@stll/folio-core 0.27.0 → 0.27.1

package/dist/ai-edits/table-cell-mutations.js

@@ -14,6 +14,7 @@ const mergeTableRectangle = ({ tr, tablePosition, table, rectangle }) => {
 	const tableStart = tablePosition + 1;
 	const seen = /* @__PURE__ */ new Set();
 	const cells = [];
+	const topRowCells = [];
 	let appendedContent = Fragment.empty;
 	for (let row = rectangle.top; row < rectangle.bottom; row++) for (let column = rectangle.left; column < rectangle.right; column++) {
 		const cellPosition = map.map[row * map.width + column];
@@ -25,6 +26,7 @@ const mergeTableRectangle = ({ tr, tablePosition, table, rectangle }) => {
 			position: cellPosition,
 			cell
 		});
+		if (row === rectangle.top) topRowCells.push(cell);
 		if (cells.length > 1 && !isEmptyTableCell(cell)) appendedContent = appendedContent.append(cell.content);
 	}
 	const merged = cells.at(0);
@@ -34,8 +36,8 @@ const mergeTableRectangle = ({ tr, tablePosition, table, rectangle }) => {
 	const colwidth = merged.cell.attrs["colwidth"];
 	if (typeof colspan !== "number" || !Number.isInteger(colspan) || colspan < 1 || typeof rowspan !== "number" || !Number.isInteger(rowspan) || rowspan < 1 || colwidth !== null && colwidth !== void 0 && (!Array.isArray(colwidth) || colwidth.length !== colspan || !colwidth.every((width) => typeof width === "number"))) return null;
 	const mergedColspan = rectangle.right - rectangle.left;
-	const nextColwidth = Array.isArray(colwidth) ? [...colwidth] : null;
-	while (nextColwidth && nextColwidth.length < mergedColspan) nextColwidth.push(0);
+	const nextColwidth = mergeTopRowColwidths(topRowCells, mergedColspan);
+	const preferredWidth = mergeTopRowPreferredWidths(topRowCells);
 	const mapFrom = tr.mapping.maps.length;
 	for (const { position: cellPosition, cell } of cells.slice(1)) {
 		const position = tr.mapping.slice(mapFrom).map(tableStart + cellPosition);
@@ -46,7 +48,9 @@ const mergeTableRectangle = ({ tr, tablePosition, table, rectangle }) => {
 		...merged.cell.attrs,
 		colspan: mergedColspan,
 		rowspan: rectangle.bottom - rectangle.top,
-		colwidth: nextColwidth
+		colwidth: nextColwidth,
+		width: preferredWidth.type === "value" ? preferredWidth.width : null,
+		widthType: preferredWidth.type === "value" ? preferredWidth.widthType : null
 	});
 	if (appendedContent.size > 0) {
 		const contentEnd = absoluteMergedPosition + 1 + merged.cell.content.size;
@@ -55,6 +59,37 @@ const mergeTableRectangle = ({ tr, tablePosition, table, rectangle }) => {
 	}
 	return tr;
 };
+const mergeTopRowColwidths = (cells, mergedColspan) => {
+	const widths = [];
+	for (const cell of cells) {
+		const colspan = cell.attrs["colspan"];
+		const colwidth = cell.attrs["colwidth"];
+		if (typeof colspan !== "number" || !Number.isInteger(colspan) || colspan < 1 || !Array.isArray(colwidth) || colwidth.length !== colspan || !colwidth.every((width) => typeof width === "number" && width > 0)) return null;
+		widths.push(...colwidth);
+	}
+	return widths.length === mergedColspan ? widths : null;
+};
+/** A horizontal merge owns the whole top-row span. Sum compatible explicit
+* preferred widths; retaining only the first cell's width makes a 50%+50%
+* bilingual row serialize as a 50%-wide spanning cell. Mixed/implicit units
+* cannot be composed safely, so clear the preference and let the table grid
+* define the merged width. */
+const mergeTopRowPreferredWidths = (cells) => {
+	let width = 0;
+	let widthType;
+	for (const cell of cells) {
+		const candidateWidth = cell.attrs["width"];
+		const candidateType = cell.attrs["widthType"];
+		if (typeof candidateWidth !== "number" || !Number.isFinite(candidateWidth) || candidateType !== "dxa" && candidateType !== "pct" || widthType !== void 0 && candidateType !== widthType) return { type: "absent" };
+		width += candidateWidth;
+		widthType = candidateType;
+	}
+	return widthType === void 0 ? { type: "absent" } : {
+		type: "value",
+		width,
+		widthType
+	};
+};
 const mergeTrackedVerticalTableCells = ({ tr, tablePosition, table, rectangle, revisionId, author, date }) => {
 	const map = TableMap.get(table);
 	if (rectangle.right - rectangle.left !== 1 || rectangle.bottom - rectangle.top < 2 || rectangle.left < 0 || rectangle.top < 0 || rectangle.right > map.width || rectangle.bottom > map.height || tableRectangleCutsMergedCell(map, rectangle)) return null;

package/dist/docx/paragraphParser.js

@@ -1,3 +1,4 @@
+import { isValidHexColor } from "../utils/colorResolver.js";
 import { isValidHexId } from "../utils/hexId.js";
 import { parseBookmarkEnd as parseBookmarkEnd$1, parseBookmarkStart as parseBookmarkStart$1 } from "./bookmarkParser.js";
 import { parseFieldType } from "./fieldParser.js";
@@ -48,9 +49,9 @@ function parseShadingProperties(shd) {
 	if (!shd) return;
 	const props = {};
 	const color = getAttribute(shd, "w", "color");
-	if (color && color !== "auto") props.color = { rgb: color };
+	if (color && color !== "auto" && isValidHexColor(color)) props.color = { rgb: color };
 	const fill = getAttribute(shd, "w", "fill");
-	if (fill && fill !== "auto") props.fill = { rgb: fill };
+	if (fill && fill !== "auto" && isValidHexColor(fill)) props.fill = { rgb: fill };
 	const validatedThemeFill = narrowEnum(getAttribute(shd, "w", "themeFill"), ThemeColorSlotSchema);
 	if (validatedThemeFill) {
 		props.fill = props.fill || {};

package/dist/docx/parser.js

@@ -1,6 +1,6 @@
 import { toArrayBuffer } from "../utils/docxInput.js";
 import { loadFontsWithMapping } from "../utils/fontLoader.js";
-import { convertTiffToPngDataUrl, isTiffMimeType } from "../utils/tiffConverter.js";
+import { MAX_PACKAGE_TIFF_PIXELS, convertTiffToPngDataUrl, isTiffMimeType } from "../utils/tiffConverter.js";
 import { parseComments } from "./commentParser.js";
 import { normalizeCommentReferences } from "./commentReferenceNormalization.js";
 import { detectDocxConformanceClass } from "./conformance.js";
@@ -237,14 +237,37 @@ function copyBytesToArrayBuffer(bytes) {
 	new Uint8Array(buffer).set(bytes);
 	return buffer;
 }
-async function buildMediaMap(raw, _rels) {
+/**
+* Media paths reachable from the package relationship graph: the document's own
+* relationships plus every `.rels` part the unzip kept. Entries outside it are
+* still stored so a round-trip keeps their bytes, but nothing decodes them.
+*/
+function collectReferencedMediaPaths(raw, rels) {
+	const referenced = /* @__PURE__ */ new Set();
+	const addTargets = (map, relsPath) => {
+		for (const relationship of map.values()) {
+			if (!relationship.target || relationship.targetMode === "External") continue;
+			const partPath = resolveRelativePath(relsPath, relationship.target);
+			referenced.add(partPath.toLowerCase());
+			referenced.add(partPath.replace(/^word\//u, "").toLowerCase());
+		}
+	};
+	addTargets(rels, DOCUMENT_RELATIONSHIPS_PATH);
+	for (const [path, xml] of raw.allXml.entries()) if (path.toLowerCase().endsWith(".rels")) addTargets(parseRelationships(xml), path);
+	return referenced;
+}
+async function buildMediaMap(raw, rels) {
 	const media = /* @__PURE__ */ new Map();
+	const referenced = collectReferencedMediaPaths(raw, rels);
+	let remainingTiffPixels = MAX_PACKAGE_TIFF_PIXELS;
 	for (const [path, data] of raw.media.entries()) {
 		const filename = path.split("/").pop() || path;
 		const mimeType = getMediaMimeType(path);
-		if (isTiffMimeType(mimeType)) {
-			const converted = await convertTiffToPngDataUrl(data);
+		const isReferenced = referenced.has(path.toLowerCase());
+		if (isReferenced && isTiffMimeType(mimeType) && remainingTiffPixels > 0) {
+			const converted = await convertTiffToPngDataUrl(data, remainingTiffPixels);
 			if (converted) {
+				remainingTiffPixels -= converted.pixels;
 				const mediaFile = {
 					path,
 					filename: filename.replace(/\.tiff?$/iu, ".png"),
@@ -258,7 +281,7 @@ async function buildMediaMap(raw, _rels) {
 				continue;
 			}
 		}
-		const raster = isMetafileMimeType(mimeType) ? extractMetafileRaster(data) : null;
+		const raster = isReferenced && isMetafileMimeType(mimeType) ? extractMetafileRaster(data) : null;
 		if (raster) {
 			const mediaFile = {
 				path,

package/dist/docx/rezip.d.ts

@@ -54,6 +54,26 @@ declare function addCommentsExtendedOverride(contentTypesXml: string): string;
 declare function removeCommentsExtendedOverride(contentTypesXml: string): string;
 declare function addCommentsExtendedRelationship(relsXml: string): string;
 declare function removeCommentsExtendedRelationship(relsXml: string): string;
+/** Result of filtering the settings part; `undefined` means "leave as it is". */
+type SettingsWithoutAttachedTemplate = {
+  settingsXml: string | undefined;
+  relsXml: string | undefined;
+};
+/**
+ * Drop `w:attachedTemplate` from a `word/settings.xml` payload together with the
+ * relationships it resolves through.
+ *
+ * The elements are located in the parsed tree by namespace URI plus local name,
+ * so both the Transitional and the Strict WordprocessingML namespace are
+ * covered and a same-named element from a foreign namespace is left alone. Only
+ * the relationship ids those elements reference are removed from the `.rels`
+ * part: the settings part may also carry mail-merge and transform
+ * relationships, and their `r:id` values must keep resolving.
+ *
+ * The removal itself is a byte splice, so everything else in both parts
+ * round-trips exactly as authored.
+ */
+declare function withoutAttachedTemplate(settingsXml: string, relsXml: string | undefined): SettingsWithoutAttachedTemplate;
 /**
  * Update only document.xml in a DOCX buffer (minimal changes)
  *
@@ -173,4 +193,4 @@ declare function createEmptyDocx(): Promise<ArrayBuffer>;
  */
 declare function createDocx(doc: document_d_exports.Document): Promise<ArrayBuffer>;
 //#endregion
-export { COMMENTS_CONTENT_TYPE, COMMENTS_EXTENDED_CONTENT_TYPE, COMMENTS_EXTENDED_PART, COMMENTS_EXTENDED_PART_LOWER, DocxPackageFidelityError, RepackOptions, addCommentsExtendedOverride, addCommentsExtendedRelationship, addMedia, addRelationship, applyUpdatesToZip, collectHeaderFooterUpdates, collectHyperlinksWithoutRId, createDocx, createEmptyDocx, findMaxRId, hasModelDrivenPictureWatermark, hasUnmaterializedHeaderFooter, isDocxBuffer, notePartRelsPath, removeCommentsExtendedOverride, removeCommentsExtendedRelationship, repackDocx, repackDocxFromRaw, updateCoreProperties, updateDocumentXml, updateMultipleFiles, updateXmlFile, validateDocx };
+export { COMMENTS_CONTENT_TYPE, COMMENTS_EXTENDED_CONTENT_TYPE, COMMENTS_EXTENDED_PART, COMMENTS_EXTENDED_PART_LOWER, DocxPackageFidelityError, RepackOptions, addCommentsExtendedOverride, addCommentsExtendedRelationship, addMedia, addRelationship, applyUpdatesToZip, collectHeaderFooterUpdates, collectHyperlinksWithoutRId, createDocx, createEmptyDocx, findMaxRId, hasModelDrivenPictureWatermark, hasUnmaterializedHeaderFooter, isDocxBuffer, notePartRelsPath, removeCommentsExtendedOverride, removeCommentsExtendedRelationship, repackDocx, repackDocxFromRaw, updateCoreProperties, updateDocumentXml, updateMultipleFiles, updateXmlFile, validateDocx, withoutAttachedTemplate };

package/dist/docx/rezip.js

@@ -18,7 +18,7 @@ import { serializeStyle, serializeStylesXml } from "./serializer/stylesSerialize
 import { serializeThemeXml } from "./serializer/themeSerializer.js";
 import { escapeXml } from "./serializer/xmlUtils.js";
 import { isPreservableDocxEntry } from "./unzip.js";
-import { WORDPROCESSINGML_NAMESPACE_URIS, findChild, getChildElements, getLocalName, getNamespaceUri, matchesName, parseXml } from "./xmlParser.js";
+import { WORDPROCESSINGML_NAMESPACE_URIS, findChild, getAttribute, getChildElements, getLocalName, getNamespaceUri, matchesName, parseXml, parseXmlDocument } from "./xmlParser.js";
 import { assertXmlResourceLimits } from "./xmlResourceLimits.js";
 import { panic } from "better-result";
 import { validateDocxPackage } from "@stll/docx-core";
@@ -459,6 +459,7 @@ const finishRepack = async ({ document, originalZip, outputZip, originalDocument
 	await serializeNumberingIntoZip(document, originalZip, outputZip, compressionLevel);
 	await serializeAddedStylesIntoZip(document, originalZip, outputZip, compressionLevel);
 	await serializeCommentsToZip(document, outputZip, compressionLevel);
+	await dropAttachedTemplateReference(outputZip, compressionLevel);
 	if (updateModifiedDate && originalCorePropertiesXml) {
 		const updatedCoreProperties = updateCoreProperties(originalCorePropertiesXml, {
 			updateModifiedDate,
@@ -547,6 +548,7 @@ async function repackDocxFromRaw(doc, rawContent, options = {}) {
 	await serializeNumberingIntoZip(exportDocument, rawContent.originalZip, newZip, compressionLevel);
 	await serializeAddedStylesIntoZip(exportDocument, rawContent.originalZip, newZip, compressionLevel);
 	await serializeCommentsToZip(exportDocument, newZip, compressionLevel);
+	await dropAttachedTemplateReference(newZip, compressionLevel);
 	if (updateModifiedDate && rawContent.corePropsXml) {
 		const updatedCoreProps = updateCoreProperties(rawContent.corePropsXml, {
 			updateModifiedDate,
@@ -582,6 +584,82 @@ function addCommentsExtendedRelationship(relsXml) {
 function removeCommentsExtendedRelationship(relsXml) {
 	return relsXml.replace(/<Relationship\b[^>]*commentsExtended\.xml[^>]*\/>/giu, "");
 }
+const SETTINGS_PART = "word/settings.xml";
+const SETTINGS_RELS_PART = "word/_rels/settings.xml.rels";
+const ATTACHED_TEMPLATE_LOCAL_NAME = "attachedTemplate";
+const ATTACHED_TEMPLATE_ELEMENT = /<(?<prefix>[\w.-]+:)?attachedTemplate\b[^>]*?(?:\/>|>\s*<\/(?:[\w.-]+:)?attachedTemplate>)/giu;
+const RELATIONSHIP_ELEMENT = /<Relationship\b[^>]*?(?:\/>|>\s*<\/Relationship>)/giu;
+const RELATIONSHIP_ID_ATTRIBUTE = /\bId\s*=\s*(?<quote>["'])(?<value>[^"']*)\k<quote>/u;
+/**
+* Drop `w:attachedTemplate` from a `word/settings.xml` payload together with the
+* relationships it resolves through.
+*
+* The elements are located in the parsed tree by namespace URI plus local name,
+* so both the Transitional and the Strict WordprocessingML namespace are
+* covered and a same-named element from a foreign namespace is left alone. Only
+* the relationship ids those elements reference are removed from the `.rels`
+* part: the settings part may also carry mail-merge and transform
+* relationships, and their `r:id` values must keep resolving.
+*
+* The removal itself is a byte splice, so everything else in both parts
+* round-trips exactly as authored.
+*/
+function withoutAttachedTemplate(settingsXml, relsXml) {
+	const root = parseXmlDocument(settingsXml);
+	if (!root) return {
+		settingsXml: void 0,
+		relsXml: void 0
+	};
+	const prefixes = /* @__PURE__ */ new Set();
+	const referencedRIds = /* @__PURE__ */ new Set();
+	for (const element of getChildElements(root)) {
+		if (getLocalName(element.name) !== ATTACHED_TEMPLATE_LOCAL_NAME || !WORDPROCESSINGML_NAMESPACE_URIS.has(getNamespaceUri(element) ?? "")) continue;
+		const name = element.name ?? "";
+		const separatorIndex = name.indexOf(":");
+		prefixes.add(separatorIndex === -1 ? "" : name.slice(0, separatorIndex));
+		const rId = getAttribute(element, "r", "id");
+		if (rId) referencedRIds.add(rId);
+	}
+	if (prefixes.size === 0) return {
+		settingsXml: void 0,
+		relsXml: void 0
+	};
+	const filteredSettings = settingsXml.replace(ATTACHED_TEMPLATE_ELEMENT, (match, prefix) => prefixes.has(prefix?.slice(0, -1) ?? "") ? "" : match);
+	return {
+		settingsXml: filteredSettings === settingsXml ? void 0 : filteredSettings,
+		relsXml: relsXml === void 0 ? void 0 : withoutRelationships(relsXml, referencedRIds)
+	};
+}
+/** Drop the named relationships from a `.rels` payload; `undefined` when unchanged. */
+function withoutRelationships(relsXml, ids) {
+	if (ids.size === 0) return;
+	const filtered = relsXml.replace(RELATIONSHIP_ELEMENT, (relationship) => {
+		const id = RELATIONSHIP_ID_ATTRIBUTE.exec(relationship)?.groups?.["value"];
+		return id !== void 0 && ids.has(id) ? "" : relationship;
+	});
+	return filtered === relsXml ? void 0 : filtered;
+}
+/**
+* The settings part and its relationships are otherwise copied from the source
+* package byte for byte. `w:attachedTemplate` resolves through a relationship
+* whose target sits outside the package (`TargetMode="External"`); the document
+* model has no field for it, so a preserved copy would carry a reference folio
+* can neither read nor rewrite. Both sides are filtered on save.
+*/
+async function dropAttachedTemplateReference(zip, compressionLevel) {
+	const settingsFile = zip.file(SETTINGS_PART);
+	if (!settingsFile) return;
+	const relsFile = zip.file(SETTINGS_RELS_PART);
+	const filtered = withoutAttachedTemplate(await settingsFile.async("text"), await relsFile?.async("text"));
+	if (filtered.settingsXml !== void 0) zip.file(SETTINGS_PART, filtered.settingsXml, {
+		compression: "DEFLATE",
+		compressionOptions: { level: compressionLevel }
+	});
+	if (filtered.relsXml !== void 0) zip.file(SETTINGS_RELS_PART, filtered.relsXml, {
+		compression: "DEFLATE",
+		compressionOptions: { level: compressionLevel }
+	});
+}
 /**
 * Ensure [Content_Types].xml contains an Override for word/comments.xml.
 * If the document already had comments, this is a no-op.
@@ -1413,4 +1491,4 @@ const assertStyleNumberingReferences = (doc) => {
 	for (const numbering of doc.package.numbering?.nums ?? []) if (!availableAbstract.has(numbering.abstractNumId)) panic(`Numbering definition ${numbering.numId} references missing abstract numbering`);
 };
 //#endregion
-export { COMMENTS_CONTENT_TYPE, COMMENTS_EXTENDED_CONTENT_TYPE, COMMENTS_EXTENDED_PART, COMMENTS_EXTENDED_PART_LOWER, DocxPackageFidelityError, addCommentsExtendedOverride, addCommentsExtendedRelationship, addMedia, addRelationship, applyUpdatesToZip, collectHeaderFooterUpdates, collectHyperlinksWithoutRId, createDocx, createEmptyDocx, findMaxRId, hasModelDrivenPictureWatermark, hasUnmaterializedHeaderFooter, isDocxBuffer, notePartRelsPath, removeCommentsExtendedOverride, removeCommentsExtendedRelationship, repackDocx, repackDocxFromRaw, updateCoreProperties, updateDocumentXml, updateMultipleFiles, updateXmlFile, validateDocx };
+export { COMMENTS_CONTENT_TYPE, COMMENTS_EXTENDED_CONTENT_TYPE, COMMENTS_EXTENDED_PART, COMMENTS_EXTENDED_PART_LOWER, DocxPackageFidelityError, addCommentsExtendedOverride, addCommentsExtendedRelationship, addMedia, addRelationship, applyUpdatesToZip, collectHeaderFooterUpdates, collectHyperlinksWithoutRId, createDocx, createEmptyDocx, findMaxRId, hasModelDrivenPictureWatermark, hasUnmaterializedHeaderFooter, isDocxBuffer, notePartRelsPath, removeCommentsExtendedOverride, removeCommentsExtendedRelationship, repackDocx, repackDocxFromRaw, updateCoreProperties, updateDocumentXml, updateMultipleFiles, updateXmlFile, validateDocx, withoutAttachedTemplate };

package/dist/docx/runParser.js

@@ -1,3 +1,4 @@
+import { isValidHexColor } from "../utils/colorResolver.js";
 import { parseGroupDrawing } from "./groupDrawingParser.js";
 import { parseImage } from "./imageParser.js";
 import { EmphasisMarkSchema, FontHintSchema, FontThemeSchema, HighlightColorSchema, PositionalTabAlignmentSchema, PositionalTabLeaderSchema, PositionalTabRelativeToSchema, ShadingPatternSchema, TextEffectSchema, ThemeColorSlotSchema, UnderlineStyleSchema, narrowEnum } from "./parserEnums.js";
@@ -37,9 +38,9 @@ function parseShadingProperties(shd) {
 	if (!shd) return;
 	const props = {};
 	const color = getAttribute(shd, "w", "color");
-	if (color && color !== "auto") props.color = { rgb: color };
+	if (color && color !== "auto" && isValidHexColor(color)) props.color = { rgb: color };
 	const fill = getAttribute(shd, "w", "fill");
-	if (fill && fill !== "auto") props.fill = { rgb: fill };
+	if (fill && fill !== "auto" && isValidHexColor(fill)) props.fill = { rgb: fill };
 	const validatedThemeFill = narrowEnum(getAttribute(shd, "w", "themeFill"), ThemeColorSlotSchema);
 	if (validatedThemeFill) {
 		if (!props.fill) props.fill = {};
@@ -252,7 +253,7 @@ function parseRunProperties(rPr, theme, _styles) {
 				if (resolved) fontFamily.ascii = resolved;
 			}
 		}
-		const hAnsiTheme = getAttribute(rFonts, "w", "hAnsiTheme");
+		const hAnsiTheme = narrowEnum(getAttribute(rFonts, "w", "hAnsiTheme"), FontThemeSchema);
 		if (hAnsiTheme) {
 			fontFamily.hAnsiTheme = hAnsiTheme;
 			if (theme && !fontFamily.hAnsi) {
@@ -260,7 +261,7 @@ function parseRunProperties(rPr, theme, _styles) {
 				if (resolved) fontFamily.hAnsi = resolved;
 			}
 		}
-		const eastAsiaTheme = getAttribute(rFonts, "w", "eastAsiaTheme");
+		const eastAsiaTheme = narrowEnum(getAttribute(rFonts, "w", "eastAsiaTheme"), FontThemeSchema);
 		if (eastAsiaTheme) {
 			fontFamily.eastAsiaTheme = eastAsiaTheme;
 			if (theme && !fontFamily.eastAsia) {
@@ -268,7 +269,7 @@ function parseRunProperties(rPr, theme, _styles) {
 				if (resolved) fontFamily.eastAsia = resolved;
 			}
 		}
-		const csTheme = getAttribute(rFonts, "w", "cstheme");
+		const csTheme = narrowEnum(getAttribute(rFonts, "w", "cstheme"), FontThemeSchema);
 		if (csTheme) {
 			fontFamily.csTheme = csTheme;
 			if (theme && !fontFamily.cs) {

package/dist/docx/selectiveSave.d.ts

@@ -14,14 +14,6 @@ type SelectiveSaveOptions = {
    */
   maxBytes?: number;
 };
-/**
- * Attempt a selective save — patch only changed paragraphs in document.xml.
- * Also updates comments, headers/footers, and core properties so that
- * all document parts stay in sync even when only paragraphs are patched.
- *
- * Returns the saved ArrayBuffer, or null if selective save is not possible
- * (caller should fall back to full repack).
- */
 declare function attemptSelectiveSave(doc: document_d_exports.Document, originalBuffer: ArrayBuffer, options: SelectiveSaveOptions): Promise<ArrayBuffer | null>;
 //#endregion
 export { SelectiveSaveOptions, attemptSelectiveSave };

package/dist/docx/selectiveSave.js

@@ -5,7 +5,7 @@ import { validateFolioDocumentModel } from "./modelValidation.js";
 import { isNewDataUrlDrawing } from "./newImage.js";
 import { parseNumbering } from "./numberingParser.js";
 import { RELATIONSHIP_TYPES } from "./relsParser.js";
-import { COMMENTS_CONTENT_TYPE, COMMENTS_EXTENDED_PART_LOWER, addCommentsExtendedOverride, addCommentsExtendedRelationship, applyUpdatesToZip, collectHeaderFooterUpdates, findMaxRId, hasModelDrivenPictureWatermark, hasUnmaterializedHeaderFooter, updateCoreProperties } from "./rezip.js";
+import { COMMENTS_CONTENT_TYPE, COMMENTS_EXTENDED_PART_LOWER, addCommentsExtendedOverride, addCommentsExtendedRelationship, applyUpdatesToZip, collectHeaderFooterUpdates, findMaxRId, hasModelDrivenPictureWatermark, hasUnmaterializedHeaderFooter, updateCoreProperties, withoutAttachedTemplate } from "./rezip.js";
 import "./selectiveSaveFlags.js";
 import { buildPatchedDocumentXml, buildPatchedNoteXml, buildPatchedNumberingXml, collectChangedNumberingDefs, collectParaIds } from "./selectiveXmlPatch.js";
 import { ensureThreadedCommentParaIds, serializeComments, serializeCommentsExtended } from "./serializer/commentSerializer.js";
@@ -174,6 +174,20 @@ async function patchNumberingPart(zip, doc, updates) {
 * Returns the saved ArrayBuffer, or null if selective save is not possible
 * (caller should fall back to full repack).
 */
+/**
+* Queue the filtered `word/settings.xml` and `word/_rels/settings.xml.rels`
+* when the source package carries an attached-template reference. Shares
+* `withoutAttachedTemplate` with the full-repack path so both saves emit the
+* same package for the same source.
+*/
+const queueSettingsUpdates = async (zip, updates) => {
+	const settingsFile = zip.file("word/settings.xml");
+	if (!settingsFile) return;
+	const relsFile = zip.file("word/_rels/settings.xml.rels");
+	const filtered = withoutAttachedTemplate(await settingsFile.async("text"), await relsFile?.async("text"));
+	if (filtered.settingsXml !== void 0) updates.set("word/settings.xml", filtered.settingsXml);
+	if (filtered.relsXml !== void 0) updates.set("word/_rels/settings.xml.rels", filtered.relsXml);
+};
 async function attemptSelectiveSave(doc, originalBuffer, options) {
 	const { changedParaIds, structuralChange, hasUntrackedChanges } = options;
 	const maxBytes = options.maxBytes ?? 104857600;
@@ -243,6 +257,7 @@ async function attemptSelectiveSave(doc, originalBuffer, options) {
 		if (!await patchCommentsExtended(zip, comments, updates)) return null;
 		await patchNumberingPart(zip, doc, updates);
 		for (const [path, xml] of headerFooterUpdates) updates.set(path, xml);
+		await queueSettingsUpdates(zip, updates);
 		const corePropsFile = zip.file("docProps/core.xml");
 		if (corePropsFile) {
 			const corePropsXml = await corePropsFile.async("text");

package/dist/docx/serializer/runSerializer.js

@@ -85,10 +85,10 @@ function serializeTextFormatting(formatting) {
 		if (formatting.fontFamily.eastAsia) fontAttrs.push(`w:eastAsia="${escapeXml(formatting.fontFamily.eastAsia)}"`);
 		if (formatting.fontFamily.cs) fontAttrs.push(`w:cs="${escapeXml(formatting.fontFamily.cs)}"`);
 		if (formatting.fontFamily.hint) fontAttrs.push(`w:hint="${escapeXml(formatting.fontFamily.hint)}"`);
-		if (formatting.fontFamily.asciiTheme) fontAttrs.push(`w:asciiTheme="${formatting.fontFamily.asciiTheme}"`);
-		if (formatting.fontFamily.hAnsiTheme) fontAttrs.push(`w:hAnsiTheme="${formatting.fontFamily.hAnsiTheme}"`);
-		if (formatting.fontFamily.eastAsiaTheme) fontAttrs.push(`w:eastAsiaTheme="${formatting.fontFamily.eastAsiaTheme}"`);
-		if (formatting.fontFamily.csTheme) fontAttrs.push(`w:cstheme="${formatting.fontFamily.csTheme}"`);
+		if (formatting.fontFamily.asciiTheme) fontAttrs.push(`w:asciiTheme="${escapeXml(formatting.fontFamily.asciiTheme)}"`);
+		if (formatting.fontFamily.hAnsiTheme) fontAttrs.push(`w:hAnsiTheme="${escapeXml(formatting.fontFamily.hAnsiTheme)}"`);
+		if (formatting.fontFamily.eastAsiaTheme) fontAttrs.push(`w:eastAsiaTheme="${escapeXml(formatting.fontFamily.eastAsiaTheme)}"`);
+		if (formatting.fontFamily.csTheme) fontAttrs.push(`w:cstheme="${escapeXml(formatting.fontFamily.csTheme)}"`);
 		if (fontAttrs.length > 0) parts.push(`<w:rFonts ${fontAttrs.join(" ")}/>`);
 	}
 	if (formatting.language) {

package/dist/docx/serializer/sectionPropertiesSerializer.js

@@ -83,7 +83,7 @@ function serializePageNumbering(props) {
 	if (pageNumbering.format) attrs.push(`w:fmt="${pageNumbering.format}"`);
 	if (pageNumbering.start !== void 0) attrs.push(`w:start="${intAttr(pageNumbering.start)}"`);
 	if (pageNumbering.chapterStyle !== void 0) attrs.push(`w:chapStyle="${intAttr(pageNumbering.chapterStyle)}"`);
-	if (pageNumbering.chapterSeparator) attrs.push(`w:chapSep="${pageNumbering.chapterSeparator}"`);
+	if (pageNumbering.chapterSeparator) attrs.push(`w:chapSep="${escapeXml(pageNumbering.chapterSeparator)}"`);
 	return attrs.length > 0 ? `<w:pgNumType ${attrs.join(" ")}/>` : "";
 }
 function serializePageBorders(props) {
@@ -113,10 +113,10 @@ function serializeBackground(props) {
 	const attrs = [];
 	const { background } = props;
 	if (background.color?.auto) attrs.push("w:color=\"auto\"");
-	else if (background.color?.rgb) attrs.push(`w:color="${background.color.rgb}"`);
-	if (background.themeColor ?? background.color?.themeColor) attrs.push(`w:themeColor="${background.themeColor ?? background.color?.themeColor}"`);
-	if (background.themeTint ?? background.color?.themeTint) attrs.push(`w:themeTint="${background.themeTint ?? background.color?.themeTint}"`);
-	if (background.themeShade ?? background.color?.themeShade) attrs.push(`w:themeShade="${background.themeShade ?? background.color?.themeShade}"`);
+	else if (background.color?.rgb) attrs.push(`w:color="${escapeXml(background.color.rgb)}"`);
+	if (background.themeColor ?? background.color?.themeColor) attrs.push(`w:themeColor="${escapeXml(background.themeColor ?? background.color?.themeColor ?? "")}"`);
+	if (background.themeTint ?? background.color?.themeTint) attrs.push(`w:themeTint="${escapeXml(background.themeTint ?? background.color?.themeTint ?? "")}"`);
+	if (background.themeShade ?? background.color?.themeShade) attrs.push(`w:themeShade="${escapeXml(background.themeShade ?? background.color?.themeShade ?? "")}"`);
 	return attrs.length > 0 ? `<w:background ${attrs.join(" ")}/>` : "";
 }
 function serializeDocGrid(props) {

package/dist/docx/server/createBilingualDocument.js

@@ -10,7 +10,10 @@ import { TaggedError } from "better-result";
 * cloned per language, so both columns count independently (1. / 1. instead of
 * 1. / 2.) and stay live in Word. Right-column paragraphs receive fresh
 * `paraId`s so callers can address each row later (for example to replace the
-* placeholder copy with a translation by block id).
+* placeholder copy with a translation by block id). Horizontal paragraph
+* geometry is projected into the half-width cells: full-page indents and tab
+* stops otherwise place signature fields outside their column and let prose
+* overlap the translation.
 *
 * Section breaks cannot live inside a table cell, so the body is split at
 * paragraphs carrying `sectionProperties`: each section becomes its own table
@@ -28,6 +31,8 @@ const HALF_WIDTH_PCT = 2500;
 const A4_TEXT_WIDTH_TWIPS = 9072;
 const ROW_ID_NAMESPACE = "folio-bilingual";
 const BILINGUAL_TABLE_STYLE_ID = "FolioBilingualTranslation";
+const MIN_COLUMN_TEXT_WIDTH_TWIPS = 720;
+const MIN_TAB_TRAILING_WIDTH_TWIPS = 360;
 const GRID_BORDER = {
 	style: "single",
 	size: 4,
@@ -111,7 +116,7 @@ function createBilingualDocument(source, options) {
 				rowId: ref.targetParaId,
 				...ref
 			});
-			sectionRows.push(buildRow(block, copy));
+			sectionRows.push(buildRow(block, copy, styleById, textWidth));
 			continue;
 		}
 		const paragraphs = collectTableParagraphs(block).filter((paragraph) => paragraph.paraId !== void 0 && options.editableParagraphIds.has(paragraph.paraId)).map((paragraph) => ({
@@ -362,11 +367,72 @@ const collectTableParagraphs = (table) => {
 	else out.push(...collectTableParagraphs(item));
 	return out;
 };
-const buildRow = (left, right) => ({
-	type: "tableRow",
-	formatting: { cantSplit: true },
-	cells: [buildCell(left), buildCell(right)]
-});
+const buildRow = (left, right, styleById, textWidth) => {
+	const columnWidth = Math.floor(textWidth / 2);
+	const geometry = resolveHorizontalParagraphGeometry(left, styleById);
+	return {
+		type: "tableRow",
+		formatting: { cantSplit: true },
+		cells: [buildCell(projectParagraphIntoColumn(left, geometry, textWidth, columnWidth)), buildCell(projectParagraphIntoColumn(right, geometry, textWidth, columnWidth))]
+	};
+};
+const HORIZONTAL_PARAGRAPH_KEYS = [
+	"indentLeft",
+	"indentRight",
+	"indentFirstLine",
+	"hangingIndent",
+	"tabs"
+];
+/** Resolve only the paragraph properties whose coordinates change when a
+* full-width paragraph is placed in a half-width cell. Direct pPr wins over
+* the basedOn style chain, matching Word's paragraph-style cascade. */
+const resolveHorizontalParagraphGeometry = (paragraph, styleById) => {
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set();
+	let style = paragraph.formatting?.styleId ? styleById.get(paragraph.formatting.styleId) : void 0;
+	while (style && !seen.has(style.styleId)) {
+		seen.add(style.styleId);
+		chain.push(style);
+		style = style.basedOn ? styleById.get(style.basedOn) : void 0;
+	}
+	const geometry = {};
+	for (const current of chain.toReversed()) assignHorizontalParagraphGeometry(geometry, current.pPr);
+	assignHorizontalParagraphGeometry(geometry, paragraph.formatting);
+	return geometry;
+};
+const assignHorizontalParagraphGeometry = (target, source) => {
+	for (const key of HORIZONTAL_PARAGRAPH_KEYS) {
+		const value = source?.[key];
+		if (value !== void 0) Object.assign(target, { [key]: value });
+	}
+};
+const projectParagraphIntoColumn = (paragraph, geometry, sourceWidth, columnWidth) => {
+	const scale = columnWidth / sourceWidth;
+	const maxSideIndent = Math.max(0, columnWidth - MIN_COLUMN_TEXT_WIDTH_TWIPS);
+	let indentLeft = projectSideIndent(geometry.indentLeft, scale, maxSideIndent);
+	let indentRight = projectSideIndent(geometry.indentRight, scale, maxSideIndent);
+	if (indentLeft + indentRight - maxSideIndent > 0) {
+		const total = indentLeft + indentRight;
+		indentLeft = Math.round(indentLeft / total * maxSideIndent);
+		indentRight = maxSideIndent - indentLeft;
+	}
+	const formatting = {
+		...paragraph.formatting,
+		...geometry.indentLeft !== void 0 && { indentLeft },
+		...geometry.indentRight !== void 0 && { indentRight },
+		...geometry.indentFirstLine !== void 0 && { indentFirstLine: Math.round(geometry.indentFirstLine * scale) },
+		...geometry.hangingIndent !== void 0 && { hangingIndent: geometry.hangingIndent },
+		...geometry.tabs !== void 0 && { tabs: geometry.tabs.map((tab) => ({
+			...tab,
+			position: Math.min(Math.max(0, Math.round(tab.position * scale)), Math.max(0, columnWidth - MIN_TAB_TRAILING_WIDTH_TWIPS))
+		})) }
+	};
+	return {
+		...paragraph,
+		formatting
+	};
+};
+const projectSideIndent = (value, scale, maximum) => Math.min(Math.max(0, Math.round((value ?? 0) * scale)), maximum);
 const buildCell = (paragraph) => ({
 	type: "tableCell",
 	formatting: {

package/dist/docx/server/extractDocxText.js

@@ -103,16 +103,26 @@ const NESTED_TABLE_CELL_SEPARATOR = " / ";
 const MAX_TABLE_COLUMNS = 256;
 /** Bound the mutual recursion between a cell and the tables nested inside it. */
 const MAX_NESTED_TABLE_DEPTH = 8;
+/** Rows collected from one `w:tbl`. The column cap alone leaves row count unbounded. */
+const MAX_TABLE_ROWS = 8192;
+/**
+* Characters one extraction emits, shared by the body and every header/footer
+* part. Element count is bounded at unzip, but a bounded element count still
+* renders an unbounded number of table rows once `w:gridSpan` padding and the
+* GFM scaffolding are counted, so the emitted side carries its own ceiling.
+*/
+const MAX_EXTRACTED_CHARS = 8e6;
 /**
 * Collect a table's `w:tr`, or a row's `w:tc`, seeing through the wrappers Word
 * puts around them (`w:sdt` / `w:sdtContent` content controls, `w:customXml`).
 * The walk stops at `w:tbl` and `w:p` so a nested table's rows and cells never
 * leak into the grid of the table that contains them.
 */
-const collectTableParts = (parent, localName) => {
+const collectTableParts = (parent, localName, limit) => {
 	const parts = [];
 	const walk = (node) => {
 		for (const child of childElements(node)) {
+			if (parts.length >= limit) return;
 			const childName = wordElementName(child);
 			if (childName === localName) {
 				parts.push(child);
@@ -142,7 +152,7 @@ const readCellSourceParagraphs = (cell, depth) => {
 			}
 			if (childName === "tbl") {
 				if (depth >= MAX_NESTED_TABLE_DEPTH) continue;
-				for (const row of collectTableParts(child, "tr")) for (const nestedCell of collectTableParts(row, "tc")) for (const paragraph of readCellSourceParagraphs(nestedCell, depth + 1)) paragraphs.push(paragraph);
+				for (const row of collectTableParts(child, "tr", MAX_TABLE_ROWS)) for (const nestedCell of collectTableParts(row, "tc", MAX_TABLE_COLUMNS)) for (const paragraph of readCellSourceParagraphs(nestedCell, depth + 1)) paragraphs.push(paragraph);
 				continue;
 			}
 			walk(child);
@@ -173,8 +183,8 @@ const readCellRenderedLines = (cell, depth) => {
 };
 const flattenNestedTable = (table, depth) => {
 	const lines = [];
-	for (const row of collectTableParts(table, "tr")) {
-		const cells = collectTableParts(row, "tc").map((cell) => readCellRenderedLines(cell, depth).join("\n"));
+	for (const row of collectTableParts(table, "tr", MAX_TABLE_ROWS)) {
+		const cells = collectTableParts(row, "tc", MAX_TABLE_COLUMNS).map((cell) => readCellRenderedLines(cell, depth).join("\n"));
 		if (cells.some((text) => text.length > 0)) lines.push(cells.join(NESTED_TABLE_CELL_SEPARATOR));
 	}
 	return lines;
@@ -229,12 +239,12 @@ const readTableGrid = (table) => {
 	const rows = [];
 	let columnCount = 0;
 	let firstRowIsHeader = false;
-	for (const [rowIndex, row] of collectTableParts(table, "tr").entries()) {
+	for (const [rowIndex, row] of collectTableParts(table, "tr", MAX_TABLE_ROWS).entries()) {
 		if (rowIndex === 0) firstRowIsHeader = declaresHeaderRow(row);
 		const columns = [];
 		const gridBefore = readRowGridOffset(row, "gridBefore");
 		for (let index = 0; index < gridBefore; index += 1) columns.push(emptyTableCell());
-		for (const cell of collectTableParts(row, "tc")) {
+		for (const cell of collectTableParts(row, "tc", MAX_TABLE_COLUMNS)) {
 			if (columns.length >= MAX_TABLE_COLUMNS) break;
 			const extractedCell = readTableCell(cell, 0);
 			columns.push(extractedCell);
@@ -293,7 +303,8 @@ const renderTableRows = (table, tableIndex) => {
 	for (const row of firstRowIsHeader ? remainingRows : rows) pushCells(row);
 	return rendered;
 };
-const extractContainer = ({ container, source, startIndex, startTableIndex }) => {
+const createCharBudget = () => ({ remaining: MAX_EXTRACTED_CHARS });
+const extractContainer = ({ container, source, startIndex, startTableIndex, budget }) => {
 	const paragraphs = [];
 	let charCount = 0;
 	let tableCount = 0;
@@ -307,6 +318,7 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 		};
 		paragraphs.push(entry);
 		charCount += text.length;
+		budget.remaining -= text.length;
 	};
 	const pushTableRow = ({ text, position }) => {
 		paragraphs.push({
@@ -316,6 +328,7 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 			tableRow: position
 		});
 		charCount += text.length;
+		budget.remaining -= text.length;
 	};
 	/**
 	* Walk block content in document order. Descent mirrors the previous
@@ -325,6 +338,7 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 	*/
 	const walkBlocks = (node) => {
 		for (const child of childElements(node)) {
+			if (budget.remaining <= 0) return;
 			const childName = wordElementName(child);
 			if (childName === "tbl") {
 				for (const row of renderTableRows(child, startTableIndex + tableCount)) pushTableRow(row);
@@ -342,7 +356,7 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 		tableCount
 	};
 };
-const extractParts = async ({ archive, source, rootName, startIndex, startTableIndex, paths }) => {
+const extractParts = async ({ archive, source, rootName, startIndex, startTableIndex, paths, budget }) => {
 	const paragraphs = [];
 	let charCount = 0;
 	let tableCount = 0;
@@ -356,7 +370,8 @@ const extractParts = async ({ archive, source, rootName, startIndex, startTableI
 			container,
 			source,
 			startIndex: nextIndex,
-			startTableIndex: startTableIndex + tableCount
+			startTableIndex: startTableIndex + tableCount,
+			budget
 		});
 		for (const paragraph of result.paragraphs) paragraphs.push(paragraph);
 		charCount += result.charCount;
@@ -427,19 +442,22 @@ const extractDocxText = async (bytes) => {
 	const body = findDeep(root, "w", "body");
 	if (!body) return createEmptyResult();
 	const referencedParts = await resolveReferencedHeaderFooterParts(archive, root);
+	const budget = createCharBudget();
 	const headers = await extractParts({
 		archive,
 		source: "header",
 		rootName: "hdr",
 		startIndex: 0,
 		startTableIndex: 0,
-		paths: referencedParts.headers
+		paths: referencedParts.headers,
+		budget
 	});
 	const bodyResult = extractContainer({
 		container: body,
 		source: "body",
 		startIndex: headers.paragraphs.length,
-		startTableIndex: headers.tableCount
+		startTableIndex: headers.tableCount,
+		budget
 	});
 	const footers = await extractParts({
 		archive,
@@ -447,7 +465,8 @@ const extractDocxText = async (bytes) => {
 		rootName: "ftr",
 		startIndex: headers.paragraphs.length + bodyResult.paragraphs.length,
 		startTableIndex: headers.tableCount + bodyResult.tableCount,
-		paths: referencedParts.footers
+		paths: referencedParts.footers,
+		budget
 	});
 	return {
 		paragraphs: [

package/dist/docx/styleParser.js

@@ -1,3 +1,4 @@
+import { isValidHexColor } from "../utils/colorResolver.js";
 import { mergeParagraphFormatting } from "../utils/paragraphFormattingMerge.js";
 import { mergeTextFormatting } from "../utils/textFormattingMerge.js";
 import { BorderStyleSchema, ConditionalStyleTypeSchema, EmphasisMarkSchema, FontHintSchema, FontThemeSchema, HighlightColorSchema, LineSpacingRuleSchema, ParagraphAlignmentSchema, ShadingPatternSchema, StyleTypeSchema, TabLeaderSchema, TabStopAlignmentSchema, TableCellTextDirectionSchema, TableRowHeightRuleSchema, TableWidthTypeSchema, TextEffectSchema, ThemeColorSlotSchema, UnderlineStyleSchema, narrowEnum } from "./parserEnums.js";
@@ -86,7 +87,7 @@ function parseRunProperties(rPr, theme) {
 				if (resolved) fontFamily.ascii = resolved;
 			}
 		}
-		const hAnsiTheme = getAttribute(rFonts, "w", "hAnsiTheme");
+		const hAnsiTheme = narrowEnum(getAttribute(rFonts, "w", "hAnsiTheme"), FontThemeSchema);
 		if (hAnsiTheme) {
 			fontFamily.hAnsiTheme = hAnsiTheme;
 			if (theme && !fontFamily.hAnsi) {
@@ -94,7 +95,7 @@ function parseRunProperties(rPr, theme) {
 				if (resolved) fontFamily.hAnsi = resolved;
 			}
 		}
-		const eastAsiaTheme = getAttribute(rFonts, "w", "eastAsiaTheme");
+		const eastAsiaTheme = narrowEnum(getAttribute(rFonts, "w", "eastAsiaTheme"), FontThemeSchema);
 		if (eastAsiaTheme) {
 			fontFamily.eastAsiaTheme = eastAsiaTheme;
 			if (theme && !fontFamily.eastAsia) {
@@ -102,7 +103,7 @@ function parseRunProperties(rPr, theme) {
 				if (resolved) fontFamily.eastAsia = resolved;
 			}
 		}
-		const csTheme = getAttribute(rFonts, "w", "cstheme");
+		const csTheme = narrowEnum(getAttribute(rFonts, "w", "cstheme"), FontThemeSchema);
 		if (csTheme) {
 			fontFamily.csTheme = csTheme;
 			if (theme && !fontFamily.cs) {
@@ -192,9 +193,9 @@ function parseShadingProperties(shd) {
 	if (!shd) return;
 	const props = {};
 	const color = getAttribute(shd, "w", "color");
-	if (color && color !== "auto") props.color = { rgb: color };
+	if (color && color !== "auto" && isValidHexColor(color)) props.color = { rgb: color };
 	const fill = getAttribute(shd, "w", "fill");
-	if (fill && fill !== "auto") props.fill = { rgb: fill };
+	if (fill && fill !== "auto" && isValidHexColor(fill)) props.fill = { rgb: fill };
 	const validatedThemeFill = narrowEnum(getAttribute(shd, "w", "themeFill"), ThemeColorSlotSchema);
 	if (validatedThemeFill) {
 		if (!props.fill) props.fill = {};

package/dist/docx/unzip.js

@@ -1,6 +1,6 @@
 import { DOCX_CONTAINER_TYPES, detectDocxContainerType } from "./encryption/containerFormat.js";
 import { openDocxBuffer } from "./encryption/openEncryptedDocx.js";
-import { FOLIO_XML_RESOURCE_LIMITS } from "./xmlResourceLimits.js";
+import { FOLIO_XML_RESOURCE_LIMITS, assertXmlResourceLimits } from "./xmlResourceLimits.js";
 import JSZip from "jszip";
 //#region src/docx/unzip.ts
 /**
@@ -191,7 +191,7 @@ async function unzipDocx(buffer, options = {}) {
 	for (const extracted of await Promise.all(extractionTasks.map((extract) => extract()))) {
 		if (!extracted) continue;
 		if (extracted.type === "xml") {
-			assignXmlContent(content, extracted);
+			assignXmlContent(content, extracted, limits);
 			continue;
 		}
 		if (extracted.type === "media") {
@@ -202,7 +202,21 @@ async function unzipDocx(buffer, options = {}) {
 	}
 	return content;
 }
-function assignXmlContent(content, { path, lowerPath, content: xmlContent }) {
+/**
+* Parts that every consumer expands into an object tree. Preflighting them once
+* here puts the bound on the unzip, so `parseDocx`, the selective save and the
+* repack path all share it instead of each entry point carrying its own.
+*/
+const PREFLIGHT_XML_PARTS = /* @__PURE__ */ new Set([
+	"word/document.xml",
+	"word/styles.xml",
+	"word/numbering.xml"
+]);
+function assignXmlContent(content, { path, lowerPath, content: xmlContent }, limits) {
+	if (PREFLIGHT_XML_PARTS.has(lowerPath)) assertXmlResourceLimits(xmlContent, {
+		...FOLIO_XML_RESOURCE_LIMITS,
+		maxBytes: limits.maxXmlBytes
+	});
 	content.allXml.set(path, xmlContent);
 	if (lowerPath === "word/document.xml") content.documentXml = xmlContent;
 	else if (lowerPath === "word/styles.xml") content.stylesXml = xmlContent;

package/dist/docx/xmlParser.js

@@ -610,6 +610,24 @@ function findAllDeep(root, namespace, localName) {
 */
 const MAX_XMLNS_DECLARATIONS_PER_ELEMENT = 64;
 /**
+* Sanity cap on one declaration's value. Namespace URIs are short; a longer
+* binding is dropped rather than replayed onto every captured subtree that
+* inherits from the declaring element.
+*/
+const MAX_XMLNS_VALUE_LENGTH = 512;
+/**
+* Sanity cap on an accumulated declaration set. Applied both when collecting one
+* element's declarations and when merging down the ancestor chain, so every set
+* this module produces or returns is bounded and a captured `w:pict` subtree
+* replays at most this much regardless of how the chain was built.
+*/
+const MAX_XMLNS_DECLARATION_CHARS = 8192;
+const xmlnsDeclarationChars = (declarations) => {
+	let chars = 0;
+	for (const [name, value] of Object.entries(declarations)) chars += name.length + value.length;
+	return chars;
+};
+/**
 * Collect every `xmlns` / `xmlns:*` declaration from an element's attributes.
 *
 * The serializer's hard-coded root namespaces only cover canonical prefixes
@@ -623,13 +641,18 @@ function collectXmlnsDeclarations(element) {
 	const attrs = element.attributes;
 	if (!attrs) return out;
 	let declarationCount = 0;
+	let declarationChars = 0;
 	for (const key in attrs) {
 		if (declarationCount >= MAX_XMLNS_DECLARATIONS_PER_ELEMENT) break;
 		const value = attrs[key];
-		if ((key === "xmlns" || key.startsWith("xmlns:")) && value !== void 0) {
-			out[key] = String(value);
-			declarationCount += 1;
-		}
+		if (key !== "xmlns" && !key.startsWith("xmlns:")) continue;
+		if (value === void 0) continue;
+		const declaration = String(value);
+		if (declaration.length > MAX_XMLNS_VALUE_LENGTH) continue;
+		if (declarationChars + key.length + declaration.length > MAX_XMLNS_DECLARATION_CHARS) break;
+		out[key] = declaration;
+		declarationCount += 1;
+		declarationChars += key.length + declaration.length;
 	}
 	return out;
 }
@@ -643,10 +666,13 @@ function collectXmlnsDeclarations(element) {
 */
 function mergeXmlnsDeclarations(inherited, element) {
 	const own = collectXmlnsDeclarations(element);
-	for (const _key in own) return {
-		...inherited,
-		...own
-	};
+	for (const _key in own) {
+		const merged = {
+			...inherited,
+			...own
+		};
+		return xmlnsDeclarationChars(merged) > MAX_XMLNS_DECLARATION_CHARS ? inherited : merged;
+	}
 	return inherited;
 }
 const QNAME_VALUE_ATTRIBUTES = /* @__PURE__ */ new Set([

package/dist/layout-painter/renderParagraph.js

@@ -15,6 +15,7 @@ import { resolvePhysicalParagraphInlineLayout } from "../utils/paragraphInlineLa
 import { inlineImageBoundingBox, parseRotationDegrees, rotatedBoundingBox } from "../utils/rotationBoundingBox.js";
 import { applySanitizedImageSrc } from "../utils/sanitizeImageSrc.js";
 import { SCRIPT_CLASS, hasCjk, hasComplexScript, segmentByScript } from "../utils/scriptSegments.js";
+import { sanitizeExternalUrl } from "../utils/urlSecurity.js";
 import { borderStrokeToCss, resolveParagraphBorderHorizontalOutsets } from "./borderStroke.js";
 import { planCursiveJoiners, withCursiveJoiners } from "./cursiveJoiners.js";
 import { getAutomaticTextColorForBackground } from "./documentColors.js";
@@ -114,6 +115,12 @@ const DEFAULT_BLACK_TEXT_COLOR_VALUES = /* @__PURE__ */ new Set(["000000", "000"
 const SUGGESTION_COLOR_CSS = "var(--suggestion-color, #6d3bd6)";
 const SUGGESTION_TINT_CSS = "var(--suggestion-bg, color-mix(in oklch, #6d3bd6 12%, transparent))";
 const SUGGESTION_TINT_LAYER_CSS = `linear-gradient(${SUGGESTION_TINT_CSS}, ${SUGGESTION_TINT_CSS})`;
+const RUN_BACKGROUND_TEXT_COLOR_VAR = "--doc-run-background-text-color";
+const setRunBackgroundTextColor = (element, color) => {
+	element.classList.add("docx-run-background-text");
+	element.style.setProperty(RUN_BACKGROUND_TEXT_COLOR_VAR, color);
+};
+const hasRunBackgroundTextSurface = (run) => Boolean(run.highlight ?? run.shading) && !run.isInsertion && !run.isDeletion && !(run.commentIds !== void 0 && run.commentIds.length > 0);
 function normalizeTextColorValue(color) {
 	return color.trim().toLowerCase().replace(/^#/u, "");
 }
@@ -205,6 +212,8 @@ function applyRunStyles(element, run) {
 		const hasCommentHighlight = run.commentIds !== void 0 && run.commentIds.length > 0;
 		const automaticTextColor = hasExplicitTextColor || hasTrackedChangeColor || hasCommentHighlight ? void 0 : getAutomaticTextColorForBackground(runBackground);
 		if (automaticTextColor) element.style.color = automaticTextColor;
+		const backgroundTextColor = hasExplicitTextColor ? textColor : automaticTextColor;
+		if (backgroundTextColor && hasRunBackgroundTextSurface(run)) setRunBackgroundTextColor(element, backgroundTextColor);
 	}
 	const decorations = [];
 	let explicitDecorationStyle = false;
@@ -315,11 +324,13 @@ function renderTextRun(run, doc, hyperlinkDirection) {
 	applyRunStyles(span, run);
 	applyPmPositions(span, run.pmStart, run.pmEnd);
 	const paintedText = toPaintedText(run.text);
-	if (run.hyperlink) {
+	const isBookmarkTarget = run.hyperlink?.href.startsWith("#") === true;
+	const hyperlinkHref = resolveHyperlinkHref(run.hyperlink?.href, isBookmarkTarget);
+	if (run.hyperlink && hyperlinkHref !== void 0) {
 		const anchor = doc.createElement("a");
-		anchor.href = run.hyperlink.href;
+		anchor.href = hyperlinkHref;
 		if (hyperlinkDirection || DISPLAYED_URL_PATTERN.test(paintedText.trim())) anchor.dir = LEFT_TO_RIGHT_DIRECTION;
-		if (!run.hyperlink.href.startsWith("#")) {
+		if (!isBookmarkTarget) {
 			anchor.target = "_blank";
 			anchor.rel = "noopener noreferrer";
 		}
@@ -332,12 +343,27 @@ function renderTextRun(run, doc, hyperlinkDirection) {
 			span.style.color = hyperlinkColor;
 			anchor.style.setProperty("--doc-run-color", hyperlinkColor);
 			span.style.setProperty("--doc-run-color", hyperlinkColor);
+			if (hasRunBackgroundTextSurface(run)) {
+				setRunBackgroundTextColor(span, hyperlinkColor);
+				setRunBackgroundTextColor(anchor, hyperlinkColor);
+			}
 		}
 		span.append(anchor);
 	} else span.textContent = paintedText;
 	applyWhitespaceUnderline(span, run);
 	return span;
 }
+/**
+* Bookmark targets (`#name`) scroll within the document and stay verbatim;
+* every other target is narrowed to the protocols the painter navigates to,
+* matching the image hyperlink path. `undefined` means the run gets no anchor:
+* an empty `href` resolves to the current document, so a rejected target would
+* otherwise stay navigable.
+*/
+function resolveHyperlinkHref(href, isBookmarkTarget) {
+	if (href === void 0) return;
+	return isBookmarkTarget ? href : sanitizeExternalUrl(href);
+}
 function isNoteReferenceRun(run) {
 	return run.footnoteRefId !== void 0 || run.endnoteRefId !== void 0;
 }
@@ -345,11 +371,14 @@ function removeUnderlineTextDecoration(element) {
 	const textDecorationLines = (element.style.textDecorationLine || "").split(/\s+/u).filter((line) => line && line !== "underline");
 	element.style.textDecorationLine = textDecorationLines.join(" ");
 }
+function applyContinuousUnderline(element, underline) {
+	removeUnderlineTextDecoration(element);
+	const color = typeof underline === "object" && underline.color ? underline.color : "currentColor";
+	element.style.boxShadow = `inset 0 -1px 0 ${color}`;
+}
 function applyWhitespaceUnderline(element, run) {
 	if (!run.underline || run.text.trim().length > 0) return;
-	removeUnderlineTextDecoration(element);
-	element.style.borderBottom = "1px solid currentColor";
-	if (typeof run.underline === "object" && run.underline.color) element.style.borderBottomColor = run.underline.color;
+	applyContinuousUnderline(element, run.underline);
 }
 /**
 * Number of leader characters to fill the tab's inner span. The inner span
@@ -401,9 +430,7 @@ function canClampTabToRightEdge(alignment, hasPriorRenderedContent, hasPriorTab,
 }
 function applyTabUnderline(element, run) {
 	if (!run.underline) return;
-	removeUnderlineTextDecoration(element);
-	element.style.borderBottom = "1px solid currentColor";
-	if (typeof run.underline === "object" && run.underline.color) element.style.borderBottomColor = run.underline.color;
+	applyContinuousUnderline(element, run.underline);
 }
 /**
 * Get leader character for tab

package/dist/prosemirror/conversion/fromProseDoc.js

@@ -1845,10 +1845,11 @@ function tableCellAttrsToFormatting(attrs) {
 		if (attrs.rowspan > 1) result.vMerge = "restart";
 		else if (result.vMerge === "restart" && !attrs._preserveVMergeRestart) delete result.vMerge;
 		const cellWidth = attrs.width;
-		if (cellWidth !== void 0) result.width = {
+		if (typeof cellWidth === "number") result.width = {
 			value: cellWidth,
 			type: attrs.widthType ?? "dxa"
 		};
+		else delete result.width;
 		if (attrs.verticalAlign !== (orig.verticalAlign ?? void 0)) if (attrs.verticalAlign) result.verticalAlign = attrs.verticalAlign;
 		else delete result.verticalAlign;
 		if (backgroundChanged) result.shading = cellShadingFromAttrs(attrs);
@@ -1859,11 +1860,11 @@ function tableCellAttrsToFormatting(attrs) {
 		return result;
 	}
 	const cellWidth = attrs.width;
-	if (!(attrs.colspan > 1 || attrs.rowspan > 1 || cellWidth !== void 0 || attrs.verticalAlign || backgroundChanged || attrs.borders || attrs.margins || attrs.textDirection)) return;
+	if (!(attrs.colspan > 1 || attrs.rowspan > 1 || typeof cellWidth === "number" || attrs.verticalAlign || backgroundChanged || attrs.borders || attrs.margins || attrs.textDirection)) return;
 	const f = {};
 	if (attrs.colspan > 1) f.gridSpan = attrs.colspan;
 	if (attrs.rowspan > 1) f.vMerge = "restart";
-	if (cellWidth !== void 0) f.width = {
+	if (typeof cellWidth === "number") f.width = {
 		value: cellWidth,
 		type: attrs.widthType ?? "dxa"
 	};

package/dist/utils/headerFooter.js

@@ -185,23 +185,11 @@ const createEmptyHeaderFooter = (document, position, isFirstPage) => {
 		type: hdrFtrType,
 		rId
 	};
-	const usedTargets = /* @__PURE__ */ new Set();
-	for (const relationship of pkg.relationships?.values() ?? []) if (relationship.target) usedTargets.add(relationship.target);
-	let targetNumber = 1;
-	while (usedTargets.has(`${position}${targetNumber}.xml`)) targetNumber++;
-	const relationshipType = position === "header" ? "http://schemas.openxmlformats.org/officeDocument/2006/relationships/header" : "http://schemas.openxmlformats.org/officeDocument/2006/relationships/footer";
-	const relationships = new Map(pkg.relationships);
-	relationships.set(rId, {
-		id: rId,
-		type: relationshipType,
-		target: `${position}${targetNumber}.xml`
-	});
 	return {
 		...document,
 		package: {
 			...pkg,
 			[mapKey]: newMap,
-			relationships,
 			document: {
 				...pkg.document,
 				finalSectionProperties: {

package/dist/utils/tiffConverter.d.ts

@@ -8,11 +8,20 @@
  * back to the raw TIFF data URL, which won't render in browsers but is
  * fine for headless round-trips.
  */
+/**
+ * Budget shared by every TIFF in one package. The per-image cap bounds a single
+ * decode; without a running total a package of many large TIFFs still adds up.
+ * Callers pass what is left of the budget and subtract the pixels each
+ * conversion reports.
+ */
+declare const MAX_PACKAGE_TIFF_PIXELS = 256000000;
 declare function isTiffMimeType(mimeType: string): boolean;
 type ConvertedTiff = {
   dataUrl: string;
   data: ArrayBuffer;
+  /** Pixels decoded, so callers can draw down a package-wide budget. */
+  pixels: number;
 };
-declare function convertTiffToPngDataUrl(tiffData: ArrayBuffer): Promise<ConvertedTiff | null>;
+declare function convertTiffToPngDataUrl(tiffData: ArrayBuffer, maxPixels?: number): Promise<ConvertedTiff | null>;
 //#endregion
-export { ConvertedTiff, convertTiffToPngDataUrl, isTiffMimeType };
+export { ConvertedTiff, MAX_PACKAGE_TIFF_PIXELS, convertTiffToPngDataUrl, isTiffMimeType };

package/dist/utils/tiffConverter.js

@@ -16,11 +16,18 @@
 * RGBA buffer, which would otherwise hang or OOM the tab.
 */
 const MAX_TIFF_PIXELS = 64e6;
+/**
+* Budget shared by every TIFF in one package. The per-image cap bounds a single
+* decode; without a running total a package of many large TIFFs still adds up.
+* Callers pass what is left of the budget and subtract the pixels each
+* conversion reports.
+*/
+const MAX_PACKAGE_TIFF_PIXELS = 256e6;
 function isTiffMimeType(mimeType) {
 	const lower = mimeType.toLowerCase();
 	return lower === "image/tiff" || lower === "image/tif";
 }
-async function convertTiffToPngDataUrl(tiffData) {
+async function convertTiffToPngDataUrl(tiffData, maxPixels = MAX_TIFF_PIXELS) {
 	if (typeof document === "undefined" || typeof document.createElement !== "function") return null;
 	try {
 		const UTIF = await import("utif2");
@@ -29,7 +36,7 @@ async function convertTiffToPngDataUrl(tiffData) {
 		const declaredWidth = readTiffTagNumber(firstImage["t256"]);
 		const declaredHeight = readTiffTagNumber(firstImage["t257"]);
 		if (!declaredWidth || !declaredHeight) return null;
-		if (declaredWidth * declaredHeight > MAX_TIFF_PIXELS) return null;
+		if (declaredWidth * declaredHeight > Math.min(maxPixels, MAX_TIFF_PIXELS)) return null;
 		UTIF.decodeImage(tiffData, firstImage);
 		const rgba = UTIF.toRGBA8(firstImage);
 		if (rgba.length === 0) return null;
@@ -50,7 +57,8 @@ async function convertTiffToPngDataUrl(tiffData) {
 		if (!data) return null;
 		return {
 			dataUrl,
-			data
+			data,
+			pixels: width * height
 		};
 	} catch {
 		return null;
@@ -80,4 +88,4 @@ function dataUrlToArrayBuffer(dataUrl) {
 	}
 }
 //#endregion
-export { convertTiffToPngDataUrl, isTiffMimeType };
+export { MAX_PACKAGE_TIFF_PIXELS, convertTiffToPngDataUrl, isTiffMimeType };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stll/folio-core",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "Headless, framework-neutral core of folio: the OOXML (.docx) parser, document model, ProseMirror integration, and page-layout engine. No React.",
   "keywords": [
     "document-model",