@doccloak/core 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to `@doccloak/core` are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 project follows [Semantic Versioning](https://semver.org/).
 
+## [0.10.0] - 2026-09-23
+
+### Added
+
+- **GLiNER PII Base provider (T122):** new `gliner-base` provider for
+  `knowledgator/gliner-pii-base-v1.0` (~197 MB quint8, Apache-2.0,
+  pinned revision + SHA-256). Span-level (`markerV0`) decoding with
+  zero-shot custom labels; strongest option for English and dates.
+  Exported as `GlinerBaseProvider` plus `GLINER_BASE_MODEL_URL` /
+  `_REVISION` / `_SHA256`, `buildSpanIndices` and `decodeSpanLogits`.
+  `ProviderId` now includes `'gliner-base'` and `createEngine` registers it.
+
+- **Office file redaction (T110):** `@doccloak/core/dom` gains
+  `readXlsx` / `writeAnonymizedXlsx` / `isExcelFile` and a
+  detection-driven `redactOfficeFile` / `analyzeOfficeFile` flow for
+  .docx and .xlsx that keeps placeholders consistent with a live
+  `AnonymizationSession`. `writeAnonymizedDocx` accepts an option to
+  accept tracked changes (deletions dropped, insertions unwrapped,
+  author/date change records removed). Defaults preserve the previous
+  output byte-for-byte.
+
+### Changed
+
+- **Light model swapped (T121):** the `gliner` provider now loads
+  `knowledgator/gliner-pii-small-v1.0` (~83 MB, same tokenizer family)
+  instead of `gliner-pii-edge-v1.0`. Cached copies of the old edge model
+  are evicted best-effort on load. Labels read "GLiNER PII Small".
+
+- **Provider descriptions (T127):** registry copy reflects the 2026-08
+  14-language benchmark. `pickDefaultProvider` is unchanged: `bardsai` on
+  capable devices, `gliner` on mobile / low-memory devices.
+
+- **ONNX Runtime 1.29.0:** providers import `onnxruntime-web/webgpu`
+  (native WebGPU EP with wasm fallback). Hosts that self-host the ORT
+  runtime files must now serve `ort-wasm-simd-threaded.asyncify.wasm`
+  and `.asyncify.mjs` instead of the plain / `.jsep` pair.
+
+### Fixed
+
+- **bardsai with transformers.js 4.x:** subtoken alignment no longer calls
+  the removed `tokenizer.model.convert_ids_to_tokens` (which made
+  detection throw on transformers.js 4); it uses `tokenizer.tokenize()`.
+
 ## [0.9.0] - 2026-08-21
 
 ### Added

package/dist/dom/docx.d.ts

@@ -13,8 +13,10 @@ export { normalizeReplacements };
 export type { ValueReplacement };
 /**
  * Represents a text node in the docx XML with its position in the flat text.
+ * Also reused by the xlsx module (T110): the same flat-text replacement
+ * machinery applies to any XML part whose text lives in leaf elements.
  */
-interface TextNodeMapping {
+export interface TextNodeMapping {
     /** The <w:t> element */
     element: Element;
     /** Start index in the flat text */
@@ -59,6 +61,31 @@ interface ContentPartExtraction {
  * Read a .docx file and extract its text content with position mapping.
  */
 export declare function readDocx(file: File): Promise<DocxExtraction>;
+/**
+ * Options for writeAnonymizedDocx (T110). All default to off, preserving the
+ * historical output byte-for-byte for existing callers.
+ */
+export interface DocxWriteOptions {
+    /**
+     * Accept and remove tracked changes: deletions (w:del and friends) are
+     * dropped, insertions (w:ins, w:moveTo) are unwrapped into plain runs, and
+     * property-change records (w:rPrChange etc., which carry author and date
+     * fingerprints) are removed. Oregon SB 2025-205 flags revision metadata as
+     * identifying, so the file-redaction flow turns this on.
+     */
+    acceptTrackedChanges?: boolean;
+}
+/**
+ * Apply a list of flat-text replacements to mapped text nodes, handling
+ * replacements that span multiple elements. Ranges are normalized (sorted,
+ * overlaps clamped) and applied end-to-start so earlier positions stay valid.
+ * Shared by the docx and xlsx writers (T110).
+ */
+export declare function applyTextReplacements(textNodes: TextNodeMapping[], replacements: Array<{
+    start: number;
+    end: number;
+    replacement: string;
+}>): void;
 /**
  * Apply text replacements to the docx XML, preserving all formatting.
  * Takes the original extraction and a list of replacements (sorted by position),
@@ -71,7 +98,7 @@ export declare function writeAnonymizedDocx(extraction: DocxExtraction, replacem
     start: number;
     end: number;
     replacement: string;
-}>, valueReplacements?: ValueReplacement[]): Promise<Blob>;
+}>, valueReplacements?: ValueReplacement[], options?: DocxWriteOptions): Promise<Blob>;
 /**
  * Get the file extension from a filename.
  */

package/dist/dom/docx.js

@@ -153,6 +153,63 @@ export async function readDocx(file) {
         contentParts,
     };
 }
+/**
+ * Apply a list of flat-text replacements to mapped text nodes, handling
+ * replacements that span multiple elements. Ranges are normalized (sorted,
+ * overlaps clamped) and applied end-to-start so earlier positions stay valid.
+ * Shared by the docx and xlsx writers (T110).
+ */
+export function applyTextReplacements(textNodes, replacements) {
+    const sorted = normalizeReplacements(replacements);
+    for (const repl of [...sorted].reverse()) {
+        applyReplacement(textNodes, repl.start, repl.end, repl.replacement);
+    }
+}
+/**
+ * Tracked-change elements that are removed outright when accepting changes:
+ * deleted content, move sources, and every *PrChange record (each carries a
+ * w:author/w:date pair identifying the reviser).
+ */
+const TRACKED_REMOVE = new Set([
+    'del', 'moveFrom', 'delText', 'delInstrText',
+    'rPrChange', 'pPrChange', 'sectPrChange', 'tblPrChange', 'tblGridChange',
+    'tcPrChange', 'trPrChange', 'numberingChange',
+    'cellDel', 'cellIns', 'cellMerge',
+    'moveFromRangeStart', 'moveFromRangeEnd', 'moveToRangeStart', 'moveToRangeEnd',
+    'customXmlDelRangeStart', 'customXmlDelRangeEnd',
+    'customXmlInsRangeStart', 'customXmlInsRangeEnd',
+    'customXmlMoveFromRangeStart', 'customXmlMoveFromRangeEnd',
+    'customXmlMoveToRangeStart', 'customXmlMoveToRangeEnd',
+]);
+/** Tracked-change wrappers whose content is kept: the wrapper is unwrapped. */
+const TRACKED_UNWRAP = new Set(['ins', 'moveTo']);
+/**
+ * Accept all tracked changes in one content part: remove deletions and
+ * change records, unwrap insertions. Operates on the live DOM after text
+ * replacements have been applied, so redaction offsets are unaffected.
+ */
+function acceptTrackedChangesInPart(xmlDoc) {
+    // Snapshot first: live HTMLCollections reorder while elements are removed.
+    const all = xmlDoc.getElementsByTagName('*');
+    const snapshot = [];
+    for (let i = 0; i < all.length; i++)
+        snapshot.push(all[i]);
+    for (const el of snapshot) {
+        if (el.namespaceURI !== W_NS)
+            continue;
+        if (TRACKED_REMOVE.has(el.localName)) {
+            el.parentNode?.removeChild(el);
+        }
+        else if (TRACKED_UNWRAP.has(el.localName)) {
+            const parent = el.parentNode;
+            if (!parent)
+                continue;
+            while (el.firstChild)
+                parent.insertBefore(el.firstChild, el);
+            parent.removeChild(el);
+        }
+    }
+}
 /**
  * Apply text replacements to the docx XML, preserving all formatting.
  * Takes the original extraction and a list of replacements (sorted by position),
@@ -161,20 +218,17 @@ export async function readDocx(file) {
  *
  * Returns a new .docx file as a Blob.
  */
-export async function writeAnonymizedDocx(extraction, replacements, valueReplacements = []) {
-    const sorted = normalizeReplacements(replacements);
-    // For each text node, compute what its new text should be
-    // We need to handle replacements that may span multiple <w:t> elements
-    // Build a map of flat-text ranges that need replacement
-    // Process from end to start to preserve positions
-    const reverseSorted = [...sorted].reverse();
-    for (const repl of reverseSorted) {
-        applyReplacement(extraction.textNodes, repl.start, repl.end, repl.replacement);
-    }
+export async function writeAnonymizedDocx(extraction, replacements, valueReplacements = [], options = {}) {
+    // Apply flat-text replacements to the mapped text nodes (spanning runs when
+    // needed), from end to start so positions stay valid.
+    applyTextReplacements(extraction.textNodes, replacements);
     // Serialize all modified XML documents back to the zip
     const serializer = new XMLSerializer();
     for (const part of extraction.contentParts) {
         sanitizeContentPartAttributes(part.xmlDoc, valueReplacements);
+        if (options.acceptTrackedChanges) {
+            acceptTrackedChangesInPart(part.xmlDoc);
+        }
         const xmlStr = serializer.serializeToString(part.xmlDoc);
         extraction.zip.file(part.path, xmlStr);
     }

package/dist/dom/index.d.ts

@@ -9,3 +9,5 @@
  */
 export * from './docx.js';
 export * from './ocr.js';
+export * from './xlsx.js';
+export * from './office.js';

package/dist/dom/index.js

@@ -9,3 +9,6 @@
  */
 export * from "./docx.js";
 export * from "./ocr.js";
+// T110: xlsx + detection-driven office file redaction
+export * from "./xlsx.js";
+export * from "./office.js";

package/dist/dom/office.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @doccloak/core/dom - detection-driven office file redaction (T110).
+ *
+ * Ties the format modules (docx.ts, xlsx.ts) to the detection pipeline and an
+ * AnonymizationSession, so a host can hand over a File plus its live session
+ * and get back a redacted copy whose placeholders are consistent with every
+ * prompt redacted in the same session: an AI reply that mentions the file's
+ * placeholders restores through the same session map.
+ *
+ * PDF is intentionally NOT handled here: layout-preserving PDF redaction is
+ * out of scope for this module.
+ */
+import type { DetectedEntity } from '../types.js';
+import type { AnonymizationSession } from '../session.js';
+/** File kinds the office redaction flow can regenerate. */
+export type OfficeFileKind = 'docx' | 'xlsx';
+/**
+ * Classify a filename into a supported office kind, or null when the format
+ * cannot be regenerated by this module (.doc has its own binary writer in
+ * src/doc.ts; PDF output is permanently out of scope for browser hosts).
+ */
+export declare function officeFileKind(filename: string): OfficeFileKind | null;
+/** A detect function, typically DocCloakEngine.detect or detectEntities. */
+export type DetectFn = (text: string) => Promise<DetectedEntity[]>;
+export interface OfficeAnalysis {
+    kind: OfficeFileKind;
+    /** Flat text extracted from every text-bearing part of the package */
+    plainText: string;
+    /** Entities detected in the flat text (offsets refer to plainText) */
+    entities: DetectedEntity[];
+}
+/**
+ * Extract a file's text and run detection WITHOUT touching the session. Hosts
+ * use this to show the user what was found before asking for consent to
+ * regenerate; a cancelled upload then leaves no trace in the session map.
+ * Extraction is deterministic, so entities returned here can be passed to
+ * redactOfficeFile later and land on identical offsets.
+ */
+export declare function analyzeOfficeFile(file: File, detect: DetectFn): Promise<OfficeAnalysis>;
+export interface RedactOfficeFileOptions {
+    /** The live session; file placeholders join the same map as prompt ones. */
+    session: AnonymizationSession;
+    /**
+     * Entities to redact, from a prior analyzeOfficeFile call (offsets refer to
+     * that call's plainText). When omitted, detect is required and is run here.
+     */
+    entities?: DetectedEntity[];
+    /** Detect function; used only when entities were not supplied. */
+    detect?: DetectFn;
+    /** Accept and strip tracked changes in docx output. Default: true. */
+    acceptTrackedChanges?: boolean;
+}
+export interface OfficeRedactionResult {
+    kind: OfficeFileKind;
+    /** The redacted file; the input file/buffer is never modified. */
+    blob: Blob;
+    /** Suggested output name: "report.docx" becomes "report.redacted.docx". */
+    suggestedName: string;
+    /** The entities that were redacted (offsets refer to plainText) */
+    entities: DetectedEntity[];
+    /** Flat text the detection ran on */
+    plainText: string;
+    /** The redacted flat text (placeholders applied), for preview UIs */
+    redactedText: string;
+}
+/** "report.docx" -> "report.redacted.docx"; extensionless names get a suffix. */
+export declare function redactedFileName(filename: string): string;
+/**
+ * Redact a DOCX or XLSX file: extract text, detect (or reuse supplied
+ * entities), map every entity through the session, and regenerate the file
+ * with placeholders spliced into the XML, formatting preserved and metadata
+ * stripped. Placeholder issuing goes through session.anonymize, so a value
+ * already seen in a prompt reuses its existing placeholder and vice versa.
+ */
+export declare function redactOfficeFile(file: File, options: RedactOfficeFileOptions): Promise<OfficeRedactionResult>;

package/dist/dom/office.js

@@ -0,0 +1,116 @@
+/**
+ * @doccloak/core/dom - detection-driven office file redaction (T110).
+ *
+ * Ties the format modules (docx.ts, xlsx.ts) to the detection pipeline and an
+ * AnonymizationSession, so a host can hand over a File plus its live session
+ * and get back a redacted copy whose placeholders are consistent with every
+ * prompt redacted in the same session: an AI reply that mentions the file's
+ * placeholders restores through the same session map.
+ *
+ * PDF is intentionally NOT handled here: layout-preserving PDF redaction is
+ * out of scope for this module.
+ */
+import { getFileExtension, readDocx, writeAnonymizedDocx } from "./docx.js";
+import { readXlsx, writeAnonymizedXlsx } from "./xlsx.js";
+/**
+ * Classify a filename into a supported office kind, or null when the format
+ * cannot be regenerated by this module (.doc has its own binary writer in
+ * src/doc.ts; PDF output is permanently out of scope for browser hosts).
+ */
+export function officeFileKind(filename) {
+    const ext = getFileExtension(filename);
+    if (ext === 'docx')
+        return 'docx';
+    if (ext === 'xlsx')
+        return 'xlsx';
+    return null;
+}
+/**
+ * Extract a file's text and run detection WITHOUT touching the session. Hosts
+ * use this to show the user what was found before asking for consent to
+ * regenerate; a cancelled upload then leaves no trace in the session map.
+ * Extraction is deterministic, so entities returned here can be passed to
+ * redactOfficeFile later and land on identical offsets.
+ */
+export async function analyzeOfficeFile(file, detect) {
+    const kind = officeFileKind(file.name);
+    if (!kind)
+        throw new Error(`Unsupported office file: ${file.name}`);
+    const plainText = kind === 'docx'
+        ? (await readDocx(file)).plainText
+        : (await readXlsx(file)).plainText;
+    const entities = await detect(plainText);
+    return { kind, plainText, entities };
+}
+/** "report.docx" -> "report.redacted.docx"; extensionless names get a suffix. */
+export function redactedFileName(filename) {
+    const dot = filename.lastIndexOf('.');
+    if (dot <= 0)
+        return `${filename}.redacted`;
+    return `${filename.slice(0, dot)}.redacted${filename.slice(dot)}`;
+}
+/**
+ * Redact a DOCX or XLSX file: extract text, detect (or reuse supplied
+ * entities), map every entity through the session, and regenerate the file
+ * with placeholders spliced into the XML, formatting preserved and metadata
+ * stripped. Placeholder issuing goes through session.anonymize, so a value
+ * already seen in a prompt reuses its existing placeholder and vice versa.
+ */
+export async function redactOfficeFile(file, options) {
+    const kind = officeFileKind(file.name);
+    if (!kind)
+        throw new Error(`Unsupported office file: ${file.name}`);
+    const extraction = kind === 'docx' ? await readDocx(file) : await readXlsx(file);
+    const plainText = extraction.plainText;
+    let entities = options.entities;
+    if (!entities) {
+        if (!options.detect) {
+            throw new Error('redactOfficeFile requires either entities or a detect function');
+        }
+        entities = await options.detect(plainText);
+    }
+    const { session } = options;
+    // Drop entities whose offsets do not match this extraction (defensive: a
+    // stale analysis of a different file must not splice garbage), then map
+    // through the session in reading order. Surrogate mode maps PERSON values
+    // first, mirroring AnonymizationSession.anonymizeText, so derived
+    // surrogates (emails from owner names) stay consistent with prompts.
+    const valid = entities
+        .filter((e) => e.start >= 0 && e.end <= plainText.length && e.start < e.end
+        && plainText.slice(e.start, e.end) === e.value)
+        .sort((a, b) => a.start - b.start || a.end - b.end);
+    if (session.getMode() === 'surrogate') {
+        for (const entity of valid) {
+            if (entity.type === 'PERSON')
+                session.anonymize(entity.value, entity.type);
+        }
+    }
+    const replacements = valid.map((entity) => ({
+        start: entity.start,
+        end: entity.end,
+        replacement: session.anonymize(entity.value, entity.type),
+    }));
+    // Value-level scrubbing (relationship targets, formulas, field instructions)
+    // uses the whole session map, so a value redacted in an earlier prompt is
+    // also caught when it hides in a hyperlink target of this file.
+    const valueReplacements = session.getEntries()
+        .filter((entry) => entry.replacement !== '________')
+        .map((entry) => ({ value: entry.original, replacement: entry.replacement }));
+    let redactedText = plainText;
+    for (const repl of [...replacements].sort((a, b) => b.start - a.start)) {
+        redactedText = redactedText.slice(0, repl.start) + repl.replacement + redactedText.slice(repl.end);
+    }
+    const blob = kind === 'docx'
+        ? await writeAnonymizedDocx(extraction, replacements, valueReplacements, {
+            acceptTrackedChanges: options.acceptTrackedChanges ?? true,
+        })
+        : await writeAnonymizedXlsx(extraction, replacements, valueReplacements);
+    return {
+        kind,
+        blob,
+        suggestedName: redactedFileName(file.name),
+        entities: valid,
+        plainText,
+        redactedText,
+    };
+}

package/dist/dom/opc.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @doccloak/core/dom - shared OPC (Open Packaging Conventions) helpers (T110).
+ *
+ * Both .docx and .xlsx are OPC packages: a zip with XML parts, docProps
+ * metadata, relationship files and an optional thumbnail. The metadata
+ * scrubbing that is format-independent lives here so the xlsx module does not
+ * duplicate the docx module's logic. The docx module keeps its historical
+ * implementation untouched (behavior-preservation for existing callers); new
+ * code paths use these helpers.
+ */
+import type JSZip from 'jszip';
+import type { ValueReplacement } from '../docx.js';
+/** Parse one XML part from the zip; null when absent or malformed. */
+export declare function readXmlPart(zip: JSZip, path: string): Promise<Document | null>;
+/** Serialize an XML document back into the zip at the given path. */
+export declare function writeXmlPart(zip: JSZip, path: string, doc: Document): void;
+/** Blank the text content of every element whose local name is in the set. */
+export declare function blankElementsByLocalName(doc: Document, names: Set<string>): void;
+/**
+ * Replace every occurrence of each sensitive value (case-insensitive) in a
+ * string. A replacer function keeps '$' sequences in values/placeholders inert.
+ */
+export declare function replaceSensitiveValues(input: string, valueReplacements: ValueReplacement[], urlEncode: boolean): string;
+/**
+ * Scrub the shared docProps parts:
+ * - core.xml: author identities and content-describing fields
+ * - app.xml: organization and template/path hints
+ * - custom.xml: every leaf value (property names/structure kept)
+ */
+export declare function scrubDocPropsParts(zip: JSZip): Promise<void>;
+/**
+ * Remove the package thumbnail (a rendered image of page/sheet one leaks
+ * content wholesale) together with its package relationship and content-type
+ * override.
+ */
+export declare function removePackageThumbnail(zip: JSZip): Promise<void>;
+/**
+ * Scrub external relationship targets (mailto:/https: hyperlinks keep the raw
+ * sensitive value even when the display text was redacted) in every .rels file
+ * matched by the given pattern.
+ */
+export declare function scrubExternalRelTargets(zip: JSZip, relsPattern: RegExp, valueReplacements: ValueReplacement[]): Promise<void>;

package/dist/dom/opc.js

@@ -0,0 +1,146 @@
+/**
+ * @doccloak/core/dom - shared OPC (Open Packaging Conventions) helpers (T110).
+ *
+ * Both .docx and .xlsx are OPC packages: a zip with XML parts, docProps
+ * metadata, relationship files and an optional thumbnail. The metadata
+ * scrubbing that is format-independent lives here so the xlsx module does not
+ * duplicate the docx module's logic. The docx module keeps its historical
+ * implementation untouched (behavior-preservation for existing callers); new
+ * code paths use these helpers.
+ */
+/** Parse one XML part from the zip; null when absent or malformed. */
+export async function readXmlPart(zip, path) {
+    const file = zip.file(path);
+    if (!file)
+        return null;
+    const xmlStr = await file.async('string');
+    const doc = new DOMParser().parseFromString(xmlStr, 'application/xml');
+    if (doc.getElementsByTagName('parsererror').length > 0)
+        return null;
+    return doc;
+}
+/** Serialize an XML document back into the zip at the given path. */
+export function writeXmlPart(zip, path, doc) {
+    zip.file(path, new XMLSerializer().serializeToString(doc));
+}
+/** Blank the text content of every element whose local name is in the set. */
+export function blankElementsByLocalName(doc, names) {
+    const all = doc.getElementsByTagName('*');
+    for (let i = 0; i < all.length; i++) {
+        if (names.has(all[i].localName))
+            all[i].textContent = '';
+    }
+}
+/**
+ * Replace every occurrence of each sensitive value (case-insensitive) in a
+ * string. A replacer function keeps '$' sequences in values/placeholders inert.
+ */
+export function replaceSensitiveValues(input, valueReplacements, urlEncode) {
+    let result = input;
+    for (const { value, replacement } of valueReplacements) {
+        if (!value)
+            continue;
+        const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const substitute = urlEncode ? encodeURIComponent(replacement) : replacement;
+        result = result.replace(new RegExp(escaped, 'gi'), () => substitute);
+    }
+    return result;
+}
+/**
+ * Scrub the shared docProps parts:
+ * - core.xml: author identities and content-describing fields
+ * - app.xml: organization and template/path hints
+ * - custom.xml: every leaf value (property names/structure kept)
+ */
+export async function scrubDocPropsParts(zip) {
+    const core = await readXmlPart(zip, 'docProps/core.xml');
+    if (core) {
+        blankElementsByLocalName(core, new Set([
+            'creator', 'lastModifiedBy', 'title', 'subject', 'description', 'keywords', 'category',
+        ]));
+        writeXmlPart(zip, 'docProps/core.xml', core);
+    }
+    const app = await readXmlPart(zip, 'docProps/app.xml');
+    if (app) {
+        blankElementsByLocalName(app, new Set(['Company', 'Manager', 'HyperlinkBase', 'Template']));
+        writeXmlPart(zip, 'docProps/app.xml', app);
+    }
+    const custom = await readXmlPart(zip, 'docProps/custom.xml');
+    if (custom) {
+        const props = custom.getElementsByTagName('*');
+        for (let i = 0; i < props.length; i++) {
+            const el = props[i];
+            if (el.localName !== 'property' && el.childElementCount === 0 && (el.textContent ?? '') !== '') {
+                el.textContent = '';
+            }
+        }
+        writeXmlPart(zip, 'docProps/custom.xml', custom);
+    }
+}
+/**
+ * Remove the package thumbnail (a rendered image of page/sheet one leaks
+ * content wholesale) together with its package relationship and content-type
+ * override.
+ */
+export async function removePackageThumbnail(zip) {
+    const thumbnailPaths = [];
+    zip.forEach((relativePath) => {
+        if (/^docProps\/thumbnail\.[a-z]+$/i.test(relativePath)) {
+            thumbnailPaths.push(relativePath);
+        }
+    });
+    if (thumbnailPaths.length === 0)
+        return;
+    for (const path of thumbnailPaths)
+        zip.remove(path);
+    const rootRels = await readXmlPart(zip, '_rels/.rels');
+    if (rootRels) {
+        const relationships = rootRels.getElementsByTagName('Relationship');
+        for (let i = relationships.length - 1; i >= 0; i--) {
+            const type = relationships[i].getAttribute('Type') ?? '';
+            if (type.endsWith('/thumbnail')) {
+                relationships[i].parentNode?.removeChild(relationships[i]);
+            }
+        }
+        writeXmlPart(zip, '_rels/.rels', rootRels);
+    }
+    const contentTypes = await readXmlPart(zip, '[Content_Types].xml');
+    if (contentTypes) {
+        const overrides = contentTypes.getElementsByTagName('Override');
+        for (let i = overrides.length - 1; i >= 0; i--) {
+            const partName = overrides[i].getAttribute('PartName') ?? '';
+            if (thumbnailPaths.some((p) => partName === '/' + p)) {
+                overrides[i].parentNode?.removeChild(overrides[i]);
+            }
+        }
+        writeXmlPart(zip, '[Content_Types].xml', contentTypes);
+    }
+}
+/**
+ * Scrub external relationship targets (mailto:/https: hyperlinks keep the raw
+ * sensitive value even when the display text was redacted) in every .rels file
+ * matched by the given pattern.
+ */
+export async function scrubExternalRelTargets(zip, relsPattern, valueReplacements) {
+    const relsPaths = [];
+    zip.forEach((relativePath) => {
+        if (relsPattern.test(relativePath))
+            relsPaths.push(relativePath);
+    });
+    for (const relsPath of relsPaths.sort()) {
+        const rels = await readXmlPart(zip, relsPath);
+        if (!rels)
+            continue;
+        const relationships = rels.getElementsByTagName('Relationship');
+        for (let i = relationships.length - 1; i >= 0; i--) {
+            const rel = relationships[i];
+            if (rel.getAttribute('TargetMode') === 'External') {
+                const target = rel.getAttribute('Target') ?? '';
+                const scrubbed = replaceSensitiveValues(target, valueReplacements, true);
+                if (scrubbed !== target)
+                    rel.setAttribute('Target', scrubbed);
+            }
+        }
+        writeXmlPart(zip, relsPath, rels);
+    }
+}

package/dist/dom/xlsx.d.ts

@@ -0,0 +1,64 @@
+/**
+ * @doccloak/core/dom - xlsx read/write (T110, file redaction phase 1).
+ *
+ * Minimal zip+XML implementation on the package's existing JSZip + DOMParser
+ * machinery (the same stack the docx module uses). SheetJS was considered and
+ * rejected at claim time: the community edition is Apache-2.0 but is a heavy
+ * dependency distributed outside npm since 0.18.x (vendor CDN), and DocCloak
+ * only needs string-cell rewriting, not formula evaluation or format
+ * conversion. The zip+XML path keeps the dependency surface unchanged.
+ *
+ * Text-bearing locations covered:
+ * - xl/sharedStrings.xml <si> entries (plain and rich-text runs, phonetic runs)
+ * - worksheet inline strings (<c t="inlineStr"><is>...)
+ * - worksheet cached formula string results (<c t="str"><v>)
+ * - worksheet header/footer definitions
+ * - legacy cell comments (xl/comments*.xml) and threaded comments
+ *
+ * Deliberately out of scope in phase 1 (documented for T-later): drawing/chart
+ * text parts (xl/drawings, xl/charts), data connection definitions
+ * (xl/connections.xml) and defined-name formulas. Metadata scrubbing follows
+ * the docx module's policy via the shared OPC helpers.
+ */
+import JSZip from 'jszip';
+import type { ValueReplacement } from '../docx.js';
+import type { TextNodeMapping } from './docx.js';
+interface XlsxContentPart {
+    path: string;
+    xmlDoc: Document;
+    textNodes: TextNodeMapping[];
+}
+/**
+ * Result of extracting text from an xlsx file. Mirrors DocxExtraction: a flat
+ * plain text plus a mapping from flat positions back to XML text elements, so
+ * detection offsets can be applied surgically without touching formatting.
+ */
+export interface XlsxExtraction {
+    /** Flat plain text: one line per string unit (shared string, cell, comment) */
+    plainText: string;
+    /** The JSZip instance for re-packaging */
+    zip: JSZip;
+    /** All text-bearing parts with their per-part node mappings */
+    contentParts: XlsxContentPart[];
+    /** All text node mappings across parts, in flat-text order */
+    textNodes: TextNodeMapping[];
+}
+/**
+ * Read a .xlsx file and extract its text content with position mapping.
+ */
+export declare function readXlsx(file: File): Promise<XlsxExtraction>;
+/**
+ * Apply text replacements to the xlsx XML, preserving formatting, then scrub
+ * metadata. Returns a new .xlsx file as a Blob; the input file is untouched.
+ */
+export declare function writeAnonymizedXlsx(extraction: XlsxExtraction, replacements: Array<{
+    start: number;
+    end: number;
+    replacement: string;
+}>, valueReplacements?: ValueReplacement[]): Promise<Blob>;
+/**
+ * Check if a file is a supported Excel workbook (.xlsx only; the legacy
+ * binary .xls format is not supported in phase 1).
+ */
+export declare function isExcelFile(filename: string): boolean;
+export {};