Release 2.1.0 — Canvas Virtualization, Security Hardening & Enhanced Signature Navigation

TeamSync PDF Viewer SDK — Version 2.1.0

Version 2.1.0 introduces massive scale and stability enhancements, enterprise-grade security hardening, and streamlined multi-page signature navigation across the SDK and React components.

⚡ Viewport Virtualization & High-Scale Rendering

• Continuous Scroll Canvas Virtualization: Added IntersectionObserver with an 800px lookahead buffer in PageRenderer. Off-screen pages immediately unmount high-DPI canvases and release GPU memory (canvas.width = 0; canvas.height = 0) while preserving container layout geometry. Unlocks smooth navigation on documents with 100+ to 1,000+ pages without exceeding mobile Safari memory limits or bloating tab memory.
• Isolated Per-Page Form Re-renders: Keystroke updates now check whether any field on the specific page has changed value before triggering a re-render. Typing on Page 1 produces 0 re-renders across all other mounted pages.
• Stable FormManager Lifecycle: Replaced useMemo with lazy useState in TeamSyncViewer to eliminate object recreation on inline prop updates and ensure the UI and SDK instance stay synchronized.
• PDF.js Page Resource Cleanup: Wrapped diff engine operations in try ... finally to immediately invoke page.cleanup(), releasing cached glyph tables during comparisons.

🛡️ Enterprise Security Hardening

• SVG XSS & Stored Injection Prevention: XML entities (&, <, >, ", ') are strictly escaped before interpolating user/role names into SVG templates, and fallback SVG signatures are Base64 encoded.
• Credential Sanitization: Hardcoded administrative Basic Auth credentials removed from the client application bundle; credentials are securely held in edge environment variables.
• Strict Signature Upload MIME Validation: Added whitelist checks (image/png, image/jpeg, image/webp) on signature uploads to block executable SVG/HTML payloads.
• Safe In-Memory Base64 Data URL Decoding: AcroForm export decodes Base64 data URLs in memory without external network fetch(), blocking SSRF and network errors.
• Edge Function Error Masking: Unhandled exceptions are logged server-side and generic client responses are returned to prevent internal path and system detail leakage.

📈 Scale & Signature Usability

• Multi-Page Sticky Signature Jump: Clicking a signature index flag triggers automatic page navigation, smooth scrolling to field coordinates (scrollIntoView), and focus pulsing across all pages.
• AcroForm Key Collision Deduplication: Duplicate field names are automatically registered and suffixed (name_1, name_2) during PDF baking, preventing FieldAlreadyExistsError from failing exports.
• Iframe Message Listener Timeouts: Added timeout handlers (30s/60s) to clean up event listeners and reject hanging promises in single-page applications.

📦 Verification

• Unit & Integration Tests: 38 test suites, 263 passing tests (npm test).
• TypeScript: tsc -b passed with 0 errors.
• Production Bundle: Clean library and standalone app builds (vite build).

Release 2.0.0 — Multi-Role Interactive Forms, Signature Sticky Flags & SDK

TeamSync PDF Viewer v2.0.0

A major milestone release introducing Multi-Role Form Templates, Host Application Current User Context, Signature Sticky / Index Flags, and Programmatic Form SDK Controls.

---

🌟 What's New in v2.0.0

👥 Multi-Role Form Templates & Host Application User Context

• Decoupled Form Roles from User Identity: Form templates assign fields to abstract roles (FormRole) such as applicant, tenant, landlord, or reviewer. Templates are completely decoupled from specific user IDs.
• Host Application Current User Integration: Host applications pass the logged-in user profile (ViewerUser) containing id, name, email, and role. Setting a user automatically activates their role in the form session.
• Audit-Grade Signature Capture: Electronic (drawn / typed) and digital (SHA-256 certificate) signatures adopted in the viewer automatically bind the active signer's name, email, role, and timestamp.

🔖 Signature Sticky / Index Flags

• Side-Docked Visual Flags: Sticky index flags positioned along the right edge of the viewport indicate pending signatures assigned to the current user's role.
• Cross-Page Accessibility: Flags remain clearly visible on the side even when viewing page 1 while signature fields reside on page 2 or later, giving users immediate visibility into required actions.
• 1-Click Jump & Sign: Clicking a sticky flag smoothly scrolls the document directly to the target signature field and activates signature capture.
• Filtered by Active Role: Only flags relevant to the current user's role are displayed, preventing clutter and cross-user confusion.

🛠️ Form SDK & Programmatic Feature Control

• Full Form SDK on WebViewerInstance:
  • getFormRoles(), setFormRoles(), addFormRole(), updateFormRole(), removeFormRole()
  • getCurrentRole(), setCurrentRole()
  • getCurrentUser(), setCurrentUser()
  • getFormFields(), setFormFields(), getFormData(), setFormData(), clearFormData()
  • validateForm(roleId?), nextFormField(roleId?), previousFormField(roleId?)
  • getFormOptions(), setFormOptions()
• Granular Feature Visibility Controls (FormFeatureOptions):
  • allowRoleSwitching: Lock users to their assigned role or allow role switching in filler mode.
  • showRoleSelector: Toggle visibility of the role selector dropdown in the toolbar.
  • otherRoleFieldsMode: Configure how fields assigned to other roles are rendered ('interactive', 'view-only', or 'hidden').
  • showSignatureFlags: Toggle sticky index flags on or off.
  • showFlowNavigation, showValidation, showReset, showExport, hideToolbar: Fine-grained visibility toggles for the filler toolbar.

---

⚠️ Breaking Changes

• Standardized on Roles: Removed legacy assignee terminology and aliases (FormAssignee, assigneeId, setUser, setAssignees, actualUser, etc.) across all models, types, and components in favor of FormRole, FormField.roleId, and currentUser.

---

📦 Installation & Upgrade

npm install teamsync-pdf-viewer@^2.0.0

Release 1.9.0 — Interactive PDF Forms Builder & View Mode Form Filler

Interactive PDF Forms Builder ("Forms" Tab)

• Added a dedicated 3rd navigation tab ("Forms") alongside "View" and "Annotate" for designing interactive forms directly over loaded PDF documents.
• Supported controls:
  • Textbox: Single-line text input for short answers, names, codes, emails.
  • Text Area: Multi-line expandable text area for comments, descriptions, notes.
  • Date and Time Picker: Calendar and clock selector supporting date, time, or datetime format modes.
  • Check List: Multi-item checklist allowing authors to configure selectable items and respondents to check/uncheck choices independently (plus single-checkbox mode).
  • Dropdown: Single-select dropdown list with customizable choices.
  • Radio Group: Mutually exclusive single-choice options.
• Visual canvas layer with drag-to-create bounding box, 8 resize handles, drag-to-move, and keyboard delete.
• Properties editor modal for field names, labels, placeholders, required toggle, date format, and options management.
• Forms toolbar with Undo, Redo, creation tools, Clear All, Export/Import schema (JSON), and test form toggle.

Interactive Form Filler (View Tab)

• Form fields render directly on top of the PDF pages at their exact unscaled PDF coordinates, zooming and rotating with the canvas.
• Live interactive HTML inputs embedded directly over pages for single-line text, multi-line textareas, date-time pickers, checklist checkboxes, dropdowns, and radio groups.
• Real-time two-way data binding to central FormManager state.
• Form filler actions bar in View mode with completion stats, validation feedback, JSON data export, and form reset.

Role & Permissions Architecture

• Added canCreateForms permission to control access to the Forms builder tab.
• Added canFillForms permission to control interactive editing vs read-only presentation in View mode.

Native PDF AcroForm Baking & Export

• Integrated with pdf-lib to bake interactive form fields into native PDF AcroForms upon export with filled values.
• Exported public SDK methods on WebViewerInstance: getFormFields(), setFormFields(), getFormData(), setFormData(), clearFormData(), validateForm(), and exportFormData().

Security Enhancements

• SSRF prevention & edge converter hardening with strict content-type validation.
• Protocol sanitization for PDF links rejecting javascript:, vbscript:, and data: schemes.
• Bounded edit distance for Myers diff engine to prevent memory exhaustion.

v1.8.1: Document comparison enhancements, security hardening, and deployment headers

Added

• Document Comparison UX Enhancements:
  • Interactive Draggable Separator: Introduced a movable vertical split separator between documents with real-time percentage split adjustment and smooth cursor dragging.
  • Optimal 90% Container Auto-Fit: Implemented proportional viewport scaling that fits comparison documents to 90% of their split container window width, ensuring readable document layout with comfortable breathing room around margins.
  • Split Viewport Zoom & Pan Controls: Added visible zoom in/out, fit to width, fit to page, and pan tool controls directly inside the comparison toolbar header for each split pane.
  • Comparison Demo Shortcut: Added a one-click "Compare PDF" sample button to the demo top bar and URL query parameter support (?compare=true) for direct deep linking.
• Dynamic Office Conversion Credentials:
  • Client and server support for per-request converter credentials via x-gotenberg-endpoint and x-gotenberg-token headers, enabling multi-tenant and customer-provided conversion backends.

Security

• SSRF Prevention & Loopback Defense: Strict validation of remote conversion URLs in /api/convert, blocking loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16, fe80::/10), private RFC1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), unique local IPv6 (fc00::/7), and major cloud provider metadata endpoints (AWS, Azure, GCP, Oracle Cloud).
• SSRF Redirect Traversal Defense: Enforced { redirect: 'manual' } on upstream remote file retrieval in edge functions, terminating HTTP 3xx redirect attempts with HTTP 400 Bad Request to prevent redirect-based SSRF circumvention.
• Microservice Boundary Limits: Enforced strict 100MB download caps, 60s request timeout abort controllers, and validated content types to mitigate denial-of-service and memory exhaustion attacks.
• Server Error Sanitization: Sanitized edge conversion error responses returned to clients, ensuring low-level LibreOffice/Gotenberg stack traces and server-side errors are captured only in internal server logs.
• Cross-Window PostMessage Restriction: Replaced wildcard * target origin in iframe communication bridges with caller origin verification or explicit trustedOrigins configuration.
• Safe Regular Expression & ReDoS Mitigation: Bounded regex evaluation length and introduced defensive execution caps in document search and redaction utilities to prevent catastrophic regex backtracking.
• PDF Link URI Protocol Sanitization: Added strict protocol validation to embedded PDF links and annotation actions, rejecting malicious URI schemes (javascript:, vbscript:, data:) before execution.
• Production Deployment Security Headers: Added X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy to production edge deployments in vercel.json.
• Security Policy: Added repository SECURITY.md establishing supported versions and responsible vulnerability disclosure workflows.

Fixed

• TypeScript Declaration Emission: Configured outDir: 'dist/src' in vite.config.ts to ensure clean TypeScript .d.ts declaration generation conforming with publint and package exports.

v1.8.0: Native Microsoft Office document viewing and conversion pipeline

Added

• Native Microsoft Office Document Viewing:
  • View Microsoft Word (.docx, .doc), Excel (.xlsx, .xls), and PowerPoint (.pptx, .ppt) documents natively inside <TeamSyncViewer>.
  • Transparent document type detection via magic byte signatures and file extension inspection (officeDetector.ts).
  • Animated conversion loading overlay (OfficeLoadingOverlay.tsx) with real-time status indication.
  • Local drag-and-drop and toolbar file picker conversion fallback.
• Enterprise Hybrid Office Architecture:
  • Edge CDN Pre-Conversion & Caching: Fast 200–400ms cached vector PDF delivery via /api/convert?file=... with zero server CPU load on repeat views.
  • Client-Side On-The-Fly Fallback: Multipart form upload proxy for local user file drops and selection via POST /api/convert.
• Host SDK Office Module:
  • Exported useOfficeDocument React hook for host applications to manage loading, pre-conversion, and error states before mounting the viewer.
  • Exported preloadOfficeDocument(fileOrUrl, config, fileName) async helper for routers, loaders, and prefetching.
  • Exported officeConverter client service supporting remote URL conversion (convertOfficeUrl) and multipart file uploads (convertOfficeFile).
  • Added dedicated ./office subpath export in package.json alongside root exports.
  • Exported office detection utilities: isOfficeDocumentUrl, isOfficeFile, detectOfficeType, isOfficeExtension, SUPPORTED_OFFICE_EXTENSIONS.
  • Exported TypeScript types: OfficeConversionConfig, OfficeConversionState, OfficeFileType, OfficeDocumentOptions, UseOfficeDocumentResult.
• Top-Level SDK Version Export & About Modal Synchronization:
  • Exported VERSION constant from teamsync-pdf-viewer public API.
  • Automated build-time version synchronization script (scripts/sync-version.mjs) ensuring parity across package and git tags.
  • Dynamic About modal reflecting the active release tag with a direct link to GitHub release notes.
  • Edge release endpoint (/api/version) caching GitHub release metadata at the CDN edge.

v1.7.1: Responsive PDF container resizing, default fit-width, and page centering

Fixed

• Default Responsive Fit-Width: Resolved an issue where omitting initialScale prevented ResizeObserver from auto-refitting the document when the browser window or viewer container resized. Now defaults to 'fit-width' and { type: 'fit-width', ratio: 1.0 } when no explicit numeric zoom is provided.
• Dynamic Horizontal Page Centering: Added live containerDimensions state tracking so that pages automatically re-center horizontally in real-time during window resize and sidebar toggles, eliminating stale pixel offsets and right-edge clipping.
• Programmatic Zoom Tracking: Fixed dangling programmatic scale flag when newScale === scale during minor resize steps so manual zoom interactions properly clear auto-fit mode.
• Window Resize Event Listener: Added window resize event listener alongside ResizeObserver for comprehensive container refitting across all viewport changes.

Full Changelog: v1.7.0...v1.7.1

v1.7.0: Cross-instance document linking, targetViewer support, and native PDF link navigation

Added

• Cross-Instance Document Linking: Links referring to other documents or specific pages can now automatically load and navigate the destination document in a designated target TeamSyncViewer instance.
• targetViewer Prop & Option: Added targetViewer to <TeamSyncViewer> and WebViewerOptions, accepting another WebViewerInstance, a React ref (useRef<WebViewerInstance>), a getter function () => WebViewerInstance | null, or an instance ID string.
• Static Viewer Instance Registry: Added WebViewerInstance.getInstance(id), WebViewerInstance.registerInstance(id, inst), WebViewerInstance.unregisterInstance(id), and automatic unregistration when the viewer is unmounted/destroyed.
• loadOrNavigate & openLink APIs: Added instance.loadOrNavigate(documentUrl, page?) (smoothly navigates to the page if the document is already loaded, or reloads at that page if not) and instance.openLink(url, options?).
• Dual Link Support (TeamSync Annotations & Embedded PDF Links):
  • Native embedded PDF /Link annotations are now extracted from PDF.js (page.getAnnotations({ intent: 'display' })) and rendered with interactive SVG hitboxes and tooltip preview.
  • Link annotations and sidebar comment links seamlessly route through the link handler.
• "Other Doc" Tab in Insert Link Modal: Added a dedicated 3rd tab to InsertLinkModal for configuring cross-document links with document URL and target page number.
• linkClicked Event & Custom Handlers: Added linkClicked event to ViewerEventMap with a cancellable LinkClickEvent supporting event.preventDefault(), plus onLinkClick and resolveLinkUrl props for URL mapping and event interception.
• Public Utilities Export: Exported parseLinkTarget, isDocumentUrl, ParsedLinkTarget, and LinkClickEvent from the library root.

Full Changelog: v1.6.1...v1.7.0

v1.6.1: Initial width-ratio option and responsive PDF container resizing

Added

• initialWidthRatio Option: Added initialWidthRatio?: number (with widthRatio?: number as an alias) to <TeamSyncViewer> and WebViewerOptions, allowing clients to target an exact fraction of the available viewing width on initial load (e.g. 0.7 for 70% width).
• Responsive PDF Container Resizing: Added automatic ResizeObserver tracking on the document container to refit the open PDF responsively at 60fps via requestAnimationFrame when the viewer page, container, or sidebars resize while in a width-ratio, fit-width, or fit-page mode.
• responsive Prop: Added responsive?: boolean (defaults to true) to <TeamSyncViewer> and WebViewerOptions for explicit control over auto-refitting on container resize.
• Public calculateFitWidthScale Utility: Exported calculateFitWidthScale(availableWidth, pageWidth, ratio?, minScale?, maxScale?) from the public package root.
• Ratio Support in fitWidth & fitToWidth: Updated instance.UI.fitWidth(ratio?), instance.UI.fitToWidth(ratio?), and added direct instance methods instance.fitWidth(ratio?), instance.fitToWidth(ratio?), instance.fitPage(), and instance.fitToPage().

v1.6.0: Whitespace-tolerant search, pageText builder, and page-scoped search

Added

• Whitespace-Tolerant Text Search: Search queries now match across line breaks, multiple whitespace runs, tabs, NBSP (\u00A0), and other unicode whitespace variants seamlessly. Matches in normalized space while accurately reporting raw source coordinates and bounds.
• Shared pageText Builder & Bounding Box Interpolator: Unified raw text extraction and character coordinate mapping between PDF search and regex redactions via internal buildPageText and boundsForRawRange helpers.
• Page-Scoped Search & Highlighting:
  • Added additive 5th parameter pages?: number[] to searchPdfText(doc, query, redactions, onProgress, pages).
  • Added options.pages?: number[] to instance.searchText(query, options).
  • Added scope?: 'document' | 'page' to instance.highlightSnippet(query, options) allowing strict page restriction when navigating to snippet citations.
• Sidebar Highlighting Precision: Result matchLength now reflects the exact consumed raw glyph span, ensuring sidebar bold highlights match rendered page text identically.
• Stable Search Results Sorting: Corrected search result sorting to maintain page index ascending order while preserving intra-page ascending match order.

v1.5.1: Redaction events, callbacks, and getRedactions API

Added

• redactionsApplied & redactionsChanged Events: Added typed redactionsApplied: { redactions: Redaction[] } and redactionsChanged: { redactions: Redaction[] } events to ViewerEventMap available via instance.on().
• Public Redaction Callbacks: Added onRedactionsApplied?: (redactions: Redaction[]) => void and onRedactionsChange?: (redactions: Redaction[]) => void props to <TeamSyncViewer> and WebViewerOptions.
• Apply Confirmation Hook: Threaded onRedactionsApplied through DocumentViewerProps, firing once per user click of Apply in the confirmation modal with the full combined list of applied redactions.
• Public getRedactions() API: Added instance.getRedactions(): Redaction[] to WebViewerInstance mirroring getAnnotations(), returning the live combined redaction list.