@stll/docx-core 0.15.1 → 0.15.2

package/dist/index.d.ts

@@ -122,10 +122,19 @@ type SerializeDocumentOptions = {
 declare const serializeDocumentToDocx: (document: Document, options?: SerializeDocumentOptions) => Promise<ArrayBuffer>;
 //#endregion
 //#region src/validate/docx.d.ts
+declare const DOCX_PACKAGE_ISSUE_CODES: {
+  readonly ArchiveBoundsExceeded: "archive_bounds_exceeded";
+  readonly InvalidArchive: "invalid_archive";
+  readonly InvalidDocumentRoot: "invalid_document_root";
+  readonly MissingNumberingPart: "missing_numbering_part";
+  readonly MissingPackagePart: "missing_package_part";
+};
+type DocxPackageIssueCode = (typeof DOCX_PACKAGE_ISSUE_CODES)[keyof typeof DOCX_PACKAGE_ISSUE_CODES];
 type ValidateDocxPackageResult = {
   valid: true;
 } | {
   valid: false;
+  code: DocxPackageIssueCode;
   error: string;
 };
 type ValidateDocumentModelIssue = {
@@ -141,4 +150,4 @@ declare const validateDocxPackage: (buffer: ArrayBuffer | Uint8Array) => Promise
 declare const validateDocumentModel: (document: Document) => ValidateDocumentModelResult;
 declare const assertValidDocumentModel: (document: Document) => void;
 //#endregion
-export { type Autofix, type BlockContent, type BreakContent, type CompiledLegalDocument, DOCX_CONFORMANCE_CLASSES, type Document, type DocumentBody, type DocxConformanceClass, type DocxPackage, type LegalDraft, type LegalDraftBlock, type LegalDraftDiagnostic, type LegalSourceCompileOptions, type LegalSourceCompileResult, type LegalSourceDocxCompileResult, type LegalSourceParseResult, type Paragraph, type ParagraphContent, type PositionalTab, type Run, type RunContent, type SectionProperties, type Style, type Table, type TableCell, type TableRow, type TextContent, type ValidateDocumentModelIssue, type ValidateDocumentModelResult, type ValidateDocxPackageResult, assertValidDocumentModel, compileLegalSourceToDocument, compileLegalSourceToDocx, parseLegalSource, serializeDocumentToDocx, validateDocumentModel, validateDocxPackage, validateLegalDraft };
+export { type Autofix, type BlockContent, type BreakContent, type CompiledLegalDocument, DOCX_CONFORMANCE_CLASSES, DOCX_PACKAGE_ISSUE_CODES, type Document, type DocumentBody, type DocxConformanceClass, type DocxPackage, type DocxPackageIssueCode, type LegalDraft, type LegalDraftBlock, type LegalDraftDiagnostic, type LegalSourceCompileOptions, type LegalSourceCompileResult, type LegalSourceDocxCompileResult, type LegalSourceParseResult, type Paragraph, type ParagraphContent, type PositionalTab, type Run, type RunContent, type SectionProperties, type Style, type Table, type TableCell, type TableRow, type TextContent, type ValidateDocumentModelIssue, type ValidateDocumentModelResult, type ValidateDocxPackageResult, assertValidDocumentModel, compileLegalSourceToDocument, compileLegalSourceToDocx, parseLegalSource, serializeDocumentToDocx, validateDocumentModel, validateDocxPackage, validateLegalDraft };

package/dist/index.js

@@ -1,6 +1,7 @@
 import { r as isOoxmlSymbolCharacter, t as DOCX_CONFORMANCE_CLASSES } from "./document-BO7h-LxY.js";
 import JSZip from "jszip";
 import { panic } from "better-result";
+import { XMLParser, XMLValidator } from "fast-xml-parser";
 //#region src/serialize/xml.ts
 const ILLEGAL_XML_CHARS_RE = /[^\u0009\u000A\u000D\u0020-\uD7FF\uE000-\uFFFD\u{10000}-\u{10FFFF}]/gu;
 const stripIllegalXmlChars = (value) => value.replace(ILLEGAL_XML_CHARS_RE, "");
@@ -322,6 +323,13 @@ const serializeCoreProperties = (document) => {
 };
 //#endregion
 //#region src/validate/docx.ts
+const DOCX_PACKAGE_ISSUE_CODES = {
+	ArchiveBoundsExceeded: "archive_bounds_exceeded",
+	InvalidArchive: "invalid_archive",
+	InvalidDocumentRoot: "invalid_document_root",
+	MissingNumberingPart: "missing_numbering_part",
+	MissingPackagePart: "missing_package_part"
+};
 /**
 * Local bounds on the ZIP archive `validateDocxPackage` inflates parts from.
 * `docx-core` has no dependency on `@stll/folio-core`, so these mirror the
@@ -334,6 +342,17 @@ const serializeCoreProperties = (document) => {
 const VALIDATE_DOCX_MAX_ENTRIES = 4096;
 const VALIDATE_DOCX_MAX_ENTRY_BYTES = 128 * 1024 * 1024;
 const VALIDATE_DOCX_MAX_TOTAL_BYTES = 256 * 1024 * 1024;
+const VALIDATE_DOCX_MAX_DOCUMENT_XML_BYTES = 32 * 1024 * 1024;
+const WORDPROCESSINGML_NAMESPACES = /* @__PURE__ */ new Set(["http://schemas.openxmlformats.org/wordprocessingml/2006/main", "http://purl.oclc.org/ooxml/wordprocessingml/main"]);
+const packageXmlParser = new XMLParser({
+	preserveOrder: true,
+	ignoreAttributes: false,
+	attributeNamePrefix: "",
+	parseTagValue: false,
+	parseAttributeValue: false,
+	processEntities: false,
+	ignoreDeclaration: true
+});
 const getDeclaredUncompressedSize = (file) => {
 	const metadata = file._data;
 	return typeof metadata?.uncompressedSize === "number" ? metadata.uncompressedSize : null;
@@ -358,36 +377,84 @@ const checkDocxArchiveBounds = (zip) => {
 	}
 	return null;
 };
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const elementName = (node) => Object.keys(node).find((key) => key !== ":@" && !key.startsWith("?")) ?? null;
+const localName = (name) => name.slice(name.indexOf(":") + 1);
+const prefix = (name) => {
+	const separator = name.indexOf(":");
+	return separator === -1 ? "" : name.slice(0, separator);
+};
+const namespaceFor = (name, attributes, inherited = {}) => {
+	const key = prefix(name) === "" ? "xmlns" : `xmlns:${prefix(name)}`;
+	const value = attributes[key] ?? inherited[key];
+	return typeof value === "string" ? value : null;
+};
+const validateDocumentXml = (xml) => {
+	if (XMLValidator.validate(xml) !== true) return "Generated DOCX has malformed word/document.xml.";
+	const parsed = packageXmlParser.parse(xml);
+	if (!Array.isArray(parsed)) return "Generated DOCX has no word/document.xml root document.";
+	const root = parsed.find(isRecord);
+	if (!root) return "Generated DOCX has no word/document.xml root document.";
+	const rootName = elementName(root);
+	const rootAttributes = isRecord(root[":@"]) ? root[":@"] : {};
+	if (rootName === null || localName(rootName) !== "document" || !WORDPROCESSINGML_NAMESPACES.has(namespaceFor(rootName, rootAttributes) ?? "")) return "Generated DOCX has no WordprocessingML document root.";
+	const children = root[rootName];
+	if (!Array.isArray(children)) return "Generated DOCX document root has no WordprocessingML body.";
+	return children.some((child) => {
+		if (!isRecord(child)) return false;
+		const childName = elementName(child);
+		const childAttributes = isRecord(child[":@"]) ? child[":@"] : {};
+		return childName !== null && localName(childName) === "body" && WORDPROCESSINGML_NAMESPACES.has(namespaceFor(childName, childAttributes, rootAttributes) ?? "");
+	}) ? null : "Generated DOCX document root has no WordprocessingML body.";
+};
 const validateDocxPackage = async (buffer) => {
 	try {
 		const zip = await JSZip.loadAsync(buffer);
 		const boundsError = checkDocxArchiveBounds(zip);
 		if (boundsError) return {
 			valid: false,
+			code: DOCX_PACKAGE_ISSUE_CODES.ArchiveBoundsExceeded,
 			error: boundsError
 		};
 		for (const requiredPath of [
 			"[Content_Types].xml",
 			"_rels/.rels",
-			"word/document.xml",
-			"word/styles.xml",
-			"word/_rels/document.xml.rels"
+			"word/document.xml"
 		]) if (!zip.file(requiredPath)) return {
 			valid: false,
+			code: DOCX_PACKAGE_ISSUE_CODES.MissingPackagePart,
 			error: `Generated DOCX is missing required package part: ${requiredPath}`
 		};
-		if (!(await zip.file("word/document.xml")?.async("string"))?.includes("<w:document")) return {
+		const documentPart = zip.file("word/document.xml");
+		const declaredDocumentBytes = documentPart ? getDeclaredUncompressedSize(documentPart) : null;
+		if (declaredDocumentBytes !== null && declaredDocumentBytes > VALIDATE_DOCX_MAX_DOCUMENT_XML_BYTES) return {
+			valid: false,
+			code: DOCX_PACKAGE_ISSUE_CODES.ArchiveBoundsExceeded,
+			error: `Generated DOCX word/document.xml declares ${declaredDocumentBytes} uncompressed bytes, over the ${VALIDATE_DOCX_MAX_DOCUMENT_XML_BYTES}-byte limit.`
+		};
+		const documentBytes = await documentPart?.async("uint8array");
+		if (documentBytes !== void 0 && documentBytes.byteLength > VALIDATE_DOCX_MAX_DOCUMENT_XML_BYTES) return {
+			valid: false,
+			code: DOCX_PACKAGE_ISSUE_CODES.ArchiveBoundsExceeded,
+			error: `Generated DOCX word/document.xml exceeds the ${VALIDATE_DOCX_MAX_DOCUMENT_XML_BYTES}-byte limit.`
+		};
+		const documentXml = documentBytes ? new TextDecoder().decode(documentBytes) : void 0;
+		const documentError = documentXml ? validateDocumentXml(documentXml) : "Generated DOCX has no word/document.xml root document.";
+		if (documentError) return {
 			valid: false,
-			error: "Generated DOCX has no word/document.xml root document."
+			code: DOCX_PACKAGE_ISSUE_CODES.InvalidDocumentRoot,
+			error: documentError
 		};
 		if ((await zip.file("word/_rels/document.xml.rels")?.async("string"))?.includes("/relationships/numbering") && !zip.file("word/numbering.xml")) return {
 			valid: false,
+			code: DOCX_PACKAGE_ISSUE_CODES.MissingNumberingPart,
 			error: "Generated DOCX references numbering.xml but does not include it."
 		};
 		return { valid: true };
 	} catch (error) {
 		return {
 			valid: false,
+			code: DOCX_PACKAGE_ISSUE_CODES.InvalidArchive,
 			error: error instanceof Error ? error.message : "Invalid DOCX package."
 		};
 	}
@@ -1983,4 +2050,4 @@ const compileLegalSourceToDocx = async (source, options = {}) => {
 	};
 };
 //#endregion
-export { DOCX_CONFORMANCE_CLASSES, assertValidDocumentModel, compileLegalSourceToDocument, compileLegalSourceToDocx, parseLegalSource, serializeDocumentToDocx, validateDocumentModel, validateDocxPackage, validateLegalDraft };
+export { DOCX_CONFORMANCE_CLASSES, DOCX_PACKAGE_ISSUE_CODES, assertValidDocumentModel, compileLegalSourceToDocument, compileLegalSourceToDocx, parseLegalSource, serializeDocumentToDocx, validateDocumentModel, validateDocxPackage, validateLegalDraft };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stll/docx-core",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "Typed OOXML/DOCX model, validation, serialization, legal-source compilation, and browser-native package projection.",
   "keywords": [
     "document-model",
@@ -61,6 +61,7 @@
   },
   "dependencies": {
     "better-result": "3.0.1",
+    "fast-xml-parser": "^5.10.1",
     "jszip": "3.10.1"
   },
   "devDependencies": {