@stll/docx-core 0.4.0 → 0.5.1

package/dist/index.d.ts

@@ -1,5 +1,4 @@
-import { Ct as RunContent, Gt as TableRow, Ht as TableCell, M as DocumentBody, Ot as SectionProperties, St as Run, Vt as Table, Yt as TextContent, _t as ParagraphContent, a as DocxPackage, b as BlockContent, gt as Paragraph, i as DocxConformanceClass, n as Document, p as Style, t as DOCX_CONFORMANCE_CLASSES, w as BreakContent } from "./document-CzARzXpt.js";
-
+import { Ct as Run, Ht as Table, Kt as TableRow, M as DocumentBody, Ut as TableCell, Xt as TextContent, _t as Paragraph, a as DocxPackage, b as BlockContent, i as DocxConformanceClass, kt as SectionProperties, n as Document, p as Style, t as DOCX_CONFORMANCE_CLASSES, vt as ParagraphContent, w as BreakContent, wt as RunContent } from "./document-DfFH8YGu.js";
 //#region src/legal-source/types.d.ts
 type LegalDocumentKind = "agreement" | "letter" | "memo" | "checklist" | "pleading" | "other";
 type LegalNumberingProfile = "legal" | "none" | "checklist";
@@ -116,7 +115,8 @@ declare const compileLegalSourceToDocx: (source: string, options?: LegalSourceCo
 //#endregion
 //#region src/serialize/docx.d.ts
 type SerializeDocumentOptions = {
-  /** BCP-47 language tag (e.g. "en", "cs", "cs-CZ"); used for footer labels. */language?: string;
+  /** BCP-47 language tag (e.g. "en", "cs", "cs-CZ"); used for footer labels. */
+  language?: string;
 };
 declare const serializeDocumentToDocx: (document: Document, options?: SerializeDocumentOptions) => Promise<ArrayBuffer>;
 //#endregion

package/dist/index.js

@@ -1,4 +1,4 @@
-import { DOCX_CONFORMANCE_CLASSES } from "./model/document.js";
+import { t as DOCX_CONFORMANCE_CLASSES } from "./document-D4XHQQIj.js";
 import JSZip from "jszip";
 import { panic } from "better-result";
 //#region src/serialize/xml.ts
@@ -320,9 +320,50 @@ const serializeCoreProperties = (document) => {
 };
 //#endregion
 //#region src/validate/docx.ts
+/**
+* Local bounds on the ZIP archive `validateDocxPackage` inflates parts from.
+* `docx-core` has no dependency on `@stll/folio-core`, so these mirror the
+* shape of `packages/core/src/docx/server/boundedArchive.ts` rather than
+* importing it: an untrusted or generator-produced buffer must be rejected
+* for entry count and declared uncompressed size before `document.xml` /
+* `document.xml.rels` are inflated, so a decompression-bomb entry or an
+* archive with an excessive part count can't force an unbounded allocation.
+*/
+const VALIDATE_DOCX_MAX_ENTRIES = 4096;
+const VALIDATE_DOCX_MAX_ENTRY_BYTES = 128 * 1024 * 1024;
+const VALIDATE_DOCX_MAX_TOTAL_BYTES = 256 * 1024 * 1024;
+const getDeclaredUncompressedSize = (file) => {
+	const metadata = file._data;
+	return typeof metadata?.uncompressedSize === "number" ? metadata.uncompressedSize : null;
+};
+/**
+* Reject an archive whose entry count or declared uncompressed size (total
+* or per-entry) exceeds the local bounds above, before any part is inflated.
+* A declared size JSZip could not determine is skipped rather than treated
+* as unbounded — the per-entry cap below still bounds what an inflate call
+* can actually produce once it runs.
+*/
+const checkDocxArchiveBounds = (zip) => {
+	const entries = Object.values(zip.files);
+	if (entries.length > VALIDATE_DOCX_MAX_ENTRIES) return `Generated DOCX declares ${entries.length} archive entries, over the ${VALIDATE_DOCX_MAX_ENTRIES}-entry limit.`;
+	let totalUncompressedBytes = 0;
+	for (const entry of entries) {
+		const declaredBytes = getDeclaredUncompressedSize(entry);
+		if (declaredBytes === null) continue;
+		if (declaredBytes > VALIDATE_DOCX_MAX_ENTRY_BYTES) return `Generated DOCX entry "${entry.name}" declares ${declaredBytes} uncompressed bytes, over the ${VALIDATE_DOCX_MAX_ENTRY_BYTES}-byte limit.`;
+		totalUncompressedBytes += declaredBytes;
+		if (totalUncompressedBytes > VALIDATE_DOCX_MAX_TOTAL_BYTES) return `Generated DOCX declares more than ${VALIDATE_DOCX_MAX_TOTAL_BYTES} cumulative uncompressed bytes.`;
+	}
+	return null;
+};
 const validateDocxPackage = async (buffer) => {
 	try {
 		const zip = await JSZip.loadAsync(buffer);
+		const boundsError = checkDocxArchiveBounds(zip);
+		if (boundsError) return {
+			valid: false,
+			error: boundsError
+		};
 		for (const requiredPath of [
 			"[Content_Types].xml",
 			"_rels/.rels",

package/dist/model/document.d.ts

@@ -1,2 +1,2 @@
-import { $ as ImageTransform, $t as VerticalAlign, A as ComplexField, An as BorderSpec, At as SectionStart, B as FooterReference, Bt as TabContent, C as BookmarkStart, Cn as TableLook, Ct as RunContent, D as CommentRangeEnd, Dn as TextEffect, Dt as Section, E as Comment, En as TableWidthType, Et as SdtType, F as EndnotePosition, Ft as ShapeTextBody, G as HeaderFooterType, Gt as TableRow, H as FootnotePosition, Ht as TableCell, I as EndnoteProperties, It as ShapeType, J as Image, Jt as TextBox, K as HeaderReference, Kt as TableRowPropertyChange, L as Field, Lt as SimpleField, M as DocumentBody, Mn as KnownBorderStyle, Mt as ShapeContent, N as DrawingContent, Nn as ShadingProperties, Nt as ShapeFill, O as CommentRangeStart, On as TextFormatting, Ot as SectionProperties, P as Endnote, Pn as ThemeColorSlot, Pt as ShapeOutline, Q as ImageSize, Qt as TrackedRunChange, R as FieldCharContent, Rt as SoftHyphenContent, S as BookmarkEnd, Sn as TableFormatting, St as Run, T as Column, Tn as TableRowFormatting, Tt as SdtProperties, U as FootnoteProperties, Ut as TableCellPropertyChange, V as Footnote, Vt as Table, W as HeaderFooter, Wt as TablePropertyChange, X as ImagePadding, Xt as TextWatermark, Y as ImageCrop, Yt as TextContent, Z as ImagePosition, Zt as TrackedChangeInfo, _ as ThemeColorScheme, _n as TabStop, _t as ParagraphContent, a as DocxPackage, an as NumberFormat, at as MathEquation, b as BlockContent, bn as TableCellBorders, bt as PictureWatermark, c as FontTable, cn as CellMargins, ct as MoveFromRangeStart, d as RelationshipMap, dn as FloatingTableProperties, dt as MoveToRangeStart, en as Watermark, et as ImageWrap, f as RelationshipType, fn as LineSpacingRule, ft as NoBreakHyphenContent, g as Theme, gn as TabLeader, gt as Paragraph, h as StyleType, hn as SpacingExplicit, ht as PageOrientation, i as DocxConformanceClass, in as ListRendering, it as LineNumberRestart, j as Deletion, jn as ColorValue, jt as Shape, k as CommentReference, kn as UnderlineStyle, kt as SectionPropertyChange, l as MediaFile, ln as ConditionalFormatStyle, lt as MoveTo, m as StyleDefinitions, mn as ParagraphFormatting, mt as NoteReferenceContent, n as Document, nn as LevelSuffix, nt as Insertion, o as DocDefaults, on as NumberingDefinitions, ot as MoveFrom, p as Style, pn as ParagraphAlignment, pt as NoteNumberRestart, q as Hyperlink, qt as TableStructuralChangeInfo, r as DocumentSettings, rn as ListLevel, rt as InstrTextContent, s as FontInfo, sn as NumberingInstance, st as MoveFromRangeEnd, t as DOCX_CONFORMANCE_CLASSES, tn as AbstractNumbering, tt as InlineSdt, u as Relationship, un as EmphasisMark, ut as MoveToRangeEnd, v as ThemeFont, vn as TabStopAlignment, vt as ParagraphMarkChange, w as BreakContent, wn as TableMeasurement, wt as RunPropertyChange, x as BlockSdt, xn as TableCellFormatting, xt as PropertyChangeInfo, y as ThemeFontScheme, yn as TableBorders, yt as ParagraphPropertyChange, z as FieldType, zt as SymbolContent } from "../document-CzARzXpt.js";
-export { type AbstractNumbering, type BlockContent, type BlockSdt, type BookmarkEnd, type BookmarkStart, type BorderSpec, type BreakContent, type CellMargins, type ColorValue, type Column, type Comment, type CommentRangeEnd, type CommentRangeStart, type CommentReference, type ComplexField, type ConditionalFormatStyle, DOCX_CONFORMANCE_CLASSES, type Deletion, type DocDefaults, Document, type DocumentBody, DocumentSettings, DocxConformanceClass, DocxPackage, type DrawingContent, type EmphasisMark, type Endnote, type EndnotePosition, type EndnoteProperties, type Field, type FieldCharContent, type FieldType, type FloatingTableProperties, type FontInfo, type FontTable, type FooterReference, type Footnote, type FootnotePosition, type FootnoteProperties, type HeaderFooter, type HeaderFooterType, type HeaderReference, type Hyperlink, type Image, type ImageCrop, type ImagePadding, type ImagePosition, type ImageSize, type ImageTransform, type ImageWrap, type InlineSdt, type Insertion, type InstrTextContent, type KnownBorderStyle, type LevelSuffix, type LineNumberRestart, type LineSpacingRule, type ListLevel, type ListRendering, type MathEquation, type MediaFile, type MoveFrom, type MoveFromRangeEnd, type MoveFromRangeStart, type MoveTo, type MoveToRangeEnd, type MoveToRangeStart, type NoBreakHyphenContent, type NoteNumberRestart, type NoteReferenceContent, type NumberFormat, type NumberingDefinitions, type NumberingInstance, type PageOrientation, type Paragraph, type ParagraphAlignment, type ParagraphContent, type ParagraphFormatting, type ParagraphMarkChange, type ParagraphPropertyChange, type PictureWatermark, type PropertyChangeInfo, type Relationship, type RelationshipMap, type RelationshipType, type Run, type RunContent, type RunPropertyChange, type SdtProperties, type SdtType, type Section, type SectionProperties, type SectionPropertyChange, type SectionStart, type ShadingProperties, type Shape, type ShapeContent, type ShapeFill, type ShapeOutline, type ShapeTextBody, type ShapeType, type SimpleField, type SoftHyphenContent, type SpacingExplicit, type Style, type StyleDefinitions, type StyleType, type SymbolContent, type TabContent, type TabLeader, type TabStop, type TabStopAlignment, type Table, type TableBorders, type TableCell, type TableCellBorders, type TableCellFormatting, type TableCellPropertyChange, type TableFormatting, type TableLook, type TableMeasurement, type TablePropertyChange, type TableRow, type TableRowFormatting, type TableRowPropertyChange, type TableStructuralChangeInfo, type TableWidthType, type TextBox, type TextContent, type TextEffect, type TextFormatting, type TextWatermark, type Theme, type ThemeColorScheme, type ThemeColorSlot, type ThemeFont, type ThemeFontScheme, type TrackedChangeInfo, type TrackedRunChange, type UnderlineStyle, type VerticalAlign, type Watermark };
+import { $ as ImageTransform, $t as TrackedRunChange, A as ComplexField, An as TextFormatting, At as SectionPropertyChange, B as FooterReference, Bt as SymbolContent, C as BookmarkStart, Cn as TableCellFormatting, Ct as Run, D as CommentRangeEnd, Dn as TableRowFormatting, Dt as SdtType, E as Comment, En as TableMeasurement, Et as SdtProperties, F as EndnotePosition, Fn as ShadingProperties, Ft as ShapeOutline, G as HeaderFooterType, Gt as TablePropertyChange, H as FootnotePosition, Ht as Table, I as EndnoteProperties, In as ThemeColorSlot, It as ShapeTextBody, J as Image, Jt as TableStructuralChangeInfo, K as HeaderReference, Kt as TableRow, L as Field, Lt as ShapeType, M as DocumentBody, Mn as BorderSpec, Mt as Shape, N as DrawingContent, Nn as ColorValue, Nt as ShapeContent, O as CommentRangeStart, On as TableWidthType, Ot as Section, P as Endnote, Pn as KnownBorderStyle, Pt as ShapeFill, Q as ImageSize, Qt as TrackedChangeInfo, R as FieldCharContent, Rt as SimpleField, S as BookmarkEnd, Sn as TableCellBorders, St as PropertyChangeInfo, T as Column, Tn as TableLook, Tt as RunPropertyChange, U as FootnoteProperties, Ut as TableCell, V as Footnote, Vt as TabContent, W as HeaderFooter, Wt as TableCellPropertyChange, X as ImagePadding, Xt as TextContent, Y as ImageCrop, Yt as TextBox, Z as ImagePosition, Zt as TextWatermark, _ as ThemeColorScheme, _n as SpacingExplicit, _t as Paragraph, a as DocxPackage, an as ListLevel, at as MAX_REVISION_ID, b as BlockContent, bn as TabStopAlignment, bt as ParagraphPropertyChange, c as FontTable, cn as NumberingDefinitions, ct as MoveFromRangeEnd, d as RelationshipMap, dn as ConditionalFormatStyle, dt as MoveToRangeEnd, en as VerticalAlign, et as ImageWrap, f as RelationshipType, fn as EmphasisMark, ft as MoveToRangeStart, g as Theme, gn as ParagraphFormatting, gt as PageOrientation, h as StyleType, hn as ParagraphAlignment, ht as NoteReferenceContent, i as DocxConformanceClass, in as LevelSuffix, it as LineNumberRestart, j as Deletion, jn as UnderlineStyle, jt as SectionStart, k as CommentReference, kn as TextEffect, kt as SectionProperties, l as MediaFile, ln as NumberingInstance, lt as MoveFromRangeStart, m as StyleDefinitions, mn as LineSpacingRule, mt as NoteNumberRestart, n as Document, nn as normalizeRevisionId, nt as Insertion, o as DocDefaults, on as ListRendering, ot as MathEquation, p as Style, pn as FloatingTableProperties, pt as NoBreakHyphenContent, q as Hyperlink, qt as TableRowPropertyChange, r as DocumentSettings, rn as AbstractNumbering, rt as InstrTextContent, s as FontInfo, sn as NumberFormat, st as MoveFrom, t as DOCX_CONFORMANCE_CLASSES, tn as Watermark, tt as InlineSdt, u as Relationship, un as CellMargins, ut as MoveTo, v as ThemeFont, vn as TabLeader, vt as ParagraphContent, w as BreakContent, wn as TableFormatting, wt as RunContent, x as BlockSdt, xn as TableBorders, xt as PictureWatermark, y as ThemeFontScheme, yn as TabStop, yt as ParagraphMarkChange, z as FieldType, zt as SoftHyphenContent } from "../document-DfFH8YGu.js";
+export { type AbstractNumbering, type BlockContent, type BlockSdt, type BookmarkEnd, type BookmarkStart, type BorderSpec, type BreakContent, type CellMargins, type ColorValue, type Column, type Comment, type CommentRangeEnd, type CommentRangeStart, type CommentReference, type ComplexField, type ConditionalFormatStyle, DOCX_CONFORMANCE_CLASSES, type Deletion, type DocDefaults, Document, type DocumentBody, DocumentSettings, DocxConformanceClass, DocxPackage, type DrawingContent, type EmphasisMark, type Endnote, type EndnotePosition, type EndnoteProperties, type Field, type FieldCharContent, type FieldType, type FloatingTableProperties, type FontInfo, type FontTable, type FooterReference, type Footnote, type FootnotePosition, type FootnoteProperties, type HeaderFooter, type HeaderFooterType, type HeaderReference, type Hyperlink, type Image, type ImageCrop, type ImagePadding, type ImagePosition, type ImageSize, type ImageTransform, type ImageWrap, type InlineSdt, type Insertion, type InstrTextContent, type KnownBorderStyle, type LevelSuffix, type LineNumberRestart, type LineSpacingRule, type ListLevel, type ListRendering, MAX_REVISION_ID, type MathEquation, type MediaFile, type MoveFrom, type MoveFromRangeEnd, type MoveFromRangeStart, type MoveTo, type MoveToRangeEnd, type MoveToRangeStart, type NoBreakHyphenContent, type NoteNumberRestart, type NoteReferenceContent, type NumberFormat, type NumberingDefinitions, type NumberingInstance, type PageOrientation, type Paragraph, type ParagraphAlignment, type ParagraphContent, type ParagraphFormatting, type ParagraphMarkChange, type ParagraphPropertyChange, type PictureWatermark, type PropertyChangeInfo, type Relationship, type RelationshipMap, type RelationshipType, type Run, type RunContent, type RunPropertyChange, type SdtProperties, type SdtType, type Section, type SectionProperties, type SectionPropertyChange, type SectionStart, type ShadingProperties, type Shape, type ShapeContent, type ShapeFill, type ShapeOutline, type ShapeTextBody, type ShapeType, type SimpleField, type SoftHyphenContent, type SpacingExplicit, type Style, type StyleDefinitions, type StyleType, type SymbolContent, type TabContent, type TabLeader, type TabStop, type TabStopAlignment, type Table, type TableBorders, type TableCell, type TableCellBorders, type TableCellFormatting, type TableCellPropertyChange, type TableFormatting, type TableLook, type TableMeasurement, type TablePropertyChange, type TableRow, type TableRowFormatting, type TableRowPropertyChange, type TableStructuralChangeInfo, type TableWidthType, type TextBox, type TextContent, type TextEffect, type TextFormatting, type TextWatermark, type Theme, type ThemeColorScheme, type ThemeColorSlot, type ThemeFont, type ThemeFontScheme, type TrackedChangeInfo, type TrackedRunChange, type UnderlineStyle, type VerticalAlign, type Watermark, normalizeRevisionId };

package/dist/model/document.js

@@ -1,9 +1,2 @@
-//#region src/model/document.ts
-/** DOCX package conformance classes. */
-const DOCX_CONFORMANCE_CLASSES = Object.freeze({
-	STRICT: "strict",
-	TRANSITIONAL: "transitional",
-	UNKNOWN: "unknown"
-});
-//#endregion
-export { DOCX_CONFORMANCE_CLASSES };
+import { n as MAX_REVISION_ID, r as normalizeRevisionId, t as DOCX_CONFORMANCE_CLASSES } from "../document-D4XHQQIj.js";
+export { DOCX_CONFORMANCE_CLASSES, MAX_REVISION_ID, normalizeRevisionId };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stll/docx-core",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Typed OOXML/DOCX document model with parsing, validation, and serialization, plus a legal-source compiler that produces DOCX packages.",
   "keywords": [
     "document-model",
@@ -54,12 +54,12 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "better-result": "2.9.2",
+    "better-result": "2.10.0",
     "jszip": "3.10.1"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",
-    "tsdown": "0.22.3"
+    "tsdown": "0.22.9"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts"