function inspectActionSubtype(subtype, dict, refStr, findings) {
 			findings.push({
 				category: "URI",
 				severity: "medium",
-				detail: `URI action (/S /URI, ISO 32000 §12.6.4.7) opens a remote URL ${describeUri(dict)}.`,
+				detail: `URI action (/S /URI, ISO 32000 §12.6.4.7) opens a remote URL ${describeUri(dict, registry)}.`,
 				objectRef: refStr
 			});
 			break;
@@ -28381,8 +28407,8 @@ function inspectActionSubtype(subtype, dict, refStr, findings) {
 	}
 }
 /** Append the target URL of a /URI action to the detail string, if present. */
-function describeUri(dict) {
-	const uri = stringValue(dict.get("/URI"));
+function describeUri(dict, registry) {
+	const uri = stringValue(dict.get("/URI"), registry);
 	return uri !== void 0 ? `→ "${uri}"` : "";
 }
 /**
@@ -28882,6 +28908,10 @@ async function verifyRedactions(pdf, regions) {
 	if (regions === void 0 || regions.length === 0) throw new TypeError("verifyRedactions requires an explicit, non-empty `regions` array. Automatic redaction-region detection is not performed: black-filled rectangles are indistinguishable from legitimate graphics, and a loaded page's original /Redact annotations are not exposed through a stable public API. Pass the regions you redacted (PDF points, bottom-left origin, y-up).");
 	const doc = await require_pdfDocument.loadPdf(pdf);
 	const pageCount = doc.getPageCount();
+	for (const region of regions) {
+		const { page } = region;
+		if (!Number.isInteger(page) || page < 0 || page >= pageCount) throw new RangeError(`verifyRedactions: region page index ${page} is out of range. The document has ${pageCount} page(s) (valid indices 0..${pageCount - 1}). Every region must name a real, inspectable page — an out-of-range page cannot be verified and must not be silently reported clean.`);
+	}
 	const itemsByPage = /* @__PURE__ */ new Map();
 	const getItems = (pageIndex) => {
 		const cached = itemsByPage.get(pageIndex);
@@ -29087,21 +29117,41 @@ function decodePermissionBits(p) {
 	};
 }
 /**
-* Test whether the empty user password (`""`) authenticates against the
-* standard security handler.  Reuses {@link PdfEncryptionHandler.fromEncryptDict},
-* which throws when the password is incorrect; a successful return means
-* the empty password derived a valid file key.
+* Test whether the empty **user** password (`""`) authenticates against the
+* standard security handler.
+*
+* This must verify specifically against the `/U` (user) value using the
+* standard /U validation algorithm — **not** simply check whether the empty
+* password opens the document.  The general file-key derivation
+* (`PdfEncryptionHandler.fromEncryptDict` / `computeFileEncryptionKey`)
+* accepts a password that matches **either** the user **or** the owner
+* password, so a document whose *owner* password is empty (while the user
+* password is non-empty) would otherwise be mis-reported as having an empty
+* user password.  To avoid asserting a possibly-false `true`, we run the
+* user-password-specific check ({@link verifyUserPassword}) against `/U`.
 *
-* Returns `undefined` when the test cannot be performed (e.g. the handler
-* implementation does not support the document's /V/R).
+* Returns `undefined` when the test cannot be performed (e.g. the `/O` / `/U`
+* values are missing, or the maths throws for an unsupported /V/R).
 */
 async function testEmptyUserPassword(dict, fileId) {
+	const ownerKey = getStringBytes(dict, "/O");
+	const userKey = getStringBytes(dict, "/U");
+	if (ownerKey === void 0 || userKey === void 0) return void 0;
+	const dictValues = {
+		version: getNumber(dict, "/V") ?? 0,
+		revision: getNumber(dict, "/R") ?? 0,
+		keyLength: getNumber(dict, "/Length") ?? 40,
+		ownerKey,
+		userKey,
+		permissions: getNumber(dict, "/P") ?? 0,
+		ownerEncryptionKey: getStringBytes(dict, "/OE"),
+		userEncryptionKey: getStringBytes(dict, "/UE"),
+		perms: getStringBytes(dict, "/Perms"),
+		encryptMetadata: getBool(dict, "/EncryptMetadata") ?? true
+	};
 	try {
-		await require_pdfDocument.PdfEncryptionHandler.fromEncryptDict(dict, fileId, "");
-		return true;
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (/password/i.test(message)) return false;
+		return await require_pdfDocument.verifyUserPassword("", dictValues, fileId);
+	} catch {
 		return;
 	}
 }
@@ -29115,6 +29165,32 @@ function getNumber(dict, key) {
 	const obj = dict.get(key);
 	if (obj !== void 0 && obj.kind === "number") return obj.value;
 }
+/** Read a boolean value from a dict. */
+function getBool(dict, key) {
+	const obj = dict.get(key);
+	if (obj !== void 0 && obj.kind === "bool") return obj.value;
+}
+/**
+* Read raw bytes from a `/String` entry.
+*
+* Hex strings whose value is still raw hex digits (e.g. produced by
+* `PdfString.hexFromBytes`) are decoded from hex pairs; otherwise the
+* character codes are treated as raw Latin-1 bytes.  Mirrors the decoding
+* used by `crypto/encryptionHandler.fromEncryptDict` so the /U validation
+* sees the same /O, /U, /OE, /UE, /Perms bytes.
+*/
+function getStringBytes(dict, key) {
+	const obj = dict.get(key);
+	if (obj === void 0 || obj.kind !== "string") return void 0;
+	const str = obj;
+	if (str.hex && /^[\da-fA-F\s]*$/.test(str.value)) {
+		const clean = str.value.replace(/\s/g, "");
+		return Uint8Array.fromHex(clean.length % 2 === 0 ? clean : clean + "0");
+	}
+	const bytes = new Uint8Array(str.value.length);
+	for (let i = 0; i < str.value.length; i++) bytes[i] = str.value.charCodeAt(i) & 255;
+	return bytes;
+}
 //#endregion
 //#region src/text/bidi.ts
 /** UAX #9 §3.3.2: the maximum explicit embedding depth. */
@@ -29866,24 +29942,16 @@ function resolveImplicit(seq, types, levels) {
 */
 function resetWhitespaceLevels(originalTypes, levels, baseLevel) {
 	const n = levels.length;
-	let resetFrom = n;
-	for (let i = n - 1; i >= 0; i--) {
+	const resettable = (t) => t === "WS" || t === "FSI" || t === "LRI" || t === "RLI" || t === "PDI" || isRemovedByX9(t);
+	let runStart = 0;
+	for (let i = 0; i < n; i++) {
 		const t = originalTypes[i];
 		if (t === "B" || t === "S") {
-			levels[i] = baseLevel;
-			for (let j = i + 1; j < resetFrom; j++) levels[j] = baseLevel;
-			resetFrom = i;
-		} else if (t === "WS" || t === "FSI" || t === "LRI" || t === "RLI" || t === "PDI" || isRemovedByX9(t)) {} else {
-			if (resetFrom === n) {}
-			resetFrom = i + 1 > resetFrom ? resetFrom : i + 1;
-			resetFrom = i + 1;
-		}
-	}
-	for (let i = n - 1; i >= 0; i--) {
-		const t = originalTypes[i];
-		if (t === "WS" || t === "FSI" || t === "LRI" || t === "RLI" || t === "PDI" || isRemovedByX9(t)) levels[i] = baseLevel;
-		else break;
+			for (let j = runStart; j <= i; j++) levels[j] = baseLevel;
+			runStart = i + 1;
+		} else if (resettable(t)) {} else runStart = i + 1;
 	}
+	for (let i = runStart; i < n; i++) levels[i] = baseLevel;
 }
 /** L2: reorder code-unit indices into visual order from the resolved levels. */
 function reorderLevels(levels) {
@@ -31913,11 +31981,15 @@ function boxBlurD(stdDev) {
 	return Math.floor(stdDev * 3 * Math.sqrt(2 * Math.PI) / 4 + .5);
 }
 /**
-* One horizontal box blur of the given (odd) length, premultiplied float
-* data, with an asymmetric left/right radius to support the even-`d` rule.
-* The window covers offsets `[-leftRadius, +rightRadius]` inclusive. Edge
-* samples are clamped (extend-edge) rather than treated as transparent so a
-* flat region stays flat.
+* One horizontal box blur of the given length, premultiplied float data, with
+* an asymmetric left/right radius to support the even-`d` rule. The window
+* covers offsets `[-leftRadius, +rightRadius]` inclusive.
+*
+* Samples that fall outside the filter region are treated as **transparent
+* black** `[0,0,0,0]` (SVG 1.1 §15.17 `edgeMode="none"`, the spec default).
+* In premultiplied space those samples contribute zero to every channel, so
+* the running sum simply skips them (the window length stays the full box
+* size, which is what fades edge pixels per spec).
 */
 function boxBlurH(data, width, height, leftRadius, rightRadius) {
 	const out = new Float32Array(data.length);
@@ -31927,38 +31999,40 @@ function boxBlurH(data, width, height, leftRadius, rightRadius) {
 		for (let c = 0; c < 4; c++) {
 			let sum = 0;
 			for (let k = -leftRadius; k <= rightRadius; k++) {
-				const cx = k < 0 ? 0 : k >= width ? width - 1 : k;
-				sum += data[(row + cx) * 4 + c];
+				if (k < 0 || k >= width) continue;
+				sum += data[(row + k) * 4 + c];
 			}
 			for (let x = 0; x < width; x++) {
 				out[(row + x) * 4 + c] = sum / windowLen;
 				const dropX = x - leftRadius;
 				const addX = x + rightRadius + 1;
-				const dc = dropX < 0 ? 0 : dropX >= width ? width - 1 : dropX;
-				const ac = addX < 0 ? 0 : addX >= width ? width - 1 : addX;
-				sum += data[(row + ac) * 4 + c] - data[(row + dc) * 4 + c];
+				if (addX >= 0 && addX < width) sum += data[(row + addX) * 4 + c];
+				if (dropX >= 0 && dropX < width) sum -= data[(row + dropX) * 4 + c];
 			}
 		}
 	}
 	return out;
 }
-/** One vertical box blur — the transpose of {@link boxBlurH}. */
+/**
+* One vertical box blur — the transpose of {@link boxBlurH}. Out-of-bounds
+* samples are transparent black (SVG 1.1 §15.17 `edgeMode="none"`) and so
+* contribute zero to the running sum.
+*/
 function boxBlurV(data, width, height, topRadius, bottomRadius) {
 	const out = new Float32Array(data.length);
 	const windowLen = topRadius + bottomRadius + 1;
 	for (let x = 0; x < width; x++) for (let c = 0; c < 4; c++) {
 		let sum = 0;
 		for (let k = -topRadius; k <= bottomRadius; k++) {
-			const cy = k < 0 ? 0 : k >= height ? height - 1 : k;
-			sum += data[(cy * width + x) * 4 + c];
+			if (k < 0 || k >= height) continue;
+			sum += data[(k * width + x) * 4 + c];
 		}
 		for (let y = 0; y < height; y++) {
 			out[(y * width + x) * 4 + c] = sum / windowLen;
 			const dropY = y - topRadius;
 			const addY = y + bottomRadius + 1;
-			const dc = dropY < 0 ? 0 : dropY >= height ? height - 1 : dropY;
-			const ac = addY < 0 ? 0 : addY >= height ? height - 1 : addY;
-			sum += data[(ac * width + x) * 4 + c] - data[(dc * width + x) * 4 + c];
+			if (addY >= 0 && addY < height) sum += data[(addY * width + x) * 4 + c];
+			if (dropY >= 0 && dropY < height) sum -= data[(dropY * width + x) * 4 + c];
 		}
 	}
 	return out;
@@ -33449,6 +33523,7 @@ function collectPages(children) {
 */
 async function renderToPdf(root) {
 	let documentEl;
+	const synthesized = [];
 	const stack = resolveNode(root);
 	while (stack.length > 0) {
 		const node = stack.shift();
@@ -33461,13 +33536,13 @@ async function renderToPdf(root) {
 			documentEl = node;
 			break;
 		}
-		documentEl = {
-			type: "document",
-			props: {},
-			children: [node]
-		};
-		break;
+		synthesized.push(node);
 	}
+	if (documentEl === void 0 && synthesized.length > 0) documentEl = {
+		type: "document",
+		props: {},
+		children: synthesized
+	};
 	const doc = require_pdfDocument.createPdf();
 	const ctx = new RenderContext(doc);
 	await ctx.init();
@@ -37243,7 +37318,7 @@ function conformanceString(conformance) {
 function convertPdfAConformanceXmp(xmp, toPart, toConformance) {
 	const partVal = partString(toPart);
 	let result = xmp;
-	const partAttr = /pdfaid:part\s*=\s*"[^"]*"/;
+	const partAttr = /pdfaid:part\s*=\s*(["'])[^"']*\1/;
 	const partElem = /<pdfaid:part>[^<]*<\/pdfaid:part>/;
 	if (partAttr.test(result)) result = result.replace(partAttr, `pdfaid:part="${partVal}"`);
 	else if (partElem.test(result)) result = result.replace(partElem, `<pdfaid:part>${partVal}</pdfaid:part>`);
@@ -37253,7 +37328,7 @@ function convertPdfAConformanceXmp(xmp, toPart, toConformance) {
 	}
 	if (toConformance !== void 0) {
 		const confVal = conformanceString(toConformance);
-		const confAttr = /pdfaid:conformance\s*=\s*"[^"]*"/;
+		const confAttr = /pdfaid:conformance\s*=\s*(["'])[^"']*\1/;
 		const confElem = /<pdfaid:conformance>[^<]*<\/pdfaid:conformance>/;
 		if (confAttr.test(result)) result = result.replace(confAttr, `pdfaid:conformance="${confVal}"`);
 		else if (confElem.test(result)) result = result.replace(confElem, `<pdfaid:conformance>${confVal}</pdfaid:conformance>`);
@@ -37291,7 +37366,7 @@ function injectIdentification(xmp, partVal, toConformance) {
 function addConformanceBesidePart(xmp, confVal) {
 	const partElem = /(<pdfaid:part>[^<]*<\/pdfaid:part>)/;
 	if (partElem.test(xmp)) return xmp.replace(partElem, `$1<pdfaid:conformance>${confVal}</pdfaid:conformance>`);
-	const partAttr = /(pdfaid:part\s*=\s*"[^"]*")/;
+	const partAttr = /(pdfaid:part\s*=\s*(["'])[^"']*\2)/;
 	if (partAttr.test(xmp)) return xmp.replace(partAttr, `$1 pdfaid:conformance="${confVal}"`);
 	return xmp;
 }
@@ -37544,10 +37619,28 @@ function isNonEmptyText(value) {
 function amountsEqual(a, b) {
 	return Math.abs(a - b) <= MONETARY_TOLERANCE;
 }
-/** Sum the line net amounts (Σ quantity × unit price) of an invoice. */
+/**
+* Round a monetary amount to two decimals using half-away-from-zero, the
+* commercial rounding convention EN 16931 applies to BT-* amounts (and the
+* convention the Factur-X generator emits). `Math.round` is half-up toward
+* +∞, which is wrong for negative amounts (e.g. a credit line), so the sign
+* is factored out explicitly.
+*/
+function roundToCents(value) {
+	return Math.sign(value) * Math.round(Math.abs(value) * 100) / 100;
+}
+/**
+* Sum the line net amounts (Σ BT-131) of an invoice.
+*
+* Per EN 16931 each line net amount (BT-131) is rounded to two decimals
+* before the document-level sum (BT-106 / BT-109) is formed. Summing the raw
+* `quantity × unitPrice` products instead would diverge from the spec total
+* for fractional unit prices and could falsely flag (or falsely pass) a
+* borderline BR-CO-10 / BR-CO-13 comparison.
+*/
 function sumLineNet(invoice) {
 	let total = 0;
-	for (const line of invoice.lines) total += line.quantity * line.unitPrice;
+	for (const line of invoice.lines) total += roundToCents(line.quantity * line.unitPrice);
 	return total;
 }
 /**
@@ -37825,15 +37918,15 @@ async function initWasm(options) {
 	if (wasmInitialized) return;
 	const inits = [];
 	if (options.deflate || options.deflateWasm) inits.push((async () => {
-		const { initDeflateWasm } = await Promise.resolve().then(() => require("./pdfDocument-D5qz7duP.cjs")).then((n) => n.libdeflateWasm_exports);
+		const { initDeflateWasm } = await Promise.resolve().then(() => require("./pdfDocument-CnVPQ_Cm.cjs")).then((n) => n.libdeflateWasm_exports);
 		await initDeflateWasm(options.deflateWasm);
 	})());
 	if (options.png || options.pngWasm) inits.push((async () => {
-		const { initPngWasm } = await Promise.resolve().then(() => require("./pdfDocument-D5qz7duP.cjs")).then((n) => n.pngEmbed_exports);
+		const { initPngWasm } = await Promise.resolve().then(() => require("./pdfDocument-CnVPQ_Cm.cjs")).then((n) => n.pngEmbed_exports);
 		await initPngWasm(options.pngWasm);
 	})());
 	if (options.fonts || options.fontWasm) inits.push((async () => {
-		const { initSubsetWasm } = await Promise.resolve().then(() => require("./pdfDocument-D5qz7duP.cjs")).then((n) => n.fontSubset_exports);
+		const { initSubsetWasm } = await Promise.resolve().then(() => require("./pdfDocument-CnVPQ_Cm.cjs")).then((n) => n.fontSubset_exports);
 		await initSubsetWasm(options.fontWasm);
 	})());
 	if (options.jpeg || options.jpegWasm) inits.push((async () => {
@@ -40293,4 +40386,4 @@ Object.defineProperty(exports, "xyzToRgb", {
 	}
 });
 
-//# sourceMappingURL=src-aDYhSnal.cjs.map
+//# sourceMappingURL=src-DFojMRwY.cjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modern-pdf-lib",
-  "version": "0.40.0",
+  "version": "0.40.2",
   "description": "A modern, WASM-accelerated PDF engine to create, parse, extract, fill, merge, and sign PDFs in every JavaScript runtime",
   "type": "module",
   "exports": {
@@ -97,11 +97,11 @@
     "fflate": "0.8.3"
   },
   "devDependencies": {
-    "@playwright/test": "1.62.0-alpha-2026-06-25",
+    "@playwright/test": "1.62.0-alpha-2026-06-27",
     "@vitest/coverage-v8": "5.0.0-beta.5",
     "esbuild": "0.28.1",
     "fast-png": "8.0.0",
-    "miniflare": "4.20260623.0",
+    "miniflare": "4.20260625.0",
     "oxlint": "^1.71.0",
     "oxlint-tsgolint": "^0.23.0",
     "pdf-lib": "^1.17.1",