@poe-platform/safe-bash 0.1.806 → 0.1.807

package/dist/safe-bash/command-chunks/chunk-OGWJD5QP.js

@@ -0,0 +1,404 @@
+import {
+  measurePackageResourceSerialization
+} from "./chunk-W6DV2CLS.js";
+import {
+  validateDocxInvocation
+} from "./chunk-DE66JRWJ.js";
+import {
+  readDocumentArchive
+} from "./chunk-GLPIFP7N.js";
+import {
+  UnsupportedEditError
+} from "./chunk-YPVBU7QF.js";
+import {
+  documentDialects
+} from "./chunk-MG7AJD5E.js";
+import {
+  MarkupCompatibility,
+  compatibilityProfileForPart
+} from "./chunk-GZ2N24A2.js";
+import {
+  encodeGeneratedLocation
+} from "./chunk-LQOKYG3O.js";
+import {
+  parseDocumentXml,
+  parseMediaType
+} from "./chunk-MWAAMNAM.js";
+import {
+  InputTypeError,
+  archiveSettings
+} from "./chunk-IQFRPIXH.js";
+
+// packages/safe-bash-docx-engine/src/diagram-observations.ts
+var drawing = "http://schemas.microsoft.com/office/drawing/2008/diagram";
+var mc = "http://schemas.openxmlformats.org/markup-compatibility/2006";
+var officeShape = "http://schemas.microsoft.com/office/word/2010/wordprocessingShape";
+var officeGroup = "http://schemas.microsoft.com/office/word/2010/wordprocessingGroup";
+var roots = ["dataModel", "layoutDef", "styleDef", "colorsDef"];
+function collectDiagramObservations(root, dialect, part, budget, compatibility) {
+  const ns = documentDialects[dialect], active = /* @__PURE__ */ new Set(), result = [];
+  const content = [...(compatibility ?? new MarkupCompatibility(root, compatibilityProfileForPart(part), budget)).content].reverse();
+  while (content.length) {
+    const item = content.pop();
+    budget.charge("work", 1);
+    if ("source" in item) {
+      active.add(item.source);
+      budget.charge("retainedBytes", 16);
+      if (item.disposition === "understood") for (let i = item.content.length - 1; i >= 0; i--) content.push(item.content[i]);
+    }
+  }
+  const attr = (node, name, namespace = "") => node.attributes.find((a) => a.namespace === namespace && a.localName === name)?.value ?? null;
+  const is = (node, namespace, name) => node?.namespace === namespace && node.localName === name;
+  const envelope = (chain) => chain.length === 4 && is(chain[0], ns.w, "drawing") && chain[1]?.namespace === ns.wp && ["inline", "anchor"].includes(chain[1].localName) && is(chain[2], ns.a, "graphic") && is(chain[3], ns.a, "graphicData");
+  const add = (node, path, kind, uri, requests = []) => {
+    budget.charge("matches", 1);
+    budget.charge("retainedBytes", 256 + path.length * 8 + (part.length + node.namespace.length + node.localName.length + (uri?.length ?? 0)) * 2 + requests.reduce((n, r) => n + 96 + r.attribute.length * 2 + (r.relationshipId?.length ?? 0) * 2, 0));
+    const issues = kind === "relIds" || requests.length ? [] : [{ code: "opaque-graphics", part, path, message: "Stored graphics content is outside the supported native profile." }];
+    if (issues.length) budget.charge("diagnosticBytes", issues[0].message.length + part.length + 64);
+    result.push({ kind, part, path, namespace: node.namespace, localName: node.localName, uri, active: active.has(node), requests, issues });
+  };
+  const transparentChildren = (node) => {
+    const result2 = [];
+    for (const child of node.children) {
+      budget.charge("work", 1);
+      if (child.namespace === mc && ["AlternateContent", "Choice", "Fallback"].includes(child.localName)) result2.push(...transparentChildren(child));
+      else result2.push(child);
+    }
+    return result2;
+  };
+  const pending = [{ node: root, path: [], ancestors: [] }];
+  while (pending.length) {
+    const { node, path, ancestors } = pending.pop();
+    budget.charge("work", ancestors.length + 1);
+    budget.charge("retainedBytes", 32 + path.length * 8);
+    const chain = ancestors.filter((n) => !(n.namespace === mc && ["AlternateContent", "Choice", "Fallback"].includes(n.localName)));
+    let drawingIndex = -1;
+    chain.forEach((n, i) => {
+      if (is(n, ns.w, "drawing")) drawingIndex = i;
+    });
+    const graphics = drawingIndex >= 0 ? chain.slice(drawingIndex) : [];
+    if (is(node, ns.a, "graphicData") && envelope([...graphics, node])) {
+      const uri = attr(node, "uri"), nativeDiagram = uri === ns.dgm && transparentChildren(node).some((n) => is(n, ns.dgm, "relIds"));
+      const known = uri === ns.pic && transparentChildren(node).some((n) => is(n, ns.pic, "pic")) || uri === ns.c && transparentChildren(node).some((n) => is(n, ns.c, "chart")) || transparentChildren(node).some((n) => n.namespace === ns.wp && ["wsp", "wgp", "grpSp", "wpc"].includes(n.localName) || is(n, officeShape, "wsp") || n.namespace === officeGroup && ["wgp", "grpSp"].includes(n.localName));
+      if (!nativeDiagram && !known) add(node, path, "unknown-graphic", uri);
+    }
+    if (is(node, ns.dgm, "relIds") && envelope(graphics) && attr(graphics[3], "uri") === ns.dgm) {
+      const fields = ["dm", "lo", "qs", "cs"], roles2 = ["data", "layout", "style", "color"];
+      add(node, path, "relIds", attr(graphics[3], "uri"), fields.map((field, i) => ({ role: roles2[i], attribute: field, relationshipId: attr(node, field, ns.r) })));
+    }
+    if (is(node, ns.a, "ext")) {
+      const list = chain.at(-1), parentChain = chain.slice(0, -1), nativeDiagram = is(list, ns.dgm, "extLst") && parentChain.length === 1 && parentChain[0] === root && root.namespace === ns.dgm && roots.includes(root.localName);
+      let start = -1;
+      parentChain.forEach((n, i) => {
+        if (is(n, ns.w, "drawing")) start = i;
+      });
+      const nativePath = start >= 0 ? parentChain.slice(start) : [];
+      const docPr = nativePath.length === 3 && is(nativePath[0], ns.w, "drawing") && nativePath[1]?.namespace === ns.wp && ["inline", "anchor"].includes(nativePath[1].localName) && is(nativePath[2], ns.wp, "docPr");
+      const dataIndex = nativePath.findIndex((n) => is(n, ns.a, "graphicData"));
+      const belowData = dataIndex === 3 && envelope(nativePath.slice(0, 4)) && nativePath.slice(4).every((n) => [ns.a, ns.pic, officeShape, officeGroup].includes(n.namespace));
+      const nativeDrawing = is(list, ns.a, "extLst") && (docPr || belowData);
+      if (nativeDiagram || nativeDrawing) {
+        const uri = attr(node, "uri");
+        if (!node.children.length) add(node, path, "extension", uri);
+        node.children.forEach((child, i) => {
+          if (nativeDrawing && belowData && is(parentChain.at(-1), ns.a, "blip") && uri === "{96DAC541-7B7A-43D3-8B79-37D633B846F1}" && child.namespace === "http://schemas.microsoft.com/office/drawing/2016/SVG/main" && child.localName === "svgBlip" || nativeDrawing && docPr && uri === "{C183D7F6-B498-43B3-948B-1728B52AA6E4}" && child.namespace === "http://schemas.microsoft.com/office/drawing/2017/decorative" && child.localName === "decorative") return;
+          const requests = nativeDiagram && uri === drawing && is(child, drawing, "dataModelExt") ? [{ role: "drawing", attribute: "relId", relationshipId: attr(child, "relId") }] : [];
+          add(child, [...path, i], "extension", uri, requests);
+        });
+      }
+    }
+    for (let i = node.children.length - 1; i >= 0; i--) pending.push({ node: node.children[i], path: [...path, i], ancestors: [...ancestors, node] });
+  }
+  return result.sort((a, b) => {
+    for (let i = 0; i < Math.min(a.path.length, b.path.length); i++) {
+      const n = a.path[i] - b.path[i];
+      if (n) return n;
+    }
+    return a.path.length - b.path.length;
+  });
+}
+
+// packages/safe-bash-docx-engine/src/diagrams.ts
+var drawingNamespace = "http://schemas.microsoft.com/office/drawing/2008/diagram";
+var roles = ["data", "layout", "style", "color", "drawing"];
+var roleConfig = {
+  data: { mime: "application/vnd.openxmlformats-officedocument.drawingml.diagramdata+xml", relationship: "diagramData", root: "dataModel" },
+  layout: { mime: "application/vnd.openxmlformats-officedocument.drawingml.diagramlayout+xml", relationship: "diagramLayout", root: "layoutDef" },
+  style: { mime: "application/vnd.openxmlformats-officedocument.drawingml.diagramstyle+xml", relationship: "diagramQuickStyle", root: "styleDef" },
+  color: { mime: "application/vnd.openxmlformats-officedocument.drawingml.diagramcolors+xml", relationship: "diagramColors", root: "colorsDef" },
+  drawing: { mime: "application/vnd.ms-office.drawingml.diagramdrawing+xml", relationship: "http://schemas.microsoft.com/office/2007/relationships/diagramDrawing", root: "drawing" }
+};
+var compare = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var reltype = (role, dialect) => role === "drawing" ? roleConfig[role].relationship : documentDialects[dialect].r + "/" + roleConfig[role].relationship;
+var xmlPart = (part) => parseMediaType(part.content_type).endsWith("+xml") || ["application/xml", "text/xml"].includes(parseMediaType(part.content_type));
+function issue(code, part, path, message, budget) {
+  budget.charge("work", 1);
+  budget.charge("diagnosticBytes", code.length + part.length + message.length + 64);
+  budget.charge("retainedBytes", 128 + (code.length + part.length + message.length) * 2 + path.length * 8);
+  return { code, part, path, message };
+}
+function diagramPartRoles(graph, dialect, budget) {
+  const evidence = /* @__PURE__ */ new Map();
+  const add = (part, role, kind) => {
+    let found = evidence.get(part);
+    if (!found) {
+      found = /* @__PURE__ */ new Map();
+      evidence.set(part, found);
+      budget.charge("retainedBytes", 96 + part.length * 2);
+    }
+    let record = found.get(role);
+    if (!record) {
+      record = { mime: false, relationship: false };
+      found.set(role, record);
+      budget.charge("retainedBytes", 64);
+    }
+    record[kind] = true;
+  };
+  for (const part of graph.parts) {
+    budget.charge("work", roles.length);
+    for (const role of roles) if (parseMediaType(part.content_type) === roleConfig[role].mime) add(part.partname, role, "mime");
+  }
+  for (const owner of ["/", ...graph.parts.filter((p) => p.content_type.toLowerCase() !== "application/vnd.openxmlformats-package.relationships+xml").map((p) => p.partname)]) for (const edge of graph.relationships(owner)) {
+    budget.charge("work", roles.length);
+    if (!edge.is_external) {
+      for (const role of roles) if (edge.reltype === reltype(role, dialect)) add(edge.target_part.partname, role, "relationship");
+    }
+  }
+  return new Map([...evidence].sort(([a], [b]) => compare(a, b)).map(([name, found]) => [name, roles.filter((r) => found.has(r)).map((role) => ({ role, evidence: found.get(role).mime ? found.get(role).relationship ? "both" : "content-type" : "relationship" }))]));
+}
+async function hash(bytes, budget) {
+  budget.charge("work", bytes.length);
+  budget.charge("retainedBytes", bytes.length + 128);
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)));
+  budget.check("work", 0);
+  return [...digest].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function location(sourceSha256, part, path) {
+  const value = { version: 1, sourceSha256, generation: 0, part, story: part, path, range: null };
+  return { kind: "part", value, token: encodeGeneratedLocation(value), positions: {} };
+}
+async function diagramDiagnosticLocation(input, part, path, budget) {
+  return location(await hash(input, budget), part, [...path]);
+}
+var UnsupportedDiagramMutationError = class extends UnsupportedEditError {
+  constructor(location2) {
+    super("Unsupported graphics mutation cannot establish faithful preservation.");
+    this.location = location2;
+    this.locations = [location2];
+  }
+  location;
+  locations;
+};
+async function inspectDocumentDiagrams(input, options, context) {
+  const settings = archiveSettings(context), invocation = validateDocxInvocation({ operation: "diagrams.list", inputs: ["document"], options }, settings.budget), opts = invocation.options;
+  const budget = settings.budget.lower(Object.fromEntries((opts.limit ?? []).map((l) => [l.name, l.value])));
+  if (!(input instanceof Uint8Array)) throw new InputTypeError("Expected archive bytes.");
+  budget.check("compressedInput", input.length);
+  budget.charge("work", input.length);
+  budget.charge("retainedBytes", input.length);
+  const owned = new Uint8Array(input);
+  const archive = await readDocumentArchive(owned, { ...settings, budget }), graph = archive.package, sourceSha256 = await hash(owned, budget), candidates = diagramPartRoles(graph, archive.dialect, budget), roots2 = /* @__PURE__ */ new Map(), observations = /* @__PURE__ */ new Map(), descriptors = /* @__PURE__ */ new Map();
+  const root = (part) => {
+    if (!xmlPart(part)) return null;
+    let value = roots2.get(part.partname);
+    if (!value) {
+      value = parseDocumentXml(part.bytes, {}, budget).root;
+      roots2.set(part.partname, value);
+    }
+    return value;
+  };
+  for (const part of graph.parts) {
+    await budget.checkpoint(1);
+    const parsed = root(part);
+    if (parsed) {
+      const found = collectDiagramObservations(parsed, archive.dialect, part.partname, budget);
+      if (found.length) observations.set(part.partname, found);
+    }
+  }
+  const descriptor = async (part) => {
+    let found = descriptors.get(part.partname);
+    if (!found) {
+      found = { name: part.partname, contentType: part.content_type, bytes: part.bytes.length, sha256: await hash(part.bytes, budget) };
+      budget.charge("retainedBytes", 256 + (found.name.length + found.contentType.length) * 2);
+      descriptors.set(part.partname, found);
+    }
+    return found;
+  };
+  const roleEvidence = (name) => {
+    const entries = candidates.get(name) ?? [], parsed = root(graph.getPart(name));
+    return entries.map((entry) => {
+      budget.charge("retainedBytes", 128);
+      return { ...entry, part: name, root: parsed ? { namespace: parsed.namespace, localName: parsed.localName } : null, status: entries.length === 1 && parsed?.namespace === (entry.role === "drawing" ? drawingNamespace : documentDialects[archive.dialect].dgm) && parsed.localName === roleConfig[entry.role].root ? "matching" : "opaque" };
+    });
+  };
+  const allEdges = [];
+  for (const owner of ["/", ...graph.parts.filter((p) => p.content_type.toLowerCase() !== "application/vnd.openxmlformats-package.relationships+xml").map((p) => p.partname)]) for (const edge of graph.relationships(owner)) {
+    budget.charge("work", 1);
+    budget.charge("retainedBytes", 32);
+    allEdges.push({ owner, edge });
+  }
+  const reference = (owner, edge) => {
+    budget.charge("retainedBytes", 128 + (owner.length + edge.rId.length + edge.reltype.length + edge.target_ref.length) * 2);
+    return { owner, id: edge.rId, type: edge.reltype, target: edge.target_ref, external: edge.is_external };
+  };
+  const items = [];
+  for (const name of [.../* @__PURE__ */ new Set([...candidates.keys(), ...observations.keys()])].sort(compare)) {
+    await budget.checkpoint(1);
+    const entries = roleEvidence(name), issues = [], found = [], seeds = new Set(candidates.has(name) ? [name] : []);
+    for (const entry of entries) if (entry.status === "opaque") issues.push(issue(entries.length > 1 ? "conflicting-diagram-role" : "opaque-diagram-root", name, [], "The declared diagram role has conflicting evidence or an unsupported root.", budget));
+    for (const observation of observations.get(name) ?? []) {
+      const bindings = [];
+      for (const request of observation.requests) {
+        const edge = request.relationshipId ? graph.relationships(name).find((e) => e.rId === request.relationshipId) : void 0;
+        let status = "internal", target = null;
+        if (edge && !edge.is_external) {
+          target = await descriptor(edge.target_part);
+          seeds.add(edge.target_part.partname);
+        }
+        if (!request.relationshipId) status = "missing-id";
+        else if (!edge) status = "missing-relationship";
+        else if (edge.reltype !== reltype(request.role, archive.dialect)) status = "wrong-relationship-type";
+        else if (edge.is_external) status = "external";
+        else if (parseMediaType(edge.target_part.content_type) !== roleConfig[request.role].mime) status = "wrong-resource-type";
+        else if (roleEvidence(edge.target_part.partname).find((e) => e.role === request.role)?.status !== "matching") status = "opaque";
+        const bindingIssues = status === "internal" ? [] : [issue("diagram-binding-" + status, name, observation.path, "The stored resource binding is unresolved or outside its native role.", budget)];
+        budget.charge("retainedBytes", 192);
+        bindings.push({ role: request.role, attribute: request.attribute, relationshipId: request.relationshipId, reference: edge ? reference(name, edge) : null, status, target, issues: bindingIssues });
+      }
+      const { requests: ignored, ...metadata } = observation;
+      found.push({ ...metadata, bindings });
+    }
+    const visited = /* @__PURE__ */ new Set(), pending = [...seeds];
+    while (pending.length) {
+      await budget.checkpoint(1);
+      const next = pending.pop();
+      if (visited.has(next)) continue;
+      visited.add(next);
+      budget.charge("retainedBytes", 96);
+      for (const edge of graph.relationships(next)) {
+        budget.charge("work", 1);
+        if (!edge.is_external && !visited.has(edge.target_part.partname)) {
+          pending.push(edge.target_part.partname);
+          budget.charge("retainedBytes", 16);
+        }
+      }
+    }
+    const parts = [];
+    for (const partname of [.../* @__PURE__ */ new Set([name, ...visited])].sort(compare)) parts.push(await descriptor(graph.getPart(partname)));
+    const references = [];
+    for (const record of allEdges) {
+      budget.charge("work", 1);
+      if (visited.has(record.owner) || !record.edge.is_external && record.edge.target_part.partname === name) references.push(reference(record.owner, record.edge));
+    }
+    references.sort((a, b) => compare(a.owner, b.owner) || compare(a.id, b.id) || compare(a.type, b.type) || compare(a.target, b.target));
+    const loc = location(sourceSha256, name, []);
+    budget.charge("matches", 1);
+    budget.charge("retainedBytes", 512 + loc.token.length * 2);
+    items.push({ kind: "diagrams", name, location: loc, properties: [], references, support: "preserve", details: { kind: "diagrams", parts, roles: entries, observations: found, issues } });
+  }
+  const warnings = items.length ? [{ code: "preserve-only-graphics", message: "Diagram and opaque graphics inventory is physical metadata only; layout and semantic editing are unsupported." }] : [];
+  const data = { items, warnings };
+  const size = measurePackageResourceSerialization({ version: 1, operation: "diagrams.list", ok: true, data, warnings, errors: [], affected: 0, locations: items.map((i) => i.location) }, budget);
+  budget.charge("retainedBytes", size);
+  return data;
+}
+async function assertDiagramXmlReplacement(archive, original, replacement, input, part, budget) {
+  if (diagramPartRoles(archive.package, archive.dialect, budget).has(part)) throw new UnsupportedDiagramMutationError(await diagramDiagnosticLocation(input, part, [], budget));
+  const before = collectDiagramObservations(original, archive.dialect, part, budget), after = collectDiagramObservations(replacement, archive.dialect, part, budget);
+  const payload = (root, observation) => {
+    let node = root, enclosing;
+    for (const index of observation.path) {
+      node = node.children[index];
+      if (node.namespace === documentDialects[archive.dialect].w && node.localName === "drawing") enclosing = node;
+    }
+    return enclosing ?? node;
+  };
+  const equal = (a, b) => {
+    budget.charge("work", 1 + a.attributes.length + b.attributes.length + a.content.length + b.content.length);
+    if (a.name !== b.name || a.namespace !== b.namespace || a.localName !== b.localName || a.attributes.length !== b.attributes.length || a.namespaces.size !== b.namespaces.size || a.content.length !== b.content.length) return false;
+    for (const [prefix, uri] of a.namespaces) if (b.namespaces.get(prefix) !== uri) return false;
+    for (let i = 0; i < a.attributes.length; i++) {
+      const x = a.attributes[i], y = b.attributes[i];
+      budget.charge("work", x.value.length + y.value.length);
+      if (x.name !== y.name || x.namespace !== y.namespace || x.value !== y.value) return false;
+    }
+    for (let i = 0; i < a.content.length; i++) {
+      const x = a.content[i], y = b.content[i];
+      if (x.kind !== y.kind) return false;
+      if (x.kind === "element" && y.kind === "element") {
+        if (!equal(x, y)) return false;
+      } else if ("text" in x && "text" in y) {
+        budget.charge("work", x.text.length + y.text.length);
+        if (x.text !== y.text || "target" in x && "target" in y && x.target !== y.target) return false;
+      } else if (measurePackageResourceSerialization(x, budget) !== measurePackageResourceSerialization(y, budget) || JSON.stringify(x) !== JSON.stringify(y)) return false;
+    }
+    return true;
+  };
+  for (let i = 0; i < Math.max(before.length, after.length); i++) {
+    const previous = before[i], next = after[i];
+    if (!previous || !next || previous.path.length !== next.path.length || previous.path.some((index, i2) => index !== next.path[i2]) || !equal(payload(original, previous), payload(replacement, next))) throw new UnsupportedDiagramMutationError(await diagramDiagnosticLocation(input, part, previous?.path ?? [], budget));
+  }
+}
+async function assertDiagramGraphReplacement(archive, candidate, input, part, budget) {
+  const snapshot = (graph) => {
+    const declared = diagramPartRoles(graph, archive.dialect, budget), pending = [...declared.keys()], bindings = /* @__PURE__ */ new Set();
+    for (const owner of graph.parts) {
+      if (!xmlPart(owner)) continue;
+      const root = parseDocumentXml(owner.bytes, {}, budget).root;
+      for (const observation of collectDiagramObservations(root, archive.dialect, owner.partname, budget)) for (const request of observation.requests) {
+        bindings.add(owner.partname + "\0" + (request.relationshipId ?? ""));
+        const edge = request.relationshipId ? graph.relationships(owner.partname).find((e) => e.rId === request.relationshipId) : void 0;
+        if (edge && !edge.is_external) pending.push(edge.target_part.partname);
+      }
+    }
+    const visited = /* @__PURE__ */ new Set();
+    while (pending.length) {
+      budget.charge("work", 1);
+      const name = pending.pop();
+      if (visited.has(name)) continue;
+      visited.add(name);
+      budget.charge("retainedBytes", 96);
+      for (const edge of graph.relationships(name)) {
+        budget.charge("work", 1);
+        if (!edge.is_external && !visited.has(edge.target_part.partname)) pending.push(edge.target_part.partname);
+      }
+    }
+    const edges = [...graph.parts.filter((p) => p.content_type.toLowerCase() !== "application/vnd.openxmlformats-package.relationships+xml").map((p) => p.partname), "/"].flatMap((owner) => graph.relationships(owner).filter((edge) => visited.has(owner) || !edge.is_external && visited.has(edge.target_part.partname) || bindings.has(owner + "\0" + edge.rId)).map((edge) => {
+      budget.charge("work", 1);
+      return [owner, edge.rId, edge.reltype, edge.target_ref, edge.is_external];
+    })).sort((a, b) => compare(a[0], b[0]) || compare(a[1], b[1]) || compare(a[2], b[2]) || compare(a[3], b[3]));
+    const value = { declared: [...declared], bindings: [...bindings].sort(compare), edges };
+    const size = measurePackageResourceSerialization(value, budget);
+    budget.charge("retainedBytes", size * 2);
+    return { visited, value: JSON.stringify(value) };
+  };
+  const before = snapshot(archive.package), after = snapshot(candidate);
+  let changed = before.value !== after.value;
+  for (const name of /* @__PURE__ */ new Set([...before.visited, ...after.visited])) {
+    budget.charge("work", 1);
+    let previous, next;
+    try {
+      previous = archive.package.getPart(name);
+      next = candidate.getPart(name);
+    } catch {
+      changed = true;
+      break;
+    }
+    budget.charge("work", previous.bytes.length + next.bytes.length);
+    if (previous.content_type !== next.content_type || previous.bytes.length !== next.bytes.length || previous.bytes.some((byte, i) => byte !== next.bytes[i])) {
+      changed = true;
+      break;
+    }
+  }
+  if (changed) throw new UnsupportedDiagramMutationError(await diagramDiagnosticLocation(input, part, [], budget));
+}
+
+export {
+  collectDiagramObservations,
+  diagramPartRoles,
+  diagramDiagnosticLocation,
+  UnsupportedDiagramMutationError,
+  inspectDocumentDiagrams,
+  assertDiagramXmlReplacement,
+  assertDiagramGraphReplacement
+};

package/dist/safe-bash/command-chunks/chunk-OIPATOZW.js

@@ -0,0 +1,154 @@
+import {
+  incomingResourceReferences,
+  measurePackageResourceSerialization
+} from "./chunk-W6DV2CLS.js";
+import {
+  validateDocxInvocation
+} from "./chunk-DE66JRWJ.js";
+import {
+  activeSettingsProtection
+} from "./chunk-TBAH4XGI.js";
+import {
+  documentPartRole
+} from "./chunk-DXX2Z2QA.js";
+import {
+  readDocumentArchive
+} from "./chunk-GLPIFP7N.js";
+import {
+  DocumentXmlEditor,
+  UnsupportedEditError,
+  activeXmlChildren
+} from "./chunk-YPVBU7QF.js";
+import {
+  storedBooleanValue
+} from "./chunk-VEUQWV2V.js";
+import {
+  compareInventoryNames
+} from "./chunk-2EUH5B6A.js";
+import {
+  MarkupCompatibility
+} from "./chunk-GZ2N24A2.js";
+import {
+  encodeGeneratedLocation
+} from "./chunk-LQOKYG3O.js";
+import {
+  parseDocumentXml,
+  parseMediaType
+} from "./chunk-MWAAMNAM.js";
+import {
+  InputTypeError,
+  archiveSettings
+} from "./chunk-IQFRPIXH.js";
+
+// packages/safe-bash-docx-engine/src/settings.ts
+var value = (node, name) => node.attributes.find((attribute) => attribute.namespace === node.namespace && attribute.localName === name)?.value;
+function booleanValue(node) {
+  if (!node) return null;
+  const stored = value(node, "val");
+  return stored === void 0 ? true : storedBooleanValue(stored);
+}
+async function inspectDocumentSettings(input, options, context, projection = "snapshot") {
+  if (projection !== "snapshot" && projection !== "resource") throw new InputTypeError("Expected a declared settings projection.");
+  const settings = archiveSettings(context), invocation = validateDocxInvocation({ operation: "settings.list", inputs: ["document"], options }, settings.budget);
+  const budget = settings.budget.lower(Object.fromEntries((invocation.options.limit ?? []).map((limit) => [limit.name, limit.value])));
+  if (!(input instanceof Uint8Array)) throw new InputTypeError("Expected archive bytes.");
+  budget.check("compressedInput", input.length);
+  budget.charge("retainedBytes", input.length);
+  const owned = new Uint8Array(input);
+  const archive = await readDocumentArchive(owned, { ...settings, budget });
+  budget.charge("work", input.length);
+  budget.charge("retainedBytes", input.length + 96);
+  const digest = await crypto.subtle.digest("SHA-256", owned);
+  const sourceSha256 = [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const records = [];
+  for (const part of archive.package.parts) {
+    budget.charge("work", 1);
+    if (parseMediaType(part.content_type) !== "application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml") continue;
+    const root = parseDocumentXml(part.bytes, {}, budget).root, native = documentPartRole(part.content_type, root) === "settings";
+    const view = new MarkupCompatibility(root, void 0, budget), entries = [], protection = [];
+    const activeProtection = native ? activeSettingsProtection(root, view, budget) : /* @__PURE__ */ new Set();
+    const active = activeXmlChildren(root, budget), rootChildren = active(root);
+    const stored = /* @__PURE__ */ new Set(), pending = rootChildren.filter((node) => native && node.namespace === root.namespace && ["compat", "updateFields", "embedTrueTypeFonts", "embedSystemFonts", "saveSubsetFonts", "documentProtection", "writeProtection", "evenAndOddHeaders"].includes(node.localName));
+    budget.charge("retainedBytes", pending.length * 8);
+    while (pending.length) {
+      const node = pending.pop(), children = active(node);
+      budget.charge("retainedBytes", 32 + children.length * 8);
+      stored.add(node);
+      for (const child of children) pending.push(child);
+    }
+    const singleton = (name) => {
+      budget.charge("work", rootChildren.length);
+      const matches = rootChildren.filter((node2) => native && node2.namespace === root.namespace && node2.localName === name);
+      const node = matches.length === 1 ? matches[0] : void 0;
+      return node && view.canEdit(node) && !node.children.length && !node.text.trim() && node.attributes.every((attribute) => attribute.namespace === "http://www.w3.org/2000/xmlns/" || attribute.namespace === node.namespace && attribute.localName === "val" && view.canEdit(attribute)) ? node : void 0;
+    };
+    const census = [];
+    budget.charge("retainedBytes", root.children.length * 40);
+    for (let index = root.children.length - 1; index >= 0; index--)
+      census.push({ node: root.children[index], path: [index] });
+    while (census.length) {
+      const { node, path } = census.pop();
+      budget.charge("work", node.attributes.length + node.children.length + 1);
+      const protectedNode = native && node.namespace === root.namespace && ["documentProtection", "writeProtection"].includes(node.localName);
+      const attributes = node.attributes.filter((attribute) => attribute.namespace !== "http://www.w3.org/2000/xmlns/" && (!protectedNode || attribute.namespace === node.namespace && ["edit", "enforcement", "recommended", "formatting"].includes(attribute.localName))).map((attribute) => ({ namespace: attribute.namespace, localName: attribute.localName, value: attribute.value })).sort((a, b) => a.namespace.localeCompare(b.namespace) || a.localName.localeCompare(b.localName));
+      budget.charge("retainedBytes", 128 + attributes.reduce((total, attribute) => total + 64 + (attribute.namespace.length + attribute.localName.length + attribute.value.length) * 2, 0));
+      entries.push({ path, namespace: node.namespace, localName: node.localName, attributes, status: stored.has(node) && node.namespace === root.namespace && view.canEdit(node) && node.attributes.every((attribute) => attribute.namespace === "http://www.w3.org/2000/xmlns/" || view.canEdit(attribute)) ? "stored" : "opaque" });
+      if (activeProtection.has(node)) {
+        const enforcement = value(node, "enforcement");
+        protection.push({ kind: node.localName, edit: value(node, "edit") ?? null, enforced: node.localName === "writeProtection" ? true : enforcement === void 0 ? false : storedBooleanValue(enforcement) });
+      }
+      budget.charge("retainedBytes", node.children.length * (32 + (path.length + 1) * 8));
+      for (let index = node.children.length - 1; index >= 0; index--)
+        census.push({ node: node.children[index], path: [...path, index] });
+    }
+    budget.check("matches", records.length + 1);
+    const locationValue = { version: 1, sourceSha256, generation: 0, part: part.partname, story: part.partname, path: [], range: null };
+    const location = { kind: "part", value: locationValue, token: encodeGeneratedLocation(locationValue), positions: {} };
+    budget.charge("retainedBytes", location.token.length * 4 + 256);
+    records.push({ kind: "settings", name: part.partname, location, properties: [], references: [], support: native ? "read" : "preserve", details: { kind: "settings", entries, updateFields: booleanValue(singleton("updateFields")), fontEmbedding: { embedTrueTypeFonts: booleanValue(singleton("embedTrueTypeFonts")), embedSystemFonts: booleanValue(singleton("embedSystemFonts")), saveSubsetFonts: booleanValue(singleton("saveSubsetFonts")) }, protection } });
+  }
+  records.sort((left, right) => compareInventoryNames(left.name, right.name));
+  const data = projection === "snapshot" ? { items: records } : { items: records.map((record) => {
+    const { details, ...item } = record;
+    const properties = [];
+    const scalar = (name, type, value2) => {
+      budget.charge("retainedBytes", 128 + name.length * 2 + (typeof value2 === "string" ? value2.length * 2 : 8));
+      properties.push({ name, type, value: value2, writable: false, cached: false });
+    };
+    scalar("updateFields", "boolean", details.updateFields);
+    for (const [name, value2] of Object.entries(details.fontEmbedding)) scalar(name, "boolean", value2);
+    scalar("entryCount", "integer", details.entries.length);
+    scalar("opaqueCount", "integer", details.entries.filter((entry) => entry.status === "opaque").length);
+    for (const entry of details.entries) {
+      const prefix = `settings[${entry.path.join(".")}]`;
+      scalar(prefix + ".namespace", "string", entry.namespace);
+      scalar(prefix + ".localName", "string", entry.localName);
+      scalar(prefix + ".status", "string", entry.status);
+      for (const [index, attribute] of entry.attributes.entries()) for (const [field, value2] of Object.entries(attribute)) scalar(`${prefix}.attributes[${index}].${field}`, "string", value2);
+    }
+    for (const [index, protection] of details.protection.entries()) {
+      scalar(`protection[${index}].kind`, "string", protection.kind);
+      scalar(`protection[${index}].enforced`, "boolean", protection.enforced);
+      scalar(`protection[${index}].edit`, "string", protection.edit);
+    }
+    return { ...item, properties, references: incomingResourceReferences(archive.package, record.name, budget) };
+  }) };
+  measurePackageResourceSerialization(data, budget);
+  return data;
+}
+function assertSettingsXmlReplacement(contentType, original, replacement, budget) {
+  if (parseMediaType(contentType) !== "application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml") return;
+  const before = new DocumentXmlEditor(original, {}, void 0, budget), after = new DocumentXmlEditor(replacement, {}, void 0, budget);
+  if (documentPartRole(contentType, before.root) !== "settings" || documentPartRole(contentType, after.root) !== "settings") throw new UnsupportedEditError("Affected settings root is unsupported.");
+  const remainder = (editor) => {
+    const fields = activeXmlChildren(editor, budget)(editor.root).filter((node) => node.namespace === editor.root.namespace && node.localName === "updateFields");
+    if (fields.length > 1 || fields.some((node) => !editor.compatibility.canEdit(node) || node.children.length || node.text.trim() || booleanValue(node) === null || node.attributes.some((attribute) => attribute.namespace !== "http://www.w3.org/2000/xmlns/" && (attribute.namespace !== node.namespace || attribute.localName !== "val" || !editor.compatibility.canEdit(attribute))))) throw new UnsupportedEditError("Affected field-update settings are unsupported.");
+    return editor.sourceXml(editor.root, new Map(fields.map((node) => [node, ""])));
+  };
+  if (remainder(before) !== remainder(after)) throw new UnsupportedEditError("Raw settings edits may change only field-update intent; preserve compatibility, font embedding and unknown settings.");
+}
+
+export {
+  inspectDocumentSettings,
+  assertSettingsXmlReplacement
+};