@stll/anonymize-docx 2.2.0 → 2.4.0

package/dist/index.mjs

@@ -1,5 +1,4 @@
-import { strToU8, unzipSync, zipSync } from "fflate";
-import { SaxesParser } from "saxes";
+import { loadNativeAnonymizeBinding } from "@stll/anonymize";
 //#region src/types.ts
 const DOCX_PART_TYPES = {
 	comments: "comments",
@@ -22,7 +21,8 @@ const DOCX_RESTORATION_ERROR_CODES = {
 	invalidPlaceholder: "invalid-placeholder",
 	invalidSession: "invalid-session",
 	restorationLimitExceeded: "restoration-limit-exceeded",
-	sessionMismatch: "session-mismatch"
+	sessionMismatch: "session-mismatch",
+	unsupportedDocument: "unsupported-document"
 };
 const DOCX_REWRITE_ERROR_CODES = {
 	invalidReplacement: "invalid-replacement",
@@ -45,47 +45,6 @@ const DOCX_ARCHIVE_MAX_BYTES = 64 * 1024 * 1024;
 const DOCX_ENTRY_MAX_BYTES = 16 * 1024 * 1024;
 const DOCX_UNCOMPRESSED_MAX_BYTES = 128 * 1024 * 1024;
 const DOCX_XML_MAX_DEPTH = 256;
-const DOCX_MAX_ENTRIES = 4096;
-const DOCX_MAX_TEXT_BLOCKS = 1e5;
-const DOCX_MAX_TEXT_SEGMENTS = 1e6;
-const DOCX_MAX_INLINE_CONTEXT_SCAN_OPS = 2e7;
-const CONTENT_TYPES_PATH = "[Content_Types].xml";
-const ROOT_RELATIONSHIPS_PATH = "_rels/.rels";
-const DOCX_CORE_PROPERTIES_PATH = "docProps/core.xml";
-const DOCX_APP_PROPERTIES_PATH = "docProps/app.xml";
-const DOCX_CUSTOM_PROPERTIES_PATH = "docProps/custom.xml";
-const CUSTOM_XML_DIRECTORY_PREFIX = "customXml/";
-const DOCPROPS_DIRECTORY_PREFIX = "docProps/";
-const METADATA_CONTENT_TYPES = /* @__PURE__ */ new Set([
-	"application/vnd.openxmlformats-package.core-properties+xml",
-	"application/vnd.openxmlformats-officedocument.extended-properties+xml",
-	"application/vnd.openxmlformats-officedocument.custom-properties+xml"
-]);
-const ABSOLUTE_URI_PATTERN = /^[a-z][a-z0-9+.-]*:/iu;
-const KNOWN_METADATA_CONTENT_TYPES = {
-	[DOCX_CORE_PROPERTIES_PATH]: "application/vnd.openxmlformats-package.core-properties+xml",
-	[DOCX_APP_PROPERTIES_PATH]: "application/vnd.openxmlformats-officedocument.extended-properties+xml",
-	[DOCX_CUSTOM_PROPERTIES_PATH]: "application/vnd.openxmlformats-officedocument.custom-properties+xml"
-};
-const GENERIC_XML_CONTENT_TYPE = "application/xml";
-const GENERIC_BINARY_CONTENT_TYPE = "application/octet-stream";
-const RELATIONSHIPS_CONTENT_TYPE = "application/vnd.openxmlformats-package.relationships+xml";
-const PII_RELATIONSHIP_TARGET_SCHEMES = ["mailto:", "tel:"];
-const CONTENT_TYPES_NAMESPACE = "http://schemas.openxmlformats.org/package/2006/content-types";
-const PACKAGE_RELATIONSHIP_NAMESPACES = /* @__PURE__ */ new Set(["http://purl.oclc.org/ooxml/package/relationships", "http://schemas.openxmlformats.org/package/2006/relationships"]);
-const WORDPROCESSING_CONTENT_TYPE_PREFIX = "application/vnd.openxmlformats-officedocument.wordprocessingml.";
-const SUPPORTED_CONTENT_TYPE_SUFFIXES = {
-	"comments+xml": DOCX_PART_TYPES.comments,
-	"document.main+xml": DOCX_PART_TYPES.mainDocument,
-	"endnotes+xml": DOCX_PART_TYPES.endnotes,
-	"footer+xml": DOCX_PART_TYPES.footer,
-	"footnotes+xml": DOCX_PART_TYPES.footnotes,
-	"header+xml": DOCX_PART_TYPES.header
-};
-const WORDPROCESSING_NAMESPACES$1 = /* @__PURE__ */ new Set(["http://purl.oclc.org/ooxml/wordprocessingml/main", "http://schemas.openxmlformats.org/wordprocessingml/2006/main"]);
-const RELATIONSHIP_NAMESPACES = /* @__PURE__ */ new Set(["http://purl.oclc.org/ooxml/officeDocument/relationships", "http://schemas.openxmlformats.org/officeDocument/2006/relationships"]);
-const OFFICE_DOCUMENT_RELATIONSHIP_TYPES = new Set([...RELATIONSHIP_NAMESPACES].map((namespace) => `${namespace}/officeDocument`));
-const MARKUP_COMPATIBILITY_NAMESPACES = /* @__PURE__ */ new Set(["http://purl.oclc.org/ooxml/markup-compatibility/main", "http://schemas.openxmlformats.org/markup-compatibility/2006"]);
 var DocxExtractionError = class extends Error {
 	code;
 	constructor(code, message) {
@@ -94,526 +53,26 @@ var DocxExtractionError = class extends Error {
 		this.code = code;
 	}
 };
-const invalidPackage = (message) => new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidPackage, message);
-const assertXmlDepth = (depth) => {
-	if (depth < 256) return;
-	throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX XML must not exceed 256 nested elements`);
-};
-const safeEntryPath = (name) => name.length > 0 && !name.startsWith("/") && !name.includes("\\") && !name.split("/").includes("..") && !name.includes("\0");
-const RELATIONSHIPS_ENTRY_PATTERN = /(?:^|\/)_rels\/[^/]+\.rels$/u;
-const isRelationshipsEntry = (name) => name === ROOT_RELATIONSHIPS_PATH || RELATIONSHIPS_ENTRY_PATTERN.test(name);
-const isCustomXmlEntry = (name) => name.startsWith(CUSTOM_XML_DIRECTORY_PREFIX) && name.endsWith(".xml");
-const archiveFilter = ({ budget, file, includeAllEntries }) => {
-	budget.entryCount += 1;
-	if (budget.entryCount > DOCX_MAX_ENTRIES) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX archives must contain at most ${DOCX_MAX_ENTRIES} entries`);
-	if (!safeEntryPath(file.name)) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.unsafeEntryPath, "DOCX archive contains an unsafe entry path");
-	if (file.originalSize > 16777216) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX entries must not exceed ${DOCX_ENTRY_MAX_BYTES} bytes`);
-	budget.uncompressedBytes += file.originalSize;
-	if (budget.uncompressedBytes > 134217728) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX archives must not exceed ${DOCX_UNCOMPRESSED_MAX_BYTES} uncompressed bytes`);
-	return includeAllEntries || file.name === CONTENT_TYPES_PATH || file.name.startsWith("word/") && file.name.endsWith(".xml") || isRelationshipsEntry(file.name) || file.name.startsWith(DOCPROPS_DIRECTORY_PREFIX) || isCustomXmlEntry(file.name);
-};
-const unzipDocxArchive = (archive, includeAllEntries = false, onSkippedEntry) => {
-	if (archive.byteLength > 67108864) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.archiveLimitExceeded, `DOCX archives must not exceed ${DOCX_ARCHIVE_MAX_BYTES} bytes`);
-	const budget = {
-		entryCount: 0,
-		uncompressedBytes: 0
-	};
-	try {
-		return unzipSync(archive, { filter: (file) => {
-			const keep = archiveFilter({
-				budget,
-				file,
-				includeAllEntries
-			});
-			if (!keep) onSkippedEntry?.(file.name);
-			return keep;
-		} });
-	} catch (error) {
-		if (error instanceof DocxExtractionError) throw error;
-		throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidArchive, "Input is not a valid bounded DOCX ZIP archive");
-	}
-};
-const decodeXml = (bytes, path) => {
-	try {
-		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-	} catch {
-		throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidXml, `DOCX XML part is not valid UTF-8: ${path}`);
-	}
-};
-const attributeByLocalName = (tag, localName, namespaces) => {
-	for (const attribute of Object.values(tag.attributes)) if (attribute.local === localName && (namespaces === void 0 || namespaces.has(attribute.uri))) return attribute.value;
-	return null;
-};
-const parseContentTypes = (xml) => {
-	const parts = [];
-	const paths = /* @__PURE__ */ new Set();
-	const parser = new SaxesParser({ xmlns: true });
-	let parseError = null;
-	let depth = 0;
-	parser.on("error", (error) => {
-		parseError = error;
-	});
-	parser.on("doctype", () => {
-		throw invalidPackage("DOCX XML must not contain a document type declaration");
-	});
-	parser.on("opentag", (tag) => {
-		assertXmlDepth(depth);
-		depth += 1;
-		if (tag.local !== "Override" || tag.uri !== CONTENT_TYPES_NAMESPACE) return;
-		const rawPath = attributeByLocalName(tag, "PartName");
-		const contentType = attributeByLocalName(tag, "ContentType");
-		if (rawPath === null || contentType === null) throw invalidPackage("DOCX content-type override is incomplete");
-		const path = rawPath.startsWith("/") ? rawPath.slice(1) : rawPath;
-		if (!safeEntryPath(path)) throw invalidPackage("DOCX content-type override has an unsafe path");
-		if (paths.has(path)) throw invalidPackage("DOCX content-type overrides must have unique paths");
-		paths.add(path);
-		parts.push({
-			path,
-			contentType
-		});
-	});
-	parser.on("closetag", () => {
-		depth -= 1;
-	});
-	try {
-		parser.write(xml).close();
-	} catch (error) {
-		if (error instanceof DocxExtractionError) throw error;
-		parseError = error instanceof Error ? error : /* @__PURE__ */ new Error("invalid XML");
-	}
-	if (parseError !== null) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidXml, "DOCX content types are not valid XML");
-	return parts;
-};
-const parseMainDocumentTarget = (xml) => {
-	const targets = [];
-	const parser = new SaxesParser({ xmlns: true });
-	let parseError = null;
-	let depth = 0;
-	parser.on("error", (error) => {
-		parseError = error;
-	});
-	parser.on("doctype", () => {
-		throw invalidPackage("DOCX XML must not contain a document type declaration");
-	});
-	parser.on("opentag", (tag) => {
-		assertXmlDepth(depth);
-		depth += 1;
-		if (tag.local !== "Relationship" || !PACKAGE_RELATIONSHIP_NAMESPACES.has(tag.uri)) return;
-		const type = attributeByLocalName(tag, "Type");
-		if (type === null || !OFFICE_DOCUMENT_RELATIONSHIP_TYPES.has(type)) return;
-		const targetMode = attributeByLocalName(tag, "TargetMode");
-		const rawTarget = attributeByLocalName(tag, "Target");
-		if (targetMode === "External" || rawTarget === null) throw invalidPackage("DOCX main-document relationship must be internal");
-		const target = rawTarget.startsWith("/") ? rawTarget.slice(1) : rawTarget;
-		if (!safeEntryPath(target) || target.includes(":")) throw invalidPackage("DOCX main-document relationship has an unsafe target");
-		targets.push(target);
-	});
-	parser.on("closetag", () => {
-		depth -= 1;
-	});
-	try {
-		parser.write(xml).close();
-	} catch (error) {
-		if (error instanceof DocxExtractionError) throw error;
-		parseError = error instanceof Error ? error : /* @__PURE__ */ new Error("invalid XML");
-	}
-	if (parseError !== null) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidXml, "DOCX root relationships are not valid XML");
-	if (targets.length !== 1) throw invalidPackage("DOCX archive must contain exactly one main-document relationship");
-	const target = targets.at(0);
-	if (target === void 0) throw invalidPackage("DOCX main-document relationship is unavailable");
-	return target;
-};
-const hasPiiRelationshipTargetScheme = (target) => {
-	const normalized = target.trim().toLowerCase();
-	return PII_RELATIONSHIP_TARGET_SCHEMES.some((scheme) => normalized.startsWith(scheme));
-};
-const isExternalRelationshipTarget = (target, targetMode) => {
-	const normalized = target.trim();
-	return targetMode?.trim().toLowerCase() === "external" || ABSOLUTE_URI_PATTERN.test(normalized) || normalized.startsWith("//");
-};
-const PII_SCHEME_TARGET_REASON = "target uses a PII-bearing external scheme (mailto/tel) that anonymization does not redact";
-const EXTERNAL_TARGET_REASON = "target is external and is not examined or redacted by anonymization";
-const DANGLING_TARGET_REASON = "target does not resolve to a package part and is not examined or redacted by anonymization";
-const relationshipBaseDirectory = (relsPath) => {
-	const marker = relsPath.lastIndexOf("_rels/");
-	return marker <= 0 ? "" : relsPath.slice(0, marker);
-};
-const decodeOpcTarget = (target) => {
-	try {
-		return decodeURIComponent(target);
-	} catch {
-		return null;
-	}
-};
-const normalizeOpcPath = (path) => {
-	const segments = [];
-	for (const segment of path.split("/")) {
-		if (segment === "" || segment === ".") continue;
-		if (segment === "..") {
-			if (segments.length === 0) return null;
-			segments.pop();
-			continue;
-		}
-		segments.push(segment);
-	}
-	return segments.length === 0 ? null : segments.join("/");
-};
-const resolveInternalRelationshipTarget = (target, relsPath) => {
-	const decoded = decodeOpcTarget(target.trim());
-	if (decoded === null || decoded === "") return null;
-	if (decoded.startsWith("/")) return normalizeOpcPath(decoded.slice(1));
-	return normalizeOpcPath(`${relationshipBaseDirectory(relsPath)}${decoded}`);
-};
-const parseUncoveredRelationshipTargets = ({ xml, relsPath: path, knownEntryPaths }) => {
-	const found = [];
-	const parser = new SaxesParser({ xmlns: true });
-	let parseError = null;
-	let depth = 0;
-	parser.on("error", (error) => {
-		parseError = error;
-	});
-	parser.on("doctype", () => {
-		throw invalidPackage("DOCX XML must not contain a document type declaration");
-	});
-	parser.on("opentag", (tag) => {
-		assertXmlDepth(depth);
-		depth += 1;
-		if (tag.local !== "Relationship" || !PACKAGE_RELATIONSHIP_NAMESPACES.has(tag.uri)) return;
-		const target = attributeByLocalName(tag, "Target");
-		if (target === null) return;
-		const targetMode = attributeByLocalName(tag, "TargetMode");
-		if (hasPiiRelationshipTargetScheme(target)) {
-			found.push({
-				relationshipId: attributeByLocalName(tag, "Id"),
-				reason: PII_SCHEME_TARGET_REASON
-			});
-			return;
-		}
-		if (isExternalRelationshipTarget(target, targetMode)) {
-			found.push({
-				relationshipId: attributeByLocalName(tag, "Id"),
-				reason: EXTERNAL_TARGET_REASON
-			});
-			return;
-		}
-		const resolved = resolveInternalRelationshipTarget(target, path);
-		if (resolved === null || !knownEntryPaths.has(resolved.toLowerCase())) found.push({
-			relationshipId: attributeByLocalName(tag, "Id"),
-			reason: DANGLING_TARGET_REASON
-		});
-	});
-	parser.on("closetag", () => {
-		depth -= 1;
-	});
-	try {
-		parser.write(xml).close();
-	} catch (error) {
-		if (error instanceof DocxExtractionError) throw error;
-		parseError = error instanceof Error ? error : /* @__PURE__ */ new Error("invalid XML");
-	}
-	if (parseError !== null) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidXml, `DOCX relationships are not valid XML: ${path}`);
-	return found;
-};
-const classifyPart = ({ contentType, path }) => {
-	if (!contentType.startsWith(WORDPROCESSING_CONTENT_TYPE_PREFIX)) return null;
-	const suffix = contentType.slice(63);
-	const type = SUPPORTED_CONTENT_TYPE_SUFFIXES[suffix];
-	return type === void 0 ? null : {
-		type,
-		path
-	};
-};
-const isWordTag = (tag, local) => tag.local === local && WORDPROCESSING_NAMESPACES$1.has(tag.uri);
-const frameByLocalName = (stack, local) => {
-	for (let index = stack.length - 1; index >= 0; index -= 1) {
-		const frame = stack.at(index);
-		if (frame !== void 0 && isWordTag(frame.tag, local)) return frame;
-	}
-	return null;
-};
-const blockLocation = (part, blockIndex, paragraphPath, stack) => {
-	const textBox = frameByLocalName(stack, "txbxContent");
-	if (textBox !== null) return {
-		type: "text-box-paragraph",
-		part,
-		blockIndex,
-		xmlPath: paragraphPath,
-		textBoxPath: textBox.path
-	};
-	const cell = frameByLocalName(stack, "tc");
-	const row = frameByLocalName(stack, "tr");
-	const table = frameByLocalName(stack, "tbl");
-	if (cell !== null && row !== null && table !== null) return {
-		type: "table-cell-paragraph",
-		part,
-		blockIndex,
-		xmlPath: paragraphPath,
-		tablePath: table.path,
-		rowPath: row.path,
-		cellPath: cell.path
-	};
-	return {
-		type: "paragraph",
-		part,
-		blockIndex,
-		xmlPath: paragraphPath
-	};
-};
-const revisionForTag = (tag) => {
-	if (!WORDPROCESSING_NAMESPACES$1.has(tag.uri)) return null;
-	const revision = {
-		del: "deletion",
-		ins: "insertion",
-		moveFrom: "move-from",
-		moveTo: "move-to"
-	}[tag.local];
-	return revision === void 0 ? null : {
-		type: "revision",
-		revision
-	};
-};
-const inlineContexts = (stack) => {
-	const contexts = [];
-	for (const { tag } of stack) {
-		if (isWordTag(tag, "hyperlink")) contexts.push({
-			type: "hyperlink",
-			relationshipId: attributeByLocalName(tag, "id", RELATIONSHIP_NAMESPACES),
-			anchor: attributeByLocalName(tag, "anchor", WORDPROCESSING_NAMESPACES$1)
-		});
-		const revision = revisionForTag(tag);
-		if (revision !== null) contexts.push(revision);
-	}
-	return contexts;
+const nativeExtractionErrorCode = (message) => {
+	if (message.includes("unsafe entry path")) return DOCX_EXTRACTION_ERROR_CODES.unsafeEntryPath;
+	if (message.includes("valid bounded DOCX ZIP archive")) return DOCX_EXTRACTION_ERROR_CODES.invalidArchive;
+	if (message.includes("valid XML") || message.includes("valid UTF-8")) return DOCX_EXTRACTION_ERROR_CODES.invalidXml;
+	if (message.includes(`DOCX archives must not exceed 67108864 bytes`)) return DOCX_EXTRACTION_ERROR_CODES.archiveLimitExceeded;
+	if (message.includes("must not exceed") || message.includes("must not contain more than") || message.includes("at most")) return DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded;
+	return DOCX_EXTRACTION_ERROR_CODES.invalidPackage;
 };
-const appendSegment = (block, budget, value, source, path, stack) => {
-	if (value.length === 0) return;
-	if (budget.segmentCount >= DOCX_MAX_TEXT_SEGMENTS) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX archives must not contain more than ${DOCX_MAX_TEXT_SEGMENTS} text segments`);
-	budget.segmentCount += 1;
-	if (budget.inlineContextScanOps + stack.length > DOCX_MAX_INLINE_CONTEXT_SCAN_OPS) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX archives must not require more than ${DOCX_MAX_INLINE_CONTEXT_SCAN_OPS} aggregate inline-context scan operations`);
-	budget.inlineContextScanOps += stack.length;
-	const start = block.text.length;
-	block.text += value;
-	block.segments.push({
-		start,
-		end: block.text.length,
-		source,
-		contexts: inlineContexts(stack),
-		xmlPath: path
-	});
-};
-const extractPart = (part, xml, textBudget) => {
-	const blocks = [];
-	const stack = [];
-	const blockStack = [];
-	let nextBlockIndex = 0;
-	let currentText = "";
-	let currentTextPath = null;
-	let parseError = null;
-	let unsupportedSymbolCount = 0;
-	let unsupportedFieldInstructionCount = 0;
-	let unsupportedAlternateContentCount = 0;
-	const parser = new SaxesParser({ xmlns: true });
-	parser.on("error", (error) => {
-		parseError = error;
-	});
-	parser.on("doctype", () => {
-		throw invalidPackage("DOCX XML must not contain a document type declaration");
-	});
-	parser.on("opentag", (tag) => {
-		assertXmlDepth(stack.length);
-		const parent = stack.at(-1);
-		const childIndex = parent?.nextChildIndex ?? 0;
-		if (parent !== void 0) parent.nextChildIndex += 1;
-		const path = [...parent?.path ?? [], childIndex];
-		if (isWordTag(tag, "p")) {
-			if (nextBlockIndex >= DOCX_MAX_TEXT_BLOCKS) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX parts must not contain more than ${DOCX_MAX_TEXT_BLOCKS} text blocks`);
-			blockStack.push({
-				text: "",
-				segments: [],
-				location: blockLocation(part, nextBlockIndex, path, stack)
-			});
-			nextBlockIndex += 1;
-		}
-		stack.push({
-			tag,
-			path,
-			nextChildIndex: 0
-		});
-		if (isWordTag(tag, "t") || isWordTag(tag, "delText")) {
-			currentText = "";
-			currentTextPath = path;
-		}
-		const currentBlock = blockStack.at(-1);
-		if (currentBlock !== void 0 && isWordTag(tag, "tab")) appendSegment(currentBlock, textBudget, "	", "tab", path, stack);
-		if (currentBlock !== void 0 && (isWordTag(tag, "br") || isWordTag(tag, "cr"))) appendSegment(currentBlock, textBudget, "\n", "break", path, stack);
-		if (isWordTag(tag, "sym")) unsupportedSymbolCount += 1;
-		if (isWordTag(tag, "instrText") || isWordTag(tag, "fldSimple")) unsupportedFieldInstructionCount += 1;
-		if (tag.local === "AlternateContent" && MARKUP_COMPATIBILITY_NAMESPACES.has(tag.uri)) unsupportedAlternateContentCount += 1;
-	});
-	parser.on("text", (text) => {
-		if (currentTextPath !== null) currentText += text;
-	});
-	parser.on("cdata", (text) => {
-		if (currentTextPath !== null) currentText += text;
-	});
-	parser.on("closetag", (tag) => {
-		const frame = stack.at(-1);
-		if (frame === void 0 || frame.tag !== tag) throw invalidPackage("DOCX XML element stack is inconsistent");
-		if (currentTextPath !== null && (isWordTag(tag, "t") || isWordTag(tag, "delText"))) {
-			const currentBlock = blockStack.at(-1);
-			if (currentBlock === void 0) {
-				if (currentText.length > 0) throw invalidPackage("DOCX text is outside a paragraph");
-			} else appendSegment(currentBlock, textBudget, currentText, "text", currentTextPath, stack);
-			currentText = "";
-			currentTextPath = null;
-		}
-		if (isWordTag(tag, "p")) {
-			const completedBlock = blockStack.pop();
-			if (completedBlock === void 0) throw invalidPackage("DOCX paragraph state is unavailable");
-			blocks.push(completedBlock);
-		}
-		stack.pop();
-	});
+const extractDocxText = (archive) => {
+	const extract = loadNativeAnonymizeBinding().extractDocxTextJson;
+	if (extract === void 0) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidPackage, "Native anonymize binding does not expose DOCX extraction");
 	try {
-		parser.write(xml).close();
+		return JSON.parse(extract(archive));
 	} catch (error) {
-		if (error instanceof DocxExtractionError) throw error;
-		parseError = error instanceof Error ? error : /* @__PURE__ */ new Error("invalid XML");
-	}
-	if (parseError !== null) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.invalidXml, `DOCX part is not valid XML: ${part.path}`);
-	blocks.sort((left, right) => left.location.blockIndex - right.location.blockIndex);
-	let hyperlinkTextSegmentCount = 0;
-	let revisionTextSegmentCount = 0;
-	for (const { segments } of blocks) for (const { contexts } of segments) {
-		if (contexts.some((context) => context.type === "hyperlink")) hyperlinkTextSegmentCount += 1;
-		if (contexts.some((context) => context.type === "revision")) revisionTextSegmentCount += 1;
-	}
-	return {
-		blocks,
-		hyperlinkTextSegmentCount,
-		revisionTextSegmentCount,
-		unsupportedAlternateContentCount,
-		unsupportedSymbolCount,
-		unsupportedFieldInstructionCount
-	};
-};
-const extractDocxText = (archive) => {
-	const skippedEntryPaths = [];
-	const entries = unzipDocxArchive(archive, false, (name) => {
-		skippedEntryPaths.push(name);
-	});
-	const contentTypesBytes = entries[CONTENT_TYPES_PATH];
-	if (contentTypesBytes === void 0) throw invalidPackage("DOCX archive is missing [Content_Types].xml");
-	const contentTypes = parseContentTypes(decodeXml(contentTypesBytes, CONTENT_TYPES_PATH));
-	const rootRelationshipsBytes = entries[ROOT_RELATIONSHIPS_PATH];
-	if (rootRelationshipsBytes === void 0) throw invalidPackage("DOCX archive is missing _rels/.rels");
-	const mainDocumentTarget = parseMainDocumentTarget(decodeXml(rootRelationshipsBytes, ROOT_RELATIONSHIPS_PATH));
-	const supportedParts = contentTypes.map(classifyPart).filter((part) => part !== null);
-	if (supportedParts.filter((part) => part.type === DOCX_PART_TYPES.mainDocument).length !== 1) throw invalidPackage("DOCX archive must contain exactly one main document");
-	if (supportedParts.find((part) => part.type === DOCX_PART_TYPES.mainDocument)?.path !== mainDocumentTarget) throw invalidPackage("DOCX main-document relationship and content type do not agree");
-	const blocks = [];
-	const coverageParts = [];
-	let hyperlinkTextSegmentCount = 0;
-	let revisionTextSegmentCount = 0;
-	let unsupportedSymbolCount = 0;
-	let unsupportedFieldInstructionCount = 0;
-	let unsupportedAlternateContentCount = 0;
-	const textBudget = {
-		segmentCount: 0,
-		inlineContextScanOps: 0
-	};
-	for (const part of supportedParts) {
-		const bytes = entries[part.path];
-		if (bytes === void 0) throw invalidPackage(`DOCX archive is missing declared part: ${part.path}`);
-		const extracted = extractPart(part, decodeXml(bytes, part.path), textBudget);
-		if (blocks.length + extracted.blocks.length > DOCX_MAX_TEXT_BLOCKS) throw new DocxExtractionError(DOCX_EXTRACTION_ERROR_CODES.uncompressedLimitExceeded, `DOCX archives must not contain more than ${DOCX_MAX_TEXT_BLOCKS} text blocks`);
-		blocks.push(...extracted.blocks);
-		coverageParts.push({
-			status: "extracted",
-			part,
-			blockCount: extracted.blocks.length
-		});
-		hyperlinkTextSegmentCount += extracted.hyperlinkTextSegmentCount;
-		revisionTextSegmentCount += extracted.revisionTextSegmentCount;
-		unsupportedSymbolCount += extracted.unsupportedSymbolCount;
-		unsupportedFieldInstructionCount += extracted.unsupportedFieldInstructionCount;
-		unsupportedAlternateContentCount += extracted.unsupportedAlternateContentCount;
-	}
-	const knownEntryPaths = new Set([...Object.keys(entries), ...skippedEntryPaths].map((name) => name.toLowerCase()));
-	for (const [relsPath, relsBytes] of Object.entries(entries)) {
-		if (!isRelationshipsEntry(relsPath)) continue;
-		const uncoveredTargets = parseUncoveredRelationshipTargets({
-			xml: decodeXml(relsBytes, relsPath),
-			relsPath,
-			knownEntryPaths
-		});
-		for (const uncovered of uncoveredTargets) coverageParts.push({
-			status: "unsupported",
-			path: relsPath,
-			contentType: RELATIONSHIPS_CONTENT_TYPE,
-			reason: uncovered.relationshipId === null ? `Relationship ${uncovered.reason}` : `Relationship "${uncovered.relationshipId}" ${uncovered.reason}`
-		});
-	}
-	const coveredPaths = /* @__PURE__ */ new Set([CONTENT_TYPES_PATH, ...supportedParts.map((part) => part.path)]);
-	const overrideContentTypes = new Map(contentTypes.map((entry) => [entry.path, entry.contentType]));
-	const markUnsupported = (path, contentType, reason) => {
-		if (coveredPaths.has(path)) return;
-		coveredPaths.add(path);
-		coverageParts.push({
-			status: "unsupported",
-			path,
-			contentType,
-			reason
-		});
-	};
-	for (const path of Object.keys(entries)) if (path.startsWith(DOCPROPS_DIRECTORY_PREFIX)) markUnsupported(path, overrideContentTypes.get(path) ?? KNOWN_METADATA_CONTENT_TYPES[path] ?? GENERIC_XML_CONTENT_TYPE, "Document metadata parts are not extracted or redacted");
-	else if (isCustomXmlEntry(path)) markUnsupported(path, overrideContentTypes.get(path) ?? GENERIC_XML_CONTENT_TYPE, "Custom XML parts are not extracted or redacted");
-	for (const { contentType, path } of contentTypes) {
-		if (contentType === RELATIONSHIPS_CONTENT_TYPE || isRelationshipsEntry(path)) continue;
-		if (METADATA_CONTENT_TYPES.has(contentType)) {
-			markUnsupported(path, contentType, "Document metadata parts are not extracted or redacted");
-			continue;
-		}
-		if (contentType.startsWith(WORDPROCESSING_CONTENT_TYPE_PREFIX)) {
-			markUnsupported(path, contentType, "WordprocessingML part type is not extracted");
-			continue;
-		}
-		markUnsupported(path, contentType, "Package part type is not extracted or redacted");
-	}
-	for (const path of [...Object.keys(entries), ...skippedEntryPaths]) {
-		if (path.endsWith("/") || isRelationshipsEntry(path)) continue;
-		markUnsupported(path, overrideContentTypes.get(path) ?? (path.endsWith(".xml") ? GENERIC_XML_CONTENT_TYPE : GENERIC_BINARY_CONTENT_TYPE), "Package part is not examined by anonymization");
+		const message = error instanceof Error ? error.message : "DOCX extraction failed";
+		throw new DocxExtractionError(nativeExtractionErrorCode(message), message);
 	}
-	return {
-		contractVersion: 1,
-		blocks,
-		coverage: {
-			parts: coverageParts,
-			hyperlinkTextSegmentCount,
-			revisionTextSegmentCount,
-			unsupportedAlternateContentCount,
-			unsupportedSymbolCount,
-			unsupportedFieldInstructionCount
-		}
-	};
 };
 //#endregion
-//#region src/location.ts
-const arraysEqual = (left, right) => left.length === right.length && left.every((value, index) => value === right.at(index));
-const docxLocationsEqual = (left, right) => {
-	if (left.type !== right.type || left.part.type !== right.part.type || left.part.path !== right.part.path || left.blockIndex !== right.blockIndex || !arraysEqual(left.xmlPath, right.xmlPath)) return false;
-	if (left.type === "paragraph" && right.type === "paragraph") return true;
-	if (left.type === "table-cell-paragraph" && right.type === "table-cell-paragraph") return arraysEqual(left.tablePath, right.tablePath) && arraysEqual(left.rowPath, right.rowPath) && arraysEqual(left.cellPath, right.cellPath);
-	if (left.type === "text-box-paragraph" && right.type === "text-box-paragraph") return arraysEqual(left.textBoxPath, right.textBoxPath);
-	return false;
-};
-const docxLocationKey = ({ blockIndex, part }) => `${part.path}\0${blockIndex}`;
-//#endregion
 //#region src/rewrite.ts
-const WORDPROCESSING_NAMESPACES = /* @__PURE__ */ new Set(["http://purl.oclc.org/ooxml/wordprocessingml/main", "http://schemas.openxmlformats.org/wordprocessingml/2006/main"]);
-const XML_NAMESPACE = "http://www.w3.org/XML/1998/namespace";
-const DOCX_MAX_REPLACEMENTS = 1e6;
-const SIGNATURE_PART_PREFIX = "_xmlsignatures/";
 var DocxRewriteError = class extends Error {
 	code;
 	constructor(code, message) {
@@ -622,261 +81,110 @@ var DocxRewriteError = class extends Error {
 		this.code = code;
 	}
 };
-const rewriteError = (code, message) => new DocxRewriteError(code, message);
-const pathKey = (path) => path.join(".");
-const isValidXmlText = (value) => {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0);
-		if (codePoint === void 0 || codePoint !== 9 && codePoint !== 10 && codePoint !== 13 && (codePoint < 32 || codePoint > 55295 && codePoint < 57344 || codePoint > 65533 && codePoint < 65536 || codePoint > 1114111)) return false;
-	}
-	return true;
-};
-const isUtf16Boundary = (value, offset) => {
-	if (offset === 0 || offset === value.length) return true;
-	const previous = value.charCodeAt(offset - 1);
-	const next = value.charCodeAt(offset);
-	return !(previous >= 55296 && previous <= 56319 && next >= 56320 && next <= 57343);
-};
-const escapeXmlText = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-const utf8ByteLength = (value) => {
-	let total = 0;
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 127) total += 1;
-		else if (codePoint <= 2047) total += 2;
-		else if (codePoint <= 65535) total += 3;
-		else total += 4;
-	}
-	return total;
-};
-const XML_SPACE_INSERTION_BYTES = 21;
-const escapedXmlTextByteLength = (value) => {
-	let total = 0;
-	for (const character of value) {
-		if (character === "&") {
-			total += 5;
-			continue;
+const REWRITE_ERROR_CODES = new Set(Object.values(DOCX_REWRITE_ERROR_CODES));
+const EXTRACTION_ERROR_CODES = new Set(Object.values(DOCX_EXTRACTION_ERROR_CODES));
+const DOCX_REWRITE_MAX_BLOCKS = 1e5;
+const DOCX_REWRITE_MAX_REPLACEMENTS = 1e6;
+const LOCATION_PATH_KEYS = [
+	"xmlPath",
+	"tablePath",
+	"rowPath",
+	"cellPath",
+	"textBoxPath"
+];
+const preflightRewritePlan = (rewrites) => {
+	const rewriteCount = rewrites.length;
+	if (rewriteCount > DOCX_REWRITE_MAX_BLOCKS) throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewrites must not contain more than ${DOCX_REWRITE_MAX_BLOCKS} blocks`);
+	let replacementCount = 0;
+	let estimatedBytes = rewriteCount * 256;
+	const serializableRewrites = [];
+	for (let rewriteIndex = 0; rewriteIndex < rewriteCount; rewriteIndex += 1) {
+		const rewrite = rewrites[rewriteIndex];
+		if (rewrite === void 0) throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "DOCX rewrite plans must not contain sparse blocks");
+		if (!Array.isArray(rewrite.replacements)) throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "DOCX block rewrite replacements must be an array");
+		const blockReplacementCount = rewrite.replacements.length;
+		replacementCount += blockReplacementCount;
+		if (replacementCount > DOCX_REWRITE_MAX_REPLACEMENTS) throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewrites must not contain more than ${DOCX_REWRITE_MAX_REPLACEMENTS} replacements`);
+		estimatedBytes += (typeof rewrite.expectedText === "string" ? rewrite.expectedText.length * 6 : 0) + blockReplacementCount * 96;
+		const serializableReplacements = [];
+		for (let replacementIndex = 0; replacementIndex < blockReplacementCount; replacementIndex += 1) {
+			const replacement = rewrite.replacements[replacementIndex];
+			if (replacement === void 0) throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "DOCX rewrite plans must not contain sparse replacements");
+			const value = replacement.replacement;
+			if (typeof value === "string") estimatedBytes += value.length * 6;
+			serializableReplacements.push({
+				start: typeof replacement.start === "number" ? replacement.start : null,
+				end: typeof replacement.end === "number" ? replacement.end : null,
+				replacement: typeof value === "string" ? value : null
+			});
 		}
-		if (character === "<" || character === ">") {
-			total += 4;
-			continue;
+		const location = rewrite.location;
+		const part = location["part"];
+		for (const value of [
+			location["type"],
+			part?.["type"],
+			part?.["path"]
+		]) if (typeof value === "string") estimatedBytes += value.length * 6;
+		const serializableLocation = {
+			type: typeof location["type"] === "string" ? location["type"] : null,
+			part: {
+				type: typeof part?.["type"] === "string" ? part["type"] : null,
+				path: typeof part?.["path"] === "string" ? part["path"] : null
+			},
+			blockIndex: typeof location["blockIndex"] === "number" ? location["blockIndex"] : null
+		};
+		for (const key of LOCATION_PATH_KEYS) {
+			const path = location[key];
+			if (Array.isArray(path)) {
+				if (path.length > 256) throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, `DOCX rewrite location paths must not exceed 256 entries`);
+				estimatedBytes += path.length * 24;
+				const serializablePath = [];
+				for (let pathIndex = 0; pathIndex < path.length; pathIndex += 1) {
+					const value = path[pathIndex];
+					serializablePath.push(typeof value === "number" ? value : null);
+				}
+				serializableLocation[key] = serializablePath;
+			}
 		}
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 127) total += 1;
-		else if (codePoint <= 2047) total += 2;
-		else if (codePoint <= 65535) total += 3;
-		else total += 4;
-	}
-	return total;
-};
-const replacementByteLength = (replacement) => escapedXmlTextByteLength(replacement.replacement);
-const validateReplacement = (replacement, blockText) => {
-	if (!Number.isSafeInteger(replacement.start) || !Number.isSafeInteger(replacement.end) || replacement.start < 0 || replacement.start >= replacement.end || replacement.end > blockText.length || !isUtf16Boundary(blockText, replacement.start) || !isUtf16Boundary(blockText, replacement.end)) throw rewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "DOCX replacement spans must be nonempty bounded integer ranges at UTF-16 boundaries");
-	if (!isValidXmlText(replacement.replacement)) throw rewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "DOCX replacement text must contain only valid XML characters");
-	if (replacementByteLength(replacement) > 16777216) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX replacement text must not exceed ${DOCX_ENTRY_MAX_BYTES} escaped UTF-8 bytes`);
-};
-const coveredTextSegments = (block, replacement) => {
-	const segments = block.segments.filter(({ end, start }) => start < replacement.end && end > replacement.start);
-	let cursor = replacement.start;
-	for (const segment of segments) {
-		if (segment.source !== "text" || segment.start > cursor || segment.contexts.some((context) => context.type === "revision")) throw rewriteError(DOCX_REWRITE_ERROR_CODES.unsupportedReplacement, "DOCX replacements must stay within contiguous non-revision text segments");
-		cursor = Math.min(replacement.end, segment.end);
-	}
-	if (segments.length === 0 || cursor !== replacement.end) throw rewriteError(DOCX_REWRITE_ERROR_CODES.unsupportedReplacement, "DOCX replacements must stay within contiguous non-revision text segments");
-	return segments;
-};
-const planBlockUpdates = (block, rewrite) => {
-	const replacements = [...rewrite.replacements].sort((left, right) => left.start - right.start);
-	for (const [index, replacement] of replacements.entries()) {
-		validateReplacement(replacement, block.text);
-		const previous = index === 0 ? void 0 : replacements.at(index - 1);
-		if (previous !== void 0 && previous.end > replacement.start) throw rewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "DOCX replacement spans must not overlap");
-	}
-	const values = /* @__PURE__ */ new Map();
-	const originalValues = /* @__PURE__ */ new Map();
-	for (const segment of block.segments) {
-		if (segment.source !== "text") continue;
-		const original = block.text.slice(segment.start, segment.end);
-		values.set(pathKey(segment.xmlPath), {
-			path: segment.xmlPath,
-			value: original,
-			originalByteLength: utf8ByteLength(original)
+		serializableRewrites.push({
+			location: serializableLocation,
+			expectedText: typeof rewrite.expectedText === "string" ? rewrite.expectedText : null,
+			replacements: serializableReplacements
 		});
-		originalValues.set(pathKey(segment.xmlPath), original);
+		if (estimatedBytes > 134217728) throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewrite plans must not exceed ${DOCX_UNCOMPRESSED_MAX_BYTES} estimated serialized bytes`);
 	}
-	for (const replacement of replacements.toReversed()) {
-		const segments = coveredTextSegments(block, replacement);
-		const first = segments.at(0);
-		const last = segments.at(-1);
-		if (first === void 0 || last === void 0) throw rewriteError(DOCX_REWRITE_ERROR_CODES.unsupportedReplacement, "DOCX replacement text segments are unavailable");
-		const firstUpdate = values.get(pathKey(first.xmlPath));
-		const lastUpdate = values.get(pathKey(last.xmlPath));
-		if (firstUpdate === void 0 || lastUpdate === void 0) throw rewriteError(DOCX_REWRITE_ERROR_CODES.unsupportedReplacement, "DOCX replacement text nodes are unavailable");
-		const firstStart = replacement.start - first.start;
-		const lastEnd = replacement.end - last.start;
-		if (first === last) {
-			firstUpdate.value = firstUpdate.value.slice(0, firstStart) + replacement.replacement + firstUpdate.value.slice(lastEnd);
-			continue;
-		}
-		firstUpdate.value = firstUpdate.value.slice(0, firstStart) + replacement.replacement;
-		for (const segment of segments.slice(1, -1)) {
-			const update = values.get(pathKey(segment.xmlPath));
-			if (update !== void 0) update.value = "";
-		}
-		lastUpdate.value = lastUpdate.value.slice(lastEnd);
-	}
-	return [...values.entries()].filter(([key, update]) => update.value !== originalValues.get(key)).map(([, update]) => update);
-};
-const requiresPreservedSpace = (value) => /^\s|\s$/u.test(value);
-const isWordTextTag = (tag) => WORDPROCESSING_NAMESPACES.has(tag.uri) && (tag.local === "t" || tag.local === "delText");
-const hasPreservedSpace = (tag) => Object.values(tag.attributes).some((attribute) => attribute.uri === XML_NAMESPACE && attribute.local === "space" && attribute.value === "preserve");
-const findClosingTagStart = ({ xml, contentStart, parserPosition }) => {
-	for (let index = parserPosition - 1; index >= contentStart; index -= 1) if (xml[index] === "<" && xml[index + 1] === "/") return index;
-	throw rewriteError(DOCX_REWRITE_ERROR_CODES.staleExtraction, "DOCX text-node closing tag changed after extraction");
+	return serializableRewrites;
 };
-const rewritePartXml = (xml, updates) => {
-	const updatesByPath = new Map(updates.map((update) => [pathKey(update.path), update]));
-	const foundPaths = /* @__PURE__ */ new Set();
-	const patches = [];
-	const stack = [];
-	let activeText;
-	let parseError = null;
-	const parser = new SaxesParser({ xmlns: true });
-	parser.on("error", (error) => {
-		parseError = error;
-	});
-	parser.on("opentag", (tag) => {
-		if (stack.length >= 256) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX XML must not exceed 256 nested elements`);
-		const parent = stack.at(-1);
-		const childIndex = parent?.nextChildIndex ?? 0;
-		if (parent !== void 0) parent.nextChildIndex += 1;
-		const path = [...parent?.path ?? [], childIndex];
-		stack.push({
-			path,
-			nextChildIndex: 0
-		});
-		const key = pathKey(path);
-		if (isWordTextTag(tag) && updatesByPath.has(key)) {
-			if (tag.isSelfClosing) throw rewriteError(DOCX_REWRITE_ERROR_CODES.unsupportedReplacement, "DOCX self-closing text nodes cannot receive replacements");
-			activeText = {
-				key,
-				contentStart: parser.position,
-				tag
-			};
-		}
-	});
-	parser.on("closetag", (tag) => {
-		if (activeText?.tag === tag) {
-			const update = updatesByPath.get(activeText.key);
-			if (update !== void 0) {
-				const contentEnd = findClosingTagStart({
-					xml,
-					contentStart: activeText.contentStart,
-					parserPosition: parser.position
-				});
-				patches.push({
-					start: activeText.contentStart,
-					end: contentEnd,
-					value: escapeXmlText(update.value)
-				});
-				if (requiresPreservedSpace(update.value) && !hasPreservedSpace(tag)) patches.push({
-					start: activeText.contentStart - 1,
-					end: activeText.contentStart - 1,
-					value: " xml:space=\"preserve\""
-				});
-				foundPaths.add(activeText.key);
-			}
-			activeText = void 0;
-		}
-		stack.pop();
-	});
+const rewriteDocxText = (archive, rewrites) => {
+	const rewrite = loadNativeAnonymizeBinding().rewriteDocxTextNative;
+	if (rewrite === void 0) throw new Error("The native anonymize binding does not expose DOCX rewriting");
+	let serializableRewrites;
 	try {
-		parser.write(xml).close();
+		serializableRewrites = preflightRewritePlan(rewrites);
 	} catch (error) {
 		if (error instanceof DocxRewriteError) throw error;
-		parseError = error instanceof Error ? error : /* @__PURE__ */ new Error("invalid XML");
+		const message = error instanceof Error ? error.message : String(error);
+		throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, `DOCX rewrite plan is invalid: ${message}`);
 	}
-	if (parseError !== null) throw rewriteError(DOCX_REWRITE_ERROR_CODES.unsupportedReplacement, "DOCX source XML changed after extraction");
-	if (foundPaths.size !== updatesByPath.size) throw rewriteError(DOCX_REWRITE_ERROR_CODES.staleExtraction, "DOCX text-node locations changed after extraction");
-	let rewritten = xml;
-	for (const patch of patches.toSorted((left, right) => right.start - left.start)) rewritten = rewritten.slice(0, patch.start) + patch.value + rewritten.slice(patch.end);
-	return rewritten;
-};
-const assertArchiveBudgets = (entries) => {
-	let totalBytes = 0;
-	for (const bytes of Object.values(entries)) {
-		if (bytes.byteLength > 16777216) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `Rewritten DOCX entries must not exceed ${DOCX_ENTRY_MAX_BYTES} bytes`);
-		totalBytes += bytes.byteLength;
-	}
-	if (totalBytes > 134217728) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `Rewritten DOCX archives must not exceed ${DOCX_UNCOMPRESSED_MAX_BYTES} uncompressed bytes`);
-};
-const rewriteDocxText = (archive, rewrites) => {
-	const extraction = extractDocxText(archive);
-	if (rewrites.length === 0) return {
-		document: archive.slice(),
-		rewrittenBlockCount: 0,
-		appliedReplacementCount: 0
-	};
-	const blocksByLocation = new Map(extraction.blocks.map((block) => [docxLocationKey(block.location), block]));
-	const updatesByPart = /* @__PURE__ */ new Map();
-	const rewrittenLocations = /* @__PURE__ */ new Set();
-	const replacementBytesByPart = /* @__PURE__ */ new Map();
-	let appliedReplacementCount = 0;
-	let totalReplacementBytes = 0;
-	for (const rewrite of rewrites) {
-		const key = docxLocationKey(rewrite.location);
-		if (rewrittenLocations.has(key)) throw rewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "Each DOCX block may appear in a rewrite plan only once");
-		rewrittenLocations.add(key);
-		const block = blocksByLocation.get(key);
-		if (block === void 0 || !docxLocationsEqual(block.location, rewrite.location) || block.text !== rewrite.expectedText) throw rewriteError(DOCX_REWRITE_ERROR_CODES.staleExtraction, "DOCX block location or expected text no longer matches");
-		if (rewrite.replacements.length === 0) throw rewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, "DOCX block rewrite plans must contain at least one replacement");
-		if (appliedReplacementCount + rewrite.replacements.length > DOCX_MAX_REPLACEMENTS) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewrites must not contain more than ${DOCX_MAX_REPLACEMENTS} replacements`);
-		const rewriteReplacementBytes = rewrite.replacements.reduce((total, replacement) => total + replacementByteLength(replacement), 0);
-		totalReplacementBytes += rewriteReplacementBytes;
-		if (totalReplacementBytes > 134217728) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewrite replacement text must not exceed ${DOCX_UNCOMPRESSED_MAX_BYTES} aggregate escaped UTF-8 bytes`);
-		const partReplacementBytes = (replacementBytesByPart.get(block.location.part.path) ?? 0) + rewriteReplacementBytes;
-		replacementBytesByPart.set(block.location.part.path, partReplacementBytes);
-		if (partReplacementBytes > 16777216) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewrite replacement text for a single part must not exceed ${DOCX_ENTRY_MAX_BYTES} aggregate escaped UTF-8 bytes`);
-		const partUpdates = updatesByPart.get(block.location.part.path) ?? /* @__PURE__ */ new Map();
-		for (const update of planBlockUpdates(block, rewrite)) partUpdates.set(pathKey(update.path), update);
-		updatesByPart.set(block.location.part.path, partUpdates);
-		appliedReplacementCount += rewrite.replacements.length;
-	}
-	let totalUpdatedNodeBytes = 0;
-	for (const updates of updatesByPart.values()) {
-		let partUpdatedNodeBytes = 0;
-		for (const update of updates.values()) partUpdatedNodeBytes += escapedXmlTextByteLength(update.value);
-		if (partUpdatedNodeBytes > 16777216) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewritten text nodes for a single part must not exceed ${DOCX_ENTRY_MAX_BYTES} escaped UTF-8 bytes`);
-		totalUpdatedNodeBytes += partUpdatedNodeBytes;
-		if (totalUpdatedNodeBytes > 134217728) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `DOCX rewritten text nodes must not exceed ${DOCX_UNCOMPRESSED_MAX_BYTES} aggregate escaped UTF-8 bytes`);
-	}
-	const entries = unzipDocxArchive(archive, true);
-	if (Object.keys(entries).some((path) => path.toLowerCase().startsWith(SIGNATURE_PART_PREFIX))) throw rewriteError(DOCX_REWRITE_ERROR_CODES.unsupportedReplacement, "Digitally signed DOCX packages must be re-signed before rewriting");
-	let projectedTotalBytes = 0;
-	for (const [partPath, partBytes] of Object.entries(entries)) {
-		let projected = partBytes.byteLength;
-		const updates = updatesByPart.get(partPath);
-		if (updates !== void 0) {
-			for (const update of updates.values()) projected += escapedXmlTextByteLength(update.value) + XML_SPACE_INSERTION_BYTES - update.originalByteLength;
-			if (projected > 16777216) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `Rewritten DOCX parts must not exceed ${DOCX_ENTRY_MAX_BYTES} projected bytes`);
-		}
-		projectedTotalBytes += projected;
-		if (projectedTotalBytes > 134217728) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `Rewritten DOCX archives must not exceed ${DOCX_UNCOMPRESSED_MAX_BYTES} projected uncompressed bytes`);
+	let rewritesJson;
+	try {
+		rewritesJson = JSON.stringify(serializableRewrites);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new DocxRewriteError(DOCX_REWRITE_ERROR_CODES.invalidReplacement, `DOCX rewrite plan is not serializable: ${message}`);
 	}
-	for (const [partPath, updates] of updatesByPart) {
-		const partBytes = entries[partPath];
-		if (partBytes === void 0) throw rewriteError(DOCX_REWRITE_ERROR_CODES.staleExtraction, "DOCX source part changed after extraction");
-		const xml = new TextDecoder("utf-8", { fatal: true }).decode(partBytes);
-		entries[partPath] = strToU8(rewritePartXml(xml, [...updates.values()]));
+	try {
+		return rewrite(archive, rewritesJson);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		const separator = message.indexOf(": ");
+		const rawCode = message.slice(0, separator);
+		const extractionCode = rawCode;
+		if (separator > 0 && EXTRACTION_ERROR_CODES.has(extractionCode)) throw new DocxExtractionError(extractionCode, message.slice(separator + 2));
+		const code = rawCode;
+		if (separator > 0 && REWRITE_ERROR_CODES.has(code)) throw new DocxRewriteError(code, message.slice(separator + 2));
+		throw error;
 	}
-	assertArchiveBudgets(entries);
-	const document = zipSync(entries);
-	if (document.byteLength > 67108864) throw rewriteError(DOCX_REWRITE_ERROR_CODES.rewriteLimitExceeded, `Rewritten DOCX archives must not exceed ${DOCX_ARCHIVE_MAX_BYTES} bytes`);
-	return {
-		document,
-		rewrittenBlockCount: rewrites.length,
-		appliedReplacementCount
-	};
 };
 //#endregion
 //#region src/coverage.ts
@@ -901,8 +209,6 @@ const docxWorkflowCoverage = (coverage) => {
 };
 //#endregion
 //#region src/restore.ts
-const DOCX_RESTORE_MAX_PLACEHOLDER_UTF16 = 512;
-const DOCX_RESTORE_MAX_CANDIDATES = 1e6;
 var DocxRestorationError = class extends Error {
 	code;
 	constructor(code, message) {
@@ -912,53 +218,6 @@ var DocxRestorationError = class extends Error {
 	}
 };
 const restorationError = (code, message) => new DocxRestorationError(code, message);
-const encodedSessionNamespace = (sessionId) => sessionId.replaceAll("_", "%5F");
-const isOwnedPlaceholderCandidate = (value, encodedSessionId) => {
-	const inner = value.endsWith("]") ? value.slice(0, -1) : value;
-	const countSeparator = inner.lastIndexOf("_");
-	if (countSeparator <= 0) return false;
-	const prefix = inner.slice(0, countSeparator);
-	const namespaceSeparator = prefix.lastIndexOf("_");
-	if (namespaceSeparator <= 0) return false;
-	return prefix.slice(namespaceSeparator + 1) === encodedSessionId;
-};
-const planBlockRestoration = ({ text, encodedSessionId, restoreCandidate, budget }) => {
-	const replacements = [];
-	let start;
-	for (let cursor = 0; cursor < text.length; cursor += 1) {
-		const character = text.at(cursor);
-		if (character === "[") {
-			if (start !== void 0 && isOwnedPlaceholderCandidate(text.slice(start + 1, cursor), encodedSessionId)) throw restorationError(DOCX_RESTORATION_ERROR_CODES.invalidPlaceholder, "DOCX text contains an incomplete placeholder for the expected session");
-			start = cursor;
-			continue;
-		}
-		if (character !== "]" || start === void 0) continue;
-		const candidateEnd = cursor + 1;
-		const candidate = text.slice(start, candidateEnd);
-		budget.candidateCount += 1;
-		if (budget.candidateCount > DOCX_RESTORE_MAX_CANDIDATES) throw restorationError(DOCX_RESTORATION_ERROR_CODES.restorationLimitExceeded, `DOCX restoration must not inspect more than ${DOCX_RESTORE_MAX_CANDIDATES} placeholder candidates`);
-		const isOwned = isOwnedPlaceholderCandidate(candidate.slice(1), encodedSessionId);
-		if (candidate.length > DOCX_RESTORE_MAX_PLACEHOLDER_UTF16) {
-			if (isOwned) throw restorationError(DOCX_RESTORATION_ERROR_CODES.invalidPlaceholder, "DOCX session placeholder exceeds the maximum length");
-			start = void 0;
-			continue;
-		}
-		if (!isOwned) {
-			start = void 0;
-			continue;
-		}
-		const replacement = restoreCandidate(candidate);
-		if (replacement !== candidate) replacements.push({
-			start,
-			end: candidateEnd,
-			replacement
-		});
-		else throw restorationError(DOCX_RESTORATION_ERROR_CODES.invalidPlaceholder, "DOCX text contains an unknown placeholder for the expected session");
-		start = void 0;
-	}
-	if (start !== void 0 && isOwnedPlaceholderCandidate(text.slice(start + 1), encodedSessionId)) throw restorationError(DOCX_RESTORATION_ERROR_CODES.invalidPlaceholder, "DOCX text contains an incomplete placeholder for the expected session");
-	return replacements;
-};
 const restoreDocxText = ({ document, session, expectedSessionId, observedAtEpochSeconds }) => {
 	const sessionId = session.sessionId();
 	if (sessionId !== expectedSessionId) throw restorationError(DOCX_RESTORATION_ERROR_CODES.sessionMismatch, "DOCX restoration session does not match the expected session id");
@@ -974,23 +233,40 @@ const restoreDocxText = ({ document, session, expectedSessionId, observedAtEpoch
 		restoredCandidates.set(candidate, restored);
 		return restored;
 	};
-	const encodedSessionId = encodedSessionNamespace(sessionId);
-	const extraction = extractDocxText(document);
+	const planRestoration = loadNativeAnonymizeBinding().planDocxRestorationJson;
+	if (planRestoration === void 0) throw restorationError(DOCX_RESTORATION_ERROR_CODES.invalidSession, "Native anonymize binding does not expose DOCX restoration planning");
+	let plan;
+	try {
+		plan = JSON.parse(planRestoration(document, sessionId));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		const separator = message.indexOf(": ");
+		const code = message.slice(0, separator);
+		const knownCodes = /* @__PURE__ */ new Set([
+			DOCX_RESTORATION_ERROR_CODES.invalidPlaceholder,
+			DOCX_RESTORATION_ERROR_CODES.restorationLimitExceeded,
+			DOCX_RESTORATION_ERROR_CODES.unsupportedDocument
+		]);
+		if (separator > 0 && knownCodes.has(code)) throw restorationError(code, message.slice(separator + 2));
+		throw error;
+	}
 	const rewrites = [];
-	const budget = { candidateCount: 0 };
 	let restoredPlaceholderCount = 0;
-	for (const block of extraction.blocks) {
-		const replacements = planBlockRestoration({
-			text: block.text,
-			encodedSessionId,
-			restoreCandidate,
-			budget
+	for (const block of plan.blocks) {
+		const replacements = block.candidates.map(({ candidate, end, start }) => {
+			const replacement = restoreCandidate(candidate);
+			if (replacement === candidate) throw restorationError(DOCX_RESTORATION_ERROR_CODES.invalidPlaceholder, "DOCX text contains an unknown placeholder for the expected session");
+			return {
+				start,
+				end,
+				replacement
+			};
 		});
 		if (replacements.length === 0) continue;
 		restoredPlaceholderCount += replacements.length;
 		rewrites.push({
 			location: block.location,
-			expectedText: block.text,
+			expectedText: block.expectedText,
 			replacements
 		});
 	}
@@ -1001,10 +277,21 @@ const restoreDocxText = ({ document, session, expectedSessionId, observedAtEpoch
 		sessionId,
 		restoredBlockCount: restored.rewrittenBlockCount,
 		restoredPlaceholderCount,
-		coverage: docxWorkflowCoverage(extraction.coverage)
+		coverage: docxWorkflowCoverage(plan.extraction.coverage)
 	};
 };
 //#endregion
+//#region src/location.ts
+const arraysEqual = (left, right) => left.length === right.length && left.every((value, index) => value === right.at(index));
+const docxLocationsEqual = (left, right) => {
+	if (left.type !== right.type || left.part.type !== right.part.type || left.part.path !== right.part.path || left.blockIndex !== right.blockIndex || !arraysEqual(left.xmlPath, right.xmlPath)) return false;
+	if (left.type === "paragraph" && right.type === "paragraph") return true;
+	if (left.type === "table-cell-paragraph" && right.type === "table-cell-paragraph") return arraysEqual(left.tablePath, right.tablePath) && arraysEqual(left.rowPath, right.rowPath) && arraysEqual(left.cellPath, right.cellPath);
+	if (left.type === "text-box-paragraph" && right.type === "text-box-paragraph") return arraysEqual(left.textBoxPath, right.textBoxPath);
+	return false;
+};
+const docxLocationKey = ({ blockIndex, part }) => `${part.path}\0${blockIndex}`;
+//#endregion
 //#region src/anonymize.ts
 const DOCX_ANONYMIZATION_MAX_CALLER_DETECTIONS = 1e6;
 var DocxAnonymizationError = class extends Error {