@stll/folio-core 0.27.0 → 0.28.0

package/dist/docx/server/extractDocxText.js

@@ -1,9 +1,10 @@
 import { escapeTableCell } from "../../markdown/escape.js";
 import { RELATIONSHIP_TYPES, parseRelationships } from "../relsParser.js";
 import { findAllDeep, findDeep, getAttribute, getAttributeByNamespaceUri, getLocalName, getNamespaceUri, getTextContent, parseXml } from "../xmlParser.js";
-import { loadDocxArchive } from "./boundedArchive.js";
+import { DocxArchiveError, loadDocxArchive } from "./boundedArchive.js";
 //#region src/docx/server/extractDocxText.ts
 const DOCUMENT_RELS_PATH = "word/_rels/document.xml.rels";
+const ARCHIVE_LIMIT_REASON = "total-too-large";
 const WORDPROCESSINGML_NAMESPACES = /* @__PURE__ */ new Set(["http://schemas.openxmlformats.org/wordprocessingml/2006/main", "http://purl.oclc.org/ooxml/wordprocessingml/main"]);
 const childElements = (element) => element.elements?.filter((child) => child.type === "element") ?? [];
 const wordElementName = (element) => WORDPROCESSINGML_NAMESPACES.has(getNamespaceUri(element) ?? "") ? getLocalName(element.name) : null;
@@ -103,18 +104,42 @@ const NESTED_TABLE_CELL_SEPARATOR = " / ";
 const MAX_TABLE_COLUMNS = 256;
 /** Bound the mutual recursion between a cell and the tables nested inside it. */
 const MAX_NESTED_TABLE_DEPTH = 8;
+/** Rows collected from one `w:tbl`. The column cap alone leaves row count unbounded. */
+const MAX_TABLE_ROWS = 8192;
+/** Source and rendered characters retained across every table in one extraction. */
+const MAX_TABLE_CHARACTERS = 8 * 1024 * 1024;
+const createTableExtractionBudget = () => ({
+	remainingSourceCharacters: MAX_TABLE_CHARACTERS,
+	remainingRenderedCharacters: MAX_TABLE_CHARACTERS
+});
+const chargeTableCharacters = ({ budget, characters, kind }) => {
+	if (characters > (kind === "source" ? budget.remainingSourceCharacters : budget.remainingRenderedCharacters)) throw new DocxArchiveError({
+		message: `Extracted DOCX table ${kind} text exceeded the ${MAX_TABLE_CHARACTERS}-character limit`,
+		reason: ARCHIVE_LIMIT_REASON
+	});
+	if (kind === "source") {
+		budget.remainingSourceCharacters -= characters;
+		return;
+	}
+	budget.remainingRenderedCharacters -= characters;
+};
 /**
-* Collect a table's `w:tr`, or a row's `w:tc`, seeing through the wrappers Word
-* puts around them (`w:sdt` / `w:sdtContent` content controls, `w:customXml`).
-* The walk stops at `w:tbl` and `w:p` so a nested table's rows and cells never
-* leak into the grid of the table that contains them.
+* Characters one extraction emits, shared by the body and every header/footer
+* part. Element count is bounded at unzip, but a bounded element count still
+* renders an unbounded number of table rows once `w:gridSpan` padding and the
+* GFM scaffolding are counted, so the emitted side carries its own ceiling.
 */
-const collectTableParts = (parent, localName) => {
+const MAX_EXTRACTED_CHARS = 8e6;
+const collectTableParts = ({ parent, localName, limit }) => {
 	const parts = [];
 	const walk = (node) => {
 		for (const child of childElements(node)) {
 			const childName = wordElementName(child);
 			if (childName === localName) {
+				if (parts.length >= limit) throw new DocxArchiveError({
+					message: `Extracted DOCX table exceeded the ${limit}-${localName} limit`,
+					reason: ARCHIVE_LIMIT_REASON
+				});
 				parts.push(child);
 				continue;
 			}
@@ -142,7 +167,15 @@ const readCellSourceParagraphs = (cell, depth) => {
 			}
 			if (childName === "tbl") {
 				if (depth >= MAX_NESTED_TABLE_DEPTH) continue;
-				for (const row of collectTableParts(child, "tr")) for (const nestedCell of collectTableParts(row, "tc")) for (const paragraph of readCellSourceParagraphs(nestedCell, depth + 1)) paragraphs.push(paragraph);
+				for (const row of collectTableParts({
+					parent: child,
+					localName: "tr",
+					limit: MAX_TABLE_ROWS
+				})) for (const nestedCell of collectTableParts({
+					parent: row,
+					localName: "tc",
+					limit: MAX_TABLE_COLUMNS
+				})) for (const paragraph of readCellSourceParagraphs(nestedCell, depth + 1)) paragraphs.push(paragraph);
 				continue;
 			}
 			walk(child);
@@ -151,18 +184,26 @@ const readCellSourceParagraphs = (cell, depth) => {
 	walk(cell);
 	return paragraphs;
 };
-const readCellRenderedLines = (cell, depth) => {
+const readCellRenderedLines = (cell, { depth, budget }) => {
 	const lines = [];
 	const walk = (node) => {
 		for (const child of childElements(node)) {
 			const childName = wordElementName(child);
 			if (childName === "p") {
 				const text = collectText(child);
+				chargeTableCharacters({
+					budget,
+					characters: text.length,
+					kind: "source"
+				});
 				if (text.length > 0) lines.push(text);
 				continue;
 			}
 			if (childName === "tbl") {
-				if (depth < MAX_NESTED_TABLE_DEPTH) for (const line of flattenNestedTable(child, depth + 1)) lines.push(line);
+				if (depth < MAX_NESTED_TABLE_DEPTH) for (const line of flattenNestedTable(child, {
+					depth: depth + 1,
+					budget
+				})) lines.push(line);
 				continue;
 			}
 			walk(child);
@@ -171,10 +212,21 @@ const readCellRenderedLines = (cell, depth) => {
 	walk(cell);
 	return lines;
 };
-const flattenNestedTable = (table, depth) => {
+const flattenNestedTable = (table, { depth, budget }) => {
 	const lines = [];
-	for (const row of collectTableParts(table, "tr")) {
-		const cells = collectTableParts(row, "tc").map((cell) => readCellRenderedLines(cell, depth).join("\n"));
+	for (const row of collectTableParts({
+		parent: table,
+		localName: "tr",
+		limit: MAX_TABLE_ROWS
+	})) {
+		const cells = collectTableParts({
+			parent: row,
+			localName: "tc",
+			limit: MAX_TABLE_COLUMNS
+		}).map((cell) => readCellRenderedLines(cell, {
+			depth,
+			budget
+		}).join("\n"));
 		if (cells.some((text) => text.length > 0)) lines.push(cells.join(NESTED_TABLE_CELL_SEPARATOR));
 	}
 	return lines;
@@ -184,7 +236,7 @@ const emptyTableCell = () => ({
 	paragraphs: [],
 	gridSpan: 1
 });
-const readTableCell = (cell, depth) => {
+const readTableCell = (cell, { depth, budget }) => {
 	const properties = findWordChild(cell, "tcPr");
 	const gridSpanValue = getWordAttribute(findWordChild(properties, "gridSpan"), "val");
 	const parsedGridSpan = gridSpanValue === null ? 1 : Number.parseInt(gridSpanValue, 10);
@@ -195,10 +247,12 @@ const readTableCell = (cell, depth) => {
 		paragraphs: [],
 		gridSpan
 	};
-	const paragraphs = readCellSourceParagraphs(cell, depth);
 	return {
-		text: readCellRenderedLines(cell, depth).join("\n"),
-		paragraphs,
+		text: readCellRenderedLines(cell, {
+			depth,
+			budget
+		}).join("\n"),
+		paragraphs: readCellSourceParagraphs(cell, depth),
 		gridSpan
 	};
 };
@@ -225,18 +279,29 @@ const readRowGridOffset = (row, localName) => {
 	const parsed = value === null ? 0 : Number.parseInt(value, 10);
 	return Number.isFinite(parsed) && parsed > 0 ? Math.min(parsed, MAX_TABLE_COLUMNS) : 0;
 };
-const readTableGrid = (table) => {
+const readTableGrid = (table, budget) => {
 	const rows = [];
 	let columnCount = 0;
 	let firstRowIsHeader = false;
-	for (const [rowIndex, row] of collectTableParts(table, "tr").entries()) {
+	for (const [rowIndex, row] of collectTableParts({
+		parent: table,
+		localName: "tr",
+		limit: MAX_TABLE_ROWS
+	}).entries()) {
 		if (rowIndex === 0) firstRowIsHeader = declaresHeaderRow(row);
 		const columns = [];
 		const gridBefore = readRowGridOffset(row, "gridBefore");
 		for (let index = 0; index < gridBefore; index += 1) columns.push(emptyTableCell());
-		for (const cell of collectTableParts(row, "tc")) {
+		for (const cell of collectTableParts({
+			parent: row,
+			localName: "tc",
+			limit: MAX_TABLE_COLUMNS
+		})) {
 			if (columns.length >= MAX_TABLE_COLUMNS) break;
-			const extractedCell = readTableCell(cell, 0);
+			const extractedCell = readTableCell(cell, {
+				depth: 0,
+				budget
+			});
 			columns.push(extractedCell);
 			const padding = Math.min(extractedCell.gridSpan - 1, MAX_TABLE_COLUMNS - columns.length);
 			for (let index = 0; index < padding; index++) columns.push(emptyTableCell());
@@ -259,12 +324,17 @@ const toRowLine = (columns, columnCount) => {
 	return `| ${cells.join(" | ")} |`;
 };
 /** Render a `w:tbl` as GFM rows. A table with no cell at all renders nothing. */
-const renderTableRows = (table, tableIndex) => {
-	const { rows, columnCount, firstRowIsHeader } = readTableGrid(table);
+const renderTableRows = ({ table, tableIndex, budget }) => {
+	const { rows, columnCount, firstRowIsHeader } = readTableGrid(table, budget);
 	const [firstRow, ...remainingRows] = rows;
 	if (columnCount === 0 || firstRow === void 0) return [];
 	const rendered = [];
 	const pushScaffolding = (text, kind) => {
+		chargeTableCharacters({
+			budget,
+			characters: text.length,
+			kind: "rendered"
+		});
 		rendered.push({
 			text,
 			position: {
@@ -274,8 +344,14 @@ const renderTableRows = (table, tableIndex) => {
 		});
 	};
 	const pushCells = (cells) => {
+		const text = toRowLine(cells, columnCount);
+		chargeTableCharacters({
+			budget,
+			characters: text.length,
+			kind: "rendered"
+		});
 		rendered.push({
-			text: toRowLine(cells, columnCount),
+			text,
 			position: {
 				table: tableIndex,
 				kind: "cells",
@@ -293,7 +369,8 @@ const renderTableRows = (table, tableIndex) => {
 	for (const row of firstRowIsHeader ? remainingRows : rows) pushCells(row);
 	return rendered;
 };
-const extractContainer = ({ container, source, startIndex, startTableIndex }) => {
+const createCharBudget = () => ({ remaining: MAX_EXTRACTED_CHARS });
+const extractContainer = ({ container, source, startIndex, startTableIndex, budget, tableBudget }) => {
 	const paragraphs = [];
 	let charCount = 0;
 	let tableCount = 0;
@@ -307,6 +384,7 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 		};
 		paragraphs.push(entry);
 		charCount += text.length;
+		budget.remaining -= text.length;
 	};
 	const pushTableRow = ({ text, position }) => {
 		paragraphs.push({
@@ -316,6 +394,7 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 			tableRow: position
 		});
 		charCount += text.length;
+		budget.remaining -= text.length;
 	};
 	/**
 	* Walk block content in document order. Descent mirrors the previous
@@ -325,9 +404,14 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 	*/
 	const walkBlocks = (node) => {
 		for (const child of childElements(node)) {
+			if (budget.remaining <= 0) return;
 			const childName = wordElementName(child);
 			if (childName === "tbl") {
-				for (const row of renderTableRows(child, startTableIndex + tableCount)) pushTableRow(row);
+				for (const row of renderTableRows({
+					table: child,
+					tableIndex: startTableIndex + tableCount,
+					budget: tableBudget
+				})) pushTableRow(row);
 				tableCount += 1;
 				continue;
 			}
@@ -342,7 +426,7 @@ const extractContainer = ({ container, source, startIndex, startTableIndex }) =>
 		tableCount
 	};
 };
-const extractParts = async ({ archive, source, rootName, startIndex, startTableIndex, paths }) => {
+const extractParts = async ({ archive, source, rootName, startIndex, startTableIndex, paths, budget, tableBudget }) => {
 	const paragraphs = [];
 	let charCount = 0;
 	let tableCount = 0;
@@ -356,7 +440,9 @@ const extractParts = async ({ archive, source, rootName, startIndex, startTableI
 			container,
 			source,
 			startIndex: nextIndex,
-			startTableIndex: startTableIndex + tableCount
+			startTableIndex: startTableIndex + tableCount,
+			budget,
+			tableBudget
 		});
 		for (const paragraph of result.paragraphs) paragraphs.push(paragraph);
 		charCount += result.charCount;
@@ -427,19 +513,25 @@ const extractDocxText = async (bytes) => {
 	const body = findDeep(root, "w", "body");
 	if (!body) return createEmptyResult();
 	const referencedParts = await resolveReferencedHeaderFooterParts(archive, root);
+	const budget = createCharBudget();
+	const tableBudget = createTableExtractionBudget();
 	const headers = await extractParts({
 		archive,
 		source: "header",
 		rootName: "hdr",
 		startIndex: 0,
 		startTableIndex: 0,
-		paths: referencedParts.headers
+		paths: referencedParts.headers,
+		budget,
+		tableBudget
 	});
 	const bodyResult = extractContainer({
 		container: body,
 		source: "body",
 		startIndex: headers.paragraphs.length,
-		startTableIndex: headers.tableCount
+		startTableIndex: headers.tableCount,
+		budget,
+		tableBudget
 	});
 	const footers = await extractParts({
 		archive,
@@ -447,7 +539,9 @@ const extractDocxText = async (bytes) => {
 		rootName: "ftr",
 		startIndex: headers.paragraphs.length + bodyResult.paragraphs.length,
 		startTableIndex: headers.tableCount + bodyResult.tableCount,
-		paths: referencedParts.footers
+		paths: referencedParts.footers,
+		budget,
+		tableBudget
 	});
 	return {
 		paragraphs: [

package/dist/docx/server/materializeYjsDocx.d.ts

@@ -0,0 +1,31 @@
+//#region src/docx/server/materializeYjsDocx.d.ts
+/** Yjs fragment that stores Folio's canonical ProseMirror document. */
+declare const FOLIO_YJS_PROSEMIRROR_FRAGMENT_NAME = "prosemirror";
+/** Maximum accepted size of a complete Yjs collaboration state update. */
+declare const FOLIO_YJS_UPDATE_MAX_BYTES: number;
+/** Stable failure codes returned by server-side Yjs-to-DOCX materialization. */
+declare const FOLIO_YJS_DOCX_MATERIALIZATION_ERROR_CODES: readonly ["empty_update", "invalid_update", "missing_document", "update_too_large"];
+/** Failure code for a rejected Yjs-to-DOCX materialization request. */
+type FolioYjsDocxMaterializationErrorCode = (typeof FOLIO_YJS_DOCX_MATERIALIZATION_ERROR_CODES)[number];
+declare const FolioYjsDocxMaterializationError_base: import("better-result").TaggedErrorClass<"FolioYjsDocxMaterializationError">;
+/** Typed failure raised when a collaboration snapshot cannot be materialized. */
+declare class FolioYjsDocxMaterializationError extends FolioYjsDocxMaterializationError_base<{
+  code: FolioYjsDocxMaterializationErrorCode;
+  message: string;
+  cause?: unknown;
+}> {}
+/** Inputs for materializing a complete Yjs state update into a DOCX package. */
+type MaterializeYjsDocxOptions = {
+  /** Original DOCX whose package parts and non-body stories must be preserved. */
+  sourceDocx: ArrayBuffer | Uint8Array;
+  /** Complete Yjs state update containing Folio's ProseMirror fragment. */
+  yjsUpdate: Uint8Array;
+};
+/**
+ * Materialize a complete Folio Yjs state update into a DOCX while preserving
+ * package parts from the source document. This is the server-side equivalent
+ * of the browser editor's full save path for the main document story.
+ */
+declare const materializeYjsDocx: ({ sourceDocx, yjsUpdate }: MaterializeYjsDocxOptions) => Promise<ArrayBuffer>;
+//#endregion
+export { FOLIO_YJS_DOCX_MATERIALIZATION_ERROR_CODES, FOLIO_YJS_PROSEMIRROR_FRAGMENT_NAME, FOLIO_YJS_UPDATE_MAX_BYTES, FolioYjsDocxMaterializationError, FolioYjsDocxMaterializationErrorCode, MaterializeYjsDocxOptions, materializeYjsDocx };

package/dist/docx/server/materializeYjsDocx.js

@@ -0,0 +1,61 @@
+import { fromProseDoc } from "../../prosemirror/conversion/fromProseDoc.js";
+import { schema } from "../../prosemirror/schema/index.js";
+import { parseDocx } from "../parser.js";
+import { repackDocx } from "../rezip.js";
+import { Result, TaggedError } from "better-result";
+import { initProseMirrorDoc } from "y-prosemirror";
+import * as Y from "yjs";
+//#region src/docx/server/materializeYjsDocx.ts
+/** Yjs fragment that stores Folio's canonical ProseMirror document. */
+const FOLIO_YJS_PROSEMIRROR_FRAGMENT_NAME = "prosemirror";
+/** Maximum accepted size of a complete Yjs collaboration state update. */
+const FOLIO_YJS_UPDATE_MAX_BYTES = 10 * 1024 * 1024;
+/** Stable failure codes returned by server-side Yjs-to-DOCX materialization. */
+const FOLIO_YJS_DOCX_MATERIALIZATION_ERROR_CODES = [
+	"empty_update",
+	"invalid_update",
+	"missing_document",
+	"update_too_large"
+];
+/** Typed failure raised when a collaboration snapshot cannot be materialized. */
+var FolioYjsDocxMaterializationError = class extends TaggedError("FolioYjsDocxMaterializationError") {};
+const readProseMirrorDocument = (yjsUpdate) => {
+	if (yjsUpdate.byteLength === 0) throw new FolioYjsDocxMaterializationError({
+		code: "empty_update",
+		message: "Cannot materialize DOCX from an empty Yjs update."
+	});
+	if (yjsUpdate.byteLength > 10485760) throw new FolioYjsDocxMaterializationError({
+		code: "update_too_large",
+		message: "Yjs update exceeds the DOCX materialization limit."
+	});
+	const ydoc = new Y.Doc();
+	const parsed = Result.try({
+		try: () => {
+			Y.applyUpdate(ydoc, yjsUpdate);
+			const fragment = ydoc.getXmlFragment(FOLIO_YJS_PROSEMIRROR_FRAGMENT_NAME);
+			if (fragment.length === 0) throw new FolioYjsDocxMaterializationError({
+				code: "missing_document",
+				message: "Yjs update does not contain a Folio document."
+			});
+			return initProseMirrorDoc(fragment, schema).doc;
+		},
+		catch: (cause) => cause instanceof FolioYjsDocxMaterializationError ? cause : new FolioYjsDocxMaterializationError({
+			code: "invalid_update",
+			message: "Yjs update is not a valid Folio collaboration snapshot.",
+			cause
+		})
+	});
+	ydoc.destroy();
+	if (parsed.isOk()) return parsed.value;
+	throw parsed.error;
+};
+/**
+* Materialize a complete Folio Yjs state update into a DOCX while preserving
+* package parts from the source document. This is the server-side equivalent
+* of the browser editor's full save path for the main document story.
+*/
+const materializeYjsDocx = async ({ sourceDocx, yjsUpdate }) => {
+	return await repackDocx(fromProseDoc(readProseMirrorDocument(yjsUpdate), await parseDocx(sourceDocx, { preloadFonts: false })));
+};
+//#endregion
+export { FOLIO_YJS_DOCX_MATERIALIZATION_ERROR_CODES, FOLIO_YJS_PROSEMIRROR_FRAGMENT_NAME, FOLIO_YJS_UPDATE_MAX_BYTES, FolioYjsDocxMaterializationError, materializeYjsDocx };

package/dist/docx/styleParser.js

@@ -1,3 +1,4 @@
+import { isValidHexColor } from "../utils/colorResolver.js";
 import { mergeParagraphFormatting } from "../utils/paragraphFormattingMerge.js";
 import { mergeTextFormatting } from "../utils/textFormattingMerge.js";
 import { BorderStyleSchema, ConditionalStyleTypeSchema, EmphasisMarkSchema, FontHintSchema, FontThemeSchema, HighlightColorSchema, LineSpacingRuleSchema, ParagraphAlignmentSchema, ShadingPatternSchema, StyleTypeSchema, TabLeaderSchema, TabStopAlignmentSchema, TableCellTextDirectionSchema, TableRowHeightRuleSchema, TableWidthTypeSchema, TextEffectSchema, ThemeColorSlotSchema, UnderlineStyleSchema, narrowEnum } from "./parserEnums.js";
@@ -86,7 +87,7 @@ function parseRunProperties(rPr, theme) {
 				if (resolved) fontFamily.ascii = resolved;
 			}
 		}
-		const hAnsiTheme = getAttribute(rFonts, "w", "hAnsiTheme");
+		const hAnsiTheme = narrowEnum(getAttribute(rFonts, "w", "hAnsiTheme"), FontThemeSchema);
 		if (hAnsiTheme) {
 			fontFamily.hAnsiTheme = hAnsiTheme;
 			if (theme && !fontFamily.hAnsi) {
@@ -94,7 +95,7 @@ function parseRunProperties(rPr, theme) {
 				if (resolved) fontFamily.hAnsi = resolved;
 			}
 		}
-		const eastAsiaTheme = getAttribute(rFonts, "w", "eastAsiaTheme");
+		const eastAsiaTheme = narrowEnum(getAttribute(rFonts, "w", "eastAsiaTheme"), FontThemeSchema);
 		if (eastAsiaTheme) {
 			fontFamily.eastAsiaTheme = eastAsiaTheme;
 			if (theme && !fontFamily.eastAsia) {
@@ -102,7 +103,7 @@ function parseRunProperties(rPr, theme) {
 				if (resolved) fontFamily.eastAsia = resolved;
 			}
 		}
-		const csTheme = getAttribute(rFonts, "w", "cstheme");
+		const csTheme = narrowEnum(getAttribute(rFonts, "w", "cstheme"), FontThemeSchema);
 		if (csTheme) {
 			fontFamily.csTheme = csTheme;
 			if (theme && !fontFamily.cs) {
@@ -192,9 +193,9 @@ function parseShadingProperties(shd) {
 	if (!shd) return;
 	const props = {};
 	const color = getAttribute(shd, "w", "color");
-	if (color && color !== "auto") props.color = { rgb: color };
+	if (color && color !== "auto" && isValidHexColor(color)) props.color = { rgb: color };
 	const fill = getAttribute(shd, "w", "fill");
-	if (fill && fill !== "auto") props.fill = { rgb: fill };
+	if (fill && fill !== "auto" && isValidHexColor(fill)) props.fill = { rgb: fill };
 	const validatedThemeFill = narrowEnum(getAttribute(shd, "w", "themeFill"), ThemeColorSlotSchema);
 	if (validatedThemeFill) {
 		if (!props.fill) props.fill = {};

package/dist/docx/unzip.js

@@ -1,6 +1,6 @@
 import { DOCX_CONTAINER_TYPES, detectDocxContainerType } from "./encryption/containerFormat.js";
 import { openDocxBuffer } from "./encryption/openEncryptedDocx.js";
-import { FOLIO_XML_RESOURCE_LIMITS } from "./xmlResourceLimits.js";
+import { FOLIO_XML_RESOURCE_LIMITS, assertXmlResourceLimits } from "./xmlResourceLimits.js";
 import JSZip from "jszip";
 //#region src/docx/unzip.ts
 /**
@@ -191,7 +191,7 @@ async function unzipDocx(buffer, options = {}) {
 	for (const extracted of await Promise.all(extractionTasks.map((extract) => extract()))) {
 		if (!extracted) continue;
 		if (extracted.type === "xml") {
-			assignXmlContent(content, extracted);
+			assignXmlContent(content, extracted, limits);
 			continue;
 		}
 		if (extracted.type === "media") {
@@ -202,7 +202,21 @@ async function unzipDocx(buffer, options = {}) {
 	}
 	return content;
 }
-function assignXmlContent(content, { path, lowerPath, content: xmlContent }) {
+/**
+* Parts that every consumer expands into an object tree. Preflighting them once
+* here puts the bound on the unzip, so `parseDocx`, the selective save and the
+* repack path all share it instead of each entry point carrying its own.
+*/
+const PREFLIGHT_XML_PARTS = /* @__PURE__ */ new Set([
+	"word/document.xml",
+	"word/styles.xml",
+	"word/numbering.xml"
+]);
+function assignXmlContent(content, { path, lowerPath, content: xmlContent }, limits) {
+	if (PREFLIGHT_XML_PARTS.has(lowerPath)) assertXmlResourceLimits(xmlContent, {
+		...FOLIO_XML_RESOURCE_LIMITS,
+		maxBytes: limits.maxXmlBytes
+	});
 	content.allXml.set(path, xmlContent);
 	if (lowerPath === "word/document.xml") content.documentXml = xmlContent;
 	else if (lowerPath === "word/styles.xml") content.stylesXml = xmlContent;

package/dist/docx/xmlParser.js

@@ -610,6 +610,24 @@ function findAllDeep(root, namespace, localName) {
 */
 const MAX_XMLNS_DECLARATIONS_PER_ELEMENT = 64;
 /**
+* Sanity cap on one declaration's value. Namespace URIs are short; a longer
+* binding is dropped rather than replayed onto every captured subtree that
+* inherits from the declaring element.
+*/
+const MAX_XMLNS_VALUE_LENGTH = 512;
+/**
+* Sanity cap on an accumulated declaration set. Applied both when collecting one
+* element's declarations and when merging down the ancestor chain, so every set
+* this module produces or returns is bounded and a captured `w:pict` subtree
+* replays at most this much regardless of how the chain was built.
+*/
+const MAX_XMLNS_DECLARATION_CHARS = 8192;
+const xmlnsDeclarationChars = (declarations) => {
+	let chars = 0;
+	for (const [name, value] of Object.entries(declarations)) chars += name.length + value.length;
+	return chars;
+};
+/**
 * Collect every `xmlns` / `xmlns:*` declaration from an element's attributes.
 *
 * The serializer's hard-coded root namespaces only cover canonical prefixes
@@ -623,13 +641,18 @@ function collectXmlnsDeclarations(element) {
 	const attrs = element.attributes;
 	if (!attrs) return out;
 	let declarationCount = 0;
+	let declarationChars = 0;
 	for (const key in attrs) {
 		if (declarationCount >= MAX_XMLNS_DECLARATIONS_PER_ELEMENT) break;
 		const value = attrs[key];
-		if ((key === "xmlns" || key.startsWith("xmlns:")) && value !== void 0) {
-			out[key] = String(value);
-			declarationCount += 1;
-		}
+		if (key !== "xmlns" && !key.startsWith("xmlns:")) continue;
+		if (value === void 0) continue;
+		const declaration = String(value);
+		if (declaration.length > MAX_XMLNS_VALUE_LENGTH) continue;
+		if (declarationChars + key.length + declaration.length > MAX_XMLNS_DECLARATION_CHARS) break;
+		out[key] = declaration;
+		declarationCount += 1;
+		declarationChars += key.length + declaration.length;
 	}
 	return out;
 }
@@ -643,10 +666,13 @@ function collectXmlnsDeclarations(element) {
 */
 function mergeXmlnsDeclarations(inherited, element) {
 	const own = collectXmlnsDeclarations(element);
-	for (const _key in own) return {
-		...inherited,
-		...own
-	};
+	for (const _key in own) {
+		const merged = {
+			...inherited,
+			...own
+		};
+		return xmlnsDeclarationChars(merged) > MAX_XMLNS_DECLARATION_CHARS ? inherited : merged;
+	}
 	return inherited;
 }
 const QNAME_VALUE_ATTRIBUTES = /* @__PURE__ */ new Set([

package/dist/layout-painter/renderParagraph.js

@@ -15,6 +15,7 @@ import { resolvePhysicalParagraphInlineLayout } from "../utils/paragraphInlineLa
 import { inlineImageBoundingBox, parseRotationDegrees, rotatedBoundingBox } from "../utils/rotationBoundingBox.js";
 import { applySanitizedImageSrc } from "../utils/sanitizeImageSrc.js";
 import { SCRIPT_CLASS, hasCjk, hasComplexScript, segmentByScript } from "../utils/scriptSegments.js";
+import { sanitizeExternalUrl } from "../utils/urlSecurity.js";
 import { borderStrokeToCss, resolveParagraphBorderHorizontalOutsets } from "./borderStroke.js";
 import { planCursiveJoiners, withCursiveJoiners } from "./cursiveJoiners.js";
 import { getAutomaticTextColorForBackground } from "./documentColors.js";
@@ -114,6 +115,12 @@ const DEFAULT_BLACK_TEXT_COLOR_VALUES = /* @__PURE__ */ new Set(["000000", "000"
 const SUGGESTION_COLOR_CSS = "var(--suggestion-color, #6d3bd6)";
 const SUGGESTION_TINT_CSS = "var(--suggestion-bg, color-mix(in oklch, #6d3bd6 12%, transparent))";
 const SUGGESTION_TINT_LAYER_CSS = `linear-gradient(${SUGGESTION_TINT_CSS}, ${SUGGESTION_TINT_CSS})`;
+const RUN_BACKGROUND_TEXT_COLOR_VAR = "--doc-run-background-text-color";
+const setRunBackgroundTextColor = (element, color) => {
+	element.classList.add("docx-run-background-text");
+	element.style.setProperty(RUN_BACKGROUND_TEXT_COLOR_VAR, color);
+};
+const hasRunBackgroundTextSurface = (run) => Boolean(run.highlight ?? run.shading) && !run.isInsertion && !run.isDeletion && !(run.commentIds !== void 0 && run.commentIds.length > 0);
 function normalizeTextColorValue(color) {
 	return color.trim().toLowerCase().replace(/^#/u, "");
 }
@@ -205,6 +212,8 @@ function applyRunStyles(element, run) {
 		const hasCommentHighlight = run.commentIds !== void 0 && run.commentIds.length > 0;
 		const automaticTextColor = hasExplicitTextColor || hasTrackedChangeColor || hasCommentHighlight ? void 0 : getAutomaticTextColorForBackground(runBackground);
 		if (automaticTextColor) element.style.color = automaticTextColor;
+		const backgroundTextColor = hasExplicitTextColor ? textColor : automaticTextColor;
+		if (backgroundTextColor && hasRunBackgroundTextSurface(run)) setRunBackgroundTextColor(element, backgroundTextColor);
 	}
 	const decorations = [];
 	let explicitDecorationStyle = false;
@@ -315,11 +324,13 @@ function renderTextRun(run, doc, hyperlinkDirection) {
 	applyRunStyles(span, run);
 	applyPmPositions(span, run.pmStart, run.pmEnd);
 	const paintedText = toPaintedText(run.text);
-	if (run.hyperlink) {
+	const isBookmarkTarget = run.hyperlink?.href.startsWith("#") === true;
+	const hyperlinkHref = resolveHyperlinkHref(run.hyperlink?.href, isBookmarkTarget);
+	if (run.hyperlink && hyperlinkHref !== void 0) {
 		const anchor = doc.createElement("a");
-		anchor.href = run.hyperlink.href;
+		anchor.href = hyperlinkHref;
 		if (hyperlinkDirection || DISPLAYED_URL_PATTERN.test(paintedText.trim())) anchor.dir = LEFT_TO_RIGHT_DIRECTION;
-		if (!run.hyperlink.href.startsWith("#")) {
+		if (!isBookmarkTarget) {
 			anchor.target = "_blank";
 			anchor.rel = "noopener noreferrer";
 		}
@@ -332,12 +343,27 @@ function renderTextRun(run, doc, hyperlinkDirection) {
 			span.style.color = hyperlinkColor;
 			anchor.style.setProperty("--doc-run-color", hyperlinkColor);
 			span.style.setProperty("--doc-run-color", hyperlinkColor);
+			if (hasRunBackgroundTextSurface(run)) {
+				setRunBackgroundTextColor(span, hyperlinkColor);
+				setRunBackgroundTextColor(anchor, hyperlinkColor);
+			}
 		}
 		span.append(anchor);
 	} else span.textContent = paintedText;
 	applyWhitespaceUnderline(span, run);
 	return span;
 }
+/**
+* Bookmark targets (`#name`) scroll within the document and stay verbatim;
+* every other target is narrowed to the protocols the painter navigates to,
+* matching the image hyperlink path. `undefined` means the run gets no anchor:
+* an empty `href` resolves to the current document, so a rejected target would
+* otherwise stay navigable.
+*/
+function resolveHyperlinkHref(href, isBookmarkTarget) {
+	if (href === void 0) return;
+	return isBookmarkTarget ? href : sanitizeExternalUrl(href);
+}
 function isNoteReferenceRun(run) {
 	return run.footnoteRefId !== void 0 || run.endnoteRefId !== void 0;
 }
@@ -345,11 +371,14 @@ function removeUnderlineTextDecoration(element) {
 	const textDecorationLines = (element.style.textDecorationLine || "").split(/\s+/u).filter((line) => line && line !== "underline");
 	element.style.textDecorationLine = textDecorationLines.join(" ");
 }
+function applyContinuousUnderline(element, underline) {
+	removeUnderlineTextDecoration(element);
+	const color = typeof underline === "object" && underline.color ? underline.color : "currentColor";
+	element.style.boxShadow = `inset 0 -1px 0 ${color}`;
+}
 function applyWhitespaceUnderline(element, run) {
 	if (!run.underline || run.text.trim().length > 0) return;
-	removeUnderlineTextDecoration(element);
-	element.style.borderBottom = "1px solid currentColor";
-	if (typeof run.underline === "object" && run.underline.color) element.style.borderBottomColor = run.underline.color;
+	applyContinuousUnderline(element, run.underline);
 }
 /**
 * Number of leader characters to fill the tab's inner span. The inner span
@@ -401,9 +430,7 @@ function canClampTabToRightEdge(alignment, hasPriorRenderedContent, hasPriorTab,
 }
 function applyTabUnderline(element, run) {
 	if (!run.underline) return;
-	removeUnderlineTextDecoration(element);
-	element.style.borderBottom = "1px solid currentColor";
-	if (typeof run.underline === "object" && run.underline.color) element.style.borderBottomColor = run.underline.color;
+	applyContinuousUnderline(element, run.underline);
 }
 /**
 * Get leader character for tab