From 736723a8fc29f9c5864e0bb48e4ffd52abaccfb2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 22:32:44 +0000
Subject: [PATCH 1/9] deps(deps): bump org.webjars.npm:pdfjs-dist from 6.0.227
 to 6.1.200

Bumps [org.webjars.npm:pdfjs-dist](https://github.com/mozilla/pdf.js) from 6.0.227 to 6.1.200.
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](https://github.com/mozilla/pdf.js/compare/v6.0.227...v6.1.200)

---
updated-dependencies:
- dependency-name: org.webjars.npm:pdfjs-dist
  dependency-version: 6.1.200
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index b2fdb11e..51e22d13 100644
--- a/pom.xml
+++ b/pom.xml
@@ -30,7 +30,7 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <argLine></argLine>
     <pdfbox.version>3.0.8</pdfbox.version>
-    <pdfjs.dist.version>6.0.227</pdfjs.dist.version>
+    <pdfjs.dist.version>6.1.200</pdfjs.dist.version>
     <!-- Security override: pull the patched Jackson line for GHSA-5jmj-h7xm-6q6v
          / CVE-2026-54515 case-insensitive deserialization bypasses. The root
          OSV config contains a narrow temporary ignore because OSV Scanner

From a4845e1948fbef7aa0b7e9f60fb6555c0b0a4b77 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:51:51 +0900
Subject: [PATCH 2/9] fix(viewer): align PDF.js shell with 6.1.200 assets

---
 .../com/clearfolio/viewer/controller/ViewerUiController.java  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
index 5e7de3c1..d7e2d198 100644
--- a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
+++ b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
@@ -16,8 +16,8 @@
 @RestController
 public class ViewerUiController {
 
-    // Keep this in sync with `pom.xml` pdfjs-dist version.
-    static final String PDF_JS_VIEWER_PATH = "/webjars/pdfjs-dist/4.10.38/web/viewer.html";
+    // Keep this in sync with `pom.xml` pdfjs-dist version and viewer.js.
+    static final String PDF_JS_VIEWER_PATH = "/webjars/pdfjs-dist/6.1.200/web/viewer.html";
     private static final String INVALID_DOC_ID_SENTINEL = "invalid";
 
     /**

From 908bf490ee75febb64778d0e1bd7417d2393e2b3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:52:49 +0900
Subject: [PATCH 3/9] fix(viewer): use matching PDF.js 6.1.200 viewer and
 worker layout

---
 src/main/resources/static/assets/viewer/viewer.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/main/resources/static/assets/viewer/viewer.js b/src/main/resources/static/assets/viewer/viewer.js
index 051d570d..4ab6d077 100644
--- a/src/main/resources/static/assets/viewer/viewer.js
+++ b/src/main/resources/static/assets/viewer/viewer.js
@@ -1,4 +1,5 @@
 const POLL_DELAY_MS = 1500;
+const PDF_JS_VIEWER_PATH = "/webjars/pdfjs-dist/6.1.200/web/viewer.html";
 const DEMO_AUTH_HEADERS = {
   "X-Clearfolio-Tenant-Id": "buyer-demo",
   "X-Clearfolio-Subject-Id": "buyer-demo-operator",
@@ -110,9 +111,11 @@ function renderPdfInline(path) {
     console.error("Blocked unsafe URL in PDF inline:", path);
     return;
   }
+  // The prebuilt PDF.js viewer resolves its matching viewer.mjs and
+  // build/pdf.worker.mjs from the same versioned WebJar directory.
   const viewerPath =
     getMetaContent("clearfolio-pdfjs-viewer-path") ||
-    "/webjars/pdfjs-dist/4.10.38/web/viewer.html";
+    PDF_JS_VIEWER_PATH;
   const viewerUrl = `${viewerPath}?file=${encodeURIComponent(path)}`;
   const frame = document.createElement("iframe");
   frame.src = viewerUrl;

From a5dda6b870887a373b8ff4d76c43efa70b366dba Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:53:25 +0900
Subject: [PATCH 4/9] test(viewer): verify matching PDF.js viewer and worker
 assets

---
 .../controller/PdfJsAssetIntegrationTest.java | 67 +++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java

diff --git a/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java b/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java
new file mode 100644
index 00000000..dadf7a54
--- /dev/null
+++ b/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java
@@ -0,0 +1,67 @@
+package com.clearfolio.viewer.controller;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.UUID;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.http.MediaType;
+import org.springframework.test.web.reactive.server.WebTestClient;
+
+/**
+ * Verifies that the configured PDF.js viewer, module, and worker are packaged
+ * together and that Clearfolio preserves its signed-artifact integration path.
+ */
+class PdfJsAssetIntegrationTest {
+
+    private static final String PDF_JS_VERSION = "6.1.200";
+    private static final String WEBJAR_ROOT = "/META-INF/resources/webjars/pdfjs-dist/" + PDF_JS_VERSION;
+
+    @Test
+    void packagesMatchingViewerModuleAndWorkerAssets() throws Exception {
+        assertPackagedResource(WEBJAR_ROOT + "/web/viewer.html");
+        assertPackagedResource(WEBJAR_ROOT + "/web/viewer.mjs");
+        assertPackagedResource(WEBJAR_ROOT + "/build/pdf.mjs");
+        assertPackagedResource(WEBJAR_ROOT + "/build/pdf.worker.mjs");
+    }
+
+    @Test
+    void viewerShellPublishesTheSameVersionedViewerPath() {
+        WebTestClient.bindToController(new ViewerUiController())
+                .build()
+                .get()
+                .uri("/viewer/{docId}", UUID.randomUUID())
+                .exchange()
+                .expectStatus().isOk()
+                .expectHeader().contentTypeCompatibleWith(MediaType.TEXT_HTML)
+                .expectBody(String.class)
+                .value(body -> assertTrue(body.contains(
+                        "clearfolio-pdfjs-viewer-path\" content=\""
+                                + ViewerUiController.PDF_JS_VIEWER_PATH
+                                + "\""
+                )));
+    }
+
+    @Test
+    void viewerScriptKeepsTheVersionAndSignedArtifactTokenFlowAligned() throws Exception {
+        try (InputStream input = getClass().getResourceAsStream("/static/assets/viewer/viewer.js")) {
+            assertNotNull(input, "viewer.js must be packaged");
+            String script = new String(input.readAllBytes(), StandardCharsets.UTF_8);
+
+            assertTrue(script.contains(ViewerUiController.PDF_JS_VIEWER_PATH));
+            assertTrue(script.contains("get(\"artifactToken\")"));
+            assertTrue(script.contains("artifactToken=${encodeURIComponent(externalArtifactToken)}"));
+            assertTrue(script.contains("renderPdfInline(artifactPath)"));
+        }
+    }
+
+    private static void assertPackagedResource(String resourcePath) throws Exception {
+        try (InputStream input = PdfJsAssetIntegrationTest.class.getResourceAsStream(resourcePath)) {
+            assertNotNull(input, () -> "missing PDF.js asset: " + resourcePath);
+            assertTrue(input.read() >= 0, () -> "empty PDF.js asset: " + resourcePath);
+        }
+    }
+}

From 8d076699b143215f7386e4e9df27a956beaa989f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:54:02 +0900
Subject: [PATCH 5/9] docs: record PDF.js 6.1.200 integration contract

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8e8c980..32e4ce00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 ### Added
 - **UI UX 개선**: 'Details' 버튼 클릭 시, 작업 상세 정보 로드 중에 사용자가 명시적인 로딩 상태를 확인할 수 있도록 'Loading...' 텍스트와 비활성화 상태를 표시하도록 추가했습니다.
 
+### Changed
+- PDF.js WebJar를 `6.1.200`으로 올리고, Clearfolio 뷰어 셸·브라우저 fallback·패키징 검증을 동일 버전의 `viewer.html`, `viewer.mjs`, `pdf.mjs`, `pdf.worker.mjs` 자산 계약에 맞췄습니다. 서명된 `artifactToken` 미리보기 흐름은 유지됩니다.
+
 # Changelog
 
 ## [Unreleased]

From 5e63c3c8c756bd85d272dc671eb7d163a71b7056 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:57:45 +0900
Subject: [PATCH 6/9] fix(viewer): publish PDF.js module and worker paths

---
 .../viewer/controller/ViewerUiController.java         | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
index d7e2d198..a0fa4d11 100644
--- a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
+++ b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
@@ -16,8 +16,9 @@
 @RestController
 public class ViewerUiController {
 
-    // Keep this in sync with `pom.xml` pdfjs-dist version and viewer.js.
-    static final String PDF_JS_VIEWER_PATH = "/webjars/pdfjs-dist/6.1.200/web/viewer.html";
+    // Keep these in sync with `pom.xml` pdfjs-dist version and viewer.js.
+    static final String PDF_JS_MODULE_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.mjs";
+    static final String PDF_JS_WORKER_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.worker.mjs";
     private static final String INVALID_DOC_ID_SENTINEL = "invalid";
 
     /**
@@ -70,7 +71,8 @@ private static String viewerShellHtml(String docId, String initialState) {
                     <meta name="referrer" content="no-referrer" />
                     <meta name="clearfolio-doc-id" content="{{DOC_ID}}" />
                     <meta name="clearfolio-initial-state" content="{{INITIAL_STATE}}" />
-                    <meta name="clearfolio-pdfjs-viewer-path" content="{{PDFJS_VIEWER_PATH}}" />
+                    <meta name="clearfolio-pdfjs-module-path" content="{{PDFJS_MODULE_PATH}}" />
+                    <meta name="clearfolio-pdfjs-worker-path" content="{{PDFJS_WORKER_PATH}}" />
                     <title>Clearfolio Viewer</title>
                     <link rel="stylesheet" href="/assets/viewer/viewer.css" />
                   </head>
@@ -133,7 +135,8 @@ private static String viewerShellHtml(String docId, String initialState) {
         return template
                 .replace("{{DOC_ID}}", docIdString)
                 .replace("{{INITIAL_STATE}}", initialState)
-                .replace("{{PDFJS_VIEWER_PATH}}", PDF_JS_VIEWER_PATH);
+                .replace("{{PDFJS_MODULE_PATH}}", PDF_JS_MODULE_PATH)
+                .replace("{{PDFJS_WORKER_PATH}}", PDF_JS_WORKER_PATH);
     }
 
     private static String demoShellHtml() {

From 1588a0c8aa2fdc8e33481e0ffe86596681de0f29 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:58:41 +0900
Subject: [PATCH 7/9] fix(viewer): render PDFs with packaged PDF.js module and
 worker

---
 .../resources/static/assets/viewer/viewer.js  | 138 ++++++++++++------
 1 file changed, 96 insertions(+), 42 deletions(-)

diff --git a/src/main/resources/static/assets/viewer/viewer.js b/src/main/resources/static/assets/viewer/viewer.js
index 4ab6d077..a998675c 100644
--- a/src/main/resources/static/assets/viewer/viewer.js
+++ b/src/main/resources/static/assets/viewer/viewer.js
@@ -1,5 +1,6 @@
 const POLL_DELAY_MS = 1500;
-const PDF_JS_VIEWER_PATH = "/webjars/pdfjs-dist/6.1.200/web/viewer.html";
+const PDF_JS_MODULE_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.mjs";
+const PDF_JS_WORKER_PATH = "/webjars/pdfjs-dist/6.1.200/build/pdf.worker.mjs";
 const DEMO_AUTH_HEADERS = {
   "X-Clearfolio-Tenant-Id": "buyer-demo",
   "X-Clearfolio-Subject-Id": "buyer-demo-operator",
@@ -17,6 +18,8 @@ const el = {
   preview: document.getElementById("preview"),
 };
 
+let pdfJsModulePromise;
+
 function getMetaContent(name) {
   const meta = document.querySelector(`meta[name="${name}"]`);
   if (!meta) {
@@ -66,7 +69,7 @@ function showError(message) {
 }
 
 function clearPreview() {
-  const nodes = Array.from(el.preview.querySelectorAll("iframe, img, pre, a"));
+  const nodes = Array.from(el.preview.querySelectorAll("iframe, img, pre, a, canvas, .pdf-preview-meta"));
   for (const node of nodes) {
     node.remove();
   }
@@ -82,22 +85,27 @@ function clearPreview() {
   }
 }
 
-function isSafeUrl(urlStr) {
+function resolveSameOriginHttpUrl(urlStr) {
+  if (typeof urlStr !== "string" || urlStr.trim() === "") {
+    return null;
+  }
   try {
     const url = new URL(urlStr, window.location.origin);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch (e) {
-    return false;
+    const safeProtocol = url.protocol === "http:" || url.protocol === "https:";
+    const safeAuthority = url.origin === window.location.origin && url.username === "" && url.password === "";
+    return safeProtocol && safeAuthority ? url.href : null;
+  } catch (_error) {
+    return null;
   }
 }
 
 function renderPreviewLink(path) {
-  if (!isSafeUrl(path)) {
-    console.error("Blocked unsafe URL in preview link:", path);
+  const resolvedPath = resolveSameOriginHttpUrl(path);
+  if (resolvedPath === null) {
     return;
   }
   const link = document.createElement("a");
-  link.href = path;
+  link.href = resolvedPath;
   link.textContent = "Open artifact";
   link.className = "btn btn-secondary";
   link.target = "_blank";
@@ -106,23 +114,67 @@ function renderPreviewLink(path) {
   el.preview.appendChild(link);
 }
 
-function renderPdfInline(path) {
-  if (!isSafeUrl(path)) {
-    console.error("Blocked unsafe URL in PDF inline:", path);
-    return;
+function getPdfJsModule() {
+  if (!pdfJsModulePromise) {
+    const modulePath = getMetaContent("clearfolio-pdfjs-module-path") || PDF_JS_MODULE_PATH;
+    const workerPath = getMetaContent("clearfolio-pdfjs-worker-path") || PDF_JS_WORKER_PATH;
+    const resolvedModulePath = resolveSameOriginHttpUrl(modulePath);
+    const resolvedWorkerPath = resolveSameOriginHttpUrl(workerPath);
+    if (resolvedModulePath === null || resolvedWorkerPath === null) {
+      return Promise.reject(new Error("PDF.js asset configuration is invalid"));
+    }
+    pdfJsModulePromise = import(resolvedModulePath).then(pdfJs => {
+      pdfJs.GlobalWorkerOptions.workerSrc = resolvedWorkerPath;
+      return pdfJs;
+    });
+  }
+  return pdfJsModulePromise;
+}
+
+async function renderPdfInline(path) {
+  const resolvedPath = resolveSameOriginHttpUrl(path);
+  if (resolvedPath === null) {
+    throw new Error("PDF preview resource is invalid");
+  }
+
+  const pdfJs = await getPdfJsModule();
+  const loadingTask = pdfJs.getDocument({
+    url: resolvedPath,
+    withCredentials: true,
+  });
+  const pdfDocument = await loadingTask.promise;
+  try {
+    const page = await pdfDocument.getPage(1);
+    const unscaledViewport = page.getViewport({ scale: 1 });
+    const availableWidth = Math.max(320, el.preview.clientWidth - 32);
+    const renderScale = Math.min(2, availableWidth / unscaledViewport.width);
+    const viewport = page.getViewport({ scale: renderScale });
+    const canvas = document.createElement("canvas");
+    const context = canvas.getContext("2d", { alpha: false });
+    if (context === null) {
+      throw new Error("Canvas rendering is unavailable");
+    }
+
+    canvas.width = Math.ceil(viewport.width);
+    canvas.height = Math.ceil(viewport.height);
+    canvas.style.width = "100%";
+    canvas.style.height = "auto";
+    canvas.className = "pdf-preview-canvas";
+    canvas.setAttribute("role", "img");
+    canvas.setAttribute("aria-label", `Rendered first page of a ${pdfDocument.numPages}-page PDF`);
+
+    await page.render({ canvasContext: context, viewport }).promise;
+    el.preview.appendChild(canvas);
+
+    const metadata = document.createElement("p");
+    metadata.className = "help pdf-preview-meta";
+    metadata.textContent = pdfDocument.numPages === 1
+      ? "Showing the document page."
+      : `Showing page 1 of ${pdfDocument.numPages}. Open the artifact for the complete document.`;
+    el.preview.appendChild(metadata);
+  } finally {
+    await pdfDocument.destroy();
   }
-  // The prebuilt PDF.js viewer resolves its matching viewer.mjs and
-  // build/pdf.worker.mjs from the same versioned WebJar directory.
-  const viewerPath =
-    getMetaContent("clearfolio-pdfjs-viewer-path") ||
-    PDF_JS_VIEWER_PATH;
-  const viewerUrl = `${viewerPath}?file=${encodeURIComponent(path)}`;
-  const frame = document.createElement("iframe");
-  frame.src = viewerUrl;
-  frame.title = "Document preview";
-  frame.loading = "lazy";
-  frame.className = "preview-frame";
-  el.preview.appendChild(frame);
 }
 
 async function fetchJson(url, signal) {
@@ -210,28 +262,28 @@ async function poll(docId, abortSignal) {
       return;
     }
 
-    el.preview.setAttribute("aria-busy", "false");
-    el.liveStatus.textContent = "Ready.";
-    el.retryBtn.disabled = false;
-    el.retryBtn.textContent = "Refresh";
-
     clearPreview();
     const path = bootstrap.data.previewResourcePath;
     if (typeof path === "string" && path.endsWith(".pdf")) {
-      renderPdfInline(path);
+      await renderPdfInline(path);
     }
     if (typeof path === "string" && path.length > 0) {
       renderPreviewLink(path);
     }
-  } catch (err) {
+
+    el.preview.setAttribute("aria-busy", "false");
+    el.liveStatus.textContent = "Ready.";
+    el.retryBtn.disabled = false;
+    el.retryBtn.textContent = "Refresh";
+  } catch (_error) {
     if (abortSignal.aborted) {
       return;
     }
-    showError("Network error while loading preview. Please retry.");
+    showError("Network or rendering error while loading preview. Please retry.");
   }
 }
 
-function init() {
+async function init() {
   const docId = getDocId();
   if (!docId) {
     el.docMeta.textContent = "Missing docId.";
@@ -250,18 +302,20 @@ function init() {
   // External integration mode: when the URL carries a signed artifactToken
   // (issued via POST /api/v1/viewer/{docId}/artifact-links), render the
   // artifact directly and skip the tenant-header bootstrap. Possession of a
-  // valid signed token already grants artifact read access, so this adds no
-  // new authority — it only lets external apps (e.g. ScopeWeave) open the
-  // PDF.js viewer page instead of the raw PDF bytes.
+  // valid signed token already grants artifact read access.
   const externalArtifactToken = new URLSearchParams(window.location.search).get("artifactToken");
   if (externalArtifactToken) {
-    el.preview.setAttribute("aria-busy", "false");
-    el.liveStatus.textContent = "Ready.";
     el.retryBtn.hidden = true;
     clearPreview();
     const artifactPath = `/artifacts/${encodeURIComponent(docId)}.pdf?artifactToken=${encodeURIComponent(externalArtifactToken)}`;
-    renderPdfInline(artifactPath);
-    renderPreviewLink(artifactPath);
+    try {
+      await renderPdfInline(artifactPath);
+      renderPreviewLink(artifactPath);
+      el.preview.setAttribute("aria-busy", "false");
+      el.liveStatus.textContent = "Ready.";
+    } catch (_error) {
+      showError("Unable to render the signed artifact preview.");
+    }
     return;
   }
 
@@ -294,4 +348,4 @@ function init() {
   start();
 }
 
-init();
+void init();

From 64b8c207fdd15426ac72aecc3b8a97bf87f11363 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:59:18 +0900
Subject: [PATCH 8/9] test(viewer): verify packaged PDF.js module and worker

---
 .../controller/PdfJsAssetIntegrationTest.java | 34 ++++++++++++-------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java b/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java
index dadf7a54..98312061 100644
--- a/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java
+++ b/src/test/java/com/clearfolio/viewer/controller/PdfJsAssetIntegrationTest.java
@@ -12,8 +12,8 @@
 import org.springframework.test.web.reactive.server.WebTestClient;
 
 /**
- * Verifies that the configured PDF.js viewer, module, and worker are packaged
- * together and that Clearfolio preserves its signed-artifact integration path.
+ * Verifies that the configured PDF.js module and worker are packaged together
+ * and that Clearfolio preserves its signed-artifact integration path.
  */
 class PdfJsAssetIntegrationTest {
 
@@ -21,15 +21,13 @@ class PdfJsAssetIntegrationTest {
     private static final String WEBJAR_ROOT = "/META-INF/resources/webjars/pdfjs-dist/" + PDF_JS_VERSION;
 
     @Test
-    void packagesMatchingViewerModuleAndWorkerAssets() throws Exception {
-        assertPackagedResource(WEBJAR_ROOT + "/web/viewer.html");
-        assertPackagedResource(WEBJAR_ROOT + "/web/viewer.mjs");
+    void packagesMatchingDisplayModuleAndWorkerAssets() throws Exception {
         assertPackagedResource(WEBJAR_ROOT + "/build/pdf.mjs");
         assertPackagedResource(WEBJAR_ROOT + "/build/pdf.worker.mjs");
     }
 
     @Test
-    void viewerShellPublishesTheSameVersionedViewerPath() {
+    void viewerShellPublishesTheSameVersionedModuleAndWorkerPaths() {
         WebTestClient.bindToController(new ViewerUiController())
                 .build()
                 .get()
@@ -38,11 +36,18 @@ void viewerShellPublishesTheSameVersionedViewerPath() {
                 .expectStatus().isOk()
                 .expectHeader().contentTypeCompatibleWith(MediaType.TEXT_HTML)
                 .expectBody(String.class)
-                .value(body -> assertTrue(body.contains(
-                        "clearfolio-pdfjs-viewer-path\" content=\""
-                                + ViewerUiController.PDF_JS_VIEWER_PATH
-                                + "\""
-                )));
+                .value(body -> {
+                    assertTrue(body.contains(
+                            "clearfolio-pdfjs-module-path\" content=\""
+                                    + ViewerUiController.PDF_JS_MODULE_PATH
+                                    + "\""
+                    ));
+                    assertTrue(body.contains(
+                            "clearfolio-pdfjs-worker-path\" content=\""
+                                    + ViewerUiController.PDF_JS_WORKER_PATH
+                                    + "\""
+                    ));
+                });
     }
 
     @Test
@@ -51,10 +56,13 @@ void viewerScriptKeepsTheVersionAndSignedArtifactTokenFlowAligned() throws Excep
             assertNotNull(input, "viewer.js must be packaged");
             String script = new String(input.readAllBytes(), StandardCharsets.UTF_8);
 
-            assertTrue(script.contains(ViewerUiController.PDF_JS_VIEWER_PATH));
+            assertTrue(script.contains(ViewerUiController.PDF_JS_MODULE_PATH));
+            assertTrue(script.contains(ViewerUiController.PDF_JS_WORKER_PATH));
+            assertTrue(script.contains("GlobalWorkerOptions.workerSrc"));
+            assertTrue(script.contains("getDocument({"));
             assertTrue(script.contains("get(\"artifactToken\")"));
             assertTrue(script.contains("artifactToken=${encodeURIComponent(externalArtifactToken)}"));
-            assertTrue(script.contains("renderPdfInline(artifactPath)"));
+            assertTrue(script.contains("await renderPdfInline(artifactPath)"));
         }
     }
 

From 9788c5150ba5c555657d2ba6762f947f4522ffb1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 5 Aug 2026 07:59:49 +0900
Subject: [PATCH 9/9] docs: describe direct PDF.js module integration

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 32e4ce00..373a661a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@
 - **UI UX 개선**: 'Details' 버튼 클릭 시, 작업 상세 정보 로드 중에 사용자가 명시적인 로딩 상태를 확인할 수 있도록 'Loading...' 텍스트와 비활성화 상태를 표시하도록 추가했습니다.
 
 ### Changed
-- PDF.js WebJar를 `6.1.200`으로 올리고, Clearfolio 뷰어 셸·브라우저 fallback·패키징 검증을 동일 버전의 `viewer.html`, `viewer.mjs`, `pdf.mjs`, `pdf.worker.mjs` 자산 계약에 맞췄습니다. 서명된 `artifactToken` 미리보기 흐름은 유지됩니다.
+- PDF.js WebJar를 `6.1.200`으로 올리고, Clearfolio가 동일 버전의 `pdf.mjs`와 `pdf.worker.mjs`를 직접 사용해 서명된 same-origin artifact의 첫 페이지를 렌더링하도록 통합했습니다. 패키징·셸 경로·서명된 `artifactToken` 흐름을 회귀 테스트로 고정했습니다.
 
 # Changelog