@stll/folio-core 0.12.0 → 0.14.0

package/dist/docx/serializer/paragraphSerializer.js

@@ -1,9 +1,11 @@
 import { numPrEqual } from "../numberingParser.js";
-import { escapeXml, intAttr } from "./xmlUtils.js";
+import { isValidHexColor } from "../../utils/colorResolver.js";
+import { escapeXml, intAttr, isSingleWellFormedElement } from "./xmlUtils.js";
 import { reconcileRawSdtPr } from "../sdtPropertiesPatch.js";
 import { serializeBorder } from "./borderSerializer.js";
 import { serializeRun, serializeTextFormatting } from "./runSerializer.js";
 import { serializeSectionProperties } from "./sectionPropertiesSerializer.js";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/paragraphSerializer.ts
 /**
 * Serialize paragraph borders (w:pBdr)
@@ -44,15 +46,15 @@ function serializeParagraphBorders(borders) {
 function serializeShading(shading) {
 	if (!shading) return "";
 	const attrs = [];
-	if (shading.pattern) attrs.push(`w:val="${shading.pattern}"`);
+	if (shading.pattern) attrs.push(`w:val="${escapeXml(shading.pattern)}"`);
 	else attrs.push("w:val=\"clear\"");
-	if (shading.color?.rgb) attrs.push(`w:color="${shading.color.rgb}"`);
+	if (shading.color?.rgb && isValidHexColor(shading.color.rgb)) attrs.push(`w:color="${escapeXml(shading.color.rgb)}"`);
 	else if (shading.color?.auto) attrs.push("w:color=\"auto\"");
-	if (shading.fill?.rgb) attrs.push(`w:fill="${shading.fill.rgb}"`);
+	if (shading.fill?.rgb && isValidHexColor(shading.fill.rgb)) attrs.push(`w:fill="${escapeXml(shading.fill.rgb)}"`);
 	else if (shading.fill?.auto) attrs.push("w:fill=\"auto\"");
-	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${shading.fill.themeColor}"`);
-	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${shading.fill.themeTint}"`);
-	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${shading.fill.themeShade}"`);
+	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${escapeXml(shading.fill.themeColor)}"`);
+	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${escapeXml(shading.fill.themeTint)}"`);
+	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${escapeXml(shading.fill.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:shd ${attrs.join(" ")}/>`;
 }
@@ -132,7 +134,7 @@ function serializeFrameProperties(frame) {
 * Serialize paragraph formatting properties to w:pPr XML
 */
 function serializeTrackedChangeAttrs(info) {
-	const parts = [`w:id="${info.id}"`, `w:author="${escapeXml(info.author)}"`];
+	const parts = [`w:id="${normalizeRevisionId(info.id)}"`, `w:author="${escapeXml(info.author)}"`];
 	if (info.date !== void 0) parts.push(`w:date="${escapeXml(info.date)}"`);
 	return parts.join(" ");
 }
@@ -198,7 +200,7 @@ function extractRPrInner(rPrXml) {
 	return rPrXml.slice(7, -8);
 }
 function serializeParagraphPropertyChange(change) {
-	const normalizedId = Number.isInteger(change.info.id) && change.info.id >= 0 ? change.info.id : 0;
+	const normalizedId = normalizeRevisionId(change.info.id);
 	const authorCandidate = typeof change.info.author === "string" ? change.info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof change.info.date === "string" ? change.info.date.trim() : void 0;
@@ -361,13 +363,13 @@ function serializeInlineSdt(sdt) {
 			default: return item;
 		}
 	}).join("");
-	const baseSdtPr = props.rawPropertiesXml ?? synthesizeInlineSdtPr(props);
+	const baseSdtPr = props.rawPropertiesXml && isSingleWellFormedElement(props.rawPropertiesXml, "sdtPr") ? props.rawPropertiesXml : synthesizeInlineSdtPr(props);
 	const dateFullDate = props.sdtType === "date" && props.dateValueISO ? props.dateValueISO : void 0;
 	const dropdownLastValue = (props.sdtType === "dropdown" || props.sdtType === "comboBox") && typeof props.dropdownLastValue === "string" ? props.dropdownLastValue : void 0;
 	return `<w:sdt>${reconcileRawSdtPr(baseSdtPr, props, {
 		...dateFullDate !== void 0 ? { dateFullDate } : {},
 		...dropdownLastValue !== void 0 ? { dropdownLastValue } : {}
-	})}${props.rawEndPropertiesXml ?? ""}<w:sdtContent>${contentXml}</w:sdtContent></w:sdt>`;
+	})}${props.rawEndPropertiesXml && isSingleWellFormedElement(props.rawEndPropertiesXml, "sdtEndPr") ? props.rawEndPropertiesXml : ""}<w:sdtContent>${contentXml}</w:sdtContent></w:sdt>`;
 }
 function serializeMoveRangeStart(tag, marker) {
 	return `<w:${tag} ${[`w:id="${marker.id}"`, `w:name="${escapeXml(marker.name)}"`].join(" ")}/>`;
@@ -380,7 +382,7 @@ function rewriteRunTextAsDeleted(xml) {
 }
 function serializeTrackedChange(tag, change) {
 	const info = change.info;
-	const normalizedId = Number.isInteger(info.id) && info.id >= 0 ? info.id : 0;
+	const normalizedId = normalizeRevisionId(info.id);
 	const authorCandidate = typeof info.author === "string" ? info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof info.date === "string" ? info.date.trim() : void 0;
@@ -455,8 +457,8 @@ function serializeParagraphContent(content, explicitCommentReferenceIds) {
 function serializeParagraph(paragraph) {
 	const parts = [];
 	const attrs = [];
-	if (paragraph.paraId) attrs.push(`w14:paraId="${paragraph.paraId}"`);
-	if (paragraph.textId) attrs.push(`w14:textId="${paragraph.textId}"`);
+	if (paragraph.paraId) attrs.push(`w14:paraId="${escapeXml(paragraph.paraId)}"`);
+	if (paragraph.textId) attrs.push(`w14:textId="${escapeXml(paragraph.textId)}"`);
 	const attrsStr = attrs.length > 0 ? ` ${attrs.join(" ")}` : "";
 	const pPrXml = serializeParagraphFormatting(paragraph.formatting, paragraph.propertyChanges, paragraph.pPrMark);
 	const sectionPropertiesXml = serializeSectionProperties(paragraph.sectionProperties);

package/dist/docx/serializer/runSerializer.js

@@ -1,8 +1,10 @@
 import { HIGHLIGHT_COLOR_VALUES } from "../../types/documentEnumValues.js";
+import { isValidHexColor } from "../../utils/colorResolver.js";
 import { escapeXml, intAttr } from "./xmlUtils.js";
 import { serializeTable } from "./tableSerializer.js";
 import { serializeParagraph } from "./paragraphSerializer.js";
 import { panic } from "better-result";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/runSerializer.ts
 /**
 * Run Serializer - Serialize runs to OOXML XML
@@ -42,10 +44,10 @@ function serializeColorElement(color) {
 	if (!color) return "";
 	const attrs = [];
 	if (color.auto) attrs.push("w:val=\"auto\"");
-	else if (color.rgb) attrs.push(`w:val="${color.rgb}"`);
-	if (color.themeColor) attrs.push(`w:themeColor="${color.themeColor}"`);
-	if (color.themeTint) attrs.push(`w:themeTint="${color.themeTint}"`);
-	if (color.themeShade) attrs.push(`w:themeShade="${color.themeShade}"`);
+	else if (color.rgb && isValidHexColor(color.rgb)) attrs.push(`w:val="${escapeXml(color.rgb)}"`);
+	if (color.themeColor) attrs.push(`w:themeColor="${escapeXml(color.themeColor)}"`);
+	if (color.themeTint) attrs.push(`w:themeTint="${escapeXml(color.themeTint)}"`);
+	if (color.themeShade) attrs.push(`w:themeShade="${escapeXml(color.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:color ${attrs.join(" ")}/>`;
 }
@@ -55,15 +57,15 @@ function serializeColorElement(color) {
 function serializeShading(shading) {
 	if (!shading) return "";
 	const attrs = [];
-	if (shading.pattern) attrs.push(`w:val="${shading.pattern}"`);
+	if (shading.pattern) attrs.push(`w:val="${escapeXml(shading.pattern)}"`);
 	else attrs.push("w:val=\"clear\"");
-	if (shading.color?.rgb) attrs.push(`w:color="${shading.color.rgb}"`);
+	if (shading.color?.rgb && isValidHexColor(shading.color.rgb)) attrs.push(`w:color="${escapeXml(shading.color.rgb)}"`);
 	else if (shading.color?.auto) attrs.push("w:color=\"auto\"");
-	if (shading.fill?.rgb) attrs.push(`w:fill="${shading.fill.rgb}"`);
+	if (shading.fill?.rgb && isValidHexColor(shading.fill.rgb)) attrs.push(`w:fill="${escapeXml(shading.fill.rgb)}"`);
 	else if (shading.fill?.auto) attrs.push("w:fill=\"auto\"");
-	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${shading.fill.themeColor}"`);
-	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${shading.fill.themeTint}"`);
-	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${shading.fill.themeShade}"`);
+	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${escapeXml(shading.fill.themeColor)}"`);
+	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${escapeXml(shading.fill.themeTint)}"`);
+	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${escapeXml(shading.fill.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:shd ${attrs.join(" ")}/>`;
 }
@@ -137,10 +139,10 @@ function serializeTextFormatting(formatting) {
 	if (formatting.underline) {
 		const uAttrs = [`w:val="${formatting.underline.style}"`];
 		if (formatting.underline.color) {
-			if (formatting.underline.color.rgb) uAttrs.push(`w:color="${formatting.underline.color.rgb}"`);
-			if (formatting.underline.color.themeColor) uAttrs.push(`w:themeColor="${formatting.underline.color.themeColor}"`);
-			if (formatting.underline.color.themeTint) uAttrs.push(`w:themeTint="${formatting.underline.color.themeTint}"`);
-			if (formatting.underline.color.themeShade) uAttrs.push(`w:themeShade="${formatting.underline.color.themeShade}"`);
+			if (formatting.underline.color.rgb && isValidHexColor(formatting.underline.color.rgb)) uAttrs.push(`w:color="${escapeXml(formatting.underline.color.rgb)}"`);
+			if (formatting.underline.color.themeColor) uAttrs.push(`w:themeColor="${escapeXml(formatting.underline.color.themeColor)}"`);
+			if (formatting.underline.color.themeTint) uAttrs.push(`w:themeTint="${escapeXml(formatting.underline.color.themeTint)}"`);
+			if (formatting.underline.color.themeShade) uAttrs.push(`w:themeShade="${escapeXml(formatting.underline.color.themeShade)}"`);
 		}
 		parts.push(`<w:u ${uAttrs.join(" ")}/>`);
 	}
@@ -160,7 +162,7 @@ function extractRPrInner(rPrXml) {
 	return rPrXml.slice(7, -8);
 }
 function serializeRunPropertyChange(change) {
-	const normalizedId = Number.isInteger(change.info.id) && change.info.id >= 0 ? change.info.id : 0;
+	const normalizedId = normalizeRevisionId(change.info.id);
 	const authorCandidate = typeof change.info.author === "string" ? change.info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof change.info.date === "string" ? change.info.date.trim() : void 0;
@@ -246,11 +248,11 @@ function serializeNoBreakHyphen(_content) {
 /** Serialize a color value to DrawingML a:srgbClr or a:schemeClr */
 function serializeDrawingColor(color) {
 	if (!color) return "";
-	if (color.rgb) return `<a:srgbClr val="${color.rgb.replace("#", "")}"/>`;
+	if (color.rgb && isValidHexColor(color.rgb)) return `<a:srgbClr val="${escapeXml(color.rgb.replace("#", ""))}"/>`;
 	if (color.themeColor) {
-		let clr = `<a:schemeClr val="${color.themeColor}"`;
-		if (color.themeTint) clr += `><a:tint val="${color.themeTint}"/></a:schemeClr>`;
-		else if (color.themeShade) clr += `><a:shade val="${color.themeShade}"/></a:schemeClr>`;
+		let clr = `<a:schemeClr val="${escapeXml(color.themeColor)}"`;
+		if (color.themeTint) clr += `><a:tint val="${escapeXml(color.themeTint)}"/></a:schemeClr>`;
+		else if (color.themeShade) clr += `><a:shade val="${escapeXml(color.themeShade)}"/></a:schemeClr>`;
 		else clr += `/>`;
 		return clr;
 	}

package/dist/docx/serializer/sectionPropertiesSerializer.js

@@ -1,6 +1,7 @@
 import { getUnserializedSectionPropertyChildNames } from "../sectionParser.js";
 import { escapeXml, intAttr } from "./xmlUtils.js";
 import { serializeBorder } from "./borderSerializer.js";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/sectionPropertiesSerializer.ts
 const serializeHeaderReference = (ref) => `<w:headerReference w:type="${ref.type}" r:id="${ref.rId}"/>`;
 const serializeFooterReference = (ref) => `<w:footerReference w:type="${ref.type}" r:id="${ref.rId}"/>`;
@@ -132,7 +133,7 @@ function serializeOnOffElement(value, name) {
 	return value ? `<w:${name}/>` : `<w:${name} w:val="0"/>`;
 }
 function serializeSectionPropertyChange(change) {
-	const normalizedId = Number.isInteger(change.info.id) && change.info.id >= 0 ? change.info.id : 0;
+	const normalizedId = normalizeRevisionId(change.info.id);
 	const authorCandidate = typeof change.info.author === "string" ? change.info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof change.info.date === "string" ? change.info.date.trim() : void 0;

package/dist/docx/serializer/tableSerializer.js

@@ -1,8 +1,10 @@
+import { isValidHexColor } from "../../utils/colorResolver.js";
 import { escapeXml, intAttr } from "./xmlUtils.js";
 import { serializeBorder } from "./borderSerializer.js";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/tableSerializer.ts
 function normalizeTrackedChangeInfo(info) {
-	const normalizedId = Number.isInteger(info.id) && info.id >= 0 ? info.id : 0;
+	const normalizedId = normalizeRevisionId(info.id);
 	const authorCandidate = typeof info.author === "string" ? info.author.trim() : "";
 	const normalizedAuthor = authorCandidate.length > 0 ? authorCandidate : "Unknown";
 	const normalizedDate = typeof info.date === "string" ? info.date.trim() : void 0;
@@ -77,15 +79,15 @@ function serializeCellMargins(margins, elementName) {
 function serializeShading(shading) {
 	if (!shading) return "";
 	const attrs = [];
-	if (shading.pattern) attrs.push(`w:val="${shading.pattern}"`);
+	if (shading.pattern) attrs.push(`w:val="${escapeXml(shading.pattern)}"`);
 	else attrs.push("w:val=\"clear\"");
-	if (shading.color?.rgb) attrs.push(`w:color="${shading.color.rgb}"`);
+	if (shading.color?.rgb && isValidHexColor(shading.color.rgb)) attrs.push(`w:color="${escapeXml(shading.color.rgb)}"`);
 	else if (shading.color?.auto) attrs.push("w:color=\"auto\"");
-	if (shading.fill?.rgb) attrs.push(`w:fill="${shading.fill.rgb}"`);
+	if (shading.fill?.rgb && isValidHexColor(shading.fill.rgb)) attrs.push(`w:fill="${escapeXml(shading.fill.rgb)}"`);
 	else if (shading.fill?.auto) attrs.push("w:fill=\"auto\"");
-	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${shading.fill.themeColor}"`);
-	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${shading.fill.themeTint}"`);
-	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${shading.fill.themeShade}"`);
+	if (shading.fill?.themeColor) attrs.push(`w:themeFill="${escapeXml(shading.fill.themeColor)}"`);
+	if (shading.fill?.themeTint) attrs.push(`w:themeFillTint="${escapeXml(shading.fill.themeTint)}"`);
+	if (shading.fill?.themeShade) attrs.push(`w:themeFillShade="${escapeXml(shading.fill.themeShade)}"`);
 	if (attrs.length === 0) return "";
 	return `<w:shd ${attrs.join(" ")}/>`;
 }

package/dist/docx/serializer/xmlUtils.d.ts

@@ -16,5 +16,17 @@ declare function escapeXml(text: string): string;
  * literal `"NaN"` or `"Infinity"` into the XML.
  */
 declare function intAttr(value: number | undefined | null): string;
+/**
+ * Verify that `xml` parses to exactly one root element named `expectedLocalName`
+ * (namespace prefix ignored). Used to gate raw XML snapshots — e.g. an SDT's
+ * `rawPropertiesXml`/`rawEndPropertiesXml` — before splicing them verbatim
+ * into a serialized document. Those snapshots are normally produced by our
+ * own parser, but they can also arrive from an untrusted surface (a
+ * programmatically constructed node, a collaboration payload); a value that
+ * is not a single well-formed `<w:sdtPr>`/`<w:sdtEndPr>` element could inject
+ * sibling markup or close the enclosing `<w:sdt>` early. Callers should fall
+ * back to a synthesized properties block when this returns `false`.
+ */
+declare function isSingleWellFormedElement(xml: string, expectedLocalName: string): boolean;
 //#endregion
-export { escapeXml, intAttr };
+export { escapeXml, intAttr, isSingleWellFormedElement };

package/dist/docx/serializer/xmlUtils.js

@@ -1,3 +1,4 @@
+import { getLocalName, parseXml } from "../xmlParser.js";
 //#region src/docx/serializer/xmlUtils.ts
 /**
 * Shared XML utility functions for serializers.
@@ -21,5 +22,30 @@ function intAttr(value) {
 	if (value == null || !Number.isFinite(value)) return "0";
 	return String(Math.round(value));
 }
+/**
+* Verify that `xml` parses to exactly one root element named `expectedLocalName`
+* (namespace prefix ignored). Used to gate raw XML snapshots — e.g. an SDT's
+* `rawPropertiesXml`/`rawEndPropertiesXml` — before splicing them verbatim
+* into a serialized document. Those snapshots are normally produced by our
+* own parser, but they can also arrive from an untrusted surface (a
+* programmatically constructed node, a collaboration payload); a value that
+* is not a single well-formed `<w:sdtPr>`/`<w:sdtEndPr>` element could inject
+* sibling markup or close the enclosing `<w:sdt>` early. Callers should fall
+* back to a synthesized properties block when this returns `false`.
+*/
+function isSingleWellFormedElement(xml, expectedLocalName) {
+	const trimmed = xml.trim();
+	if (!trimmed) return false;
+	let parsed;
+	try {
+		parsed = parseXml(trimmed);
+	} catch {
+		return false;
+	}
+	const roots = (parsed.elements ?? []).filter((element) => element.type === "element");
+	if (roots.length !== 1) return false;
+	const root = roots[0];
+	return root?.name !== void 0 && getLocalName(root.name) === expectedLocalName;
+}
 //#endregion
-export { escapeXml, intAttr };
+export { escapeXml, intAttr, isSingleWellFormedElement };

package/dist/docx/server/docxToMarkdown.d.ts

@@ -0,0 +1,15 @@
+import { MarkdownOptions } from "../../markdown/types.js";
+
+//#region src/docx/server/docxToMarkdown.d.ts
+/**
+ * Convert a DOCX file to markdown in a single server-safe call.
+ *
+ * Composes {@link parseDocx} (bytes -> Document, with font preloading disabled
+ * so it never touches the DOM) and {@link toMarkdown} (Document -> markdown).
+ * This gives non-browser callers folio's full DOCX fidelity — headings,
+ * tables, lists, and content controls (`w:sdt`) at every position — without
+ * deep-importing internal subpaths or re-implementing an OOXML walker.
+ */
+declare function docxToMarkdown(input: ArrayBuffer | Uint8Array, opts?: MarkdownOptions): Promise<string>;
+//#endregion
+export { docxToMarkdown };

package/dist/docx/server/docxToMarkdown.js

@@ -0,0 +1,17 @@
+import { parseDocx } from "../parser.js";
+import { toMarkdown } from "../../markdown/index.js";
+//#region src/docx/server/docxToMarkdown.ts
+/**
+* Convert a DOCX file to markdown in a single server-safe call.
+*
+* Composes {@link parseDocx} (bytes -> Document, with font preloading disabled
+* so it never touches the DOM) and {@link toMarkdown} (Document -> markdown).
+* This gives non-browser callers folio's full DOCX fidelity — headings,
+* tables, lists, and content controls (`w:sdt`) at every position — without
+* deep-importing internal subpaths or re-implementing an OOXML walker.
+*/
+async function docxToMarkdown(input, opts) {
+	return toMarkdown(await parseDocx(input, { preloadFonts: false }), opts);
+}
+//#endregion
+export { docxToMarkdown };

package/dist/docx/server/extractDocxText.js

@@ -1,7 +1,8 @@
-import { findAllDeep, findChild, findDeep, getAttributeAnyPrefix, getLocalName, getTextContent, parseXml } from "../xmlParser.js";
+import { findAllDeep, findChild, findDeep, getAttribute, getAttributeAnyPrefix, getLocalName, getTextContent, parseXml } from "../xmlParser.js";
+import { RELATIONSHIP_TYPES, parseRelationships } from "../relsParser.js";
 import { loadDocxArchive } from "./boundedArchive.js";
 //#region src/docx/server/extractDocxText.ts
-const HEADER_FOOTER_PATH = /^word\/(?:header|footer)\d+\.xml$/u;
+const DOCUMENT_RELS_PATH = "word/_rels/document.xml.rels";
 const childElements = (element) => element.elements?.filter((child) => child.type === "element") ?? [];
 const collectText = (element) => {
 	let text = "";
@@ -86,12 +87,10 @@ const extractContainer = ({ container, source, startIndex }) => {
 		charCount
 	};
 };
-const extractParts = async ({ archive, source, rootName, startIndex }) => {
+const extractParts = async ({ archive, source, rootName, startIndex, paths }) => {
 	const paragraphs = [];
 	let charCount = 0;
 	let nextIndex = startIndex;
-	const prefix = `word/${source}`;
-	const paths = archive.entries.filter((path) => HEADER_FOOTER_PATH.test(path) && path.startsWith(prefix)).toSorted();
 	for (const path of paths) {
 		const xml = await archive.readEntryString(path);
 		if (xml === null) continue;
@@ -111,6 +110,50 @@ const extractParts = async ({ archive, source, rootName, startIndex }) => {
 		charCount
 	};
 };
+/** A `word/_rels/document.xml.rels` `Target` is relative to `word/`; resolve it to a full archive-entry path. */
+const resolveWordPartPath = (target) => target.startsWith("/") ? target.slice(1) : `word/${target}`;
+/**
+* Resolve the header/footer parts actually wired into the document via
+* `word/_rels/document.xml.rels` + each section's `w:headerReference` /
+* `w:footerReference`, instead of extracting every `word/header*.xml` /
+* `word/footer*.xml` entry by filename. A DOCX can carry an orphaned
+* header/footer part (stale, or planted by an attacker) that no section
+* references — reading it unconditionally would surface prompt-injection or
+* stale content that Word itself never renders.
+*/
+const resolveReferencedHeaderFooterParts = async (archive, documentRoot) => {
+	const relsXml = await archive.readEntryString(DOCUMENT_RELS_PATH);
+	if (relsXml === null) return {
+		headers: [],
+		footers: []
+	};
+	const relationships = parseRelationships(relsXml);
+	const headerRIds = /* @__PURE__ */ new Set();
+	const footerRIds = /* @__PURE__ */ new Set();
+	for (const sectPr of findAllDeep(documentRoot, "w", "sectPr")) {
+		for (const ref of findAllDeep(sectPr, "w", "headerReference")) {
+			const rId = getAttribute(ref, "r", "id");
+			if (rId !== null) headerRIds.add(rId);
+		}
+		for (const ref of findAllDeep(sectPr, "w", "footerReference")) {
+			const rId = getAttribute(ref, "r", "id");
+			if (rId !== null) footerRIds.add(rId);
+		}
+	}
+	const resolvePaths = (rIds, relationshipType) => {
+		const paths = /* @__PURE__ */ new Set();
+		for (const rId of rIds) {
+			const relationship = relationships.get(rId);
+			if (!relationship || relationship.type !== relationshipType || relationship.targetMode === "External") continue;
+			paths.add(resolveWordPartPath(relationship.target));
+		}
+		return [...paths].toSorted();
+	};
+	return {
+		headers: resolvePaths(headerRIds, RELATIONSHIP_TYPES.header),
+		footers: resolvePaths(footerRIds, RELATIONSHIP_TYPES.footer)
+	};
+};
 const createEmptyResult = () => ({
 	paragraphs: [],
 	charCount: 0,
@@ -121,13 +164,16 @@ const extractDocxText = async (bytes) => {
 	const archive = await loadDocxArchive(bytes);
 	const documentXml = await archive.readEntryString("word/document.xml");
 	if (documentXml === null) return createEmptyResult();
-	const body = findDeep(parseXml(documentXml), "w", "body");
+	const root = parseXml(documentXml);
+	const body = findDeep(root, "w", "body");
 	if (!body) return createEmptyResult();
+	const referencedParts = await resolveReferencedHeaderFooterParts(archive, root);
 	const headers = await extractParts({
 		archive,
 		source: "header",
 		rootName: "hdr",
-		startIndex: 0
+		startIndex: 0,
+		paths: referencedParts.headers
 	});
 	const bodyResult = extractContainer({
 		container: body,
@@ -138,7 +184,8 @@ const extractDocxText = async (bytes) => {
 		archive,
 		source: "footer",
 		rootName: "ftr",
-		startIndex: headers.paragraphs.length + bodyResult.paragraphs.length
+		startIndex: headers.paragraphs.length + bodyResult.paragraphs.length,
+		paths: referencedParts.footers
 	});
 	return {
 		paragraphs: [

package/dist/docx/settingsParser.js

@@ -10,6 +10,19 @@ const DEFAULT_TAB_STOP_TWIPS = 720;
 const MAX_TAB_STOP_TWIPS = 31680;
 const MAX_HYPHENATION_ZONE_TWIPS = 31680;
 const MAX_CONSECUTIVE_HYPHEN_LIMIT = 255;
+/**
+* Floor on `w:defaultTabStop`, in twips (1/12 inch). A near-zero value would
+* force the layout engine to generate thousands of tab stops across a
+* single line; below this floor we substitute the OOXML default instead.
+*/
+const MIN_TAB_STOP_TWIPS = 120;
+/**
+* Sanity cap on parsed `w:noLineBreaksBefore`/`w:noLineBreaksAfter`
+* character lists. Typical kinsoku overrides list a handful of prohibited
+* characters; anything past this is corruption or a hostile input crafted
+* to inflate the per-character membership set built at measure time.
+*/
+const MAX_KINSOKU_CHARACTERS_LENGTH = 128;
 function parseSettings(xml) {
 	const root = xml ? parseXmlDocument(xml) : null;
 	const settings = { defaultTabStop: parseDefaultTabStop(root) };
@@ -76,7 +89,7 @@ function parseKinsokuOverride(root, name) {
 	if (!characters) return;
 	const language = getAttribute(element, "w", "lang") || void 0;
 	return {
-		characters,
+		characters: Array.from(characters).slice(0, MAX_KINSOKU_CHARACTERS_LENGTH).join(""),
 		...language ? { language } : {}
 	};
 }
@@ -87,7 +100,7 @@ function parseDefaultTabStop(root) {
 	const raw = getAttribute(el, "w", "val");
 	if (raw === null) return 720;
 	const parsed = Number.parseInt(raw, 10);
-	if (!Number.isFinite(parsed) || parsed <= 0 || parsed > MAX_TAB_STOP_TWIPS) return 720;
+	if (!Number.isFinite(parsed) || parsed < MIN_TAB_STOP_TWIPS || parsed > MAX_TAB_STOP_TWIPS) return 720;
 	return parsed;
 }
 //#endregion

package/dist/docx/tableParser.d.ts

@@ -4,6 +4,13 @@ import { StyleMap } from "./styleParser.js";
 import { XmlElement } from "./xmlParser.js";
 
 //#region src/docx/tableParser.d.ts
+/**
+ * Sanity cap on `w:gridSpan` (and the derived table column count). Word's
+ * practical column limit is 63; a hostile/corrupt value here would blow up
+ * every downstream structure sized by column count (TableMap, border grids,
+ * cell-grid arrays).
+ */
+declare const MAX_TABLE_COLUMNS = 63;
 /**
  * Parse a table measurement (width, height, etc.)
  *
@@ -199,4 +206,4 @@ declare function getHeaderRows(table: document_d_exports.Table): document_d_expo
  */
 declare function isFloatingTable(table: document_d_exports.Table): boolean;
 //#endregion
-export { getHeaderRows, getTableColumnCount, getTableRowCount, getTableText, hasHeaderRow, isCellHorizontallyMerged, isCellMergeContinuation, isCellMergeStart, isFloatingTable, parseBorderSpec, parseCellMargins, parseConditionalFormatStyle, parseFloatingTableProperties, parseShading, parseTable, parseTableBorders, parseTableCell, parseTableCellProperties, parseTableGrid, parseTableLook, parseTableMeasurement, parseTableProperties, parseTableRow, parseTableRowProperties };
+export { MAX_TABLE_COLUMNS, getHeaderRows, getTableColumnCount, getTableRowCount, getTableText, hasHeaderRow, isCellHorizontallyMerged, isCellMergeContinuation, isCellMergeStart, isFloatingTable, parseBorderSpec, parseCellMargins, parseConditionalFormatStyle, parseFloatingTableProperties, parseShading, parseTable, parseTableBorders, parseTableCell, parseTableCellProperties, parseTableGrid, parseTableLook, parseTableMeasurement, parseTableProperties, parseTableRow, parseTableRowProperties };

package/dist/docx/tableParser.js

@@ -4,8 +4,16 @@ import { parseBookmarkEnd, parseBookmarkStart } from "./bookmarkParser.js";
 import { parseParagraph } from "./paragraphParser.js";
 import { appendBookmarkMarkerToLastParagraphInBlocks, appendBookmarkMarkerToLastParagraphInCells, prependBookmarkMarkersToFirstParagraphInBlocks, prependBookmarkMarkersToFirstParagraphInCell } from "./bookmarkPlacement.js";
 import { enrichParagraphTextBoxes } from "./paragraphTextBoxEnrichment.js";
+import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/tableParser.ts
 /**
+* Sanity cap on `w:gridSpan` (and the derived table column count). Word's
+* practical column limit is 63; a hostile/corrupt value here would blow up
+* every downstream structure sized by column count (TableMap, border grids,
+* cell-grid arrays).
+*/
+const MAX_TABLE_COLUMNS = 63;
+/**
 * Parse a table measurement (width, height, etc.)
 *
 * @param element - Element with w:w and w:type attributes
@@ -32,11 +40,13 @@ function parseTrackedChangeInfo(node) {
 	const parsedId = rawId ? Number.parseInt(rawId, 10) : 0;
 	const author = (getAttribute(node, "w", "author") ?? "").trim();
 	const date = (getAttribute(node, "w", "date") ?? "").trim();
+	const initials = (getAttribute(node, "w", "initials") ?? "").trim();
 	const info = {
-		id: Number.isInteger(parsedId) && parsedId >= 0 ? parsedId : 0,
+		id: normalizeRevisionId(parsedId),
 		author: author.length > 0 ? author : "Unknown"
 	};
 	if (date.length > 0) info.date = date;
+	if (initials.length > 0) info.initials = initials;
 	return info;
 }
 function parsePropertyChangeInfo(node) {
@@ -485,7 +495,7 @@ function parseTableCellProperties(tcPrElement) {
 	const gridSpanElement = findChild(tcPrElement, "w", "gridSpan");
 	if (gridSpanElement) {
 		const gridSpan = parseNumericAttribute(gridSpanElement, "w", "val");
-		if (gridSpan !== void 0 && gridSpan > 1) formatting.gridSpan = gridSpan;
+		if (gridSpan !== void 0 && gridSpan > 1) formatting.gridSpan = Math.min(gridSpan, 63);
 	}
 	const vMergeElement = findChild(tcPrElement, "w", "vMerge");
 	if (vMergeElement) if (getAttribute(vMergeElement, "w", "val") === "restart") formatting.vMerge = "restart";
@@ -514,23 +524,34 @@ function parseCellContent(tcElement, styles, theme, numbering, rels, media, opti
 	const content = [];
 	const pendingBookmarkMarkers = [];
 	const elements = getChildElements(tcElement);
-	for (const child of elements) {
-		if (!child.name) continue;
+	const parseCellChild = (child) => {
+		if (!child.name) return;
 		const localName = getLocalName(child.name);
 		if (localName === "p") {
 			const para = parseParagraph(child, styles, theme, numbering, rels, media, options);
 			enrichParagraphTextBoxes(para, child, styles, theme, numbering, rels, media, parseTable);
 			prependPendingBookmarkMarkers(para, pendingBookmarkMarkers);
 			content.push(para);
-		} else if (localName === "tbl") {
+			return;
+		}
+		if (localName === "tbl") {
 			const table = parseTable(child, styles, theme, numbering, rels, media, options);
 			if (prependBookmarkMarkersToFirstParagraphInBlocks([table], pendingBookmarkMarkers)) pendingBookmarkMarkers.length = 0;
 			content.push(table);
-		} else if (localName === "bookmarkStart" || localName === "bookmarkEnd") {
+			return;
+		}
+		if (localName === "sdt") {
+			const sdtContent = findChildByLocalName(child, "sdtContent");
+			if (!sdtContent) return;
+			for (const sdtChild of getChildElements(sdtContent)) parseCellChild(sdtChild);
+			return;
+		}
+		if (localName === "bookmarkStart" || localName === "bookmarkEnd") {
 			const marker = parseBookmarkMarker(child, localName);
 			if (!appendBookmarkMarkerToLastParagraphInBlocks(content, marker)) pendingBookmarkMarkers.push(marker);
 		}
-	}
+	};
+	for (const child of elements) parseCellChild(child);
 	if (content.length === 0) content.push({
 		type: "paragraph",
 		content: [...pendingBookmarkMarkers]
@@ -838,4 +859,4 @@ function isFloatingTable(table) {
 	return table.formatting?.floating !== void 0;
 }
 //#endregion
-export { getHeaderRows, getTableColumnCount, getTableRowCount, getTableText, hasHeaderRow, isCellHorizontallyMerged, isCellMergeContinuation, isCellMergeStart, isFloatingTable, parseBorderSpec, parseCellMargins, parseConditionalFormatStyle, parseFloatingTableProperties, parseShading, parseTable, parseTableBorders, parseTableCell, parseTableCellProperties, parseTableGrid, parseTableLook, parseTableMeasurement, parseTableProperties, parseTableRow, parseTableRowProperties };
+export { MAX_TABLE_COLUMNS, getHeaderRows, getTableColumnCount, getTableRowCount, getTableText, hasHeaderRow, isCellHorizontallyMerged, isCellMergeContinuation, isCellMergeStart, isFloatingTable, parseBorderSpec, parseCellMargins, parseConditionalFormatStyle, parseFloatingTableProperties, parseShading, parseTable, parseTableBorders, parseTableCell, parseTableCellProperties, parseTableGrid, parseTableLook, parseTableMeasurement, parseTableProperties, parseTableRow, parseTableRowProperties };

package/dist/docx/unzip.js

@@ -261,6 +261,7 @@ function isPreservableDocxEntry(path) {
 	if (!isSafeDocxPath(path)) return false;
 	const lowerPath = path.toLowerCase();
 	if (lowerPath.startsWith("word/media/")) return PRESERVABLE_MEDIA_MIME_TYPES.has(getMediaMimeType(path));
+	if (lowerPath.startsWith("docprops/thumbnail.")) return PRESERVABLE_MEDIA_MIME_TYPES.has(getMediaMimeType(path));
 	if (lowerPath.startsWith("word/fonts/")) return true;
 	if (!(lowerPath.endsWith(".xml") || lowerPath.endsWith(".rels"))) return false;
 	return lowerPath === "[content_types].xml" || lowerPath.startsWith("_rels/") || lowerPath.startsWith("docprops/") || lowerPath.startsWith("word/") || lowerPath.startsWith("customxml/");

package/dist/docx/vmlImageParser.js

@@ -1,5 +1,6 @@
 import { cloneWithXmlnsDeclarations, elementToXml, findAllDeep, findChild, getAttribute, getChildElements, getLocalName } from "./xmlParser.js";
 import { pixelsToEmu } from "../utils/units.js";
+import { sanitizeImageSrc } from "../utils/sanitizeImageSrc.js";
 import { resolveImageData } from "./imageParser.js";
 import { isWatermarkShape } from "./watermarkParser.js";
 //#region src/docx/vmlImageParser.ts
@@ -49,16 +50,22 @@ function cssLengthToPx(raw) {
 		default: return;
 	}
 }
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
 /** Read a `style="k1:v1;k2:v2"` attribute into a lowercased key/value record. */
 function parseStyleAttr(style) {
-	const out = {};
+	const out = Object.create(null);
 	if (!style) return out;
 	for (const decl of style.split(";")) {
 		const colon = decl.indexOf(":");
 		if (colon < 0) continue;
 		const key = decl.slice(0, colon).trim().toLowerCase();
 		const value = decl.slice(colon + 1).trim();
-		if (key) out[key] = value;
+		if (!key || PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		out[key] = value;
 	}
 	return out;
 }
@@ -216,7 +223,8 @@ function parseVmlImageContent(pictElement, rels, media, rootXmlns = {}) {
 			},
 			wrap: { type: "inline" }
 		};
-		if (src) image.src = src;
+		const safeSrc = sanitizeImageSrc(src);
+		if (safeSrc) image.src = safeSrc;
 		if (mimeType) image.mimeType = mimeType;
 		if (filename) image.filename = filename;
 		const title = getAttribute(imagedata, "o", "title");