@stll/folio-core 0.32.2 → 0.33.1

package/dist/docx/paraIdRangeNormalization.js

@@ -0,0 +1,64 @@
+import { deterministicHexId } from "../utils/hexId.js";
+//#region src/docx/paraIdRangeNormalization.ts
+/**
+* Keep every paragraph id a package carries inside the range the schema gives
+* it.
+*
+* `w14:paraId`, `w14:textId` and the comment-part ids that reference a
+* paragraph are `ST_LongHexNumber` with a maximum: the value has to be below
+* `0x80000000`, so the ids are 31-bit. Producers exist that write eight hex
+* digits without that bound, and folio preserves the ids a document arrives
+* with — so a package can carry an out-of-range id in, and a save that copies
+* it through hands a consumer a package it will refuse.
+*
+* {@link paraIdInRange} is the one mapping, and it is a pure function of the
+* value alone. That is what lets the parser and the save agree without
+* consulting each other: a paragraph's id in the model is the id the file gets,
+* so bringing an id into range does not make a document's own identity move
+* under it between reading and writing. The package pass below is the same
+* mapping applied to every attribute that carries such an id, so a paragraph
+* and every reference to it move together.
+*/
+/** Exclusive upper bound on a paragraph id: the values are 31-bit. */
+const MAX_PARA_ID_EXCLUSIVE = 2147483648;
+/**
+* Every attribute that carries a paragraph id or the text-revision marker
+* written beside one: the paragraph's own `w14:paraId` / `w14:textId` (the
+* parser accepts a `w:` prefix too), the comment part's `w15:paraId` and the
+* `w15:paraIdParent` that links a reply to its thread, and the durable-comment
+* part's `w16cid:paraId`.
+*/
+const PARA_ID_ATTRIBUTE = /\b(w|w14|w15|w16cid):(paraId|paraIdParent|textId)=(?<quote>["'])([0-9A-Fa-f]{8})\k<quote>/gu;
+/** A candidate part is one that mentions any of those attributes at all. */
+const PARA_ID_CANDIDATE = /\b(?:w|w14|w15|w16cid):(?:paraId|paraIdParent|textId)=/u;
+/**
+* `value` when it already fits, and a value derived from it when it does not.
+*
+* The replacement is derived from the id being replaced and from nothing else.
+* A package-aware search for a free id would read better here and would be
+* wrong: the parser has no package to search, and an id that means one
+* paragraph while reading and another while writing is worse than the
+* vanishing chance of two rewritten ids landing on one value, which is a
+* duplicate rather than a package a consumer refuses.
+*/
+const paraIdInRange = (value) => Number.parseInt(value, 16) < MAX_PARA_ID_EXCLUSIVE ? value : deterministicHexId(value);
+/**
+* Rewrite out-of-range paragraph ids across a whole package.
+*
+* Returns the parts unchanged when every id already fits, so a save of a
+* document that never carried one is byte-identical.
+*/
+const normalizeParaIdRangeInXmlParts = (parts) => {
+	const normalized = new Map(parts);
+	for (const [path, xml] of parts) {
+		if (!PARA_ID_CANDIDATE.test(xml)) continue;
+		const rewritten = xml.replaceAll(PARA_ID_ATTRIBUTE, (whole, prefix, name, quote, value) => {
+			const replacement = paraIdInRange(value);
+			return replacement === value ? whole : `${prefix}:${name}=${quote}${replacement}${quote}`;
+		});
+		if (rewritten !== xml) normalized.set(path, rewritten);
+	}
+	return normalized;
+};
+//#endregion
+export { normalizeParaIdRangeInXmlParts, paraIdInRange };

package/dist/docx/paragraphParser.js

@@ -2,16 +2,17 @@ import { isValidHexColor } from "../utils/colorResolver.js";
 import { isValidHexId } from "../utils/hexId.js";
 import { parseBookmarkEnd as parseBookmarkEnd$1, parseBookmarkStart as parseBookmarkStart$1 } from "./bookmarkParser.js";
 import { parseFieldType } from "./fieldParser.js";
-import { parseHyperlink as parseHyperlink$1 } from "./hyperlinkParser.js";
+import { parseHyperlink as parseHyperlink$1, parseHyperlinkChild } from "./hyperlinkParser.js";
 import { markerFormattingFromLevel } from "./numberingParser.js";
+import { paraIdInRange } from "./paraIdRangeNormalization.js";
 import { BorderStyleSchema, FrameWrapSchema, FrameXAlignSchema, FrameYAlignSchema, LineSpacingRuleSchema, ParagraphAlignmentSchema, ShadingPatternSchema, TabLeaderSchema, TabStopAlignmentSchema, ThemeColorSlotSchema, narrowEnum } from "./parserEnums.js";
 import { consolidateParagraphContent } from "./runConsolidator.js";
 import { parseRun, parseRunProperties } from "./runParser.js";
 import { parseSdtProperties } from "./sdtProperties.js";
 import { parseSectionProperties } from "./sectionParser.js";
-import { elementToXml, findChild, findChildren, getAttribute, getChildElements, getLocalName, matchesName, mergeXmlnsDeclarations, parseBooleanElement, parseNumberingLevelAttribute, parseNumericAttribute } from "./xmlParser.js";
+import { WORDPROCESSINGML_NAMESPACE_URIS, elementToXml, findChild, findChildByNamespaceUri, findChildren, getAttribute, getChildElements, getLocalName, matchesName, mergeXmlnsDeclarations, parseBooleanElement, parseNumberingLevelAttribute, parseNumericAttribute } from "./xmlParser.js";
 import { panic } from "better-result";
-import { normalizeRevisionId } from "@stll/docx-core/model";
+import { PARAGRAPH_MARK_CHANGE_KINDS, normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/paragraphParser.ts
 /**
 * Extract plain text from a math element (recursive text content extraction)
@@ -528,19 +529,16 @@ function parseParagraphMarkChange(pPr) {
 	if (!pPr) return;
 	const rPr = findChild(pPr, "w", "rPr");
 	if (!rPr) return;
-	const ins = findChild(rPr, "w", "ins");
-	if (ins) return {
-		kind: "ins",
-		info: parseTrackedChangeInfo(ins)
-	};
-	const del = findChild(rPr, "w", "del");
-	if (del) return {
-		kind: "del",
-		info: parseTrackedChangeInfo(del)
-	};
+	for (const kind of PARAGRAPH_MARK_CHANGE_KINDS) {
+		const element = findChildByNamespaceUri(rPr, WORDPROCESSINGML_NAMESPACE_URIS, kind);
+		if (element) return {
+			kind,
+			info: parseTrackedChangeInfo(element)
+		};
+	}
 }
 function isTrackedChangeWrapperChild(content) {
-	return content.type === "run" || content.type === "hyperlink";
+	return content.type === "run" || content.type === "hyperlink" || content.type === "bookmarkStart" || content.type === "bookmarkEnd" || content.type === "simpleField" || content.type === "complexField" || content.type === "insertion" || content.type === "deletion" || content.type === "moveFrom" || content.type === "moveTo";
 }
 function isInlineSdtContent(content) {
 	return content.type === "run" || content.type === "hyperlink" || content.type === "simpleField" || content.type === "complexField" || content.type === "inlineSdt" || content.type === "insertion" || content.type === "deletion" || content.type === "moveFrom" || content.type === "moveTo" || content.type === "mathEquation";
@@ -649,6 +647,80 @@ function pushInlineSdtSegments({ contents, properties, parsedContent }) {
 function parseHyperlink(node, rels, styles, theme, media, rootXmlns = {}) {
 	return parseHyperlink$1(node, rels, styles, theme, media, rootXmlns);
 }
+/** The revision wrapper a `w:hyperlink` child is, when it is one. */
+const hyperlinkRevisionWrapperType = (node) => {
+	switch (getLocalName(node.name)) {
+		case "ins": return "insertion";
+		case "del": return "deletion";
+		case "moveFrom": return "moveFrom";
+		case "moveTo": return "moveTo";
+		default: return;
+	}
+};
+const isHyperlinkChildContent = (content) => content.type === "run" || content.type === "bookmarkStart" || content.type === "bookmarkEnd";
+/**
+* A `w:hyperlink` as paragraph content, with any revision wrapper it holds
+* hoisted around it.
+*
+* OOXML nests `w:ins`/`w:del` INSIDE `w:hyperlink`; the model nests the
+* hyperlink inside the revision, because a revision is the unit a redline
+* reads and a link that is half deleted is two links to it. This is the exact
+* inverse of what the serializer writes, so a package survives the round trip.
+*/
+function parseHyperlinkParagraphContents(node, rels, styles, theme, media, rootXmlns) {
+	const children = getChildElements(node);
+	if (!children.some((child) => hyperlinkRevisionWrapperType(child) !== void 0)) return [parseHyperlink(node, rels, styles, theme, media, rootXmlns)];
+	const inScopeXmlns = mergeXmlnsDeclarations(rootXmlns, node);
+	const shell = parseHyperlink(node, rels, styles, theme, media, rootXmlns);
+	const linkOver = (linkChildren) => ({
+		...shell,
+		children: [...linkChildren]
+	});
+	const contents = [];
+	let plain = [];
+	const flushPlain = () => {
+		if (plain.length > 0) {
+			contents.push(linkOver(plain));
+			plain = [];
+		}
+	};
+	for (const child of children) {
+		const wrapperType = hyperlinkRevisionWrapperType(child);
+		if (wrapperType === void 0) {
+			const parsed = parseHyperlinkChild(child, styles, theme, rels, media, inScopeXmlns);
+			if (parsed) plain.push(parsed);
+			continue;
+		}
+		flushPlain();
+		const wrapped = parseParagraphContents(child, styles, theme, null, rels, media, wrapperType === "deletion" || wrapperType === "moveFrom" ? "deletion" : "default", inScopeXmlns);
+		const content = [];
+		let linked = [];
+		const flushLinked = () => {
+			if (linked.length > 0) {
+				content.push(linkOver(linked));
+				linked = [];
+			}
+		};
+		for (const item of wrapped) {
+			if (isHyperlinkChildContent(item)) {
+				linked.push(item);
+				continue;
+			}
+			flushLinked();
+			if (isTrackedChangeWrapperChild(item)) content.push(item);
+		}
+		flushLinked();
+		pushTrackedChangeWrapper({
+			contents,
+			type: wrapperType,
+			info: parseTrackedChangeInfo(child),
+			content,
+			preserveEmpty: true
+		});
+	}
+	flushPlain();
+	return contents;
+}
 /**
 * Parse bookmark start (w:bookmarkStart)
 * Delegates to bookmarkParser module.
@@ -801,7 +873,7 @@ function parseParagraphContents(paraElement, styles, theme, _numbering, rels, me
 				break;
 			}
 			case "hyperlink":
-				contents.push(parseHyperlink(child, rels, styles, theme, media, inScopeXmlns));
+				contents.push(...parseHyperlinkParagraphContents(child, rels, styles, theme, media, inScopeXmlns));
 				break;
 			case "bookmarkStart":
 				contents.push(parseBookmarkStart(child));
@@ -964,9 +1036,9 @@ function parseParagraph(node, styles, theme, numbering, rels = null, media = nul
 		content: []
 	};
 	const paraId = getAttribute(node, "w14", "paraId") ?? getAttribute(node, "w", "paraId");
-	if (paraId && isValidHexId(paraId)) paragraph.paraId = paraId;
+	if (paraId && isValidHexId(paraId)) paragraph.paraId = paraIdInRange(paraId);
 	const textId = getAttribute(node, "w14", "textId") ?? getAttribute(node, "w", "textId");
-	if (textId && isValidHexId(textId)) paragraph.textId = textId;
+	if (textId && isValidHexId(textId)) paragraph.textId = paraIdInRange(textId);
 	if (!options?.inHeaderFooter && paragraphStartsWithRenderedPageBreak(node)) paragraph.renderedPageBreakBefore = true;
 	const pPr = findChild(node, "w", "pPr");
 	if (pPr) {
@@ -980,16 +1052,19 @@ function parseParagraph(node, styles, theme, numbering, rels = null, media = nul
 		if (sectPr) paragraph.sectionProperties = parseSectionProperties(sectPr);
 	}
 	paragraph.content = consolidateParagraphContent(parseParagraphContents(node, styles, theme, numbering, rels, media, "default", options?.rootXmlns ?? {}));
-	let effectiveNumPr = paragraph.formatting?.numPr;
+	const paragraphFormatting = paragraph.formatting;
+	const directNumPr = paragraphFormatting?.numPr;
+	const styleNumPr = paragraphFormatting?.styleId && styles ? styles.get(paragraphFormatting.styleId)?.pPr?.numPr : void 0;
+	let effectiveNumPr = directNumPr;
 	let numPrFromStyle = false;
-	if (!effectiveNumPr && paragraph.formatting?.styleId && styles) {
-		const style = styles.get(paragraph.formatting.styleId);
-		if (style?.pPr?.numPr) {
-			effectiveNumPr = style.pPr.numPr;
-			numPrFromStyle = true;
-			paragraph.formatting.numPr = effectiveNumPr;
-			paragraph.formatting.numPrFromStyle = effectiveNumPr;
-		}
+	if (paragraphFormatting && styleNumPr && directNumPr?.numId === void 0) {
+		effectiveNumPr = {
+			...styleNumPr,
+			...directNumPr
+		};
+		numPrFromStyle = true;
+		paragraphFormatting.numPr = effectiveNumPr;
+		paragraphFormatting.numPrFromStyle = styleNumPr;
 	}
 	if (effectiveNumPr && numbering) {
 		const { numId, ilvl = 0 } = effectiveNumPr;

package/dist/docx/paragraphTraversal.js

@@ -13,7 +13,7 @@ const visitParagraphRuns = (paragraph, visit) => {
 				visitRun(child);
 				continue;
 			}
-			visitHyperlink(child);
+			if (child.type === "hyperlink") visitHyperlink(child);
 		}
 	};
 	const visitParagraphContent = (content) => {

package/dist/docx/renderedPageBreakNormalization.js

@@ -37,7 +37,9 @@ const scanHyperlink = (hyperlink, scan) => {
 };
 const scanInlineContent = (content, scan) => {
 	for (const child of content) {
-		const result = child.type === "run" ? scanRun(child, scan) : scanHyperlink(child, scan);
+		let result;
+		if (child.type === "run") result = scanRun(child, scan);
+		else if (child.type === "hyperlink") result = scanHyperlink(child, scan);
 		if (result !== void 0) return result;
 	}
 };

package/dist/docx/revisionIdNormalization.d.ts

@@ -0,0 +1,27 @@
+//#region src/docx/revisionIdNormalization.d.ts
+declare const RevisionIdCollisionError_base: import("better-result").TaggedErrorClass<"RevisionIdCollisionError">;
+/**
+ * Two revision elements in one package claimed the same `w:id`.
+ *
+ * `w:id` on a revision element is unique across the package, so a collision is
+ * a package a consumer may reject rather than a cosmetic detail. The
+ * normalization below hands every id it emits to one choke point, which throws
+ * this rather than letting the duplicate reach the ZIP.
+ */
+declare class RevisionIdCollisionError extends RevisionIdCollisionError_base<{
+  message: string;
+  revisionId: number;
+  part: string;
+}> {}
+declare const REVISION_ELEMENT_NAMES: Set<string>;
+/**
+ * Keep physical tracked-change element ids unique across a package.
+ *
+ * Live editor marks and operation receipts keep their logical revision IDs.
+ * Saving assigns fresh IDs only where one logical change was split into
+ * multiple physical OOXML wrappers; reopening therefore exposes the physical
+ * wrapper IDs that the file format requires.
+ */
+declare const normalizeRevisionIdsInXmlParts: (parts: ReadonlyMap<string, string>) => Map<string, string>;
+//#endregion
+export { REVISION_ELEMENT_NAMES, RevisionIdCollisionError, normalizeRevisionIdsInXmlParts };

package/dist/docx/revisionIdNormalization.js

@@ -0,0 +1,121 @@
+import { rewriteStreamingXmlDecimalAttributes } from "./streamingXmlParser.js";
+import { WORDPROCESSINGML_NAMESPACE_URIS, findAttributeByNamespaceUri, getLocalName, getNamespaceUri } from "./xmlParser.js";
+import { XmlResourceLimitError, assertXmlResourceLimits } from "./xmlResourceLimits.js";
+import { TaggedError } from "better-result";
+//#region src/docx/revisionIdNormalization.ts
+/**
+* Two revision elements in one package claimed the same `w:id`.
+*
+* `w:id` on a revision element is unique across the package, so a collision is
+* a package a consumer may reject rather than a cosmetic detail. The
+* normalization below hands every id it emits to one choke point, which throws
+* this rather than letting the duplicate reach the ZIP.
+*/
+var RevisionIdCollisionError = class extends TaggedError("RevisionIdCollisionError") {};
+const REVISION_ELEMENT_NAMES = /* @__PURE__ */ new Set([
+	"cellDel",
+	"cellIns",
+	"cellMerge",
+	"del",
+	"ins",
+	"moveFrom",
+	"moveTo",
+	"numberingChange",
+	"pPrChange",
+	"rPrChange",
+	"sectPrChange",
+	"tblGridChange",
+	"tblPrChange",
+	"tblPrExChange",
+	"tcPrChange",
+	"trPrChange"
+]);
+const REVISION_ELEMENT_CANDIDATE = new RegExp(`<(?:[^\\s<>/:]+:)?(?:${[...REVISION_ELEMENT_NAMES].join("|")})(?:[\\s/>])`, "u");
+const revisionAttribute = (element) => {
+	if (!element.name || !WORDPROCESSINGML_NAMESPACE_URIS.has(getNamespaceUri(element) ?? "") || !REVISION_ELEMENT_NAMES.has(getLocalName(element.name))) return null;
+	const attribute = findAttributeByNamespaceUri(element, WORDPROCESSINGML_NAMESPACE_URIS, "id");
+	if (!attribute) return null;
+	const id = Number(attribute.value);
+	return Number.isSafeInteger(id) && id >= 0 ? {
+		name: attribute.name,
+		id
+	} : null;
+};
+/**
+* Keep physical tracked-change element ids unique across a package.
+*
+* Live editor marks and operation receipts keep their logical revision IDs.
+* Saving assigns fresh IDs only where one logical change was split into
+* multiple physical OOXML wrappers; reopening therefore exposes the physical
+* wrapper IDs that the file format requires.
+*/
+const normalizeRevisionIdsInXmlParts = (parts) => {
+	const candidates = [...parts].filter(([, xml]) => REVISION_ELEMENT_CANDIDATE.test(xml));
+	const occurrencesByPath = /* @__PURE__ */ new Map();
+	const reserved = /* @__PURE__ */ new Set();
+	for (const [path, xml] of candidates) {
+		assertXmlResourceLimits(xml);
+		const ids = [];
+		if (rewriteStreamingXmlDecimalAttributes(xml, (element) => {
+			const attribute = revisionAttribute(element);
+			if (attribute) {
+				ids.push(attribute.id);
+				reserved.add(attribute.id);
+			}
+			return null;
+		}).status === "unsupported") throw new XmlResourceLimitError({
+			message: `Revision-id normalization could not safely scan ${path}`,
+			limit: "syntax"
+		});
+		occurrencesByPath.set(path, ids);
+	}
+	const repeatedPaths = /* @__PURE__ */ new Set();
+	const firstSeen = /* @__PURE__ */ new Set();
+	for (const [path, ids] of occurrencesByPath) for (const id of ids) if (firstSeen.has(id)) repeatedPaths.add(path);
+	else firstSeen.add(id);
+	let nextId = 0;
+	const allocate = () => {
+		while (reserved.has(nextId)) nextId += 1;
+		const allocated = nextId;
+		reserved.add(allocated);
+		nextId += 1;
+		return allocated;
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const normalized = new Map(parts);
+	for (const [path, xml] of candidates) {
+		const ids = occurrencesByPath.get(path);
+		if (!ids) continue;
+		const claim = (id) => {
+			if (seen.has(id)) throw new RevisionIdCollisionError({
+				message: `Revision id ${String(id)} is claimed twice in ${path}`,
+				revisionId: id,
+				part: path
+			});
+			seen.add(id);
+		};
+		if (!repeatedPaths.has(path) && ids.every((id) => !seen.has(id))) {
+			for (const id of ids) claim(id);
+			continue;
+		}
+		const rewritten = rewriteStreamingXmlDecimalAttributes(xml, (element) => {
+			const attribute = revisionAttribute(element);
+			if (!attribute) return null;
+			if (!seen.has(attribute.id)) {
+				claim(attribute.id);
+				return null;
+			}
+			const replacement = allocate();
+			claim(replacement);
+			return /* @__PURE__ */ new Map([[attribute.name, String(replacement)]]);
+		});
+		if (rewritten.status === "unsupported") throw new XmlResourceLimitError({
+			message: `Revision-id normalization could not safely rewrite ${path}`,
+			limit: "syntax"
+		});
+		normalized.set(path, rewritten.value);
+	}
+	return normalized;
+};
+//#endregion
+export { REVISION_ELEMENT_NAMES, RevisionIdCollisionError, normalizeRevisionIdsInXmlParts };

package/dist/docx/rezip.d.ts

@@ -105,6 +105,12 @@ declare function updateMultipleFiles(originalBuffer: ArrayBuffer, updates: Map<s
 /**
  * Apply file updates to an already-loaded JSZip instance and generate the output.
  * Use this when the zip is already loaded to avoid a redundant decompression pass.
+ *
+ * This is the selective save's exit, so it owes the package the same id passes
+ * {@link generateDocxZip} runs: a save that rewrites only the changed
+ * paragraphs still has to see the parts it left alone, both to know which
+ * revision ids are free and because an out-of-range paragraph id can sit in a
+ * part it never touched.
  */
 declare function applyUpdatesToZip(zip: JSZip, updates: Map<string, string | ArrayBuffer>, options?: RepackOptions): Promise<ArrayBuffer>;
 /**

package/dist/docx/rezip.js

@@ -5,7 +5,10 @@ import { parseEndnotes, parseFootnotes } from "./footnoteParser.js";
 import { assertValidFolioDocumentModel } from "./modelValidation.js";
 import { isNewDataUrlDrawing } from "./newImage.js";
 import { parseNumbering } from "./numberingParser.js";
+import { isUnsafePackagePath, reconcilePackageReferences, removeUnsafeEntries } from "./packageParts.js";
+import { normalizeParaIdRangeInXmlParts } from "./paraIdRangeNormalization.js";
 import { RELATIONSHIP_TYPES, parseRelationships, resolveRelativePath } from "./relsParser.js";
+import { normalizeRevisionIdsInXmlParts } from "./revisionIdNormalization.js";
 import { appendNumberingDefs, buildPatchedNotePartXml, buildPatchedNumberingXml, collectAddedNumberingDefs, collectChangedNoteParaIds, collectChangedNumberingDefs, collectParaIds } from "./selectiveXmlPatch.js";
 import { ensureThreadedCommentParaIds, serializeComments, serializeCommentsExtended } from "./serializer/commentSerializer.js";
 import { serializeDocument } from "./serializer/documentSerializer.js";
@@ -17,7 +20,6 @@ import { serializeSettingsXml } from "./serializer/settingsSerializer.js";
 import { serializeStyle, serializeStylesXml } from "./serializer/stylesSerializer.js";
 import { serializeThemeXml } from "./serializer/themeSerializer.js";
 import { escapeXml } from "./serializer/xmlUtils.js";
-import { isPreservableDocxEntry } from "./unzip.js";
 import { WORDPROCESSINGML_NAMESPACE_URIS, findChild, getAttribute, getChildElements, getLocalName, getNamespaceUri, matchesName, parseXml, parseXmlDocument } from "./xmlParser.js";
 import { assertXmlResourceLimits } from "./xmlResourceLimits.js";
 import { panic } from "better-result";
@@ -405,20 +407,47 @@ async function processNewHyperlinks(parts, zip, compressionLevel) {
 		});
 	}
 }
-const generateDocxZip = (zip, compressionLevel) => zip.generateAsync({
-	type: "arraybuffer",
-	compression: "DEFLATE",
-	compressionOptions: { level: compressionLevel }
-});
-const parsedZipSources = /* @__PURE__ */ new WeakMap();
-const removeNonPreservableEntries = (zip) => {
-	for (const [path, file] of Object.entries(zip.files)) if (!file.dir && !isPreservableDocxEntry(path)) zip.remove(path);
+/**
+* Bring the ids a package addresses itself by inside the bounds the format
+* gives them.
+*
+* Both bounds belong to the package rather than to a part, and neither is
+* something one serializer can see on its own. A revision `w:id` is unique
+* across the package, and one logical revision serializes as several physical
+* wrappers — a word diff cut around unchanged words, a revision split around a
+* hyperlink. A paragraph id is 31-bit, and a paragraph is referenced by id
+* from parts other than the one it lives in. So the passes run at the exits,
+* over every `word/*.xml` part including the ones a save left untouched.
+*/
+const normalizePackageIdsInZip = async (zip, compressionLevel) => {
+	const xmlParts = /* @__PURE__ */ new Map();
+	for (const [path, file] of Object.entries(zip.files)) if (!file.dir && path.startsWith("word/") && path.endsWith(".xml")) xmlParts.set(path, await file.async("text"));
+	const normalizedParts = normalizeParaIdRangeInXmlParts(normalizeRevisionIdsInXmlParts(xmlParts));
+	for (const [path, xml] of normalizedParts) if (xml !== xmlParts.get(path)) zip.file(path, xml, {
+		compression: "DEFLATE",
+		compressionOptions: { level: compressionLevel }
+	});
+};
+/**
+* The single exit for a repacked package. Reconciliation runs here rather than
+* at each caller so no save path can emit a package whose relationships or
+* content types name a part it does not hold.
+*/
+const generateDocxZip = async (zip, compressionLevel) => {
+	await reconcilePackageReferences(zip, compressionLevel);
+	await normalizePackageIdsInZip(zip, compressionLevel);
+	return zip.generateAsync({
+		type: "arraybuffer",
+		compression: "DEFLATE",
+		compressionOptions: { level: compressionLevel }
+	});
 };
+const parsedZipSources = /* @__PURE__ */ new WeakMap();
 const loadParsedZipSource = async (document, buffer) => {
 	const cached = parsedZipSources.get(document);
 	if (cached?.buffer === buffer) return cached;
 	const zip = await JSZip.loadAsync(buffer);
-	removeNonPreservableEntries(zip);
+	removeUnsafeEntries(zip);
 	const [documentXml, corePropertiesXml] = await Promise.all([zip.file("word/document.xml")?.async("text"), zip.file("docProps/core.xml")?.async("text")]);
 	const source = {
 		buffer,
@@ -486,7 +515,7 @@ async function repackDocx(doc, options = {}) {
 	const exportDocument = withoutOrphanCommentRanges(doc);
 	const originalZip = await JSZip.loadAsync(doc.originalBuffer);
 	const [originalDocumentXml, originalCorePropertiesXml] = await Promise.all([originalZip.file("word/document.xml")?.async("text"), originalZip.file("docProps/core.xml")?.async("text")]);
-	removeNonPreservableEntries(originalZip);
+	removeUnsafeEntries(originalZip);
 	const newZip = cloneDocxZip(originalZip);
 	return finishRepack({
 		document: exportDocument,
@@ -517,7 +546,7 @@ async function repackDocxFromRaw(doc, rawContent, options = {}) {
 			newZip.folder(path.replace(/\/$/u, ""));
 			continue;
 		}
-		if (!isPreservableDocxEntry(path)) continue;
+		if (isUnsafePackagePath(path)) continue;
 		const content = await file.async("arraybuffer");
 		newZip.file(path, content, {
 			compression: "DEFLATE",
@@ -559,11 +588,7 @@ async function repackDocxFromRaw(doc, rawContent, options = {}) {
 			compressionOptions: { level: compressionLevel }
 		});
 	}
-	return await newZip.generateAsync({
-		type: "arraybuffer",
-		compression: "DEFLATE",
-		compressionOptions: { level: compressionLevel }
-	});
+	return generateDocxZip(newZip, compressionLevel);
 }
 const COMMENTS_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.wordprocessingml.comments+xml";
 const COMMENTS_EXTENDED_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.wordprocessingml.commentsExtended+xml";
@@ -749,14 +774,21 @@ async function updateMultipleFiles(originalBuffer, updates, options = {}) {
 /**
 * Apply file updates to an already-loaded JSZip instance and generate the output.
 * Use this when the zip is already loaded to avoid a redundant decompression pass.
+*
+* This is the selective save's exit, so it owes the package the same id passes
+* {@link generateDocxZip} runs: a save that rewrites only the changed
+* paragraphs still has to see the parts it left alone, both to know which
+* revision ids are free and because an out-of-range paragraph id can sit in a
+* part it never touched.
 */
-function applyUpdatesToZip(zip, updates, options = {}) {
+async function applyUpdatesToZip(zip, updates, options = {}) {
 	const { compressionLevel = 6 } = options;
 	for (const [path, content] of updates) zip.file(path, content, {
 		compression: "DEFLATE",
 		compressionOptions: { level: compressionLevel }
 	});
-	return zip.generateAsync({
+	await normalizePackageIdsInZip(zip, compressionLevel);
+	return await zip.generateAsync({
 		type: "arraybuffer",
 		compression: "DEFLATE",
 		compressionOptions: { level: compressionLevel }

package/dist/docx/selectiveSave.js

@@ -4,6 +4,7 @@ import { hasUnsynthesizedReplyRanges } from "./commentReplyMarkers.js";
 import { validateFolioDocumentModel } from "./modelValidation.js";
 import { isNewDataUrlDrawing } from "./newImage.js";
 import { parseNumbering } from "./numberingParser.js";
+import { isUnsafePackagePath } from "./packageParts.js";
 import { RELATIONSHIP_TYPES } from "./relsParser.js";
 import { COMMENTS_CONTENT_TYPE, COMMENTS_EXTENDED_PART_LOWER, addCommentsExtendedOverride, addCommentsExtendedRelationship, applyUpdatesToZip, collectHeaderFooterUpdates, findMaxRId, hasModelDrivenPictureWatermark, hasUnmaterializedHeaderFooter, updateCoreProperties, withoutAttachedTemplate } from "./rezip.js";
 import "./selectiveSaveFlags.js";
@@ -12,7 +13,6 @@ import { ensureThreadedCommentParaIds, serializeComments, serializeCommentsExten
 import { serializeDocument } from "./serializer/documentSerializer.js";
 import { serializeEndnotes, serializeFootnotes } from "./serializer/noteSerializer.js";
 import { serializeNumberingXml } from "./serializer/numberingSerializer.js";
-import { isPreservableDocxEntry } from "./unzip.js";
 //#region src/docx/selectiveSave.ts
 /**
 * Check if document content has new images (data: URL without rId) or
@@ -212,7 +212,7 @@ async function attemptSelectiveSave(doc, originalBuffer, options) {
 	const headerFooterUpdates = collectHeaderFooterUpdates(doc);
 	try {
 		const zip = await (await import("jszip")).default.loadAsync(originalBuffer);
-		for (const [path, file] of Object.entries(zip.files)) if (!file.dir && !isPreservableDocxEntry(path)) return null;
+		for (const [path, file] of Object.entries(zip.files)) if (!file.dir && isUnsafePackagePath(path)) return null;
 		const updates = /* @__PURE__ */ new Map();
 		if (changedParaIds.size > 0) {
 			const docXmlFile = zip.file("word/document.xml");

package/dist/docx/serializer/commentSerializer.js

@@ -36,7 +36,12 @@ function serializeComment(comment) {
 	xml += "</w:comment>";
 	return xml;
 }
-const COMMENTS_HEADER = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<w:comments xmlns:wpc=\"http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas\" xmlns:mc=\"http://schemas.openxmlformats.org/markup-compatibility/2006\" xmlns:o=\"urn:schemas-microsoft-com:office:office\" xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" xmlns:m=\"http://schemas.openxmlformats.org/officeDocument/2006/math\" xmlns:v=\"urn:schemas-microsoft-com:vml\" xmlns:wp=\"http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing\" xmlns:w10=\"urn:schemas-microsoft-com:office:word\" xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\" xmlns:w14=\"http://schemas.microsoft.com/office/word/2010/wordml\" xmlns:wpg=\"http://schemas.microsoft.com/office/word/2010/wordprocessingGroup\" xmlns:wpi=\"http://schemas.microsoft.com/office/word/2010/wordprocessingInk\" xmlns:wne=\"http://schemas.microsoft.com/office/word/2006/wordml\" xmlns:wps=\"http://schemas.microsoft.com/office/word/2010/wordprocessingShape\" mc:Ignorable=\"w14 wp14\">";
+const COMMENT_EXTENSION_NAMESPACES = {
+	w14: "http://schemas.microsoft.com/office/word/2010/wordml",
+	wp14: "http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing"
+};
+const COMMENTS_HEADER = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<w:comments xmlns:wpc="http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:m="http://schemas.openxmlformats.org/officeDocument/2006/math" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing" xmlns:w10="urn:schemas-microsoft-com:office:word" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" ${Object.entries(COMMENT_EXTENSION_NAMESPACES).map(([prefix, namespace]) => `xmlns:${prefix}="${namespace}"`).join(" ")} xmlns:wpg="http://schemas.microsoft.com/office/word/2010/wordprocessingGroup" xmlns:wpi="http://schemas.microsoft.com/office/word/2010/wordprocessingInk" xmlns:wne="http://schemas.microsoft.com/office/word/2006/wordml" xmlns:wps="http://schemas.microsoft.com/office/word/2010/wordprocessingShape" mc:Ignorable="${Object.keys(COMMENT_EXTENSION_NAMESPACES).join(" ")}">`;
 /**
 * Serialize comments array to comments.xml content. Returns a valid empty
 * `<w:comments/>` document for an empty array so callers can overwrite an