@stll/folio-core 0.12.0 → 0.14.0

package/dist/controller/hiddenEditorManager.js

@@ -25,6 +25,16 @@ import { EditorView } from "prosemirror-view";
 const normalizeSeedState = (state) => ensureBaseDirectionInState(ensureParaIdsInState(state));
 const normalizeLocalSeedState = (state) => ensureBaseDirectionInState(state);
 const isObjectRecord = (value) => typeof value === "object" && value !== null;
+/**
+* A remote collaborator's awareness `user.color` is read from another
+* peer's Yjs awareness state — effectively untrusted network input — and
+* gets fed straight into `element.style.background`/`backgroundColor` (see
+* `RemoteSelectionOverlay`). Restrict it to a plain 6-digit hex color before
+* accepting it so a crafted value (e.g. a CSS `url(...)` payload) can't ride
+* along as a CSS-injection / beacon vector; anything else falls back to the
+* default selection color below.
+*/
+const AWARENESS_HEX_COLOR_PATTERN = /^#[0-9A-Fa-f]{6}$/u;
 const isYSyncState = (value, yjs) => {
 	if (!isObjectRecord(value)) return false;
 	const binding = value["binding"];
@@ -48,8 +58,9 @@ const readAwarenessUser = (state, clientId) => {
 		name: `User ${clientId}`
 	};
 	const user = state["user"];
+	const rawColor = user["color"];
 	return {
-		color: typeof user["color"] === "string" ? user["color"] : "var(--doc-image-selection)",
+		color: typeof rawColor === "string" && AWARENESS_HEX_COLOR_PATTERN.test(rawColor) ? rawColor : "var(--doc-image-selection)",
 		name: typeof user["name"] === "string" ? user["name"] : `User ${clientId}`
 	};
 };

package/dist/controller/layoutPipeline.js

@@ -1,3 +1,4 @@
+import { getDocumentWatermark } from "../watermark/index.js";
 import "../layout-engine/types.js";
 import { resolveEffectiveParagraphSpacingTree } from "../layout-engine/paragraphSpacing.js";
 import { renderPages } from "../layout-painter/renderPage.js";
@@ -20,7 +21,6 @@ import { resolveJustificationCompatibility } from "../layout-engine/justificatio
 import { measureBlocks, measureSingleBlockWithoutFloatingZones } from "../layout-engine/measure/measureBlocks.js";
 import { tryBuildIncrementalMeasures } from "../paged-layout/incrementalMeasure.js";
 import { computePerBlockMeasureInputs } from "../paged-layout/sectionBlockWidths.js";
-import { getDocumentWatermark } from "../watermark/index.js";
 //#region src/controller/layoutPipeline.ts
 function bodyMarginsClearHeaderFooter({ authoredMargins, preparedHeader, preparedFooter }) {
 	const headerBottom = preparedHeader ? (authoredMargins.header ?? 0) + (preparedHeader.marginPushBottom ?? preparedHeader.height) : authoredMargins.top;

package/dist/controller/noteEditorManager.js

@@ -1,4 +1,3 @@
-import { proseDocToBlocks } from "../prosemirror/conversion/fromProseDoc.js";
 import { ExtensionManager } from "../prosemirror/extensions/ExtensionManager.js";
 import { ensureBaseDirectionInState } from "../prosemirror/extensions/features/AutoBidiDetectionExtension.js";
 import { createDocumentStylesPlugin } from "../prosemirror/plugins/documentStyles.js";
@@ -6,6 +5,7 @@ import { ensureParaIdsInState } from "../prosemirror/extensions/features/ParaIdA
 import { createStarterKit } from "../prosemirror/extensions/StarterKit.js";
 import { schema } from "../prosemirror/schema/index.js";
 import { footnoteToProseDoc } from "../prosemirror/conversion/toProseDoc.js";
+import { proseDocToBlocks } from "../prosemirror/conversion/fromProseDoc.js";
 import { isSeparatorEndnote, isSeparatorFootnote } from "../docx/footnoteParser.js";
 import { EditorState } from "prosemirror-state";
 import { EditorView } from "prosemirror-view";

package/dist/document-operations.d.ts

@@ -4,7 +4,7 @@ import { FolioAIEditView } from "./ai-edits/apply.js";
 //#region src/document-operations.d.ts
 declare const FOLIO_DOCUMENT_OPERATION_CONTRACT_VERSION: 1;
 declare const FOLIO_DOCUMENT_OPERATION_TYPES: readonly ["replaceInBlock", "replaceRange", "commentOnRange", "formatRange", "insertAfterBlock", "insertBeforeBlock", "replaceBlock", "deleteBlock", "commentOnBlock", "insertSignatureTable", "insertTableRow", "deleteTableRow", "insertTableColumn", "deleteTableColumn", "mergeTableCells", "splitTableCell"];
-declare const FOLIO_DOCUMENT_OPERATION_MODES: readonly ["direct", "tracked-changes"];
+declare const FOLIO_DOCUMENT_OPERATION_MODES: readonly ["direct", "tracked-changes", "suggested"];
 declare const FOLIO_DOCUMENT_OPERATION_STORIES: readonly ["main", "header", "footer", "footnote", "endnote"];
 declare const FOLIO_DOCUMENT_OPERATION_PRECONDITIONS: readonly ["blockTextHash"];
 declare const FOLIO_DOCUMENT_OPERATION_BATCH_MODES: readonly ["best-effort", "atomic"];
@@ -13,20 +13,20 @@ type FolioDocumentOperationMode = FolioAIEditApplyMode;
 type FolioDocumentOperationPrecondition = FolioAIEditPrecondition;
 type FolioDocumentOperationType = FolioDocumentOperation["type"];
 declare const FOLIO_DOCUMENT_OPERATION_MODES_BY_TYPE: Readonly<{
-  readonly replaceInBlock: readonly ["direct", "tracked-changes"];
-  readonly replaceRange: readonly ["direct", "tracked-changes"];
+  readonly replaceInBlock: readonly ["direct", "tracked-changes", "suggested"];
+  readonly replaceRange: readonly ["direct", "tracked-changes", "suggested"];
   readonly commentOnRange: readonly ["direct", "tracked-changes"];
-  readonly formatRange: readonly ["direct", "tracked-changes"];
-  readonly insertAfterBlock: readonly ["direct", "tracked-changes"];
-  readonly insertBeforeBlock: readonly ["direct", "tracked-changes"];
-  readonly replaceBlock: readonly ["direct", "tracked-changes"];
-  readonly deleteBlock: readonly ["direct", "tracked-changes"];
+  readonly formatRange: readonly ["direct", "tracked-changes", "suggested"];
+  readonly insertAfterBlock: readonly ["direct", "tracked-changes", "suggested"];
+  readonly insertBeforeBlock: readonly ["direct", "tracked-changes", "suggested"];
+  readonly replaceBlock: readonly ["direct", "tracked-changes", "suggested"];
+  readonly deleteBlock: readonly ["direct", "tracked-changes", "suggested"];
   readonly commentOnBlock: readonly ["direct", "tracked-changes"];
-  readonly insertSignatureTable: readonly ["direct"];
-  readonly insertTableRow: readonly ["direct", "tracked-changes"];
-  readonly deleteTableRow: readonly ["direct", "tracked-changes"];
-  readonly insertTableColumn: readonly ["direct", "tracked-changes"];
-  readonly deleteTableColumn: readonly ["direct", "tracked-changes"];
+  readonly insertSignatureTable: readonly ["direct", "suggested"];
+  readonly insertTableRow: readonly ["direct", "tracked-changes", "suggested"];
+  readonly deleteTableRow: readonly ["direct", "tracked-changes", "suggested"];
+  readonly insertTableColumn: readonly ["direct", "tracked-changes", "suggested"];
+  readonly deleteTableColumn: readonly ["direct", "tracked-changes", "suggested"];
   readonly mergeTableCells: readonly ["direct", "tracked-changes"];
   readonly splitTableCell: readonly ["direct", "tracked-changes"];
 }>;

package/dist/document-operations.js

@@ -20,7 +20,11 @@ const FOLIO_DOCUMENT_OPERATION_TYPES = Object.freeze([
 	"mergeTableCells",
 	"splitTableCell"
 ]);
-const FOLIO_DOCUMENT_OPERATION_MODES = Object.freeze(["direct", "tracked-changes"]);
+const FOLIO_DOCUMENT_OPERATION_MODES = Object.freeze([
+	"direct",
+	"tracked-changes",
+	"suggested"
+]);
 const FOLIO_DOCUMENT_OPERATION_STORIES = Object.freeze([
 	"main",
 	"header",
@@ -30,23 +34,24 @@ const FOLIO_DOCUMENT_OPERATION_STORIES = Object.freeze([
 ]);
 const FOLIO_DOCUMENT_OPERATION_PRECONDITIONS = Object.freeze(["blockTextHash"]);
 const FOLIO_DOCUMENT_OPERATION_BATCH_MODES = Object.freeze(["best-effort", "atomic"]);
-const DIRECT_AND_TRACKED_MODES = FOLIO_DOCUMENT_OPERATION_MODES;
-const DIRECT_ONLY_MODES = Object.freeze(["direct"]);
+const DIRECT_AND_TRACKED_MODES = Object.freeze(["direct", "tracked-changes"]);
+const DIRECT_TRACKED_AND_SUGGESTED_MODES = FOLIO_DOCUMENT_OPERATION_MODES;
+const DIRECT_AND_SUGGESTED_MODES = Object.freeze(["direct", "suggested"]);
 const FOLIO_DOCUMENT_OPERATION_MODES_BY_TYPE = Object.freeze({
-	replaceInBlock: DIRECT_AND_TRACKED_MODES,
-	replaceRange: DIRECT_AND_TRACKED_MODES,
+	replaceInBlock: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	replaceRange: DIRECT_TRACKED_AND_SUGGESTED_MODES,
 	commentOnRange: DIRECT_AND_TRACKED_MODES,
-	formatRange: DIRECT_AND_TRACKED_MODES,
-	insertAfterBlock: DIRECT_AND_TRACKED_MODES,
-	insertBeforeBlock: DIRECT_AND_TRACKED_MODES,
-	replaceBlock: DIRECT_AND_TRACKED_MODES,
-	deleteBlock: DIRECT_AND_TRACKED_MODES,
+	formatRange: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	insertAfterBlock: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	insertBeforeBlock: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	replaceBlock: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	deleteBlock: DIRECT_TRACKED_AND_SUGGESTED_MODES,
 	commentOnBlock: DIRECT_AND_TRACKED_MODES,
-	insertSignatureTable: DIRECT_ONLY_MODES,
-	insertTableRow: DIRECT_AND_TRACKED_MODES,
-	deleteTableRow: DIRECT_AND_TRACKED_MODES,
-	insertTableColumn: DIRECT_AND_TRACKED_MODES,
-	deleteTableColumn: DIRECT_AND_TRACKED_MODES,
+	insertSignatureTable: DIRECT_AND_SUGGESTED_MODES,
+	insertTableRow: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	deleteTableRow: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	insertTableColumn: DIRECT_TRACKED_AND_SUGGESTED_MODES,
+	deleteTableColumn: DIRECT_TRACKED_AND_SUGGESTED_MODES,
 	mergeTableCells: DIRECT_AND_TRACKED_MODES,
 	splitTableCell: DIRECT_AND_TRACKED_MODES
 });
@@ -63,8 +68,8 @@ const DOCUMENT_OPERATION_CAPABILITIES = Object.freeze({
 const getFolioDocumentOperationCapabilities = () => DOCUMENT_OPERATION_CAPABILITIES;
 const includesDocumentOperationMode = (supportedModes, mode) => supportedModes.includes(mode);
 const isFolioDocumentOperationModeSupported = (operationType, mode) => {
+	if (!Object.hasOwn(FOLIO_DOCUMENT_OPERATION_MODES_BY_TYPE, operationType)) return false;
 	const supportedModes = FOLIO_DOCUMENT_OPERATION_MODES_BY_TYPE[operationType];
-	if (supportedModes === void 0) return false;
 	return includesDocumentOperationMode(supportedModes, mode);
 };
 const isSupportedFolioDocumentOperationVersion = (value) => value === 1;
@@ -204,7 +209,8 @@ const COMMON_OPERATION_KEYS = [
 	"blockId",
 	"severity",
 	"area",
-	"precondition"
+	"precondition",
+	"suggestionId"
 ];
 const parseSignatureParties = (value, path) => {
 	const parties = value["parties"];
@@ -232,10 +238,12 @@ const parseDocumentOperation = (value, index) => {
 	const type = readString(value, "type", path);
 	const reviewMeta = readReviewMeta(value, path);
 	const precondition = readOptionalPrecondition(value, path);
+	const suggestionId = readOptionalString(value, "suggestionId", path);
 	const comment = readOptionalComment(value, path);
 	const operationMeta = {
 		...reviewMeta,
-		...precondition !== void 0 && { precondition }
+		...precondition !== void 0 && { precondition },
+		...suggestionId !== void 0 && { suggestionId }
 	};
 	if (type === "replaceRange") {
 		assertAllowedKeys(value, path, [
@@ -246,7 +254,8 @@ const parseDocumentOperation = (value, index) => {
 			"comment",
 			"severity",
 			"area",
-			"precondition"
+			"precondition",
+			"suggestionId"
 		]);
 		return {
 			...operationMeta,
@@ -284,7 +293,8 @@ const parseDocumentOperation = (value, index) => {
 			"formatting",
 			"severity",
 			"area",
-			"precondition"
+			"precondition",
+			"suggestionId"
 		]);
 		return {
 			...operationMeta,
@@ -510,7 +520,7 @@ const parseFolioDocumentOperationBatch = (value) => {
 	const operations = value["operations"];
 	if (!Array.isArray(operations)) return invalidBatch("$.operations", "expected an array");
 	const mode = value["mode"];
-	if (mode !== void 0 && mode !== "direct" && mode !== "tracked-changes") return invalidBatch("$.mode", "expected \"direct\" or \"tracked-changes\" when provided");
+	if (mode !== void 0 && mode !== "direct" && mode !== "tracked-changes" && mode !== "suggested") return invalidBatch("$.mode", "expected \"direct\", \"tracked-changes\", or \"suggested\" when provided");
 	const atomic = readOptionalBoolean(value, "atomic", "$");
 	const dryRun = readOptionalBoolean(value, "dryRun", "$");
 	const parsedOperations = operations.map(parseDocumentOperation);

package/dist/docx/blockContentParser.js

@@ -53,7 +53,7 @@ const formatNumber = (value, numFmt) => {
 		default: return String(value);
 	}
 };
-const computeListMarker = (paragraph, { numbering, listCounters, abstractCounters, restartedNumIds, previousList }) => {
+const computeListMarker = (paragraph, { numbering, listCounters, abstractCounters, restartedNumIds, previousList, siblingNumIdsByAbstractNumId }) => {
 	const listRendering = paragraph.listRendering;
 	if (!listRendering || !numbering) {
 		previousList.abstractNumId = null;
@@ -73,6 +73,14 @@ const computeListMarker = (paragraph, { numbering, listCounters, abstractCounter
 	const counters = listCounters.get(numId);
 	if (!counters) return;
 	const abstractNumId = numbering.getAbstractNumId(numId);
+	if (firstEncounter && abstractNumId !== null) {
+		let siblingNumIds = siblingNumIdsByAbstractNumId.get(abstractNumId);
+		if (!siblingNumIds) {
+			siblingNumIds = /* @__PURE__ */ new Set();
+			siblingNumIdsByAbstractNumId.set(abstractNumId, siblingNumIds);
+		}
+		siblingNumIds.add(numId);
+	}
 	const styleNumbering = paragraph.formatting?.numPrFromStyle;
 	let resumedAbstractCounters;
 	const resumesRestartedInstance = firstEncounter && listRendering.startOverride === void 0 && abstractNumId !== null && previousList.abstractNumId === abstractNumId && previousList.numId !== null && previousList.numId !== numId && restartedNumIds.has(previousList.numId);
@@ -101,9 +109,13 @@ const computeListMarker = (paragraph, { numbering, listCounters, abstractCounter
 		counters[level + 1] = (childCounter === void 0 || Number.isNaN(childCounter) ? 0 : childCounter) + childAdvances;
 	}
 	if (abstractNumId !== null) {
-		if (resumedAbstractCounters) for (const [otherNumId, otherCounters] of listCounters) {
-			if (otherNumId === numId || numbering.getAbstractNumId(otherNumId) !== abstractNumId || !otherCounters.every((value, index) => Object.is(value, resumedAbstractCounters[index]))) continue;
-			for (let i = 0; i < otherCounters.length; i += 1) otherCounters[i] = counters[i] ?? NaN;
+		if (resumedAbstractCounters) {
+			const siblingNumIds = siblingNumIdsByAbstractNumId.get(abstractNumId);
+			for (const otherNumId of siblingNumIds ?? []) {
+				const otherCounters = listCounters.get(otherNumId);
+				if (otherNumId === numId || !otherCounters || !otherCounters.every((value, index) => Object.is(value, resumedAbstractCounters[index]))) continue;
+				for (let i = 0; i < otherCounters.length; i += 1) otherCounters[i] = counters[i] ?? NaN;
+			}
 		}
 		abstractCounters.set(abstractNumId, [...counters]);
 	}
@@ -140,6 +152,7 @@ const parseBlockContent = (parent, styles, theme, numbering, rels, media, option
 		fromStyle: false,
 		numId: null
 	},
+	siblingNumIdsByAbstractNumId: /* @__PURE__ */ new Map(),
 	options: {
 		...options,
 		rootXmlns: mergeXmlnsDeclarations(options?.rootXmlns ?? {}, parent)
@@ -160,7 +173,8 @@ const parseBlockContentWithState = (parent, styles, theme, numbering, rels, medi
 				listCounters: state.listCounters,
 				abstractCounters: state.abstractCounters,
 				restartedNumIds: state.restartedNumIds,
-				previousList: state.previousList
+				previousList: state.previousList,
+				siblingNumIdsByAbstractNumId: state.siblingNumIdsByAbstractNumId
 			});
 			content.push(paragraph);
 			continue;

package/dist/docx/commentRangeIntegrity.d.ts

@@ -0,0 +1,6 @@
+import { document_d_exports } from "../types/document.js";
+
+//#region src/docx/commentRangeIntegrity.d.ts
+declare const withoutOrphanCommentRanges: (doc: document_d_exports.Document) => document_d_exports.Document;
+//#endregion
+export { withoutOrphanCommentRanges };

package/dist/docx/commentRangeIntegrity.js

@@ -0,0 +1,186 @@
+//#region src/docx/commentRangeIntegrity.ts
+const withoutOrphanCommentRanges = (doc) => {
+	const validCommentIds = new Set((doc.package.document.comments ?? []).map((comment) => comment.id));
+	const document = withoutOrphanDocumentBodyMarkers(doc.package.document, validCommentIds);
+	const headers = withoutOrphanHeaderFooterMapMarkers(doc.package.headers, validCommentIds);
+	const footers = withoutOrphanHeaderFooterMapMarkers(doc.package.footers, validCommentIds);
+	const footnotes = withoutOrphanNoteMarkers(doc.package.footnotes, validCommentIds);
+	const endnotes = withoutOrphanNoteMarkers(doc.package.endnotes, validCommentIds);
+	if (!document && !headers && !footers && !footnotes && !endnotes) return doc;
+	return {
+		...doc,
+		package: {
+			...doc.package,
+			...document ? { document } : {},
+			...headers ? { headers } : {},
+			...footers ? { footers } : {},
+			...footnotes ? { footnotes } : {},
+			...endnotes ? { endnotes } : {}
+		}
+	};
+};
+const withoutOrphanDocumentBodyMarkers = (document, validCommentIds) => {
+	const content = withoutOrphanBlockMarkers(document.content, validCommentIds);
+	const comments = withoutOrphanCommentBodyMarkers(document.comments, validCommentIds);
+	if (!content && !comments) return null;
+	return {
+		...document,
+		...content ? { content } : {},
+		...comments ? { comments } : {}
+	};
+};
+const withoutOrphanCommentBodyMarkers = (comments, validCommentIds) => {
+	if (!comments) return null;
+	let changed = false;
+	const next = [];
+	for (const comment of comments) {
+		const content = withoutOrphanParagraphListMarkers(comment.content, validCommentIds);
+		if (!content) {
+			next.push(comment);
+			continue;
+		}
+		changed = true;
+		next.push({
+			...comment,
+			content
+		});
+	}
+	return changed ? next : null;
+};
+const withoutOrphanParagraphListMarkers = (paragraphs, validCommentIds) => {
+	let changed = false;
+	const next = [];
+	for (const paragraph of paragraphs) {
+		const nextParagraph = withoutOrphanParagraphMarkers(paragraph, validCommentIds);
+		if (nextParagraph !== paragraph) changed = true;
+		next.push(nextParagraph);
+	}
+	return changed ? next : null;
+};
+const withoutOrphanHeaderFooterMapMarkers = (map, validCommentIds) => {
+	if (!map) return null;
+	let changed = false;
+	const next = /* @__PURE__ */ new Map();
+	for (const [rId, headerFooter] of map) {
+		const content = withoutOrphanBlockMarkers(headerFooter.content, validCommentIds);
+		if (!content) {
+			next.set(rId, headerFooter);
+			continue;
+		}
+		changed = true;
+		next.set(rId, {
+			...headerFooter,
+			content
+		});
+	}
+	return changed ? next : null;
+};
+const withoutOrphanNoteMarkers = (notes, validCommentIds) => {
+	if (!notes) return null;
+	let changed = false;
+	const next = [];
+	for (const note of notes) {
+		const content = withoutOrphanBlockMarkers(note.content, validCommentIds);
+		if (!content) {
+			next.push(note);
+			continue;
+		}
+		changed = true;
+		next.push({
+			...note,
+			content
+		});
+	}
+	return changed ? next : null;
+};
+const withoutOrphanBlockMarkers = (blocks, validCommentIds) => {
+	let changed = false;
+	const next = [];
+	for (const block of blocks) {
+		const nextBlock = withoutOrphanBlockMarker(block, validCommentIds);
+		if (nextBlock !== block) changed = true;
+		next.push(nextBlock);
+	}
+	return changed ? next : null;
+};
+const withoutOrphanBlockMarker = (block, validCommentIds) => {
+	if (block.type === "paragraph") return withoutOrphanParagraphMarkers(block, validCommentIds);
+	if (block.type === "table") return withoutOrphanTableMarkers(block, validCommentIds);
+	if (!("content" in block) || !block.content) return block;
+	const content = withoutOrphanBlockMarkers(block.content, validCommentIds);
+	if (!content) return block;
+	return {
+		...block,
+		content
+	};
+};
+const withoutOrphanTableMarkers = (table, validCommentIds) => {
+	let changed = false;
+	const rows = [];
+	for (const row of table.rows) {
+		const nextRow = withoutOrphanTableRowMarkers(row, validCommentIds);
+		if (nextRow !== row) changed = true;
+		rows.push(nextRow);
+	}
+	if (!changed) return table;
+	return {
+		...table,
+		rows
+	};
+};
+const withoutOrphanTableRowMarkers = (row, validCommentIds) => {
+	let changed = false;
+	const cells = [];
+	for (const cell of row.cells) {
+		const nextCell = withoutOrphanTableCellMarkers(cell, validCommentIds);
+		if (nextCell !== cell) changed = true;
+		cells.push(nextCell);
+	}
+	if (!changed) return row;
+	return {
+		...row,
+		cells
+	};
+};
+const withoutOrphanTableCellMarkers = (cell, validCommentIds) => {
+	const content = withoutOrphanTableCellBlockMarkers(cell.content, validCommentIds);
+	if (!content) return cell;
+	return {
+		...cell,
+		content
+	};
+};
+const withoutOrphanTableCellBlockMarkers = (blocks, validCommentIds) => {
+	let changed = false;
+	const next = [];
+	for (const block of blocks) {
+		const nextBlock = withoutOrphanTableCellBlockMarker(block, validCommentIds);
+		if (nextBlock !== block) changed = true;
+		next.push(nextBlock);
+	}
+	return changed ? next : null;
+};
+const withoutOrphanTableCellBlockMarker = (block, validCommentIds) => {
+	if (block.type === "paragraph") return withoutOrphanParagraphMarkers(block, validCommentIds);
+	if (block.type === "table") return withoutOrphanTableMarkers(block, validCommentIds);
+	return block;
+};
+const withoutOrphanParagraphMarkers = (paragraph, validCommentIds) => {
+	let changed = false;
+	const content = [];
+	for (const item of paragraph.content) {
+		if (isCommentMarker(item) && !validCommentIds.has(item.id)) {
+			changed = true;
+			continue;
+		}
+		content.push(item);
+	}
+	if (!changed) return paragraph;
+	return {
+		...paragraph,
+		content
+	};
+};
+const isCommentMarker = (content) => content.type === "commentRangeStart" || content.type === "commentRangeEnd" || content.type === "commentReference";
+//#endregion
+export { withoutOrphanCommentRanges };

package/dist/docx/conformance.js

@@ -4,11 +4,65 @@ import { DOCX_CONFORMANCE_CLASSES } from "@stll/docx-core/model";
 const STRICT_MAIN_NAMESPACE = "http://purl.oclc.org/ooxml/wordprocessingml/main";
 const TRANSITIONAL_MAIN_NAMESPACE = "http://schemas.openxmlformats.org/wordprocessingml/2006/main";
 const ROOT_START_TAG_SCAN_LIMIT = 64 * 1024;
-const ROOT_START_TAG_PATTERN = /^(?:\uFEFF|\s|<\?[\s\S]*?\?>|<!--[\s\S]*?-->)*(?<tag><[^\s/>]+(?:[^>"']|"[^"]*"|'[^']*')*>)/u;
+const XML_WHITESPACE = /\s/u;
+/**
+* Find the root start tag within a bounded prefix of `document.xml`,
+* without backtracking.
+*
+* Equivalent in captured-tag semantics to the previous
+* `/^(?:\uFEFF|\s|<\?[\s\S]*?\?>|<!--[\s\S]*?-->)*(?<tag><[^\s/>]+(?:[^>"']|"[^"]*"|'[^']*')*>)/u`
+* pattern, but as a linear hand-rolled scanner: the original alternation of
+* greedy/lazy `[\s\S]*?` spans over an attacker-controlled prefix was
+* susceptible to catastrophic backtracking on crafted input. This walks
+* `scanTarget` once, tracking in-quote state, and returns `undefined` in
+* every case the regex would have failed to match (unterminated PI/comment,
+* no tag found before the scan limit, malformed tag open).
+*/
+function scanRootStartTag(scanTarget) {
+	const length = scanTarget.length;
+	let index = 0;
+	for (;;) {
+		if (index >= length) return;
+		const character = scanTarget[index];
+		if (character === "" || XML_WHITESPACE.test(character ?? "")) {
+			index += 1;
+			continue;
+		}
+		if (scanTarget.startsWith("<?", index)) {
+			const closeIndex = scanTarget.indexOf("?>", index + 2);
+			if (closeIndex === -1) return;
+			index = closeIndex + 2;
+			continue;
+		}
+		if (scanTarget.startsWith("<!--", index)) {
+			const closeIndex = scanTarget.indexOf("-->", index + 4);
+			if (closeIndex === -1) return;
+			index = closeIndex + 3;
+			continue;
+		}
+		break;
+	}
+	if (scanTarget[index] !== "<") return;
+	const nameStart = index + 1;
+	const firstNameChar = scanTarget[nameStart];
+	if (firstNameChar === void 0 || firstNameChar === "/" || firstNameChar === ">" || XML_WHITESPACE.test(firstNameChar)) return;
+	let quote;
+	for (let cursor = nameStart; cursor < length; cursor++) {
+		const character = scanTarget[cursor];
+		if (quote) {
+			if (character === quote) quote = void 0;
+			continue;
+		}
+		if (character === "\"" || character === "'") {
+			quote = character;
+			continue;
+		}
+		if (character === ">") return scanTarget.slice(index, cursor + 1);
+	}
+}
 const detectDocxConformanceClass = (documentXml) => {
 	if (documentXml === null) return DOCX_CONFORMANCE_CLASSES.UNKNOWN;
-	const scanTarget = documentXml.length <= ROOT_START_TAG_SCAN_LIMIT ? documentXml : documentXml.slice(0, ROOT_START_TAG_SCAN_LIMIT);
-	const rootStartTag = ROOT_START_TAG_PATTERN.exec(scanTarget)?.groups?.["tag"];
+	const rootStartTag = scanRootStartTag(documentXml.length <= ROOT_START_TAG_SCAN_LIMIT ? documentXml : documentXml.slice(0, ROOT_START_TAG_SCAN_LIMIT));
 	const root = (rootStartTag === void 0 ? null : parseXmlDocument(rootStartTag.endsWith("/>") ? rootStartTag : `${rootStartTag.slice(0, -1)}/>`)) ?? parseXmlDocument(documentXml);
 	return detectDocxConformanceClassFromRoot(root);
 };

package/dist/docx/encryption/agileDecryption.js

@@ -1,5 +1,6 @@
 import { DOCX_ENCRYPTION_ERROR_CODES, DocxEncryptionError } from "./errors.js";
 import { bytesEqual, joinBytes, padToBlock, passwordToUtf16Le, toArrayBuffer, writeUint32Le } from "./cryptoBytes.js";
+import { MAX_SPIN_COUNT } from "./encryptionInfo.js";
 //#region src/docx/encryption/agileDecryption.ts
 /**
 * Agile Encryption decryption (Office 2010+) using Web Crypto.
@@ -115,11 +116,20 @@ const decryptAesCbc = async (rawKey, iv, ciphertext) => {
 	}, key, toArrayBuffer(paddedCiphertext));
 	return new Uint8Array(decrypted).subarray(0, ciphertext.length);
 };
-/** [MS-OFFCRYPTO] 2.3.4.9 — iterated hash of password + salt. */
+/**
+* [MS-OFFCRYPTO] 2.3.4.9 — iterated hash of password + salt.
+*
+* `iterations` is expected to already be validated by
+* `encryptionInfo.ts`'s `spinCount` parsing, but this loop drives real
+* WebCrypto work per iteration, so it is clamped again here as well —
+* this function must stay safe to call with an untrusted iteration count
+* regardless of caller.
+*/
 const hashPassword = async (password, salt, iterations, hashName) => {
 	const algorithm = webHashName(hashName);
+	const boundedIterations = Math.min(Math.max(iterations, 0), MAX_SPIN_COUNT);
 	let state = await digest(algorithm, joinBytes([salt, passwordToUtf16Le(password)]));
-	for (let i = 0; i < iterations; i++) state = await digest(algorithm, joinBytes([writeUint32Le(i), state]));
+	for (let i = 0; i < boundedIterations; i++) state = await digest(algorithm, joinBytes([writeUint32Le(i), state]));
 	return state;
 };
 /** [MS-OFFCRYPTO] 2.3.4.9 — finalize a derived key with a block key suffix. */

package/dist/docx/encryption/compoundFile.js

@@ -83,9 +83,14 @@ const loadSector = (file, header, sectorId) => {
 };
 const loadFatSectorIds = (file, header) => {
 	const ids = [...header.headerDifat];
+	const maxDifatSectors = Math.ceil(file.length / header.sectorBytes);
+	const stepLimit = Math.min(header.difatSectorCount, maxDifatSectors);
+	const seen = /* @__PURE__ */ new Set();
 	let chain = header.difatStart;
-	for (let step = 0; step < header.difatSectorCount; step++) {
+	for (let step = 0; step < stepLimit; step++) {
 		if (chain === SECTOR_END || chain === SECTOR_FREE) break;
+		if (seen.has(chain)) throw new Error(`DIFAT chain loop at sector ${chain}`);
+		seen.add(chain);
 		const sector = loadSector(file, header, chain);
 		const view = viewOf(sector);
 		const slotsPerSector = header.sectorBytes / 4 - 1;

package/dist/docx/encryption/encryptionInfo.d.ts

@@ -27,6 +27,14 @@ type AgileEncryptionDescriptor = {
   scheme: "agile";
   material: AgileKeyMaterial;
 };
+/**
+ * Cap on `encryptedKey/@spinCount`. MS-OFFCRYPTO's documented default is
+ * 100,000; a hostile/corrupt value here would drive `hashPassword`'s
+ * per-iteration WebCrypto digest loop (agileDecryption.ts) an
+ * attacker-chosen number of times, so reject anything past a generous
+ * multiple of that default instead of trusting the file.
+ */
+declare const MAX_SPIN_COUNT = 200000;
 declare const parseAgileEncryptionInfo: (stream: Uint8Array) => AgileEncryptionDescriptor;
 //#endregion
-export { AgileEncryptionDescriptor, AgileKeyMaterial, parseAgileEncryptionInfo };
+export { AgileEncryptionDescriptor, AgileKeyMaterial, MAX_SPIN_COUNT, parseAgileEncryptionInfo };

package/dist/docx/encryption/encryptionInfo.js

@@ -68,6 +68,22 @@ const requireInt = (attrs, name, element) => {
 	return parsed;
 };
 const requireBase64 = (attrs, name, element) => decodeBase64(requireAttr(attrs, name, element));
+/**
+* Cap on `encryptedKey/@spinCount`. MS-OFFCRYPTO's documented default is
+* 100,000; a hostile/corrupt value here would drive `hashPassword`'s
+* per-iteration WebCrypto digest loop (agileDecryption.ts) an
+* attacker-chosen number of times, so reject anything past a generous
+* multiple of that default instead of trusting the file.
+*/
+const MAX_SPIN_COUNT = 2e5;
+const requireSpinCount = (attrs, element) => {
+	const spinCount = requireInt(attrs, "spinCount", element);
+	if (spinCount < 0 || spinCount > 2e5) throw new DocxEncryptionError({
+		code: DOCX_ENCRYPTION_ERROR_CODES.DECRYPTION_FAILED,
+		message: `EncryptionInfo <${element}> attribute "spinCount" out of range: ${spinCount}`
+	});
+	return spinCount;
+};
 const parseAgileXml = (xmlBytes) => {
 	const xml = new TextDecoder("utf-8").decode(xmlBytes);
 	const keyDataTag = findElement(xml, "keyData");
@@ -88,7 +104,7 @@ const parseAgileXml = (xmlBytes) => {
 		cipherBlockBytes: requireInt(keyData, "blockSize", "keyData"),
 		cipherName: requireAttr(keyData, "cipherAlgorithm", "keyData"),
 		cipherMode: requireAttr(keyData, "cipherChaining", "keyData"),
-		passwordIterations: requireInt(encryptedKey, "spinCount", "encryptedKey"),
+		passwordIterations: requireSpinCount(encryptedKey, "encryptedKey"),
 		passwordSalt: requireBase64(encryptedKey, "saltValue", "encryptedKey"),
 		passwordHash: requireAttr(encryptedKey, "hashAlgorithm", "encryptedKey"),
 		passwordKeyBits: requireInt(encryptedKey, "keyBits", "encryptedKey"),
@@ -125,4 +141,4 @@ const parseAgileEncryptionInfo = (stream) => {
 	});
 };
 //#endregion
-export { parseAgileEncryptionInfo };
+export { MAX_SPIN_COUNT, parseAgileEncryptionInfo };

package/dist/docx/encryption/openEncryptedDocx.js

@@ -1,9 +1,9 @@
 import { DOCX_ENCRYPTION_ERROR_CODES, DocxEncryptionError } from "./errors.js";
 import { toArrayBuffer } from "./cryptoBytes.js";
+import { parseAgileEncryptionInfo } from "./encryptionInfo.js";
 import { decryptAgileEncryptedPackage } from "./agileDecryption.js";
 import { readEncryptedPackageStreams } from "./compoundFile.js";
 import { DOCX_CONTAINER_TYPES, detectDocxContainerType } from "./containerFormat.js";
-import { parseAgileEncryptionInfo } from "./encryptionInfo.js";
 //#region src/docx/encryption/openEncryptedDocx.ts
 /**
 * Decrypt password-protected OOXML before ZIP extraction.