@adeu/core 1.21.0 → 1.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adeu/core",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "description": "",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/domain.ts

@@ -134,10 +134,19 @@ export function extract_all_domain_metadata(
       if (definitions[matched_term]) definitions[matched_term].count++;
     }
 
+    // Drop unused terms from the SYMBOL TABLE only — the filter is noise
+    // reduction for the Defined Terms listing, and must not gate the
+    // Semantic Diagnostics: a term defined twice and never used is two
+    // drafting errors, not zero (QA 2026-07-17 F6; mirrors Python). Surface
+    // the orphan definition itself as a diagnostic instead.
     for (const term of def_keys) {
       if (definitions[term].count === 0) {
         delete definitions[term];
-        duplicates.delete(term);
+        if (!duplicates.has(term)) {
+          diagnostics.push(
+            `[Warning] Unused Definition: '${term}' is defined but never used.`,
+          );
+        }
       }
     }
   }

package/src/engine.ts

@@ -27,6 +27,7 @@ import {
   REPORT_ECHO_CAP,
   truncate_middle,
 } from "./utils/text.js";
+import { RegexTimeoutError } from "./utils/safe-regex.js";
 
 // Width of the surrounding-document window shown in redline previews.
 const PREVIEW_CONTEXT_CHARS = 30;
@@ -178,6 +179,20 @@ const TRANSACTIONAL_NOT_APPLIED_ERROR =
   "Not applied: the batch is transactional and other edits failed " +
   "validation (see their errors). Fix or remove those edits and re-run.";
 
+// Characters XML 1.0 cannot represent: C0 controls except tab/newline/CR.
+// Word refuses to open a package carrying them, and @xmldom serializes them
+// silently, so they must be rejected before they reach the DOM
+// (QA 2026-07-17 F11; mirrors Python's clean per-edit error).
+const XML_ILLEGAL_CHARS_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f]/g;
+
+export function describe_illegal_control_chars(text: string): string | null {
+  if (!text) return null;
+  const found = text.match(XML_ILLEGAL_CHARS_RE);
+  if (!found) return null;
+  const codes = Array.from(new Set(found.map((c) => `0x${c.charCodeAt(0).toString(16).padStart(2, "0")}`))).sort();
+  return codes.join(", ");
+}
+
 export function validate_edit_strings(
   edits: any[],
   index_offset: number = 0,
@@ -189,6 +204,25 @@ export function validate_edit_strings(
     const t_text = edit.target_text || "";
     const n_text = edit.new_text || "";
 
+    // VAL-CRIT-8: XML-illegal control characters (QA 2026-07-17 F11).
+    const checked_fields: Array<[string, string]> = [
+      ["target_text", t_text],
+      ["new_text", n_text],
+    ];
+    if (edit.comment) checked_fields.push(["comment", edit.comment]);
+    (edit.cells || []).forEach((cell: string, cell_idx: number) => {
+      checked_fields.push([`cells[${cell_idx}]`, cell || ""]);
+    });
+    for (const [field_name, field_value] of checked_fields) {
+      const described = describe_illegal_control_chars(field_value);
+      if (described) {
+        errors.push(
+          `- Edit ${i + 1 + index_offset} Failed: \`${field_name}\` contains control character(s) ` +
+            `(${described}) that cannot be stored in a DOCX. Remove them and re-submit.`,
+        );
+      }
+    }
+
     if (
       n_text.includes("{++") ||
       n_text.includes("{--") ||
@@ -571,8 +605,8 @@ export class RedlineEngine {
    * Snapshots the document text around a resolved edit BEFORE anything is
    * applied. Previews rendered after the batch mutates the DOM cannot slice
    * full_text at the stored offsets: applied edits shift offsets and inject
-   * tracked-change markup, which produced garbled previews mixing unrelated
-   * edits and internal scaffolding (QA H1).
+   * tracked-change markup, garbling previews with unrelated edits and
+   * internal scaffolding (QA H1).
    */
   private _capture_preview_context(edit: any): void {
     if (edit.type !== "modify") return;
@@ -690,8 +724,8 @@ export class RedlineEngine {
 
   /**
    * The "new text" a batch report should show for an edit. InsertTableRow has
-   * no new_text field — surface its cell contents instead of the misleading
-   * empty string the report used to print (QA M4).
+   * no new_text field — surface its cell contents rather than a misleading
+   * empty string (QA M4).
    */
   private static _report_new_text(edit: any): string {
     if (edit && edit.type === "insert_row" && Array.isArray(edit.cells)) {
@@ -2114,7 +2148,7 @@ export class RedlineEngine {
 
       // Structural table edits: verify the anchor really is a table row, and
       // that insert_row does not provide more cells than the row has columns —
-      // extra cells used to produce a structurally inconsistent row (QA M3).
+      // extra cells must never produce a structurally inconsistent row (QA M3).
       if (
         (edit.type === "insert_row" || edit.type === "delete_row") &&
         matches.length > 0
@@ -2297,16 +2331,14 @@ export class RedlineEngine {
         !["accept", "reject", "reply"].includes(c.type),
     );
 
-    // NOTE: a previous "edits_for_merge" pre-pass here silently UNWRAPPED a
-    // foreign author's <w:ins> when a strict/first edit only partially straddled
-    // its boundary — turning that author's tracked-inserted text into untracked
-    // committed body text before the edit applied, destroying their provenance.
-    // That is the same provenance-laundering failure mode the canonical engine
-    // refuses, so it has been removed: a partial straddle now surfaces the
-    // standard validation error ("Modification targets an active insertion from
-    // another author …") via validate_edits, matching the Python engine. An edit
-    // fully CONTAINED inside a foreign <w:ins> stays allowed and is handled by
-    // nesting the <w:del> inside that <w:ins> (see _apply_single_edit_indexed /
+    // Never pre-unwrap a foreign author's <w:ins> to make a partially
+    // straddling edit fit: that turns their tracked-inserted text into
+    // untracked committed body text before the edit applies, destroying
+    // their provenance. A partial straddle surfaces the standard validation
+    // error ("Modification targets an active insertion from another author
+    // …") via validate_edits, matching the Python engine. An edit fully
+    // CONTAINED inside a foreign <w:ins> is allowed and handled by nesting
+    // the <w:del> inside that <w:ins> (see _apply_single_edit_indexed /
     // _insert_and_split_ins).
 
     // BUG-7: Unified single-pass validation in wet-run / standard mode.
@@ -2391,7 +2423,15 @@ export class RedlineEngine {
         // not claim any edit "applied" (transactional parity with Python).
         const validation_failed_idx = new Set<number>();
         for (const { edit, i } of ordered_edits) {
-          let single_errors = this.validate_edits([edit], i);
+          let single_errors: string[];
+          try {
+            single_errors = this.validate_edits([edit], i);
+          } catch (e) {
+            // A pathological user pattern must fail as a clean per-edit
+            // validation error, never a hang or crash (QA 2026-07-17 F5).
+            if (!(e instanceof RegexTimeoutError)) throw e;
+            single_errors = [`- Edit ${i + 1} Failed: ${e.message}`];
+          }
           if (single_errors.length > 0) {
             if (applied_edits > 0) {
               const hint = sequential_context_hint(applied_edits);
@@ -2489,7 +2529,14 @@ export class RedlineEngine {
           const sequential_errors: string[] = [];
           let applied_so_far = 0;
           for (const { edit, i } of ordered_edits) {
-            let single_errors = this.validate_edits([edit], i);
+            let single_errors: string[];
+            try {
+              single_errors = this.validate_edits([edit], i);
+            } catch (e) {
+              // Clean per-edit failure for time-budget violations (QA F5).
+              if (!(e instanceof RegexTimeoutError)) throw e;
+              single_errors = [`- Edit ${i + 1} Failed: ${e.message}`];
+            }
             if (single_errors.length > 0) {
               if (applied_so_far > 0) {
                 const hint = sequential_context_hint(applied_so_far);
@@ -2624,7 +2671,20 @@ export class RedlineEngine {
           edit._error_msg = msg;
         }
       } else {
-        const resolved = this._pre_resolve_heuristic_edit(edit);
+        let resolved: any;
+        try {
+          resolved = this._pre_resolve_heuristic_edit(edit);
+        } catch (e) {
+          // Direct apply_edits callers bypass validate_edits; the time
+          // budget must still fail cleanly here (QA F5).
+          if (!(e instanceof RegexTimeoutError)) throw e;
+          skipped++;
+          edit._applied_status = false;
+          const msg = `- Failed to apply edit targeting: '${(edit.target_text || "").substring(0, 40)}...' (${e.message})`;
+          this.skipped_details.push(msg);
+          edit._error_msg = msg;
+          continue;
+        }
         if (resolved) {
           if (Array.isArray(resolved)) {
             for (const r of resolved) {
@@ -2667,8 +2727,8 @@ export class RedlineEngine {
 
     // Snapshot preview context now, while every resolved offset still refers
     // to the untouched document. The sweep below mutates the DOM and rebuilds
-    // the map, which shifts offsets and injects tracked-change markup —
-    // slicing full_text at report time garbled previews (QA H1).
+    // the map, shifting offsets and injecting tracked-change markup —
+    // slicing full_text at report time garbles previews (QA H1).
     for (const [res_edit] of resolved_edits) {
       this._capture_preview_context(res_edit);
       if (res_edit._parent_edit_ref) {
@@ -2814,6 +2874,29 @@ export class RedlineEngine {
         continue;
       }
 
+      // Refuse accept/reject on a w:id shared by revisions from DIFFERENT
+      // authors. Uniqueness of w:id is assumed but not guaranteed for
+      // externally produced documents (merges, cross-document copy-paste),
+      // where one action would silently resolve several unrelated changes
+      // (QA 2026-07-17 F9). Same-author reuse is legitimate — this engine
+      // itself mints one id across every element of a single logical edit —
+      // so authorship is the discriminator.
+      const dup_authors = Array.from(
+        new Set(all_nodes.map((n) => n.getAttribute("w:author") || "Unknown")),
+      ).sort();
+      if (dup_authors.length > 1) {
+        skipped++;
+        this.skipped_details.push(
+          `- Failed to apply action: ${type} on Chg:${target_id} is ambiguous. The document ` +
+            `contains ${all_nodes.length} tracked-change elements sharing w:id=${target_id} from ` +
+            `different authors (${dup_authors.join(", ")}) — duplicate revision IDs produced ` +
+            `outside this engine (e.g. by a document merge or copy-paste). Acting on this ID ` +
+            `would resolve all of them at once. Resolve these changes individually in Word, or ` +
+            `apply the intended outcome as an explicit text edit instead.`,
+        );
+        continue;
+      }
+
       for (const node of all_nodes) {
         const is_ins = node.tagName === "w:ins";
         const parent_tag = node.parentNode

package/src/index.ts

@@ -4,10 +4,11 @@ export function identifyEngine() {
 
 export { DocumentObject } from './docx/bridge.js';
 export { DocumentMapper, TextSpan } from './mapper.js';
-export { RedlineEngine, BatchValidationError } from './engine.js';
+export { RedlineEngine, BatchValidationError, validate_edit_strings, describe_illegal_control_chars } from './engine.js';
 export { generate_edits_from_text, trim_common_context, create_unified_diff, create_word_patch_diff } from './diff.js';
 export { apply_edits_to_markdown } from './markup.js';
 export { paginate, split_structural_appendix, PaginationResult, PageInfo } from './pagination.js';
 export { extract_outline, OutlineNode } from './outline.js';
 export { extractTextFromBuffer, _extractTextFromDoc } from './ingest.js';
-export { finalize_document, FinalizeOptions, FinalizeResult } from './sanitize/core.js';
+export { finalize_document, FinalizeOptions, FinalizeResult } from './sanitize/core.js';
+export { RegexTimeoutError, userFindAllMatches, userSearch, USER_PATTERN_TIMEOUT_MS } from './utils/safe-regex.js';

package/src/mapper.ts

@@ -2,6 +2,7 @@ import { DocumentObject } from "./docx/bridge.js";
 import { Paragraph, Table, Run, DocxEvent } from "./docx/primitives.js";
 import { findAllDescendants, findChild } from "./docx/dom.js";
 import { extract_comments_data } from "./comments.js";
+import { RegexTimeoutError, userFindAllMatches, userSearch } from "./utils/safe-regex.js";
 import {
   _get_style_cache,
   get_paragraph_prefix,
@@ -879,11 +880,16 @@ export class DocumentMapper {
     is_regex: boolean = false,
   ): [number, number] {
     if (is_regex) {
+      // User/LLM-supplied pattern: run it under a wall-clock budget so a
+      // catastrophic pattern cannot hang the event loop (QA 2026-07-17 F5).
+      // RegexTimeoutError propagates for a clean per-edit error; only
+      // invalid-pattern errors mean "no match" here.
       try {
-        const pattern = new RegExp(target_text);
-        const match = pattern.exec(this.full_text);
-        if (match) return [match.index, match[0].length];
-      } catch (e) {}
+        const match = userSearch(target_text, this.full_text);
+        if (match) return [match.start, match.end - match.start];
+      } catch (e) {
+        if (e instanceof RegexTimeoutError) throw e;
+      }
       return [-1, 0];
     }
 
@@ -923,12 +929,13 @@ export class DocumentMapper {
     if (!target_text) return [];
 
     if (is_regex) {
+      // Budgeted like find_match_index above (QA 2026-07-17 F5).
       try {
-        const pattern = new RegExp(target_text, "g");
-        const matches = [...this.full_text.matchAll(pattern)];
-        if (matches.length > 0)
-          return matches.map((m) => [m.index!, m[0].length]);
-      } catch (e) {}
+        const matches = userFindAllMatches(target_text, this.full_text);
+        if (matches.length > 0) return matches.map((m) => [m.start, m.end - m.start]);
+      } catch (e) {
+        if (e instanceof RegexTimeoutError) throw e;
+      }
       return [];
     }
     // Exact tiers use plain indexOf scans, NOT RegExp: building a RegExp from

package/src/markup.test.ts

@@ -115,7 +115,8 @@ describe('apply_edits_to_markdown', () => {
       { type: 'modify', target_text: 'C', new_text: 'Z' }
     ];
     const result = apply_edits_to_markdown(text, edits, true);
-    expect(result).toContain('[Edit:0]');
+    // 1-based, matching apply's "Edit N" reports (QA 2026-07-17 F10).
+    expect(result).toContain('[Edit:1]');
     expect(result.indexOf('{++X++}')).toBeLessThan(result.indexOf('{++Y++}'));
     expect(result.indexOf('{++Y++}')).toBeLessThan(result.indexOf('{++Z++}'));
   });

package/src/markup.ts

@@ -360,7 +360,9 @@ export function apply_edits_to_markdown(
       isolated_target,
       isolated_new,
       edit.comment,
-      orig_idx,
+      // 1-based, matching apply's "Edit N" reports and batch validation
+      // errors (QA 2026-07-17 F10; mirrors Python).
+      orig_idx + 1,
       include_index,
       highlight_only,
     );