@gmickel/gno 1.45.1 → 2.0.0

package/vendor/converters/officeparser/dist/utils/sanitize.js

@@ -0,0 +1,344 @@
+"use strict";
+/**
+ * Shared output-sanitization helpers.
+ *
+ * Every string in the parsed AST originates from an untrusted document, so any
+ * value interpolated into generated output (HTML, XHTML, CSS, URLs, inline
+ * scripts, CSV, RTF, Markdown) must be escaped for its destination context.
+ * These are the single source of truth — each generator delegates to them so
+ * escaping stays consistent and a gap fixed here is fixed everywhere.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeHtmlAttributeName = isSafeHtmlAttributeName;
+exports.isSafeStyleMapTag = isSafeStyleMapTag;
+exports.escapeHtml = escapeHtml;
+exports.escapeXml = escapeXml;
+exports.sanitizeCssValue = sanitizeCssValue;
+exports.sanitizeUrl = sanitizeUrl;
+exports.iframeAllowed = iframeAllowed;
+exports.sanitizeImageUrl = sanitizeImageUrl;
+exports.serializeForInlineScript = serializeForInlineScript;
+exports.csvSafeCell = csvSafeCell;
+exports.sanitizeRtfUrl = sanitizeRtfUrl;
+exports.escapeRtf = escapeRtf;
+exports.markdownEscapeText = markdownEscapeText;
+exports.sanitizeMarkdownUrl = sanitizeMarkdownUrl;
+/**
+ * Whether a string is a plain HTML attribute *name*, safe to interpolate before `="..."`.
+ *
+ * Escaping the value is not enough on its own: a key containing a quote or `=` closes the
+ * attribute and opens another, so `x" onmouseover="alert(1)" z` yields a real event handler no
+ * matter how carefully the value is escaped. This is the shape an attribute-injection payload
+ * takes, and rejecting it outright is simpler and safer than trying to escape a name.
+ *
+ * The predicate is shared rather than restated because it is now applied at four independent
+ * points (the parser's attribute collection, the generator's attribute bag, and two
+ * styleMap-driven paths). Each of those still keeps its own skip-list inline: the lists are the
+ * same policy expressed for different layers, and collapsing them would erase the defence in
+ * depth the surrounding comments describe.
+ */
+function isSafeHtmlAttributeName(name) {
+    return typeof name === 'string' && /^[a-zA-Z][a-zA-Z0-9-]*$/.test(name);
+}
+/**
+ * Element names a `styleMap` may map a node onto.
+ *
+ * An allowlist rather than a pattern: a tag name is interpolated into both `<TAG …>` and
+ * `</TAG>`, so it is not enough for it to *look* like a name - `script`, `style`, `iframe` and
+ * friends are perfectly well-formed names that would introduce an active context the rest of the
+ * generator's escaping assumes does not exist. This is the semantic set a style mapping is for:
+ * block containers, headings, and the inline emphasis elements.
+ */
+const SAFE_STYLE_MAP_TAGS = new Set([
+    'p', 'div', 'span', 'section', 'article', 'aside', 'header', 'footer', 'main', 'figure', 'figcaption',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+    'blockquote', 'pre', 'code', 'q', 'cite', 'address',
+    'ul', 'ol', 'li', 'dl', 'dt', 'dd',
+    'b', 'strong', 'i', 'em', 'u', 'ins', 'del', 's', 'strike', 'mark', 'small', 'sub', 'sup', 'kbd', 'samp', 'var', 'abbr',
+]);
+/**
+ * Whether a `styleMap` `output.tag` may be emitted as an element name.
+ *
+ * Callers must fall back to their default tag when this returns false, never emit the value.
+ */
+function isSafeStyleMapTag(tag) {
+    return typeof tag === 'string' && SAFE_STYLE_MAP_TAGS.has(tag.toLowerCase());
+}
+/**
+ * Escapes text for an HTML text node or a double-quoted attribute value.
+ * Includes the single quote so the result is also safe inside single-quoted
+ * attributes.
+ */
+function escapeHtml(text) {
+    if (typeof text !== 'string')
+        return text;
+    return text
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Escapes text for an XML text node or attribute (XHTML/OPF/NCX). Same as
+ * escapeHtml but emits the XML-canonical `&apos;` for the single quote.
+ */
+function escapeXml(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+/**
+ * Sanitizes a single CSS value (e.g. a color/size/font/alignment pulled from a
+ * document) for placement inside a `style="prop: VALUE"` attribute.
+ *
+ * - Drops the whole value if it contains a resource-fetching or executing
+ *   construct (`url()`, `expression()`, `@import`, `image-set()`, `javascript:`)
+ *   or angle brackets that could break out of the attribute/tag.
+ * - Strips characters that break out of `prop: value` (`;`, quotes), out of a
+ *   `<style>` rule (`{}`), CSS escapes (`\`), and control characters.
+ *
+ * `rgb()/hsl()` and hex/named colors, lengths, and (unquoted) font names all
+ * survive; the trade-off is that legitimately quoted font names lose their
+ * quotes, which browsers tolerate.
+ */
+function sanitizeCssValue(value) {
+    if (typeof value !== 'string')
+        return '';
+    // Strip every form of intra-token noise FIRST, then test for dangerous constructs.
+    // Order matters: a payload like "u\nrl(", "url/*x*/(" or "u\rl(" would survive the test if
+    // tested before removal, then reassemble into "url(" once the noise is stripped.
+    //
+    // The backslash strip belongs here, not after the test. CSS treats `\` as an escape a
+    // browser resolves away, so `u\rl(http://evil)` IS `url(http://evil)` to a renderer -
+    // stripping it downstream of the test meant the sanitizer handed back a live `url()` it
+    // had just declared safe. Every construct in the denylist is reachable this way
+    // (`expr\ession(`, `image\-set(`), so the fix is the ordering, not another pattern.
+    const cleaned = value
+        .replace(/[\x00-\x1F\x7F]/g, '') // control chars (incl. newlines/tabs)
+        .replace(/\/\*[\s\S]*?\*\//g, '') // CSS comments used to obfuscate
+        .replace(/\\/g, ''); // CSS escapes; see above
+    if (/(?:url|expression|image-set|element|-moz-binding)\s*\(|@import|javascript:|[<>]/i.test(cleaned)) {
+        return '';
+    }
+    // Backslash is already gone above; the rest still have work to do here.
+    return cleaned.replace(/[;{}"'`]/g, '').trim();
+}
+/**
+ * Escapes a document-supplied URL for use in an href/src attribute. Beyond the
+ * usual attribute escaping, this rejects script-executing schemes (javascript:,
+ * vbscript:, data:, etc.) so a hyperlink extracted from an untrusted document
+ * can't run code when clicked — only http(s)/mailto/tel and relative/fragment
+ * URLs are passed through.
+ */
+function sanitizeUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    // Browsers ignore control characters when parsing a URL scheme, so strip them
+    // first to catch obfuscated payloads like "java\tscript:alert(1)".
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch && !/^(https?|mailto|tel)$/i.test(schemeMatch[1])) {
+        return '';
+    }
+    // Emit the same normalized string that was validated.
+    return escapeHtml(stripped);
+}
+/**
+ * Decide whether a non-provider `<iframe>` should be preserved, per
+ * `HtmlParserConfig.preserveIframes`. `true` allows any src; an array is a hostname allowlist,
+ * where an entry matches the src's host exactly or as a `.`-suffix (so `"vimeo.com"` also matches
+ * `player.vimeo.com`). A relative or unparseable src is allowed only under `true`. This is a
+ * preservation gate, not a sanitizer - the src is still scheme-checked with `sanitizeUrl` on
+ * generation.
+ */
+function iframeAllowed(src, preserve) {
+    if (preserve === true)
+        return true;
+    if (!Array.isArray(preserve) || preserve.length === 0)
+        return false;
+    let host;
+    try {
+        host = new URL(src).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    return preserve.some(entry => {
+        const e = String(entry).toLowerCase().trim();
+        return e.length > 0 && (host === e || host.endsWith('.' + e));
+    });
+}
+/**
+ * Like sanitizeUrl but for an <img>/<source> src: additionally permits
+ * `data:image/*` URIs (embedded document images) while still rejecting
+ * script-executing schemes and non-image data URIs (e.g. data:text/html).
+ */
+function sanitizeImageUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        if (scheme === 'data') {
+            if (!/^data:image\//i.test(stripped))
+                return '';
+        }
+        else if (scheme !== 'http' && scheme !== 'https') {
+            return '';
+        }
+    }
+    return escapeHtml(stripped);
+}
+/**
+ * Serializes data for embedding inside an inline <script> block. JSON.stringify
+ * alone doesn't escape "<", so a value containing "</script>" (e.g. a chart
+ * label from attacker-controlled document XML) would close the script early and
+ * inject markup. Also escapes the U+2028/U+2029 line separators, which are
+ * invalid in JS string literals.
+ */
+function serializeForInlineScript(data) {
+    // U+2028/U+2029 (line/paragraph separators) are valid in JSON but break
+    // JS string literals; reference them by code point to keep the source ASCII.
+    const lineSep = String.fromCharCode(0x2028);
+    const paraSep = String.fromCharCode(0x2029);
+    return JSON.stringify(data)
+        .replace(/</g, '\\u003C')
+        .replace(/>/g, '\\u003E')
+        .split(lineSep).join('\\u2028')
+        .split(paraSep).join('\\u2029');
+}
+/**
+ * Formats a value for a CSV field: guards against spreadsheet formula/DDE
+ * injection (CWE-1236) and applies RFC 4180 quoting.
+ *
+ * A cell beginning with `= + - @` (or a tab/CR that some apps treat as a
+ * formula start) is prefixed with a single quote so Excel/Sheets render it as
+ * literal text rather than executing it. Genuine numbers (including negatives)
+ * are exempt so numeric columns are preserved.
+ */
+function csvSafeCell(value, delimiter) {
+    let v = typeof value === 'string' ? value : String(value ?? '');
+    // A plain signed number (e.g. "-8", "+7", "-5.3") can't be a formula, so exempt it —
+    // otherwise numeric columns get quoted as text. Anything else starting with a formula
+    // trigger (including "+1+1", "-1+cmd", "=", "@") is prefixed with a quote.
+    const isNumber = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/.test(v.trim());
+    // Test the trimmed value: the numeric exemption above already trims, so testing the raw
+    // string here meant a leading space slipped a trigger past the guard (" =1+1" was emitted
+    // unprefixed). Most spreadsheet apps treat a leading-space cell as text and would not
+    // evaluate it, so this is defence in depth rather than a demonstrated bypass - but the
+    // asymmetry between the two tests was an accident, not a decision.
+    if (!isNumber && /^[=+\-@\t\r]/.test(v.trim())) {
+        v = `'${v}`;
+    }
+    if (v.includes(delimiter) || v.includes('"') || v.includes('\n') || v.includes('\r')) {
+        return `"${v.replace(/"/g, '""')}"`;
+    }
+    return v;
+}
+/**
+ * Validates and escapes a document-supplied URL for an RTF `HYPERLINK` field argument.
+ *
+ * Mirrors `sanitizeUrl`'s contract (validate the scheme, then encode for the destination, else
+ * return `''`) but cannot reuse it: `sanitizeUrl` returns `escapeHtml(...)`, which would emit
+ * `&amp;` into an RTF field. The scheme allowlist is deliberately identical to `sanitizeUrl`'s
+ * and `sanitizeMarkdownUrl`'s, so all three text generators agree on what a hyperlink may point at.
+ *
+ * **Additionally rejects UNC paths (`\\host\share`), which the HTML allowlist does not.** In a
+ * browser `\\evil.com\share` is an inert relative path; in Word it is a live UNC reference that
+ * triggers an SMB fetch and an NTLM handshake on click, which is a credential-leak vector rather
+ * than a rendering quirk. That asymmetry is why this is a separate function and not a flag on
+ * `sanitizeUrl` - the HTML helper must NOT gain this behaviour, since there the path is harmless
+ * and rejecting it would break legitimate relative links.
+ *
+ * Returns `''` for a rejected URL; callers emit the link text without the field wrapper, matching
+ * how HTML degrades to `href=""` and Markdown to `[text]()`.
+ */
+function sanitizeRtfUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    // Control characters are stripped before scheme matching for the same reason as sanitizeUrl:
+    // they are ignored when the target application parses the scheme.
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    if (/^[\\/]{2}[^\\/]/.test(stripped))
+        return ''; // UNC (\\host\share, //host\share)
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch && !/^(https?|mailto|tel)$/i.test(schemeMatch[1])) {
+        return '';
+    }
+    return escapeRtf(stripped);
+}
+/**
+ * Escapes text for RTF: neutralizes the control/group metacharacters `\ { }`
+ * (which would otherwise inject RTF control words or groups), encodes the double
+ * quote (so a hyperlink field argument can't be terminated early), and hex/unicode
+ * encodes non-ASCII characters.
+ */
+function escapeRtf(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text
+        .replace(/\\/g, '\\\\')
+        .replace(/{/g, '\\{')
+        .replace(/}/g, '\\}')
+        .replace(/"/g, "\\'22")
+        .replace(/[^\x00-\x7F]/g, (match) => {
+        let code = match.charCodeAt(0);
+        if (code < 256) {
+            return `\\'${code.toString(16).padStart(2, '0')}`;
+        }
+        if (code > 32767) {
+            code -= 65536;
+        }
+        return `{\\uc0\\u${code}}`;
+    });
+}
+/**
+ * Escapes document text for a Markdown text position. Markdown passes raw HTML
+ * through to the renderer, so a `<` that begins an HTML tag or comment must be
+ * neutralized to prevent `<script>`/`<img onerror>` injection when the Markdown
+ * is later rendered to HTML.
+ *
+ * Deliberately narrow — only a `<` immediately followed by a letter, `/`, `!` or
+ * `?` (i.e. one that actually opens a tag/comment/PI, matching how browsers
+ * detect tags) is encoded. A bare `<` (e.g. `a < b`), `>`, `&`, `[]` and other
+ * Markdown metacharacters are left untouched: they can't start a tag, and
+ * MarkdownParser round-trips this output without decoding entities, so encoding
+ * them would corrupt re-parsed content. URL schemes are handled by
+ * sanitizeMarkdownUrl.
+ */
+function markdownEscapeText(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text.replace(/<(?=[a-zA-Z/!?])/g, '&lt;');
+}
+/**
+ * Sanitizes a document-supplied URL for a Markdown `[text](url)` / `![alt](url)`
+ * target. Rejects script-executing schemes (returning '' → a dead link) and
+ * percent-encodes the characters that would break out of the `(...)` or inject
+ * markup. `&` is preserved so query strings survive; set `allowDataImage` for
+ * image targets so embedded `data:image/*` URIs are permitted.
+ */
+function sanitizeMarkdownUrl(url, opts) {
+    if (typeof url !== 'string')
+        return '';
+    const stripped = url.trim().replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        const ok = /^(?:https?|mailto|tel)$/.test(scheme)
+            || (opts?.allowDataImage === true && /^data:image\//i.test(stripped));
+        if (!ok)
+            return '';
+    }
+    return stripped.replace(/[\s()<>"`\\]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
+}

package/vendor/converters/officeparser/dist/utils/sheetUtils.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Parses a range string (e.g., "1", "1-3", "1,2", "1,3-5, 7") into an array of numbers.
+ *
+ * @param rangeStr - The range string to parse
+ * @returns An array of unique, sorted numbers (1-based indices)
+ */
+export declare function parseRangeString(rangeStr: string): number[];

package/vendor/converters/officeparser/dist/utils/sheetUtils.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRangeString = parseRangeString;
+/**
+ * Parses a range string (e.g., "1", "1-3", "1,2", "1,3-5, 7") into an array of numbers.
+ *
+ * @param rangeStr - The range string to parse
+ * @returns An array of unique, sorted numbers (1-based indices)
+ */
+function parseRangeString(rangeStr) {
+    const result = new Set();
+    const segments = rangeStr.split(',');
+    for (const segment of segments) {
+        const trimmed = segment.trim();
+        if (trimmed.includes('-')) {
+            const [startStr, endStr] = trimmed.split('-');
+            const start = parseInt(startStr, 10);
+            const end = parseInt(endStr, 10);
+            if (!isNaN(start) && !isNaN(end)) {
+                const actualStart = Math.min(start, end);
+                const actualEnd = Math.max(start, end);
+                for (let i = actualStart; i <= actualEnd; i++) {
+                    result.add(i);
+                }
+            }
+        }
+        else {
+            const val = parseInt(trimmed, 10);
+            if (!isNaN(val)) {
+                result.add(val);
+            }
+        }
+    }
+    return Array.from(result).sort((a, b) => a - b);
+}

package/vendor/converters/officeparser/dist/utils/styleMapper.d.ts

@@ -0,0 +1,36 @@
+import { OfficeContentNode, StructuredStyleMapping } from '../types.js';
+export interface StyleMapping {
+    selector: {
+        nodeType?: string;
+        attributes: Record<string, {
+            value: string | number | boolean;
+            operator: '=' | '~=';
+            compiled?: RegExp;
+        }>;
+    };
+    output: {
+        tag: string;
+        classes: string[];
+        attributes: Record<string, string>;
+        fresh: boolean;
+    };
+}
+/**
+ * Parser and matcher for the style mapping DSL.
+ * Supports a structured JSON format and a legacy string DSL.
+ */
+export declare class StyleMapper {
+    private mappings;
+    constructor(mappings?: string[] | StructuredStyleMapping[] | Record<string, any>, ignoreDefaults?: boolean);
+    /**
+     * Finds the best matching mapping for a node.
+     */
+    getMapping(node: OfficeContentNode): StyleMapping['output'] | undefined;
+    private matches;
+    private getNodeAttribute;
+    private convertStructuredMapping;
+    /**
+     * Parses a mapping string like "p[style-name='Heading 1'] => h1.title:fresh"
+     */
+    private parseMappingString;
+}

package/vendor/converters/officeparser/dist/utils/styleMapper.js

@@ -0,0 +1,224 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StyleMapper = void 0;
+const types_js_1 = require("../types.js");
+const errorUtils_js_1 = require("./errorUtils.js");
+const DEFAULT_MAPPINGS = [
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Heading 1' } }, output: { tag: 'h1' } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Heading 2' } }, output: { tag: 'h2' } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Heading 3' } }, output: { tag: 'h3' } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Heading 4' } }, output: { tag: 'h4' } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Heading 5' } }, output: { tag: 'h5' } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Heading 6' } }, output: { tag: 'h6' } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Title' } }, output: { tag: 'h1', classes: ['title'] } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Subtitle' } }, output: { tag: 'p', classes: ['subtitle'] } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Quote' } }, output: { tag: 'blockquote' } },
+    { selector: { nodeType: 'paragraph', attributes: { 'style-name': 'Intense Quote' } }, output: { tag: 'blockquote', classes: ['intense'] } },
+];
+/**
+ * Parser and matcher for the style mapping DSL.
+ * Supports a structured JSON format and a legacy string DSL.
+ */
+class StyleMapper {
+    mappings = [];
+    constructor(mappings, ignoreDefaults = false) {
+        // 1. Add user mappings (they take precedence)
+        if (mappings) {
+            if (Array.isArray(mappings)) {
+                for (const m of mappings) {
+                    if (typeof m === 'string') {
+                        this.mappings.push(this.parseMappingString(m));
+                    }
+                    else {
+                        this.mappings.push(this.convertStructuredMapping(m));
+                    }
+                }
+            }
+            else {
+                // Support legacy object format: { 'Heading 1': { tag: 'h1', class: 'title' } }
+                for (const [styleName, target] of Object.entries(mappings)) {
+                    this.mappings.push({
+                        selector: {
+                            attributes: { style: { value: styleName, operator: '=' } }
+                        },
+                        output: {
+                            tag: target.tag || 'div',
+                            classes: target.class ? target.class.split(' ') : [],
+                            attributes: {},
+                            fresh: false
+                        }
+                    });
+                }
+            }
+        }
+        // 2. Add default mappings if not ignored
+        if (!ignoreDefaults) {
+            this.mappings.push(...DEFAULT_MAPPINGS.map(m => this.convertStructuredMapping(m)));
+        }
+    }
+    /**
+     * Finds the best matching mapping for a node.
+     */
+    getMapping(node) {
+        for (const mapping of this.mappings) {
+            if (this.matches(node, mapping.selector)) {
+                return mapping.output;
+            }
+        }
+        return undefined;
+    }
+    matches(node, selector) {
+        // Match node type if specified
+        if (selector.nodeType && node.type !== selector.nodeType) {
+            return false;
+        }
+        // Match attributes (style, level, etc.)
+        for (const [attr, { value, operator, compiled }] of Object.entries(selector.attributes)) {
+            const actualValue = this.getNodeAttribute(node, attr);
+            if (actualValue === undefined)
+                return false;
+            if (operator === '=') {
+                if (String(actualValue) !== String(value))
+                    return false;
+            }
+            else if (operator === '~=') {
+                const regex = compiled || new RegExp(String(value));
+                if (!regex.test(String(actualValue)))
+                    return false;
+            }
+        }
+        return true;
+    }
+    getNodeAttribute(node, attr) {
+        // Special case for style (alias style-name for mammoth.js compatibility)
+        if (attr === 'style' || attr === 'style-name') {
+            return node.metadata?.style || node.formatting?.font;
+        }
+        // Metadata attributes
+        if (node.metadata && attr in node.metadata) {
+            return node.metadata[attr];
+        }
+        // Formatting attributes
+        if (node.formatting && attr in node.formatting) {
+            return node.formatting[attr];
+        }
+        return undefined;
+    }
+    convertStructuredMapping(m) {
+        const attributes = {};
+        if (m.selector.attributes) {
+            for (const [key, val] of Object.entries(m.selector.attributes)) {
+                if (typeof val === 'object' && val !== null && 'value' in val) {
+                    const operator = val.operator || '=';
+                    attributes[key] = {
+                        value: val.value,
+                        operator,
+                        compiled: operator === '~=' ? new RegExp(String(val.value)) : undefined
+                    };
+                }
+                else {
+                    attributes[key] = {
+                        value: val,
+                        operator: '='
+                    };
+                }
+            }
+        }
+        return {
+            selector: {
+                nodeType: m.selector.nodeType,
+                attributes
+            },
+            output: {
+                tag: m.output.tag,
+                classes: m.output.classes || [],
+                attributes: m.output.attributes || {},
+                fresh: m.output.fresh || false
+            }
+        };
+    }
+    /**
+     * Parses a mapping string like "p[style-name='Heading 1'] => h1.title:fresh"
+     */
+    parseMappingString(mapping) {
+        const lastIndex = mapping.lastIndexOf('=>');
+        if (lastIndex === -1) {
+            throw (0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.INVALID_STYLE_MAPPING, undefined, mapping);
+        }
+        const selectorStr = mapping.substring(0, lastIndex).trim();
+        const outputStr = mapping.substring(lastIndex + 2).trim();
+        // Parse Selector
+        const selectorMatch = selectorStr.match(/^([a-z]+)?(?:\[(.+?)\])?$/);
+        if (!selectorMatch) {
+            throw (0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.INVALID_SELECTOR, undefined, selectorStr);
+        }
+        const typeMap = {
+            'p': 'paragraph',
+            'h': 'heading',
+            't': 'table',
+            'tr': 'row',
+            'td': 'cell',
+            'li': 'list',
+            'img': 'image'
+        };
+        const nodeType = selectorMatch[1] ? (typeMap[selectorMatch[1]] || selectorMatch[1]) : undefined;
+        const attrStr = selectorMatch[2];
+        const attributes = {};
+        if (attrStr) {
+            // Improved attribute parsing to handle commas inside quotes
+            const attrParts = [];
+            let currentPart = '';
+            let inQuotes = false;
+            for (let i = 0; i < attrStr.length; i++) {
+                const char = attrStr[i];
+                if (char === "'" || char === '"')
+                    inQuotes = !inQuotes;
+                if (char === ',' && !inQuotes) {
+                    attrParts.push(currentPart.trim());
+                    currentPart = '';
+                }
+                else {
+                    currentPart += char;
+                }
+            }
+            if (currentPart)
+                attrParts.push(currentPart.trim());
+            for (const part of attrParts) {
+                const m = part.match(/^([\w-]+)\s*(=|~=)\s*(?:(["'])(.*?)\3|(.+))$/);
+                if (m) {
+                    const operator = m[2];
+                    const value = m[4] !== undefined ? m[4] : m[5];
+                    attributes[m[1]] = {
+                        operator,
+                        value,
+                        compiled: operator === '~=' ? new RegExp(value) : undefined
+                    };
+                }
+            }
+        }
+        // Parse Output
+        const outputParts = outputStr.split(':');
+        const fresh = outputParts.includes('fresh');
+        const mainOutput = outputParts[0];
+        const outputMatch = mainOutput.match(/^([a-z0-9]+)?((?:\.[\w-]+)*)(?:\[(.+?)\])?$/);
+        if (!outputMatch) {
+            throw (0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.INVALID_OUTPUT_MAPPING, undefined, mainOutput);
+        }
+        const tag = outputMatch[1] || 'div';
+        const classes = outputMatch[2] ? outputMatch[2].split('.').filter(Boolean) : [];
+        const outAttrs = {};
+        if (outputMatch[3]) {
+            const outAttrParts = outputMatch[3].split(',').map(a => a.trim());
+            for (const part of outAttrParts) {
+                const m = part.match(/^([\w-]+)\s*=\s*(?:(["'])(.*?)\2|(.+))$/);
+                if (m)
+                    outAttrs[m[1]] = m[3] !== undefined ? m[3] : m[4];
+            }
+        }
+        return {
+            selector: { nodeType, attributes },
+            output: { tag, classes, attributes: outAttrs, fresh }
+        };
+    }
+}
+exports.StyleMapper = StyleMapper;