@beyondwork/docx-react-component 1.0.96 → 1.0.98

package/src/io/ooxml/parse-shapes.ts

@@ -10,7 +10,11 @@
  * preserved in the canonical node's rawXml field for lossless round-trip export.
  */
 
-import type { BlockNode, ShapeContent } from "../../model/canonical-document.ts";
+import type {
+  BlockNode,
+  ShapeContent,
+  TextBoxBodyProperties,
+} from "../../model/canonical-document.ts";
 import { parseFill } from "./parse-fill.ts";
 import {
   type XmlElementNode,
@@ -32,6 +36,8 @@ export interface ParsedWpsShape {
   text?: string;
   /** Raw txbxContent XML for structured re-rendering. */
   txbxContentXml?: string;
+  /** Text-box body layout from wps:bodyPr / a:bodyPr. */
+  textBoxBody?: TextBoxBodyProperties;
   /**
    * Parsed block-level structure from `w:txbxContent`, populated when a
    * `blockParser` callback is supplied (coord-02 §14 / coord-11 §22 —
@@ -97,6 +103,7 @@ export function parseShapeXml(
   const txbx = findFirstChild(wsp, "txbx");
   const txbxContent = txbx ? findFirstDescendant(txbx, "txbxContent") : null;
   const text = txbxContent ? extractAllText(txbxContent).trim() || undefined : undefined;
+  const textBoxBody = readTextBoxBody(wsp);
 
   // WordArt detection: geometry preset names that start with "text"
   if (prst && /^text/i.test(prst)) {
@@ -145,6 +152,7 @@ export function parseShapeXml(
     type: "shape",
     ...(isTextBox ? { isTextBox: true } : {}),
     ...(text ? { text } : {}),
+    ...(textBoxBody ? { textBoxBody } : {}),
     ...(txbxContentXml ? { txbxContentXml } : {}),
     ...(txbxBlocks && txbxBlocks.length > 0 ? { txbxBlocks } : {}),
     ...(prst ? { geometry: prst } : {}),
@@ -254,12 +262,14 @@ export function parseShapeContent(
 
   const fill = spPr ? readFill(spPr) : undefined;
   const line = spPr ? readLine(spPr) : undefined;
+  const textBoxBody = readTextBoxBody(wsp);
 
   // Text-box content — preserve raw XML for serialization + recurse via the
   // optional blockParser callback (CO4 F3.3) to populate txbxBlocks.
   const txbx = findFirstChild(wsp, "txbx");
   const txbxContent = txbx ? findFirstDescendant(txbx, "txbxContent") : undefined;
   const txbxContentXml = txbxContent ? extractRawXml(txbxContent) : undefined;
+  const text = txbxContent ? extractAllText(txbxContent).trim() || undefined : undefined;
 
   let txbxBlocks: ReadonlyArray<BlockNode> | undefined;
   if (txbxContentXml && blockParser) {
@@ -286,14 +296,37 @@ export function parseShapeContent(
 
   const result: ShapeContent = { type: "shape", rawXml: drawingRawXml };
   if (geometry) result.geometry = geometry;
+  if (text) result.text = text;
   if (fill) result.fill = fill;
   if (line) result.line = line;
   if (isTextBox) result.isTextBox = true;
+  if (textBoxBody) result.textBoxBody = textBoxBody;
   if (txbxContentXml) result.txbxContentXml = txbxContentXml;
   if (txbxBlocks && txbxBlocks.length > 0) result.txbxBlocks = txbxBlocks;
   return result;
 }
 
+function readTextBoxBody(wsp: XmlElementNode): TextBoxBodyProperties | undefined {
+  const bodyPr = findFirstChild(wsp, "bodyPr");
+  if (!bodyPr) return undefined;
+
+  const result: TextBoxBodyProperties = {};
+  const anchor = bodyPr.attributes.anchor;
+  if (anchor === "t" || anchor === "ctr" || anchor === "b") {
+    result.anchor = anchor;
+  }
+  const left = readIntAttr(bodyPr, "lIns");
+  const top = readIntAttr(bodyPr, "tIns");
+  const right = readIntAttr(bodyPr, "rIns");
+  const bottom = readIntAttr(bodyPr, "bIns");
+  if (left !== undefined) result.insetLeftEmu = left;
+  if (top !== undefined) result.insetTopEmu = top;
+  if (right !== undefined) result.insetRightEmu = right;
+  if (bottom !== undefined) result.insetBottomEmu = bottom;
+
+  return Object.keys(result).length > 0 ? result : undefined;
+}
+
 // F3.4 + P5 — readFill delegates to the shared `parseFill` primitive covering
 // solid / none / gradient / pattern. Lane 5 chart-style cascade can consume
 // the same parser via `src/io/ooxml/parse-fill.ts`.
@@ -320,3 +353,10 @@ function readLine(
   }
   return Object.keys(result).length > 0 ? result : undefined;
 }
+
+function readIntAttr(node: XmlElementNode, attr: string): number | undefined {
+  const raw = node.attributes[attr];
+  if (raw === undefined) return undefined;
+  const parsed = parseInt(raw, 10);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}

package/src/io/ooxml/payload-signature.ts

@@ -49,6 +49,107 @@ export async function verifyWorkflowPayloadXml(
   return verifier.verify(bytes, sig);
 }
 
+/**
+ * Coord-06 cleanup §3 (2026-04-24) — sign the workflow payload XML and
+ * inject a `<bw:signature>` block into the payload root. The block is
+ * excluded from canonicalization before hashing (see
+ * `canonicalize-payload.ts::stripSignature`) so the signature is
+ * self-consistent: writer and reader both canonicalize-with-signature-
+ * stripped, so the same bytes hash.
+ *
+ * The injection happens inside the root `<bw:workflowPayload>` element,
+ * before the closing tag. Idempotent — re-signing on export re-injects
+ * a fresh signature block, stripping any prior one first.
+ */
+export async function signAndInjectWorkflowPayloadSignature(
+  xml: string,
+  signer: PayloadSigner,
+  now: string = new Date().toISOString(),
+): Promise<string> {
+  const withoutPriorSignature = stripSignatureBlockFromPayload(xml);
+  const signature = await signWorkflowPayloadXml(withoutPriorSignature, signer, now);
+  return injectSignatureBlock(withoutPriorSignature, signature);
+}
+
+/**
+ * Parse a `<bw:signature ...>base64...</bw:signature>` block out of a
+ * workflow payload XML string. Returns `null` when the payload is
+ * unsigned (no `<bw:signature>` found) or when the block is malformed
+ * (missing required attributes / unparseable). Malformed returns null
+ * rather than throwing — the caller flips the tamper-gate to
+ * `"unsigned"` on null and to `"tampered"` only when verification
+ * fails on a well-formed signature block.
+ */
+export function extractWorkflowPayloadSignature(
+  xml: string,
+): PayloadSignature | null {
+  // Match `<bw:signature ...>...</bw:signature>` or self-closing.
+  const re =
+    /<bw:signature\b([^>]*?)(?:\/>|>([\s\S]*?)<\/bw:signature>)/u;
+  const m = re.exec(xml);
+  if (!m) return null;
+  const attrs = parseAttributes(m[1] ?? "");
+  const body = (m[2] ?? "").trim();
+  const algorithm = attrs.algorithm;
+  const keyId = attrs.keyId;
+  const signedAt = attrs.signedAt;
+  const canonicalizationProfile = attrs.canonicalizationProfile;
+  if (!algorithm || !keyId || !signedAt || !canonicalizationProfile) return null;
+  if (algorithm !== "hmac-sha256" && algorithm !== "ed25519") return null;
+  if (canonicalizationProfile !== "bw-canon/1") return null;
+  if (!body) return null;
+  return {
+    algorithm,
+    keyId,
+    signedAt,
+    canonicalizationProfile,
+    value: body,
+  };
+}
+
+function stripSignatureBlockFromPayload(xml: string): string {
+  return xml.replace(
+    /<bw:signature\b[^>]*?(?:\/>|>[\s\S]*?<\/bw:signature>)\s*/u,
+    "",
+  );
+}
+
+function injectSignatureBlock(xml: string, sig: PayloadSignature): string {
+  const block =
+    `<bw:signature algorithm="${escapeAttr(sig.algorithm)}"` +
+    ` keyId="${escapeAttr(sig.keyId)}"` +
+    ` signedAt="${escapeAttr(sig.signedAt)}"` +
+    ` canonicalizationProfile="${escapeAttr(sig.canonicalizationProfile)}">` +
+    `${sig.value}</bw:signature>`;
+  // Inject just before the closing `</bw:workflowPayload>` tag so the
+  // block is a direct child of the root element. Falls back to a
+  // root-tag rewrite if the closing tag isn't the expected shape
+  // (e.g. the root is renamed in a future schema bump).
+  const closeRe = /<\/bw:workflowPayload>\s*$/u;
+  if (closeRe.test(xml)) {
+    return xml.replace(closeRe, `${block}</bw:workflowPayload>`);
+  }
+  return xml.replace(/<\/([^>]+)>\s*$/u, `${block}</$1>`);
+}
+
+function parseAttributes(source: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  const re = /([a-zA-Z_][\w:.-]*)\s*=\s*"([^"]*)"/gu;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(source)) !== null) {
+    out[m[1]] = m[2];
+  }
+  return out;
+}
+
+function escapeAttr(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
 // HMAC-SHA256 helpers ----------------------------------------------------
 
 /**

package/src/model/canonical-document.ts

@@ -1876,6 +1876,8 @@ export interface ShapeNode {
   text?: string;
   geometry?: string;
   isTextBox?: boolean;
+  /** Text box body layout from `wps:bodyPr` / `a:bodyPr`. */
+  textBoxBody?: TextBoxBodyProperties;
   /** Raw `<w:txbxContent>` XML, preserved for serialization + round-trip. */
   txbxContentXml?: string;
   /**
@@ -2001,6 +2003,8 @@ export interface PictureContent {
   packagePartName?: string;
   /** MIME resolved from the OPC media part, when known. */
   contentType?: string;
+  /** DrawingML a:lum brightness/contrast adjustments on the blip. Values are OOXML fixed percentages. */
+  lum?: { bright?: number; contrast?: number };
   srcRect?: { top: number; bottom: number; left: number; right: number };
   stretch?: boolean;
   /**
@@ -2032,6 +2036,8 @@ export interface PictureContent {
 
 export interface ShapeContent {
   type: "shape";
+  /** Plain-text fallback extracted from `w:txbxContent` when present. */
+  text?: string;
   geometry?: string;
   /**
    * Shape fill — solid, gradient, pattern, or none. srgbClr values on solid +
@@ -2061,6 +2067,8 @@ export interface ShapeContent {
   line?: { color?: string; widthEmu?: number; noLine?: boolean };
   /** True when the shape's geometry + txbxContent presence make it a text box. */
   isTextBox?: boolean;
+  /** Text box body layout from `wps:bodyPr` / `a:bodyPr`. */
+  textBoxBody?: TextBoxBodyProperties;
   /** Raw w:txbxContent XML, preserved for serialization + lossless round-trip. */
   txbxContentXml?: string;
   /**
@@ -2080,6 +2088,15 @@ export interface ShapeContent {
   rawXml: string;
 }
 
+export interface TextBoxBodyProperties {
+  /** OOXML bodyPr anchor: top, center, or bottom. */
+  anchor?: "t" | "ctr" | "b";
+  insetLeftEmu?: number;
+  insetTopEmu?: number;
+  insetRightEmu?: number;
+  insetBottomEmu?: number;
+}
+
 export interface DrawingFrameNode {
   type: "drawing_frame";
   anchor: AnchorGeometry;

package/src/runtime/layout/layout-engine-version.ts

@@ -1018,8 +1018,21 @@
  *   of reconstructing chapter-prefixed numbering in caller-local formulas.
  *   Cache envelopes from v59 invalidate because page graph line-box,
  *   fragment geometry, and page-numbering payloads changed.
+ *
+ *  61 — Page-story resolver + paginator refresh landed on react-refactor
+ *   alongside the floating-drawings-in-page-view fix (`70acfd9ae`). Both
+ *   `page-story-resolver.ts` and `paginated-layout-engine.ts` changed
+ *   without an upstream bump. Bump here so persisted cache envelopes
+ *   re-derive; no algorithm change beyond the floating-drawing clip
+ *   widening already covered by the resurrected tests.
+ *
+ *  62 — nested break detection inside wrapped surface blocks. Page and
+ *   column break detection now walks `sdt_block` children and table-cell
+ *   content instead of checking only top-level paragraphs. This honors
+ *   `<w:br w:type="page"/>` inside cover-page SDTs such as the CCEP SOW
+ *   template, changing page assignment from the v61 cache shape.
  */
-export const LAYOUT_ENGINE_VERSION = 60 as const;
+export const LAYOUT_ENGINE_VERSION = 62 as const;
 
 /**
  * Serialization schema version for the LayCache payload (the cache envelope

package/src/runtime/layout/page-story-resolver.ts

@@ -149,6 +149,7 @@ function resolveStoryVariant(
         sectionIndex: layout.sectionIndex,
       };
     }
+    return undefined;
   }
 
   // Even page variant when evenAndOddHeaders is active

package/src/runtime/layout/paginated-layout-engine.ts

@@ -2432,17 +2432,33 @@ function isOutOfFlowFrame(
 }
 
 function hasColumnBreak(block: SurfaceBlockSnapshot): boolean {
-  return block.kind === "paragraph" && block.segments.some(
-    (segment) =>
-      segment.kind === "opaque_inline" &&
-      segment.label === "Column break",
-  );
+  if (block.kind === "paragraph") {
+    return block.segments.some(
+      (segment) =>
+        segment.kind === "opaque_inline" &&
+        segment.label === "Column break",
+    );
+  }
+  return nestedBlocks(block).some(hasColumnBreak);
 }
 
 function hasPageBreak(block: SurfaceBlockSnapshot): boolean {
-  return block.kind === "paragraph" && block.segments.some(
-    (segment) =>
-      segment.kind === "opaque_inline" &&
-      segment.label === "Page break",
-  );
+  if (block.kind === "paragraph") {
+    return block.segments.some(
+      (segment) =>
+        segment.kind === "opaque_inline" &&
+        segment.label === "Page break",
+    );
+  }
+  return nestedBlocks(block).some(hasPageBreak);
+}
+
+function nestedBlocks(block: SurfaceBlockSnapshot): readonly SurfaceBlockSnapshot[] {
+  if (block.kind === "sdt_block") {
+    return block.children;
+  }
+  if (block.kind === "table") {
+    return block.rows.flatMap((row) => row.cells.flatMap((cell) => cell.content));
+  }
+  return [];
 }

package/src/runtime/surface-projection.ts

@@ -49,6 +49,34 @@ import {
   isBlockedImportFeatureKey,
 } from "../preservation/store.ts";
 import { getStoryBlocks } from "./story-targeting.ts";
+
+/**
+ * Refactor/11b Slice A — internal seam for the L1 PM Node identity cache.
+ *
+ * Surface-projection attaches a parallel `(BlockNode | null)[]` array
+ * alongside `EditorSurfaceSnapshot.blocks` via a globally-registered
+ * Symbol.  `pm-state-from-snapshot` reads it through an inline mirror of
+ * the same Symbol — `Symbol.for` guarantees both sides resolve to the
+ * same symbol even though they live in different layers and never
+ * import each other.  This avoids a cross-layer import that would blow
+ * the Layer 11 boundary register.
+ *
+ * The property is non-enumerable, so JSON.stringify and public
+ * consumers of `EditorSurfaceSnapshot` see no change in shape.
+ */
+const CANONICAL_BLOCK_REFS_SYMBOL = Symbol.for("wre.canonical-block-refs");
+
+function attachCanonicalBlockRefs(
+  snapshot: EditorSurfaceSnapshot,
+  refs: readonly (BlockNode | null)[],
+): void {
+  Object.defineProperty(snapshot, CANONICAL_BLOCK_REFS_SYMBOL, {
+    value: refs,
+    enumerable: false,
+    configurable: true,
+    writable: false,
+  });
+}
 import {
   collectSectionContexts,
   findHeaderFooterDocumentEntry,
@@ -182,6 +210,12 @@ export function createEditorSurfaceSnapshot(
     children: [...getStoryBlocks(document, activeStory)],
   });
   const blocks: SurfaceBlockSnapshot[] = [];
+  // Refactor/11b Slice A — canonical BlockNode ref parallel to `blocks`.
+  // Feeds the L1 identity cache in `pm-state-from-snapshot` so unchanged
+  // canonical blocks reuse their PM Node instance across commits, which
+  // lets PM's `node.eq()` short-circuit `ViewDesc.update()`. `null` for
+  // placeholder-culled blocks — those are synthetic, not canonical.
+  const blockRefs: (BlockNode | null)[] = [];
   const lockedFragmentIds: string[] = [];
   // L03 boundary: construct one formatting context per projection pass.
   // The context owns the theme resolver + numbering prefix counter +
@@ -251,6 +285,7 @@ export function createEditorSurfaceSnapshot(
 
     if (isInViewport) {
       blocks.push(surfaceBlock.block);
+      blockRefs.push(root.children[index]);
       lockedFragmentIds.push(...surfaceBlock.lockedFragmentIds);
     } else {
       // Replace with size-preserving placeholder. from/to track the SAME
@@ -270,6 +305,8 @@ export function createEditorSurfaceSnapshot(
         placeholderSize,
         state: "placeholder-culled",
       } as SurfaceBlockSnapshot);
+      // Placeholder has no canonical ref — L1 cache will skip it.
+      blockRefs.push(null);
       // Do NOT push lockedFragmentIds — placeholder has no real fragment.
     }
 
@@ -317,7 +354,7 @@ export function createEditorSurfaceSnapshot(
     }
   }
 
-  return {
+  const snapshot: EditorSurfaceSnapshot = {
     storySize: cursor,
     plainText: createPlainText(blocks),
     blocks,
@@ -325,6 +362,8 @@ export function createEditorSurfaceSnapshot(
     secondaryStories,
     viewportBlockRanges,
   };
+  attachCanonicalBlockRefs(snapshot, blockRefs);
+  return snapshot;
 }
 
 /**
@@ -1427,7 +1466,7 @@ function appendInlineSegments(
       return { nextCursor: start + 1, lockedFragmentIds: [node.fragmentId] };
     }
     case "chart_preview": {
-      const parsedChartId = registerParsedChartPreview(node);
+      const parsedChartId = registerParsedChartPreview(node, document);
       return appendComplexPreviewSegment(paragraph, node, start, "Embedded chart", createChartDetail(node), {
         previewMediaId: node.previewMediaId,
         parsedChartId,
@@ -1438,6 +1477,9 @@ function appendInlineSegments(
         previewMediaId: node.previewMediaId,
       });
     case "shape":
+      if (isMicrosoftSensitivityLabelShape(node)) {
+        return { nextCursor: start + 1, lockedFragmentIds: [] };
+      }
       if (promoteSecondaryStoryTextBoxes && node.isTextBox && node.text) {
         return appendTextBoxSegment(
           paragraph,
@@ -1452,6 +1494,9 @@ function appendInlineSegments(
     case "wordart":
       return appendComplexPreviewSegment(paragraph, node, start, "WordArt", createWordArtDetail(node));
     case "vml_shape":
+      if (isMicrosoftSensitivityLabelShape(node)) {
+        return { nextCursor: start + 1, lockedFragmentIds: [] };
+      }
       if (promoteSecondaryStoryTextBoxes && shouldRenderSecondaryStoryVmlTextBox(node)) {
         return appendTextBoxSegment(
           paragraph,
@@ -1487,7 +1532,8 @@ function appendInlineSegments(
         const label = c.isTextBox ? "Text box" : "Drawing shape";
         const detail = `DrawingFrame shape (${node.anchor.wrapMode}).`;
         const anchor = surfaceAnchorFromGeometry(node.anchor);
-        const txbxText = c.isTextBox ? extractTxbxFirstText(c.txbxBlocks) : undefined;
+        const txbxTextSegment = c.isTextBox ? extractTxbxFirstTextSegment(c.txbxBlocks) : undefined;
+        const txbxText = txbxTextSegment?.text ?? (c.isTextBox ? c.text : undefined);
         const surfaceFill = c.fill;
         paragraph.segments.push({
           segmentId: `${paragraph.blockId}-segment-${paragraph.segments.length}`,
@@ -1501,12 +1547,17 @@ function appendInlineSegments(
           ...(surfaceFill ? { fill: surfaceFill } : {}),
           ...(c.line ? { line: c.line } : {}),
           ...(c.isTextBox ? { isTextBox: true } : {}),
+          ...(c.textBoxBody ? { textBoxBody: c.textBoxBody } : {}),
           ...(txbxText ? { txbxText } : {}),
+          ...(txbxTextSegment?.marks && txbxTextSegment.marks.length > 0
+            ? { txbxMarks: txbxTextSegment.marks }
+            : {}),
+          ...(txbxTextSegment?.markAttrs ? { txbxMarkAttrs: txbxTextSegment.markAttrs } : {}),
         });
         return { nextCursor: start + 1, lockedFragmentIds: [] };
       }
       if (c.type === "chart_preview") {
-        const parsedChartId = registerParsedChartPreview(c);
+        const parsedChartId = registerParsedChartPreview(c, document);
         return appendComplexPreviewSegment(
           paragraph,
           c,
@@ -1752,7 +1803,10 @@ function appendInlineSegments(
   }
 }
 
-function registerParsedChartPreview(node: ChartPreviewNode): string | undefined {
+function registerParsedChartPreview(
+  node: ChartPreviewNode,
+  document: CanonicalDocumentEnvelope,
+): string | undefined {
   if (!node.parsedData) return undefined;
   const parsedChartId = stableChartId(node.rawXml);
   // Always call `set` (even when the entry exists) so the active
@@ -1763,7 +1817,7 @@ function registerParsedChartPreview(node: ChartPreviewNode): string | undefined
     model: node.parsedData,
     widthPx,
     heightPx,
-    theme: undefined,
+    theme: document.subParts?.resolvedTheme,
   });
   return parsedChartId;
 }
@@ -1898,6 +1952,7 @@ function surfacePictureEffectsFromContent(
   const outerShadow = resolveSurfacePictureShadow(content.outerShadow, themeResolver);
   const glow = resolveSurfacePictureGlow(content.glow, themeResolver);
   const has =
+    content.lum !== undefined ||
     content.srcRect !== undefined ||
     content.rotation !== undefined ||
     content.flipH !== undefined ||
@@ -1909,6 +1964,7 @@ function surfacePictureEffectsFromContent(
     glow !== undefined;
   if (!has) return undefined;
   return {
+    ...(content.lum ? { lum: { ...content.lum } } : {}),
     ...(content.srcRect ? { srcRect: { ...content.srcRect } } : {}),
     ...(content.rotation !== undefined ? { rotation: content.rotation } : {}),
     ...(content.flipH !== undefined ? { flipH: content.flipH } : {}),
@@ -2007,16 +2063,51 @@ function flattenSurfaceFieldDisplayText(
  * and read the immediate run content.  Returns `undefined` when no text
  * is present.
  */
-function extractTxbxFirstText(
+function extractTxbxFirstTextSegment(
   blocks: ShapeContent["txbxBlocks"],
-): string | undefined {
+): {
+  text: string;
+  marks?: SurfaceTextMark[];
+  markAttrs?: {
+    backgroundColor?: string;
+    charSpacing?: number;
+    kerning?: number;
+    textFill?: string;
+    fontFamily?: string;
+    fontSize?: number;
+    textColor?: string;
+  };
+} | undefined {
   if (!blocks || blocks.length === 0) return undefined;
   for (const block of blocks) {
     if (block.type !== "paragraph") continue;
-    const runs = (block as { runs?: ReadonlyArray<{ text?: string }> }).runs;
-    if (!runs) continue;
-    const text = runs.map((r) => r.text ?? "").join("").trim();
-    if (text) return text;
+    const children = (block as { children?: ReadonlyArray<{ type?: string; text?: string; marks?: TextMark[] }> }).children;
+    const legacyRuns = (block as { runs?: ReadonlyArray<{ text?: string; marks?: TextMark[] }> }).runs;
+    if (!children && !legacyRuns) continue;
+    let firstMarks: TextMark[] | undefined;
+    const text = (children
+      ? children
+          .map((child) => {
+            if (child.type !== "text") return "";
+            if (!firstMarks && child.marks) firstMarks = child.marks;
+            return child.text ?? "";
+          })
+          .join("")
+      : legacyRuns
+          ?.map((run) => {
+            if (!firstMarks && run.marks) firstMarks = run.marks;
+            return run.text ?? "";
+          })
+          .join("") ?? ""
+    ).trim();
+    if (text) {
+      const cloned = firstMarks ? cloneMarks(firstMarks) : undefined;
+      return {
+        text,
+        ...(cloned?.marks && cloned.marks.length > 0 ? { marks: cloned.marks } : {}),
+        ...(cloned?.markAttrs ? { markAttrs: cloned.markAttrs } : {}),
+      };
+    }
   }
   return undefined;
 }
@@ -2072,6 +2163,17 @@ function shouldRenderSecondaryStoryVmlTextBox(node: VmlShapeNode): boolean {
   return Boolean(node.text) && (!node.shapeType || /_x0000_t202$/iu.test(node.shapeType));
 }
 
+function isMicrosoftSensitivityLabelShape(
+  node: ShapeNode | VmlShapeNode,
+): boolean {
+  if (!/classification/i.test(node.text ?? "")) {
+    return false;
+  }
+  return /\b(?:id|name)="MSIPCM/iu.test(node.rawXml) ||
+    /\b(?:alt|descr)="[^"]*&quot;Placement&quot;:&quot;Footer&quot;/iu.test(node.rawXml) ||
+    /"Placement"\s*:\s*"Footer"/iu.test(node.rawXml);
+}
+
 function createChartDetail(node: ChartPreviewNode): string {
   const parts = ["Embedded chart."];
   if (node.previewMediaId) {

package/src/session/export/stateful-export-pipeline.ts

@@ -164,6 +164,17 @@ export function ensureHostMetadataParts(
   });
 }
 
+/**
+ * Return shape reports whether a payload part was written AND exposes
+ * the built XML + path so the export pipeline can post-process (e.g.
+ * coord-06 §3 sign-and-inject `<bw:signature>`). Returns `null` when
+ * no payload part was written (no runtime-owned content).
+ */
+export interface EnsureWorkflowPayloadPartsResult {
+  readonly payloadPartPath: string;
+  readonly payloadPartXml: string;
+}
+
 export function ensureWorkflowPayloadParts(
   exportSession: ExportSession,
   sessionState: EditorSessionState,
@@ -174,7 +185,7 @@ export function ensureWorkflowPayloadParts(
     itemPropsPartPath: string;
   },
   editorState?: EditorStatePayload,
-): void {
+): EnsureWorkflowPayloadPartsResult | null {
   const payloadParts = buildWorkflowPayloadParts({
     sourcePackage,
     workflowMetadata: sessionState.workflowMetadata,
@@ -188,7 +199,7 @@ export function ensureWorkflowPayloadParts(
     producerVersion: sessionState.editorBuild,
   });
   if (!payloadParts) {
-    return;
+    return null;
   }
   if (
     payloadParts.payloadPartPath !== resolvedPartPaths.payloadPartPath ||
@@ -228,6 +239,11 @@ export function ensureWorkflowPayloadParts(
     target: WORKFLOW_PAYLOAD_CUSTOM_PROPS_PART_PATH,
     preferredId: "rIdBwWorkflowCustomProps",
   });
+
+  return {
+    payloadPartPath: payloadParts.payloadPartPath,
+    payloadPartXml: payloadParts.payloadPartXml,
+  };
 }
 
 export function hasHostSafeMetadataPackageStructure(sourcePackage: OpcPackage): boolean {

package/src/session/export/stateful-export.ts

@@ -93,6 +93,7 @@ import {
   ensureWorkflowPayloadParts,
   serializeProtectionRangesIntoDocumentXml,
 } from "./stateful-export-pipeline.ts";
+import { signAndInjectWorkflowPayloadSignature } from "../../io/ooxml/payload-signature.ts";
 import {
   assertExportNotBlockedByCompatibility,
   assertNoBlockingPreservedComments,
@@ -612,7 +613,7 @@ export async function runStatefulExport(
 
   // Schema 1.2: pass through editorState payload collected by the
   // runtime channel, with any offload entries folded in above.
-  ensureWorkflowPayloadParts(
+  const payloadResult = ensureWorkflowPayloadParts(
     exportSession,
     sessionState,
     currentDocument,
@@ -621,6 +622,25 @@ export async function runStatefulExport(
     editorStateWithEmbeddings,
   );
 
+  // coord-06 cleanup §3 — if the host supplied a PayloadSigner, sign
+  // the built payload XML and rewrite the customXml/item1.xml part with
+  // a `<bw:signature>` block injected inside the root element. The
+  // canonicalization pass strips the block before hashing so signer
+  // and verifier agree; see `src/io/ooxml/canonicalize-payload.ts`.
+  if (options?.signer && payloadResult) {
+    const signedXml = await signAndInjectWorkflowPayloadSignature(
+      payloadResult.payloadPartXml,
+      options.signer,
+    );
+    const payloadPart = state.sourcePackage.parts.get(payloadResult.payloadPartPath);
+    exportSession.replaceOwnedPart({
+      path: payloadResult.payloadPartPath,
+      bytes: new TextEncoder().encode(signedXml),
+      contentType: payloadPart?.contentType ?? "application/xml",
+      compression: payloadPart?.compression,
+    });
+  }
+
   return {
     bytes: exportSession.serialize(),
     mimeType: DOCX_MIME_TYPE,