@bendyline/squisq-formats 2.1.0 → 2.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bendyline LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE.md

@@ -0,0 +1,19 @@
+# Third-Party Notices for @bendyline/squisq-formats
+
+This notice applies to the `@bendyline/squisq-formats` npm package.
+Squisq-authored code is licensed under the MIT license in `LICENSE`.
+Third-party components remain under their respective license terms.
+
+## Runtime dependencies
+
+| Package        | Version | License                 | Repository                       |
+| -------------- | ------- | ----------------------- | -------------------------------- |
+| @pdf-lib/upng  | 1.0.1   | MIT                     | https://github.com/Hopding/upng  |
+| @xmldom/xmldom | 0.9.10  | MIT                     | https://github.com/xmldom/xmldom |
+| jszip          | 3.10.1  | MIT OR GPL-3.0-or-later | https://github.com/Stuk/jszip    |
+| pdf-lib        | 1.17.1  | MIT                     | https://pdf-lib.js.org           |
+| pdfjs-dist     | 4.10.38 | Apache-2.0              | https://mozilla.github.io/pdf.js |
+
+Squisq uses jszip under its MIT license option. Copyright and complete license
+texts for these dependencies are included in their respective npm
+distributions and source repositories.

package/README.md

@@ -87,7 +87,7 @@ const imported = await pdfToMarkdownDoc(pdfBuffer);
 const container = await pdfToContainer(pdfBuffer);
 ```
 
-**Fidelity:** export uses pdf-lib's standard 14 fonts (`themeId` affects colors only). PDF has no semantic structure, so import is heuristic and best-effort: headings are detected by font size, and tables / code blocks / blockquotes / links via the `detectTables` / `detectCodeBlocks` / `detectBlockquotes` / `detectLinks` options (all default true). `pdfToMarkdownDoc` is text-only; `pdfToContainer` also extracts embedded images, placed **by page** — each image is inserted after the last content block from its page (image-only pages fall back to the nearest preceding page with content, else the document end). Placement is page-level only. Image extraction needs a browser canvas to encode PNG — **under Node it is skipped** (with a `console.warn`) and no images are emitted.
+**Fidelity:** export uses pdf-lib's standard 14 fonts (`themeId` affects colors only). PDF has no semantic structure, so import is heuristic and best-effort: headings are detected by font size, and tables / code blocks / blockquotes / links via the `detectTables` / `detectCodeBlocks` / `detectBlockquotes` / `detectLinks` options (all default true). `pdfToMarkdownDoc` is text-only; `pdfToContainer` also extracts embedded XObject and inline raster images in browsers and Node, placed **by page** — each image is inserted after the last content block from its page (image-only pages fall back to the nearest preceding page with content, else the document end). Placement is page-level only; masks, vector artwork, and images that PDF.js cannot expose as decoded pixels are not emitted.
 
 ### HTML
 
@@ -299,7 +299,7 @@ Also exported: `createRegistry` / `defaultRegistry` / `defaultFormats`, `BUILTIN
 
 The package root re-exports the common converters; `./container`, the plain-HTML/bundle functions, `docxToContainer`, `pdfToContainer`, `PdfPageSize`, and the image utilities are subpath-only.
 
-See the full [API Reference](../../docs/API.md#bendylinesquisq-formats) for every signature and options interface.
+See the full [API Reference](https://github.com/bendyline/squisq/blob/main/docs/API.md#bendylinesquisq-formats) for every signature and options interface.
 
 ## Related Packages
 

package/dist/{chunk-NNHKUXKA.js → chunk-26ISNJ7Y.js}

@@ -1,21 +1,20 @@
 import {
+  RelIdAllocator,
   inlineNodeToRuns,
-  inlineNodesToRuns
-} from "./chunk-6M7Z25LA.js";
+  inlineNodesToRuns,
+  normalizeOoxmlHex,
+  sanitizeOfficeHyperlink
+} from "./chunk-GX7RAUME.js";
 import {
   stripHtmlTags
-} from "./chunk-PN52A5AA.js";
-import {
-  baseDirOf,
-  resolveTarget
-} from "./chunk-YRT7GQ5Y.js";
+} from "./chunk-SBUW7NHR.js";
 import {
   createPackage
-} from "./chunk-KURGXM4I.js";
+} from "./chunk-4V3KCHAP.js";
 import {
   escapeXml,
   xmlDeclaration
-} from "./chunk-U4MRIFKL.js";
+} from "./chunk-JU2RHXUB.js";
 import {
   CONTENT_TYPE_DOCX_DOCUMENT,
   CONTENT_TYPE_DOCX_FONT_TABLE,
@@ -38,17 +37,20 @@ import {
   REL_OFFICE_DOCUMENT,
   REL_SETTINGS,
   REL_STYLES,
+  baseDirOf,
   getPartBinary,
   getPartRelationships,
   getPartXml,
-  openPackage
-} from "./chunk-7ARKUCQT.js";
+  openPackage,
+  requireMainPartPath,
+  resolveTarget
+} from "./chunk-X2DEAXNK.js";
 import {
   buildContainer
-} from "./chunk-SSUPBUF5.js";
+} from "./chunk-IIQYS2YH.js";
 import {
   extToMime
-} from "./chunk-O3GVVND4.js";
+} from "./chunk-AONELFLA.js";
 
 // src/docx/export.ts
 import { resolveFontFamily } from "@bendyline/squisq/schemas";
@@ -111,6 +113,7 @@ function pointsToTwips(points) {
 
 // src/docx/export.ts
 async function markdownDocToDocx(doc, options = {}) {
+  options.signal?.throwIfAborted();
   const resolvedOptions = options.themeId !== void 0 ? options : { ...options, themeId: readFrontmatterThemeId(doc.frontmatter) };
   const ctx = new ExportContext(resolvedOptions, doc);
   const stories = partitionDocumentStories(doc.children);
@@ -142,7 +145,14 @@ async function docToDocx(doc, options = {}) {
 }
 var ExportContext = class {
   constructor(options, doc) {
-    this.nextRelId = 1;
+    /**
+     * One id source per rels part — see `RelIdAllocator`. Hyperlink, image AND
+     * fixed (styles/numbering/settings/…) rels all draw from this, keyed by the
+     * story part they belong to, so `word/_rels/document.xml.rels` cannot
+     * contain a duplicate `Id` no matter how many hyperlinks/images a document
+     * has.
+     */
+    this.relIds = new RelIdAllocator();
     this.nextNumId = 1;
     this.nextFootnoteId = 1;
     // 0 is separator, start user footnotes at 1
@@ -172,11 +182,10 @@ var ExportContext = class {
       const theme = resolveThemeForDoc(doc, options.themeId, options.themeRegistry);
       themeFont = firstFontFromStack(resolveFontFamily(theme.typography?.bodyFont, ""));
       themeTitleFont = firstFontFromStack(resolveFontFamily(theme.typography?.titleFont, ""));
-      const stripHash = (c) => c.startsWith("#") ? c.slice(1) : c;
-      if (theme.colors?.primary) themeHeadingColor = stripHash(theme.colors.primary);
-      if (theme.colors?.text) themeBodyColor = stripHash(theme.colors.text);
-      if (theme.colors?.textMuted) themeMutedColor = stripHash(theme.colors.textMuted);
-      if (theme.colors?.background) themeBackgroundColor = stripHash(theme.colors.background);
+      themeHeadingColor = normalizeOoxmlHex(theme.colors?.primary);
+      themeBodyColor = normalizeOoxmlHex(theme.colors?.text);
+      themeMutedColor = normalizeOoxmlHex(theme.colors?.textMuted);
+      themeBackgroundColor = normalizeOoxmlHex(theme.colors?.background);
     }
     this.font = options.defaultFont ?? themeFont ?? DEFAULT_FONT;
     this.headingFont = themeTitleFont ?? this.font;
@@ -186,21 +195,31 @@ var ExportContext = class {
     this.mutedColor = themeMutedColor;
     this.backgroundColor = themeBackgroundColor;
     this.resolvedImages = options.images ?? /* @__PURE__ */ new Map();
+    this.allowRelativeHyperlinks = options.allowRelativeHyperlinks ?? false;
+    this.signal = options.signal;
   }
-  /** Allocate a new relationship ID */
+  /** Allocate a relationship ID on the story part currently being converted. */
   allocRelId() {
-    return `rId${this.nextRelId++}`;
+    return this.allocRelIdFor(this.relationshipSource);
+  }
+  /** Allocate a relationship ID on a specific story part. */
+  allocRelIdFor(source) {
+    return this.relIds.alloc(docxStoryPartPath(source));
   }
   setRelationshipSource(source) {
     this.relationshipSource = source;
   }
   /** Add a hyperlink relationship and return the rId */
   addHyperlink(url) {
+    const target = sanitizeOfficeHyperlink(url, {
+      allowRelative: this.allowRelativeHyperlinks
+    });
+    if (!target) return null;
     const id = this.allocRelId();
     this.relationships.push({
       id,
       type: REL_HYPERLINK,
-      target: url,
+      target,
       targetMode: "External",
       source: this.relationshipSource
     });
@@ -238,6 +257,11 @@ var ExportContext = class {
     return id;
   }
 };
+function docxStoryPartPath(source) {
+  if (source === "header") return "word/header1.xml";
+  if (source === "footer") return "word/footer1.xml";
+  return "word/document.xml";
+}
 function firstFontFromStack(stack) {
   if (!stack) return "";
   const generics = /* @__PURE__ */ new Set([
@@ -264,7 +288,9 @@ function firstFontFromStack(stack) {
 }
 function convertBlocks(nodes, ctx) {
   const parts = [];
-  for (const node of nodes) {
+  for (let index = 0; index < nodes.length; index++) {
+    if ((index & 255) === 0) ctx.signal?.throwIfAborted();
+    const node = nodes[index];
     parts.push(convertBlock(node, ctx, 0));
   }
   return parts.join("");
@@ -426,21 +452,20 @@ function convertInline(node, ctx, format) {
 function makeRun(text, format) {
   if (!text) return "";
   const rPrParts = [];
+  if (format.code) {
+    rPrParts.push(`<w:rFonts w:ascii="${DEFAULT_CODE_FONT}" w:hAnsi="${DEFAULT_CODE_FONT}"/>`);
+  }
   if (format.bold) rPrParts.push("<w:b/>");
   if (format.italic) rPrParts.push("<w:i/>");
   if (format.strike) rPrParts.push("<w:strike/>");
   if (format.color) rPrParts.push(`<w:color w:val="${format.color}"/>`);
-  if (format.code) {
-    rPrParts.push(
-      `<w:rFonts w:ascii="${DEFAULT_CODE_FONT}" w:hAnsi="${DEFAULT_CODE_FONT}"/>`,
-      `<w:sz w:val="${DEFAULT_CODE_FONT_SIZE}"/>`
-    );
-  }
+  if (format.code) rPrParts.push(`<w:sz w:val="${DEFAULT_CODE_FONT_SIZE}"/>`);
   const rPr = rPrParts.length > 0 ? `<w:rPr>${rPrParts.join("")}</w:rPr>` : "";
   return `<w:r>${rPr}<w:t xml:space="preserve">${escapeXml(text)}</w:t></w:r>`;
 }
 function convertLink(node, ctx, format) {
   const rId = ctx.addHyperlink(node.url);
+  if (!rId) return convertInlines(node.children, ctx, format);
   const styledRuns = convertInlinesWithHyperlinkStyle(node.children, ctx, format);
   return `<w:hyperlink r:id="${rId}">${styledRuns}</w:hyperlink>`;
 }
@@ -457,13 +482,10 @@ function convertInlinesWithHyperlinkStyle(nodes, ctx, format) {
 }
 function makeHyperlinkRun(text, format) {
   if (!text) return "";
-  const rPrParts = [
-    '<w:rStyle w:val="Hyperlink"/>',
-    `<w:color w:val="${HYPERLINK_COLOR}"/>`,
-    '<w:u w:val="single"/>'
-  ];
+  const rPrParts = ['<w:rStyle w:val="Hyperlink"/>'];
   if (format.bold) rPrParts.push("<w:b/>");
   if (format.italic) rPrParts.push("<w:i/>");
+  rPrParts.push(`<w:color w:val="${HYPERLINK_COLOR}"/>`, '<w:u w:val="single"/>');
   return `<w:r><w:rPr>${rPrParts.join("")}</w:rPr><w:t xml:space="preserve">${escapeXml(text)}</w:t></w:r>`;
 }
 function convertImage(node, ctx) {
@@ -536,22 +558,16 @@ function convertFootnoteRef(node, ctx) {
 }
 async function buildDocxPackage(bodyXml, headerXml, footerXml, ctx, options) {
   const pkg = createPackage();
-  let relCounter = 100;
-  const stylesRelId = `rId${relCounter++}`;
-  const numberingRelId = `rId${relCounter++}`;
-  const settingsRelId = `rId${relCounter++}`;
-  const fontTableRelId = `rId${relCounter++}`;
-  const footnotesRelId = `rId${relCounter++}`;
-  const headerRelId = `rId${relCounter++}`;
-  const footerRelId = `rId${relCounter++}`;
   const hasHeader = headerXml.trim().length > 0;
   const hasFooter = footerXml.trim().length > 0;
-  const documentXml = buildDocumentXml(
-    bodyXml,
-    ctx.backgroundColor,
-    hasHeader ? headerRelId : void 0,
-    hasFooter ? footerRelId : void 0
-  );
+  const stylesRelId = ctx.allocRelIdFor("document");
+  const settingsRelId = ctx.allocRelIdFor("document");
+  const fontTableRelId = ctx.allocRelIdFor("document");
+  const numberingRelId = ctx.hasLists ? ctx.allocRelIdFor("document") : void 0;
+  const footnotesRelId = ctx.hasFootnotes ? ctx.allocRelIdFor("document") : void 0;
+  const headerRelId = hasHeader ? ctx.allocRelIdFor("document") : void 0;
+  const footerRelId = hasFooter ? ctx.allocRelIdFor("document") : void 0;
+  const documentXml = buildDocumentXml(bodyXml, ctx.backgroundColor, headerRelId, footerRelId);
   pkg.addPart("word/document.xml", documentXml, CONTENT_TYPE_DOCX_DOCUMENT);
   if (hasHeader) {
     pkg.addPart("word/header1.xml", buildStoryXml("header", headerXml), CONTENT_TYPE_DOCX_HEADER);
@@ -593,28 +609,28 @@ async function buildDocxPackage(bodyXml, headerXml, footerXml, ctx, options) {
     type: REL_FONT_TABLE,
     target: "fontTable.xml"
   });
-  if (ctx.hasLists) {
+  if (numberingRelId) {
     pkg.addRelationship("word/document.xml", {
       id: numberingRelId,
       type: REL_NUMBERING,
       target: "numbering.xml"
     });
   }
-  if (ctx.hasFootnotes) {
+  if (footnotesRelId) {
     pkg.addRelationship("word/document.xml", {
       id: footnotesRelId,
       type: REL_FOOTNOTES,
       target: "footnotes.xml"
     });
   }
-  if (hasHeader) {
+  if (headerRelId) {
     pkg.addRelationship("word/document.xml", {
       id: headerRelId,
       type: REL_HEADER,
       target: "header1.xml"
     });
   }
-  if (hasFooter) {
+  if (footerRelId) {
     pkg.addRelationship("word/document.xml", {
       id: footerRelId,
       type: REL_FOOTER,
@@ -622,8 +638,7 @@ async function buildDocxPackage(bodyXml, headerXml, footerXml, ctx, options) {
     });
   }
   for (const rel of ctx.relationships) {
-    const sourcePart = rel.source === "header" ? "word/header1.xml" : rel.source === "footer" ? "word/footer1.xml" : "word/document.xml";
-    pkg.addRelationship(sourcePart, {
+    pkg.addRelationship(docxStoryPartPath(rel.source), {
       id: rel.id,
       type: rel.type,
       target: rel.target,
@@ -726,12 +741,14 @@ function buildFootnotesXml(ctx) {
 // src/docx/import.ts
 import { markdownToDoc } from "@bendyline/squisq/doc";
 import { stringifyMarkdown } from "@bendyline/squisq/markdown";
+var DOCX_MAIN_PART = "word/document.xml";
 async function docxToMarkdownDoc(data, options = {}) {
   const pkg = await openPackage(data, options);
-  const ctx = await buildImportContext(pkg, options);
-  const documentXml = await getPartXml(pkg, "word/document.xml");
+  const mainPart = requireMainPartPath(pkg, DOCX_MAIN_PART, "DOCX");
+  const ctx = await buildImportContext(pkg, options, mainPart);
+  const documentXml = await getPartXml(pkg, mainPart);
   if (!documentXml) {
-    return { type: "document", children: [] };
+    throw new Error(`Invalid DOCX package: main document part "${mainPart}" could not be parsed.`);
   }
   const body = getFirstElement(documentXml, "body");
   if (!body) {
@@ -746,16 +763,19 @@ async function docxToDoc(data, options = {}) {
 }
 async function docxToContainer(data, options = {}) {
   const pkg = await openPackage(data, options);
-  const ctx = await buildImportContext(pkg, { ...options, extractImages: true });
-  const documentXml = await getPartXml(pkg, "word/document.xml");
-  if (!documentXml) return buildContainer("", []);
+  const mainPart = requireMainPartPath(pkg, DOCX_MAIN_PART, "DOCX");
+  const ctx = await buildImportContext(pkg, { ...options, extractImages: true }, mainPart);
+  const documentXml = await getPartXml(pkg, mainPart);
+  if (!documentXml) {
+    throw new Error(`Invalid DOCX package: main document part "${mainPart}" could not be parsed.`);
+  }
   const body = getFirstElement(documentXml, "body");
   if (!body) return buildContainer("", []);
   const blocks = await convertDocumentStories(body, ctx);
   const markdownDoc = { type: "document", children: blocks };
   return buildContainer(stringifyMarkdown(markdownDoc), ctx.extractedImages);
 }
-async function buildImportContext(pkg, options) {
+async function buildImportContext(pkg, options, mainPartPath = DOCX_MAIN_PART) {
   const ctx = {
     headingStyles: /* @__PURE__ */ new Map(),
     quoteStyles: /* @__PURE__ */ new Set(),
@@ -765,7 +785,8 @@ async function buildImportContext(pkg, options) {
     numbering: /* @__PURE__ */ new Map(),
     footnotes: /* @__PURE__ */ new Map(),
     endnotes: /* @__PURE__ */ new Map(),
-    currentPartPath: "word/document.xml",
+    currentPartPath: mainPartPath,
+    mainPartPath,
     pkg,
     options,
     extractedImages: /* @__PURE__ */ new Map(),
@@ -784,7 +805,7 @@ async function buildImportContext(pkg, options) {
     ctx.inlineCodeStyles.add(id);
   }
   await parseStyles(pkg, ctx);
-  const rels = await getPartRelationships(pkg, "word/document.xml");
+  const rels = await getPartRelationships(pkg, mainPartPath);
   for (const rel of rels) {
     ctx.documentRels.set(rel.id, rel);
   }
@@ -902,7 +923,7 @@ async function convertRelatedStories(body, ctx, kind) {
   const results = [];
   for (const relationship of documentRelationships.values()) {
     if (!relationship.type.endsWith(relationshipTypeSuffix)) continue;
-    const partPath = resolveTarget(baseDirOf("word/document.xml"), relationship.target);
+    const partPath = resolveTarget(baseDirOf(ctx.mainPartPath), relationship.target);
     const part = await getPartXml(ctx.pkg, partPath);
     if (!part?.documentElement) continue;
     const partRelationships = await getPartRelationships(ctx.pkg, partPath);
@@ -1431,4 +1452,3 @@ export {
   docxToDoc,
   docxToContainer
 };
-//# sourceMappingURL=chunk-NNHKUXKA.js.map

package/dist/{chunk-NKAJPJ4G.js → chunk-2JJ5RFDZ.js}

@@ -103,4 +103,3 @@ export {
   compileExtractedTheme,
   colorHintsFromExtraction
 };
-//# sourceMappingURL=chunk-NKAJPJ4G.js.map

package/dist/{chunk-KURGXM4I.js → chunk-4V3KCHAP.js}

@@ -1,7 +1,7 @@
 import {
   escapeXml,
   xmlDeclaration
-} from "./chunk-U4MRIFKL.js";
+} from "./chunk-JU2RHXUB.js";
 import {
   CONTENT_TYPE_CORE_PROPERTIES,
   CONTENT_TYPE_RELATIONSHIPS,
@@ -12,10 +12,10 @@ import {
   NS_RELATIONSHIPS,
   NS_XSI,
   REL_CORE_PROPERTIES
-} from "./chunk-7ARKUCQT.js";
+} from "./chunk-X2DEAXNK.js";
 import {
   assertSafeZipPath
-} from "./chunk-FE6OJV6O.js";
+} from "./chunk-7AWFHP5U.js";
 
 // src/ooxml/writer.ts
 import JSZip from "jszip";
@@ -192,4 +192,3 @@ function groupRelationshipsBySource(pending) {
 export {
   createPackage
 };
-//# sourceMappingURL=chunk-KURGXM4I.js.map

package/dist/{chunk-MLX2BOJC.js → chunk-6RQOV3B3.js}

@@ -1,6 +1,6 @@
 import {
   extToMime
-} from "./chunk-O3GVVND4.js";
+} from "./chunk-AONELFLA.js";
 
 // src/html/imageUtils.ts
 function inferMimeType(filename) {
@@ -31,4 +31,3 @@ export {
   arrayBufferToBase64DataUrl,
   extractFilename
 };
-//# sourceMappingURL=chunk-MLX2BOJC.js.map

package/dist/{chunk-EW54IRRS.js → chunk-6S6GU3ZG.js}

@@ -1,19 +1,19 @@
 import {
   ConversionError
-} from "./chunk-ODL3SSPT.js";
+} from "./chunk-KXOZMWBS.js";
 import {
   extractDocxTheme,
   extractPptxTheme,
   extractXlsxTheme
-} from "./chunk-74GO3FVS.js";
+} from "./chunk-PU7REGWV.js";
 import {
   colorHintsFromExtraction,
   compileExtractedTheme
-} from "./chunk-NKAJPJ4G.js";
+} from "./chunk-2JJ5RFDZ.js";
 import {
   openPackage,
   throwIfOoxmlAborted
-} from "./chunk-7ARKUCQT.js";
+} from "./chunk-X2DEAXNK.js";
 
 // src/infer/index.ts
 async function looksLikePdf(data, signal) {
@@ -107,7 +107,7 @@ async function inferThemeFromFile(data, options = {}) {
     if (format !== "pptx") {
       warnings.push("Layout inference is only available for PowerPoint files; skipped.");
     } else {
-      const { analyzePptxLayouts } = await import("./layouts-5VDIRPIJ.js");
+      const { analyzePptxLayouts } = await import("./layouts-DRWZGSPD.js");
       const analysis = await analyzePptxLayouts(pkg, {
         colors: colorHintsFromExtraction(extraction),
         signal: options.signal
@@ -124,4 +124,3 @@ async function inferThemeFromFile(data, options = {}) {
 export {
   inferThemeFromFile
 };
-//# sourceMappingURL=chunk-EW54IRRS.js.map

package/dist/{chunk-FE6OJV6O.js → chunk-7AWFHP5U.js}

@@ -555,6 +555,6 @@ function makeCrcTable() {
 export {
   ZipSafetyError,
   assertSafeZipPath,
+  resolveZipSafetyLimits,
   openBoundedZipArchive
 };
-//# sourceMappingURL=chunk-FE6OJV6O.js.map

package/dist/{chunk-RFAPOKHJ.js → chunk-AD2WT564.js}

@@ -1,27 +1,54 @@
 // src/csv/index.ts
 import { markdownToDoc } from "@bendyline/squisq/doc";
+var DEFAULT_MAX_CSV_CELLS = 1e5;
+var DEFAULT_MAX_CSV_ROWS = 1e4;
+var DEFAULT_MAX_CSV_FIELD_CHARS = 1024 * 1024;
 async function toText(data) {
   if (typeof data === "string") return data;
   if (typeof Blob !== "undefined" && data instanceof Blob) return data.text();
   return new TextDecoder().decode(new Uint8Array(data));
 }
-function parseCsv(text, delimiter = ",") {
+function validateDelimiter(delimiter) {
+  if ([...delimiter].length !== 1 || /["\r\n\uFEFF]/u.test(delimiter)) {
+    throw new TypeError(
+      "CSV delimiter must be exactly one character and cannot be a quote, line break, or BOM"
+    );
+  }
+  return delimiter;
+}
+function parseCsv(text, delimiter = ",", limits = {}) {
+  delimiter = validateDelimiter(delimiter);
+  const maxCells = safetyInteger("maxCells", limits.maxCells ?? DEFAULT_MAX_CSV_CELLS);
+  const maxRows = safetyInteger("maxRows", limits.maxRows ?? DEFAULT_MAX_CSV_ROWS);
+  const maxFieldChars = safetyInteger(
+    "maxFieldChars",
+    limits.maxFieldChars ?? DEFAULT_MAX_CSV_FIELD_CHARS
+  );
   const rows = [];
   let row = [];
   let field = "";
   let inQuotes = false;
   let sawAny = false;
+  let cellCount = 0;
   const pushField = () => {
+    if (++cellCount > maxCells)
+      throw new RangeError(`CSV exceeds the ${maxCells}-cell safety limit`);
     row.push(field);
     field = "";
   };
   const pushRow = () => {
+    if (rows.length >= maxRows) throw new RangeError(`CSV exceeds the ${maxRows}-row safety limit`);
     pushField();
     rows.push(row);
     row = [];
   };
   for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
+    if ((i & 16383) === 0) limits.signal?.throwIfAborted();
+    let ch = text[i];
+    if (delimiter.length === 2 && text.slice(i, i + 2) === delimiter) {
+      ch = delimiter;
+      i++;
+    }
     if (inQuotes) {
       if (ch === '"') {
         if (text[i + 1] === '"') {
@@ -32,6 +59,9 @@ function parseCsv(text, delimiter = ",") {
         }
       } else {
         field += ch;
+        if (field.length > maxFieldChars) {
+          throw new RangeError(`CSV field exceeds the ${maxFieldChars}-character safety limit`);
+        }
       }
       continue;
     }
@@ -53,10 +83,19 @@ function parseCsv(text, delimiter = ",") {
     }
     sawAny = true;
     field += ch;
+    if (field.length > maxFieldChars) {
+      throw new RangeError(`CSV field exceeds the ${maxFieldChars}-character safety limit`);
+    }
   }
   if (field !== "" || row.length > 0 || sawAny) pushRow();
   return rows;
 }
+function safetyInteger(name, value) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new RangeError(`${name} must be a non-negative safe integer`);
+  }
+  return value;
+}
 function rowsToTable(rows, hasHeader) {
   const maxCols = rows.reduce((m, r) => Math.max(m, r.length), 1);
   const mdRows = rows.map((cells, rowIdx) => {
@@ -74,8 +113,8 @@ function rowsToTable(rows, hasHeader) {
   return { type: "table", children: mdRows };
 }
 async function csvToMarkdownDoc(data, options = {}) {
-  const text = await toText(data);
-  const rows = parseCsv(text, options.delimiter ?? ",");
+  const text = (await toText(data)).replace(/^\uFEFF/, "");
+  const rows = parseCsv(text, options.delimiter ?? ",", options);
   const hasHeader = options.hasHeader ?? true;
   const children = rows.length > 0 ? [rowsToTable(rows, hasHeader)] : [];
   return { type: "document", children };
@@ -89,6 +128,11 @@ function escapeCsvField(value, delimiter) {
   }
   return value;
 }
+var SPREADSHEET_FORMULA_PREFIX = /^[\t\r\n \uFEFF]*[=+\-@]/;
+function neutralizeSpreadsheetFormula(value, handling) {
+  if (handling === "preserve" || !SPREADSHEET_FORMULA_PREFIX.test(value)) return value;
+  return `'${value}`;
+}
 function cellText(cell) {
   const walk = (nodes) => nodes.map((n) => {
     const node = n;
@@ -99,7 +143,8 @@ function cellText(cell) {
   return walk(cell.children);
 }
 function markdownDocToCsv(doc, options = {}) {
-  const delimiter = options.delimiter ?? ",";
+  const delimiter = validateDelimiter(options.delimiter ?? ",");
+  const formulaHandling = options.formulaHandling ?? "escape";
   const tables = doc.children.filter((n) => n.type === "table");
   const index = options.tableIndex ?? 0;
   if (options.tableIndex !== void 0 && (!Number.isInteger(index) || index < 0 || index >= tables.length)) {
@@ -109,9 +154,15 @@ function markdownDocToCsv(doc, options = {}) {
   }
   const table = tables[index];
   if (!table) return "";
-  return table.children.map(
-    (row) => row.children.map((cell) => escapeCsvField(cellText(cell), delimiter)).join(delimiter)
-  ).join("\r\n");
+  const maxCells = safetyInteger("maxCells", options.maxCells ?? DEFAULT_MAX_CSV_CELLS);
+  const cellCount = table.children.reduce((count, row) => count + row.children.length, 0);
+  if (cellCount > maxCells) throw new RangeError(`CSV exceeds the ${maxCells}-cell safety limit`);
+  return table.children.map((row, rowIndex) => {
+    if ((rowIndex & 255) === 0) options.signal?.throwIfAborted();
+    return row.children.map(
+      (cell) => escapeCsvField(neutralizeSpreadsheetFormula(cellText(cell), formulaHandling), delimiter)
+    ).join(delimiter);
+  }).join("\r\n");
 }
 
 export {
@@ -120,4 +171,3 @@ export {
   csvToDoc,
   markdownDocToCsv
 };
-//# sourceMappingURL=chunk-RFAPOKHJ.js.map

package/dist/{chunk-O3GVVND4.js → chunk-AONELFLA.js}

@@ -30,4 +30,3 @@ function extToMime(ext) {
 export {
   extToMime
 };
-//# sourceMappingURL=chunk-O3GVVND4.js.map

package/dist/{chunk-SC67HYQJ.js → chunk-EJTNGKEA.js}

@@ -1,14 +1,12 @@
-import {
-  baseDirOf,
-  findRelByType,
-  resolveTarget
-} from "./chunk-YRT7GQ5Y.js";
 import {
   NS_DRAWINGML,
   REL_THEME,
+  baseDirOf,
+  findRelByType,
   getPartRelationships,
-  getPartXml
-} from "./chunk-7ARKUCQT.js";
+  getPartXml,
+  resolveTarget
+} from "./chunk-X2DEAXNK.js";
 
 // src/ooxml/themeReader.ts
 var HEX6_RE = /^[0-9a-fA-F]{6}$/;
@@ -128,4 +126,3 @@ export {
   parseThemeXml,
   readThemePart
 };
-//# sourceMappingURL=chunk-SC67HYQJ.js.map