pretext-pdf 1.1.1 → 1.7.0

package/README.md

@@ -9,7 +9,7 @@
 [![npm downloads](https://img.shields.io/npm/dw/pretext-pdf)](https://www.npmjs.com/package/pretext-pdf)
 [![CI](https://github.com/Himaan1998Y/pretext-pdf/actions/workflows/ci.yml/badge.svg)](https://github.com/Himaan1998Y/pretext-pdf/actions)
 [![TypeScript](https://img.shields.io/badge/typescript-strict-blue)](https://www.typescriptlang.org/)
-[![Tests](https://img.shields.io/badge/tests-743-brightgreen)](#tests)
+[![Tests](https://img.shields.io/badge/tests-passing-brightgreen)](#tests)
 [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![Bundle](https://img.shields.io/badge/runtime%20deps-7-informational)](#runtime-footprint)
 
@@ -135,17 +135,53 @@ const pdf = await render({
 writeFileSync('invoice.pdf', pdf)
 ```
 
-> **Security — file-path access**
-> By default, `render()` will read any absolute file path supplied in `image.src`, `svg.src`,
-> or watermark image fields. If your document JSON originates from user input, an LLM,
-> or any external source, set `allowedFileDirs` to restrict reads to a known directory:
+> **Validation — when documents come from external sources**
+>
+> If your document JSON originates from user input, an LLM agent, an API response, or any external source, call `validate()` or `validateDocument()` first:
+>
+> ```typescript
+> import { validate, render } from 'pretext-pdf'
+> // LLM-generated documents or user input: validate before rendering
+> validate(untrustedDoc) // Throws if invalid
+> const pdf = await render(untrustedDoc)
+> // Or use validateDocument() for non-throwing validation:
+> const result = validateDocument(untrustedDoc)
+> if (!result.valid) {
+>   console.error('Invalid document:', result.errors)
+>   return
+> }
+> ```
+>
+> Validation prevents injection attacks, catches shape errors early, and gives better error messages than render() alone.
+
+> **⚠️ Security — file-path access (READ BEFORE PRODUCTION DEPLOY)**
+>
+> **`allowedFileDirs` is opt-in, not on by default.** If you do not set it,
+> `render()` will read ANY absolute file path supplied in `image.src`,
+> `svg.src`, font `src`, watermark image, or P12 cert path — including
+> sensitive system paths like `/etc/passwd`, `~/.ssh/id_rsa`,
+> `/proc/self/environ`, or AWS credentials files.
+>
+> This default-open behavior is intentional for trusted in-process callers
+> (your own backend constructing documents from internal data). It is
+> **unsafe** for any deployment where document JSON crosses a trust
+> boundary: API requests, webhooks, user uploads, LLM-generated documents,
+> or any MCP-style tool call.
+>
+> **For untrusted input, you MUST set `allowedFileDirs`:**
 >
 > ```typescript
 > await render(doc, { allowedFileDirs: ['/srv/safe/assets/'] })
 > ```
 >
-> Paths outside the listed directories throw `PATH_TRAVERSAL`. HTTPS image URLs are
-> always validated against an SSRF blocklist regardless of this setting.
+> Paths outside the listed directories throw `PATH_TRAVERSAL`. HTTPS image
+> URLs are always validated against an SSRF blocklist (undici-pinned DNS,
+> private-range blocking) regardless of this setting.
+>
+> **Reference deployments using untrusted input must also call
+> `validateDocument(doc)` before `render(doc)`** (see the "Validation"
+> section below) — `allowedFileDirs` is one of three layers; validation
+> and SSRF defense are the other two.
 
 ### CLI
 
@@ -481,6 +517,42 @@ const schemaString = JSON.stringify(pdfDocumentSchema, null, 2)
 
 ---
 
+## Validation
+
+When `document` comes from external sources (API requests, user input, MCP tools, LLM output), **ALWAYS** run `validateDocument(doc)` (or `validate(doc)`) before `render(doc)`:
+
+```typescript
+import { validateDocument, render } from 'pretext-pdf'
+
+const validation = validateDocument(untrustedDoc)
+if (!validation.valid) {
+  return { error: validation.errors }
+}
+const bytes = await render(untrustedDoc)
+```
+
+Skipping validation on untrusted input may cause:
+
+- **Stack overflow on deeply nested malicious input** — Without the depth and
+  cycle guards in `validate()`, cyclic or pathologically nested documents can
+  exhaust the call stack inside the layout engine.
+- **Prototype pollution** — Properties like `__proto__` smuggled through
+  `JSON.parse` can leak into the rendering pipeline if not filtered by the
+  validator's strict checks.
+- **Unexpected runtime errors that surface as 500s** — Renderer assumes
+  well-typed input; passing malformed shapes through `render()` directly will
+  surface as opaque stack traces rather than structured `VALIDATION_ERROR`s.
+
+The validator enforces:
+
+- A nesting depth cap (`MAX_VALIDATION_DEPTH = 32`) at every container entry.
+- Cycle detection on `ListItem.items`, `FloatGroup.content`, `RichParagraph.spans`,
+  and `TableElement.rows`.
+- URL scheme allow-listing (no `javascript:`, `data:`, `vbscript:`).
+- File-path safety for fonts and images (no UNC, no remote URLs).
+
+---
+
 ## Strict validation
 
 By default, `render()` uses permissive validation — unknown properties are silently ignored. Enable strict mode to catch typos and ensure property names match the schema exactly:
@@ -888,6 +960,9 @@ See [SECURITY.md](SECURITY.md) for disclosure policy.
 | **0.9.0** | **CLI, pdfmake compat shim, GFM tables + task lists** | ✅ |
 | **1.0.0** | **Plugin API (custom element types), strict validation, `PdfBuilder` fluent API** | ✅ |
 | **1.0.2–1.0.6** | **`validateDocument()`, JSON Schema export, full schema coverage, audit fixes** | ✅ |
+| **1.1.0** | **Vendored pretext layout engine, removed `@chenglou/pretext` npm dep** | ✅ |
+| **1.2.x** | **Discriminated union types, security hardening (SSRF, isError), benchmark corpora** | ✅ |
+| **1.3.0–1.3.4** | **DNS dedup, parallel raster, word-width cache (~1.66x speedup); drift guards; toc-entry validation** | ✅ |
 | Future | Variable fonts, OpenType features, PDF/A, PDF/UA accessibility | 🔜 |
 
 See [docs/ROADMAP.md](docs/ROADMAP.md).

package/dist/allowed-props.d.ts

@@ -3,6 +3,81 @@
  * Enforced at runtime by strict: true validation.
  * Compile-time drift guards via Exact<T, Keys> ensure types stay synchronized.
  */
+import type { PdfDocument, ParagraphElement, HeadingElement, SpacerElement, TableElement, TableCell, ColumnDef, ImageElement, SvgElement, QrCodeElement, BarcodeElement, ChartElement, ListElement, ListItem, HorizontalRuleElement, PageBreakElement, CodeBlockElement, RichParagraphElement, InlineSpan, BlockquoteElement, CalloutElement, CommentElement, FormFieldElement, FootnoteDefElement, TocElement, FloatGroupElement, AnnotationSpec, TableRow, DocumentMetadata, EncryptionSpec } from './types.js';
+import type { TocEntryElement } from './types-internal.js';
+/** Compile-time assertion that T has exactly the keys in Keys (no more, no less) */
+type Exact<T, Keys extends readonly (keyof T)[]> = T & Record<Exclude<keyof T, Keys[number]>, never>;
+declare const DOC_KEYS: readonly ["pageSize", "margins", "defaultFont", "defaultFontSize", "defaultLineHeight", "fonts", "header", "footer", "watermark", "encryption", "signature", "bookmarks", "hyphenation", "metadata", "defaultParagraphStyle", "sections", "content", "flattenForms", "onImageLoadError", "onFormFieldError", "renderDate", "allowedFileDirs"];
+declare const METADATA_KEYS: readonly ["title", "author", "subject", "keywords", "creator", "language", "producer"];
+declare const PARAGRAPH_KEYS: readonly ["type", "text", "dir", "fontSize", "lineHeight", "fontFamily", "fontWeight", "color", "align", "bgColor", "spaceAfter", "spaceBefore", "keepTogether", "underline", "strikethrough", "url", "columns", "columnGap", "hyphenate", "letterSpacing", "smallCaps", "tabularNumbers", "annotation"];
+declare const HEADING_KEYS: readonly ["type", "level", "text", "dir", "fontFamily", "fontWeight", "fontSize", "lineHeight", "align", "color", "bgColor", "spaceBefore", "spaceAfter", "keepTogether", "underline", "strikethrough", "bookmark", "hyphenate", "url", "anchor", "letterSpacing", "smallCaps", "tabularNumbers", "annotation"];
+declare const SPACER_KEYS: readonly ["type", "height"];
+declare const TABLE_KEYS: readonly ["type", "columns", "rows", "dir", "headerRows", "borderColor", "borderWidth", "headerBgColor", "fontSize", "cellPaddingH", "cellPaddingV", "spaceAfter", "spaceBefore"];
+declare const COLUMN_DEF_KEYS: readonly ["width", "align"];
+declare const TABLE_ROW_KEYS: readonly ["cells", "isHeader"];
+declare const TABLE_CELL_KEYS: readonly ["text", "dir", "align", "fontWeight", "fontFamily", "fontSize", "color", "bgColor", "colspan", "rowspan", "tabularNumbers"];
+declare const IMAGE_KEYS: readonly ["type", "src", "format", "width", "height", "align", "spaceAfter", "spaceBefore", "float", "floatWidth", "floatGap", "floatText", "floatSpans", "floatFontSize", "floatFontFamily", "floatColor"];
+declare const SVG_KEYS: readonly ["type", "svg", "src", "width", "height", "align", "spaceBefore", "spaceAfter"];
+declare const QR_CODE_KEYS: readonly ["type", "data", "size", "errorCorrectionLevel", "foreground", "background", "margin", "align", "spaceBefore", "spaceAfter"];
+declare const BARCODE_KEYS: readonly ["type", "symbology", "data", "width", "height", "includeText", "align", "spaceBefore", "spaceAfter"];
+declare const CHART_KEYS: readonly ["type", "spec", "width", "height", "caption", "align", "spaceBefore", "spaceAfter"];
+declare const LIST_KEYS: readonly ["type", "style", "items", "marker", "indent", "markerWidth", "fontSize", "lineHeight", "itemSpaceAfter", "spaceAfter", "spaceBefore", "color", "nestedNumberingStyle"];
+declare const LIST_ITEM_KEYS: readonly ["text", "dir", "fontWeight", "items"];
+declare const HR_KEYS: readonly ["type", "thickness", "color", "spaceAbove", "spaceBelow", "spaceBefore", "spaceAfter"];
+declare const PAGE_BREAK_KEYS: readonly ["type"];
+declare const CODE_KEYS: readonly ["type", "text", "dir", "fontFamily", "fontSize", "lineHeight", "bgColor", "color", "padding", "spaceAfter", "spaceBefore", "keepTogether", "language", "highlightTheme"];
+declare const RICH_PARAGRAPH_KEYS: readonly ["type", "spans", "dir", "fontSize", "lineHeight", "align", "bgColor", "spaceBefore", "spaceAfter", "keepTogether", "columns", "columnGap", "letterSpacing", "smallCaps", "tabularNumbers"];
+declare const INLINE_SPAN_KEYS: readonly ["text", "dir", "fontFamily", "fontWeight", "fontStyle", "color", "fontSize", "underline", "strikethrough", "url", "href", "verticalAlign", "smallCaps", "letterSpacing", "footnoteRef"];
+declare const BLOCKQUOTE_KEYS: readonly ["type", "text", "dir", "borderColor", "borderWidth", "bgColor", "color", "fontFamily", "fontWeight", "fontStyle", "fontSize", "lineHeight", "padding", "paddingH", "paddingV", "align", "spaceBefore", "spaceAfter", "keepTogether", "underline", "strikethrough"];
+declare const CALLOUT_KEYS: readonly ["type", "content", "style", "title", "backgroundColor", "borderColor", "color", "titleColor", "fontFamily", "fontWeight", "fontSize", "lineHeight", "padding", "paddingH", "paddingV", "spaceAfter", "spaceBefore", "keepTogether", "dir"];
+declare const COMMENT_KEYS: readonly ["type", "contents", "author", "color", "open", "spaceAfter"];
+declare const FORM_FIELD_KEYS: readonly ["type", "fieldType", "name", "label", "placeholder", "defaultValue", "multiline", "maxLength", "checked", "options", "defaultSelected", "width", "height", "fontSize", "borderColor", "backgroundColor", "spaceAfter", "spaceBefore", "keepTogether"];
+declare const FOOTNOTE_DEF_KEYS: readonly ["type", "id", "text", "fontSize", "fontFamily", "spaceAfter"];
+declare const TOC_KEYS: readonly ["type", "title", "showTitle", "minLevel", "maxLevel", "fontSize", "titleFontSize", "levelIndent", "leader", "entrySpacing", "fontFamily", "spaceBefore", "spaceAfter"];
+declare const TOC_ENTRY_KEYS: readonly ["type", "text", "pageNumber", "level", "levelIndent", "leader", "fontFamily", "fontWeight"];
+declare const FLOAT_GROUP_KEYS: readonly ["type", "image", "float", "floatWidth", "floatGap", "content", "spaceBefore", "spaceAfter"];
+declare const ANNOTATION_KEYS: readonly ["contents", "author", "color", "open"];
+declare const ENCRYPTION_KEYS: readonly ["userPassword", "ownerPassword", "permissions"];
+/**
+ * Compile-time drift guard — fails the build if any element/sub-structure type
+ * gains or loses a property without the corresponding KEYS array being updated.
+ * Consolidated from per-type `type _X = Exact<...>` aliases in v1.5.1 (M5a) to
+ * keep noUnusedLocals enabled without 30 unused-type warnings. The tuple is
+ * referenced via `export type` so TypeScript counts it as used.
+ */
+export type _AllowedPropsDriftGuard = [
+    Exact<PdfDocument, typeof DOC_KEYS>,
+    Exact<DocumentMetadata, typeof METADATA_KEYS>,
+    Exact<ParagraphElement, typeof PARAGRAPH_KEYS>,
+    Exact<HeadingElement, typeof HEADING_KEYS>,
+    Exact<SpacerElement, typeof SPACER_KEYS>,
+    Exact<TableElement, typeof TABLE_KEYS>,
+    Exact<ColumnDef, typeof COLUMN_DEF_KEYS>,
+    Exact<TableRow, typeof TABLE_ROW_KEYS>,
+    Exact<TableCell, typeof TABLE_CELL_KEYS>,
+    Exact<ImageElement, typeof IMAGE_KEYS>,
+    Exact<SvgElement, typeof SVG_KEYS>,
+    Exact<QrCodeElement, typeof QR_CODE_KEYS>,
+    Exact<BarcodeElement, typeof BARCODE_KEYS>,
+    Exact<ChartElement, typeof CHART_KEYS>,
+    Exact<ListElement, typeof LIST_KEYS>,
+    Exact<ListItem, typeof LIST_ITEM_KEYS>,
+    Exact<HorizontalRuleElement, typeof HR_KEYS>,
+    Exact<PageBreakElement, typeof PAGE_BREAK_KEYS>,
+    Exact<CodeBlockElement, typeof CODE_KEYS>,
+    Exact<RichParagraphElement, typeof RICH_PARAGRAPH_KEYS>,
+    Exact<InlineSpan, typeof INLINE_SPAN_KEYS>,
+    Exact<BlockquoteElement, typeof BLOCKQUOTE_KEYS>,
+    Exact<CalloutElement, typeof CALLOUT_KEYS>,
+    Exact<CommentElement, typeof COMMENT_KEYS>,
+    Exact<FormFieldElement, typeof FORM_FIELD_KEYS>,
+    Exact<FootnoteDefElement, typeof FOOTNOTE_DEF_KEYS>,
+    Exact<TocElement, typeof TOC_KEYS>,
+    Exact<TocEntryElement, typeof TOC_ENTRY_KEYS>,
+    Exact<FloatGroupElement, typeof FLOAT_GROUP_KEYS>,
+    Exact<AnnotationSpec, typeof ANNOTATION_KEYS>,
+    Exact<EncryptionSpec, typeof ENCRYPTION_KEYS>
+];
 export declare const ALLOWED_PROPS: {
     readonly paragraph: Set<"text" | "type" | "dir" | "fontSize" | "lineHeight" | "fontFamily" | "fontWeight" | "color" | "align" | "bgColor" | "spaceAfter" | "spaceBefore" | "keepTogether" | "underline" | "strikethrough" | "url" | "columns" | "columnGap" | "hyphenate" | "letterSpacing" | "smallCaps" | "tabularNumbers" | "annotation">;
     readonly heading: Set<"text" | "type" | "dir" | "fontSize" | "lineHeight" | "fontFamily" | "fontWeight" | "color" | "align" | "bgColor" | "spaceAfter" | "spaceBefore" | "keepTogether" | "underline" | "strikethrough" | "url" | "hyphenate" | "letterSpacing" | "smallCaps" | "tabularNumbers" | "annotation" | "level" | "bookmark" | "anchor">;
@@ -38,4 +113,5 @@ export declare const ALLOWED_PROPS_SUB: {
     readonly annotation: Set<"author" | "color" | "contents" | "open">;
     readonly encryption: Set<"userPassword" | "ownerPassword" | "permissions">;
 };
+export {};
 //# sourceMappingURL=allowed-props.d.ts.map

package/dist/allowed-props.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allowed-props.d.ts","sourceRoot":"","sources":["../src/allowed-props.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkMH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;CAuBhB,CAAA;AAEV,eAAO,MAAM,iBAAiB;;;;;;;;;;CAUpB,CAAA"}
+{"version":3,"file":"allowed-props.d.ts","sourceRoot":"","sources":["../src/allowed-props.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,SAAS,EACT,SAAS,EACT,YAAY,EACZ,UAAU,EACV,aAAa,EACb,cAAc,EACd,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,cAAc,EACf,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1D,oFAAoF;AACpF,KAAK,KAAK,CAAC,CAAC,EAAE,IAAI,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAIpG,QAAA,MAAM,QAAQ,+UAKJ,CAAA;AAEV,QAAA,MAAM,aAAa,wFAAyF,CAAA;AAE5G,QAAA,MAAM,cAAc,0SAKV,CAAA;AAEV,QAAA,MAAM,YAAY,iTAKR,CAAA;AAEV,QAAA,MAAM,WAAW,6BAA8B,CAAA;AAE/C,QAAA,MAAM,UAAU,mLAGN,CAAA;AAEV,QAAA,MAAM,eAAe,6BAA8B,CAAA;AAEnD,QAAA,MAAM,cAAc,gCAAiC,CAAA;AAErD,QAAA,MAAM,eAAe,uIAGX,CAAA;AAEV,QAAA,MAAM,UAAU,6MAIN,CAAA;AAEV,QAAA,MAAM,QAAQ,0FAA2F,CAAA;AAEzG,QAAA,MAAM,YAAY,uIAGR,CAAA;AAEV,QAAA,MAAM,YAAY,gHAER,CAAA;AAEV,QAAA,MAAM,UAAU,+FAAgG,CAAA;AAEhH,QAAA,MAAM,SAAS,kLAGL,CAAA;AAEV,QAAA,MAAM,cAAc,iDAAkD,CAAA;AAEtE,QAAA,MAAM,OAAO,kGAAmG,CAAA;AAEhH,QAAA,MAAM,eAAe,mBAAoB,CAAA;AAEzC,QAAA,MAAM,SAAS,oLAGL,CAAA;AAEV,QAAA,MAAM,mBAAmB,sMAIf,CAAA;AAEV,QAAA,MAAM,gBAAgB,mMAGZ,CAAA;AAEV,QAAA,MAAM,eAAe,8QAIX,CAAA;AAEV,QAAA,MAAM,YAAY,sPAIR,CAAA;AAEV,QAAA,MAAM,YAAY,wEAAyE,CAAA;AAE3F,QAAA,MAAM,eAAe,iQAIX,CAAA;AAEV,QAAA,MAAM,iBAAiB,yEAA0E,CAAA;AAEjG,QAAA,MAAM,QAAQ,kLAGJ,CAAA;AAEV,QAAA,MAAM,cAAc,uGAAwG,CAAA;AAE5H,QAAA,MAAM,gBAAgB,uGAAwG,CAAA;AAE9H,QAAA,MAAM,eAAe,kDAAmD,CAAA;AAExE,QAAA,MAAM,eAAe,2DAA4D,CAAA;AAEjF;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,CAAC,WAAW,EAAE,OAAO,QAAQ,CAAC;IACnC,KAAK,CAAC,gBAAgB,EAAE,OAAO,aAAa,CAAC;IAC7C,KAAK,CAAC,gBAAgB,EAAE,OAAO,cAAc,CAAC;IAC9C,KAAK,CAAC,cAAc,EAAE,OAAO,YAAY,CAAC;IAC1C,KAAK,CAAC,aAAa,EAAE,OAAO,WAAW,CAAC;IACxC,KAAK,CAAC,YAAY,EAAE,OAAO,UAAU,CAAC;IACtC,KAAK,CAAC,SAAS,EAAE,OAAO,eAAe,CAAC;IACxC,KAAK,CAAC,QAAQ,EAAE,OAAO,cAAc,CAAC;IACtC,KAAK,CAAC,SAAS,EAAE,OAAO,eAAe,CAAC;IACxC,KAAK,CAAC,YAAY,EAAE,OAAO,UAAU,CAAC;IACtC,KAAK,CAAC,UAAU,EAAE,OAAO,QAAQ,CAAC;IAClC,KAAK,CAAC,aAAa,EAAE,OAAO,YAAY,CAAC;IACzC,KAAK,CAAC,cAAc,EAAE,OAAO,YAAY,CAAC;IAC1C,KAAK,CAAC,YAAY,EAAE,OAAO,UAAU,CAAC;IACtC,KAAK,CAAC,WAAW,EAAE,OAAO,SAAS,CAAC;IACpC,KAAK,CAAC,QAAQ,EAAE,OAAO,cAAc,CAAC;IACtC,KAAK,CAAC,qBAAqB,EAAE,OAAO,OAAO,CAAC;IAC5C,KAAK,CAAC,gBAAgB,EAAE,OAAO,eAAe,CAAC;IAC/C,KAAK,CAAC,gBAAgB,EAAE,OAAO,SAAS,CAAC;IACzC,KAAK,CAAC,oBAAoB,EAAE,OAAO,mBAAmB,CAAC;IACvD,KAAK,CAAC,UAAU,EAAE,OAAO,gBAAgB,CAAC;IAC1C,KAAK,CAAC,iBAAiB,EAAE,OAAO,eAAe,CAAC;IAChD,KAAK,CAAC,cAAc,EAAE,OAAO,YAAY,CAAC;IAC1C,KAAK,CAAC,cAAc,EAAE,OAAO,YAAY,CAAC;IAC1C,KAAK,CAAC,gBAAgB,EAAE,OAAO,eAAe,CAAC;IAC/C,KAAK,CAAC,kBAAkB,EAAE,OAAO,iBAAiB,CAAC;IACnD,KAAK,CAAC,UAAU,EAAE,OAAO,QAAQ,CAAC;IAClC,KAAK,CAAC,eAAe,EAAE,OAAO,cAAc,CAAC;IAC7C,KAAK,CAAC,iBAAiB,EAAE,OAAO,gBAAgB,CAAC;IACjD,KAAK,CAAC,cAAc,EAAE,OAAO,eAAe,CAAC;IAC7C,KAAK,CAAC,cAAc,EAAE,OAAO,eAAe,CAAC;CAC9C,CAAA;AAID,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;CAuBhB,CAAA;AAEV,eAAO,MAAM,iBAAiB;;;;;;;;;;CAUpB,CAAA"}

package/dist/allowed-props.js.map

@@ -1 +1 @@
-{"version":3,"file":"allowed-props.js","sourceRoot":"","sources":["../src/allowed-props.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuCH,iFAAiF;AAEjF,MAAM,QAAQ,GAAG;IACf,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB;IAC5E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IAChF,aAAa,EAAE,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,SAAS;IACzE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,iBAAiB;CAC/E,CAAA;AAGV,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAU,CAAA;AAG5G,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO;IACpF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW;IAC5E,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe;IAC5E,WAAW,EAAE,gBAAgB,EAAE,YAAY;CACnC,CAAA;AAGV,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY;IACpF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;IACrF,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW;IACvF,gBAAgB,EAAE,YAAY;CACtB,CAAA;AAGV,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAA;AAG/C,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa;IAC5E,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa;CAChF,CAAA;AAGV,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAA;AAGnD,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,UAAU,CAAU,CAAA;AAGrD,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS;IAClF,SAAS,EAAE,SAAS,EAAE,gBAAgB;CAC9B,CAAA;AAGV,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa;IAChF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe;IAC7E,iBAAiB,EAAE,YAAY;CACvB,CAAA;AAGV,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAGzG,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ;IACpF,OAAO,EAAE,aAAa,EAAE,YAAY;CAC5B,CAAA;AAGV,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY;CAC3F,CAAA;AAGV,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAGhH,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY;IACrF,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB;CACtE,CAAA;AAGV,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAU,CAAA;AAGtE,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAGhH,MAAM,eAAe,GAAG,CAAC,MAAM,CAAU,CAAA;AAGzC,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO;IACjF,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB;CAC5E,CAAA;AAGV,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa;IACnF,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW;IAClF,gBAAgB;CACR,CAAA;AAGV,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;IACxF,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa;CACpF,CAAA;AAGV,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY;IACrF,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IACtF,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe;CAC1E,CAAA;AAGV,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY;IAC5F,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IACvF,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK;CAC1C,CAAA;AAGV,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAU,CAAA;AAG3F,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW;IAChF,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;IACnF,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc;CACrE,CAAA;AAGV,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAU,CAAA;AAGjG,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe;IACjF,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY;CAC1E,CAAA;AAGV,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAU,CAAA;AAG5H,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAG9H,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,CAAA;AAGxE,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,aAAa,CAAU,CAAA;AAGjF,iFAAiF;AAEjF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC;IAC9B,OAAO,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC;IAC5B,OAAO,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC;IAC5B,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;IACxB,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,OAAO,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC;IAC5B,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC;IAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC;IACtB,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC;IAC1B,gBAAgB,EAAE,IAAI,GAAG,CAAC,mBAAmB,CAAC;IAC9C,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;IACxB,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,cAAc,EAAE,IAAI,GAAG,CAAC,iBAAiB,CAAC;IAC1C,aAAa,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC;CAChC,CAAA;AAEV,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,UAAU,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;IAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC;IAClC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,aAAa,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;CAC9B,CAAA"}
+{"version":3,"file":"allowed-props.js","sourceRoot":"","sources":["../src/allowed-props.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuCH,iFAAiF;AAEjF,MAAM,QAAQ,GAAG;IACf,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB;IAC5E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IAChF,aAAa,EAAE,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,SAAS;IACzE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,iBAAiB;CAC/E,CAAA;AAEV,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAU,CAAA;AAE5G,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO;IACpF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW;IAC5E,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe;IAC5E,WAAW,EAAE,gBAAgB,EAAE,YAAY;CACnC,CAAA;AAEV,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY;IACpF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;IACrF,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW;IACvF,gBAAgB,EAAE,YAAY;CACtB,CAAA;AAEV,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAA;AAE/C,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa;IAC5E,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa;CAChF,CAAA;AAEV,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAA;AAEnD,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,UAAU,CAAU,CAAA;AAErD,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS;IAClF,SAAS,EAAE,SAAS,EAAE,gBAAgB;CAC9B,CAAA;AAEV,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa;IAChF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe;IAC7E,iBAAiB,EAAE,YAAY;CACvB,CAAA;AAEV,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAEzG,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ;IACpF,OAAO,EAAE,aAAa,EAAE,YAAY;CAC5B,CAAA;AAEV,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY;CAC3F,CAAA;AAEV,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAEhH,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY;IACrF,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB;CACtE,CAAA;AAEV,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAU,CAAA;AAEtE,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAEhH,MAAM,eAAe,GAAG,CAAC,MAAM,CAAU,CAAA;AAEzC,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO;IACjF,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB;CAC5E,CAAA;AAEV,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa;IACnF,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW;IAClF,gBAAgB;CACR,CAAA;AAEV,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;IACxF,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa;CACpF,CAAA;AAEV,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY;IACrF,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IACtF,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe;CAC1E,CAAA;AAEV,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY;IAC5F,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IACvF,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK;CAC1C,CAAA;AAEV,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAU,CAAA;AAE3F,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW;IAChF,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;IACnF,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc;CACrE,CAAA;AAEV,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAU,CAAA;AAEjG,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe;IACjF,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY;CAC1E,CAAA;AAEV,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAU,CAAA;AAE5H,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,CAAU,CAAA;AAE9H,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,CAAA;AAExE,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,aAAa,CAAU,CAAA;AA2CjF,iFAAiF;AAEjF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC;IAC9B,OAAO,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC;IAC5B,OAAO,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC;IAC5B,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;IACxB,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,OAAO,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC;IAC5B,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC;IAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC;IACtB,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC;IAC1B,gBAAgB,EAAE,IAAI,GAAG,CAAC,mBAAmB,CAAC;IAC9C,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;IACxB,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;IAChC,cAAc,EAAE,IAAI,GAAG,CAAC,iBAAiB,CAAC;IAC1C,aAAa,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC;CAChC,CAAA;AAEV,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,UAAU,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;IAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC;IAClC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,WAAW,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;IACpC,aAAa,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;IACtC,YAAY,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC;CAC9B,CAAA"}

package/dist/assets/generators/barcode.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Barcode SVG generator — extracted from src/assets.ts in v1.6.0 commit 12/16.
+ *
+ * `bwip-js` is loaded via dynamic import (optional peer dep). Lazy-load
+ * pattern preserved so cold-start cost stays equivalent.
+ */
+import type { BarcodeElement } from '../../types.js';
+export declare function generateBarcodeSvg(el: BarcodeElement): Promise<string>;
+//# sourceMappingURL=barcode.d.ts.map

package/dist/assets/generators/barcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"barcode.d.ts","sourceRoot":"","sources":["../../../src/assets/generators/barcode.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAGpD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B5E"}

package/dist/assets/generators/barcode.js

@@ -0,0 +1,24 @@
+import { PretextPdfError } from '../../errors.js';
+export async function generateBarcodeSvg(el) {
+    let bwip;
+    try {
+        bwip = await import('bwip-js');
+    }
+    catch {
+        throw new PretextPdfError('BARCODE_DEP_MISSING', 'barcode elements require the bwip-js package. Install it: npm install bwip-js');
+    }
+    try {
+        return bwip.toSVG({
+            bcid: el.symbology,
+            text: el.data,
+            scale: 3,
+            includetext: el.includeText !== false,
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const isSymbology = msg.toLowerCase().includes('unknown') || msg.toLowerCase().includes('bcid');
+        throw new PretextPdfError(isSymbology ? 'BARCODE_SYMBOLOGY_INVALID' : 'BARCODE_GENERATE_FAILED', `Barcode generation failed (symbology: '${el.symbology}'): ${msg}`);
+    }
+}
+//# sourceMappingURL=barcode.js.map

package/dist/assets/generators/barcode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"barcode.js","sourceRoot":"","sources":["../../../src/assets/generators/barcode.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAkB;IAEzD,IAAI,IAAgB,CAAA;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,SAAmB,CAAe,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,+EAA+E,CAChF,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,IAAI,EAAE,EAAE,CAAC,SAAS;YAClB,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,CAAC;YACR,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,KAAK;SACtC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/F,MAAM,IAAI,eAAe,CACvB,WAAW,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,yBAAyB,EACrE,0CAA0C,EAAE,CAAC,SAAS,OAAO,GAAG,EAAE,CACnE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/assets/generators/chart.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Chart SVG generator (vega-lite, optional) — extracted from src/assets.ts
+ * in v1.6.0 commit 12/16.
+ *
+ * `vega` + `vega-lite` are loaded via dynamic import (optional peer deps).
+ * Lazy-load pattern preserved so cold-start cost stays equivalent.
+ *
+ * Remote data loading is explicitly disabled inside the loader to block the
+ * SSRF vector through `spec.data.url`.
+ */
+import type { ChartElement } from '../../types.js';
+export declare function generateChartSvg(el: ChartElement, contentWidth: number): Promise<string>;
+//# sourceMappingURL=chart.d.ts.map

package/dist/assets/generators/chart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chart.d.ts","sourceRoot":"","sources":["../../../src/assets/generators/chart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAGlD,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC9F"}

package/dist/assets/generators/chart.js

@@ -0,0 +1,32 @@
+import { PretextPdfError } from '../../errors.js';
+export async function generateChartSvg(el, contentWidth) {
+    let vegaLite;
+    let vega;
+    try {
+        vegaLite = await import('vega-lite');
+        vega = await import('vega');
+    }
+    catch {
+        throw new PretextPdfError('CHART_DEP_MISSING', 'chart elements require vega and vega-lite packages. Install them: npm install vega vega-lite');
+    }
+    let vegaSpec;
+    try {
+        const specWithSize = { ...el.spec, width: el.width ?? contentWidth, height: el.height ?? 300 };
+        vegaSpec = vegaLite.compile(specWithSize).spec;
+    }
+    catch (err) {
+        throw new PretextPdfError('CHART_SPEC_INVALID', `vega-lite spec compilation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        // Block all remote data loading to prevent SSRF — vega's default loader
+        // follows any data.url in the spec, which could reach internal services
+        const blockedLoader = vega.loader();
+        blockedLoader.load = (_uri) => Promise.reject(new Error('Remote data loading is disabled in pretext-pdf'));
+        const view = new vega.View(vega.parse(vegaSpec), { renderer: 'none', loader: blockedLoader });
+        return await view.toSVG();
+    }
+    catch (err) {
+        throw new PretextPdfError('CHART_RENDER_FAILED', `Chart SVG rendering failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=chart.js.map

package/dist/assets/generators/chart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chart.js","sourceRoot":"","sources":["../../../src/assets/generators/chart.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAgB,EAAE,YAAoB;IAI3E,IAAI,QAAwB,CAAA;IAC5B,IAAI,IAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAqB,CAAmB,CAAA;QAChE,IAAI,GAAO,MAAM,MAAM,CAAC,MAAgB,CAAe,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,8FAA8F,CAC/F,CAAA;IACH,CAAC;IACD,IAAI,QAAiC,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG,EAAE,CAAA;QAC9F,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzF,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QACnC,aAAa,CAAC,IAAI,GAAG,CAAC,IAAY,EAAmB,EAAE,CACrD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAA;QAC7E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;QAC7F,OAAO,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/assets/generators/qr.d.ts

@@ -0,0 +1,9 @@
+/**
+ * QR code SVG generator — extracted from src/assets.ts in v1.6.0 commit 12/16.
+ *
+ * `qrcode` is loaded via dynamic import (optional peer dep). Lazy-load
+ * pattern preserved so cold-start cost stays equivalent.
+ */
+import type { QrCodeElement } from '../../types.js';
+export declare function generateQrSvg(el: QrCodeElement): Promise<string>;
+//# sourceMappingURL=qr.d.ts.map

package/dist/assets/generators/qr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.d.ts","sourceRoot":"","sources":["../../../src/assets/generators/qr.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGnD,wBAAsB,aAAa,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}

package/dist/assets/generators/qr.js

@@ -0,0 +1,25 @@
+import { PretextPdfError } from '../../errors.js';
+export async function generateQrSvg(el) {
+    let qrLib;
+    try {
+        qrLib = await import('qrcode');
+    }
+    catch {
+        throw new PretextPdfError('QR_DEP_MISSING', 'qr-code elements require the qrcode package. Install it: npm install qrcode');
+    }
+    try {
+        return await qrLib.toString(el.data, {
+            type: 'svg',
+            errorCorrectionLevel: el.errorCorrectionLevel ?? 'M',
+            margin: el.margin ?? 4,
+            color: {
+                dark: el.foreground ?? '#000000',
+                light: el.background ?? '#ffffff',
+            },
+        });
+    }
+    catch (err) {
+        throw new PretextPdfError('QR_GENERATE_FAILED', `QR code generation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=qr.js.map

package/dist/assets/generators/qr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../../src/assets/generators/qr.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAiB;IAEnD,IAAI,KAAmB,CAAA;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,QAAkB,CAAiB,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,6EAA6E,CAC9E,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;YACnC,IAAI,EAAE,KAAK;YACX,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,IAAI,GAAG;YACpD,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC;YACtB,KAAK,EAAE;gBACL,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,SAAS;gBAChC,KAAK,EAAE,EAAE,CAAC,UAAU,IAAI,SAAS;aAClC;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjF,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/assets/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Internal barrel for the assets module — created in v1.6.0 commit 15/16.
+ *
+ * Aggregates every public symbol that was previously exported from
+ * src/assets.ts. src/assets.ts now re-exports this barrel as a one-line
+ * back-compat shim so the compiled dist/assets.js retains the same
+ * surface (fonts.ts, post-process.ts, pipeline.ts, plus direct test
+ * imports for security-ssrf, security-ipv4-bypass, assets-dns-dedup,
+ * svg-sanitizer all keep working unchanged).
+ */
+export { redactPath } from './util/redact-path.js';
+export { assertPathAllowed } from './security/path-allowlist.js';
+export { normalizeIpv4Hostname } from './security/ipv4-normalize.js';
+export { resolveAndValidateUrl, assertSafeUrl, type ResolvedSafeUrl, } from './security/url-validation.js';
+export { fetchWithTimeout } from './security/fetch.js';
+export { sanitizeSvg } from './svg/sanitize.js';
+export { VECTOR_RASTER_CONCURRENCY } from './loaders/vectors.js';
+export { loadImages } from './loaders/orchestrator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/assets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA"}

package/dist/assets/index.js

@@ -0,0 +1,19 @@
+/**
+ * Internal barrel for the assets module — created in v1.6.0 commit 15/16.
+ *
+ * Aggregates every public symbol that was previously exported from
+ * src/assets.ts. src/assets.ts now re-exports this barrel as a one-line
+ * back-compat shim so the compiled dist/assets.js retains the same
+ * surface (fonts.ts, post-process.ts, pipeline.ts, plus direct test
+ * imports for security-ssrf, security-ipv4-bypass, assets-dns-dedup,
+ * svg-sanitizer all keep working unchanged).
+ */
+export { redactPath } from './util/redact-path.js';
+export { assertPathAllowed } from './security/path-allowlist.js';
+export { normalizeIpv4Hostname } from './security/ipv4-normalize.js';
+export { resolveAndValidateUrl, assertSafeUrl, } from './security/url-validation.js';
+export { fetchWithTimeout } from './security/fetch.js';
+export { sanitizeSvg } from './svg/sanitize.js';
+export { VECTOR_RASTER_CONCURRENCY } from './loaders/vectors.js';
+export { loadImages } from './loaders/orchestrator.js';
+//# sourceMappingURL=index.js.map

package/dist/assets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EACL,qBAAqB,EACrB,aAAa,GAEd,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA"}

package/dist/assets/loaders/images.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Image loaders — extracted from src/assets.ts in v1.6.0 commit 13/16.
+ *
+ * Two pieces:
+ * - loadImageBytes(): fetch/read raw bytes from URL, file path, or Uint8Array.
+ *   Used by the loadImages() orchestrator (still in assets.ts for this commit).
+ * - resolveImageFormat(): pick 'png' vs 'jpg' from the element spec, magic
+ *   bytes, or file extension. Pure compute.
+ *
+ * Dynamic fs/path imports preserved.
+ */
+import type { ImageElement } from '../../types.js';
+/**
+ * Resolve the image format from the element spec, magic bytes, or file extension.
+ * Priority: explicit 'png'/'jpg' → magic bytes → file extension → error.
+ */
+export declare function resolveImageFormat(el: ImageElement, bytes: Uint8Array, key: string): 'png' | 'jpg';
+/** Load image bytes from a URL, file path, or Uint8Array */
+export declare function loadImageBytes(el: ImageElement, key: string, allowedDirs?: string[]): Promise<Uint8Array>;
+//# sourceMappingURL=images.d.ts.map

package/dist/assets/loaders/images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.d.ts","sourceRoot":"","sources":["../../../src/assets/loaders/images.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAMlD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAiBlG;AAED,4DAA4D;AAC5D,wBAAsB,cAAc,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAuD/G"}

package/dist/assets/loaders/images.js

@@ -0,0 +1,69 @@
+import { PretextPdfError } from '../../errors.js';
+import { redactPath } from '../util/redact-path.js';
+import { assertPathAllowed } from '../security/path-allowlist.js';
+import { fetchWithTimeout } from '../security/fetch.js';
+/**
+ * Resolve the image format from the element spec, magic bytes, or file extension.
+ * Priority: explicit 'png'/'jpg' → magic bytes → file extension → error.
+ */
+export function resolveImageFormat(el, bytes, key) {
+    if (el.format === 'png')
+        return 'png';
+    if (el.format === 'jpg')
+        return 'jpg';
+    if (bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4E && bytes[3] === 0x47)
+        return 'png';
+    if (bytes[0] === 0xFF && bytes[1] === 0xD8 && bytes[2] === 0xFF)
+        return 'jpg';
+    if (typeof el.src === 'string') {
+        const ext = el.src.toLowerCase().split('.').pop();
+        if (ext === 'png')
+            return 'png';
+        if (ext === 'jpg' || ext === 'jpeg')
+            return 'jpg';
+    }
+    throw new PretextPdfError('IMAGE_FORMAT_MISMATCH', `Image "${key}": format could not be auto-detected. Specify format: 'png' or 'jpg' explicitly.`);
+}
+/** Load image bytes from a URL, file path, or Uint8Array */
+export async function loadImageBytes(el, key, allowedDirs) {
+    if (el.src instanceof Uint8Array) {
+        return el.src;
+    }
+    const src = el.src;
+    if (!src || typeof src !== 'string') {
+        throw new PretextPdfError('IMAGE_LOAD_FAILED', `Image "${key}": 'src' must be a non-empty string path, URL, or Uint8Array`);
+    }
+    if (src.startsWith('https://') || src.startsWith('http://')) {
+        // SSRF validation happens inside fetchWithTimeout — no need to pre-validate
+        let resp;
+        try {
+            resp = await fetchWithTimeout(src, 'IMAGE_LOAD_FAILED', `Image "${key}"`);
+        }
+        catch (err) {
+            throw new PretextPdfError('IMAGE_LOAD_FAILED', `Image "${key}": failed to fetch URL: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!resp.ok) {
+            throw new PretextPdfError('IMAGE_LOAD_FAILED', `Image "${key}": URL returned HTTP ${resp.status}`);
+        }
+        try {
+            return new Uint8Array(await resp.arrayBuffer());
+        }
+        catch (err) {
+            throw new PretextPdfError('IMAGE_LOAD_FAILED', `Image "${key}": failed to read response body: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const fs = await import('fs');
+    const pathMod = await import('path');
+    const filePath = pathMod.resolve(src);
+    assertPathAllowed(filePath, allowedDirs, `Image "${key}"`);
+    if (!fs.existsSync(filePath)) {
+        throw new PretextPdfError('IMAGE_LOAD_FAILED', `Image "${key}": file not found — "${redactPath(src)}". Check the path in the image element's 'src' field.`);
+    }
+    try {
+        return new Uint8Array(fs.readFileSync(filePath));
+    }
+    catch (err) {
+        throw new PretextPdfError('IMAGE_LOAD_FAILED', `Image "${key}": failed to read file "${redactPath(src)}": ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=images.js.map

package/dist/assets/loaders/images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.js","sourceRoot":"","sources":["../../../src/assets/loaders/images.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAgB,EAAE,KAAiB,EAAE,GAAW;IACjF,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAClG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAE7E,IAAI,OAAO,EAAE,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;QACjD,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAC/B,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,KAAK,CAAA;IACnD,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,uBAAuB,EACvB,UAAU,GAAG,kFAAkF,CAChG,CAAA;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAgB,EAAE,GAAW,EAAE,WAAsB;IACxF,IAAI,EAAE,CAAC,GAAG,YAAY,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,GAAG,CAAA;IACf,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAA;IAElB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,UAAU,GAAG,8DAA8D,CAAC,CAAA;IAC7H,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,4EAA4E;QAC5E,IAAI,IAAc,CAAA;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,UAAU,GAAG,GAAG,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,UAAU,GAAG,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3F,CAAA;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,UAAU,GAAG,wBAAwB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACpG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,UAAU,GAAG,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,GAAG,GAAG,CAAC,CAAA;IAE1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,UAAU,GAAG,wBAAwB,UAAU,CAAC,GAAG,CAAC,uDAAuD,CAC5G,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,UAAU,GAAG,2BAA2B,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChH,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/assets/loaders/orchestrator.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Image-loading orchestrator — extracted from src/assets.ts in v1.6.0 commit 15/16.
+ *
+ * Stage 2b of the render pipeline: loads + embeds every ImageElement,
+ * float-group image, vector asset (SVG / QR / barcode / chart), plugin
+ * asset, and watermark image into a single ImageMap that the layout
+ * engine consumes.
+ *
+ * Image keys are 'img-N' / 'float-group-N' / 'watermark' / per-vector keys
+ * assigned inside loadVectorAssets / plugin-supplied keys.
+ *
+ * IMPORTANT: @cantoo/pdf-lib image embedding is NOT thread-safe. Raw bytes
+ * load in parallel; embed calls run sequentially.
+ *
+ * Images that fail to load (network error, file not found, unreachable URL)
+ * are routed through doc.onImageLoadError (default = warn-and-skip) so a
+ * single broken image does not crash the document.
+ */
+import { PDFDocument } from '@cantoo/pdf-lib';
+import type { PdfDocument, Logger } from '../../types.js';
+import type { ImageMap } from '../../types-internal.js';
+import type { PluginDefinition } from '../../plugin-types.js';
+export declare function loadImages(doc: PdfDocument, pdfDoc: PDFDocument, contentWidth: number, plugins?: PluginDefinition[], logger?: Logger): Promise<ImageMap>;
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/assets/loaders/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../../src/assets/loaders/orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAEvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAM7D,wBAAsB,UAAU,CAC9B,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,gBAAgB,EAAE,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAuFnB"}