@stll/folio-core 0.11.0 → 0.13.0

package/dist/docx/selectiveXmlPatch.js

@@ -74,6 +74,66 @@ function extractParagraphXml(serializedXml, paraId) {
 	return serializedXml.slice(offsets.start, offsets.end);
 }
 /**
+* Single linear-scan index of every `<w:p>` element's start/end offsets,
+* keyed by `w14:paraId`. Generalizes {@link findParagraphOffsets} (one
+* regex-scan-plus-depth-walk per lookup) to build every paragraph's offsets
+* in a single pass, so a caller that needs many paragraphs from the same XML
+* (e.g. `collectChangedNoteParaIds` in rezip.ts, walking every note paraId)
+* does O(1) map lookups afterward instead of re-scanning the whole XML once
+* per id — O(ids * XML length) collapses to O(XML length).
+*
+* A `<w:p>` nested inside another (e.g. inside `mc:AlternateContent`) is
+* indexed too via a depth stack, matching every element `findParagraphOffsets`
+* can resolve. A paraId that appears on more than one element is ambiguous —
+* mirroring {@link findParagraphOffsets}'s single-match requirement — and is
+* omitted from the index, so a lookup misses exactly where the per-id
+* function would return null.
+*/
+function buildParagraphOffsetIndex(xml) {
+	const seenCount = /* @__PURE__ */ new Map();
+	const ranges = /* @__PURE__ */ new Map();
+	const stack = [];
+	let pos = 0;
+	const noteOpen = (paraId) => {
+		if (paraId) seenCount.set(paraId, (seenCount.get(paraId) ?? 0) + 1);
+	};
+	const noteRange = (paraId, start, end) => {
+		if (paraId) ranges.set(paraId, {
+			start,
+			end
+		});
+	};
+	while (pos < xml.length) {
+		const tagStart = xml.indexOf("<", pos);
+		if (tagStart === -1) break;
+		if (xml.startsWith("</w:p>", tagStart)) {
+			const frame = stack.pop();
+			const end = tagStart + 6;
+			if (frame) noteRange(frame.paraId, frame.start, end);
+			pos = end;
+			continue;
+		}
+		if (!xml.startsWith("<w:p", tagStart) || !isXmlNameBoundary(xml[tagStart + 4])) {
+			pos = tagStart + 1;
+			continue;
+		}
+		const tagEnd = xml.indexOf(">", tagStart);
+		if (tagEnd === -1) break;
+		const openTag = xml.slice(tagStart, tagEnd + 1);
+		const paraId = /\bw14:paraId="(?<id>[^"]*)"/u.exec(openTag)?.groups?.["id"];
+		noteOpen(paraId);
+		if (xml[tagEnd - 1] === "/") noteRange(paraId, tagStart, tagEnd + 1);
+		else stack.push({
+			start: tagStart,
+			paraId
+		});
+		pos = tagEnd + 1;
+	}
+	const index = /* @__PURE__ */ new Map();
+	for (const [id, range] of ranges) if (seenCount.get(id) === 1) index.set(id, range);
+	return index;
+}
+/**
 * Count <w:p> elements in an XML string (top-level paragraph count).
 * Counts opening <w:p tags that are NOT self-closing.
 */
@@ -484,4 +544,4 @@ function escapeRegExp(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
 //#endregion
-export { buildPatchedDocumentXml, buildPatchedNoteXml, buildPatchedNumberingXml, collectChangedNumberingDefs, collectParaIds, countParagraphElements, extractParagraphXml, findParagraphOffsets, isXmlNameBoundary, validatePatchSafety };
+export { buildParagraphOffsetIndex, buildPatchedDocumentXml, buildPatchedNoteXml, buildPatchedNumberingXml, collectChangedNumberingDefs, collectParaIds, countParagraphElements, extractParagraphXml, findParagraphOffsets, isXmlNameBoundary, validatePatchSafety };

package/dist/docx/serializer/blockSdtSerializer.js

@@ -1,3 +1,4 @@
+import { isSingleWellFormedElement } from "./xmlUtils.js";
 import { reconcileRawSdtPr } from "../sdtPropertiesPatch.js";
 //#region src/docx/serializer/blockSdtSerializer.ts
 function escapeXmlAttr(value) {
@@ -73,14 +74,14 @@ function extractDateFullDate(blockSdt) {
 }
 function serializeBlockSdt(blockSdt, serializeChild) {
 	const props = blockSdt.properties;
-	const baseSdtPr = props.rawPropertiesXml ?? serializeFallbackSdtPr(props);
+	const baseSdtPr = props.rawPropertiesXml && isSingleWellFormedElement(props.rawPropertiesXml, "sdtPr") ? props.rawPropertiesXml : serializeFallbackSdtPr(props);
 	const dateFullDate = extractDateFullDate(blockSdt);
 	const dropdownLastValue = extractDropdownLastValue(blockSdt);
 	const sdtPrXml = reconcileRawSdtPr(baseSdtPr, props, {
 		...dateFullDate !== void 0 ? { dateFullDate } : {},
 		...dropdownLastValue !== void 0 ? { dropdownLastValue } : {}
 	});
-	const sdtEndPrXml = props.rawEndPropertiesXml ?? "";
+	const sdtEndPrXml = props.rawEndPropertiesXml && isSingleWellFormedElement(props.rawEndPropertiesXml, "sdtEndPr") ? props.rawEndPropertiesXml : "";
 	const contentXml = blockSdt.content.map(serializeChild).join("");
 	return `<w:sdt>${sdtPrXml}${sdtEndPrXml}${props.rawSdtChildrenBeforeContent ?? ""}<w:sdtContent>${contentXml}</w:sdtContent>${props.rawSdtChildrenAfterContent ?? ""}</w:sdt>`;
 }

package/dist/docx/serializer/commentSerializer.js

@@ -27,8 +27,8 @@ function serializeRunContent(run) {
 */
 function commentParagraphOpenTag(p) {
 	const attrs = [];
-	if (p.paraId) attrs.push(`w14:paraId="${p.paraId}"`);
-	if (p.textId) attrs.push(`w14:textId="${p.textId}"`);
+	if (p.paraId) attrs.push(`w14:paraId="${escapeXml(p.paraId)}"`);
+	if (p.textId) attrs.push(`w14:textId="${escapeXml(p.textId)}"`);
 	return attrs.length > 0 ? `<w:p ${attrs.join(" ")}>` : "<w:p>";
 }
 function serializeParagraph(p) {
@@ -46,8 +46,7 @@ function serializeParagraphWithAnnotationRef(p) {
 	return xml;
 }
 function serializeComment(comment) {
-	const attrs = [`w:id="${comment.id}"`];
-	if (comment.author) attrs.push(`w:author="${escapeXml(comment.author)}"`);
+	const attrs = [`w:id="${comment.id}"`, `w:author="${escapeXml(comment.author)}"`];
 	if (comment.initials) attrs.push(`w:initials="${escapeXml(comment.initials)}"`);
 	if (comment.date) attrs.push(`w:date="${escapeXml(comment.date)}"`);
 	let xml = `<w:comment ${attrs.join(" ")}>`;
@@ -174,8 +173,8 @@ function serializeCommentsExtended(comments) {
 	if (!entries) return null;
 	let xml = COMMENTS_EXTENDED_HEADER;
 	for (const entry of entries) {
-		const parentAttr = entry.paraIdParent !== void 0 ? ` w15:paraIdParent="${entry.paraIdParent}"` : "";
-		xml += `<w15:commentEx w15:paraId="${entry.paraId}"${parentAttr} w15:done="${entry.done ? "1" : "0"}"/>`;
+		const parentAttr = entry.paraIdParent !== void 0 ? ` w15:paraIdParent="${escapeXml(entry.paraIdParent)}"` : "";
+		xml += `<w15:commentEx w15:paraId="${escapeXml(entry.paraId)}"${parentAttr} w15:done="${entry.done ? "1" : "0"}"/>`;
 	}
 	xml += "</w15:commentsEx>";
 	return xml;

package/dist/docx/serializer/documentSerializer.js

@@ -1,8 +1,8 @@
 import { serializeBlockSdt } from "./blockSdtSerializer.js";
+import { serializeTable } from "./tableSerializer.js";
 import { resetAutoIdCounter } from "./runSerializer.js";
 import { serializeSectionProperties } from "./sectionPropertiesSerializer.js";
 import { serializeParagraph } from "./paragraphSerializer.js";
-import { serializeTable } from "./tableSerializer.js";
 //#region src/docx/serializer/documentSerializer.ts
 /**
 * Standard OOXML namespaces for document.xml
@@ -74,7 +74,7 @@ function buildNamespaceDeclarations() {
 */
 function serializeBlockContent(block) {
 	if (block.type === "paragraph") return serializeParagraph(block);
-	if (block.type === "table") return serializeTable(block);
+	if (block.type === "table") return serializeTable(block, serializeParagraph);
 	return serializeBlockSdt(block, serializeBlockContent);
 }
 /**

package/dist/docx/serializer/headerFooterSerializer.js

@@ -1,8 +1,8 @@
 import { canReplayHeaderFooterVerbatim, getHeaderFooterVerbatimXml } from "../headerFooterVerbatim.js";
 import { escapeXml } from "./xmlUtils.js";
 import { serializeBlockSdt } from "./blockSdtSerializer.js";
-import { serializeParagraph } from "./paragraphSerializer.js";
 import { serializeTable } from "./tableSerializer.js";
+import { serializeParagraph } from "./paragraphSerializer.js";
 //#region src/docx/serializer/headerFooterSerializer.ts
 const NAMESPACES = {
 	wpc: "http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas",
@@ -36,7 +36,7 @@ function buildNamespaceDeclarations() {
 */
 function serializeBlock(block) {
 	if (block.type === "paragraph") return serializeParagraph(block);
-	if (block.type === "table") return serializeTable(block);
+	if (block.type === "table") return serializeTable(block, serializeParagraph);
 	return serializeBlockSdt(block, serializeBlock);
 }
 /**

package/dist/docx/serializer/noteSerializer.js

@@ -1,6 +1,6 @@
 import { serializeBlockSdt } from "./blockSdtSerializer.js";
-import { serializeParagraph } from "./paragraphSerializer.js";
 import { serializeTable } from "./tableSerializer.js";
+import { serializeParagraph } from "./paragraphSerializer.js";
 //#region src/docx/serializer/noteSerializer.ts
 const NAMESPACES = {
 	wpc: "http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas",
@@ -34,7 +34,7 @@ function buildNamespaceDeclarations() {
 */
 function serializeBlock(block) {
 	if (block.type === "paragraph") return serializeParagraph(block);
-	if (block.type === "table") return serializeTable(block);
+	if (block.type === "table") return serializeTable(block, serializeParagraph);
 	return serializeBlockSdt(block, serializeBlock);
 }
 /**

package/dist/docx/serializer/paragraphSerializer.js

@@ -1,9 +1,11 @@
 import { numPrEqual } from "../numberingParser.js";
-import { escapeXml, intAttr } from "./xmlUtils.js";
+import { isValidHexColor } from "../../utils/colorResolver.js";
+import { escapeXml, intAttr, isSingleWellFormedElement } from "./xmlUtils.js";
 import { reconcileRawSdtPr } from "../sdtPropertiesPatch.js";
 import { serializeBorder } from "./borderSerializer.js";
 import { serializeRun, serializeTextFormatting } from "./runSerializer.js";
 import { serializeSectionProperties } from "./sectionPropertiesSerializer.js";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/paragraphSerializer.ts
 /**
 * Serialize paragraph borders (w:pBdr)
@@ -44,15 +46,15 @@ function serializeParagraphBorders(borders) {
 function serializeShading(shading) {
 	if (!shading) return "";
 	const attrs = [];
-	if (shading.pattern) attrs.push(`w:val="${shading.pattern}"`);
+	if (shading.pattern) attrs.push(`w:val="${escapeXml(shading.pattern)}"`);
 	else attrs.push("w:val=\"clear\"");
-	if (shading.color?.rgb) attrs.push(`w:color="${shading.color.rgb}"`);
+	if (shading.color?.rgb && isValidHexColor(shading.color.rgb)) attrs.push(`w:color="${escapeXml(shading.color.rgb)}"`);
 	else if (shading.color?.auto) attrs.push("w:color=\"auto\"");
-	if (shading.fill?.rgb) attrs.push(`w:fill="${shading.fill.rgb}"`);
+	if (shading.fill?.rgb && isValidHexColor(shading.fill.rgb)) attrs.push(`w:fill="${escapeXml(shading.fill.rgb)}"`);
 	else if (shading.fill?.auto) attrs.push("w:fill=\"auto\"");
-	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${shading.fill.themeColor}"`);
-	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${shading.fill.themeTint}"`);
-	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${shading.fill.themeShade}"`);
+	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${escapeXml(shading.fill.themeColor)}"`);
+	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${escapeXml(shading.fill.themeTint)}"`);
+	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${escapeXml(shading.fill.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:shd ${attrs.join(" ")}/>`;
 }
@@ -132,7 +134,7 @@ function serializeFrameProperties(frame) {
 * Serialize paragraph formatting properties to w:pPr XML
 */
 function serializeTrackedChangeAttrs(info) {
-	const parts = [`w:id="${info.id}"`, `w:author="${escapeXml(info.author)}"`];
+	const parts = [`w:id="${normalizeRevisionId(info.id)}"`, `w:author="${escapeXml(info.author)}"`];
 	if (info.date !== void 0) parts.push(`w:date="${escapeXml(info.date)}"`);
 	return parts.join(" ");
 }
@@ -155,6 +157,7 @@ function serializeParagraphFormatting(formatting, propertyChanges, pPrMark) {
 		const frameXml = serializeFrameProperties(formatting.frame);
 		if (frameXml) parts.push(frameXml);
 		pushToggle("widowControl", formatting.widowControl);
+		pushToggle("snapToGrid", formatting.snapToGrid);
 		const numPrXml = formatting.numPrFromStyle != null && numPrEqual(formatting.numPr, formatting.numPrFromStyle) ? "" : serializeNumbering(formatting.numPr);
 		if (numPrXml) parts.push(numPrXml);
 		const bordersXml = serializeParagraphBorders(formatting.borders);
@@ -197,7 +200,7 @@ function extractRPrInner(rPrXml) {
 	return rPrXml.slice(7, -8);
 }
 function serializeParagraphPropertyChange(change) {
-	const normalizedId = Number.isInteger(change.info.id) && change.info.id >= 0 ? change.info.id : 0;
+	const normalizedId = normalizeRevisionId(change.info.id);
 	const authorCandidate = typeof change.info.author === "string" ? change.info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof change.info.date === "string" ? change.info.date.trim() : void 0;
@@ -354,17 +357,19 @@ function serializeInlineSdt(sdt) {
 			case "inlineSdt": return serializeInlineSdt(item);
 			case "insertion": return serializeTrackedChange("ins", item);
 			case "deletion": return serializeTrackedChange("del", item);
+			case "moveFrom": return serializeTrackedChange("moveFrom", item);
+			case "moveTo": return serializeTrackedChange("moveTo", item);
 			case "mathEquation": return item.ommlXml || "";
 			default: return item;
 		}
 	}).join("");
-	const baseSdtPr = props.rawPropertiesXml ?? synthesizeInlineSdtPr(props);
+	const baseSdtPr = props.rawPropertiesXml && isSingleWellFormedElement(props.rawPropertiesXml, "sdtPr") ? props.rawPropertiesXml : synthesizeInlineSdtPr(props);
 	const dateFullDate = props.sdtType === "date" && props.dateValueISO ? props.dateValueISO : void 0;
 	const dropdownLastValue = (props.sdtType === "dropdown" || props.sdtType === "comboBox") && typeof props.dropdownLastValue === "string" ? props.dropdownLastValue : void 0;
 	return `<w:sdt>${reconcileRawSdtPr(baseSdtPr, props, {
 		...dateFullDate !== void 0 ? { dateFullDate } : {},
 		...dropdownLastValue !== void 0 ? { dropdownLastValue } : {}
-	})}${props.rawEndPropertiesXml ?? ""}<w:sdtContent>${contentXml}</w:sdtContent></w:sdt>`;
+	})}${props.rawEndPropertiesXml && isSingleWellFormedElement(props.rawEndPropertiesXml, "sdtEndPr") ? props.rawEndPropertiesXml : ""}<w:sdtContent>${contentXml}</w:sdtContent></w:sdt>`;
 }
 function serializeMoveRangeStart(tag, marker) {
 	return `<w:${tag} ${[`w:id="${marker.id}"`, `w:name="${escapeXml(marker.name)}"`].join(" ")}/>`;
@@ -377,7 +382,7 @@ function rewriteRunTextAsDeleted(xml) {
 }
 function serializeTrackedChange(tag, change) {
 	const info = change.info;
-	const normalizedId = Number.isInteger(info.id) && info.id >= 0 ? info.id : 0;
+	const normalizedId = normalizeRevisionId(info.id);
 	const authorCandidate = typeof info.author === "string" ? info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof info.date === "string" ? info.date.trim() : void 0;
@@ -452,8 +457,8 @@ function serializeParagraphContent(content, explicitCommentReferenceIds) {
 function serializeParagraph(paragraph) {
 	const parts = [];
 	const attrs = [];
-	if (paragraph.paraId) attrs.push(`w14:paraId="${paragraph.paraId}"`);
-	if (paragraph.textId) attrs.push(`w14:textId="${paragraph.textId}"`);
+	if (paragraph.paraId) attrs.push(`w14:paraId="${escapeXml(paragraph.paraId)}"`);
+	if (paragraph.textId) attrs.push(`w14:textId="${escapeXml(paragraph.textId)}"`);
 	const attrsStr = attrs.length > 0 ? ` ${attrs.join(" ")}` : "";
 	const pPrXml = serializeParagraphFormatting(paragraph.formatting, paragraph.propertyChanges, paragraph.pPrMark);
 	const sectionPropertiesXml = serializeSectionProperties(paragraph.sectionProperties);
@@ -478,7 +483,10 @@ function serializeParagraph(paragraph) {
 }
 function injectRenderedPageBreakIntoFirstRun(xml) {
 	const runOpeningTag = /<w:r(?=[\s>/])[^>]*>/u;
-	if (!runOpeningTag.test(xml)) return null;
+	const openingTag = runOpeningTag.exec(xml);
+	if (!openingTag) return null;
+	const runEnd = xml.indexOf("</w:r>", openingTag.index + openingTag[0].length);
+	if (runEnd !== -1 && xml.slice(openingTag.index + openingTag[0].length, runEnd).includes("<w:lastRenderedPageBreak/>")) return xml;
 	return xml.replace(runOpeningTag, (match) => `${match}<w:lastRenderedPageBreak/>`);
 }
 /**

package/dist/docx/serializer/runSerializer.js

@@ -1,7 +1,10 @@
 import { HIGHLIGHT_COLOR_VALUES } from "../../types/documentEnumValues.js";
+import { isValidHexColor } from "../../utils/colorResolver.js";
 import { escapeXml, intAttr } from "./xmlUtils.js";
+import { serializeTable } from "./tableSerializer.js";
 import { serializeParagraph } from "./paragraphSerializer.js";
 import { panic } from "better-result";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/runSerializer.ts
 /**
 * Run Serializer - Serialize runs to OOXML XML
@@ -41,10 +44,10 @@ function serializeColorElement(color) {
 	if (!color) return "";
 	const attrs = [];
 	if (color.auto) attrs.push("w:val=\"auto\"");
-	else if (color.rgb) attrs.push(`w:val="${color.rgb}"`);
-	if (color.themeColor) attrs.push(`w:themeColor="${color.themeColor}"`);
-	if (color.themeTint) attrs.push(`w:themeTint="${color.themeTint}"`);
-	if (color.themeShade) attrs.push(`w:themeShade="${color.themeShade}"`);
+	else if (color.rgb && isValidHexColor(color.rgb)) attrs.push(`w:val="${escapeXml(color.rgb)}"`);
+	if (color.themeColor) attrs.push(`w:themeColor="${escapeXml(color.themeColor)}"`);
+	if (color.themeTint) attrs.push(`w:themeTint="${escapeXml(color.themeTint)}"`);
+	if (color.themeShade) attrs.push(`w:themeShade="${escapeXml(color.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:color ${attrs.join(" ")}/>`;
 }
@@ -54,15 +57,15 @@ function serializeColorElement(color) {
 function serializeShading(shading) {
 	if (!shading) return "";
 	const attrs = [];
-	if (shading.pattern) attrs.push(`w:val="${shading.pattern}"`);
+	if (shading.pattern) attrs.push(`w:val="${escapeXml(shading.pattern)}"`);
 	else attrs.push("w:val=\"clear\"");
-	if (shading.color?.rgb) attrs.push(`w:color="${shading.color.rgb}"`);
+	if (shading.color?.rgb && isValidHexColor(shading.color.rgb)) attrs.push(`w:color="${escapeXml(shading.color.rgb)}"`);
 	else if (shading.color?.auto) attrs.push("w:color=\"auto\"");
-	if (shading.fill?.rgb) attrs.push(`w:fill="${shading.fill.rgb}"`);
+	if (shading.fill?.rgb && isValidHexColor(shading.fill.rgb)) attrs.push(`w:fill="${escapeXml(shading.fill.rgb)}"`);
 	else if (shading.fill?.auto) attrs.push("w:fill=\"auto\"");
-	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${shading.fill.themeColor}"`);
-	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${shading.fill.themeTint}"`);
-	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${shading.fill.themeShade}"`);
+	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${escapeXml(shading.fill.themeColor)}"`);
+	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${escapeXml(shading.fill.themeTint)}"`);
+	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${escapeXml(shading.fill.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:shd ${attrs.join(" ")}/>`;
 }
@@ -136,10 +139,10 @@ function serializeTextFormatting(formatting) {
 	if (formatting.underline) {
 		const uAttrs = [`w:val="${formatting.underline.style}"`];
 		if (formatting.underline.color) {
-			if (formatting.underline.color.rgb) uAttrs.push(`w:color="${formatting.underline.color.rgb}"`);
-			if (formatting.underline.color.themeColor) uAttrs.push(`w:themeColor="${formatting.underline.color.themeColor}"`);
-			if (formatting.underline.color.themeTint) uAttrs.push(`w:themeTint="${formatting.underline.color.themeTint}"`);
-			if (formatting.underline.color.themeShade) uAttrs.push(`w:themeShade="${formatting.underline.color.themeShade}"`);
+			if (formatting.underline.color.rgb && isValidHexColor(formatting.underline.color.rgb)) uAttrs.push(`w:color="${escapeXml(formatting.underline.color.rgb)}"`);
+			if (formatting.underline.color.themeColor) uAttrs.push(`w:themeColor="${escapeXml(formatting.underline.color.themeColor)}"`);
+			if (formatting.underline.color.themeTint) uAttrs.push(`w:themeTint="${escapeXml(formatting.underline.color.themeTint)}"`);
+			if (formatting.underline.color.themeShade) uAttrs.push(`w:themeShade="${escapeXml(formatting.underline.color.themeShade)}"`);
 		}
 		parts.push(`<w:u ${uAttrs.join(" ")}/>`);
 	}
@@ -159,7 +162,7 @@ function extractRPrInner(rPrXml) {
 	return rPrXml.slice(7, -8);
 }
 function serializeRunPropertyChange(change) {
-	const normalizedId = Number.isInteger(change.info.id) && change.info.id >= 0 ? change.info.id : 0;
+	const normalizedId = normalizeRevisionId(change.info.id);
 	const authorCandidate = typeof change.info.author === "string" ? change.info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof change.info.date === "string" ? change.info.date.trim() : void 0;
@@ -245,11 +248,11 @@ function serializeNoBreakHyphen(_content) {
 /** Serialize a color value to DrawingML a:srgbClr or a:schemeClr */
 function serializeDrawingColor(color) {
 	if (!color) return "";
-	if (color.rgb) return `<a:srgbClr val="${color.rgb.replace("#", "")}"/>`;
+	if (color.rgb && isValidHexColor(color.rgb)) return `<a:srgbClr val="${escapeXml(color.rgb.replace("#", ""))}"/>`;
 	if (color.themeColor) {
-		let clr = `<a:schemeClr val="${color.themeColor}"`;
-		if (color.themeTint) clr += `><a:tint val="${color.themeTint}"/></a:schemeClr>`;
-		else if (color.themeShade) clr += `><a:shade val="${color.themeShade}"/></a:schemeClr>`;
+		let clr = `<a:schemeClr val="${escapeXml(color.themeColor)}"`;
+		if (color.themeTint) clr += `><a:tint val="${escapeXml(color.themeTint)}"/></a:schemeClr>`;
+		else if (color.themeShade) clr += `><a:shade val="${escapeXml(color.themeShade)}"/></a:schemeClr>`;
 		else clr += `/>`;
 		return clr;
 	}
@@ -418,8 +421,8 @@ function serializeDrawingContent(content) {
 	].join("");
 }
 /** Serialize text body content for shapes/textboxes */
-function serializeShapeTextBody(paragraphs) {
-	return paragraphs.map((p) => serializeParagraph(p)).join("");
+function serializeShapeTextBody(blocks) {
+	return blocks.map((block) => block.type === "paragraph" ? serializeParagraph(block) : serializeTable(block, serializeParagraph)).join("");
 }
 /**
 * Serialize shape content to full DrawingML XML (wps:wsp inside w:drawing)
@@ -534,6 +537,7 @@ function serializeRunContent(content) {
 		case "instrText": return serializeInstrText(content);
 		case "softHyphen": return serializeSoftHyphen(content);
 		case "noBreakHyphen": return serializeNoBreakHyphen(content);
+		case "renderedPageBreak": return "<w:lastRenderedPageBreak/>";
 		case "drawing":
 			if (content.rawXml) return content.rawXml;
 			return serializeDrawingContent(content);

package/dist/docx/serializer/sectionPropertiesSerializer.js

@@ -1,6 +1,7 @@
 import { getUnserializedSectionPropertyChildNames } from "../sectionParser.js";
 import { escapeXml, intAttr } from "./xmlUtils.js";
 import { serializeBorder } from "./borderSerializer.js";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/sectionPropertiesSerializer.ts
 const serializeHeaderReference = (ref) => `<w:headerReference w:type="${ref.type}" r:id="${ref.rId}"/>`;
 const serializeFooterReference = (ref) => `<w:footerReference w:type="${ref.type}" r:id="${ref.rId}"/>`;
@@ -132,7 +133,7 @@ function serializeOnOffElement(value, name) {
 	return value ? `<w:${name}/>` : `<w:${name} w:val="0"/>`;
 }
 function serializeSectionPropertyChange(change) {
-	const normalizedId = Number.isInteger(change.info.id) && change.info.id >= 0 ? change.info.id : 0;
+	const normalizedId = normalizeRevisionId(change.info.id);
 	const authorCandidate = typeof change.info.author === "string" ? change.info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof change.info.date === "string" ? change.info.date.trim() : void 0;

package/dist/docx/serializer/stylesSerializer.js

@@ -1,7 +1,7 @@
 import { escapeXml } from "./xmlUtils.js";
+import { serializeTableCellFormatting, serializeTableFormatting, serializeTableRowFormatting } from "./tableSerializer.js";
 import { serializeTextFormatting } from "./runSerializer.js";
 import { serializeParagraphFormatting } from "./paragraphSerializer.js";
-import { serializeTableCellFormatting, serializeTableFormatting, serializeTableRowFormatting } from "./tableSerializer.js";
 //#region src/docx/serializer/stylesSerializer.ts
 const W_NS = "http://schemas.openxmlformats.org/wordprocessingml/2006/main";
 const serializeStylesXml = (definitions) => {

package/dist/docx/serializer/tableSerializer.d.ts

@@ -1,6 +1,7 @@
 import { document_d_exports } from "../../types/document.js";
 
 //#region src/docx/serializer/tableSerializer.d.ts
+type ParagraphSerializer = (paragraph: document_d_exports.Paragraph) => string;
 /**
  * Serialize table formatting properties (w:tblPr)
  */
@@ -16,25 +17,25 @@ declare function serializeTableCellFormatting(formatting: document_d_exports.Tab
 /**
  * Serialize a table cell (w:tc)
  */
-declare function serializeTableCell(cell: document_d_exports.TableCell): string;
+declare function serializeTableCell(cell: document_d_exports.TableCell, serializeParagraph: ParagraphSerializer): string;
 /**
  * Serialize a table row (w:tr)
  */
-declare function serializeTableRow(row: document_d_exports.TableRow): string;
+declare function serializeTableRow(row: document_d_exports.TableRow, serializeParagraph: ParagraphSerializer): string;
 /**
  * Serialize a table to OOXML XML (w:tbl)
  *
  * @param table - The table to serialize
  * @returns XML string for the table
  */
-declare function serializeTable(table: document_d_exports.Table): string;
+declare function serializeTable(table: document_d_exports.Table, serializeParagraph: ParagraphSerializer): string;
 /**
  * Serialize multiple tables to OOXML XML
  *
  * @param tables - The tables to serialize
  * @returns XML string for all tables
  */
-declare function serializeTables(tables: document_d_exports.Table[]): string;
+declare function serializeTables(tables: document_d_exports.Table[], serializeParagraph: ParagraphSerializer): string;
 /**
  * Check if a table has any rows
  */

package/dist/docx/serializer/tableSerializer.js

@@ -1,9 +1,10 @@
+import { isValidHexColor } from "../../utils/colorResolver.js";
 import { escapeXml, intAttr } from "./xmlUtils.js";
 import { serializeBorder } from "./borderSerializer.js";
-import { serializeParagraph } from "./paragraphSerializer.js";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/tableSerializer.ts
 function normalizeTrackedChangeInfo(info) {
-	const normalizedId = Number.isInteger(info.id) && info.id >= 0 ? info.id : 0;
+	const normalizedId = normalizeRevisionId(info.id);
 	const authorCandidate = typeof info.author === "string" ? info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof info.date === "string" ? info.date.trim() : void 0;
@@ -78,15 +79,15 @@ function serializeCellMargins(margins, elementName) {
 function serializeShading(shading) {
 	if (!shading) return "";
 	const attrs = [];
-	if (shading.pattern) attrs.push(`w:val="${shading.pattern}"`);
+	if (shading.pattern) attrs.push(`w:val="${escapeXml(shading.pattern)}"`);
 	else attrs.push("w:val=\"clear\"");
-	if (shading.color?.rgb) attrs.push(`w:color="${shading.color.rgb}"`);
+	if (shading.color?.rgb && isValidHexColor(shading.color.rgb)) attrs.push(`w:color="${escapeXml(shading.color.rgb)}"`);
 	else if (shading.color?.auto) attrs.push("w:color=\"auto\"");
-	if (shading.fill?.rgb) attrs.push(`w:fill="${shading.fill.rgb}"`);
+	if (shading.fill?.rgb && isValidHexColor(shading.fill.rgb)) attrs.push(`w:fill="${escapeXml(shading.fill.rgb)}"`);
 	else if (shading.fill?.auto) attrs.push("w:fill=\"auto\"");
-	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${shading.fill.themeColor}"`);
-	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${shading.fill.themeTint}"`);
-	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${shading.fill.themeShade}"`);
+	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${escapeXml(shading.fill.themeColor)}"`);
+	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${escapeXml(shading.fill.themeTint)}"`);
+	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${escapeXml(shading.fill.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:shd ${attrs.join(" ")}/>`;
 }
@@ -247,12 +248,17 @@ function serializeTableCellFormatting(formatting, propertyChanges, structuralCha
 		if (formatting.textDirection) parts.push(`<w:textDirection w:val="${formatting.textDirection}"/>`);
 		if (formatting.fitText) parts.push("<w:tcFitText/>");
 		if (formatting.verticalAlign) parts.push(`<w:vAlign w:val="${formatting.verticalAlign}"/>`);
-		if (formatting.hideMark) parts.push("<w:hideMark/>");
+		if (formatting.hideMark !== void 0) parts.push(formatting.hideMark ? "<w:hideMark/>" : "<w:hideMark w:val=\"false\"/>");
 	}
 	if (structuralChange) {
 		if (structuralChange.type === "tableCellInsertion") parts.push(`<w:cellIns ${serializeTrackedChangeAttributes(structuralChange.info)}/>`);
 		else if (structuralChange.type === "tableCellDeletion") parts.push(`<w:cellDel ${serializeTrackedChangeAttributes(structuralChange.info)}/>`);
-		else if (structuralChange.type === "tableCellMerge") parts.push(`<w:cellMerge ${serializeTrackedChangeAttributes(structuralChange.info)}/>`);
+		else if (structuralChange.type === "tableCellMerge") {
+			const attrs = [serializeTrackedChangeAttributes(structuralChange.info)];
+			if (structuralChange.verticalMerge) attrs.push(`w:vMerge="${structuralChange.verticalMerge === "continue" ? "cont" : "rest"}"`);
+			if (structuralChange.verticalMergeOriginal) attrs.push(`w:vMergeOrig="${structuralChange.verticalMergeOriginal === "continue" ? "cont" : "rest"}"`);
+			parts.push(`<w:cellMerge ${attrs.join(" ")}/>`);
+		}
 	}
 	if (propertyChanges && propertyChanges.length > 0) parts.push(...propertyChanges.map((change) => serializeTableCellPropertyChange(change)));
 	if (parts.length === 0) return "";
@@ -277,31 +283,31 @@ function serializeTableGrid(columnWidths) {
 /**
 * Serialize cell content (paragraphs, nested tables)
 */
-function serializeCellContent(content) {
+function serializeCellContent(content, serializeParagraph) {
 	const parts = [];
 	for (const item of content) if (item.type === "paragraph") parts.push(serializeParagraph(item));
-	else parts.push(serializeTable(item));
+	else parts.push(serializeTable(item, serializeParagraph));
 	if (parts.length === 0) parts.push("<w:p/>");
 	return parts.join("");
 }
 /**
 * Serialize a table cell (w:tc)
 */
-function serializeTableCell(cell) {
+function serializeTableCell(cell, serializeParagraph) {
 	const parts = [];
 	const tcPrXml = serializeTableCellFormatting(cell.formatting, cell.propertyChanges, cell.structuralChange);
 	if (tcPrXml) parts.push(tcPrXml);
-	parts.push(serializeCellContent(cell.content));
+	parts.push(serializeCellContent(cell.content, serializeParagraph));
 	return `<w:tc>${parts.join("")}</w:tc>`;
 }
 /**
 * Serialize a table row (w:tr)
 */
-function serializeTableRow(row) {
+function serializeTableRow(row, serializeParagraph) {
 	const parts = [];
 	const trPrXml = serializeTableRowFormatting(row.formatting, row.propertyChanges, row.structuralChange);
 	if (trPrXml) parts.push(trPrXml);
-	for (const cell of row.cells) parts.push(serializeTableCell(cell));
+	for (const cell of row.cells) parts.push(serializeTableCell(cell, serializeParagraph));
 	return `<w:tr>${parts.join("")}</w:tr>`;
 }
 /**
@@ -310,13 +316,13 @@ function serializeTableRow(row) {
 * @param table - The table to serialize
 * @returns XML string for the table
 */
-function serializeTable(table) {
+function serializeTable(table, serializeParagraph) {
 	const parts = [];
 	const tblPrXml = serializeTableFormatting(table.formatting, table.propertyChanges);
 	if (tblPrXml) parts.push(tblPrXml);
 	const tblGridXml = serializeTableGrid(table.columnWidths);
 	if (tblGridXml) parts.push(tblGridXml);
-	for (const row of table.rows) parts.push(serializeTableRow(row));
+	for (const row of table.rows) parts.push(serializeTableRow(row, serializeParagraph));
 	return `<w:tbl>${parts.join("")}</w:tbl>`;
 }
 /**
@@ -325,8 +331,8 @@ function serializeTable(table) {
 * @param tables - The tables to serialize
 * @returns XML string for all tables
 */
-function serializeTables(tables) {
-	return tables.map(serializeTable).join("");
+function serializeTables(tables, serializeParagraph) {
+	return tables.map((table) => serializeTable(table, serializeParagraph)).join("");
 }
 /**
 * Check if a table has any rows

package/dist/docx/serializer/xmlUtils.d.ts

@@ -16,5 +16,17 @@ declare function escapeXml(text: string): string;
  * literal `"NaN"` or `"Infinity"` into the XML.
  */
 declare function intAttr(value: number | undefined | null): string;
+/**
+ * Verify that `xml` parses to exactly one root element named `expectedLocalName`
+ * (namespace prefix ignored). Used to gate raw XML snapshots — e.g. an SDT's
+ * `rawPropertiesXml`/`rawEndPropertiesXml` — before splicing them verbatim
+ * into a serialized document. Those snapshots are normally produced by our
+ * own parser, but they can also arrive from an untrusted surface (a
+ * programmatically constructed node, a collaboration payload); a value that
+ * is not a single well-formed `<w:sdtPr>`/`<w:sdtEndPr>` element could inject
+ * sibling markup or close the enclosing `<w:sdt>` early. Callers should fall
+ * back to a synthesized properties block when this returns `false`.
+ */
+declare function isSingleWellFormedElement(xml: string, expectedLocalName: string): boolean;
 //#endregion
-export { escapeXml, intAttr };
+export { escapeXml, intAttr, isSingleWellFormedElement };