@stll/folio-core 0.53.0 → 0.54.1

package/dist/docx/archiveInflation.d.ts

@@ -0,0 +1,127 @@
+import JSZip from "jszip";
+//#region src/docx/archiveInflation.d.ts
+declare module "jszip" {
+  interface JSZipObject {
+    /**
+     * Chunked read of the entry content, missing from the published typings.
+     * `nodeStream` is this stream wrapped in a Node.js `Readable`, which
+     * browsers and web workers cannot provide; the stream itself is
+     * platform-neutral.
+     */
+    internalStream(type: "uint8array"): JSZip.JSZipStreamHelper<Uint8Array>;
+  }
+}
+/**
+ * Default ceiling on inflated bytes per compressed byte.
+ *
+ * Document parts in the repository's fixtures stay under 75:1, and parts over a
+ * mebibyte under 15:1. A DEFLATE stream tops out near 1032:1, which is the
+ * shape of an entry made of one repeated byte.
+ */
+declare const DOCX_MAX_COMPRESSION_RATIO = 200;
+/**
+ * Inflated size below which the ratio cap does not apply.
+ *
+ * A small part can compress extremely well without costing anything to hold,
+ * so the ratio only has to bound entries (and packages) large enough to
+ * matter. The byte caps still apply below this size.
+ */
+declare const DOCX_COMPRESSION_RATIO_GRACE_BYTES: number;
+/**
+ * Upper bound on the central-directory records in `bytes`, counted without
+ * parsing the archive and stopping once the count passes `stopAfter`.
+ *
+ * Every record JSZip reads starts with the record signature, so the number of
+ * signature occurrences cannot be lower than the number of entries JSZip would
+ * build, whatever the end-of-central-directory record claims.
+ */
+declare const countCentralDirectoryRecords: (bytes: Uint8Array, stopAfter: number) => number;
+/** Sizes a loaded entry declares in the central directory. */
+type ZipEntrySizes = {
+  readonly compressedBytes: number | null;
+  readonly uncompressedBytes: number | null;
+};
+/** Declared sizes of an entry JSZip loaded from an archive. */
+declare const getZipEntrySizes: (entry: JSZip.JSZipObject) => ZipEntrySizes;
+/**
+ * Whether a loaded entry is stored rather than compressed. A stored entry
+ * reads back exactly the bytes the archive carries, so it cannot expand.
+ */
+declare const isStoredZipEntry: (entry: JSZip.JSZipObject) => boolean;
+/**
+ * Whether the per-entry ratio cap applies to a part. Markup and text parts
+ * never compress anywhere near the cap. Binary parts can: an uncompressed
+ * bitmap of one colour compresses like a run of one byte. Those stay bounded
+ * by the byte caps and the package-wide ratio instead.
+ */
+declare const isRatioBoundedPart: (path: string) => boolean;
+/** The per-entry ratio cap for `path`: `maxRatio`, or none for a binary part. */
+declare const compressionRatioLimitFor: (path: string, maxRatio: number) => number;
+type CompressionRatioCheck = {
+  inflatedBytes: number;
+  compressedBytes: number | null;
+  maxRatio: number;
+};
+/**
+ * Whether `inflatedBytes` produced from `compressedBytes` passes the ratio cap.
+ * Sizes under {@link DOCX_COMPRESSION_RATIO_GRACE_BYTES} never do, and an
+ * unknown compressed size is left to the byte caps.
+ */
+declare const exceedsCompressionRatio: ({ inflatedBytes, compressedBytes, maxRatio }: CompressionRatioCheck) => boolean;
+/**
+ * Inflated bytes charged across one package. `aborted` stops every inflation
+ * sharing the budget at its next chunk, once one of them has failed the
+ * package.
+ */
+type InflationBudget = {
+  readonly maxTotalBytes: number;
+  inflatedBytes: number;
+  aborted: boolean;
+};
+declare const createInflationBudget: (maxTotalBytes: number) => InflationBudget;
+/**
+ * The bound an inflation stopped at.
+ *
+ * - `declared-size` — the entry produced more than its declared size.
+ * - `compression-ratio` — the entry passed the ratio cap for its compressed size.
+ * - `entry` — the entry passed the per-entry cap the caller set.
+ * - `total` — the package passed its cumulative budget.
+ * - `aborted` — another inflation sharing the budget already failed.
+ */
+type InflationLimit = "declared-size" | "compression-ratio" | "entry" | "total" | "aborted";
+type InflateEntryResult = {
+  readonly ok: true;
+  readonly bytes: Uint8Array<ArrayBuffer>;
+} | {
+  readonly ok: false;
+  readonly limit: InflationLimit;
+};
+type InflateEntryOptions = {
+  entry: JSZip.JSZipObject;
+  /** Most bytes this entry may inflate to. */
+  maxEntryBytes: number;
+  /** Ratio cap while streaming; see {@link compressionRatioLimitFor}. */
+  maxCompressionRatio: number;
+  budget: InflationBudget;
+  /**
+   * `false` inflates the entry only to prove it stays within its bounds; the
+   * chunks are dropped and the result carries no bytes. A package part that
+   * is never read here is still inflated by a later save, so the bound has
+   * to be established for it too.
+   */
+  retain?: boolean;
+};
+/**
+ * Inflate one entry chunk by chunk, checking every bound before a chunk is
+ * kept. Pausing the stream abandons the rest of the entry, so a limit bounds
+ * memory rather than reporting an overrun afterwards.
+ *
+ * The budget is charged as chunks arrive, which keeps concurrent inflations
+ * of one package honest, and refunded when this entry stops at a limit or
+ * fails, since none of its bytes are kept. Stream errors (a corrupt entry)
+ * reject; limits resolve with `ok: false` for the caller to map onto its own
+ * error or skip policy.
+ */
+declare const inflateEntryWithinLimits: ({ entry, maxEntryBytes, maxCompressionRatio, budget, retain }: InflateEntryOptions) => Promise<InflateEntryResult>;
+//#endregion
+export { DOCX_COMPRESSION_RATIO_GRACE_BYTES, DOCX_MAX_COMPRESSION_RATIO, InflateEntryOptions, InflateEntryResult, InflationBudget, InflationLimit, ZipEntrySizes, compressionRatioLimitFor, countCentralDirectoryRecords, createInflationBudget, exceedsCompressionRatio, getZipEntrySizes, inflateEntryWithinLimits, isRatioBoundedPart, isStoredZipEntry };

package/dist/docx/archiveInflation.js

@@ -0,0 +1,181 @@
+//#region src/docx/archiveInflation.ts
+/**
+* Default ceiling on inflated bytes per compressed byte.
+*
+* Document parts in the repository's fixtures stay under 75:1, and parts over a
+* mebibyte under 15:1. A DEFLATE stream tops out near 1032:1, which is the
+* shape of an entry made of one repeated byte.
+*/
+const DOCX_MAX_COMPRESSION_RATIO = 200;
+/**
+* Inflated size below which the ratio cap does not apply.
+*
+* A small part can compress extremely well without costing anything to hold,
+* so the ratio only has to bound entries (and packages) large enough to
+* matter. The byte caps still apply below this size.
+*/
+const DOCX_COMPRESSION_RATIO_GRACE_BYTES = 4 * 1024 * 1024;
+const CENTRAL_DIRECTORY_RECORD_SIGNATURE = [
+	80,
+	75,
+	1,
+	2
+];
+/**
+* Upper bound on the central-directory records in `bytes`, counted without
+* parsing the archive and stopping once the count passes `stopAfter`.
+*
+* Every record JSZip reads starts with the record signature, so the number of
+* signature occurrences cannot be lower than the number of entries JSZip would
+* build, whatever the end-of-central-directory record claims.
+*/
+const countCentralDirectoryRecords = (bytes, stopAfter) => {
+	const [first, second, third, fourth] = CENTRAL_DIRECTORY_RECORD_SIGNATURE;
+	let count = 0;
+	let offset = bytes.indexOf(first);
+	while (offset !== -1 && offset + 3 < bytes.length) {
+		if (bytes[offset + 1] === second && bytes[offset + 2] === third && bytes[offset + 3] === fourth) {
+			count += 1;
+			if (count > stopAfter) return count;
+		}
+		offset = bytes.indexOf(first, offset + 1);
+	}
+	return count;
+};
+const finiteSize = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+/** Declared sizes of an entry JSZip loaded from an archive. */
+const getZipEntrySizes = (entry) => {
+	const data = "_data" in entry ? entry._data : void 0;
+	if (typeof data !== "object" || data === null) return {
+		compressedBytes: null,
+		uncompressedBytes: null
+	};
+	return {
+		compressedBytes: "compressedSize" in data ? finiteSize(data.compressedSize) : null,
+		uncompressedBytes: "uncompressedSize" in data ? finiteSize(data.uncompressedSize) : null
+	};
+};
+const STORED_COMPRESSION_MAGIC = "\0\0";
+/**
+* Whether a loaded entry is stored rather than compressed. A stored entry
+* reads back exactly the bytes the archive carries, so it cannot expand.
+*/
+const isStoredZipEntry = (entry) => {
+	const data = "_data" in entry ? entry._data : void 0;
+	if (typeof data !== "object" || data === null || !("compression" in data)) return false;
+	const { compression } = data;
+	return typeof compression === "object" && compression !== null && "magic" in compression && compression.magic === STORED_COMPRESSION_MAGIC;
+};
+const RATIO_BOUNDED_EXTENSIONS = /* @__PURE__ */ new Set([
+	"xml",
+	"rels",
+	"vml",
+	"txt",
+	"htm",
+	"html",
+	"mht",
+	"mhtml",
+	"rtf"
+]);
+/**
+* Whether the per-entry ratio cap applies to a part. Markup and text parts
+* never compress anywhere near the cap. Binary parts can: an uncompressed
+* bitmap of one colour compresses like a run of one byte. Those stay bounded
+* by the byte caps and the package-wide ratio instead.
+*/
+const isRatioBoundedPart = (path) => RATIO_BOUNDED_EXTENSIONS.has(path.slice(path.lastIndexOf(".") + 1).toLowerCase());
+/** The per-entry ratio cap for `path`: `maxRatio`, or none for a binary part. */
+const compressionRatioLimitFor = (path, maxRatio) => isRatioBoundedPart(path) ? maxRatio : Number.POSITIVE_INFINITY;
+/**
+* Whether `inflatedBytes` produced from `compressedBytes` passes the ratio cap.
+* Sizes under {@link DOCX_COMPRESSION_RATIO_GRACE_BYTES} never do, and an
+* unknown compressed size is left to the byte caps.
+*/
+const exceedsCompressionRatio = ({ inflatedBytes, compressedBytes, maxRatio }) => compressedBytes !== null && inflatedBytes > 4194304 && inflatedBytes > compressedBytes * maxRatio;
+const createInflationBudget = (maxTotalBytes) => ({
+	maxTotalBytes,
+	inflatedBytes: 0,
+	aborted: false
+});
+const EMPTY_BYTES = /* @__PURE__ */ new Uint8Array(0);
+const concatChunks = (chunks, totalBytes) => {
+	const merged = new Uint8Array(totalBytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		merged.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return merged;
+};
+/**
+* Inflate one entry chunk by chunk, checking every bound before a chunk is
+* kept. Pausing the stream abandons the rest of the entry, so a limit bounds
+* memory rather than reporting an overrun afterwards.
+*
+* The budget is charged as chunks arrive, which keeps concurrent inflations
+* of one package honest, and refunded when this entry stops at a limit or
+* fails, since none of its bytes are kept. Stream errors (a corrupt entry)
+* reject; limits resolve with `ok: false` for the caller to map onto its own
+* error or skip policy.
+*/
+const inflateEntryWithinLimits = async ({ entry, maxEntryBytes, maxCompressionRatio, budget, retain = true }) => {
+	const { compressedBytes, uncompressedBytes } = getZipEntrySizes(entry);
+	return await new Promise((resolve, reject) => {
+		const stream = entry.internalStream("uint8array");
+		const chunks = [];
+		let entryBytes = 0;
+		let settled = false;
+		const settle = () => {
+			if (settled) return false;
+			settled = true;
+			return true;
+		};
+		const refund = () => {
+			budget.inflatedBytes -= entryBytes;
+		};
+		const stop = (limit) => {
+			if (!settle()) return;
+			stream.pause();
+			refund();
+			resolve({
+				ok: false,
+				limit
+			});
+		};
+		const limitFor = () => {
+			if (budget.aborted) return "aborted";
+			if (uncompressedBytes !== null && entryBytes > uncompressedBytes) return "declared-size";
+			if (exceedsCompressionRatio({
+				inflatedBytes: entryBytes,
+				compressedBytes,
+				maxRatio: maxCompressionRatio
+			})) return "compression-ratio";
+			if (entryBytes > maxEntryBytes) return "entry";
+			if (budget.inflatedBytes > budget.maxTotalBytes) return "total";
+			return null;
+		};
+		stream.on("data", (chunk) => {
+			if (settled) return;
+			entryBytes += chunk.length;
+			budget.inflatedBytes += chunk.length;
+			const limit = limitFor();
+			if (limit !== null) {
+				stop(limit);
+				return;
+			}
+			if (retain) chunks.push(chunk);
+		}).on("end", () => {
+			if (!settle()) return;
+			resolve({
+				ok: true,
+				bytes: retain ? concatChunks(chunks, entryBytes) : EMPTY_BYTES
+			});
+		}).on("error", (error) => {
+			if (!settle()) return;
+			refund();
+			reject(error);
+		}).resume();
+	});
+};
+//#endregion
+export { DOCX_COMPRESSION_RATIO_GRACE_BYTES, DOCX_MAX_COMPRESSION_RATIO, compressionRatioLimitFor, countCentralDirectoryRecords, createInflationBudget, exceedsCompressionRatio, getZipEntrySizes, inflateEntryWithinLimits, isRatioBoundedPart, isStoredZipEntry };

package/dist/docx/metadataPrivacy.js

@@ -1,3 +1,4 @@
+import { countCentralDirectoryRecords, createInflationBudget, inflateEntryWithinLimits } from "./archiveInflation.js";
 import { elementToXml, getLocalName, parseXmlDocument } from "./xmlParser.js";
 import { TaggedError } from "better-result";
 import JSZip from "jszip";
@@ -63,6 +64,10 @@ const loadPrivacyArchive = async (buffer) => {
 		message: "Document privacy input exceeded the compressed-size limit",
 		reason: "input-too-large"
 	});
+	if (countCentralDirectoryRecords(new Uint8Array(buffer), MAX_ARCHIVE_ENTRIES) > MAX_ARCHIVE_ENTRIES) throw new FolioDocumentPrivacyArchiveError({
+		message: "Document privacy input exceeded the package-entry limit",
+		reason: "too-many-entries"
+	});
 	let zip;
 	try {
 		zip = await JSZip.loadAsync(buffer);
@@ -109,6 +114,24 @@ const rewriteCorePropertiesPrivacy = (xml, transforms) => {
 		removedMetadataProperties: FOLIO_DOCUMENT_METADATA_PROPERTIES.filter((property) => removedPropertySet.has(property))
 	};
 };
+/**
+* Read the core-properties part within its size limit. The declared size was
+* checked when the archive loaded, but only the inflation itself can show that
+* the part is no larger than it claims.
+*/
+const readCoreProperties = async (entry) => {
+	const result = await inflateEntryWithinLimits({
+		entry,
+		maxEntryBytes: MAX_CORE_PROPERTIES_BYTES,
+		maxCompressionRatio: 200,
+		budget: createInflationBudget(MAX_CORE_PROPERTIES_BYTES)
+	});
+	if (!result.ok) throw new FolioDocumentPrivacyArchiveError({
+		message: "Document privacy core properties exceeded the part-size limit",
+		reason: "core-properties-too-large"
+	});
+	return new TextDecoder("utf-8", { ignoreBOM: true }).decode(result.bytes);
+};
 /** Rewrite selected package metadata fields without changing other package parts. */
 const rewriteDocxMetadataPrivacy = async (buffer, { transforms }) => {
 	const appliedTransforms = resolveFolioDocumentPrivacyTransforms(transforms);
@@ -121,7 +144,7 @@ const rewriteDocxMetadataPrivacy = async (buffer, { transforms }) => {
 			removedMetadataProperties: []
 		}
 	};
-	const rewritten = rewriteCorePropertiesPrivacy(await coreProperties.async("text"), appliedTransforms);
+	const rewritten = rewriteCorePropertiesPrivacy(await readCoreProperties(coreProperties), appliedTransforms);
 	if (rewritten.removedMetadataProperties.length === 0) return {
 		buffer,
 		privacyReport: {

package/dist/docx/noteReferenceMark.d.ts

@@ -0,0 +1,15 @@
+import { document_d_exports } from "../types/document.js";
+//#region src/docx/noteReferenceMark.d.ts
+type NoteKind = "footnote" | "endnote";
+/** The run carrying a note's in-note reference mark, in the note reference style. */
+declare const noteReferenceMarkRun: (kind: NoteKind) => document_d_exports.Run;
+/**
+ * A note's content with its reference mark run at the start of its first
+ * paragraph, added when the note has none.
+ */
+declare const withNoteReferenceMark: (kind: NoteKind, content: readonly document_d_exports.BlockContent[]) => document_d_exports.BlockContent[];
+/** A new note, as an editor adds one: its content led by its own reference mark. */
+declare function createNote(kind: "footnote", id: number, content: readonly document_d_exports.BlockContent[]): document_d_exports.Footnote;
+declare function createNote(kind: "endnote", id: number, content: readonly document_d_exports.BlockContent[]): document_d_exports.Endnote;
+//#endregion
+export { createNote, noteReferenceMarkRun, withNoteReferenceMark };

package/dist/docx/noteReferenceMark.js

@@ -0,0 +1,48 @@
+import { cloneParagraphWithPropertySource } from "./paragraphPropertySource.js";
+//#region src/docx/noteReferenceMark.ts
+const MARK_ELEMENT = /<(?:[\w.-]+:)?(?:footnote|endnote)Ref[\s/>]/u;
+/** The run carrying a note's in-note reference mark, in the note reference style. */
+const noteReferenceMarkRun = (kind) => ({
+	type: "run",
+	formatting: { styleId: kind === "footnote" ? "FootnoteReference" : "EndnoteReference" },
+	content: [{
+		type: "preservedXml",
+		xml: `<w:${kind}Ref/>`,
+		text: ""
+	}]
+});
+const holdsReferenceMark = (value) => {
+	if (Array.isArray(value)) return value.some(holdsReferenceMark);
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	if (record["type"] === "preservedXml" && typeof record["xml"] === "string") return MARK_ELEMENT.test(record["xml"]);
+	return Object.values(record).some(holdsReferenceMark);
+};
+/**
+* A note's content with its reference mark run at the start of its first
+* paragraph, added when the note has none.
+*/
+const withNoteReferenceMark = (kind, content) => {
+	if (holdsReferenceMark(content)) return [...content];
+	const index = content.findIndex((block) => block.type === "paragraph");
+	const mark = noteReferenceMarkRun(kind);
+	if (index === -1) return [{
+		type: "paragraph",
+		content: [mark]
+	}, ...content];
+	const paragraph = content[index];
+	return content.map((block, position) => position === index ? cloneParagraphWithPropertySource(paragraph, { content: [mark, ...paragraph.content] }) : block);
+};
+function createNote(kind, id, content) {
+	return kind === "footnote" ? {
+		type: "footnote",
+		id,
+		content: withNoteReferenceMark(kind, content)
+	} : {
+		type: "endnote",
+		id,
+		content: withNoteReferenceMark(kind, content)
+	};
+}
+//#endregion
+export { createNote, noteReferenceMarkRun, withNoteReferenceMark };

package/dist/docx/paragraphParser.js

@@ -2,6 +2,7 @@ import { isValidHexId } from "../utils/hexId.js";
 import { attributeRemainder } from "./attributeRemainder.js";
 import { parseBookmarkEnd as parseBookmarkEnd$1, parseBookmarkStart as parseBookmarkStart$1 } from "./bookmarkParser.js";
 import { CAPTURE, dispatchChildrenWithContext, ownedElsewhere, transitionalNamespaceOf, withPreservedChildren } from "./containerChildren.js";
+import { resolveDefaultParagraphStyle } from "./defaultParagraphStyle.js";
 import { parseFieldType } from "./fieldParser.js";
 import { fieldStateOf, parseFieldState } from "./fieldState.js";
 import { HYPERLINK_CHILD_HANDLERS, parseHyperlink as parseHyperlink$1, parseHyperlinkShell } from "./hyperlinkParser.js";
@@ -1241,7 +1242,8 @@ function parseParagraph(node, styles, theme, numbering, rels = null, media = nul
 				}
 				if (implicitChildLevelAdvances > 0) listRendering.implicitChildLevelAdvances = implicitChildLevelAdvances;
 				paragraph.listRendering = listRendering;
-				const chainInd = numPrFromStyle ? styleChainInd(paragraph.formatting?.styleId, styles) : {
+				const styleInd = styleChainInd(paragraph.formatting?.styleId ?? (styles ? resolveDefaultParagraphStyle(styles.values())?.styleId : void 0), styles);
+				const chainInd = numPrFromStyle ? styleInd : {
 					left: false,
 					firstLine: false
 				};
@@ -1250,8 +1252,8 @@ function parseParagraph(node, styles, theme, numbering, rels = null, media = nul
 					const directInd = pPr ? findChild(pPr, "w", "ind") : null;
 					const hasDirectLeft = hasAttributeAnySpelling(directInd, "CT_Ind @left");
 					const hasDirectFirstLineOrHanging = parseNumericAttribute(directInd, "w", "firstLine") !== void 0 || parseNumericAttribute(directInd, "w", "hanging") !== void 0;
-					if (!hasDirectLeft && !chainInd.left && level.pPr.indentLeft !== void 0) paragraph.formatting.indentLeft = level.pPr.indentLeft;
-					if (!hasDirectFirstLineOrHanging && !chainInd.firstLine && numberingLevelHasMarkerSlot(level)) {
+					if (!hasDirectLeft && !chainInd.left && level.pPr.indentLeft !== void 0 && (level.pPr.indentLeft !== 0 || styleInd.left)) paragraph.formatting.indentLeft = level.pPr.indentLeft;
+					if (!hasDirectFirstLineOrHanging && !chainInd.firstLine && numberingLevelHasMarkerSlot(level) && (level.pPr.indentFirstLine !== 0 || styleInd.firstLine)) {
 						if (level.pPr.indentFirstLine !== void 0) paragraph.formatting.indentFirstLine = level.pPr.indentFirstLine;
 						if (level.pPr.hangingIndent !== void 0) paragraph.formatting.hangingIndent = level.pPr.hangingIndent;
 					}

package/dist/docx/paragraphPropertySource.d.ts

@@ -136,4 +136,4 @@ declare const linkParagraphPropertySourceCandidate: (target: document_d_exports.
 declare const getParagraphPropertySourceCandidate: (paragraph: document_d_exports.Paragraph) => document_d_exports.Paragraph | undefined;
 declare const getParagraphPropertySourceTransferId: (paragraph: document_d_exports.Paragraph) => string | undefined;
 //#endregion
-export { DecodedTableCellParagraphSourcePayload, PARAGRAPH_PROPERTY_SOURCE_VALIDATION_CODES, PROSE_PARAGRAPH_SOURCE_CONTRACT_ATTR, PROSE_PARAGRAPH_SOURCE_TOKEN_ATTR, ParagraphPropertySourceValidationCode, ParagraphPropertySourceValidationError, TABLE_CELL_PARAGRAPH_SOURCE_BINDING_ATTR, TABLE_CELL_PARAGRAPH_SOURCE_PAYLOAD_ERROR_CLASSIFICATIONS, TableCellParagraphPropertySourceBinding, TableCellParagraphSourcePayloadErrorClassification, assignDocumentParagraphPropertySourceContract, assignParagraphPropertySource, cloneDocumentWithParagraphPropertySources, cloneParagraphWithPropertySource, cloneParagraphWithoutPropertySource, cloneTableCellsWithParagraphPropertyCaptures, copyDocumentParagraphPropertySourceContract, copyDocumentParagraphPropertySources, copyParagraphPropertyCapture, copyParagraphPropertySource, createProseParagraphWithPropertySource, decodeTableCellParagraphSourcePayload, getDocumentParagraphPropertySourceContract, getExplicitParagraphPropertySourceTransfers, getParagraphPropertySource, getParagraphPropertySourceCandidate, getParagraphPropertySourceToken, getParagraphPropertySourceTransferId, getProseDocumentParagraphPropertySourceContract, getProseParagraphPropertySourceToken, isParagraphPropertySourceToken, joinProseParagraphsWithRightPropertySource, linkParagraphPropertySourceCandidate, linkProseParagraphPropertySource, markParagraphPropertySourceTransfers, paragraphPropertySourceBelongsToDocument, paragraphPropertySourceMatchesEmission, paragraphPropertySourceTokenMatchesContract, proseParagraphAttrsWithoutPropertySource, recreateProseNodeWithDetachedParagraphPropertySource, recreateProseNodeWithParagraphPropertySource, restoreTableCellsWithParagraphPropertySources, setProseParagraphMarkupWithPropertySource, transferProseParagraphPropertySource, transportTableCellsWithParagraphPropertySources, visitDocumentStoryParagraphs, visitTableCellParagraphPropertySourceBindings };
+export { DecodedTableCellParagraphSourcePayload, PARAGRAPH_PROPERTY_SOURCE_VALIDATION_CODES, PROSE_PARAGRAPH_SOURCE_CONTRACT_ATTR, PROSE_PARAGRAPH_SOURCE_TOKEN_ATTR, ParagraphPropertySourceTransfer, ParagraphPropertySourceValidationCode, ParagraphPropertySourceValidationError, TABLE_CELL_PARAGRAPH_SOURCE_BINDING_ATTR, TABLE_CELL_PARAGRAPH_SOURCE_PAYLOAD_ERROR_CLASSIFICATIONS, TableCellParagraphPropertySourceBinding, TableCellParagraphSourcePayloadErrorClassification, assignDocumentParagraphPropertySourceContract, assignParagraphPropertySource, cloneDocumentWithParagraphPropertySources, cloneParagraphWithPropertySource, cloneParagraphWithoutPropertySource, cloneTableCellsWithParagraphPropertyCaptures, copyDocumentParagraphPropertySourceContract, copyDocumentParagraphPropertySources, copyParagraphPropertyCapture, copyParagraphPropertySource, createProseParagraphWithPropertySource, decodeTableCellParagraphSourcePayload, getDocumentParagraphPropertySourceContract, getExplicitParagraphPropertySourceTransfers, getParagraphPropertySource, getParagraphPropertySourceCandidate, getParagraphPropertySourceToken, getParagraphPropertySourceTransferId, getProseDocumentParagraphPropertySourceContract, getProseParagraphPropertySourceToken, isParagraphPropertySourceToken, joinProseParagraphsWithRightPropertySource, linkParagraphPropertySourceCandidate, linkProseParagraphPropertySource, markParagraphPropertySourceTransfers, paragraphPropertySourceBelongsToDocument, paragraphPropertySourceMatchesEmission, paragraphPropertySourceTokenMatchesContract, proseParagraphAttrsWithoutPropertySource, recreateProseNodeWithDetachedParagraphPropertySource, recreateProseNodeWithParagraphPropertySource, restoreTableCellsWithParagraphPropertySources, setProseParagraphMarkupWithPropertySource, transferProseParagraphPropertySource, transportTableCellsWithParagraphPropertySources, visitDocumentStoryParagraphs, visitTableCellParagraphPropertySourceBindings };

package/dist/docx/paragraphPropertySource.js

@@ -542,7 +542,7 @@ const tableCellParagraphPropertySourceBindingForTransport = (paragraph, inspecti
 };
 /** Prepare opaque continuation cells for ProseMirror and Yjs transport. */
 const transportTableCellsWithParagraphPropertySources = (cells) => {
-	const cloned = structuredClone(cells);
+	const cloned = cells.map((cell) => structuredClone(cell));
 	const sources = paragraphsInTableCells(cells);
 	const targets = paragraphsInTableCells(cloned);
 	if (sources.length !== targets.length) panic("The cloned table cells changed paragraph graph ownership.");
@@ -679,7 +679,9 @@ const proseParagraphAttrsWithoutPropertySource = (attrs) => {
 /** Replace paragraph markup without losing its private parser-owner link. */
 const setProseParagraphMarkupWithPropertySource = ({ attrs, ownership, pos, transaction }) => {
 	const source = transaction.doc.nodeAt(pos);
-	transaction.setNodeMarkup(pos, void 0, attrs);
+	if (source) {
+		for (const [name, value] of Object.entries(attrs)) if (source.attrs[name] !== value) transaction.setNodeAttribute(pos, name, value);
+	} else transaction.setNodeMarkup(pos, void 0, attrs);
 	const target = transaction.doc.nodeAt(pos);
 	if (!source || !target) return;
 	if (ownership === "preserve") {

package/dist/docx/parser.js

@@ -738,7 +738,7 @@ function fullParseDocx(buffer, onProgress) {
 * Faster than full parse when you only need variables
 */
 async function getDocxVariables(buffer) {
-	const raw = await unzipDocx(buffer);
+	const raw = await unzipDocx(buffer, {}, { verifyUnreadEntries: false });
 	if (!raw.documentXml) return [];
 	return extractAllTemplateVariables(parseDocumentBody(raw.documentXml).content);
 }
@@ -746,7 +746,7 @@ async function getDocxVariables(buffer) {
 * Get document summary without full parsing
 */
 async function getDocxSummary(buffer) {
-	const raw = await unzipDocx(buffer);
+	const raw = await unzipDocx(buffer, {}, { verifyUnreadEntries: false });
 	const variables = raw.documentXml ? extractAllTemplateVariables(parseDocumentBody(raw.documentXml).content) : [];
 	return {
 		hasDocument: raw.documentXml !== null,

package/dist/docx/rezip.js

@@ -1339,7 +1339,8 @@ async function serializeHeadersFootersToZip(doc, zip, compressionLevel) {
 }
 async function serializeNotesToZip({ doc, originalZip, newZip, compressionLevel, changedNoteParaIds }) {
 	const footnotes = doc.package.footnotes ?? [];
-	if (footnotes.length > 0) if (findNotePartEntry(originalZip, "word/footnotes.xml")) await patchNotePartIntoZip({
+	const originalFootnotes = doc.package.footnotes === void 0 ? null : findNotePartEntry(originalZip, "word/footnotes.xml");
+	if (footnotes.length > 0 || originalFootnotes) if (originalFootnotes) await patchNotePartIntoZip({
 		conventionalLowerPath: "word/footnotes.xml",
 		currentXml: serializeFootnotes(footnotes),
 		replacementXml: serializeNewFootnotesPart(footnotes),
@@ -1359,7 +1360,8 @@ async function serializeNotesToZip({ doc, originalZip, newZip, compressionLevel,
 		compressionLevel
 	});
 	const endnotes = doc.package.endnotes ?? [];
-	if (endnotes.length > 0) if (findNotePartEntry(originalZip, "word/endnotes.xml")) await patchNotePartIntoZip({
+	const originalEndnotes = doc.package.endnotes === void 0 ? null : findNotePartEntry(originalZip, "word/endnotes.xml");
+	if (endnotes.length > 0 || originalEndnotes) if (originalEndnotes) await patchNotePartIntoZip({
 		conventionalLowerPath: "word/endnotes.xml",
 		currentXml: serializeEndnotes(endnotes),
 		replacementXml: serializeNewEndnotesPart(endnotes),

package/dist/docx/selectiveXmlPatch.d.ts

@@ -165,7 +165,9 @@ type XmlSplice = {
  * the rest of the part byte-for-byte, so it can write half a comment range:
  * invalid OOXML that anchors the comment to nothing. Answers null when it
  * would, leaving the caller to rewrite a wider region — ultimately the whole
- * part from the model, which is balanced with itself.
+ * part from the model, which is balanced with itself. Overlapping source
+ * regions are refused too: replacing an inner region moves the outer region's
+ * end, so its original offsets cannot be applied to the resulting string.
  */
 declare const spliceXml: (xml: string, splices: readonly XmlSplice[]) => string | null;
 type NoteElementName = "footnote" | "endnote";

package/dist/docx/selectiveXmlPatch.js

@@ -426,7 +426,11 @@ const routeChangedParagraphs = (originalXml, serializedXml, changedIds) => {
 		});
 	}
 	const candidate = spliceXml(originalXml, splices);
-	if (candidate === null || !splicesAsCanonical(candidate, PARAGRAPH_SCAN_NAMES)) return {
+	if (candidate === null) return {
+		type: "refused",
+		reason: "unsafe-paragraph-splices"
+	};
+	if (!splicesAsCanonical(candidate, PARAGRAPH_SCAN_NAMES)) return {
 		type: "refused",
 		reason: "replacement-namespace-conflict"
 	};
@@ -496,11 +500,18 @@ function buildPatchedNoteXml(originalXml, serializedXml, changedIds) {
 * the rest of the part byte-for-byte, so it can write half a comment range:
 * invalid OOXML that anchors the comment to nothing. Answers null when it
 * would, leaving the caller to rewrite a wider region — ultimately the whole
-* part from the model, which is balanced with itself.
+* part from the model, which is balanced with itself. Overlapping source
+* regions are refused too: replacing an inner region moves the outer region's
+* end, so its original offsets cannot be applied to the resulting string.
 */
 const spliceXml = (xml, splices) => {
 	let result = xml;
-	for (const { start, end, newXml } of [...splices].toSorted((a, b) => b.start - a.start)) result = result.slice(0, start) + newXml + result.slice(end);
+	let unpatchedEnd = xml.length;
+	for (const { start, end, newXml } of [...splices].toSorted((a, b) => b.start - a.start)) {
+		if (end > unpatchedEnd) return null;
+		result = result.slice(0, start) + newXml + result.slice(end);
+		unpatchedEnd = start;
+	}
 	return patchBreaksCommentRangeBalance(xml, result) ? null : result;
 };
 /**
@@ -732,9 +743,25 @@ function buildPatchedNotePartXml({ originalXml, baselineXml, serializedXml, repl
 	const serializedParaIds = collectParaIds(serializedXml);
 	const effectiveChangedParaIds = changedParaIds ?? collectChangedNoteParaIds(baselineXml, serializedXml);
 	const unroutedChangedParaIds = new Set([...effectiveChangedParaIds].filter((paraId) => serializedParaIds.has(paraId)));
+	/** Notes the model has and the part does not: new notes, appended to the part. */
+	const addedNotes = [];
 	for (const [id, currentSyntaxEntries] of currentElements) {
 		const originalSyntaxEntries = originalElements.get(id);
 		const replacementSyntaxEntries = replacementElements.get(id);
+		if (originalSyntaxEntries === void 0) {
+			const replacementSyntax = currentSyntaxEntries.length === 1 && replacementSyntaxEntries?.length === 1 ? replacementSyntaxEntries[0] : void 0;
+			const replacementNote = replacementSyntax ? extractNoteElement(replacementXml, replacementSyntax, id) : null;
+			if (!replacementSyntax || !replacementNote) return {
+				type: "refused",
+				reason: "unroutable-paragraph"
+			};
+			for (const paraId of collectParaIds(replacementNote).keys()) unroutedChangedParaIds.delete(paraId);
+			addedNotes.push({
+				note: replacementNote,
+				syntax: replacementSyntax
+			});
+			continue;
+		}
 		if (currentSyntaxEntries.length !== 1 || originalSyntaxEntries?.length !== 1 || replacementSyntaxEntries?.length !== 1) return {
 			type: "refused",
 			reason: "unroutable-paragraph"
@@ -806,10 +833,36 @@ function buildPatchedNotePartXml({ originalXml, baselineXml, serializedXml, repl
 			});
 		}
 	}
+	for (const [id, baselineSyntaxEntries] of baselineElements) {
+		if (currentElements.has(id) || baselineSyntaxEntries.length !== 1) continue;
+		const originalSyntaxEntries = originalElements.get(id);
+		const originalSyntax = originalSyntaxEntries?.length === 1 ? originalSyntaxEntries[0] : void 0;
+		const originalOffsets = originalSyntax && findNoteElement(originalXml, originalSyntax, id);
+		if (!originalOffsets) return {
+			type: "refused",
+			reason: "unroutable-paragraph"
+		};
+		const removal = {
+			start: originalOffsets.start,
+			end: originalOffsets.end,
+			newXml: ""
+		};
+		paragraphSplices.push(removal);
+		noteSplices.push(removal);
+	}
 	if (unroutedChangedParaIds.size > 0) return {
 		type: "refused",
 		reason: "unroutable-paragraph"
 	};
+	if (addedNotes.length > 0) {
+		const appended = appendNotesSplice(originalXml, originalElements, addedNotes, { sourceXmlnsDeclarations: replacementXmlnsDeclarations });
+		if (!appended) return {
+			type: "refused",
+			reason: "unroutable-paragraph"
+		};
+		paragraphSplices.push(appended);
+		noteSplices.push(appended);
+	}
 	const patched = spliceXml(originalXml, paragraphSplices);
 	if (patched !== null) return {
 		type: "patched",
@@ -825,6 +878,31 @@ function buildPatchedNotePartXml({ originalXml, baselineXml, serializedXml, repl
 	};
 }
 /**
+* Insert new notes after the part's last note, spelled with that note's
+* prefixes. Null when the part holds no note to follow.
+*/
+const appendNotesSplice = (originalXml, originalElements, addedNotes, { sourceXmlnsDeclarations }) => {
+	let last = null;
+	for (const [id, entries] of originalElements) for (const syntax of entries) {
+		const offsets = findNoteElement(originalXml, syntax, id);
+		if (offsets && (!last || offsets.end > last.end)) last = {
+			end: offsets.end,
+			syntax
+		};
+	}
+	if (!last) return null;
+	const target = last.syntax;
+	return {
+		start: last.end,
+		end: last.end,
+		newXml: addedNotes.map(({ note, syntax }) => rewriteWordprocessingPrefixes(note, {
+			source: syntax,
+			target,
+			sourceXmlnsDeclarations
+		})).join("")
+	};
+};
+/**
 * The full range of the first `<openLiteral …>…</closeTag>` element, or null.
 * Used to locate an unkeyed sub-element (a level's `mc:AlternateContent`).
 */