@stll/folio-core 0.12.0 → 0.14.0

package/dist/utils/colorResolver.js

@@ -1,5 +1,34 @@
 //#region src/utils/colorResolver.ts
 /**
+* Strict hex-color validator shared by every OOXML → CSS color path in this
+* module. OOXML readers are lenient about `w:val`/`w:fill` attribute content
+* and theme swatch text, so a crafted `<w:color>`, table shading, or
+* `themeN.xml` color-scheme entry can carry arbitrary text — including a CSS
+* `url(...)` payload — instead of a real color. Accepts a 3, 6, or 8 digit
+* hex string with an optional leading `#`; anything else (including the
+* literal `"auto"`, which callers handle separately) is rejected.
+*/
+const HEX_COLOR_PATTERN = /^#?[0-9A-Fa-f]{3}(?:[0-9A-Fa-f]{3})?(?:[0-9A-Fa-f]{2})?$/u;
+/**
+* Normalize a raw color string to a bare uppercase hex value (no `#`), or
+* `undefined` when it is not a valid 3/6/8-digit hex color. This is the
+* single choke point every resolved color passes through before becoming a
+* CSS string — see {@link resolveColor} and {@link resolveColorToHex}.
+*/
+function normalizeHexColor(value) {
+	if (!value) return;
+	return HEX_COLOR_PATTERN.test(value) ? value.replace(/^#/u, "").toUpperCase() : void 0;
+}
+/**
+* Public form of the same hex-color check, for callers that read a color
+* value from an untrusted surface (e.g. a pasted DOM node's `dataset`,
+* which bypasses the CSSOM's own value validation) and must reject it
+* before storing it as editor state.
+*/
+function isValidHexColor(value) {
+	return typeof value === "string" && normalizeHexColor(value) !== void 0;
+}
+/**
 * Default theme colors (Office 2016 default theme)
 */
 const DEFAULT_THEME_COLORS = {
@@ -194,8 +223,9 @@ function resolveThemeColorSlot(colorName) {
 * @returns CSS color string (e.g., "#FF0000" or "inherit")
 */
 function resolveColor(color, theme, defaultColor = "000000") {
-	if (!color) return `#${defaultColor}`;
-	if (color.auto) return `#${defaultColor}`;
+	const safeDefault = normalizeHexColor(defaultColor) ?? "000000";
+	if (!color) return `#${safeDefault}`;
+	if (color.auto) return `#${safeDefault}`;
 	let hexColor;
 	if (color.themeColor) {
 		const slot = resolveThemeColorSlot(color.themeColor);
@@ -210,7 +240,7 @@ function resolveColor(color, theme, defaultColor = "000000") {
 		}
 	} else if (color.rgb) hexColor = color.rgb === "auto" ? defaultColor : color.rgb;
 	else hexColor = defaultColor;
-	return `#${hexColor.toUpperCase().replace(/^#/u, "")}`;
+	return `#${normalizeHexColor(hexColor) ?? safeDefault}`;
 }
 /**
 * Resolve a highlight color name to CSS
@@ -227,7 +257,7 @@ function resolveColor(color, theme, defaultColor = "000000") {
 function resolveColorToHex(color, theme) {
 	if (!color || color.auto) return void 0;
 	if (color.themeColor && theme) return resolveColor(color, theme).slice(1);
-	if (color.rgb && color.rgb !== "auto") return color.rgb.toUpperCase().replace(/^#/, "");
+	if (color.rgb && color.rgb !== "auto") return normalizeHexColor(color.rgb);
 }
 function resolveHighlightColor(highlight) {
 	if (!highlight || highlight === "none") return "";
@@ -565,4 +595,4 @@ function colorsEqual(color1, color2, theme) {
 	return resolveColor(color1, theme).toUpperCase() === resolveColor(color2, theme).toUpperCase();
 }
 //#endregion
-export { STANDARD_TEXT_COLORS, blendColors, colorsEqual, createRgbColor, createThemeColor, darkenColor, ensureHexPrefix, generateThemeTintShadeMatrix, getContrastingColor, getThemeTintShadeHex, isBlack, isWhite, lightenColor, parseColorString, resolveColor, resolveColorToHex, resolveHighlightColor, resolveHighlightToCss, resolveShadingColor };
+export { STANDARD_TEXT_COLORS, blendColors, colorsEqual, createRgbColor, createThemeColor, darkenColor, ensureHexPrefix, generateThemeTintShadeMatrix, getContrastingColor, getThemeTintShadeHex, isBlack, isValidHexColor, isWhite, lightenColor, parseColorString, resolveColor, resolveColorToHex, resolveHighlightColor, resolveHighlightToCss, resolveShadingColor };

package/dist/utils/fontResolver.d.ts

@@ -40,6 +40,7 @@ declare function isCjkFont(family: string): boolean;
 declare const CJK_FALLBACK_FONT_FAMILY = "MS Mincho";
 declare const setGoogleFontsEnabled: (enabled: boolean) => void;
 declare const getGoogleFontsEnabled: () => boolean;
+declare const setEmbeddedFontFamilyMap: (map: ReadonlyMap<string, string> | null) => void;
 declare function resolveFontFamily(docxFontName: string): ResolvedFont;
 /**
  * Resolve a theme font reference to actual font names
@@ -79,4 +80,4 @@ declare function getGoogleFontEquivalent(docxFontName: string): string | null;
  */
 declare function hasGoogleFontEquivalent(docxFontName: string): boolean;
 //#endregion
-export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, ResolvedFont, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setGoogleFontsEnabled };
+export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, ResolvedFont, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setEmbeddedFontFamilyMap, setGoogleFontsEnabled };

package/dist/utils/fontResolver.js

@@ -809,15 +809,21 @@ const setGoogleFontsEnabled = (enabled) => {
 	googleFontsEnabled = enabled;
 };
 const getGoogleFontsEnabled = () => googleFontsEnabled;
+let embeddedFontFamilyMap = null;
+const setEmbeddedFontFamilyMap = (map) => {
+	embeddedFontFamilyMap = map;
+};
 function resolveFontFamily(docxFontName) {
 	const normalizedName = docxFontName.trim().toLowerCase();
+	const scopedFamily = embeddedFontFamilyMap?.get(docxFontName) ?? null;
 	const aliasTarget = CJK_FONT_ALIASES[normalizedName];
 	const mapping = FONT_MAPPINGS[aliasTarget ?? normalizedName];
 	if (mapping) {
 		const fallbackStack = aliasTarget && !mapping.fallbackStack.some((f) => f.toLowerCase() === normalizedName) ? [docxFontName, ...mapping.fallbackStack] : mapping.fallbackStack;
+		const primaryStack = scopedFamily ? [scopedFamily, ...fallbackStack.filter((f) => f.toLowerCase() !== normalizedName)] : fallbackStack;
 		return {
 			googleFont: googleFontsEnabled ? mapping.googleFont : null,
-			cssFallback: withArabicFallback(fallbackStack.map(quoteFontName).join(", ")),
+			cssFallback: withArabicFallback(primaryStack.map(quoteFontName).join(", ")),
 			originalFont: docxFontName,
 			hasGoogleEquivalent: googleFontsEnabled,
 			singleLineRatio: mapping.singleLineRatio
@@ -827,7 +833,7 @@ function resolveFontFamily(docxFontName) {
 	const defaultFallback = DEFAULT_FALLBACKS[category];
 	return {
 		googleFont: null,
-		cssFallback: withArabicFallback(`${quoteFontName(docxFontName)}, ${defaultFallback}`),
+		cssFallback: withArabicFallback(`${quoteFontName(scopedFamily ?? docxFontName)}, ${defaultFallback}`),
 		originalFont: docxFontName,
 		hasGoogleEquivalent: false,
 		singleLineRatio: DEFAULT_SINGLE_LINE_RATIO
@@ -922,4 +928,4 @@ function hasGoogleFontEquivalent(docxFontName) {
 	return (CJK_FONT_ALIASES[normalizedName] ?? normalizedName) in FONT_MAPPINGS;
 }
 //#endregion
-export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setGoogleFontsEnabled };
+export { CJK_FALLBACK_FONT_FAMILY, DEFAULT_SINGLE_LINE_RATIO, buildFontFamilyString, getGoogleFontEquivalent, getGoogleFontsEnabled, getGoogleFontsToLoad, hasGoogleFontEquivalent, isCjkFont, resolveFontFamily, resolveThemeFont, setEmbeddedFontFamilyMap, setGoogleFontsEnabled };

package/dist/utils/hexId.d.ts

@@ -15,6 +15,16 @@
  * strict OOXML validators.
  */
 declare const MAX_HEX_ID_EXCLUSIVE = 2147483647;
+/**
+ * OOXML `ST_LongHexNumber` shape: exactly 8 hex digits (`xsd:hexBinary`,
+ * length 4 bytes). `w14:paraId` / `w14:textId` / comment `paraId` /
+ * `w15:paraIdParent` are all typed this way. A value that doesn't match this
+ * is not a real Word id — it must not be trusted as one (e.g. echoed
+ * unescaped into serialized XML attributes).
+ */
+declare const HEX_ID_PATTERN: RegExp;
+/** Whether `value` is a well-formed 8-hex-digit OOXML long-hex id. */
+declare const isValidHexId: (value: string | undefined | null) => boolean;
 /**
  * Random 8-char uppercase hex id, matching Microsoft's `w14:paraId`
  * extension format (also reused for comment `paraId` / `durableId`).
@@ -37,4 +47,4 @@ declare const generateHexId: () => string;
  */
 declare const deterministicHexId: (seed: string) => string;
 //#endregion
-export { MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId };
+export { HEX_ID_PATTERN, MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId, isValidHexId };

package/dist/utils/hexId.js

@@ -16,6 +16,16 @@
 */
 const MAX_HEX_ID_EXCLUSIVE = 2147483647;
 /**
+* OOXML `ST_LongHexNumber` shape: exactly 8 hex digits (`xsd:hexBinary`,
+* length 4 bytes). `w14:paraId` / `w14:textId` / comment `paraId` /
+* `w15:paraIdParent` are all typed this way. A value that doesn't match this
+* is not a real Word id — it must not be trusted as one (e.g. echoed
+* unescaped into serialized XML attributes).
+*/
+const HEX_ID_PATTERN = /^[0-9A-Fa-f]{8}$/u;
+/** Whether `value` is a well-formed 8-hex-digit OOXML long-hex id. */
+const isValidHexId = (value) => typeof value === "string" && HEX_ID_PATTERN.test(value);
+/**
 * Random 8-char uppercase hex id, matching Microsoft's `w14:paraId`
 * extension format (also reused for comment `paraId` / `durableId`).
 *
@@ -42,4 +52,4 @@ const deterministicHexId = (seed) => {
 	return (value === 0 ? 1 : value).toString(16).toUpperCase().padStart(8, "0");
 };
 //#endregion
-export { MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId };
+export { HEX_ID_PATTERN, MAX_HEX_ID_EXCLUSIVE, deterministicHexId, generateHexId, isValidHexId };

package/dist/utils/sanitizeImageSrc.d.ts

@@ -0,0 +1,21 @@
+//#region src/utils/sanitizeImageSrc.d.ts
+/**
+ * Keep painted image sources local to bytes the host already owns.
+ *
+ * Document media and pasted files enter the editor as `data:image/*` or
+ * `blob:` URLs. Network and executable schemes are rejected so opening or
+ * pasting an untrusted document cannot trigger an external request or run a
+ * script scheme through `<img src>`.
+ */
+declare function sanitizeImageSrc(src: string | null | undefined): string | undefined;
+/**
+ * Assign a sanitized source to an `<img>` element. When the source is rejected
+ * the `src` attribute is left unset: assigning `""` makes some browsers resolve
+ * it against the page URL and fire a spurious request for the current page.
+ *
+ * Structural parameter type so painter unit tests (which fake the DOM) can
+ * exercise it without an `HTMLImageElement`.
+ */
+declare function applySanitizedImageSrc(imgEl: Pick<HTMLImageElement, "src">, src: string | null | undefined): void;
+//#endregion
+export { applySanitizedImageSrc, sanitizeImageSrc };

package/dist/utils/sanitizeImageSrc.js

@@ -0,0 +1,30 @@
+//#region src/utils/sanitizeImageSrc.ts
+/**
+* Keep painted image sources local to bytes the host already owns.
+*
+* Document media and pasted files enter the editor as `data:image/*` or
+* `blob:` URLs. Network and executable schemes are rejected so opening or
+* pasting an untrusted document cannot trigger an external request or run a
+* script scheme through `<img src>`.
+*/
+function sanitizeImageSrc(src) {
+	if (typeof src !== "string") return;
+	const value = src.trim();
+	if (!value) return;
+	if (/^blob:/iu.test(value)) return value;
+	if (/^data:image\/[a-z0-9.+-]+(?:;[^,]*)?,/iu.test(value)) return value;
+}
+/**
+* Assign a sanitized source to an `<img>` element. When the source is rejected
+* the `src` attribute is left unset: assigning `""` makes some browsers resolve
+* it against the page URL and fire a spurious request for the current page.
+*
+* Structural parameter type so painter unit tests (which fake the DOM) can
+* exercise it without an `HTMLImageElement`.
+*/
+function applySanitizedImageSrc(imgEl, src) {
+	const safeSrc = sanitizeImageSrc(src);
+	if (safeSrc !== void 0) imgEl.src = safeSrc;
+}
+//#endregion
+export { applySanitizedImageSrc, sanitizeImageSrc };

package/dist/utils/stripXmlDeclarations.d.ts

@@ -0,0 +1,11 @@
+//#region src/utils/stripXmlDeclarations.d.ts
+/**
+ * Remove complete `<?xml ...?>` declarations from attacker-controlled clipboard HTML.
+ *
+ * Linear scan instead of `/<\?xml[^>]*>/gi`: that pattern backtracks polynomially
+ * when many `<?xml` openers appear with no closing `>`. An unterminated opener
+ * is preserved verbatim (same as the regex, which never matched it).
+ */
+declare function stripXmlDeclarations(html: string): string;
+//#endregion
+export { stripXmlDeclarations };

package/dist/utils/stripXmlDeclarations.js

@@ -0,0 +1,35 @@
+//#region src/utils/stripXmlDeclarations.ts
+/**
+* Remove complete `<?xml ...?>` declarations from attacker-controlled clipboard HTML.
+*
+* Linear scan instead of `/<\?xml[^>]*>/gi`: that pattern backtracks polynomially
+* when many `<?xml` openers appear with no closing `>`. An unterminated opener
+* is preserved verbatim (same as the regex, which never matched it).
+*/
+function stripXmlDeclarations(html) {
+	const chunks = [];
+	let cursor = 0;
+	let searchFrom = 0;
+	while (true) {
+		const start = html.indexOf("<", searchFrom);
+		if (start === -1) {
+			chunks.push(html.slice(cursor));
+			break;
+		}
+		if (!(html.charCodeAt(start + 1) === 63 && (html.charCodeAt(start + 2) === 88 || html.charCodeAt(start + 2) === 120) && (html.charCodeAt(start + 3) === 77 || html.charCodeAt(start + 3) === 109) && (html.charCodeAt(start + 4) === 76 || html.charCodeAt(start + 4) === 108))) {
+			searchFrom = start + 1;
+			continue;
+		}
+		const end = html.indexOf(">", start + 5);
+		if (end === -1) {
+			chunks.push(html.slice(cursor));
+			break;
+		}
+		chunks.push(html.slice(cursor, start));
+		cursor = end + 1;
+		searchFrom = cursor;
+	}
+	return chunks.join("");
+}
+//#endregion
+export { stripXmlDeclarations };

package/dist/version-comparison.d.ts

@@ -109,6 +109,20 @@ type FolioVersionDiff = {
 };
 /** True when an `unpairedBaseCount * unpairedRevisedCount` LCS table would exceed {@link MAX_LCS_CELLS}. */
 declare const exceedsLcsBudget: (unpairedBaseCount: number, unpairedRevisedCount: number) => boolean;
+/**
+ * Mutable cell budget SHARED across every story pair one {@link compareDocxVersions}
+ * call compares. {@link exceedsLcsBudget} alone only bounds a single pass 2
+ * call's own table; without an aggregate budget, a document with many
+ * attacker-controlled stories (footnotes/endnotes) could still force a fresh
+ * near-{@link MAX_LCS_CELLS}-sized allocation for EVERY story pair. Each
+ * `pairByExactText` call that actually runs pass 2 decrements
+ * `remainingCells` by its own `m * n`; once exhausted, every subsequent
+ * story's pass 2 is refused regardless of that story's own size, falling
+ * through to pass 3's linear positional zip.
+ */
+type FolioVersionComparisonLcsBudget = {
+  remainingCells: number;
+};
 /**
  * One step of a completed alignment, in revised-side document order with
  * base-only blocks slotted where they sat. `pair` events cover pass 1/2
@@ -131,8 +145,14 @@ type FolioAlignedBlockEvent = {
  * snapshots and flatten it into an ordered event stream. Shared by
  * {@link compareDocxVersions} and the redline generator so both interpret
  * one document walk instead of re-deriving it.
+ *
+ * `lcsBudget` defaults to a fresh, single-call budget so a caller comparing
+ * one block pair in isolation (the redline generator) behaves exactly as
+ * before. {@link compareDocxVersions} passes one budget object shared across
+ * every story pair instead, so pass 2's cell allowance is aggregate across
+ * the whole comparison rather than reset per story.
  */
-declare const alignFolioBlocks: (baseBlocks: readonly FolioAIBlock[], revisedBlocks: readonly FolioAIBlock[]) => FolioAlignedBlockEvent[];
+declare const alignFolioBlocks: (baseBlocks: readonly FolioAIBlock[], revisedBlocks: readonly FolioAIBlock[], lcsBudget?: FolioVersionComparisonLcsBudget) => FolioAlignedBlockEvent[];
 /** Apply auditable, output-only privacy transforms to a structured version diff. */
 declare const applyFolioVersionDiffPrivacy: (diff: FolioVersionDiff, options: FolioVersionDiffPrivacyOptions) => FolioVersionDiff;
 /**
@@ -143,4 +163,4 @@ declare const applyFolioVersionDiffPrivacy: (diff: FolioVersionDiff, options: Fo
  */
 declare const compareDocxVersions: (base: ArrayBuffer, revised: ArrayBuffer, options?: FolioCompareDocxVersionsOptions) => Promise<FolioVersionDiff>;
 //#endregion
-export { FOLIO_DOCUMENT_METADATA_PROPERTIES, FOLIO_VERSION_COMPARISON_PRIVACY_TRANSFORMS, FOLIO_VERSION_COMPARISON_SCOPES, FolioAlignedBlockEvent, FolioBlockDiff, FolioCompareDocxVersionsOptions, type FolioDocumentMetadataProperty, FolioDocumentMetadataValue, FolioFormatProperty, FolioMetadataDiff, FolioStoryDiff, FolioVersionBlockHandle, FolioVersionComparisonPrivacyTransform, FolioVersionComparisonScope, FolioVersionDiff, FolioVersionDiffPrivacyOptions, FolioVersionDiffPrivacyReport, FolioVersionDiffSegment, FolioVersionDiffSummaryCounts, InvalidFolioVersionComparisonOptionsError, alignFolioBlocks, applyFolioVersionDiffPrivacy, compareDocxVersions, exceedsLcsBudget, isFolioVersionComparisonPrivacyTransform, isFolioVersionComparisonScope };
+export { FOLIO_DOCUMENT_METADATA_PROPERTIES, FOLIO_VERSION_COMPARISON_PRIVACY_TRANSFORMS, FOLIO_VERSION_COMPARISON_SCOPES, FolioAlignedBlockEvent, FolioBlockDiff, FolioCompareDocxVersionsOptions, type FolioDocumentMetadataProperty, FolioDocumentMetadataValue, FolioFormatProperty, FolioMetadataDiff, FolioStoryDiff, FolioVersionBlockHandle, FolioVersionComparisonLcsBudget, FolioVersionComparisonPrivacyTransform, FolioVersionComparisonScope, FolioVersionDiff, FolioVersionDiffPrivacyOptions, FolioVersionDiffPrivacyReport, FolioVersionDiffSegment, FolioVersionDiffSummaryCounts, InvalidFolioVersionComparisonOptionsError, alignFolioBlocks, applyFolioVersionDiffPrivacy, compareDocxVersions, exceedsLcsBudget, isFolioVersionComparisonPrivacyTransform, isFolioVersionComparisonScope };

package/dist/version-comparison.js

@@ -160,12 +160,14 @@ const pairByStableId = (base, revised) => {
 const MAX_LCS_CELLS = 4e6;
 /** True when an `unpairedBaseCount * unpairedRevisedCount` LCS table would exceed {@link MAX_LCS_CELLS}. */
 const exceedsLcsBudget = (unpairedBaseCount, unpairedRevisedCount) => unpairedBaseCount * unpairedRevisedCount > MAX_LCS_CELLS;
+const createLcsBudget = () => ({ remainingCells: MAX_LCS_CELLS });
 /** Pass 2: order-preserving LCS by exact text equality over the blocks pass 1 left unpaired. */
-const pairByExactText = (base, revised) => {
+const pairByExactText = (base, revised, lcsBudget) => {
 	const m = base.length;
 	const n = revised.length;
 	if (m === 0 || n === 0) return [];
-	if (exceedsLcsBudget(m, n)) return [];
+	if (exceedsLcsBudget(m, n) || lcsBudget.remainingCells <= 0) return [];
+	lcsBudget.remainingCells -= m * n;
 	const baseTexts = base.map(({ block }) => block.text);
 	const revisedTexts = revised.map(({ block }) => block.text);
 	const stride = n + 1;
@@ -205,8 +207,14 @@ const pairByExactText = (base, revised) => {
 * snapshots and flatten it into an ordered event stream. Shared by
 * {@link compareDocxVersions} and the redline generator so both interpret
 * one document walk instead of re-deriving it.
+*
+* `lcsBudget` defaults to a fresh, single-call budget so a caller comparing
+* one block pair in isolation (the redline generator) behaves exactly as
+* before. {@link compareDocxVersions} passes one budget object shared across
+* every story pair instead, so pass 2's cell allowance is aggregate across
+* the whole comparison rather than reset per story.
 */
-const alignFolioBlocks = (baseBlocks, revisedBlocks) => {
+const alignFolioBlocks = (baseBlocks, revisedBlocks, lcsBudget = createLcsBudget()) => {
 	const stableIdAnchors = pairByStableId(baseBlocks, revisedBlocks);
 	const usedBaseIndexes = new Set(stableIdAnchors.map((anchor) => anchor.baseIndex));
 	const usedRevisedIndexes = new Set(stableIdAnchors.map((anchor) => anchor.revisedIndex));
@@ -224,7 +232,7 @@ const alignFolioBlocks = (baseBlocks, revisedBlocks) => {
 			index: blockIndex
 		});
 	});
-	const exactTextAnchors = pairByExactText(baseRemaining, revisedRemaining);
+	const exactTextAnchors = pairByExactText(baseRemaining, revisedRemaining, lcsBudget);
 	const anchors = longestIncreasingByRevisedIndex([...stableIdAnchors, ...exactTextAnchors].toSorted((a, b) => a.baseIndex - b.baseIndex));
 	const events = [];
 	/** Pass 3: positionally zip the leftover blocks in one gap between anchors. */
@@ -331,6 +339,20 @@ const meetsMoveWordCount = (text) => {
 	return false;
 };
 /**
+* Cap on how many same-text `deleted` candidates {@link detectMoves} queues
+* per distinct text. Duplicated boilerplate at or above the word floor
+* (e.g. a repeated long clause) could otherwise grow one text's candidate
+* list without bound; past this cap, further same-text deletions are simply
+* left as `deleted` (never matched to a move) instead of queued.
+*/
+const MAX_MOVE_CANDIDATES_PER_TEXT = 1e4;
+const dequeueDeletedIndex = (queue) => {
+	if (!queue || queue.head >= queue.items.length) return;
+	const index = queue.items[queue.head];
+	queue.head += 1;
+	return index;
+};
+/**
 * Re-classify `deleted` + `added` pairs with identical text as
 * `movedFrom` / `movedTo` entries sharing a `moveGroupId`, in place, so each
 * side keeps its slot in the revised-side document order. Matching is FIFO
@@ -340,17 +362,22 @@ const meetsMoveWordCount = (text) => {
 const detectMoves = (changes, counts, firstMoveGroupId) => {
 	const deletedIndexesByText = /* @__PURE__ */ new Map();
 	changes.forEach((change, index) => {
-		if (change.type === "deleted" && meetsMoveWordCount(change.text)) {
-			const queue = deletedIndexesByText.get(change.text) ?? [];
-			queue.push(index);
-			deletedIndexesByText.set(change.text, queue);
+		if (change.type !== "deleted" || !meetsMoveWordCount(change.text)) return;
+		const queue = deletedIndexesByText.get(change.text);
+		if (!queue) {
+			deletedIndexesByText.set(change.text, {
+				items: [index],
+				head: 0
+			});
+			return;
 		}
+		if (queue.items.length < MAX_MOVE_CANDIDATES_PER_TEXT) queue.items.push(index);
 	});
 	if (deletedIndexesByText.size === 0) return;
 	let moveGroupId = firstMoveGroupId - 1;
 	changes.forEach((change, index) => {
 		if (change.type !== "added") return;
-		const deletedIndex = deletedIndexesByText.get(change.text)?.shift();
+		const deletedIndex = dequeueDeletedIndex(deletedIndexesByText.get(change.text));
 		if (deletedIndex === void 0) return;
 		const deleted = changes[deletedIndex];
 		if (!deleted || deleted.type !== "deleted") return;
@@ -394,10 +421,10 @@ const addSummaryCounts = (target, source) => {
 	target.metadataChanged += source.metadataChanged;
 	target.unchanged += source.unchanged;
 };
-const compareStoryBlocks = ({ baseStory, revisedStory, baseBlocks, revisedBlocks, firstMoveGroupId, includeText, includeFormatting }) => {
+const compareStoryBlocks = ({ baseStory, revisedStory, baseBlocks, revisedBlocks, firstMoveGroupId, includeText, includeFormatting, lcsBudget }) => {
 	const changes = [];
 	const counts = createSummaryCounts();
-	for (const event of alignFolioBlocks(baseBlocks, revisedBlocks)) {
+	for (const event of alignFolioBlocks(baseBlocks, revisedBlocks, lcsBudget)) {
 		if (event.type === "pair") {
 			if (!baseStory || !revisedStory) panic("A paired comparison event requires both story handles");
 			const { baseBlock, revisedBlock } = event;
@@ -554,6 +581,7 @@ const compareDocxVersions = async (base, revised, options = {}) => {
 	const baseStories = baseReviewer.listStories().map(({ handle }) => handle);
 	const revisedStories = revisedReviewer.listStories().map(({ handle }) => handle);
 	let nextMoveGroupId = 1;
+	const lcsBudget = createLcsBudget();
 	for (const pair of pairFolioDocumentStories(baseStories, revisedStories)) {
 		const baseBlocks = pair.baseStory ? baseReviewer.readReviewedStory({
 			story: pair.baseStory,
@@ -569,7 +597,8 @@ const compareDocxVersions = async (base, revised, options = {}) => {
 			revisedBlocks,
 			firstMoveGroupId: nextMoveGroupId,
 			includeText: scopes.has("text"),
-			includeFormatting: scopes.has("formatting")
+			includeFormatting: scopes.has("formatting"),
+			lcsBudget
 		});
 		stories.push(storyDiff);
 		for (const change of storyDiff.changes) changes.push(change);

package/dist/watermark/index.d.ts

@@ -1,6 +1,16 @@
 import { document_d_exports } from "../types/document.js";
 
 //#region src/watermark/index.d.ts
+/**
+ * Whether `target` is safe to save as a watermark picture's external image
+ * relationship. A watermark dialog lets an author type an arbitrary string
+ * for this field; without a scheme check it becomes a `TargetMode="External"`
+ * relationship verbatim (see `docx/rezip.ts`), which would let a `file:` URL
+ * or UNC path (`\\host\share\...`) into the exported `.docx` — a resource
+ * whatever later opens the file (e.g. Word) would try to resolve. Only
+ * `http:`/`https:` targets are allowed.
+ */
+declare function isAllowedExternalWatermarkImageUrl(target: string): boolean;
 /**
  * Read the document's watermark. Walks every header part and returns
  * the first watermark encountered (header insertion order). Returns
@@ -36,4 +46,4 @@ declare function ensureWatermarkHeaderCoverage(doc: document_d_exports.Document,
 type PictureWatermark = document_d_exports.PictureWatermark;
 type TextWatermark = document_d_exports.TextWatermark;
 type Watermark = document_d_exports.Watermark;
-export { type PictureWatermark, type TextWatermark, type Watermark, ensureWatermarkHeaderCoverage, getDocumentWatermark, setDocumentWatermark };
+export { type PictureWatermark, type TextWatermark, type Watermark, ensureWatermarkHeaderCoverage, getDocumentWatermark, isAllowedExternalWatermarkImageUrl, setDocumentWatermark };

package/dist/watermark/index.js

@@ -1,5 +1,26 @@
 //#region src/watermark/index.ts
 /**
+* Schemes allowed for a picture watermark's external image target
+* (`TargetMode="External"` in the saved package's relationships).
+*/
+const ALLOWED_EXTERNAL_IMAGE_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+/**
+* Whether `target` is safe to save as a watermark picture's external image
+* relationship. A watermark dialog lets an author type an arbitrary string
+* for this field; without a scheme check it becomes a `TargetMode="External"`
+* relationship verbatim (see `docx/rezip.ts`), which would let a `file:` URL
+* or UNC path (`\\host\share\...`) into the exported `.docx` — a resource
+* whatever later opens the file (e.g. Word) would try to resolve. Only
+* `http:`/`https:` targets are allowed.
+*/
+function isAllowedExternalWatermarkImageUrl(target) {
+	try {
+		return ALLOWED_EXTERNAL_IMAGE_SCHEMES.has(new URL(target).protocol);
+	} catch {
+		return false;
+	}
+}
+/**
 * Read the document's watermark. Walks every header part and returns
 * the first watermark encountered (header insertion order). Returns
 * `undefined` when no header carries one.
@@ -146,4 +167,4 @@ function ensureWatermarkHeaderCoverage(doc, watermark) {
 	};
 }
 //#endregion
-export { ensureWatermarkHeaderCoverage, getDocumentWatermark, setDocumentWatermark };
+export { ensureWatermarkHeaderCoverage, getDocumentWatermark, isAllowedExternalWatermarkImageUrl, setDocumentWatermark };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stll/folio-core",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Headless, framework-neutral core of folio: the OOXML (.docx) parser, document model, ProseMirror integration, and page-layout engine. No React.",
   "keywords": [
     "document-model",
@@ -107,11 +107,12 @@
     "perf": "bun scripts/profile-editor.ts"
   },
   "dependencies": {
-    "@stll/docx-core": "^0.1.0",
+    "@stll/docx-core": "^0.4.0",
     "@stll/docx-utils": "^0.1.0",
     "@stll/template-conditions": "^0.1.0",
     "better-result": "2.9.2",
     "csstype": "^3.1.3",
+    "dompurify": "^3.4.12",
     "fast-xml-parser": "^5.9.3",
     "hyphen": "1.14.1",
     "jszip": "3.10.1",