docxmlater 11.0.9 → 12.0.1

package/src/utils/xmlSanitization.ts

@@ -9,11 +9,13 @@
  * - 0x09 (tab), 0x0A (newline), 0x0D (carriage return)
  * - 0x20-0xD7FF, 0xE000-0xFFFD, 0x10000-0x10FFFF
  *
- * Invalid characters (control characters that must be removed):
+ * Invalid characters that must be removed:
  * - 0x00-0x08 (NULL through BACKSPACE)
  * - 0x0B-0x0C (VERTICAL TAB and FORM FEED)
  * - 0x0E-0x1F (SHIFT OUT through UNIT SEPARATOR)
  * - 0x7F (DELETE)
+ * - 0xFFFE-0xFFFF (Unicode noncharacters excluded by the Char production)
+ * - Unpaired surrogates (0xD800-0xDFFF outside a valid high/low pair)
  *
  * @module xmlSanitization
  */
@@ -21,26 +23,40 @@
 import { getGlobalLogger } from './logger.js';
 
 /**
- * Regular expression matching invalid XML 1.0 control characters.
- * Matches: 0x00-0x08, 0x0B-0x0C, 0x0E-0x1F, 0x7F
+ * Regular expression matching invalid XML 1.0 characters.
+ * Matches: 0x00-0x08, 0x0B-0x0C, 0x0E-0x1F, 0x7F, 0xFFFE, 0xFFFF
  * Does NOT match valid chars: 0x09 (tab), 0x0A (newline), 0x0D (CR)
  */
-const INVALID_XML_CHAR_REGEX = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g;
+const INVALID_XML_CHAR_REGEX = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F￾￿]/g;
 
 /**
- * Removes invalid XML 1.0 control characters from text.
+ * Matches surrogate code units that do not form a valid high/low pair.
+ * XML 1.0 Char excludes 0xD800-0xDFFF entirely; only properly paired
+ * surrogates (which decode to a single 0x10000-0x10FFFF character) are
+ * legal, so lone halves must be stripped or they corrupt the part at
+ * UTF-8 encode time.
+ */
+const UNPAIRED_SURROGATE_REGEX =
+  /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+
+/**
+ * Removes invalid XML 1.0 characters from text.
  *
- * Per XML 1.0 spec, characters 0x00-0x08, 0x0B-0x0C, 0x0E-0x1F, 0x7F are invalid
- * and cannot appear in XML documents. This function removes them.
+ * Per XML 1.0 spec, characters 0x00-0x08, 0x0B-0x0C, 0x0E-0x1F, 0x7F,
+ * 0xFFFE, 0xFFFF, and unpaired surrogates are invalid and cannot appear
+ * in XML documents. This function removes them.
  *
  * Valid control characters are preserved:
  * - Tab (0x09)
  * - Line Feed / Newline (0x0A)
  * - Carriage Return (0x0D)
  *
+ * Properly paired surrogates (astral-plane characters such as emoji)
+ * are preserved.
+ *
  * @param text - Input text to sanitize
  * @param logWarning - If true, logs a warning when invalid chars are found (default: true)
- * @returns Sanitized text with invalid control characters removed
+ * @returns Sanitized text with invalid characters removed
  *
  * @example
  * ```typescript
@@ -54,31 +70,33 @@ const INVALID_XML_CHAR_REGEX = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g;
  * ```
  */
 export function removeInvalidXmlChars(text: string, logWarning = true): string {
-  // Reset regex lastIndex for global regex
+  // Reset regex lastIndex for global regexes
   INVALID_XML_CHAR_REGEX.lastIndex = 0;
+  UNPAIRED_SURROGATE_REGEX.lastIndex = 0;
 
-  if (logWarning && INVALID_XML_CHAR_REGEX.test(text)) {
+  if (logWarning && (INVALID_XML_CHAR_REGEX.test(text) || UNPAIRED_SURROGATE_REGEX.test(text))) {
     // Reset regex lastIndex after test
     INVALID_XML_CHAR_REGEX.lastIndex = 0;
+    UNPAIRED_SURROGATE_REGEX.lastIndex = 0;
 
     const invalidChars = findInvalidXmlChars(text);
     const hexCodes = invalidChars
       .map((c) => `0x${c.toString(16).toUpperCase().padStart(2, '0')}`)
       .join(', ');
-    getGlobalLogger().warn(
-      `[XMLSanitization] Removing invalid XML control characters: ${hexCodes}`
-    );
+    getGlobalLogger().warn(`[XMLSanitization] Removing invalid XML characters: ${hexCodes}`);
   }
 
   // Reset regex lastIndex before replace
   INVALID_XML_CHAR_REGEX.lastIndex = 0;
-  return text.replace(INVALID_XML_CHAR_REGEX, '');
+  UNPAIRED_SURROGATE_REGEX.lastIndex = 0;
+  return text.replace(INVALID_XML_CHAR_REGEX, '').replace(UNPAIRED_SURROGATE_REGEX, '');
 }
 
 /**
- * Finds all invalid XML 1.0 control characters in text.
+ * Finds all invalid XML 1.0 characters in text.
  *
- * Returns an array of unique character codes that are invalid per XML 1.0 spec.
+ * Returns an array of unique character codes that are invalid per XML 1.0 spec,
+ * including 0xFFFE/0xFFFF noncharacters and unpaired surrogate code units.
  * This is useful for diagnostics and error reporting.
  *
  * @param text - Text to scan for invalid characters
@@ -100,12 +118,25 @@ export function findInvalidXmlChars(text: string): number[] {
     const code = text.charCodeAt(i);
 
     // Check if character is in invalid ranges
-    if (
+    let isInvalid =
       (code >= 0x00 && code <= 0x08) || // NULL through BACKSPACE
       (code >= 0x0b && code <= 0x0c) || // VERTICAL TAB and FORM FEED
       (code >= 0x0e && code <= 0x1f) || // SHIFT OUT through UNIT SEPARATOR
-      code === 0x7f // DELETE
-    ) {
+      code === 0x7f || // DELETE
+      code === 0xfffe || // Noncharacter excluded by XML 1.0 Char
+      code === 0xffff; // Noncharacter excluded by XML 1.0 Char
+
+    if (!isInvalid && code >= 0xd800 && code <= 0xdbff) {
+      // High surrogate is only valid when followed by a low surrogate
+      const next = text.charCodeAt(i + 1); // NaN at end of string fails the range check
+      isInvalid = !(next >= 0xdc00 && next <= 0xdfff);
+    } else if (!isInvalid && code >= 0xdc00 && code <= 0xdfff) {
+      // Low surrogate is only valid when preceded by a high surrogate
+      const prev = text.charCodeAt(i - 1); // NaN at start of string fails the range check
+      isInvalid = !(prev >= 0xd800 && prev <= 0xdbff);
+    }
+
+    if (isInvalid) {
       // Only add unique codes
       if (!invalid.includes(code)) {
         invalid.push(code);
@@ -117,7 +148,7 @@ export function findInvalidXmlChars(text: string): number[] {
 }
 
 /**
- * Checks if text contains any invalid XML 1.0 control characters.
+ * Checks if text contains any invalid XML 1.0 characters.
  *
  * This is a fast check that returns true/false without identifying specific characters.
  * Use `findInvalidXmlChars()` if you need to know which characters are invalid.
@@ -133,9 +164,174 @@ export function findInvalidXmlChars(text: string): number[] {
  * ```
  */
 export function hasInvalidXmlChars(text: string): boolean {
-  // Reset regex lastIndex for global regex
+  // Reset regex lastIndex for global regexes
   INVALID_XML_CHAR_REGEX.lastIndex = 0;
-  return INVALID_XML_CHAR_REGEX.test(text);
+  UNPAIRED_SURROGATE_REGEX.lastIndex = 0;
+  return INVALID_XML_CHAR_REGEX.test(text) || UNPAIRED_SURROGATE_REGEX.test(text);
+}
+
+/**
+ * CT_RPr child element order per ECMA-376 Part 1 §17.3.2.28 (local names,
+ * `w:` namespace). Used to repair raw-preserved run-property blocks whose
+ * children are out of schema order — Word rejects, for example, a `w:b`
+ * that appears after `w:color`/`w:sz` and reports the document as corrupt.
+ */
+const CT_RPR_CHILD_ORDER: readonly string[] = [
+  'rStyle',
+  'rFonts',
+  'b',
+  'bCs',
+  'i',
+  'iCs',
+  'caps',
+  'smallCaps',
+  'strike',
+  'dstrike',
+  'outline',
+  'shadow',
+  'emboss',
+  'imprint',
+  'noProof',
+  'snapToGrid',
+  'vanish',
+  'webHidden',
+  'color',
+  'spacing',
+  'w',
+  'kern',
+  'position',
+  'sz',
+  'szCs',
+  'highlight',
+  'u',
+  'effect',
+  'bdr',
+  'shd',
+  'fitText',
+  'vertAlign',
+  'rtl',
+  'cs',
+  'em',
+  'lang',
+  'eastAsianLayout',
+  'specVanish',
+  'oMath',
+];
+
+/**
+ * Splits the inner content of an element into its top-level child elements,
+ * respecting nesting so that a child's descendants are kept with it. Returns
+ * the raw XML fragment for each direct child in document order. Non-element
+ * text between children (whitespace) is dropped, which is safe for the
+ * element-only content models this helper targets (e.g. `w:rPr`).
+ */
+function splitTopLevelElements(inner: string): string[] {
+  const children: string[] = [];
+  const tagRegex = /<([A-Za-z][\w:.-]*)([^>]*?)(\/?)>|<\/([A-Za-z][\w:.-]*)\s*>/g;
+  let depth = 0;
+  let start = -1;
+  let match: RegExpExecArray | null;
+  while ((match = tagRegex.exec(inner)) !== null) {
+    const isClosing = match[4] !== undefined;
+    const isSelfClosing = match[3] === '/';
+    if (isClosing) {
+      if (depth > 0) {
+        depth--;
+        if (depth === 0 && start !== -1) {
+          children.push(inner.slice(start, tagRegex.lastIndex));
+          start = -1;
+        }
+      }
+      continue;
+    }
+    if (isSelfClosing) {
+      if (depth === 0) {
+        children.push(inner.slice(match.index, tagRegex.lastIndex));
+      }
+      continue;
+    }
+    // Opening tag of a paired element
+    if (depth === 0) start = match.index;
+    depth++;
+  }
+  return children;
+}
+
+/**
+ * Reorders the direct children of every `<w:rPr>` block in a raw XML part to
+ * the ECMA-376 CT_RPr sequence. Unknown/unmodeled children retain their
+ * relative position at the end of the block. The transform is idempotent:
+ * already-ordered run properties are returned unchanged.
+ *
+ * Some producers (and older versions of this framework) appended boolean
+ * toggles such as `w:b`/`w:bCs` to the end of an existing `w:rPr`, leaving
+ * them after `w:color`/`w:sz`. Word treats the out-of-order child as an
+ * unexpected element and flags the whole document as corrupt. Numbering
+ * definitions are written back verbatim for fidelity, so this repair runs on
+ * the preserved part before it is saved.
+ *
+ * @param xml - Raw XML for a part containing `w:rPr` blocks (e.g. numbering.xml)
+ * @returns XML with every `w:rPr` child sequence normalized to schema order
+ */
+export function reorderRunPropertyChildren(xml: string): string {
+  if (!xml || !xml.includes('<w:rPr')) return xml;
+
+  const orderIndex = (fragment: string): number => {
+    const nameMatch = /^<w:(\w+)/.exec(fragment);
+    const name = nameMatch?.[1];
+    if (!name) return CT_RPR_CHILD_ORDER.length;
+    const idx = CT_RPR_CHILD_ORDER.indexOf(name);
+    return idx === -1 ? CT_RPR_CHILD_ORDER.length : idx;
+  };
+
+  // Only match non-empty <w:rPr>...</w:rPr> blocks; self-closing <w:rPr/> has
+  // no children to reorder.
+  return xml.replace(/<w:rPr(\s[^>]*)?>([\s\S]*?)<\/w:rPr>/g, (full, attrs, inner) => {
+    if (!inner || !(inner as string).includes('<')) return full;
+    const children = splitTopLevelElements(inner);
+    if (children.length < 2) return full;
+
+    const ordered = children
+      .map((frag, i) => ({ frag, i, order: orderIndex(frag) }))
+      // Stable sort: ties (including unknown children) keep original order.
+      .sort((a, b) => a.order - b.order || a.i - b.i);
+
+    if (ordered.every((c, i) => c.i === i)) return full; // already in order
+
+    return `<w:rPr${attrs ?? ''}>${ordered.map((c) => c.frag).join('')}</w:rPr>`;
+  });
+}
+
+/**
+ * Normalizes malformed floating-drawing relative-size elements in a raw anchor
+ * fragment. Per ECMA-376 (DrawingML wordprocessing 2010 extensions),
+ * `wp14:sizeRelH` must contain a `wp14:pctWidth` child and `wp14:sizeRelV` a
+ * `wp14:pctHeight` child. Some producers emit the percentage as bare text
+ * content (`<wp14:sizeRelH relativeFrom="margin">0</wp14:sizeRelH>`), which
+ * Word rejects as incomplete content. This wraps such text in the required
+ * child element. Already-valid nested forms are left untouched because the
+ * text-content pattern (`[^<]`) cannot match an element child.
+ *
+ * @param xml - Raw anchor-extras fragment captured during parsing
+ * @returns Fragment with sizeRelH/sizeRelV normalized to schema-valid form
+ */
+export function normalizeAnchorSizeRel(xml: string): string {
+  if (!xml) return xml;
+  return xml
+    .replace(
+      /(<wp14:sizeRelH\b[^>]*>)([^<]+)(<\/wp14:sizeRelH>)/g,
+      (_m, open: string, text: string, close: string) =>
+        text.trim() === ''
+          ? `${open}${text}${close}`
+          : `${open}<wp14:pctWidth>${text.trim()}</wp14:pctWidth>${close}`
+    )
+    .replace(
+      /(<wp14:sizeRelV\b[^>]*>)([^<]+)(<\/wp14:sizeRelV>)/g,
+      (_m, open: string, text: string, close: string) =>
+        text.trim() === ''
+          ? `${open}${text}${close}`
+          : `${open}<wp14:pctHeight>${text.trim()}</wp14:pctHeight>${close}`
+    );
 }
 
 /**

package/src/validation/RevisionAutoFixer.ts

@@ -17,7 +17,11 @@ import {
   FixAction,
   ValidationIssue,
 } from './ValidationRules.js';
-import { RevisionValidator } from './RevisionValidator.js';
+import {
+  CONTENTLESS_REVISION_TYPES,
+  RevisionValidator,
+  revisionHasContent,
+} from './RevisionValidator.js';
 
 /**
  * Automatically fixes revision validation issues.
@@ -81,9 +85,16 @@ export class RevisionAutoFixer {
         actions.push(...this.fixMissingAuthors(revisions, defaultAuthor, options?.dryRun));
       }
 
-      // Fix orphaned move markers (REV003, REV004)
+      // Fix orphaned move markers (REV003, REV004) — one pairing pass
+      // produces both rules, so gate each side individually to honor
+      // onlyRules/skipRules without mutating revisions the caller excluded.
       if (shouldProcess('REV003') || shouldProcess('REV004')) {
-        actions.push(...this.fixOrphanedMoveMarkers(revisionManager, revisions, options?.dryRun));
+        actions.push(
+          ...this.fixOrphanedMoveMarkers(revisionManager, revisions, options?.dryRun, doc, {
+            moveFrom: shouldProcess('REV003'),
+            moveTo: shouldProcess('REV004'),
+          })
+        );
       }
 
       // Fix missing dates (REV101)
@@ -98,7 +109,7 @@ export class RevisionAutoFixer {
 
       // Fix empty revisions (REV103)
       if (shouldProcess('REV103')) {
-        actions.push(...this.fixEmptyRevisions(revisionManager, revisions, options?.dryRun));
+        actions.push(...this.fixEmptyRevisions(revisionManager, revisions, options?.dryRun, doc));
       }
 
       // Fix non-sequential IDs (REV104)
@@ -297,20 +308,51 @@ export class RevisionAutoFixer {
     return actions;
   }
 
+  /**
+   * Removes a revision from the paragraph content that owns it.
+   *
+   * RevisionManager.removeById() only deregisters the revision from the
+   * manager registry, but serialization reads Paragraph.content directly —
+   * without this step the removed markup would still be written on save.
+   *
+   * @param doc - Document whose paragraphs are searched
+   * @param revision - Revision instance to remove
+   * @returns True if the revision was found and removed from a paragraph
+   */
+  private static removeRevisionFromContent(doc: Document, revision: Revision): boolean {
+    for (const paragraph of doc.getAllParagraphs()) {
+      // replaceContent matches by identity and splices without tracking side effects
+      if (paragraph.replaceContent(revision, [])) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * Fix orphaned move markers by removing them.
    *
    * @param revisionManager - RevisionManager instance
    * @param revisions - Array of revisions
    * @param dryRun - If true, only report changes without applying
+   * @param doc - Document to remove the revision content from; without it
+   *   only the manager registry is pruned and saved XML keeps the markup
+   * @param ruleFilter - Which sides of the pairing to fix; REV003 (moveFrom)
+   *   and REV004 (moveTo) are separate rules, so callers honoring
+   *   onlyRules/skipRules must be able to fix one without the other.
+   *   Defaults to both.
    * @returns Array of fix actions
    */
   static fixOrphanedMoveMarkers(
     revisionManager: { removeById(id: number): boolean },
     revisions: Revision[],
-    dryRun?: boolean
+    dryRun?: boolean,
+    doc?: Document,
+    ruleFilter?: { moveFrom?: boolean; moveTo?: boolean }
   ): FixAction[] {
     const actions: FixAction[] = [];
+    const fixMoveFrom = ruleFilter?.moveFrom ?? true;
+    const fixMoveTo = ruleFilter?.moveTo ?? true;
 
     const moveFromIds = new Map<string, Revision>();
     const moveToIds = new Map<string, Revision>();
@@ -326,52 +368,62 @@ export class RevisionAutoFixer {
       }
     }
 
-    // Remove orphaned moveFrom
-    for (const [moveId, rev] of moveFromIds) {
-      if (!moveToIds.has(moveId)) {
-        const issue: ValidationIssue = {
-          code: REVISION_RULES.ORPHANED_MOVE_FROM.code,
-          severity: 'error',
-          message: `Orphaned moveFrom with moveId="${moveId}"`,
-          location: { revisionId: rev.getId() },
-          autoFixable: true,
-        };
-
-        actions.push({
-          issue,
-          action: `Removed orphaned moveFrom (ID: ${rev.getId()}, moveId: ${moveId})`,
-          before: { type: 'moveFrom', moveId },
-          after: null,
-          success: true,
-        });
-
-        if (!dryRun) {
-          revisionManager.removeById(rev.getId());
+    // Remove orphaned moveFrom (REV003)
+    if (fixMoveFrom) {
+      for (const [moveId, rev] of moveFromIds) {
+        if (!moveToIds.has(moveId)) {
+          const issue: ValidationIssue = {
+            code: REVISION_RULES.ORPHANED_MOVE_FROM.code,
+            severity: 'error',
+            message: `Orphaned moveFrom with moveId="${moveId}"`,
+            location: { revisionId: rev.getId() },
+            autoFixable: true,
+          };
+
+          actions.push({
+            issue,
+            action: `Removed orphaned moveFrom (ID: ${rev.getId()}, moveId: ${moveId})`,
+            before: { type: 'moveFrom', moveId },
+            after: null,
+            success: true,
+          });
+
+          if (!dryRun) {
+            revisionManager.removeById(rev.getId());
+            if (doc) {
+              this.removeRevisionFromContent(doc, rev);
+            }
+          }
         }
       }
     }
 
-    // Remove orphaned moveTo
-    for (const [moveId, rev] of moveToIds) {
-      if (!moveFromIds.has(moveId)) {
-        const issue: ValidationIssue = {
-          code: REVISION_RULES.ORPHANED_MOVE_TO.code,
-          severity: 'error',
-          message: `Orphaned moveTo with moveId="${moveId}"`,
-          location: { revisionId: rev.getId() },
-          autoFixable: true,
-        };
-
-        actions.push({
-          issue,
-          action: `Removed orphaned moveTo (ID: ${rev.getId()}, moveId: ${moveId})`,
-          before: { type: 'moveTo', moveId },
-          after: null,
-          success: true,
-        });
-
-        if (!dryRun) {
-          revisionManager.removeById(rev.getId());
+    // Remove orphaned moveTo (REV004)
+    if (fixMoveTo) {
+      for (const [moveId, rev] of moveToIds) {
+        if (!moveFromIds.has(moveId)) {
+          const issue: ValidationIssue = {
+            code: REVISION_RULES.ORPHANED_MOVE_TO.code,
+            severity: 'error',
+            message: `Orphaned moveTo with moveId="${moveId}"`,
+            location: { revisionId: rev.getId() },
+            autoFixable: true,
+          };
+
+          actions.push({
+            issue,
+            action: `Removed orphaned moveTo (ID: ${rev.getId()}, moveId: ${moveId})`,
+            before: { type: 'moveTo', moveId },
+            after: null,
+            success: true,
+          });
+
+          if (!dryRun) {
+            revisionManager.removeById(rev.getId());
+            if (doc) {
+              this.removeRevisionFromContent(doc, rev);
+            }
+          }
         }
       }
     }
@@ -385,38 +437,27 @@ export class RevisionAutoFixer {
    * @param revisionManager - RevisionManager instance
    * @param revisions - Array of revisions
    * @param dryRun - If true, only report changes without applying
+   * @param doc - Document to remove the revision content from; without it
+   *   only the manager registry is pruned and saved XML keeps the markup
    * @returns Array of fix actions
    */
   static fixEmptyRevisions(
     revisionManager: RevisionManager,
     revisions: Revision[],
-    dryRun?: boolean
+    dryRun?: boolean,
+    doc?: Document
   ): FixAction[] {
     const actions: FixAction[] = [];
 
-    const propertyChangeTypes = [
-      'runPropertiesChange',
-      'paragraphPropertiesChange',
-      'tablePropertiesChange',
-      'tableExceptionPropertiesChange',
-      'tableRowPropertiesChange',
-      'tableCellPropertiesChange',
-      'sectionPropertiesChange',
-      'numberingChange',
-    ];
-
     for (const rev of revisions) {
       const type = rev.getType();
 
-      // Skip property changes
-      if (propertyChangeTypes.includes(type)) {
+      // Property changes and cell markers are contentless by design
+      if (CONTENTLESS_REVISION_TYPES.has(type)) {
         continue;
       }
 
-      const runs = rev.getRuns();
-      const hasContent = runs.length > 0 && runs.some((r) => r.getText().length > 0);
-
-      if (!hasContent) {
+      if (!revisionHasContent(rev)) {
         const issue: ValidationIssue = {
           code: REVISION_RULES.EMPTY_REVISION.code,
           severity: 'warning',
@@ -435,6 +476,9 @@ export class RevisionAutoFixer {
 
         if (!dryRun) {
           revisionManager.removeById(rev.getId());
+          if (doc) {
+            this.removeRevisionFromContent(doc, rev);
+          }
         }
       }
     }

package/src/validation/RevisionValidator.ts

@@ -9,6 +9,7 @@
 
 import type { Document } from '../core/Document.js';
 import type { Revision } from '../elements/Revision.js';
+import { isHyperlinkContent, isImageRunContent } from '../elements/RevisionContent.js';
 import {
   REVISION_RULES,
   ValidationIssue,
@@ -18,6 +19,44 @@ import {
 } from './ValidationRules.js';
 import { ValidationRuleRegistry } from './ValidationRuleRegistry.js';
 
+/**
+ * Revision types that are structurally contentless per ECMA-376: property
+ * change markers carry before/after property snapshots rather than runs, and
+ * table cell markers (w:cellIns/w:cellDel/w:cellMerge) annotate the cell
+ * itself. The REV103 empty-content rule must never flag these.
+ *
+ * Shared with RevisionAutoFixer so the validator and fixer cannot drift
+ * apart on which revision types are allowed to be empty.
+ */
+export const CONTENTLESS_REVISION_TYPES: ReadonlySet<string> = new Set([
+  'runPropertiesChange',
+  'paragraphPropertiesChange',
+  'tablePropertiesChange',
+  'tableExceptionPropertiesChange',
+  'tableRowPropertiesChange',
+  'tableCellPropertiesChange',
+  'sectionPropertiesChange',
+  'numberingChange',
+  'tableCellInsert',
+  'tableCellDelete',
+  'tableCellMerge',
+]);
+
+/**
+ * True when a revision carries real content. Per ECMA-376, w:ins/w:del may
+ * contain w:hyperlink and image runs (w:r with w:drawing) in addition to
+ * text runs, so a runs-only text check would falsely flag hyperlink-only
+ * and image-only tracked changes as empty. Shared with RevisionAutoFixer.
+ */
+export function revisionHasContent(rev: Revision): boolean {
+  // Covers text runs and hyperlink display text
+  if (rev.getText().length > 0) {
+    return true;
+  }
+  // Hyperlinks count even without display text; ImageRuns have no text at all
+  return rev.getContent().some((item) => isHyperlinkContent(item) || isImageRunContent(item));
+}
+
 /**
  * Validates document revisions for ECMA-376 compliance.
  *
@@ -67,15 +106,15 @@ export class RevisionValidator {
     if (!skipRules.has('REV001')) {
       allIssues.push(...this.validateRevisionIds(revisions));
     }
-    if (!skipRules.has('REV003') && !skipRules.has('REV004')) {
-      allIssues.push(...this.validateMovePairs(revisions));
-    }
+    // validateMovePairs emits both REV003 and REV004 from one pairing pass;
+    // filter per issue code so skipping one rule does not silently disable
+    // the other (REV004 is error-severity and corruption-relevant).
+    allIssues.push(...this.validateMovePairs(revisions).filter((i) => !skipRules.has(i.code)));
     if (!skipRules.has('REV002')) {
       allIssues.push(...this.validateAuthors(revisions));
     }
-    if (!skipRules.has('REV101') && !skipRules.has('REV102')) {
-      allIssues.push(...this.validateDates(revisions));
-    }
+    // validateDates emits both REV101 and REV102 — same per-code filtering.
+    allIssues.push(...this.validateDates(revisions).filter((i) => !skipRules.has(i.code)));
     if (!skipRules.has('REV103')) {
       allIssues.push(...this.validateContent(revisions));
     }
@@ -302,29 +341,15 @@ export class RevisionValidator {
   static validateContent(revisions: Revision[]): ValidationIssue[] {
     const issues: ValidationIssue[] = [];
 
-    const propertyChangeTypes = [
-      'runPropertiesChange',
-      'paragraphPropertiesChange',
-      'tablePropertiesChange',
-      'tableExceptionPropertiesChange',
-      'tableRowPropertiesChange',
-      'tableCellPropertiesChange',
-      'sectionPropertiesChange',
-      'numberingChange',
-    ];
-
     for (const rev of revisions) {
       const type = rev.getType();
 
-      // Property changes don't need text content
-      if (propertyChangeTypes.includes(type)) {
+      // Property changes and cell markers are contentless by design
+      if (CONTENTLESS_REVISION_TYPES.has(type)) {
         continue;
       }
 
-      const runs = rev.getRuns();
-      const hasContent = runs.length > 0 && runs.some((r) => r.getText().length > 0);
-
-      if (!hasContent) {
+      if (!revisionHasContent(rev)) {
         issues.push(
           createIssueFromRule(
             REVISION_RULES.EMPTY_REVISION,