@portone/docx-editor 0.2.1 → 0.4.0

package/dist/docx/paraProps.js

@@ -1,26 +1,23 @@
 // src/docx/paraProps.ts
 import {
-  attrPairs,
   elementXml,
+  wAttrValue,
   withoutAttrs
 } from "../ooxml/element.js";
 import { wName } from "../ooxml/names.js";
 import { setAttr } from "../ooxml/precedence.js";
-import { childByLocalName, localPart } from "../ooxml/xml.js";
 import {
-  layerParagraphFormat,
-  layerRunFormat,
-  NO_STYLES,
-  paragraphStyleFormat,
-  readParagraphFormat
-} from "./formatting.js";
-import {
-  P_PR_ORDER,
+  childElement,
   parseProps,
-  parsePropsXml,
   renderProps,
-  setPropsChild
-} from "./propsXml.js";
+  setChild
+} from "../ooxml/props.js";
+import {
+  ST_DecimalNumber,
+  ST_SignedTwipsMeasure,
+  TWIPS_PER_PT
+} from "../ooxml/simpleTypes.js";
+import { LINE_UNITS_PER_LINE } from "./formatting.js";
 var LEFT_IND_ATTRS = ["left", "start", "leftChars", "startChars"];
 var LEFT_TWIPS_IND_ATTRS = ["left", "start"];
 var HANGING_IND_ATTRS = ["hanging", "hangingChars"];
@@ -29,15 +26,6 @@ var FIRST_LINE_IND_ATTRS = [
   "firstLine",
   "firstLineChars"
 ];
-function readParagraphProps(pPr, styles = NO_STYLES, defaultStyleId = null) {
-  const direct = pPr === null ? null : readParagraphFormat(parsePropsXml(pPr));
-  const style = paragraphStyleFormat(pPr, styles, defaultStyleId);
-  return layerParagraphFormat(style?.paragraph ?? {}, direct);
-}
-function readParagraphStyleRun(pPr, styles = NO_STYLES, defaultStyleId = null) {
-  const style = paragraphStyleFormat(pPr, styles, defaultStyleId);
-  return layerRunFormat(style?.run ?? {}, null);
-}
 function numPrXml(ref) {
   if (!ref) return null;
   return elementXml(
@@ -66,91 +54,75 @@ function indXml(attrs) {
 function nextIndXml(ind, change) {
   if (change.kind === "keep") return void 0;
   if (change.kind === "clearHanging") {
-    return indXml(withoutAttrs(attrPairs(ind), HANGING_IND_ATTRS));
+    return indXml(withoutAttrs(ind, HANGING_IND_ATTRS));
   }
   const dropped = [...LEFT_IND_ATTRS, ...FIRST_LINE_IND_ATTRS];
   return indXml([
     ...levelIndAttrs(change.indent),
-    ...withoutAttrs(attrPairs(ind), dropped)
+    ...withoutAttrs(ind, dropped)
   ]);
 }
-function leftIndAttrs(ind, leftTwips) {
-  const original = attrPairs(ind);
-  const slot = original.find(
-    ([name]) => LEFT_TWIPS_IND_ATTRS.includes(localPart(name))
-  )?.[0];
+function leftIndAttrs(original, leftTwips) {
+  const slot = LEFT_TWIPS_IND_ATTRS.find(
+    (name) => wAttrValue(original, name) !== null
+  );
   const written = leftTwips > 0 ? `${leftTwips}` : null;
   const kept = withoutAttrs(
     original,
-    LEFT_IND_ATTRS.filter(
-      (name) => slot === void 0 || name !== localPart(slot)
-    )
+    LEFT_IND_ATTRS.filter((name) => name !== slot)
   );
-  if (slot !== void 0) return setAttr(kept, "ind", localPart(slot), written);
+  if (slot !== void 0) return setAttr(kept, "ind", slot, written);
   return written === null ? kept : [[wName("left"), written], ...kept];
 }
 var EMPTY_P_PR = { tag: "w:pPr", attrs: null, children: [] };
-function editParagraphProps(pPr, styles, defaultStyleId, plan) {
+function editParagraphProps(pPr, plan) {
   const props = pPr === null ? EMPTY_P_PR : parseProps(pPr);
-  const element = pPr === null ? null : parsePropsXml(pPr);
-  if (!props || pPr !== null && !element) return null;
+  if (!props) return null;
+  const edits = plan(props);
+  if (!edits) return null;
   const rendered = renderProps(
-    plan(element).reduce(
-      (kept, [name, xml]) => setPropsChild(kept, name, xml, P_PR_ORDER),
-      props
-    )
+    edits.reduce((kept, [name, xml]) => setChild(kept, name, xml), props)
   );
-  const next = rendered === "" ? null : rendered;
-  return {
-    pPr: next,
-    format: readParagraphProps(next, styles, defaultStyleId),
-    styleRun: readParagraphStyleRun(next, styles, defaultStyleId)
-  };
+  return { pPr: rendered === "" ? null : rendered };
 }
-function withListNumbering(pPr, change, styles = NO_STYLES, defaultStyleId = null) {
-  return editParagraphProps(pPr, styles, defaultStyleId, (element) => {
-    const ind = nextIndXml(
-      element ? childByLocalName(element, "ind") : null,
-      change.indent
-    );
+function withListNumbering(pPr, change) {
+  return editParagraphProps(pPr, (props) => {
+    const current = childElement(props, "ind");
+    if (!current) return null;
+    const ind = nextIndXml(current.attrs, change.indent);
     const numPr = ["numPr", numPrXml(change.numbering)];
     return ind === void 0 ? [numPr] : [numPr, ["ind", ind]];
   });
 }
-function withLeftIndent(pPr, leftTwips, styles = NO_STYLES, defaultStyleId = null) {
-  return editParagraphProps(pPr, styles, defaultStyleId, (element) => {
-    const ind = element ? childByLocalName(element, "ind") : null;
-    return [["ind", indXml(leftIndAttrs(ind, leftTwips))]];
+function withLeftIndent(pPr, leftTwips) {
+  return editParagraphProps(pPr, (props) => {
+    const ind = childElement(props, "ind");
+    if (!ind) return null;
+    return [["ind", indXml(leftIndAttrs(ind.attrs, leftTwips))]];
   });
 }
 function spacingAttrs(spacing, edits) {
-  const changed = attrPairs(spacing).map(
-    ([name, value]) => [
-      name,
-      edits.find(([edited]) => edited === localPart(name))?.[1] ?? value
-    ]
-  );
   return edits.reduce(
     (attrs, [name, value]) => setAttr(attrs, "spacing", name, value),
-    changed
+    spacing
   );
 }
-function withLineSpacing(pPr, spacing, styles = NO_STYLES, defaultStyleId = null) {
-  const line = spacing.rule === "auto" ? Math.round(spacing.lines * 240) : Math.round(spacing.pt * 20);
-  return editParagraphProps(pPr, styles, defaultStyleId, (element) => {
-    const current = element ? childByLocalName(element, "spacing") : null;
-    const attrs = spacingAttrs(current, [
-      ["line", `${line}`],
+function withLineSpacing(pPr, spacing) {
+  const line = spacing.rule === "auto" ? ST_DecimalNumber.format(Math.round(spacing.lines * LINE_UNITS_PER_LINE)) : ST_SignedTwipsMeasure.format(Math.round(spacing.pt * TWIPS_PER_PT));
+  if (line === null) return null;
+  return editParagraphProps(pPr, (props) => {
+    const current = childElement(props, "spacing");
+    if (!current) return null;
+    const attrs = spacingAttrs(current.attrs, [
+      ["line", line],
       ["lineRule", spacing.rule]
     ]);
     return [["spacing", elementXml(wName("spacing"), attrs)]];
   });
 }
-function withParagraphStyle(pPr, styleId, styles = NO_STYLES, defaultStyleId = null) {
+function withParagraphStyle(pPr, styleId) {
   const pStyle = styleId === null ? null : elementXml(wName("pStyle"), [[wName("val"), styleId]]);
-  return editParagraphProps(pPr, styles, defaultStyleId, () => [
-    ["pStyle", pStyle]
-  ]);
+  return editParagraphProps(pPr, () => [["pStyle", pStyle]]);
 }
 var JC_BY_ALIGN = {
   left: "left",
@@ -158,12 +130,11 @@ var JC_BY_ALIGN = {
   right: "right",
   justify: "both"
 };
-function withParagraphAlign(pPr, align, styles = NO_STYLES, defaultStyleId = null) {
+function withParagraphAlign(pPr, align) {
   const jc = elementXml(wName("jc"), [[wName("val"), JC_BY_ALIGN[align]]]);
-  return editParagraphProps(pPr, styles, defaultStyleId, () => [["jc", jc]]);
+  return editParagraphProps(pPr, () => [["jc", jc]]);
 }
 export {
-  readParagraphProps,
   withLeftIndent,
   withLineSpacing,
   withListNumbering,

package/dist/docx/partPlan.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The contract every part an export writes beside the body is written under.
+ *
+ * A planner answers with the parts it rewrites, keyed by path, and declares what a part it adds
+ * needs through the two writers the context carries: a relationship from the main part and a
+ * content type. Those two parts are written once at the end from everything every planner asked
+ * for, so no planner writes either of them itself and none can write over what another declared.
+ */
+import type { Node as PMNode } from "prosemirror-model";
+import { type ContentTypeWriter } from "./packageParts";
+import { type RelationshipWriter } from "./relationships";
+import type { SessionStore } from "./session";
+export interface PartPlanContext {
+    readonly relationships: RelationshipWriter;
+    readonly contentTypes: ContentTypeWriter;
+}
+export interface PartPlanner {
+    readonly name: string;
+    /** The parts to write, keyed by path, and null when the document gives this planner nothing to write */
+    plan(doc: PMNode, session: SessionStore, context: PartPlanContext): ReadonlyMap<string, Uint8Array> | null;
+}
+/**
+ * Every part the planners write, folded into one map in planner order.
+ *
+ * The body and context-owned parts are reserved. Earlier writes include media planned before
+ * the body, so no later planner can overwrite those bytes either. Part names are compared
+ * without regard to case, as package part names are.
+ */
+export declare function runPartPlanners(planners: readonly PartPlanner[], doc: PMNode, session: SessionStore, context: PartPlanContext, prior?: ReadonlyMap<string, Uint8Array>): Map<string, Uint8Array>;
+/**
+ * Every rewritten XML part has to read back as XML, and a refusal names the part.
+ *
+ * The parts are spliced as text, so this is where a splice that cut in the wrong place shows up:
+ * before the package is repacked rather than when somebody opens it.
+ */
+export declare function assertPartsParse(replacements: ReadonlyMap<string, Uint8Array>, contentTypes?: Uint8Array): void;

package/dist/docx/partPlan.js

@@ -0,0 +1,59 @@
+// src/docx/partPlan.ts
+import { DocxExportError } from "../ooxml/errors.js";
+import { decodeUtf8, parseXml } from "../ooxml/xml.js";
+import {
+  CONTENT_TYPES_PATH,
+  declaredXmlParts
+} from "./packageParts.js";
+import { relsPathOf } from "./relationships.js";
+function runPartPlanners(planners, doc, session, context, prior = /* @__PURE__ */ new Map()) {
+  const owned = new Set(
+    [
+      CONTENT_TYPES_PATH,
+      relsPathOf(session.mainPartPath),
+      session.mainPartPath
+    ].map((path) => path.toLowerCase())
+  );
+  const parts = new Map(prior);
+  const written = new Set(
+    Array.from(prior.keys(), (path) => path.toLowerCase())
+  );
+  for (const planner of planners) {
+    for (const [path, bytes] of planner.plan(doc, session, context) ?? []) {
+      if (owned.has(path.toLowerCase())) {
+        throw new Error(
+          `the ${planner.name} planner wrote ${path}, which another export writer owns`
+        );
+      }
+      if (written.has(path.toLowerCase())) {
+        throw new Error(
+          `the ${planner.name} planner wrote ${path}, which an earlier writer wrote already`
+        );
+      }
+      parts.set(path, bytes);
+      written.add(path.toLowerCase());
+    }
+  }
+  return parts;
+}
+var XML_PART = /\.(?:xml|rels)$/i;
+function assertPartsParse(replacements, contentTypes) {
+  const paths = [...replacements.keys()];
+  const declared = contentTypes && paths.some((path) => !XML_PART.test(path)) ? declaredXmlParts(contentTypes, paths) : /* @__PURE__ */ new Set();
+  for (const [path, bytes] of replacements) {
+    if (!XML_PART.test(path) && !declared.has(path)) continue;
+    try {
+      parseXml(decodeUtf8(bytes).text);
+    } catch (cause) {
+      throw new DocxExportError(
+        "malformed-xml",
+        `${path} as written could not be parsed`,
+        { cause }
+      );
+    }
+  }
+}
+export {
+  assertPartsParse,
+  runPartPlanners
+};

package/dist/docx/protectionPolicy.d.ts

@@ -0,0 +1,127 @@
+/**
+ * What a protection level lets a change rewrite, as one value every side of the package reads.
+ *
+ * A level says three things: which parts of the package a change may write, what an entry in one
+ * of those parts may look like, and how the story reads once the markup the level is about is
+ * taken out of it. The part planners write those parts and the verifier judges them, and each
+ * carried its own copy of the first two with nothing but a test holding them together. Declaring
+ * them once means a part the writer starts adding is a part the verifier already knows.
+ *
+ * A level with no policy registered is one no file is judged under: `protectionPolicyFor` answers
+ * undefined, and a caller holding the level alone has nothing to run.
+ */
+import { type XmlParser } from "../ooxml/xml";
+import type { EditableComments, EditingProtection } from "../schema/protection";
+import { type DocxBytes } from "./importDocx";
+import type { SessionStore } from "./session";
+import { type Story } from "./storyProjection";
+/** One entry of a story part: the element read out of it, and its text for the byte-for-byte case */
+export interface StoryEntry {
+    el: Element;
+    xml: string;
+}
+/**
+ * How a part's entries are read.
+ *
+ * `arrived` is the reference a submission is held against rather than something to judge, so it
+ * takes what it can read and passes over the rest, leaving an entry standing on something
+ * unreadable to be judged as one that appeared. `submitted` is what is judged.
+ */
+export type EntryReading = "arrived" | "submitted";
+/** What a judgement may be told about the reader beyond the two documents */
+export interface PolicyOptions {
+    editableComments: EditableComments;
+}
+/** What a judgement over two files may be told beyond that */
+export interface VerifyOptions extends PolicyOptions {
+    xmlParser?: XmlParser;
+}
+/** One package part a protection lets an editor rewrite, and how a rewritten entry is judged */
+export interface StoryPartKind {
+    relType: string;
+    contentType: string;
+    /** Where the reader found this part, and null for a package that holds none */
+    pathIn(session: SessionStore): string | null;
+    /**
+     * Where the part goes when it is written: where it already sits, or the first name in the
+     * story's own folder that no part of the package has taken.
+     */
+    writePathIn(session: SessionStore): string;
+    /**
+     * The part's entries keyed by the id the story or a sibling part refers to them by, and null
+     * for a submitted part this editor's writer could not have put out at all.
+     */
+    entriesIn(session: SessionStore, reading: EntryReading): ReadonlyMap<string, StoryEntry> | null;
+    /**
+     * Whether the element the entries stand in came back as it left, save for the compatibility
+     * markup the writer declares on a part it writes a thread key into.
+     */
+    rootKept(before: SessionStore, after: SessionStore): boolean;
+    /** The keys this file still stands behind, which is what an entry has to be keyed by */
+    referents(story: Story): ReadonlySet<string>;
+    /** Grammar alone: whether the entry is one this editor's writer could have put out, whoever it belongs to */
+    wellFormed(entry: Element): boolean;
+    /**
+     * Whether the entry came back differing from the one that arrived in nothing but a change this
+     * protection leaves to everyone. Such an entry is nobody's rewrite, so it is held neither to
+     * the grammar this editor writes in nor to who owns it.
+     */
+    anyonesChange(entry: Element, original: Element): boolean;
+    /**
+     * Permission alone: whether `authorId` may have written (`original === null`) or rewritten this
+     * entry under `options`. `session` is the submission's, so a kind can look across at a sibling
+     * part, the way a comment's author resolves through the people part.
+     */
+    allowed(entry: Element, original: Element | null, authorId: string, options: PolicyOptions, session: SessionStore): boolean;
+}
+/** The two reasons the package comparison answers with, whatever the policy */
+export type PackageReason = "part-changed" | "relationship-changed";
+/**
+ * The shape every verdict takes: a story reason carries no part, a part reason names the part it
+ * was reached over. A public verdict keeps its own declaration and is one instance of this.
+ */
+export type ChangeVerdict<StoryReason extends string, PartReason extends string> = {
+    ok: true;
+} | {
+    ok: false;
+    reason: StoryReason;
+} | {
+    ok: false;
+    reason: PartReason;
+    part: string;
+};
+export interface ProtectionPolicy<StoryReason extends string, PartReason extends string> {
+    level: EditingProtection;
+    parts: readonly StoryPartKind[];
+    /** The reason a rewritten entry is refused under when no part takes it as well formed and allowed */
+    rejectedMarkup: PartReason;
+    /** Whether the story reads the same once this protection's own markup is taken out */
+    storyKept(before: Story, after: Story, authorId: string, options: PolicyOptions): ChangeVerdict<StoryReason, PartReason>;
+}
+/** Records the policy under its level and hands it back, so a module declares and registers at once */
+export declare function registerProtectionPolicy<S extends string, P extends string>(policy: ProtectionPolicy<S, P>): ProtectionPolicy<S, P>;
+/**
+ * The policy for a level, and undefined for a level no loaded module declares one for, `none` and
+ * `readOnly` among them.
+ */
+export declare function protectionPolicyFor(level: EditingProtection): ProtectionPolicy<string, string> | undefined;
+/**
+ * Whether the parts this protection lets an edit rewrite came back holding only entries this
+ * editor writes, each of them one this author was in a position to write.
+ *
+ * This runs after the story has been judged, so a comment rewritten, re-anchored or deleted by the
+ * wrong hand is already named for what it is. What is left to this is everything the story cannot
+ * show: markup forged into a body, an entry nothing refers to, an identity recorded for somebody
+ * else.
+ */
+export declare function partsKept<P extends string>(policy: ProtectionPolicy<string, P>, before: Story, after: Story, authorId: string, options: PolicyOptions): ChangeVerdict<never, P>;
+/**
+ * Whether the submitted file differs from the original in nothing this protection forbids.
+ *
+ * Both files are opened inside the one parser scope, so the parser named here is the parser both
+ * reads go through even though neither `importDocx` call is given it. The package is judged first,
+ * then the story, then the parts the policy excused from the package comparison: the parts are
+ * last so that an edit the wrong hand made is named for the edit rather than for the part it was
+ * written across.
+ */
+export declare function verifyChange<S extends string, P extends string>(policy: ProtectionPolicy<S, P>, original: DocxBytes, submitted: DocxBytes, authorId: string, { xmlParser, ...options }: VerifyOptions): ChangeVerdict<S, P | PackageReason>;

package/dist/docx/protectionPolicy.js

@@ -0,0 +1,169 @@
+// src/docx/protectionPolicy.ts
+import {
+  decodeUtf8,
+  elementChildren,
+  parseXml,
+  withXmlParser
+} from "../ooxml/xml.js";
+import { importDocx } from "./importDocx.js";
+import { CONTENT_TYPES_PATH } from "./packageParts.js";
+import {
+  readRelationships,
+  relsPathOf
+} from "./relationships.js";
+import { isModelledBlock } from "./storyProjection.js";
+var policies = /* @__PURE__ */ new Map();
+function registerProtectionPolicy(policy) {
+  policies.set(policy.level, policy);
+  return policy;
+}
+function protectionPolicyFor(level) {
+  return policies.get(level);
+}
+function sameBytes(before, after) {
+  return before.length === after.length && before.every((byte, index) => byte === after[index]);
+}
+function partPathsOf(policy, session) {
+  return policy.parts.map((kind) => kind.pathIn(session));
+}
+function excusedPaths(policy, session) {
+  return partPathsOf(policy, session).filter(
+    (path) => path !== null
+  );
+}
+function aroundTheStory(session) {
+  const preserved = session.blocks.filter((block) => !isModelledBlock(block.node)).map((block) => block.xml).join("");
+  return session.documentPrefix + preserved + session.documentSuffix;
+}
+function relationshipsKept(before, after, relTypes) {
+  if (new Set(before.map((entry) => entry.id)).size !== before.length || new Set(after.map((entry) => entry.id)).size !== after.length) {
+    return false;
+  }
+  const now = new Map(after.map((entry) => [entry.id, entry]));
+  const kept = before.every((entry) => {
+    const current = now.get(entry.id);
+    return current !== void 0 && current.type === entry.type && current.target === entry.target && current.external === entry.external;
+  });
+  const ids = new Set(before.map((entry) => entry.id));
+  const parts = after.filter((entry) => !entry.external);
+  return kept && after.filter((entry) => !ids.has(entry.id)).every(
+    (entry) => relTypes.includes(entry.type) && !entry.external && parts.filter((other) => other.type === entry.type).length === 1
+  );
+}
+function contentTypes(bytes) {
+  if (bytes === void 0) return /* @__PURE__ */ new Map();
+  const declared = /* @__PURE__ */ new Map();
+  for (const el of elementChildren(
+    parseXml(decodeUtf8(bytes).text).documentElement
+  )) {
+    const key = el.localName === "Default" ? el.getAttribute("Extension") : el.localName === "Override" ? el.getAttribute("PartName") : null;
+    if (key !== null) declared.set(key, el.getAttribute("ContentType") ?? "");
+  }
+  return declared;
+}
+function contentTypesKept(before, after, declarable) {
+  for (const [key, type] of before) {
+    if (after.get(key) !== type) return false;
+  }
+  for (const [key, type] of after) {
+    if (!before.has(key) && !declarable.includes(type)) return false;
+  }
+  return true;
+}
+function gainedPartsAreNew(policy, before, after) {
+  const had = partPathsOf(policy, before);
+  return partPathsOf(policy, after).every(
+    (path, kind) => path === null || path === had[kind] || !before.parts.has(path)
+  );
+}
+function packageKept(policy, before, after) {
+  if (before.mainPartPath !== after.mainPartPath) {
+    return { ok: false, reason: "part-changed", part: before.mainPartPath };
+  }
+  const relsPath = relsPathOf(before.mainPartPath);
+  const untouched = /* @__PURE__ */ new Set([
+    before.mainPartPath,
+    relsPath,
+    CONTENT_TYPES_PATH,
+    ...excusedPaths(policy, before),
+    ...excusedPaths(policy, after)
+  ]);
+  for (const path of /* @__PURE__ */ new Set([...before.parts.keys(), ...after.parts.keys()])) {
+    if (untouched.has(path)) continue;
+    const was = before.parts.get(path);
+    const now = after.parts.get(path);
+    if (was === void 0 || now === void 0 || !sameBytes(was, now)) {
+      return { ok: false, reason: "part-changed", part: path };
+    }
+  }
+  if (!relationshipsKept(
+    readRelationships(before.parts, relsPath),
+    readRelationships(after.parts, relsPath),
+    policy.parts.map((kind) => kind.relType)
+  ) || !gainedPartsAreNew(policy, before, after)) {
+    return { ok: false, reason: "relationship-changed", part: relsPath };
+  }
+  if (!contentTypesKept(
+    contentTypes(before.parts.get(CONTENT_TYPES_PATH)),
+    contentTypes(after.parts.get(CONTENT_TYPES_PATH)),
+    policy.parts.map((kind) => kind.contentType)
+  )) {
+    return { ok: false, reason: "part-changed", part: CONTENT_TYPES_PATH };
+  }
+  if (aroundTheStory(before) !== aroundTheStory(after)) {
+    return { ok: false, reason: "part-changed", part: before.mainPartPath };
+  }
+  return { ok: true };
+}
+function partKept(kind, before, after, authorId, options) {
+  const arrived = kind.entriesIn(before.session, "arrived") ?? /* @__PURE__ */ new Map();
+  const submitted = kind.entriesIn(after.session, "submitted");
+  if (submitted === null) return false;
+  if (!kind.rootKept(before.session, after.session)) return false;
+  const stoodBehindNow = kind.referents(after);
+  for (const [id, entry] of submitted) {
+    const original = arrived.get(id);
+    if (original && original.xml === entry.xml) continue;
+    if (!stoodBehindNow.has(id)) return false;
+    if (original && kind.anyonesChange(entry.el, original.el)) continue;
+    if (!kind.wellFormed(entry.el) || !kind.allowed(
+      entry.el,
+      original?.el ?? null,
+      authorId,
+      options,
+      after.session
+    )) {
+      return false;
+    }
+  }
+  const stoodBehindBefore = kind.referents(before);
+  return Array.from(arrived.keys()).every(
+    (id) => stoodBehindBefore.has(id) || submitted.has(id)
+  );
+}
+function partsKept(policy, before, after, authorId, options) {
+  for (const kind of policy.parts) {
+    const path = kind.pathIn(after.session) ?? kind.pathIn(before.session);
+    if (path === null) continue;
+    if (!partKept(kind, before, after, authorId, options)) {
+      return { ok: false, reason: policy.rejectedMarkup, part: path };
+    }
+  }
+  return { ok: true };
+}
+function verifyChange(policy, original, submitted, authorId, { xmlParser, ...options }) {
+  return withXmlParser(xmlParser, () => {
+    const before = importDocx(original);
+    const after = importDocx(submitted);
+    const packaged = packageKept(policy, before.session, after.session);
+    if (!packaged.ok) return packaged;
+    const story = policy.storyKept(before, after, authorId, options);
+    return story.ok ? partsKept(policy, before, after, authorId, options) : story;
+  });
+}
+export {
+  partsKept,
+  protectionPolicyFor,
+  registerProtectionPolicy,
+  verifyChange
+};

package/dist/docx/relationships.d.ts

@@ -20,7 +20,7 @@ export interface Relationship {
     /** Set when the target is a file outside the package */
     external: boolean;
 }
-export declare function readRelationships(parts: Map<string, Uint8Array>, relsPath: string): Relationship[];
+export declare function readRelationships(parts: ReadonlyMap<string, Uint8Array>, relsPath: string): Relationship[];
 /** A relationship an export puts in. The target is escaped here, so hand it in as it reads */
 export interface NewRelationship {
     type: string;

package/dist/docx/relationships.js

@@ -1,6 +1,6 @@
 // src/docx/relationships.ts
 import { elementXml } from "../ooxml/element.js";
-import { DocxExportError } from "../ooxml/errors.js";
+import { rootPrefixOf, splicePart } from "../ooxml/partSplice.js";
 import {
   decodeUtf8,
   elementChildren,
@@ -47,9 +47,9 @@ function takeRelId(taken) {
     }
   }
 }
-function relationshipXml(added) {
+function relationshipXml(added, prefix) {
   const mode = added.external ? [["TargetMode", "External"]] : [];
-  return elementXml("Relationship", [
+  return elementXml(`${prefix}Relationship`, [
     ["Id", added.id],
     ["Type", added.type],
     ["Target", added.target],
@@ -57,23 +57,18 @@ function relationshipXml(added) {
   ]);
 }
 function relationshipsPart(original, added) {
-  const entries = added.map(relationshipXml).join("");
   if (!original) {
+    const entries2 = added.map((entry) => relationshipXml(entry, "")).join("");
     return encodeUtf8(
-      `<?xml version="1.0" encoding="UTF-8" standalone="yes"?><Relationships xmlns="${RELATIONSHIPS_NS}">${entries}</Relationships>`,
+      `<?xml version="1.0" encoding="UTF-8" standalone="yes"?><Relationships xmlns="${RELATIONSHIPS_NS}">${entries2}</Relationships>`,
       false
     );
   }
   const { text, hadBom } = decodeUtf8(original);
-  const closing = text.lastIndexOf("</Relationships>");
-  if (closing === -1) {
-    throw new DocxExportError(
-      "malformed-xml",
-      "the relationships part has no closing tag"
-    );
-  }
+  const prefix = rootPrefixOf(text);
+  const entries = added.map((entry) => relationshipXml(entry, prefix)).join("");
   return encodeUtf8(
-    text.slice(0, closing) + entries + text.slice(closing),
+    splicePart(text, { root: "Relationships", append: entries }),
     hadBom
   );
 }