@stll/folio-core 0.11.0 → 0.13.0

package/dist/server.js

@@ -1,5 +1,5 @@
 import { deriveBlockId, getFolioParaIdFromBlockId, isFolioBlockId, isSequentialFolioBlockId } from "./types/block-id.js";
-import { createFolioAITextRangeHandle } from "./ai-edits/snapshot.js";
+import { createFolioAITextRangeHandle, hashFolioAIBlockText, normalizeFolioAIBlockText } from "./ai-edits/snapshot.js";
 import { FOLIO_DOCUMENT_OPERATION_BATCH_MODES, FOLIO_DOCUMENT_OPERATION_CONTRACT_VERSION, FOLIO_DOCUMENT_OPERATION_MODES, FOLIO_DOCUMENT_OPERATION_MODES_BY_TYPE, FOLIO_DOCUMENT_OPERATION_PRECONDITIONS, FOLIO_DOCUMENT_OPERATION_STORIES, FOLIO_DOCUMENT_OPERATION_TYPES, InvalidFolioDocumentOperationBatchError, UnsupportedFolioDocumentOperationVersionError, assertSupportedFolioDocumentOperationVersion, getFolioDocumentOperationCapabilities, getFolioDocumentOperationIssues, getFolioDocumentOperationReceipts, isFolioDocumentOperationModeSupported, isSupportedFolioDocumentOperationVersion, parseFolioDocumentOperationBatch } from "./document-operations.js";
 import { DOCUMENT_PRESET_VERSION, DOCUMENT_STYLE_SET_VERSION } from "./style-sets/types.js";
 import { createEmptyDocument } from "./utils/createDocument.js";
@@ -12,7 +12,11 @@ import { FOLIO_RESOLVED_REVIEWED_VIEWS, FOLIO_REVIEWED_VIEWS, FolioDocumentStory
 import { FOLIO_DOCUMENT_METADATA_PROPERTIES, FOLIO_DOCUMENT_PRIVACY_TRANSFORMS, FolioDocumentPrivacyArchiveError, InvalidFolioDocumentPrivacyOptionsError, isFolioDocumentPrivacyTransform, rewriteDocxMetadataPrivacy } from "./docx/metadataPrivacy.js";
 import { FOLIO_VERSION_COMPARISON_PRIVACY_TRANSFORMS, FOLIO_VERSION_COMPARISON_SCOPES, InvalidFolioVersionComparisonOptionsError, applyFolioVersionDiffPrivacy, compareDocxVersions, isFolioVersionComparisonPrivacyTransform, isFolioVersionComparisonScope } from "./version-comparison.js";
 import { InvalidGenerateRedlineDocxOptionsError, generateRedlineDocx } from "./redline.js";
-import { EnsureParaIdsError, ensureParaIds } from "./docx/ensureParaIds.js";
 import { DocxArchiveError } from "./docx/server/boundedArchive.js";
+import { EnsureParaIdsError, ensureParaIds } from "./docx/ensureParaIds.js";
 import { extractDocxText } from "./docx/server/extractDocxText.js";
-export { DOCUMENT_PRESET_VERSION, DOCUMENT_STYLE_SET_VERSION, DocxArchiveError, EnsureParaIdsError, FOLIO_DOCUMENT_METADATA_PROPERTIES, FOLIO_DOCUMENT_OPERATION_BATCH_MODES, FOLIO_DOCUMENT_OPERATION_CONTRACT_VERSION, FOLIO_DOCUMENT_OPERATION_MODES, FOLIO_DOCUMENT_OPERATION_MODES_BY_TYPE, FOLIO_DOCUMENT_OPERATION_PRECONDITIONS, FOLIO_DOCUMENT_OPERATION_STORIES, FOLIO_DOCUMENT_OPERATION_TYPES, FOLIO_DOCUMENT_PRIVACY_TRANSFORMS, FOLIO_RESOLVED_REVIEWED_VIEWS, FOLIO_REVIEWED_VIEWS, FOLIO_VERSION_COMPARISON_PRIVACY_TRANSFORMS, FOLIO_VERSION_COMPARISON_SCOPES, FolioDocumentPrivacyArchiveError, FolioDocumentStoryNotFoundError, FolioDocxReviewer, InvalidFolioDocumentOperationBatchError, InvalidFolioDocumentPrivacyOptionsError, InvalidFolioVersionComparisonOptionsError, InvalidGenerateRedlineDocxOptionsError, STELLA_STYLE_SET_NAME, UnsupportedFolioDocumentOperationVersionError, UnsupportedFolioReviewedViewError, applyFolioAIEditsToBuffer, applyFolioVersionDiffPrivacy, assertSupportedFolioDocumentOperationVersion, compareDocxVersions, createDocx, createEmptyDocument, createFolioAITextRangeHandle, createStellaStyleDocumentPreset, createStellaStyleSet, deriveBlockId, ensureParaIds, extractDocumentStyleSet, extractDocumentStyleSetFromDocx, extractDocxText, generateRedlineDocx, getFolioDocumentOperationCapabilities, getFolioDocumentOperationIssues, getFolioDocumentOperationReceipts, getFolioDocumentOutline, getFolioParaIdFromBlockId, inspectDocumentStyles, inspectDocumentStylesFromDocx, isFolioBlockId, isFolioDocumentOperationModeSupported, isFolioDocumentPrivacyTransform, isFolioResolvedReviewedView, isFolioReviewedView, isFolioVersionComparisonPrivacyTransform, isFolioVersionComparisonScope, isSequentialFolioBlockId, isSupportedFolioDocumentOperationVersion, parseFolioDocumentOperationBatch, readFolioDocumentSection, replyToComment, rewriteDocxMetadataPrivacy };
+import { FOLIO_DOCX_PACKAGE_INSPECTION_DEFAULTS, FOLIO_DOCX_PACKAGE_INSPECTION_ERROR_CODES, FOLIO_DOCX_PACKAGE_INSPECTION_VERSION, FolioDocxPackageInspectionError, inspectDocxPackage } from "./docx/server/inspectDocxPackage.js";
+import { FOLIO_DOCX_XML_PATCH_PROPOSAL_DEFAULTS, FOLIO_DOCX_XML_PATCH_PROPOSAL_ISSUE_CODES, FOLIO_DOCX_XML_PATCH_PROPOSAL_PROFILE, FOLIO_DOCX_XML_PATCH_PROPOSAL_VERSION, InvalidFolioDocxXmlPatchProposalError, InvalidFolioDocxXmlPatchProposalOptionsError, evaluateDocxXmlPatchProposal, parseFolioDocxXmlPatchProposal } from "./docx/server/evaluateDocxXmlPatchProposal.js";
+import { FOLIO_DOCX_CONFORMANCE_CHECKS, FOLIO_DOCX_CONFORMANCE_ISSUE_CODES, FOLIO_DOCX_CONFORMANCE_PROFILE, FOLIO_DOCX_CONFORMANCE_REPORT_VERSION, validateDocxConformance } from "./docx/server/validateDocxConformance.js";
+import { FOLIO_DOCX_XML_PATCH_APPLICATION_PROFILE, FOLIO_DOCX_XML_PATCH_APPLICATION_VERSION, FolioDocxXmlPatchApplicationError, UnsupportedFolioDocxXmlPatchApplicationProfileError, applyDocxXmlPatchProposal } from "./docx/server/applyDocxXmlPatchProposal.js";
+export { DOCUMENT_PRESET_VERSION, DOCUMENT_STYLE_SET_VERSION, DocxArchiveError, EnsureParaIdsError, FOLIO_DOCUMENT_METADATA_PROPERTIES, FOLIO_DOCUMENT_OPERATION_BATCH_MODES, FOLIO_DOCUMENT_OPERATION_CONTRACT_VERSION, FOLIO_DOCUMENT_OPERATION_MODES, FOLIO_DOCUMENT_OPERATION_MODES_BY_TYPE, FOLIO_DOCUMENT_OPERATION_PRECONDITIONS, FOLIO_DOCUMENT_OPERATION_STORIES, FOLIO_DOCUMENT_OPERATION_TYPES, FOLIO_DOCUMENT_PRIVACY_TRANSFORMS, FOLIO_DOCX_CONFORMANCE_CHECKS, FOLIO_DOCX_CONFORMANCE_ISSUE_CODES, FOLIO_DOCX_CONFORMANCE_PROFILE, FOLIO_DOCX_CONFORMANCE_REPORT_VERSION, FOLIO_DOCX_PACKAGE_INSPECTION_DEFAULTS, FOLIO_DOCX_PACKAGE_INSPECTION_ERROR_CODES, FOLIO_DOCX_PACKAGE_INSPECTION_VERSION, FOLIO_DOCX_XML_PATCH_APPLICATION_PROFILE, FOLIO_DOCX_XML_PATCH_APPLICATION_VERSION, FOLIO_DOCX_XML_PATCH_PROPOSAL_DEFAULTS, FOLIO_DOCX_XML_PATCH_PROPOSAL_ISSUE_CODES, FOLIO_DOCX_XML_PATCH_PROPOSAL_PROFILE, FOLIO_DOCX_XML_PATCH_PROPOSAL_VERSION, FOLIO_RESOLVED_REVIEWED_VIEWS, FOLIO_REVIEWED_VIEWS, FOLIO_VERSION_COMPARISON_PRIVACY_TRANSFORMS, FOLIO_VERSION_COMPARISON_SCOPES, FolioDocumentPrivacyArchiveError, FolioDocumentStoryNotFoundError, FolioDocxPackageInspectionError, FolioDocxReviewer, FolioDocxXmlPatchApplicationError, InvalidFolioDocumentOperationBatchError, InvalidFolioDocumentPrivacyOptionsError, InvalidFolioDocxXmlPatchProposalError, InvalidFolioDocxXmlPatchProposalOptionsError, InvalidFolioVersionComparisonOptionsError, InvalidGenerateRedlineDocxOptionsError, STELLA_STYLE_SET_NAME, UnsupportedFolioDocumentOperationVersionError, UnsupportedFolioDocxXmlPatchApplicationProfileError, UnsupportedFolioReviewedViewError, applyDocxXmlPatchProposal, applyFolioAIEditsToBuffer, applyFolioVersionDiffPrivacy, assertSupportedFolioDocumentOperationVersion, compareDocxVersions, createDocx, createEmptyDocument, createFolioAITextRangeHandle, createStellaStyleDocumentPreset, createStellaStyleSet, deriveBlockId, ensureParaIds, evaluateDocxXmlPatchProposal, extractDocumentStyleSet, extractDocumentStyleSetFromDocx, extractDocxText, generateRedlineDocx, getFolioDocumentOperationCapabilities, getFolioDocumentOperationIssues, getFolioDocumentOperationReceipts, getFolioDocumentOutline, getFolioParaIdFromBlockId, hashFolioAIBlockText, inspectDocumentStyles, inspectDocumentStylesFromDocx, inspectDocxPackage, isFolioBlockId, isFolioDocumentOperationModeSupported, isFolioDocumentPrivacyTransform, isFolioResolvedReviewedView, isFolioReviewedView, isFolioVersionComparisonPrivacyTransform, isFolioVersionComparisonScope, isSequentialFolioBlockId, isSupportedFolioDocumentOperationVersion, normalizeFolioAIBlockText, parseFolioDocumentOperationBatch, parseFolioDocxXmlPatchProposal, readFolioDocumentSection, replyToComment, rewriteDocxMetadataPrivacy, validateDocxConformance };

package/dist/utils/clipboard.d.ts

@@ -85,6 +85,15 @@ declare function isWordHtml(html: string): boolean;
  * Check if HTML is from our editor
  */
 declare function isEditorHtml(html: string): boolean;
+/**
+ * Sanitize inbound clipboard HTML at the paste trust boundary.
+ *
+ * Comments and XML declarations are stripped with linear scanners. When a
+ * browser `window` is available, DOMPurify removes scripts, event handlers,
+ * and dangerous URLs before any DOM walk. Without a window (unit stubs / SSR)
+ * the linear cleaners still run; the live editor path always has `window`.
+ */
+declare function sanitizeInboundClipboardHtml(html: string): string;
 /**
  * Clean Microsoft Word HTML
  */
@@ -123,4 +132,4 @@ declare const _default: {
   createClipboardHandlers: typeof createClipboardHandlers;
 };
 //#endregion
-export { CLIPBOARD_TYPES, ClipboardContent, ClipboardOptions, INTERNAL_CLIPBOARD_TYPE, ParsedClipboardContent, cleanWordHtml, copyParagraphs, copyRuns, createClipboardHandlers, _default as default, getClipboardImageFiles, handlePasteEvent, htmlToRuns, isEditorHtml, isWordHtml, paragraphsToClipboardContent, parseClipboardHtml, readFromClipboard, runsToClipboardContent, writeToClipboard };
+export { CLIPBOARD_TYPES, ClipboardContent, ClipboardOptions, INTERNAL_CLIPBOARD_TYPE, ParsedClipboardContent, cleanWordHtml, copyParagraphs, copyRuns, createClipboardHandlers, _default as default, getClipboardImageFiles, handlePasteEvent, htmlToRuns, isEditorHtml, isWordHtml, paragraphsToClipboardContent, parseClipboardHtml, readFromClipboard, runsToClipboardContent, sanitizeInboundClipboardHtml, writeToClipboard };

package/dist/utils/clipboard.js

@@ -1,5 +1,18 @@
+import { stripXmlDeclarations } from "./stripXmlDeclarations.js";
+import createDOMPurify from "dompurify";
 //#region src/utils/clipboard.ts
 /**
+* Clipboard utilities for copy/paste with formatting
+*
+* Handles:
+* - Copy: puts formatted HTML and plain text on clipboard
+* - Paste: reads HTML clipboard, converts to runs with formatting
+* - Handles paste from Word (cleans up Word HTML)
+* - Ctrl+C, Ctrl+V, Ctrl+X keyboard shortcuts
+*/
+let domPurify;
+const getDomPurify = () => domPurify ??= createDOMPurify(window);
+/**
 * Custom MIME type for internal clipboard format
 */
 const INTERNAL_CLIPBOARD_TYPE = "application/x-stella-folio";
@@ -308,12 +321,24 @@ function stripPairedNamespaceTags(html, prefix) {
 	return result;
 }
 /**
+* Sanitize inbound clipboard HTML at the paste trust boundary.
+*
+* Comments and XML declarations are stripped with linear scanners. When a
+* browser `window` is available, DOMPurify removes scripts, event handlers,
+* and dangerous URLs before any DOM walk. Without a window (unit stubs / SSR)
+* the linear cleaners still run; the live editor path always has `window`.
+*/
+function sanitizeInboundClipboardHtml(html) {
+	let cleaned = stripHtmlComments(html);
+	cleaned = stripXmlDeclarations(cleaned);
+	if (typeof globalThis.window === "undefined") return cleaned;
+	return getDomPurify().sanitize(cleaned);
+}
+/**
 * Clean Microsoft Word HTML
 */
 function cleanWordHtml(html) {
-	let cleaned = html;
-	cleaned = stripHtmlComments(cleaned);
-	cleaned = cleaned.replace(/<\?xml[^>]*>/gi, "");
+	let cleaned = sanitizeInboundClipboardHtml(html);
 	cleaned = stripPairedNamespaceTags(cleaned, "o:");
 	cleaned = cleaned.replace(/<o:[^>]*\/>/gi, "");
 	cleaned = stripPairedNamespaceTags(cleaned, "w:");
@@ -325,7 +350,8 @@ function cleanWordHtml(html) {
 	return cleaned;
 }
 function cleanWordAttributes(html) {
-	const container = new DOMParser().parseFromString(html, "text/html").body;
+	const sanitized = sanitizeInboundClipboardHtml(html);
+	const container = new DOMParser().parseFromString(sanitized, "text/html").body;
 	for (const element of Array.from(container.querySelectorAll("*"))) {
 		const filteredClasses = Array.from(element.classList).filter((className) => !className.includes("Mso"));
 		if (filteredClasses.length === 0) element.removeAttribute("class");
@@ -346,7 +372,8 @@ function cleanWordAttributes(html) {
 */
 function htmlToRuns(html, plainTextFallback) {
 	if (!html || html.trim() === "") return plainTextFallback ? [createTextRun(plainTextFallback)] : [];
-	const container = new DOMParser().parseFromString(html, "text/html").body;
+	const sanitized = sanitizeInboundClipboardHtml(html);
+	const container = new DOMParser().parseFromString(sanitized, "text/html").body;
 	const runs = [];
 	processNode(container, runs, {});
 	if (runs.length === 0 && plainTextFallback) return [createTextRun(plainTextFallback)];
@@ -619,4 +646,4 @@ var clipboard_default = {
 	createClipboardHandlers
 };
 //#endregion
-export { CLIPBOARD_TYPES, INTERNAL_CLIPBOARD_TYPE, cleanWordHtml, copyParagraphs, copyRuns, createClipboardHandlers, clipboard_default as default, getClipboardImageFiles, handlePasteEvent, htmlToRuns, isEditorHtml, isWordHtml, paragraphsToClipboardContent, parseClipboardHtml, readFromClipboard, runsToClipboardContent, writeToClipboard };
+export { CLIPBOARD_TYPES, INTERNAL_CLIPBOARD_TYPE, cleanWordHtml, copyParagraphs, copyRuns, createClipboardHandlers, clipboard_default as default, getClipboardImageFiles, handlePasteEvent, htmlToRuns, isEditorHtml, isWordHtml, paragraphsToClipboardContent, parseClipboardHtml, readFromClipboard, runsToClipboardContent, sanitizeInboundClipboardHtml, writeToClipboard };

package/dist/utils/colorResolver.d.ts

@@ -1,6 +1,13 @@
 import { document_d_exports } from "../types/document.js";
 
 //#region src/utils/colorResolver.d.ts
+/**
+ * Public form of the same hex-color check, for callers that read a color
+ * value from an untrusted surface (e.g. a pasted DOM node's `dataset`,
+ * which bypasses the CSSOM's own value validation) and must reject it
+ * before storing it as editor state.
+ */
+declare function isValidHexColor(value: string | undefined | null): boolean;
 /**
  * Resolve a ColorValue to a CSS color string
  *
@@ -162,4 +169,4 @@ declare function generateThemeTintShadeMatrix(colorScheme?: document_d_exports.T
  */
 declare function colorsEqual(color1: document_d_exports.ColorValue | undefined | null, color2: document_d_exports.ColorValue | undefined | null, theme: document_d_exports.Theme | null | undefined): boolean;
 //#endregion
-export { STANDARD_TEXT_COLORS, ThemeMatrixCell, blendColors, colorsEqual, createRgbColor, createThemeColor, darkenColor, ensureHexPrefix, generateThemeTintShadeMatrix, getContrastingColor, getThemeTintShadeHex, isBlack, isWhite, lightenColor, parseColorString, resolveColor, resolveColorToHex, resolveHighlightColor, resolveHighlightToCss, resolveShadingColor };
+export { STANDARD_TEXT_COLORS, ThemeMatrixCell, blendColors, colorsEqual, createRgbColor, createThemeColor, darkenColor, ensureHexPrefix, generateThemeTintShadeMatrix, getContrastingColor, getThemeTintShadeHex, isBlack, isValidHexColor, isWhite, lightenColor, parseColorString, resolveColor, resolveColorToHex, resolveHighlightColor, resolveHighlightToCss, resolveShadingColor };

package/dist/utils/colorResolver.js

@@ -1,5 +1,34 @@
 //#region src/utils/colorResolver.ts
 /**
+* Strict hex-color validator shared by every OOXML → CSS color path in this
+* module. OOXML readers are lenient about `w:val`/`w:fill` attribute content
+* and theme swatch text, so a crafted `<w:color>`, table shading, or
+* `themeN.xml` color-scheme entry can carry arbitrary text — including a CSS
+* `url(...)` payload — instead of a real color. Accepts a 3, 6, or 8 digit
+* hex string with an optional leading `#`; anything else (including the
+* literal `"auto"`, which callers handle separately) is rejected.
+*/
+const HEX_COLOR_PATTERN = /^#?[0-9A-Fa-f]{3}(?:[0-9A-Fa-f]{3})?(?:[0-9A-Fa-f]{2})?$/u;
+/**
+* Normalize a raw color string to a bare uppercase hex value (no `#`), or
+* `undefined` when it is not a valid 3/6/8-digit hex color. This is the
+* single choke point every resolved color passes through before becoming a
+* CSS string — see {@link resolveColor} and {@link resolveColorToHex}.
+*/
+function normalizeHexColor(value) {
+	if (!value) return;
+	return HEX_COLOR_PATTERN.test(value) ? value.replace(/^#/u, "").toUpperCase() : void 0;
+}
+/**
+* Public form of the same hex-color check, for callers that read a color
+* value from an untrusted surface (e.g. a pasted DOM node's `dataset`,
+* which bypasses the CSSOM's own value validation) and must reject it
+* before storing it as editor state.
+*/
+function isValidHexColor(value) {
+	return typeof value === "string" && normalizeHexColor(value) !== void 0;
+}
+/**
 * Default theme colors (Office 2016 default theme)
 */
 const DEFAULT_THEME_COLORS = {
@@ -194,8 +223,9 @@ function resolveThemeColorSlot(colorName) {
 * @returns CSS color string (e.g., "#FF0000" or "inherit")
 */
 function resolveColor(color, theme, defaultColor = "000000") {
-	if (!color) return `#${defaultColor}`;
-	if (color.auto) return `#${defaultColor}`;
+	const safeDefault = normalizeHexColor(defaultColor) ?? "000000";
+	if (!color) return `#${safeDefault}`;
+	if (color.auto) return `#${safeDefault}`;
 	let hexColor;
 	if (color.themeColor) {
 		const slot = resolveThemeColorSlot(color.themeColor);
@@ -210,7 +240,7 @@ function resolveColor(color, theme, defaultColor = "000000") {
 		}
 	} else if (color.rgb) hexColor = color.rgb === "auto" ? defaultColor : color.rgb;
 	else hexColor = defaultColor;
-	return `#${hexColor.toUpperCase().replace(/^#/u, "")}`;
+	return `#${normalizeHexColor(hexColor) ?? safeDefault}`;
 }
 /**
 * Resolve a highlight color name to CSS
@@ -227,7 +257,7 @@ function resolveColor(color, theme, defaultColor = "000000") {
 function resolveColorToHex(color, theme) {
 	if (!color || color.auto) return void 0;
 	if (color.themeColor && theme) return resolveColor(color, theme).slice(1);
-	if (color.rgb && color.rgb !== "auto") return color.rgb.toUpperCase().replace(/^#/, "");
+	if (color.rgb && color.rgb !== "auto") return normalizeHexColor(color.rgb);
 }
 function resolveHighlightColor(highlight) {
 	if (!highlight || highlight === "none") return "";
@@ -565,4 +595,4 @@ function colorsEqual(color1, color2, theme) {
 	return resolveColor(color1, theme).toUpperCase() === resolveColor(color2, theme).toUpperCase();
 }
 //#endregion
-export { STANDARD_TEXT_COLORS, blendColors, colorsEqual, createRgbColor, createThemeColor, darkenColor, ensureHexPrefix, generateThemeTintShadeMatrix, getContrastingColor, getThemeTintShadeHex, isBlack, isWhite, lightenColor, parseColorString, resolveColor, resolveColorToHex, resolveHighlightColor, resolveHighlightToCss, resolveShadingColor };
+export { STANDARD_TEXT_COLORS, blendColors, colorsEqual, createRgbColor, createThemeColor, darkenColor, ensureHexPrefix, generateThemeTintShadeMatrix, getContrastingColor, getThemeTintShadeHex, isBlack, isValidHexColor, isWhite, lightenColor, parseColorString, resolveColor, resolveColorToHex, resolveHighlightColor, resolveHighlightToCss, resolveShadingColor };

package/dist/utils/fontFamilyMerge.js

@@ -1,4 +1,11 @@
 //#region src/utils/fontFamilyMerge.ts
+const FONT_FAMILY_PAIRS = [
+	["ascii", "asciiTheme"],
+	["hAnsi", "hAnsiTheme"],
+	["eastAsia", "eastAsiaTheme"],
+	["cs", "csTheme"]
+];
+const isFontFamilyPairKey = (key) => key === "ascii" || key === "asciiTheme" || key === "hAnsi" || key === "hAnsiTheme" || key === "eastAsia" || key === "eastAsiaTheme" || key === "cs" || key === "csTheme";
 function mergeFontFamily(target, source) {
 	const result = {};
 	const src = source;
@@ -10,21 +17,12 @@ function mergeFontFamily(target, source) {
 		if (replacesAscii && (key === "ascii" || key === "asciiTheme") || replacesHAnsi && (key === "hAnsi" || key === "hAnsiTheme") || replacesEastAsia && (key === "eastAsia" || key === "eastAsiaTheme") || replacesCs && (key === "cs" || key === "csTheme")) continue;
 		result[key] = target[key];
 	}
-	const pairs = [
-		["ascii", "asciiTheme"],
-		["hAnsi", "hAnsiTheme"],
-		["eastAsia", "eastAsiaTheme"],
-		["cs", "csTheme"]
-	];
-	const pairKeys = /* @__PURE__ */ new Set();
-	for (const [explicit, theme] of pairs) {
-		pairKeys.add(explicit);
-		pairKeys.add(theme);
+	for (const [explicit, theme] of FONT_FAMILY_PAIRS) {
 		if (src[explicit] === void 0 && src[theme] === void 0) continue;
 		if (src[explicit] !== void 0) result[explicit] = src[explicit];
 		if (src[theme] !== void 0) result[theme] = src[theme];
 	}
-	for (const key of Object.keys(src)) if (!pairKeys.has(key) && src[key] !== void 0) result[key] = src[key];
+	for (const key of Object.keys(src)) if (!isFontFamilyPairKey(key) && src[key] !== void 0) result[key] = src[key];
 	return result;
 }
 //#endregion

package/dist/utils/fontLoader.js

@@ -17,8 +17,8 @@ let isLoadingAny = false;
 * this map is used for font availability checks and preloading.
 */
 const FONT_MAPPING = {
-	Aptos: "Source Sans 3",
-	"Aptos Display": "Source Sans 3",
+	Aptos: "Lato",
+	"Aptos Display": "Lato",
 	Calibri: "Carlito",
 	Cambria: "Caladea",
 	Arial: "Arimo",
@@ -40,6 +40,7 @@ const BUNDLED_FONTS = /* @__PURE__ */ new Set([
 	"Arimo",
 	"Tinos",
 	"Cousine",
+	"Lato",
 	"Source Sans 3",
 	"Calibri",
 	"Cambria",

package/dist/utils/fontResolver.d.ts

@@ -40,6 +40,7 @@ declare function isCjkFont(family: string): boolean;
 declare const CJK_FALLBACK_FONT_FAMILY = "MS Mincho";
 declare const setGoogleFontsEnabled: (enabled: boolean) => void;
 declare const getGoogleFontsEnabled: () => boolean;
+declare const setEmbeddedFontFamilyMap: (map: ReadonlyMap<string, string> | null) => void;
 declare function resolveFontFamily(docxFontName: string): ResolvedFont;
 /**
  * Resolve a theme font reference to actual font names
@@ -79,4 +80,4 @@ declare function getGoogleFontEquivalent(docxFontName: string): string | null;
  */
 declare function hasGoogleFontEquivalent(docxFontName: string): boolean;
 //#endregion
-export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, ResolvedFont, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setGoogleFontsEnabled };
+export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, ResolvedFont, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setEmbeddedFontFamilyMap, setGoogleFontsEnabled };

package/dist/utils/fontResolver.js

@@ -65,11 +65,11 @@ const APTOS_MEASURED_LINE_HEIGHT = {
 */
 const FONT_MAPPINGS = {
 	aptos: {
-		googleFont: "Source Sans 3",
+		googleFont: "Lato",
 		category: "sans-serif",
 		fallbackStack: [
 			"Aptos",
-			"Source Sans 3",
+			"Lato",
 			"Arial",
 			"Helvetica",
 			"sans-serif"
@@ -77,11 +77,11 @@ const FONT_MAPPINGS = {
 		singleLineRatio: singleLineRatioOf(APTOS_MEASURED_LINE_HEIGHT)
 	},
 	"aptos display": {
-		googleFont: "Source Sans 3",
+		googleFont: "Lato",
 		category: "sans-serif",
 		fallbackStack: [
 			"Aptos Display",
-			"Source Sans 3",
+			"Lato",
 			"Arial",
 			"Helvetica",
 			"sans-serif"
@@ -242,6 +242,24 @@ const FONT_MAPPINGS = {
 			unitsPerEm: 2048
 		})
 	},
+	"segoe ui": {
+		googleFont: "Source Sans 3",
+		category: "sans-serif",
+		fallbackStack: [
+			"Segoe UI",
+			"Source Sans 3",
+			"Arial",
+			"Helvetica",
+			"sans-serif"
+		],
+		singleLineRatio: singleLineRatioOf({
+			source: "hhea",
+			hheaAscent: 2210,
+			hheaDescent: -514,
+			hheaLineGap: 0,
+			unitsPerEm: 2048
+		})
+	},
 	montserrat: {
 		googleFont: "Montserrat",
 		category: "sans-serif",
@@ -791,15 +809,21 @@ const setGoogleFontsEnabled = (enabled) => {
 	googleFontsEnabled = enabled;
 };
 const getGoogleFontsEnabled = () => googleFontsEnabled;
+let embeddedFontFamilyMap = null;
+const setEmbeddedFontFamilyMap = (map) => {
+	embeddedFontFamilyMap = map;
+};
 function resolveFontFamily(docxFontName) {
 	const normalizedName = docxFontName.trim().toLowerCase();
+	const scopedFamily = embeddedFontFamilyMap?.get(docxFontName) ?? null;
 	const aliasTarget = CJK_FONT_ALIASES[normalizedName];
 	const mapping = FONT_MAPPINGS[aliasTarget ?? normalizedName];
 	if (mapping) {
 		const fallbackStack = aliasTarget && !mapping.fallbackStack.some((f) => f.toLowerCase() === normalizedName) ? [docxFontName, ...mapping.fallbackStack] : mapping.fallbackStack;
+		const primaryStack = scopedFamily ? [scopedFamily, ...fallbackStack.filter((f) => f.toLowerCase() !== normalizedName)] : fallbackStack;
 		return {
 			googleFont: googleFontsEnabled ? mapping.googleFont : null,
-			cssFallback: withArabicFallback(fallbackStack.map(quoteFontName).join(", ")),
+			cssFallback: withArabicFallback(primaryStack.map(quoteFontName).join(", ")),
 			originalFont: docxFontName,
 			hasGoogleEquivalent: googleFontsEnabled,
 			singleLineRatio: mapping.singleLineRatio
@@ -809,7 +833,7 @@ function resolveFontFamily(docxFontName) {
 	const defaultFallback = DEFAULT_FALLBACKS[category];
 	return {
 		googleFont: null,
-		cssFallback: withArabicFallback(`${quoteFontName(docxFontName)}, ${defaultFallback}`),
+		cssFallback: withArabicFallback(`${quoteFontName(scopedFamily ?? docxFontName)}, ${defaultFallback}`),
 		originalFont: docxFontName,
 		hasGoogleEquivalent: false,
 		singleLineRatio: DEFAULT_SINGLE_LINE_RATIO
@@ -904,4 +928,4 @@ function hasGoogleFontEquivalent(docxFontName) {
 	return (CJK_FONT_ALIASES[normalizedName] ?? normalizedName) in FONT_MAPPINGS;
 }
 //#endregion
-export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setGoogleFontsEnabled };
+export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setEmbeddedFontFamilyMap, setGoogleFontsEnabled };

package/dist/utils/fontWeights.d.ts

@@ -1,4 +1,4 @@
 //#region src/utils/fontWeights.d.ts
-declare const DOCX_BOLD_FONT_WEIGHT = "800";
+declare const DOCX_BOLD_FONT_WEIGHT = "700";
 //#endregion
 export { DOCX_BOLD_FONT_WEIGHT };

package/dist/utils/fontWeights.js

@@ -1,4 +1,4 @@
 //#region src/utils/fontWeights.ts
-const DOCX_BOLD_FONT_WEIGHT = "800";
+const DOCX_BOLD_FONT_WEIGHT = "700";
 //#endregion
 export { DOCX_BOLD_FONT_WEIGHT };

package/dist/utils/hexId.d.ts

@@ -15,6 +15,16 @@
  * strict OOXML validators.
  */
 declare const MAX_HEX_ID_EXCLUSIVE = 2147483647;
+/**
+ * OOXML `ST_LongHexNumber` shape: exactly 8 hex digits (`xsd:hexBinary`,
+ * length 4 bytes). `w14:paraId` / `w14:textId` / comment `paraId` /
+ * `w15:paraIdParent` are all typed this way. A value that doesn't match this
+ * is not a real Word id — it must not be trusted as one (e.g. echoed
+ * unescaped into serialized XML attributes).
+ */
+declare const HEX_ID_PATTERN: RegExp;
+/** Whether `value` is a well-formed 8-hex-digit OOXML long-hex id. */
+declare const isValidHexId: (value: string | undefined | null) => boolean;
 /**
  * Random 8-char uppercase hex id, matching Microsoft's `w14:paraId`
  * extension format (also reused for comment `paraId` / `durableId`).
@@ -37,4 +47,4 @@ declare const generateHexId: () => string;
  */
 declare const deterministicHexId: (seed: string) => string;
 //#endregion
-export { MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId };
+export { HEX_ID_PATTERN, MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId, isValidHexId };

package/dist/utils/hexId.js

@@ -16,6 +16,16 @@
 */
 const MAX_HEX_ID_EXCLUSIVE = 2147483647;
 /**
+* OOXML `ST_LongHexNumber` shape: exactly 8 hex digits (`xsd:hexBinary`,
+* length 4 bytes). `w14:paraId` / `w14:textId` / comment `paraId` /
+* `w15:paraIdParent` are all typed this way. A value that doesn't match this
+* is not a real Word id — it must not be trusted as one (e.g. echoed
+* unescaped into serialized XML attributes).
+*/
+const HEX_ID_PATTERN = /^[0-9A-Fa-f]{8}$/u;
+/** Whether `value` is a well-formed 8-hex-digit OOXML long-hex id. */
+const isValidHexId = (value) => typeof value === "string" && HEX_ID_PATTERN.test(value);
+/**
 * Random 8-char uppercase hex id, matching Microsoft's `w14:paraId`
 * extension format (also reused for comment `paraId` / `durableId`).
 *
@@ -42,4 +52,4 @@ const deterministicHexId = (seed) => {
 	return (value === 0 ? 1 : value).toString(16).toUpperCase().padStart(8, "0");
 };
 //#endregion
-export { MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId };
+export { HEX_ID_PATTERN, MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId, isValidHexId };

package/dist/utils/paragraphFormattingMerge.js

@@ -9,6 +9,7 @@ const PARAGRAPH_REPLACE_KEYS = [
 	"spaceAfter",
 	"lineSpacing",
 	"lineSpacingRule",
+	"snapToGrid",
 	"beforeAutospacing",
 	"afterAutospacing",
 	"spacingExplicit",

package/dist/utils/sanitizeImageSrc.d.ts

@@ -0,0 +1,21 @@
+//#region src/utils/sanitizeImageSrc.d.ts
+/**
+ * Keep painted image sources local to bytes the host already owns.
+ *
+ * Document media and pasted files enter the editor as `data:image/*` or
+ * `blob:` URLs. Network and executable schemes are rejected so opening or
+ * pasting an untrusted document cannot trigger an external request or run a
+ * script scheme through `<img src>`.
+ */
+declare function sanitizeImageSrc(src: string | null | undefined): string | undefined;
+/**
+ * Assign a sanitized source to an `<img>` element. When the source is rejected
+ * the `src` attribute is left unset: assigning `""` makes some browsers resolve
+ * it against the page URL and fire a spurious request for the current page.
+ *
+ * Structural parameter type so painter unit tests (which fake the DOM) can
+ * exercise it without an `HTMLImageElement`.
+ */
+declare function applySanitizedImageSrc(imgEl: Pick<HTMLImageElement, "src">, src: string | null | undefined): void;
+//#endregion
+export { applySanitizedImageSrc, sanitizeImageSrc };

package/dist/utils/sanitizeImageSrc.js

@@ -0,0 +1,30 @@
+//#region src/utils/sanitizeImageSrc.ts
+/**
+* Keep painted image sources local to bytes the host already owns.
+*
+* Document media and pasted files enter the editor as `data:image/*` or
+* `blob:` URLs. Network and executable schemes are rejected so opening or
+* pasting an untrusted document cannot trigger an external request or run a
+* script scheme through `<img src>`.
+*/
+function sanitizeImageSrc(src) {
+	if (typeof src !== "string") return;
+	const value = src.trim();
+	if (!value) return;
+	if (/^blob:/iu.test(value)) return value;
+	if (/^data:image\/[a-z0-9.+-]+(?:;[^,]*)?,/iu.test(value)) return value;
+}
+/**
+* Assign a sanitized source to an `<img>` element. When the source is rejected
+* the `src` attribute is left unset: assigning `""` makes some browsers resolve
+* it against the page URL and fire a spurious request for the current page.
+*
+* Structural parameter type so painter unit tests (which fake the DOM) can
+* exercise it without an `HTMLImageElement`.
+*/
+function applySanitizedImageSrc(imgEl, src) {
+	const safeSrc = sanitizeImageSrc(src);
+	if (safeSrc !== void 0) imgEl.src = safeSrc;
+}
+//#endregion
+export { applySanitizedImageSrc, sanitizeImageSrc };

package/dist/utils/stripXmlDeclarations.d.ts

@@ -0,0 +1,11 @@
+//#region src/utils/stripXmlDeclarations.d.ts
+/**
+ * Remove complete `<?xml ...?>` declarations from attacker-controlled clipboard HTML.
+ *
+ * Linear scan instead of `/<\?xml[^>]*>/gi`: that pattern backtracks polynomially
+ * when many `<?xml` openers appear with no closing `>`. An unterminated opener
+ * is preserved verbatim (same as the regex, which never matched it).
+ */
+declare function stripXmlDeclarations(html: string): string;
+//#endregion
+export { stripXmlDeclarations };

package/dist/utils/stripXmlDeclarations.js

@@ -0,0 +1,35 @@
+//#region src/utils/stripXmlDeclarations.ts
+/**
+* Remove complete `<?xml ...?>` declarations from attacker-controlled clipboard HTML.
+*
+* Linear scan instead of `/<\?xml[^>]*>/gi`: that pattern backtracks polynomially
+* when many `<?xml` openers appear with no closing `>`. An unterminated opener
+* is preserved verbatim (same as the regex, which never matched it).
+*/
+function stripXmlDeclarations(html) {
+	const chunks = [];
+	let cursor = 0;
+	let searchFrom = 0;
+	while (true) {
+		const start = html.indexOf("<", searchFrom);
+		if (start === -1) {
+			chunks.push(html.slice(cursor));
+			break;
+		}
+		if (!(html.charCodeAt(start + 1) === 63 && (html.charCodeAt(start + 2) === 88 || html.charCodeAt(start + 2) === 120) && (html.charCodeAt(start + 3) === 77 || html.charCodeAt(start + 3) === 109) && (html.charCodeAt(start + 4) === 76 || html.charCodeAt(start + 4) === 108))) {
+			searchFrom = start + 1;
+			continue;
+		}
+		const end = html.indexOf(">", start + 5);
+		if (end === -1) {
+			chunks.push(html.slice(cursor));
+			break;
+		}
+		chunks.push(html.slice(cursor, start));
+		cursor = end + 1;
+		searchFrom = cursor;
+	}
+	return chunks.join("");
+}
+//#endregion
+export { stripXmlDeclarations };

package/dist/version-comparison.d.ts

@@ -109,6 +109,20 @@ type FolioVersionDiff = {
 };
 /** True when an `unpairedBaseCount * unpairedRevisedCount` LCS table would exceed {@link MAX_LCS_CELLS}. */
 declare const exceedsLcsBudget: (unpairedBaseCount: number, unpairedRevisedCount: number) => boolean;
+/**
+ * Mutable cell budget SHARED across every story pair one {@link compareDocxVersions}
+ * call compares. {@link exceedsLcsBudget} alone only bounds a single pass 2
+ * call's own table; without an aggregate budget, a document with many
+ * attacker-controlled stories (footnotes/endnotes) could still force a fresh
+ * near-{@link MAX_LCS_CELLS}-sized allocation for EVERY story pair. Each
+ * `pairByExactText` call that actually runs pass 2 decrements
+ * `remainingCells` by its own `m * n`; once exhausted, every subsequent
+ * story's pass 2 is refused regardless of that story's own size, falling
+ * through to pass 3's linear positional zip.
+ */
+type FolioVersionComparisonLcsBudget = {
+  remainingCells: number;
+};
 /**
  * One step of a completed alignment, in revised-side document order with
  * base-only blocks slotted where they sat. `pair` events cover pass 1/2
@@ -131,8 +145,14 @@ type FolioAlignedBlockEvent = {
  * snapshots and flatten it into an ordered event stream. Shared by
  * {@link compareDocxVersions} and the redline generator so both interpret
  * one document walk instead of re-deriving it.
+ *
+ * `lcsBudget` defaults to a fresh, single-call budget so a caller comparing
+ * one block pair in isolation (the redline generator) behaves exactly as
+ * before. {@link compareDocxVersions} passes one budget object shared across
+ * every story pair instead, so pass 2's cell allowance is aggregate across
+ * the whole comparison rather than reset per story.
  */
-declare const alignFolioBlocks: (baseBlocks: readonly FolioAIBlock[], revisedBlocks: readonly FolioAIBlock[]) => FolioAlignedBlockEvent[];
+declare const alignFolioBlocks: (baseBlocks: readonly FolioAIBlock[], revisedBlocks: readonly FolioAIBlock[], lcsBudget?: FolioVersionComparisonLcsBudget) => FolioAlignedBlockEvent[];
 /** Apply auditable, output-only privacy transforms to a structured version diff. */
 declare const applyFolioVersionDiffPrivacy: (diff: FolioVersionDiff, options: FolioVersionDiffPrivacyOptions) => FolioVersionDiff;
 /**
@@ -143,4 +163,4 @@ declare const applyFolioVersionDiffPrivacy: (diff: FolioVersionDiff, options: Fo
  */
 declare const compareDocxVersions: (base: ArrayBuffer, revised: ArrayBuffer, options?: FolioCompareDocxVersionsOptions) => Promise<FolioVersionDiff>;
 //#endregion
-export { FOLIO_DOCUMENT_METADATA_PROPERTIES, FOLIO_VERSION_COMPARISON_PRIVACY_TRANSFORMS, FOLIO_VERSION_COMPARISON_SCOPES, FolioAlignedBlockEvent, FolioBlockDiff, FolioCompareDocxVersionsOptions, type FolioDocumentMetadataProperty, FolioDocumentMetadataValue, FolioFormatProperty, FolioMetadataDiff, FolioStoryDiff, FolioVersionBlockHandle, FolioVersionComparisonPrivacyTransform, FolioVersionComparisonScope, FolioVersionDiff, FolioVersionDiffPrivacyOptions, FolioVersionDiffPrivacyReport, FolioVersionDiffSegment, FolioVersionDiffSummaryCounts, InvalidFolioVersionComparisonOptionsError, alignFolioBlocks, applyFolioVersionDiffPrivacy, compareDocxVersions, exceedsLcsBudget, isFolioVersionComparisonPrivacyTransform, isFolioVersionComparisonScope };
+export { FOLIO_DOCUMENT_METADATA_PROPERTIES, FOLIO_VERSION_COMPARISON_PRIVACY_TRANSFORMS, FOLIO_VERSION_COMPARISON_SCOPES, FolioAlignedBlockEvent, FolioBlockDiff, FolioCompareDocxVersionsOptions, type FolioDocumentMetadataProperty, FolioDocumentMetadataValue, FolioFormatProperty, FolioMetadataDiff, FolioStoryDiff, FolioVersionBlockHandle, FolioVersionComparisonLcsBudget, FolioVersionComparisonPrivacyTransform, FolioVersionComparisonScope, FolioVersionDiff, FolioVersionDiffPrivacyOptions, FolioVersionDiffPrivacyReport, FolioVersionDiffSegment, FolioVersionDiffSummaryCounts, InvalidFolioVersionComparisonOptionsError, alignFolioBlocks, applyFolioVersionDiffPrivacy, compareDocxVersions, exceedsLcsBudget, isFolioVersionComparisonPrivacyTransform, isFolioVersionComparisonScope };