documonster 0.16.0 → 0.16.1

package/dist/esm/modules/excel/chart/shared/shape-properties.js

@@ -401,26 +401,26 @@ function parsePatternFill(xml) {
     return { pattern: { preset, foreground, background } };
 }
 /**
- * Remove the FIRST matching `<tag …>…</tag>` (or self-closing
- * `<tag …/>`) block from the input XML, returning the remainder. Used
- * by {@link parseSpPr} to isolate shape-level children (fill / effects)
- * from decorative children that nest inside `<a:ln>` — the line's own
- * `<a:solidFill>` / `<a:noFill/>` / `<a:gradFill>` should not be
- * harvested as the shape's fill.
+ * Remove `<tag …>…</tag>` (or self-closing `<tag …/>`) blocks from the input
+ * XML, returning the remainder. Used by {@link parseSpPr} to keep the line's
+ * own `<a:solidFill>` / `<a:noFill/>` / `<a:gradFill>` inside `<a:ln>` from
+ * being harvested as the shape's fill.
  *
- * Strips ALL occurrences of `tag` (both self-closing and paired) in
- * one pass. A previous version returned after the earliest match,
- * which failed on inputs like `<a:ln/>…<a:ln>…</a:ln>` — the paired
- * block survived and its inner `<a:solidFill>` was then mistakenly
- * parsed as the shape's fill.
+ * Strips up to eight occurrences in one pass, so a `<a:ln/>` ahead of
+ * `<a:ln>…</a:ln>` does not leave the paired block behind.
  *
- * Not a general-purpose XML tool — does not handle same-named nested
- * occurrences. Sufficient for DrawingML spPr, where `<a:ln>` never
- * nests another `<a:ln>`.
+ * The trailing slash is **captured** rather than excluded with a `(?<!/)`
+ * lookbehind, which Safari only supports from 16.4 and which threw
+ * `SyntaxError` here at first use, not at import.
+ *
+ * Not a general-purpose XML tool: no same-named nesting, and no `>` inside an
+ * attribute value. Sufficient for DrawingML spPr.
  */
 function stripOuterElement(xml, tag) {
-    const selfCloseRe = new RegExp(`<${tag}\\b[^>]*/>`);
-    const openRe = new RegExp(`<${tag}\\b[^>]*(?<!/)>`);
+    // `[^>]*?` is lazy so `(/?)` gets the chance to claim the slash of a
+    // self-closing tag; a greedy `[^>]*` would swallow it and report every
+    // `<tag …/>` as a paired open tag.
+    const tagRe = new RegExp(`<${tag}\\b[^>]*?(/?)>`);
     const closeRe = new RegExp(`</${tag}>`);
     let current = xml;
     // Strip up to 8 occurrences. DrawingML spPr never has more than one
@@ -428,36 +428,27 @@ function stripOuterElement(xml, tag) {
     // the ceiling guards against pathological input causing infinite
     // loops without changing the happy path.
     for (let i = 0; i < 8; i++) {
-        const selfCloseMatch = selfCloseRe.exec(current);
-        const openMatch = openRe.exec(current);
-        const selfCloseIndex = selfCloseMatch ? selfCloseMatch.index : Infinity;
-        const openIndex = openMatch ? openMatch.index : Infinity;
-        if (selfCloseIndex === Infinity && openIndex === Infinity) {
+        const match = tagRe.exec(current);
+        if (!match) {
             break;
         }
-        if (selfCloseIndex < openIndex && selfCloseMatch) {
-            current =
-                current.slice(0, selfCloseMatch.index) +
-                    current.slice(selfCloseMatch.index + selfCloseMatch[0].length);
+        const matchEnd = match.index + match[0].length;
+        if (match[1] === "/") {
+            current = current.slice(0, match.index) + current.slice(matchEnd);
             continue;
         }
-        if (openMatch) {
-            // Find the close tag that pairs with this open — start searching
-            // after the open's end to avoid capturing `</tag>` that belongs
-            // to a prior unrelated (e.g. self-closing lookalike) open.
-            const openEnd = openMatch.index + openMatch[0].length;
-            const closeMatch = closeRe.exec(current.slice(openEnd));
-            if (!closeMatch) {
-                // Malformed — stop stripping to avoid further mutation of
-                // input we don't understand.
-                break;
-            }
-            const closeStart = openEnd + closeMatch.index;
-            const closeEnd = closeStart + closeMatch[0].length;
-            current = current.slice(0, openMatch.index) + current.slice(closeEnd);
-            continue;
+        // Find the close tag that pairs with this open — start searching
+        // after the open's end to avoid capturing `</tag>` that belongs
+        // to a prior unrelated (e.g. self-closing lookalike) open.
+        const closeMatch = closeRe.exec(current.slice(matchEnd));
+        if (!closeMatch) {
+            // Malformed — stop stripping to avoid further mutation of
+            // input we don't understand.
+            break;
         }
-        break;
+        current =
+            current.slice(0, match.index) +
+                current.slice(matchEnd + closeMatch.index + closeMatch[0].length);
     }
     return current;
 }

package/dist/esm/modules/excel/core/workbook.browser.js

@@ -876,11 +876,17 @@ export function setWorkbookModel(wb, value) {
     // workbook replaces any accumulated state from previous writes.
     wb._writerExternalLinkCache = new Map();
 }
+/**
+ * Deep-clone workbook-model data.
+ *
+ * `structuredClone` unguarded: it exists in every supported environment, and
+ * the `JSON.parse(JSON.stringify(...))` fallback this used to carry was a
+ * lossier second implementation, not a fallback — it strips a typed-array
+ * prototype, which the `Uint8Array` values on `ChartExModel.externalParts`
+ * need. `chart/chart-handle.ts` had already dropped the same fallback.
+ */
 function deepClone(value) {
-    if (typeof structuredClone === "function") {
-        return structuredClone(value);
-    }
-    return JSON.parse(JSON.stringify(value));
+    return structuredClone(value);
 }
 /**
  * Deep-copy a {@link ChartEntry}, preserving every field that affects

package/dist/esm/modules/excel/utils/guid.js

@@ -1,35 +1,13 @@
 /**
  * GUID helpers for OOXML.
  *
- * Office parts that need stable cross-reference ids (threaded comments,
- * chart uniqueIds, slicer caches, …) use the canonical Microsoft
- * `{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}` format — 32 uppercase hex
- * characters split into 8-4-4-4-12 groups, surrounded by braces.
- *
- * `synthGuid()` returns an RFC-4122 version-4-compatible value suitable
- * for those callers. We don't use `crypto.randomUUID()` directly because
- * it isn't available in every supported runtime (older Node without
- * `node:crypto` globals); `Math.random` is good enough for uniqueness
- * within a single workbook, which is the only thing Office cares about.
+ * Office parts needing stable cross-reference ids (threaded comments, chart
+ * uniqueIds, slicer caches) use uppercase hex in 8-4-4-4-12 groups; callers add
+ * the braces. `synthGuid()` delegates to {@link uuidV4} and upper-cases it
+ * rather than rolling its own digits out of `Math.random()`, which skipped Web
+ * Crypto even where it exists and duplicated the version/variant masking.
  */
+import { uuidV4 } from "../../../utils/uuid.js";
 export function synthGuid() {
-    const hex = "0123456789ABCDEF";
-    let out = "";
-    for (let i = 0; i < 32; i++) {
-        // Version 4: bit 48 (13th hex digit) is always '4'.
-        // Variant 10xx: bit 64 (17th hex digit) is one of 8, 9, A, B.
-        if (i === 12) {
-            out += "4";
-        }
-        else if (i === 16) {
-            out += hex[8 + Math.floor(Math.random() * 4)];
-        }
-        else {
-            out += hex[Math.floor(Math.random() * 16)];
-        }
-        if (i === 7 || i === 11 || i === 15 || i === 19) {
-            out += "-";
-        }
-    }
-    return out;
+    return uuidV4().toUpperCase();
 }

package/dist/esm/modules/stream/core/utils.js

@@ -42,7 +42,7 @@ export function promisify(fn) {
 // =============================================================================
 // High Water Mark
 // =============================================================================
-let _defaultHighWaterMark = 65536; // 64KB default (matches Node.js 25)
+let _defaultHighWaterMark = 65536; // 64KB default (matches Node's own on every supported line)
 let _defaultHighWaterMarkObjectMode = 16; // 16 objects default
 /**
  * Get the default high water mark for streams

package/dist/esm/modules/stream/node/factories.js

@@ -24,8 +24,10 @@ import { Writable } from "./writable.js";
 /**
  * Ensure the options include a highWaterMark so that native Node.js streams
  * use the same default as the browser implementation (from common/utils.ts).
- * This matters on Node.js 20/21 where the native default is 16 KB instead of
- * the 64 KB we standardise on across both platforms.
+ *
+ * Every supported Node line already defaults to the same 64 KB, so this is not
+ * a version workaround: it exists so `setDefaultHighWaterMark` is honoured on
+ * native streams too, which otherwise read Node's default rather than ours.
  */
 function withDefaultHWM(options) {
     if (options?.highWaterMark != null) {

package/dist/esm/modules/word/core/internal-utils.js

@@ -5,6 +5,7 @@
  * used throughout the word module. Consolidates previously duplicated
  * implementations of base64, UUID, UTF-16LE encoding, and XML helpers.
  */
+import { uuidV4 } from "../../../utils/uuid.js";
 import { DocxError } from "../errors.js";
 // =============================================================================
 // Shared TextEncoder / TextDecoder singletons
@@ -62,25 +63,18 @@ export function base64ToBytes(s) {
 // =============================================================================
 // UUID v4 Generation
 // =============================================================================
-/**
- * Generate a random UUID v4 string in the form "XXXXXXXX-XXXX-4XXX-YXXX-XXXXXXXXXXXX".
- * Uses `crypto.getRandomValues` for cryptographic randomness.
- */
-function generateUuid() {
-    const bytes = new Uint8Array(16);
-    crypto.getRandomValues(bytes);
-    // RFC 4122 v4 UUID: set version (4) and variant (10xx) bits
-    bytes[6] = (bytes[6] & 0x0f) | 0x40;
-    bytes[8] = (bytes[8] & 0x3f) | 0x80;
-    const hex = Array.from(bytes, b => b.toString(16).padStart(2, "0")).join("");
-    return `${hex.substring(0, 8)}-${hex.substring(8, 12)}-${hex.substring(12, 16)}-${hex.substring(16, 20)}-${hex.substring(20, 32)}`;
-}
 /**
  * Generate a GUID in braced format: "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}".
  * Used by font obfuscation (w:fontKey) and building blocks.
+ *
+ * Delegates to {@link uuidV4} rather than assembling a third copy of the v4 bit
+ * masking here. These ids identify rather than protect — a `w:fontKey` is
+ * stored in the document in plain text — so a non-cryptographic tier is
+ * acceptable. Keys, salts and verifiers use {@link randomBytes}, which throws
+ * when Web Crypto is missing.
  */
 export function generateGuid() {
-    return `{${generateUuid()}}`;
+    return `{${uuidV4()}}`;
 }
 // =============================================================================
 // UTF-16LE Encoding