@stll/folio-core 0.44.0 → 0.45.0

package/dist/docx/serializer/themeSerializer.js

@@ -1,8 +1,8 @@
 import { serializePartElement } from "./partNamespaces.js";
-import { escapeXml } from "./xmlUtils.js";
+import { escapeXmlAttribute } from "@stll/docx-core";
 //#region src/docx/serializer/themeSerializer.ts
 const serializeThemeXml = (theme) => {
-	const name = escapeXml(theme.name ?? "Folio Theme");
+	const name = escapeXmlAttribute(theme.name ?? "Folio Theme");
 	const elements = `${serializeColorScheme(theme.colorScheme)}${serializeFontScheme(theme)}${serializeFormatScheme(theme)}`;
 	return "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n" + serializePartElement({
 		partPath: "word/theme/theme1.xml",
@@ -28,17 +28,17 @@ const serializeColorScheme = (colors) => {
 		hlink: colors?.hlink ?? "0563C1",
 		folHlink: colors?.folHlink ?? "954F72"
 	};
-	return `<a:clrScheme name="Folio">${Object.entries(values).map(([slot, value]) => `<a:${slot}><a:srgbClr val="${escapeXml(value)}"/></a:${slot}>`).join("")}</a:clrScheme>`;
+	return `<a:clrScheme name="Folio">${Object.entries(values).map(([slot, value]) => `<a:${slot}><a:srgbClr val="${escapeXmlAttribute(value)}"/></a:${slot}>`).join("")}</a:clrScheme>`;
 };
 const serializeFontScheme = (theme) => {
 	return `<a:fontScheme name="Folio">${serializeThemeFont(theme.fontScheme?.majorFont, "majorFont", "Arial")}${serializeThemeFont(theme.fontScheme?.minorFont, "minorFont", "Arial")}</a:fontScheme>`;
 };
 const serializeThemeFont = (font, element, fallback) => {
-	const scriptFonts = Object.entries(font?.fonts ?? {}).map(([script, typeface]) => `<a:font script="${escapeXml(script)}" typeface="${escapeXml(typeface)}"/>`).join("");
-	return `<a:${element}><a:latin typeface="${escapeXml(font?.latin ?? fallback)}"/><a:ea typeface="${escapeXml(font?.ea ?? "")}"/><a:cs typeface="${escapeXml(font?.cs ?? "")}"/>${scriptFonts}</a:${element}>`;
+	const scriptFonts = Object.entries(font?.fonts ?? {}).map(([script, typeface]) => `<a:font script="${escapeXmlAttribute(script)}" typeface="${escapeXmlAttribute(typeface)}"/>`).join("");
+	return `<a:${element}><a:latin typeface="${escapeXmlAttribute(font?.latin ?? fallback)}"/><a:ea typeface="${escapeXmlAttribute(font?.ea ?? "")}"/><a:cs typeface="${escapeXmlAttribute(font?.cs ?? "")}"/>${scriptFonts}</a:${element}>`;
 };
 const serializeFormatScheme = (theme) => {
-	return `<a:fmtScheme name="${escapeXml(theme.formatScheme?.name ?? "Folio")}"><a:fillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:fillStyleLst><a:lnStyleLst><a:ln w="6350" cap="flat" cmpd="sng" algn="ctr"><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:prstDash val="solid"/></a:ln></a:lnStyleLst><a:effectStyleLst><a:effectStyle><a:effectLst/></a:effectStyle></a:effectStyleLst><a:bgFillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:bgFillStyleLst></a:fmtScheme>`;
+	return `<a:fmtScheme name="${escapeXmlAttribute(theme.formatScheme?.name ?? "Folio")}"><a:fillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:fillStyleLst><a:lnStyleLst><a:ln w="6350" cap="flat" cmpd="sng" algn="ctr"><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:prstDash val="solid"/></a:ln></a:lnStyleLst><a:effectStyleLst><a:effectStyle><a:effectLst/></a:effectStyle></a:effectStyleLst><a:bgFillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill></a:bgFillStyleLst></a:fmtScheme>`;
 };
 //#endregion
 export { serializeThemeXml };

package/dist/docx/serializer/trackedChangeAttributes.js

@@ -1,6 +1,6 @@
 import { DATE_UTC_ATTRIBUTE } from "../trackedChangeInfo.js";
-import { escapeXml } from "./xmlUtils.js";
 import { panic } from "better-result";
+import { escapeXmlAttribute } from "@stll/docx-core";
 import { normalizeRevisionId } from "@stll/docx-core/model";
 //#region src/docx/serializer/trackedChangeAttributes.ts
 /** Enforces the singular `w:rPrChange` child in a run-property container. */
@@ -26,6 +26,6 @@ const trackedChangeAttributeEntries = (info) => {
 	return entries;
 };
 const trackedChangeAttributeRecord = (info) => Object.fromEntries(trackedChangeAttributeEntries(info));
-const serializeTrackedChangeAttributes = (info) => trackedChangeAttributeEntries(info).map(([name, value]) => `${name}="${escapeXml(value)}"`).join(" ");
+const serializeTrackedChangeAttributes = (info) => trackedChangeAttributeEntries(info).map(([name, value]) => `${name}="${escapeXmlAttribute(value)}"`).join(" ");
 //#endregion
 export { getSingularRunPropertyChange, serializeTrackedChangeAttributes, trackedChangeAttributeEntries, trackedChangeAttributeRecord };

package/dist/docx/serializer/xmlUtils.d.ts

@@ -2,7 +2,6 @@
 /**
  * Shared XML utility functions for serializers.
  */
-declare function escapeXml(text: string): string;
 /**
  * Format a numeric value as an integer XML attribute.
  *
@@ -29,4 +28,4 @@ declare function intAttr(value: number | undefined | null): string;
  */
 declare function isSingleWellFormedElement(xml: string, expectedLocalName: string): boolean;
 //#endregion
-export { escapeXml, intAttr, isSingleWellFormedElement };
+export { intAttr, isSingleWellFormedElement };

package/dist/docx/serializer/xmlUtils.js

@@ -3,18 +3,6 @@ import { getLocalName, parseXml } from "../xmlParser.js";
 /**
 * Shared XML utility functions for serializers.
 */
-const XML_SPECIAL_CHARACTER_PATTERN = /[&<>"']/u;
-const XML_SPECIAL_CHARACTER_GLOBAL_PATTERN = /[&<>"']/gu;
-function escapeXml(text) {
-	if (!XML_SPECIAL_CHARACTER_PATTERN.test(text)) return text;
-	return text.replace(XML_SPECIAL_CHARACTER_GLOBAL_PATTERN, (character) => {
-		if (character === "&") return "&amp;";
-		if (character === "<") return "&lt;";
-		if (character === ">") return "&gt;";
-		if (character === "\"") return "&quot;";
-		return "&apos;";
-	});
-}
 /**
 * Format a numeric value as an integer XML attribute.
 *
@@ -57,4 +45,4 @@ function isSingleWellFormedElement(xml, expectedLocalName) {
 	return root?.name !== void 0 && getLocalName(root.name) === expectedLocalName;
 }
 //#endregion
-export { escapeXml, intAttr, isSingleWellFormedElement };
+export { intAttr, isSingleWellFormedElement };

package/dist/docx/server/boundedArchive.d.ts

@@ -1,3 +1,4 @@
+import { XmlResourceLimits } from "../xmlResourceLimits.js";
 import JSZip from "jszip";
 //#region src/docx/server/boundedArchive.d.ts
 declare module "jszip" {
@@ -27,6 +28,17 @@ type DocxArchiveOptions = {
   maxEntryBytes?: number;
   maxTotalBytes?: number;
   maxEntries?: number;
+  /**
+   * Bounds on parsed XML structure, applied to every XML part this archive
+   * hands out as a string.
+   *
+   * Every consumer of `readEntryString` parses the result into an object tree,
+   * and the byte caps above bound the markup, not the tree. Enforcing the
+   * element and attribute bounds here rather than at each parse site means a
+   * new consumer is bounded by construction: there is no way to obtain a part
+   * string from this archive that has not been counted.
+   */
+  xmlLimits?: Partial<XmlResourceLimits>;
 };
 type DocxArchiveEntry = {
   readonly path: string;

package/dist/docx/server/boundedArchive.js

@@ -1,3 +1,4 @@
+import { FOLIO_XML_RESOURCE_LIMITS, assertXmlResourceLimits, createXmlPackageBudget } from "../xmlResourceLimits.js";
 import { TaggedError } from "better-result";
 import JSZip from "jszip";
 //#region src/docx/server/boundedArchive.ts
@@ -117,6 +118,12 @@ const loadDocxArchive = async (bytes, options = {}) => {
 		message: `DOCX archive declares ${declaredTotalBytes} cumulative bytes (max ${maxTotalBytes})`,
 		reason: "total-too-large"
 	});
+	const xmlLimits = {
+		...FOLIO_XML_RESOURCE_LIMITS,
+		...options.xmlLimits
+	};
+	const xmlBudget = createXmlPackageBudget();
+	const countedParts = /* @__PURE__ */ new Set();
 	let totalBytesRead = 0;
 	let readChain = Promise.resolve();
 	const readEntry = async (path, readOptions = {}) => {
@@ -151,7 +158,19 @@ const loadDocxArchive = async (bytes, options = {}) => {
 		}))),
 		async readEntryString(path) {
 			const content = await readEntry(path);
-			return content === null ? null : new TextDecoder("utf-8", { ignoreBOM: true }).decode(content);
+			if (content === null) return null;
+			const xml = new TextDecoder("utf-8", { ignoreBOM: true }).decode(content);
+			const lower = path.toLowerCase();
+			if (!lower.endsWith(".xml") && !lower.endsWith(".rels")) return xml;
+			const charged = countedParts.has(path);
+			countedParts.add(path);
+			assertXmlResourceLimits({
+				xml,
+				limits: xmlLimits,
+				partPath: path,
+				...charged ? {} : { budget: xmlBudget }
+			});
+			return xml;
 		},
 		readEntryUint8: readEntry
 	};

package/dist/docx/server/validateDocxConformance.js

@@ -3,6 +3,7 @@ import { DOCX_CONTAINER_TYPES, detectDocxContainerType } from "../encryption/con
 import { DocxModelValidationError, validateFolioDocumentModel } from "../modelValidation.js";
 import { DocxParseError, parseDocx } from "../parser.js";
 import { findChildByLocalName, getAttributeAnyPrefix, getLocalName, getNamespacePrefix, parseXmlDocument } from "../xmlParser.js";
+import { XmlResourceLimitError } from "../xmlResourceLimits.js";
 import { getDocxXmlSafetyIssue } from "../xmlSafety.js";
 import { DocxArchiveError, loadDocxArchive } from "./boundedArchive.js";
 import { DOCX_CONFORMANCE_CLASSES } from "@stll/docx-core/model";
@@ -112,11 +113,31 @@ const XML_SAFETY_ISSUE = {
 		message: "An XML package part is not well formed."
 	}
 };
+/**
+* Read a part for inspection, including one the safe reader declines.
+*
+* `readEntryString` runs the XML structure preflight, and the preflight
+* refuses to scan markup it cannot count — a document type declaration, an
+* unterminated tag — which is exactly the markup this check exists to report.
+* Such a part is read raw and classified below, so the report names why the
+* package is invalid instead of saying it could not tell. A part that overran
+* a real bound still refuses, and the caller reports that as indeterminate,
+* because a package too large to scan is not a package known to be wrong.
+*/
+const readPartForInspection = async (archive, part) => {
+	try {
+		return await archive.readEntryString(part);
+	} catch (error) {
+		if (!(error instanceof XmlResourceLimitError) || error.limit !== "syntax") throw error;
+		const bytes = await archive.readEntryUint8(part);
+		return bytes === null ? null : new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes);
+	}
+};
 const validateXmlParts = async (archive, report) => {
 	const xmlByPath = /* @__PURE__ */ new Map();
 	let hasInvalidXml = false;
 	for (const part of archive.entries.filter((path) => XML_PART_PATTERN.test(path)).toSorted()) {
-		const xml = await archive.readEntryString(part);
+		const xml = await readPartForInspection(archive, part);
 		if (xml === null) continue;
 		xmlByPath.set(part, xml);
 		const safetyIssue = getDocxXmlSafetyIssue(xml);

package/dist/docx/shapeParser.js

@@ -1,4 +1,5 @@
 import { parseAnchorPosition, parseAnchorWrap, parseFill, parseOutline } from "./drawingUtils.js";
+import { parseNonVisualDrawingNames } from "./nonVisualDrawingProps.js";
 import { ShapeTypeSchema, narrowEnum } from "./parserEnums.js";
 import { findAllDeep, findChildByLocalName, findChildren, getAttribute, getChildElements, parseNumericAttribute, parseOnOffAttribute } from "./xmlParser.js";
 //#region src/docx/shapeParser.ts
@@ -139,16 +140,15 @@ function parseShape(node) {
 	const fill = parseShapeFill(spPr);
 	const outline = parseOutline(spPr);
 	const id = cNvPr ? getAttribute(cNvPr, null, "id") ?? void 0 : void 0;
-	const name = cNvPr ? getAttribute(cNvPr, null, "name") ?? void 0 : void 0;
 	const shape = {
 		type: "shape",
 		shapeType,
-		size
+		size,
+		...parseNonVisualDrawingNames(cNvPr)
 	};
 	const geometryAdjustments = parseGeometryAdjustments(spPr);
 	if (geometryAdjustments !== void 0) shape.geometryAdjustments = geometryAdjustments;
 	if (id !== void 0) shape.id = id;
-	if (name !== void 0) shape.name = name;
 	if (fill !== void 0) shape.fill = fill;
 	if (outline !== void 0) shape.outline = outline;
 	if (transform !== void 0) shape.transform = transform;
@@ -193,9 +193,11 @@ function parseShapeFromDrawing(drawingEl) {
 	const docPr = findChildByLocalName(container, "docPr");
 	if (docPr) {
 		const id = getAttribute(docPr, null, "id");
-		const name = getAttribute(docPr, null, "name");
 		if (id !== null) shape.id = id;
-		if (name !== null) shape.name = name;
+		const names = parseNonVisualDrawingNames(docPr);
+		if (names.name !== void 0) shape.name = names.name;
+		if (names.alt !== void 0) shape.alt = names.alt;
+		if (names.title !== void 0) shape.title = names.title;
 	}
 	return shape;
 }

package/dist/docx/textBoxParser.js

@@ -1,5 +1,6 @@
 import { emuToPixels } from "../utils/units.js";
 import { parseAnchorPosition, parseAnchorWrap, parseFill, parseOutline, resolveColorValueToHex } from "./drawingUtils.js";
+import { parseNonVisualDrawingNames } from "./nonVisualDrawingProps.js";
 import { findByFullName, findChildByLocalName, findChildByNamespaceUri, findChildrenByLocalName, findChildrenByNamespaceUri, getAttribute, getChildElements, parseNumericAttribute, parseOnOffAttribute } from "./xmlParser.js";
 //#region src/docx/textBoxParser.ts
 const DRAWINGML_MAIN_NAMESPACE_URIS = /* @__PURE__ */ new Set(["http://schemas.openxmlformats.org/drawingml/2006/main", "http://purl.oclc.org/ooxml/drawingml/main"]);
@@ -148,13 +149,15 @@ function parseTextBox(drawingEl) {
 	};
 	const docPr = findByFullName(container, "wp:docPr");
 	const id = docPr ? getAttribute(docPr, null, "id") ?? void 0 : void 0;
+	const names = parseNonVisualDrawingNames(docPr);
 	const fill = parseFill(spPr ?? null);
 	const outline = parseOutline(spPr ?? null);
 	const bodyProps = parseBodyProperties(bodyPr ?? null);
 	const textBox = {
 		type: "textBox",
 		size,
-		content: []
+		content: [],
+		...names
 	};
 	if (id) textBox.id = id;
 	if (fill) textBox.fill = fill;
@@ -193,13 +196,15 @@ function parseTextBoxFromShape(wsp, size, position, wrap) {
 	const bodyPr = findChildByNamespaceUri(wsp, WORDPROCESSING_SHAPE_NAMESPACE_URIS, "bodyPr");
 	const cNvPr = wspChildren.find((el) => el.name === "wps:cNvPr");
 	const id = cNvPr ? getAttribute(cNvPr, null, "id") ?? void 0 : void 0;
+	const names = parseNonVisualDrawingNames(cNvPr);
 	const fill = parseFill(spPr ?? null);
 	const outline = parseOutline(spPr ?? null);
 	const bodyProps = parseBodyProperties(bodyPr ?? null);
 	const textBox = {
 		type: "textBox",
 		size,
-		content: []
+		content: [],
+		...names
 	};
 	if (id) textBox.id = id;
 	if (fill) textBox.fill = fill;

package/dist/docx/unzip.d.ts

@@ -6,10 +6,33 @@ declare class DocxSecurityError extends Error {
 type DocxUnzipLimits = {
   maxInputBytes: number;
   maxFiles: number;
+  /**
+   * Inflated bytes allowed in one XML part.
+   *
+   * A byte ceiling bounds the markup, not what parsing it allocates: a parsed
+   * tree costs 3x to 15x the part's bytes, and the cheapest element to write
+   * is the most expensive per byte. Use `maxXmlElementsPerPart` and the
+   * package bounds to cap memory; this one caps text-dominated parts, where
+   * bytes and cost do track each other.
+   */
   maxXmlBytes: number;
   maxMediaBytes: number;
   maxFontBytes: number;
+  /**
+   * Inflated bytes allowed across every entry in the package.
+   *
+   * Same caveat as `maxXmlBytes`: this is a ceiling on what passes through
+   * memory as bytes, not on what the parsed structure retains.
+   */
   maxTotalUncompressedBytes: number;
+  /** Elements allowed in one XML part, counted before any tree is built. */
+  maxXmlElementsPerPart: number;
+  /** Attributes allowed in one XML part, counted before any tree is built. */
+  maxXmlAttributesPerPart: number;
+  /** Elements allowed across every XML part in the package. */
+  maxXmlElementsPerPackage: number;
+  /** Attributes allowed across every XML part in the package. */
+  maxXmlAttributesPerPackage: number;
   allowedMediaMimeTypes: ReadonlySet<string>;
 };
 type DocxUnzipOptions = Partial<Omit<DocxUnzipLimits, "allowedMediaMimeTypes">> & {

package/dist/docx/unzip.js

@@ -1,6 +1,7 @@
+import { bytesToDataUrl } from "../utils/base64.js";
 import { DOCX_CONTAINER_TYPES, detectDocxContainerType } from "./encryption/containerFormat.js";
 import { openDocxBuffer } from "./encryption/openEncryptedDocx.js";
-import { FOLIO_XML_RESOURCE_LIMITS, assertXmlResourceLimits } from "./xmlResourceLimits.js";
+import { FOLIO_XML_RESOURCE_LIMITS, assertXmlResourceLimits, createXmlPackageBudget } from "./xmlResourceLimits.js";
 import JSZip from "jszip";
 //#region src/docx/unzip.ts
 /**
@@ -58,8 +59,21 @@ const DEFAULT_UNZIP_LIMITS = {
 	maxMediaBytes: 25 * MEBIBYTE,
 	maxFontBytes: 10 * MEBIBYTE,
 	maxTotalUncompressedBytes: 250 * MEBIBYTE,
+	maxXmlElementsPerPart: FOLIO_XML_RESOURCE_LIMITS.maxElementsPerPart,
+	maxXmlAttributesPerPart: FOLIO_XML_RESOURCE_LIMITS.maxAttributesPerPart,
+	maxXmlElementsPerPackage: FOLIO_XML_RESOURCE_LIMITS.maxElementsPerPackage,
+	maxXmlAttributesPerPackage: FOLIO_XML_RESOURCE_LIMITS.maxAttributesPerPackage,
 	allowedMediaMimeTypes: DEFAULT_ALLOWED_MEDIA_MIME_TYPES
 };
+/** The XML bounds an unzip enforces, in the shape the preflight takes. */
+const xmlResourceLimitsFor = (limits) => ({
+	maxBytes: limits.maxXmlBytes,
+	maxDepth: FOLIO_XML_RESOURCE_LIMITS.maxDepth,
+	maxElementsPerPart: limits.maxXmlElementsPerPart,
+	maxAttributesPerPart: limits.maxXmlAttributesPerPart,
+	maxElementsPerPackage: limits.maxXmlElementsPerPackage,
+	maxAttributesPerPackage: limits.maxXmlAttributesPerPackage
+});
 const PARSED_XML_PARTS = /* @__PURE__ */ new Set([
 	"[content_types].xml",
 	"_rels/.rels",
@@ -188,10 +202,11 @@ async function unzipDocx(buffer, options = {}) {
 			}));
 		}
 	}
+	const xmlBudget = createXmlPackageBudget();
 	for (const extracted of await Promise.all(extractionTasks.map((extract) => extract()))) {
 		if (!extracted) continue;
 		if (extracted.type === "xml") {
-			assignXmlContent(content, extracted, limits);
+			assignXmlContent(content, extracted, limits, xmlBudget);
 			continue;
 		}
 		if (extracted.type === "media") {
@@ -203,19 +218,21 @@ async function unzipDocx(buffer, options = {}) {
 	return content;
 }
 /**
-* Parts that every consumer expands into an object tree. Preflighting them once
-* here puts the bound on the unzip, so `parseDocx`, the selective save and the
-* repack path all share it instead of each entry point carrying its own.
+* Preflight every XML part the unzip retains, not a named few.
+*
+* Naming the parts to bound is the bug: `word/document.xml`, `word/styles.xml`
+* and `word/numbering.xml` were counted, and headers, footers, footnotes,
+* endnotes, comments and every other `word/*.xml` part were parsed into trees
+* unbounded. Bounding the reader instead of the part list means a part added
+* later is bounded by construction, and the package budget makes the ceiling
+* the package's rather than each part's.
 */
-const PREFLIGHT_XML_PARTS = /* @__PURE__ */ new Set([
-	"word/document.xml",
-	"word/styles.xml",
-	"word/numbering.xml"
-]);
-function assignXmlContent(content, { path, lowerPath, content: xmlContent }, limits) {
-	if (PREFLIGHT_XML_PARTS.has(lowerPath)) assertXmlResourceLimits(xmlContent, {
-		...FOLIO_XML_RESOURCE_LIMITS,
-		maxBytes: limits.maxXmlBytes
+function assignXmlContent(content, { path, lowerPath, content: xmlContent }, limits, budget) {
+	assertXmlResourceLimits({
+		xml: xmlContent,
+		limits: xmlResourceLimitsFor(limits),
+		partPath: path,
+		budget
 	});
 	content.allXml.set(path, xmlContent);
 	if (lowerPath === "word/document.xml") content.documentXml = xmlContent;
@@ -426,14 +443,7 @@ function getMediaMimeType(path) {
 * @returns Data URL string
 */
 function mediaToDataUrl(data, mimeType) {
-	const bytes = new Uint8Array(data);
-	const chunks = [];
-	const chunkSize = 32768;
-	for (let offset = 0; offset < bytes.length; offset += chunkSize) {
-		const chunk = bytes.subarray(offset, offset + chunkSize);
-		chunks.push(String.fromCodePoint(...chunk));
-	}
-	return `data:${mimeType};base64,${btoa(chunks.join(""))}`;
+	return bytesToDataUrl(new Uint8Array(data), mimeType);
 }
 /**
 * Extract a specific file from the original ZIP

package/dist/docx/verbatimCapture.js

@@ -270,7 +270,7 @@ const parsedReplayEnvelope = (xml, inheritedNamespaceScope) => {
 };
 const withinXmlResourceLimits = (xml) => {
 	try {
-		assertXmlResourceLimits(xml);
+		assertXmlResourceLimits({ xml });
 		return true;
 	} catch {
 		return false;

package/dist/docx/vmlImageParser.js

@@ -1,6 +1,7 @@
 import { sanitizeImageSrc } from "../utils/sanitizeImageSrc.js";
 import { pixelsToEmu } from "../utils/units.js";
 import { resolveImageData } from "./imageParser.js";
+import { PREVIEW_KINDS } from "./previewBudget.js";
 import { captureVerbatimXml } from "./verbatimCapture.js";
 import { isValidVmlPreviewDimension, parseVmlNumber, parseVmlStyle, renderStandaloneVmlPreview, renderVmlGroupPreview, vmlCssLengthToPx, vmlSvgDataUrl } from "./vmlPreview.js";
 import { isWatermarkShape } from "./watermarkParser.js";
@@ -73,8 +74,8 @@ const previewImage = (pictElement, svg, widthPx, heightPx, style, rootXmlns) =>
 			type: "image",
 			rId: "",
 			src,
-			mimeType: "image/svg+xml",
-			filename: "vml-shape-preview.svg",
+			mimeType: PREVIEW_KINDS.vmlShape.mimeType,
+			filename: PREVIEW_KINDS.vmlShape.filename,
 			size: {
 				width: pixelsToEmu(widthPx),
 				height: pixelsToEmu(heightPx)

package/dist/docx/vmlPreview.d.ts

@@ -25,7 +25,5 @@ declare const vmlSvgDataUrl: (svg: string) => string | undefined;
 declare const renderStandaloneVmlPreview: (shape: XmlElement) => VmlPreviewResult;
 /** Render a VML group through bounded, non-clipping local-coordinate transforms. */
 declare const renderVmlGroupPreview: (group: XmlElement) => VmlPreviewResult;
-/** Bound retained synthetic VML previews while preserving their raw replay nodes. */
-declare const enforcePackageVmlPreviewBudget: (root: unknown, maxCharacters?: number) => void;
 //#endregion
-export { VmlPreviewResult, enforcePackageVmlPreviewBudget, isValidVmlPreviewDimension, parseVmlNumber, parseVmlStyle, renderStandaloneVmlPreview, renderVmlGroupPreview, vmlCssLengthToPx, vmlSvgDataUrl };
+export { VmlPreviewResult, isValidVmlPreviewDimension, parseVmlNumber, parseVmlStyle, renderStandaloneVmlPreview, renderVmlGroupPreview, vmlCssLengthToPx, vmlSvgDataUrl };

package/dist/docx/vmlPreview.js

@@ -1,3 +1,4 @@
+import { VML_PREVIEW_DATA_URL_PREFIX } from "./previewBudget.js";
 import { findChild, findDeep, getAttribute, getChildElements, getLocalName } from "./xmlParser.js";
 //#region src/docx/vmlPreview.ts
 const MAX_VML_PREVIEW_DEPTH = 16;
@@ -6,10 +7,6 @@ const MAX_VML_PREVIEW_PATH_POINTS = 2e4;
 const MAX_VML_PREVIEW_COORDINATE = 1e6;
 const MAX_VML_PREVIEW_DIMENSION_PX = 2e4;
 const MAX_VML_SVG_CHARACTERS = 1e6;
-const MAX_PACKAGE_VML_PREVIEW_CHARACTERS = 8 * 1024 * 1024;
-const VML_PREVIEW_DATA_URL_PREFIX = "data:image/svg+xml;charset=utf-8,";
-const VML_PREVIEW_FILENAME = "vml-shape-preview.svg";
-const VML_PREVIEW_MIME_TYPE = "image/svg+xml";
 const SAFE_VML_COLORS = /* @__PURE__ */ new Set([
 	"black",
 	"white",
@@ -506,30 +503,5 @@ const renderVmlGroupPreview = (group) => {
 		style
 	};
 };
-/** Bound retained synthetic VML previews while preserving their raw replay nodes. */
-const enforcePackageVmlPreviewBudget = (root, maxCharacters = MAX_PACKAGE_VML_PREVIEW_CHARACTERS) => {
-	let remainingCharacters = Math.max(0, maxCharacters);
-	const visited = /* @__PURE__ */ new WeakSet();
-	const visit = (value) => {
-		if (value === null || typeof value !== "object" || visited.has(value)) return;
-		visited.add(value);
-		if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) return;
-		if (value instanceof Map) {
-			for (const child of value.values()) visit(child);
-			return;
-		}
-		if (Array.isArray(value)) {
-			for (const child of value) visit(child);
-			return;
-		}
-		if ("type" in value && value.type === "image" && "rId" in value && value.rId === "" && "mimeType" in value && value.mimeType === VML_PREVIEW_MIME_TYPE && "filename" in value && value.filename === VML_PREVIEW_FILENAME && "src" in value && typeof value.src === "string" && value.src.startsWith(VML_PREVIEW_DATA_URL_PREFIX)) if (value.src.length <= remainingCharacters) remainingCharacters -= value.src.length;
-		else {
-			remainingCharacters = 0;
-			delete value.src;
-		}
-		for (const child of Object.values(value)) visit(child);
-	};
-	visit(root);
-};
 //#endregion
-export { enforcePackageVmlPreviewBudget, isValidVmlPreviewDimension, parseVmlNumber, parseVmlStyle, renderStandaloneVmlPreview, renderVmlGroupPreview, vmlCssLengthToPx, vmlSvgDataUrl };
+export { isValidVmlPreviewDimension, parseVmlNumber, parseVmlStyle, renderStandaloneVmlPreview, renderVmlGroupPreview, vmlCssLengthToPx, vmlSvgDataUrl };

package/dist/docx/xmlParser.d.ts

@@ -71,7 +71,22 @@ declare const NAMESPACES: {
 declare const OOXML_NAMESPACE_SCOPE: XmlNamespaceScope;
 declare function parseXml(xml: string, inheritedNamespaceScope?: XmlNamespaceScope): XmlElement;
 /**
- * Serialize an XmlElement back to an XML string
+ * Serialize an XmlElement back to an XML string.
+ *
+ * Written here rather than handed to `fast-xml-parser`'s builder for two
+ * reasons. The builder writes a tab or a newline inside an attribute value
+ * literally, and XML 1.0 §3.3.3 has every conformant reader normalise those to
+ * a space: a `descr="two lines
"` a source file wrote came back as
+ * `descr="two lines "`. `escapeXmlAttribute` writes the character references
+ * that survive that step. And the builder returned a string per node, so a
+ * subtree's bytes were copied into its parent's answer, its grandparent's and
+ * so on, which `writeElement` below replaces with one buffer.
+ *
+ * Those two are the whole difference from the builder: the attribute
+ * character references, an attribute the model dropped written as absent
+ * rather than as the word "undefined", and the characters XML 1.0 §2.2 admits
+ * no spelling for dropped. Every other rule reproduces its output byte for
+ * byte, so replaying a capture is unchanged wherever it was already correct.
  */
 declare function elementToXml(element: XmlElement): string;
 /**

package/dist/docx/xmlParser.js

@@ -1,6 +1,7 @@
 import { NUMBERS_PER_PERCENT, percentageSpelling, transitionalSlotEncoding } from "./transitionalSpelling.js";
 import { universalMeasureAs } from "./universalMeasure.js";
-import { XMLBuilder, XMLParser } from "fast-xml-parser";
+import { escapeXmlAttribute, escapeXmlText } from "@stll/docx-core";
+import { XMLParser } from "fast-xml-parser";
 import { OOXML_NS } from "@stll/docx-utils";
 import { PARSE_WARNING_CODES } from "@stll/docx-core/model";
 //#region src/docx/xmlParser.ts
@@ -42,22 +43,12 @@ const fxpParserOptionsWithStopNodes = {
 	...fxpParserOptions,
 	stopNodes: ["*.w:binData"]
 };
-const fxpBuilderOptions = {
-	preserveOrder: true,
-	ignoreAttributes: false,
-	attributeNamePrefix: "",
-	textNodeName: "#text",
-	suppressEmptyNode: true
-};
 const fxpParser = new XMLParser(fxpParserOptions);
 const fxpParserWithStopNodes = new XMLParser(fxpParserOptionsWithStopNodes);
-const fxpBuilder = new XMLBuilder(fxpBuilderOptions);
 /** Text node key used by fast-xml-parser in preserveOrder mode. */
 const TEXT_KEY = "#text";
 /** Attribute group key used by fast-xml-parser in preserveOrder mode. */
 const ATTR_KEY = ":@";
-/** Character reference required to keep carriage returns through XML end-of-line normalization. */
-const XML_CARRIAGE_RETURN_REFERENCE = "
";
 const EMPTY_NAMESPACE_SCOPE = { bindings: /* @__PURE__ */ new Map() };
 const resolveNamespaceUri = (scope, prefix) => {
 	let current = scope;
@@ -138,18 +129,6 @@ function fxpToRootElement(nodes, inheritedNamespaceScope = EMPTY_NAMESPACE_SCOPE
 	return { elements: nodes };
 }
 /**
-* Convert an XmlElement back into the fast-xml-parser preserveOrder format
-* so we can feed it to XMLBuilder.
-*/
-function elementToFxpNode(el) {
-	if (el.type === "text") return { [TEXT_KEY]: el.text ?? "" };
-	const name = el.name ?? "";
-	const children = el.elements ? el.elements.map(elementToFxpNode) : [];
-	const node = { [name]: children };
-	if (el.attributes && Object.keys(el.attributes).length > 0) node[ATTR_KEY] = el.attributes;
-	return node;
-}
-/**
 * Common OOXML namespace URIs — re-exported from @stll/docx-utils.
 */
 const NAMESPACES = OOXML_NS;
@@ -174,13 +153,64 @@ function parseXml(xml, inheritedNamespaceScope = EMPTY_NAMESPACE_SCOPE) {
 	return fxpToRootElement((xml.includes("binData") ? fxpParserWithStopNodes : fxpParser).parse(xml), inheritedNamespaceScope);
 }
 /**
-* Serialize an XmlElement back to an XML string
+* Serialize an XmlElement back to an XML string.
+*
+* Written here rather than handed to `fast-xml-parser`'s builder for two
+* reasons. The builder writes a tab or a newline inside an attribute value
+* literally, and XML 1.0 §3.3.3 has every conformant reader normalise those to
+* a space: a `descr="two lines
"` a source file wrote came back as
+* `descr="two lines "`. `escapeXmlAttribute` writes the character references
+* that survive that step. And the builder returned a string per node, so a
+* subtree's bytes were copied into its parent's answer, its grandparent's and
+* so on, which `writeElement` below replaces with one buffer.
+*
+* Those two are the whole difference from the builder: the attribute
+* character references, an attribute the model dropped written as absent
+* rather than as the word "undefined", and the characters XML 1.0 §2.2 admits
+* no spelling for dropped. Every other rule reproduces its output byte for
+* byte, so replaying a capture is unchanged wherever it was already correct.
 */
 function elementToXml(element) {
-	const fxpNode = elementToFxpNode(element);
-	return fxpBuilder.build([fxpNode]).replaceAll("\r", XML_CARRIAGE_RETURN_REFERENCE);
+	const out = [];
+	writeElement(element, out);
+	return out.join("");
 }
 /**
+* Serialize into one shared buffer rather than a string per node.
+*
+* Returning a string per element makes a subtree's bytes a substring of its
+* parent's, its grandparent's and so on, so a table pays for its rows, its
+* rows pay for their cells, and a part that nests four levels deep is copied
+* four times before anything is written. Appending into one array of chunks
+* and joining once costs each node its own text and nothing for its ancestors.
+*
+* Whether an element self-closes is not known until its children are written,
+* so the opening tag reserves a slot in the buffer and fills it afterwards:
+* `>` when something was appended, `/>` when nothing was.
+*/
+const writeElement = (element, out) => {
+	if (element.type === "text") {
+		const text = String(element.text ?? "");
+		if (text !== "") out.push(escapeXmlText(text));
+		return;
+	}
+	const name = element.name ?? "";
+	out.push(`<${name}`);
+	if (element.attributes) for (const [attribute, value] of Object.entries(element.attributes)) {
+		if (value === void 0) continue;
+		out.push(` ${attribute}="${escapeXmlAttribute(String(value))}"`);
+	}
+	const openingSlot = out.push("") - 1;
+	const contentStart = out.length;
+	for (const child of element.elements ?? []) writeElement(child, out);
+	if (out.length === contentStart) {
+		out[openingSlot] = "/>";
+		return;
+	}
+	out[openingSlot] = ">";
+	out.push(`</${name}>`);
+};
+/**
 * Parse XML string to a more convenient format
 */
 function parseXmlDocument(xml) {