@beyondwork/docx-react-component 1.0.41 → 1.0.42

package/src/io/export/serialize-runtime-revisions.ts

@@ -3,6 +3,7 @@ import {
   mapRevisionBoundaries,
   type RevisionParagraphBoundary,
 } from "../ooxml/revision-boundaries.ts";
+import { escapeXmlAttribute } from "./escape-xml-attribute.ts";
 
 interface XmlReplacement {
   start: number;
@@ -360,7 +361,7 @@ function serializeRevisionAttributes(revision: RevisionRecord): string {
 
   return Object.entries(attributes)
     .filter(([, value]) => value && value.length > 0)
-    .map(([name, value]) => ` ${name}="${escapeAttribute(value)}"`)
+    .map(([name, value]) => ` ${name}="${escapeXmlAttribute(value)}"`)
     .join("");
 }
 
@@ -453,11 +454,3 @@ function applyReplacements(documentXml: string, replacements: readonly XmlReplac
 
   return output;
 }
-
-function escapeAttribute(value: string): string {
-  return value
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
-}

package/src/io/export/serialize-tables.ts

@@ -11,6 +11,7 @@ import type {
   ParsedTableWidth,
 } from "../ooxml/parse-tables.ts";
 import { twip } from "./twip.ts";
+import { escapeXmlAttribute } from "./escape-xml-attribute.ts";
 
 export function serializeTable(table: ParsedTable): string {
   const propertiesXml = table.propertiesXml ?? buildTablePropertiesXml(table);
@@ -60,10 +61,10 @@ function buildTablePropertiesXml(table: ParsedTable): string {
     children.push(table.bidiVisual ? `<w:bidiVisual/>` : `<w:bidiVisual w:val="0"/>`);
   }
   if (table.caption !== undefined) {
-    children.push(`<w:tblCaption w:val="${escapeAttribute(table.caption)}"/>`);
+    children.push(`<w:tblCaption w:val="${escapeXmlAttribute(table.caption)}"/>`);
   }
   if (table.description !== undefined) {
-    children.push(`<w:tblDescription w:val="${escapeAttribute(table.description)}"/>`);
+    children.push(`<w:tblDescription w:val="${escapeXmlAttribute(table.description)}"/>`);
   }
   if (table.floating) {
     const floatingXml = serializeTableFloating(table.floating);
@@ -106,7 +107,7 @@ function serializeTableFloating(floating: NonNullable<ParsedTable["floating"]>):
 function buildRowPropertiesXml(row: ParsedTableRow): string {
   const children: string[] = [];
   if (row.cnfStyle) {
-    children.push(`<w:cnfStyle w:val="${escapeAttribute(row.cnfStyle)}"/>`);
+    children.push(`<w:cnfStyle w:val="${escapeXmlAttribute(row.cnfStyle)}"/>`);
   }
   if (row.cantSplit !== undefined) {
     children.push(row.cantSplit ? `<w:cantSplit/>` : `<w:cantSplit w:val="0"/>`);
@@ -131,7 +132,7 @@ function ensureCellProperties(cell: ParsedTableCell): string {
 
   const children: string[] = [];
   if (cell.cnfStyle) {
-    children.push(`<w:cnfStyle w:val="${escapeAttribute(cell.cnfStyle)}"/>`);
+    children.push(`<w:cnfStyle w:val="${escapeXmlAttribute(cell.cnfStyle)}"/>`);
   }
   if (cell.width) {
     children.push(serializeWidth("tcW", cell.width));
@@ -174,15 +175,15 @@ function ensureCellProperties(cell: ParsedTableCell): string {
 }
 
 function serializeWidth(element: string, width: ParsedTableWidth): string {
-  return `<w:${element} w:w="${twip(width.value)}" w:type="${width.type}"/>`;
+  return `<w:${element} w:w="${twip(width.value)}" w:type="${escapeXmlAttribute(width.type)}"/>`;
 }
 
 function serializeBorderSpec(element: string, spec: ParsedBorderSpec): string {
   const attrs: string[] = [];
-  if (spec.value) attrs.push(`w:val="${spec.value}"`);
+  if (spec.value) attrs.push(`w:val="${escapeXmlAttribute(spec.value)}"`);
   if (spec.size !== undefined) attrs.push(`w:sz="${twip(spec.size)}"`);
   if (spec.space !== undefined) attrs.push(`w:space="${twip(spec.space)}"`);
-  if (spec.color) attrs.push(`w:color="${spec.color}"`);
+  if (spec.color) attrs.push(`w:color="${escapeXmlAttribute(spec.color)}"`);
   const attrsStr = attrs.length > 0 ? ` ${attrs.join(" ")}` : "";
   return `<w:${element}${attrsStr}/>`;
 }
@@ -240,11 +241,3 @@ function serializeTableCellMargins(margins: ParsedCellMargins): string {
   if (margins.right !== undefined) parts.push(`<w:right w:w="${twip(margins.right)}" w:type="dxa"/>`);
   return parts.join("");
 }
-
-function escapeAttribute(value: string): string {
-  return value
-    .replace(/&/gu, "&amp;")
-    .replace(/"/gu, "&quot;")
-    .replace(/</gu, "&lt;")
-    .replace(/>/gu, "&gt;");
-}

package/src/io/export/table-properties-xml.ts

@@ -1,4 +1,5 @@
 import { twip } from "./twip.ts";
+import { escapeXmlAttribute } from "./escape-xml-attribute.ts";
 
 interface TableWidthLike {
   value: number;
@@ -233,31 +234,31 @@ function stripKnownProperties(xml: string, stripSpec: PropertyStripSpec): string
 function buildTablePropertiesInnerXml(table: TablePropertiesLike): string {
   const children: string[] = [];
   if (table.styleId) {
-    children.push(`<w:tblStyle w:val="${escapeAttribute(table.styleId)}"/>`);
+    children.push(`<w:tblStyle w:val="${escapeXmlAttribute(table.styleId)}"/>`);
   }
   if (table.width) {
     children.push(serializeWidth("tblW", table.width));
   }
   if (table.alignment) {
-    children.push(`<w:jc w:val="${escapeAttribute(table.alignment)}"/>`);
+    children.push(`<w:jc w:val="${escapeXmlAttribute(table.alignment)}"/>`);
   }
   if (table.indent) {
-    children.push(`<w:tblInd w:w="${table.indent.value}" w:type="${escapeAttribute(table.indent.type)}"/>`);
+    children.push(`<w:tblInd w:w="${table.indent.value}" w:type="${escapeXmlAttribute(table.indent.type)}"/>`);
   }
   if (table.layoutMode) {
-    children.push(`<w:tblLayout w:type="${escapeAttribute(table.layoutMode)}"/>`);
+    children.push(`<w:tblLayout w:type="${escapeXmlAttribute(table.layoutMode)}"/>`);
   }
   if (table.cellSpacing) {
-    children.push(`<w:tblCellSpacing w:w="${table.cellSpacing.value}" w:type="${escapeAttribute(table.cellSpacing.type)}"/>`);
+    children.push(`<w:tblCellSpacing w:w="${table.cellSpacing.value}" w:type="${escapeXmlAttribute(table.cellSpacing.type)}"/>`);
   }
   if (table.bidiVisual !== undefined) {
     children.push(table.bidiVisual ? `<w:bidiVisual/>` : `<w:bidiVisual w:val="0"/>`);
   }
   if (table.caption !== undefined) {
-    children.push(`<w:tblCaption w:val="${escapeAttribute(table.caption)}"/>`);
+    children.push(`<w:tblCaption w:val="${escapeXmlAttribute(table.caption)}"/>`);
   }
   if (table.description !== undefined) {
-    children.push(`<w:tblDescription w:val="${escapeAttribute(table.description)}"/>`);
+    children.push(`<w:tblDescription w:val="${escapeXmlAttribute(table.description)}"/>`);
   }
   if (table.floating) {
     const floatingXml = serializeTableFloating(table.floating);
@@ -286,11 +287,11 @@ function buildTablePropertiesInnerXml(table: TablePropertiesLike): string {
 
 function serializeTableFloating(floating: TableFloatingPropertiesLike): string {
   const attrs: string[] = [];
-  if (floating.horizontalAnchor) attrs.push(`w:horzAnchor="${escapeAttribute(floating.horizontalAnchor)}"`);
-  if (floating.verticalAnchor) attrs.push(`w:vertAnchor="${escapeAttribute(floating.verticalAnchor)}"`);
-  if (floating.horizontalAlign) attrs.push(`w:tblpXSpec="${escapeAttribute(floating.horizontalAlign)}"`);
+  if (floating.horizontalAnchor) attrs.push(`w:horzAnchor="${escapeXmlAttribute(floating.horizontalAnchor)}"`);
+  if (floating.verticalAnchor) attrs.push(`w:vertAnchor="${escapeXmlAttribute(floating.verticalAnchor)}"`);
+  if (floating.horizontalAlign) attrs.push(`w:tblpXSpec="${escapeXmlAttribute(floating.horizontalAlign)}"`);
   if (floating.horizontalOffset !== undefined) attrs.push(`w:tblpX="${floating.horizontalOffset}"`);
-  if (floating.verticalAlign) attrs.push(`w:tblpYSpec="${escapeAttribute(floating.verticalAlign)}"`);
+  if (floating.verticalAlign) attrs.push(`w:tblpYSpec="${escapeXmlAttribute(floating.verticalAlign)}"`);
   if (floating.verticalOffset !== undefined) attrs.push(`w:tblpY="${floating.verticalOffset}"`);
   if (floating.leftFromText !== undefined) attrs.push(`w:leftFromText="${floating.leftFromText}"`);
   if (floating.rightFromText !== undefined) attrs.push(`w:rightFromText="${floating.rightFromText}"`);
@@ -306,7 +307,7 @@ function serializeTableFloating(floating: TableFloatingPropertiesLike): string {
 function buildTableRowPropertiesInnerXml(row: TableRowPropertiesLike): string {
   const children: string[] = [];
   if (row.cnfStyle) {
-    children.push(`<w:cnfStyle w:val="${escapeAttribute(row.cnfStyle)}"/>`);
+    children.push(`<w:cnfStyle w:val="${escapeXmlAttribute(row.cnfStyle)}"/>`);
   }
   if (row.gridBefore !== undefined) {
     children.push(`<w:gridBefore w:val="${twip(row.gridBefore)}"/>`);
@@ -328,7 +329,7 @@ function buildTableRowPropertiesInnerXml(row: TableRowPropertiesLike): string {
     children.push(row.cantSplit ? `<w:cantSplit/>` : `<w:cantSplit w:val="0"/>`);
   }
   if (row.height !== undefined) {
-    const hRuleAttr = row.heightRule ? ` w:hRule="${escapeAttribute(row.heightRule)}"` : "";
+    const hRuleAttr = row.heightRule ? ` w:hRule="${escapeXmlAttribute(row.heightRule)}"` : "";
     children.push(`<w:trHeight w:val="${twip(row.height)}"${hRuleAttr}/>`);
   }
   // ST_OnOff element (A.3):
@@ -343,7 +344,7 @@ function buildTableRowPropertiesInnerXml(row: TableRowPropertiesLike): string {
     children.push(`<w:tblHeader w:val="false"/>`);
   }
   if (row.horizontalAlignment) {
-    children.push(`<w:jc w:val="${escapeAttribute(row.horizontalAlignment)}"/>`);
+    children.push(`<w:jc w:val="${escapeXmlAttribute(row.horizontalAlignment)}"/>`);
   }
   return children.join("");
 }
@@ -351,7 +352,7 @@ function buildTableRowPropertiesInnerXml(row: TableRowPropertiesLike): string {
 function buildTableCellPropertiesInnerXml(cell: TableCellPropertiesLike): string {
   const children: string[] = [];
   if (cell.cnfStyle) {
-    children.push(`<w:cnfStyle w:val="${escapeAttribute(cell.cnfStyle)}"/>`);
+    children.push(`<w:cnfStyle w:val="${escapeXmlAttribute(cell.cnfStyle)}"/>`);
   }
   if (cell.width) {
     children.push(serializeWidth("tcW", cell.width));
@@ -391,10 +392,10 @@ function buildTableCellPropertiesInnerXml(cell: TableCellPropertiesLike): string
     children.push(cell.fitText ? `<w:tcFitText/>` : `<w:tcFitText w:val="0"/>`);
   }
   if (cell.textDirection) {
-    children.push(`<w:textDirection w:val="${escapeAttribute(cell.textDirection)}"/>`);
+    children.push(`<w:textDirection w:val="${escapeXmlAttribute(cell.textDirection)}"/>`);
   }
   if (cell.verticalAlign) {
-    children.push(`<w:vAlign w:val="${escapeAttribute(cell.verticalAlign)}"/>`);
+    children.push(`<w:vAlign w:val="${escapeXmlAttribute(cell.verticalAlign)}"/>`);
   }
   return children.join("");
 }
@@ -402,7 +403,7 @@ function buildTableCellPropertiesInnerXml(cell: TableCellPropertiesLike): string
 function serializeWidth(elementName: "tblW" | "tcW", width: TableWidthLike): string {
   // OOXML allows w:w to be percentage (pct) or twentieths-of-a-percent too, but
   // both are integer-typed in the schema. Always round at the authoring edge.
-  return `<w:${elementName} w:w="${twip(width.value)}" w:type="${escapeAttribute(width.type)}"/>`;
+  return `<w:${elementName} w:w="${twip(width.value)}" w:type="${escapeXmlAttribute(width.type)}"/>`;
 }
 
 function serializeBorders(borders: TableBordersLike): string {
@@ -415,10 +416,10 @@ function serializeBorders(borders: TableBordersLike): string {
 
 function serializeBorderSpec(elementName: string, border: BorderSpecLike): string {
   const attrs: string[] = [];
-  if (border.value) attrs.push(`w:val="${escapeAttribute(border.value)}"`);
+  if (border.value) attrs.push(`w:val="${escapeXmlAttribute(border.value)}"`);
   if (border.size !== undefined) attrs.push(`w:sz="${twip(border.size)}"`);
   if (border.space !== undefined) attrs.push(`w:space="${twip(border.space)}"`);
-  if (border.color) attrs.push(`w:color="${escapeAttribute(border.color)}"`);
+  if (border.color) attrs.push(`w:color="${escapeXmlAttribute(border.color)}"`);
   return attrs.length > 0 ? `<w:${elementName} ${attrs.join(" ")}/>` : "";
 }
 
@@ -434,7 +435,7 @@ function serializeTableCellMargins(margins: TableCellMarginsLike): string {
 function serializeTableLook(tblLook: TableLookLike): string {
   const attrs: string[] = [];
   if (tblLook.val) {
-    attrs.push(`w:val="${escapeAttribute(tblLook.val)}"`);
+    attrs.push(`w:val="${escapeXmlAttribute(tblLook.val)}"`);
   }
   for (const [key, attr] of [
     ["firstRow", "w:firstRow"],
@@ -457,16 +458,8 @@ function serializeTableLook(tblLook: TableLookLike): string {
 
 function serializeCellShading(shading: CellShadingLike): string {
   const attrs: string[] = [];
-  if (shading.val) attrs.push(`w:val="${escapeAttribute(shading.val)}"`);
-  if (shading.color) attrs.push(`w:color="${escapeAttribute(shading.color)}"`);
-  if (shading.fill) attrs.push(`w:fill="${escapeAttribute(shading.fill)}"`);
+  if (shading.val) attrs.push(`w:val="${escapeXmlAttribute(shading.val)}"`);
+  if (shading.color) attrs.push(`w:color="${escapeXmlAttribute(shading.color)}"`);
+  if (shading.fill) attrs.push(`w:fill="${escapeXmlAttribute(shading.fill)}"`);
   return attrs.length > 0 ? `<w:shd ${attrs.join(" ")}/>` : "";
 }
-
-function escapeAttribute(value: string): string {
-  return value
-    .replace(/&/gu, "&amp;")
-    .replace(/"/gu, "&quot;")
-    .replace(/</gu, "&lt;")
-    .replace(/>/gu, "&gt;");
-}

package/src/io/import/external-reimport.ts

@@ -0,0 +1,40 @@
+import type {
+  ExternalCustody,
+  ExternalCustodyResolver,
+  ExternalCustodyRestoredContent,
+} from "../../api/external-custody-types.ts";
+
+export type ReimportResult =
+  | { outcome: "skipped" /* no custody attached */ }
+  | { outcome: "resolver_missing" /* custody present, no host resolver */ }
+  | { outcome: "tampered" /* incoming doc body hash ≠ originContentHash */ }
+  | { outcome: "deferred" /* resolver returned undefined; keep custody for retry */ }
+  | { outcome: "restored"; content: ExternalCustodyRestoredContent };
+
+export interface MaybeRestoreArgs {
+  custody: ExternalCustody | undefined;
+  resolver: ExternalCustodyResolver | undefined;
+  /** sha256:{hex} of canonicalized word/document.xml of the incoming docx. */
+  incomingDocxHash: string;
+}
+
+/**
+ * Re-import pipeline. Classifies the call into a closed outcome set so
+ * the caller can decide how to merge the restored content back into
+ * the runtime state.
+ */
+export async function maybeRestoreFromExternalCustody(
+  args: MaybeRestoreArgs,
+): Promise<ReimportResult> {
+  if (!args.custody) return { outcome: "skipped" };
+  if (!args.resolver) return { outcome: "resolver_missing" };
+  if (args.custody.originContentHash !== args.incomingDocxHash) {
+    return { outcome: "tampered" };
+  }
+  const restored = await args.resolver.restore({
+    custodyId: args.custody.custodyId,
+    originContentHash: args.custody.originContentHash,
+  });
+  if (!restored) return { outcome: "deferred" };
+  return { outcome: "restored", content: restored };
+}

package/src/io/ooxml/bw-xml.ts

@@ -0,0 +1,244 @@
+/**
+ * Minimal XML helpers shared by the `bw:` round-trip builders +
+ * parsers. Intentionally not a general-purpose parser — only covers
+ * the shapes the bw schema uses: elements with attributes, text +
+ * CDATA content, no processing instructions, no mixed namespaces.
+ *
+ * The canonicalizer in `canonicalize-payload.ts` has its own inline
+ * parser because its contract is stricter (attribute sort, sort-key
+ * tables). These helpers are for conventional build/parse work where
+ * we just need the tree.
+ */
+
+export interface BwElement {
+  kind: "element";
+  name: string;
+  attributes: Record<string, string>;
+  children: BwNode[];
+}
+
+export interface BwText {
+  kind: "text";
+  text: string;
+}
+
+export type BwNode = BwElement | BwText;
+
+export function parseBwXml(src: string): BwElement {
+  let i = 0;
+  skipPrologAndWs();
+  const root = readElement();
+  if (!root) throw new Error("bw-xml: no root element");
+  return root;
+
+  function skipPrologAndWs(): void {
+    while (i < src.length) {
+      if (src.startsWith("<?", i)) {
+        const end = src.indexOf("?>", i);
+        if (end < 0) throw new Error("bw-xml: unterminated prolog");
+        i = end + 2;
+        continue;
+      }
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("bw-xml: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (/\s/.test(src[i]!)) {
+        i += 1;
+        continue;
+      }
+      break;
+    }
+  }
+
+  function readElement(): BwElement | null {
+    while (i < src.length) {
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("bw-xml: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (/\s/.test(src[i]!)) {
+        i += 1;
+        continue;
+      }
+      break;
+    }
+    if (src[i] !== "<") return null;
+    if (src.startsWith("</", i)) return null;
+    i += 1;
+
+    const nameStart = i;
+    while (i < src.length && !/[\s/>]/.test(src[i]!)) i += 1;
+    const name = src.slice(nameStart, i);
+
+    const attrs: Record<string, string> = {};
+    while (i < src.length) {
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      if (src[i] === "/" || src[i] === ">") break;
+      const aStart = i;
+      while (i < src.length && src[i] !== "=" && !/\s/.test(src[i]!)) i += 1;
+      const aName = src.slice(aStart, i);
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      if (src[i] !== "=") {
+        attrs[aName] = "";
+        continue;
+      }
+      i += 1;
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      const quote = src[i];
+      if (quote !== '"' && quote !== "'") {
+        throw new Error(`bw-xml: unquoted attr at ${i}`);
+      }
+      i += 1;
+      const vStart = i;
+      while (i < src.length && src[i] !== quote) i += 1;
+      attrs[aName] = xmlDecode(src.slice(vStart, i));
+      i += 1;
+    }
+
+    if (src[i] === "/") {
+      i += 1;
+      if (src[i] !== ">") throw new Error("bw-xml: bad self-close");
+      i += 1;
+      return { kind: "element", name, attributes: attrs, children: [] };
+    }
+    if (src[i] !== ">") throw new Error("bw-xml: expected >");
+    i += 1;
+
+    const children: BwNode[] = [];
+    while (i < src.length) {
+      if (src.startsWith("</", i)) {
+        i += 2;
+        const endStart = i;
+        while (i < src.length && src[i] !== ">") i += 1;
+        const endName = src.slice(endStart, i).trim();
+        if (endName !== name) {
+          throw new Error(
+            `bw-xml: mismatched close: opened <${name}> got </${endName}>`,
+          );
+        }
+        i += 1;
+        return { kind: "element", name, attributes: attrs, children };
+      }
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("bw-xml: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (src.startsWith("<![CDATA[", i)) {
+        const end = src.indexOf("]]>", i);
+        if (end < 0) throw new Error("bw-xml: unterminated CDATA");
+        children.push({ kind: "text", text: src.slice(i + 9, end) });
+        i = end + 3;
+        continue;
+      }
+      if (src[i] === "<") {
+        const child = readElement();
+        if (child) children.push(child);
+        continue;
+      }
+      const textStart = i;
+      while (i < src.length && src[i] !== "<") i += 1;
+      const raw = src.slice(textStart, i);
+      if (raw.length > 0) {
+        children.push({ kind: "text", text: xmlDecode(raw) });
+      }
+    }
+    throw new Error(`bw-xml: unterminated <${name}>`);
+  }
+}
+
+// ----- build helpers --------------------------------------------------------
+
+export function renderElement(
+  name: string,
+  attrs: Record<string, string | undefined>,
+  children: readonly string[] = [],
+): string {
+  const pairs: string[] = [];
+  for (const [k, v] of Object.entries(attrs)) {
+    if (v === undefined || v === "") continue;
+    pairs.push(`${k}="${xmlEncode(v)}"`);
+  }
+  const head = pairs.length ? `${name} ${pairs.join(" ")}` : name;
+  const body = children.filter((c) => c.length > 0).join("");
+  if (body.length === 0) return `<${head}/>`;
+  return `<${head}>${body}</${name}>`;
+}
+
+export function renderText(text: string): string {
+  return xmlEncode(text);
+}
+
+export function renderCdata(text: string): string {
+  const safe = text.replace(/\]\]>/g, "]]]]><![CDATA[>");
+  return `<![CDATA[${safe}]]>`;
+}
+
+// ----- element traversal helpers -------------------------------------------
+
+export function childrenOf(el: BwElement, localName: string): BwElement[] {
+  const out: BwElement[] = [];
+  for (const child of el.children) {
+    if (child.kind === "element" && stripNs(child.name) === localName) {
+      out.push(child);
+    }
+  }
+  return out;
+}
+
+export function firstChild(
+  el: BwElement,
+  localName: string,
+): BwElement | undefined {
+  for (const child of el.children) {
+    if (child.kind === "element" && stripNs(child.name) === localName) {
+      return child;
+    }
+  }
+  return undefined;
+}
+
+export function textOf(el: BwElement): string {
+  return el.children
+    .map((c) => (c.kind === "text" ? c.text : ""))
+    .join("");
+}
+
+export function stripNs(qname: string): string {
+  const colon = qname.indexOf(":");
+  return colon < 0 ? qname : qname.slice(colon + 1);
+}
+
+export function attrNumber(
+  value: string | undefined,
+): number | undefined {
+  if (value === undefined || value === "") return undefined;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : undefined;
+}
+
+// ----- encoding -------------------------------------------------------------
+
+export function xmlEncode(text: string): string {
+  return text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+export function xmlDecode(text: string): string {
+  return text
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&amp;/g, "&");
+}