kordoc 1.6.0 → 1.7.0

package/dist/index.cjs

@@ -91,6 +91,7 @@ __export(index_exports, {
   parsePdf: () => parsePdf
 });
 module.exports = __toCommonJS(index_exports);
+var import_promises = require("fs/promises");
 
 // src/detect.ts
 function magicBytes(buffer) {
@@ -122,6 +123,12 @@ var import_zlib = require("zlib");
 var import_xmldom = require("@xmldom/xmldom");
 
 // src/table/builder.ts
+var SAFE_HREF_RE = /^(?:https?:|mailto:|tel:|#)/i;
+function sanitizeHref(href) {
+  const trimmed = href.trim();
+  if (!trimmed || !SAFE_HREF_RE.test(trimmed)) return null;
+  return trimmed;
+}
 var MAX_COLS = 200;
 var MAX_ROWS = 1e4;
 function buildTable(rows) {
@@ -187,6 +194,10 @@ function blocksToMarkdown(blocks) {
       lines.push("", `${prefix} ${block.text}`, "");
       continue;
     }
+    if (block.type === "image" && block.text) {
+      lines.push("", `![image](${block.text})`, "");
+      continue;
+    }
     if (block.type === "separator") {
       lines.push("", "---", "");
       continue;
@@ -220,7 +231,8 @@ function blocksToMarkdown(blocks) {
         continue;
       }
       if (block.href) {
-        text = `[${text}](${block.href})`;
+        const href = sanitizeHref(block.href);
+        if (href) text = `[${text}](${href})`;
       }
       if (block.footnoteText) {
         text += ` (\uC8FC: ${block.footnoteText})`;
@@ -282,7 +294,13 @@ function tableToMarkdown(table) {
 }
 
 // src/utils.ts
-var VERSION = true ? "1.6.0" : "0.0.0-dev";
+var VERSION = true ? "1.7.0" : "0.0.0-dev";
+function toArrayBuffer(buf) {
+  if (buf.byteOffset === 0 && buf.byteLength === buf.buffer.byteLength) {
+    return buf.buffer;
+  }
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+}
 var KordocError = class extends Error {
   constructor(message) {
     super(message);
@@ -290,6 +308,7 @@ var KordocError = class extends Error {
   }
 };
 function isPathTraversal(name) {
+  if (name.includes("\0")) return true;
   const normalized = name.replace(/\\/g, "/");
   return normalized.includes("..") || normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized);
 }
@@ -341,7 +360,16 @@ var MAX_ZIP_ENTRIES = 500;
 function clampSpan(val, max) {
   return Math.max(1, Math.min(val, max));
 }
-async function extractHwpxStyles(zip) {
+var MAX_XML_DEPTH = 200;
+function createXmlParser(warnings) {
+  return new import_xmldom.DOMParser({
+    onError(level, msg) {
+      if (level === "fatalError") throw new KordocError(`XML \uD30C\uC2F1 \uC2E4\uD328: ${msg}`);
+      warnings?.push({ code: "MALFORMED_XML", message: `XML ${level === "warn" ? "\uACBD\uACE0" : "\uC624\uB958"}: ${msg}` });
+    }
+  });
+}
+async function extractHwpxStyles(zip, decompressed) {
   const result = {
     charProperties: /* @__PURE__ */ new Map(),
     styles: /* @__PURE__ */ new Map()
@@ -353,7 +381,11 @@ async function extractHwpxStyles(zip) {
     if (!file) continue;
     try {
       const xml = await file.async("text");
-      const parser = new import_xmldom.DOMParser();
+      if (decompressed) {
+        decompressed.total += xml.length * 2;
+        if (decompressed.total > MAX_DECOMPRESS_SIZE) throw new KordocError("ZIP \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (ZIP bomb \uC758\uC2EC)");
+      }
+      const parser = createXmlParser();
       const doc = parser.parseFromString(stripDtd(xml), "text/xml");
       if (!doc.documentElement) continue;
       parseCharProperties(doc, result.charProperties);
@@ -431,37 +463,128 @@ async function parseHwpxDocument(buffer, options) {
   if (actualEntryCount > MAX_ZIP_ENTRIES) {
     throw new KordocError("ZIP \uC5D4\uD2B8\uB9AC \uC218 \uCD08\uACFC (ZIP bomb \uC758\uC2EC)");
   }
+  const decompressed = { total: 0 };
   const metadata = {};
-  await extractHwpxMetadata(zip, metadata);
-  const styleMap = await extractHwpxStyles(zip);
+  await extractHwpxMetadata(zip, metadata, decompressed);
+  const styleMap = await extractHwpxStyles(zip, decompressed);
   const warnings = [];
   const sectionPaths = await resolveSectionPaths(zip);
   if (sectionPaths.length === 0) throw new KordocError("HWPX\uC5D0\uC11C \uC139\uC158 \uD30C\uC77C\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4");
   metadata.pageCount = sectionPaths.length;
   const pageFilter = options?.pages ? parsePageRange(options.pages, sectionPaths.length) : null;
-  let totalDecompressed = 0;
+  const totalTarget = pageFilter ? pageFilter.size : sectionPaths.length;
   const blocks = [];
+  let parsedSections = 0;
   for (let si = 0; si < sectionPaths.length; si++) {
     if (pageFilter && !pageFilter.has(si + 1)) continue;
     const file = zip.file(sectionPaths[si]);
     if (!file) continue;
-    const xml = await file.async("text");
-    totalDecompressed += xml.length * 2;
-    if (totalDecompressed > MAX_DECOMPRESS_SIZE) throw new KordocError("ZIP \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (ZIP bomb \uC758\uC2EC)");
-    blocks.push(...parseSectionXml(xml, styleMap, warnings, si + 1));
+    try {
+      const xml = await file.async("text");
+      decompressed.total += xml.length * 2;
+      if (decompressed.total > MAX_DECOMPRESS_SIZE) throw new KordocError("ZIP \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (ZIP bomb \uC758\uC2EC)");
+      blocks.push(...parseSectionXml(xml, styleMap, warnings, si + 1));
+      parsedSections++;
+      options?.onProgress?.(parsedSections, totalTarget);
+    } catch (secErr) {
+      if (secErr instanceof KordocError) throw secErr;
+      warnings.push({ page: si + 1, message: `\uC139\uC158 ${si + 1} \uD30C\uC2F1 \uC2E4\uD328: ${secErr instanceof Error ? secErr.message : "\uC54C \uC218 \uC5C6\uB294 \uC624\uB958"}`, code: "PARTIAL_PARSE" });
+    }
   }
+  const images = await extractImagesFromZip(zip, blocks, decompressed, warnings);
   detectHwpxHeadings(blocks, styleMap);
   const outline = blocks.filter((b) => b.type === "heading" && b.level && b.text).map((b) => ({ level: b.level, text: b.text, pageNumber: b.pageNumber }));
   const markdown = blocksToMarkdown(blocks);
-  return { markdown, blocks, metadata, outline: outline.length > 0 ? outline : void 0, warnings: warnings.length > 0 ? warnings : void 0 };
+  return { markdown, blocks, metadata, outline: outline.length > 0 ? outline : void 0, warnings: warnings.length > 0 ? warnings : void 0, images: images.length > 0 ? images : void 0 };
+}
+function imageExtToMime(ext) {
+  switch (ext.toLowerCase()) {
+    case "jpg":
+    case "jpeg":
+      return "image/jpeg";
+    case "png":
+      return "image/png";
+    case "gif":
+      return "image/gif";
+    case "bmp":
+      return "image/bmp";
+    case "tif":
+    case "tiff":
+      return "image/tiff";
+    case "wmf":
+      return "image/wmf";
+    case "emf":
+      return "image/emf";
+    case "svg":
+      return "image/svg+xml";
+    default:
+      return "application/octet-stream";
+  }
+}
+function mimeToExt(mime) {
+  if (mime.includes("jpeg")) return "jpg";
+  if (mime.includes("png")) return "png";
+  if (mime.includes("gif")) return "gif";
+  if (mime.includes("bmp")) return "bmp";
+  if (mime.includes("tiff")) return "tif";
+  if (mime.includes("wmf")) return "wmf";
+  if (mime.includes("emf")) return "emf";
+  if (mime.includes("svg")) return "svg";
+  return "bin";
+}
+async function extractImagesFromZip(zip, blocks, decompressed, warnings) {
+  const images = [];
+  let imageIndex = 0;
+  for (const block of blocks) {
+    if (block.type !== "image" || !block.text) continue;
+    const ref = block.text;
+    const candidates = [
+      `BinData/${ref}`,
+      `Contents/BinData/${ref}`,
+      ref
+      // 절대 경로일 수도 있음
+    ];
+    let found = false;
+    for (const path of candidates) {
+      if (isPathTraversal(path)) continue;
+      const file = zip.file(path);
+      if (!file) continue;
+      try {
+        const data = await file.async("uint8array");
+        decompressed.total += data.length;
+        if (decompressed.total > MAX_DECOMPRESS_SIZE) throw new KordocError("ZIP \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (ZIP bomb \uC758\uC2EC)");
+        const ext = ref.includes(".") ? ref.split(".").pop() : "png";
+        const mimeType = imageExtToMime(ext);
+        imageIndex++;
+        const filename = `image_${String(imageIndex).padStart(3, "0")}.${mimeToExt(mimeType)}`;
+        images.push({ filename, data, mimeType });
+        block.text = filename;
+        block.imageData = { data, mimeType, filename: ref };
+        found = true;
+        break;
+      } catch (err) {
+        if (err instanceof KordocError) throw err;
+      }
+    }
+    if (!found) {
+      warnings?.push({ page: block.pageNumber, message: `\uC774\uBBF8\uC9C0 \uD30C\uC77C \uC5C6\uC74C: ${ref}`, code: "SKIPPED_IMAGE" });
+      block.type = "paragraph";
+      block.text = `[\uC774\uBBF8\uC9C0: ${ref}]`;
+    }
+  }
+  return images;
 }
-async function extractHwpxMetadata(zip, metadata) {
+async function extractHwpxMetadata(zip, metadata, decompressed) {
   try {
     const metaPaths = ["meta.xml", "META-INF/meta.xml", "docProps/core.xml"];
     for (const mp of metaPaths) {
       const file = zip.file(mp) || Object.values(zip.files).find((f) => f.name.toLowerCase() === mp.toLowerCase()) || null;
       if (!file) continue;
       const xml = await file.async("text");
+      if (decompressed) {
+        decompressed.total += xml.length * 2;
+        if (decompressed.total > MAX_DECOMPRESS_SIZE) throw new KordocError("ZIP \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (ZIP bomb \uC758\uC2EC)");
+      }
       parseDublinCoreMetadata(xml, metadata);
       if (metadata.title || metadata.author) return;
     }
@@ -469,7 +592,7 @@ async function extractHwpxMetadata(zip, metadata) {
   }
 }
 function parseDublinCoreMetadata(xml, metadata) {
-  const parser = new import_xmldom.DOMParser();
+  const parser = createXmlParser();
   const doc = parser.parseFromString(stripDtd(xml), "text/xml");
   if (!doc.documentElement) return;
   const getText = (tagNames) => {
@@ -533,7 +656,14 @@ function extractFromBrokenZip(buffer) {
   let totalDecompressed = 0;
   let entryCount = 0;
   while (pos < data.length - 30) {
-    if (data[pos] !== 80 || data[pos + 1] !== 75 || data[pos + 2] !== 3 || data[pos + 3] !== 4) break;
+    if (data[pos] !== 80 || data[pos + 1] !== 75 || data[pos + 2] !== 3 || data[pos + 3] !== 4) {
+      pos++;
+      while (pos < data.length - 30) {
+        if (data[pos] === 80 && data[pos + 1] === 75 && data[pos + 2] === 3 && data[pos + 3] === 4) break;
+        pos++;
+      }
+      continue;
+    }
     if (++entryCount > MAX_ZIP_ENTRIES) break;
     const method = view.getUint16(pos + 8, true);
     const compSize = view.getUint32(pos + 18, true);
@@ -593,7 +723,7 @@ async function resolveSectionPaths(zip) {
   return sectionFiles.map((f) => f.name).sort();
 }
 function parseSectionPathsFromManifest(xml) {
-  const parser = new import_xmldom.DOMParser();
+  const parser = createXmlParser();
   const doc = parser.parseFromString(stripDtd(xml), "text/xml");
   const items = doc.getElementsByTagName("opf:item");
   const spine = doc.getElementsByTagName("opf:itemref");
@@ -655,14 +785,33 @@ function detectHwpxHeadings(blocks, styleMap) {
   }
 }
 function parseSectionXml(xml, styleMap, warnings, sectionNum) {
-  const parser = new import_xmldom.DOMParser();
+  const parser = createXmlParser(warnings);
   const doc = parser.parseFromString(stripDtd(xml), "text/xml");
   if (!doc.documentElement) return [];
   const blocks = [];
   walkSection(doc.documentElement, blocks, null, [], styleMap, warnings, sectionNum);
   return blocks;
 }
-function walkSection(node, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum) {
+function extractImageRef(el) {
+  const children = el.childNodes;
+  if (!children) return null;
+  for (let i = 0; i < children.length; i++) {
+    const child = children[i];
+    if (child.nodeType !== 1) continue;
+    const tag = (child.tagName || child.localName || "").replace(/^[^:]+:/, "");
+    if (tag === "imgRect" || tag === "img" || tag === "imgClip") {
+      const ref = child.getAttribute("binaryItemIDRef") || child.getAttribute("href") || "";
+      if (ref) return ref;
+    }
+    const nested = extractImageRef(child);
+    if (nested) return nested;
+  }
+  const directRef = el.getAttribute("binaryItemIDRef") || "";
+  if (directRef) return directRef;
+  return null;
+}
+function walkSection(node, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum, depth = 0) {
+  if (depth > MAX_XML_DEPTH) return;
   const children = node.childNodes;
   if (!children) return;
   for (let i = 0; i < children.length; i++) {
@@ -674,7 +823,7 @@ function walkSection(node, blocks, tableCtx, tableStack, styleMap, warnings, sec
       case "tbl": {
         if (tableCtx) tableStack.push(tableCtx);
         const newTable = { rows: [], currentRow: [], cell: null };
-        walkSection(el, blocks, newTable, tableStack, styleMap, warnings, sectionNum);
+        walkSection(el, blocks, newTable, tableStack, styleMap, warnings, sectionNum, depth + 1);
         if (newTable.rows.length > 0) {
           if (tableStack.length > 0) {
             const parentTable = tableStack.pop();
@@ -695,7 +844,7 @@ function walkSection(node, blocks, tableCtx, tableStack, styleMap, warnings, sec
       case "tr":
         if (tableCtx) {
           tableCtx.currentRow = [];
-          walkSection(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum);
+          walkSection(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum, depth + 1);
           if (tableCtx.currentRow.length > 0) tableCtx.rows.push(tableCtx.currentRow);
           tableCtx.currentRow = [];
         }
@@ -703,7 +852,7 @@ function walkSection(node, blocks, tableCtx, tableStack, styleMap, warnings, sec
       case "tc":
         if (tableCtx) {
           tableCtx.cell = { text: "", colSpan: 1, rowSpan: 1 };
-          walkSection(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum);
+          walkSection(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum, depth + 1);
           if (tableCtx.cell) {
             tableCtx.currentRow.push(tableCtx.cell);
             tableCtx.cell = null;
@@ -731,24 +880,29 @@ function walkSection(node, blocks, tableCtx, tableStack, styleMap, warnings, sec
             blocks.push(block);
           }
         }
-        tableCtx = walkParagraphChildren(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum);
+        tableCtx = walkParagraphChildren(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum, depth + 1);
         break;
       }
-      // 이미지/그림 — 경고 수집
+      // 이미지/그림 — 경로 추출 또는 경고
       case "pic":
       case "shape":
-      case "drawingObject":
-        if (warnings && sectionNum) {
+      case "drawingObject": {
+        const imgRef = extractImageRef(el);
+        if (imgRef) {
+          blocks.push({ type: "image", text: imgRef, pageNumber: sectionNum });
+        } else if (warnings && sectionNum) {
           warnings.push({ page: sectionNum, message: `\uC2A4\uD0B5\uB41C \uC694\uC18C: ${localTag}`, code: "SKIPPED_IMAGE" });
         }
         break;
+      }
       default:
-        walkSection(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum);
+        walkSection(el, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum, depth + 1);
         break;
     }
   }
 }
-function walkParagraphChildren(node, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum) {
+function walkParagraphChildren(node, blocks, tableCtx, tableStack, styleMap, warnings, sectionNum, depth = 0) {
+  if (depth > MAX_XML_DEPTH) return tableCtx;
   const children = node.childNodes;
   if (!children) return tableCtx;
   for (let i = 0; i < children.length; i++) {
@@ -759,7 +913,7 @@ function walkParagraphChildren(node, blocks, tableCtx, tableStack, styleMap, war
     if (localTag === "tbl") {
       if (tableCtx) tableStack.push(tableCtx);
       const newTable = { rows: [], currentRow: [], cell: null };
-      walkSection(el, blocks, newTable, tableStack, styleMap, warnings, sectionNum);
+      walkSection(el, blocks, newTable, tableStack, styleMap, warnings, sectionNum, depth + 1);
       if (newTable.rows.length > 0) {
         if (tableStack.length > 0) {
           const parentTable = tableStack.pop();
@@ -776,7 +930,10 @@ function walkParagraphChildren(node, blocks, tableCtx, tableStack, styleMap, war
         tableCtx = tableStack.length > 0 ? tableStack.pop() : null;
       }
     } else if (localTag === "pic" || localTag === "shape" || localTag === "drawingObject") {
-      if (warnings && sectionNum) {
+      const imgRef = extractImageRef(el);
+      if (imgRef) {
+        blocks.push({ type: "image", text: imgRef, pageNumber: sectionNum });
+      } else if (warnings && sectionNum) {
         warnings.push({ page: sectionNum, message: `\uC2A4\uD0B5\uB41C \uC694\uC18C: ${localTag}`, code: "SKIPPED_IMAGE" });
       }
     }
@@ -992,6 +1149,7 @@ function extractText(data) {
         break;
       case CHAR_TAB:
         result += "	";
+        if (i + 14 <= data.length) i += 14;
         break;
       case CHAR_HYPHEN:
         result += "-";
@@ -1049,24 +1207,34 @@ function parseHwp5Document(buffer, options) {
   if (sections.length === 0) throw new KordocError("\uC139\uC158 \uC2A4\uD2B8\uB9BC\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4");
   metadata.pageCount = sections.length;
   const pageFilter = options?.pages ? parsePageRange(options.pages, sections.length) : null;
+  const totalTarget = pageFilter ? pageFilter.size : sections.length;
   const blocks = [];
   let totalDecompressed = 0;
+  let parsedSections = 0;
   for (let si = 0; si < sections.length; si++) {
     if (pageFilter && !pageFilter.has(si + 1)) continue;
-    const sectionData = sections[si];
-    const data = compressed ? decompressStream(Buffer.from(sectionData)) : Buffer.from(sectionData);
-    totalDecompressed += data.length;
-    if (totalDecompressed > MAX_TOTAL_DECOMPRESS) throw new KordocError("\uCD1D \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (decompression bomb \uC758\uC2EC)");
-    const records = readRecords(data);
-    const sectionBlocks = parseSection(records, docInfo, warnings, si + 1);
-    blocks.push(...sectionBlocks);
-  }
+    try {
+      const sectionData = sections[si];
+      const data = compressed ? decompressStream(Buffer.from(sectionData)) : Buffer.from(sectionData);
+      totalDecompressed += data.length;
+      if (totalDecompressed > MAX_TOTAL_DECOMPRESS) throw new KordocError("\uCD1D \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (decompression bomb \uC758\uC2EC)");
+      const records = readRecords(data);
+      const sectionBlocks = parseSection(records, docInfo, warnings, si + 1);
+      blocks.push(...sectionBlocks);
+      parsedSections++;
+      options?.onProgress?.(parsedSections, totalTarget);
+    } catch (secErr) {
+      if (secErr instanceof KordocError) throw secErr;
+      warnings.push({ page: si + 1, message: `\uC139\uC158 ${si + 1} \uD30C\uC2F1 \uC2E4\uD328: ${secErr instanceof Error ? secErr.message : "\uC54C \uC218 \uC5C6\uB294 \uC624\uB958"}`, code: "PARTIAL_PARSE" });
+    }
+  }
+  const images = extractHwp5Images(cfb, blocks, compressed, warnings);
   if (docInfo) {
     detectHwp5Headings(blocks, docInfo);
   }
   const outline = blocks.filter((b) => b.type === "heading" && b.level && b.text).map((b) => ({ level: b.level, text: b.text, pageNumber: b.pageNumber }));
   const markdown = blocksToMarkdown(blocks);
-  return { markdown, blocks, metadata, outline: outline.length > 0 ? outline : void 0, warnings: warnings.length > 0 ? warnings : void 0 };
+  return { markdown, blocks, metadata, outline: outline.length > 0 ? outline : void 0, warnings: warnings.length > 0 ? warnings : void 0, images: images.length > 0 ? images : void 0 };
 }
 function parseDocInfoStream(cfb, compressed) {
   try {
@@ -1176,6 +1344,78 @@ function findSections(cfb) {
   }
   return sections.sort((a, b) => a.idx - b.idx).map((s) => s.content);
 }
+var TAG_SHAPE_COMPONENT = 74;
+function extractBinDataId(records, ctrlIdx) {
+  const ctrlLevel = records[ctrlIdx].level;
+  for (let j = ctrlIdx + 1; j < records.length && j < ctrlIdx + 50; j++) {
+    const r = records[j];
+    if (r.level <= ctrlLevel) break;
+    if (r.data.length >= 2) {
+      if (r.tagId > TAG_SHAPE_COMPONENT && r.level > ctrlLevel + 1 && r.data.length >= 4) {
+        const possibleId = r.data.readUInt16LE(0);
+        if (possibleId < 1e4) return possibleId;
+      }
+    }
+  }
+  return -1;
+}
+function detectImageMime(data) {
+  if (data.length < 4) return null;
+  if (data[0] === 137 && data[1] === 80 && data[2] === 78 && data[3] === 71) return "image/png";
+  if (data[0] === 255 && data[1] === 216 && data[2] === 255) return "image/jpeg";
+  if (data[0] === 71 && data[1] === 73 && data[2] === 70) return "image/gif";
+  if (data[0] === 66 && data[1] === 77) return "image/bmp";
+  if (data[0] === 215 && data[1] === 205 && data[2] === 198 && data[3] === 154) return "image/wmf";
+  if (data[0] === 1 && data[1] === 0 && data[2] === 0 && data[3] === 0) return "image/emf";
+  return null;
+}
+function extractHwp5Images(cfb, blocks, compressed, warnings) {
+  const binDataMap = /* @__PURE__ */ new Map();
+  for (let idx = 0; idx < 1e4; idx++) {
+    const entry = CFB.find(cfb, `/BinData/BIN${String(idx).padStart(4, "0")}`) || CFB.find(cfb, `/BinData/Bin${String(idx).padStart(4, "0")}`);
+    if (!entry?.content) {
+      if (idx > 0) break;
+      continue;
+    }
+    let data = Buffer.from(entry.content);
+    if (compressed) {
+      try {
+        data = decompressStream(data);
+      } catch {
+      }
+    }
+    binDataMap.set(idx, { data, name: entry.name || `BIN${idx}` });
+  }
+  if (binDataMap.size === 0) return [];
+  const images = [];
+  let imageIndex = 0;
+  for (const block of blocks) {
+    if (block.type !== "image" || !block.text) continue;
+    const binId = parseInt(block.text, 10);
+    if (isNaN(binId)) continue;
+    const bin = binDataMap.get(binId);
+    if (!bin) {
+      warnings.push({ page: block.pageNumber, message: `BinData ${binId} \uC5C6\uC74C`, code: "SKIPPED_IMAGE" });
+      block.type = "paragraph";
+      block.text = `[\uC774\uBBF8\uC9C0: BinData ${binId}]`;
+      continue;
+    }
+    const mime = detectImageMime(bin.data);
+    if (!mime) {
+      warnings.push({ page: block.pageNumber, message: `BinData ${binId}: \uC54C \uC218 \uC5C6\uB294 \uC774\uBBF8\uC9C0 \uD615\uC2DD`, code: "SKIPPED_IMAGE" });
+      block.type = "paragraph";
+      block.text = `[\uC774\uBBF8\uC9C0: ${bin.name}]`;
+      continue;
+    }
+    imageIndex++;
+    const ext = mime.includes("jpeg") ? "jpg" : mime.includes("png") ? "png" : mime.includes("gif") ? "gif" : mime.includes("bmp") ? "bmp" : "bin";
+    const filename = `image_${String(imageIndex).padStart(3, "0")}.${ext}`;
+    images.push({ filename, data: new Uint8Array(bin.data), mimeType: mime });
+    block.text = filename;
+    block.imageData = { data: new Uint8Array(bin.data), mimeType: mime, filename: bin.name };
+  }
+  return images;
+}
 function parseSection(records, docInfo, warnings, sectionNum) {
   const blocks = [];
   let i = 0;
@@ -1203,7 +1443,14 @@ function parseSection(records, docInfo, warnings, sectionNum) {
         i = nextIdx;
         continue;
       }
-      if (ctrlId === "gso " || ctrlId === " osg" || ctrlId === " elo" || ctrlId === "ole ") {
+      if (ctrlId === "gso " || ctrlId === " osg") {
+        const binId = extractBinDataId(records, i);
+        if (binId >= 0) {
+          blocks.push({ type: "image", text: String(binId), pageNumber: sectionNum });
+        } else {
+          warnings.push({ page: sectionNum, message: `\uC2A4\uD0B5\uB41C \uC81C\uC5B4 \uC694\uC18C: ${ctrlId.trim()}`, code: "SKIPPED_IMAGE" });
+        }
+      } else if (ctrlId === " elo" || ctrlId === "ole ") {
         warnings.push({ page: sectionNum, message: `\uC2A4\uD0B5\uB41C \uC81C\uC5B4 \uC694\uC18C: ${ctrlId.trim()}`, code: "SKIPPED_IMAGE" });
       }
     }
@@ -1293,9 +1540,13 @@ function parseCellBlock(records, startIdx, tableLevel) {
   const texts = [];
   let colSpan = 1;
   let rowSpan = 1;
-  if (rec.data.length >= 14) {
-    const cs = rec.data.readUInt16LE(10);
-    const rs = rec.data.readUInt16LE(12);
+  let colAddr;
+  let rowAddr;
+  if (rec.data.length >= 16) {
+    colAddr = rec.data.readUInt16LE(8);
+    rowAddr = rec.data.readUInt16LE(10);
+    const cs = rec.data.readUInt16LE(12);
+    const rs = rec.data.readUInt16LE(14);
     if (cs > 0) colSpan = Math.min(cs, MAX_COLS);
     if (rs > 0) rowSpan = Math.min(rs, MAX_ROWS);
   }
@@ -1310,15 +1561,16 @@ function parseCellBlock(records, startIdx, tableLevel) {
     }
     i++;
   }
-  return { cell: { text: texts.join("\n"), colSpan, rowSpan }, nextIdx: i };
+  return { cell: { text: texts.join("\n"), colSpan, rowSpan, colAddr, rowAddr }, nextIdx: i };
 }
 function arrangeCells(rows, cols, cells) {
   const grid = Array.from({ length: rows }, () => Array(cols).fill(null));
-  let cellIdx = 0;
-  for (let r = 0; r < rows && cellIdx < cells.length; r++) {
-    for (let c = 0; c < cols && cellIdx < cells.length; c++) {
-      if (grid[r][c] !== null) continue;
-      const cell = cells[cellIdx++];
+  const hasAddr = cells.some((c) => c.colAddr !== void 0 && c.rowAddr !== void 0);
+  if (hasAddr) {
+    for (const cell of cells) {
+      const r = cell.rowAddr ?? 0;
+      const c = cell.colAddr ?? 0;
+      if (r >= rows || c >= cols) continue;
       grid[r][c] = cell;
       for (let dr = 0; dr < cell.rowSpan; dr++) {
         for (let dc = 0; dc < cell.colSpan; dc++) {
@@ -1328,6 +1580,22 @@ function arrangeCells(rows, cols, cells) {
         }
       }
     }
+  } else {
+    let cellIdx = 0;
+    for (let r = 0; r < rows && cellIdx < cells.length; r++) {
+      for (let c = 0; c < cols && cellIdx < cells.length; c++) {
+        if (grid[r][c] !== null) continue;
+        const cell = cells[cellIdx++];
+        grid[r][c] = cell;
+        for (let dr = 0; dr < cell.rowSpan; dr++) {
+          for (let dc = 0; dc < cell.colSpan; dc++) {
+            if (dr === 0 && dc === 0) continue;
+            if (r + dr < rows && c + dc < cols)
+              grid[r + dr][c + dc] = { text: "", colSpan: 1, rowSpan: 1 };
+          }
+        }
+      }
+    }
   }
   return grid.map((row) => row.map((c) => c || { text: "", colSpan: 1, rowSpan: 1 }));
 }
@@ -1889,13 +2157,26 @@ var import_pdf2 = require("pdfjs-dist/legacy/build/pdf.mjs");
 import_pdf2.GlobalWorkerOptions.workerSrc = "";
 var MAX_PAGES = 5e3;
 var MAX_TOTAL_TEXT = 100 * 1024 * 1024;
-async function parsePdfDocument(buffer, options) {
-  const doc = await (0, import_pdf2.getDocument)({
+var PDF_LOAD_TIMEOUT_MS = 3e4;
+async function loadPdfWithTimeout(buffer) {
+  const loadingTask = (0, import_pdf2.getDocument)({
     data: new Uint8Array(buffer),
     useSystemFonts: true,
     disableFontFace: true,
     isEvalSupported: false
-  }).promise;
+  });
+  return Promise.race([
+    loadingTask.promise,
+    new Promise(
+      (_, reject) => setTimeout(() => {
+        loadingTask.destroy();
+        reject(new KordocError("PDF \uB85C\uB529 \uD0C0\uC784\uC544\uC6C3 (30\uCD08 \uCD08\uACFC)"));
+      }, PDF_LOAD_TIMEOUT_MS)
+    )
+  ]);
+}
+async function parsePdfDocument(buffer, options) {
+  const doc = await loadPdfWithTimeout(buffer);
   try {
     const pageCount = doc.numPages;
     if (pageCount === 0) return { success: false, fileType: "pdf", pageCount: 0, error: "PDF\uC5D0 \uD398\uC774\uC9C0\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.", code: "PARSE_ERROR" };
@@ -1907,32 +2188,43 @@ async function parsePdfDocument(buffer, options) {
     let totalTextBytes = 0;
     const effectivePageCount = Math.min(pageCount, MAX_PAGES);
     const pageFilter = options?.pages ? parsePageRange(options.pages, effectivePageCount) : null;
+    const totalTarget = pageFilter ? pageFilter.size : effectivePageCount;
     const allFontSizes = [];
+    const pageHeights = /* @__PURE__ */ new Map();
+    let parsedPages = 0;
     for (let i = 1; i <= effectivePageCount; i++) {
       if (pageFilter && !pageFilter.has(i)) continue;
-      const page = await doc.getPage(i);
-      const tc = await page.getTextContent();
-      const viewport = page.getViewport({ scale: 1 });
-      const rawItems = tc.items;
-      const items = normalizeItems(rawItems);
-      const { visible, hiddenCount } = filterHiddenText(items, viewport.width, viewport.height);
-      if (hiddenCount > 0) {
-        warnings.push({ page: i, message: `${hiddenCount}\uAC1C \uC228\uACA8\uC9C4 \uD14D\uC2A4\uD2B8 \uC694\uC18C \uD544\uD130\uB9C1\uB428`, code: "HIDDEN_TEXT_FILTERED" });
-      }
-      for (const item of visible) {
-        if (item.fontSize > 0) allFontSizes.push(item.fontSize);
-      }
-      const opList = await page.getOperatorList();
-      const pageBlocks = extractPageBlocksWithLines(visible, i, opList, viewport.width, viewport.height);
-      for (const b of pageBlocks) blocks.push(b);
-      for (const b of pageBlocks) {
-        const t = b.text || "";
-        totalChars += t.replace(/\s/g, "").length;
-        totalTextBytes += t.length * 2;
-      }
-      if (totalTextBytes > MAX_TOTAL_TEXT) throw new KordocError("\uD14D\uC2A4\uD2B8 \uCD94\uCD9C \uD06C\uAE30 \uCD08\uACFC");
-    }
-    const parsedPageCount = pageFilter ? pageFilter.size : effectivePageCount;
+      try {
+        const page = await doc.getPage(i);
+        const tc = await page.getTextContent();
+        const viewport = page.getViewport({ scale: 1 });
+        pageHeights.set(i, viewport.height);
+        const rawItems = tc.items;
+        const items = normalizeItems(rawItems);
+        const { visible, hiddenCount } = filterHiddenText(items, viewport.width, viewport.height);
+        if (hiddenCount > 0) {
+          warnings.push({ page: i, message: `${hiddenCount}\uAC1C \uC228\uACA8\uC9C4 \uD14D\uC2A4\uD2B8 \uC694\uC18C \uD544\uD130\uB9C1\uB428`, code: "HIDDEN_TEXT_FILTERED" });
+        }
+        for (const item of visible) {
+          if (item.fontSize > 0) allFontSizes.push(item.fontSize);
+        }
+        const opList = await page.getOperatorList();
+        const pageBlocks = extractPageBlocksWithLines(visible, i, opList, viewport.width, viewport.height);
+        for (const b of pageBlocks) blocks.push(b);
+        for (const b of pageBlocks) {
+          const t = b.text || "";
+          totalChars += t.replace(/\s/g, "").length;
+          totalTextBytes += t.length * 2;
+        }
+        if (totalTextBytes > MAX_TOTAL_TEXT) throw new KordocError("\uD14D\uC2A4\uD2B8 \uCD94\uCD9C \uD06C\uAE30 \uCD08\uACFC");
+        parsedPages++;
+        options?.onProgress?.(parsedPages, totalTarget);
+      } catch (pageErr) {
+        if (pageErr instanceof KordocError) throw pageErr;
+        warnings.push({ page: i, message: `\uD398\uC774\uC9C0 ${i} \uD30C\uC2F1 \uC2E4\uD328: ${pageErr instanceof Error ? pageErr.message : "\uC54C \uC218 \uC5C6\uB294 \uC624\uB958"}`, code: "PARTIAL_PARSE" });
+      }
+    }
+    const parsedPageCount = parsedPages || (pageFilter ? pageFilter.size : effectivePageCount);
     if (totalChars / Math.max(parsedPageCount, 1) < 10) {
       if (options?.ocr) {
         try {
@@ -1947,6 +2239,12 @@ async function parsePdfDocument(buffer, options) {
       }
       return { success: false, fileType: "pdf", pageCount, isImageBased: true, error: `\uC774\uBBF8\uC9C0 \uAE30\uBC18 PDF (${pageCount}\uD398\uC774\uC9C0, ${totalChars}\uC790)`, code: "IMAGE_BASED_PDF" };
     }
+    if (options?.removeHeaderFooter && parsedPageCount >= 3) {
+      const removed = removeHeaderFooterBlocks(blocks, pageHeights, warnings);
+      for (let ri = removed.length - 1; ri >= 0; ri--) {
+        blocks.splice(removed[ri], 1);
+      }
+    }
     const medianFontSize = computeMedianFontSize(allFontSizes);
     if (medianFontSize > 0) {
       detectHeadings(blocks, medianFontSize);
@@ -2128,8 +2426,8 @@ function extractBlocksWithGrids(items, pageNum, grids, horizontals, verticals) {
       () => Array.from({ length: numCols }, () => ({ text: "", colSpan: 1, rowSpan: 1 }))
     );
     for (const cell of cells) {
-      const textItems2 = cellTextMap.get(cell) || [];
-      const text = cellTextToString(textItems2);
+      const cellItems = cellTextMap.get(cell) || [];
+      const text = cellTextToString(cellItems);
       irGrid[cell.row][cell.col] = {
         text,
         colSpan: cell.colSpan,
@@ -2547,6 +2845,7 @@ function detectListBlocks(blocks) {
   return result;
 }
 var KOREAN_TABLE_HEADER_RE = /^\(?(구분|항목|종류|분류|유형|대상|내용|기간|금액|비율|방법|절차|요건|조건|근거|목적|범위|기준)\)?[:\s]/;
+var KV_FALSE_POSITIVE_RE = /\d{1,2}:\d{2}|:\/\/|\d+:\d+/;
 function detectSpecialKoreanTables(blocks) {
   const result = [];
   let kvLines = [];
@@ -2612,16 +2911,18 @@ function detectSpecialKoreanTables(blocks) {
       }
       continue;
     }
-    if (kvLines.length > 0 && text.includes(":") && !text.includes("(") && !text.includes(")")) {
-      const colonIdx = text.indexOf(":");
-      const key = text.slice(0, colonIdx).trim();
-      if (/^[가-힣]+$/.test(key) && key.length >= 2 && key.length <= 8) {
-        kvLines.push({
-          key,
-          value: text.slice(colonIdx + 1).trim(),
-          block
-        });
-        continue;
+    if (kvLines.length > 0 && text.includes(":")) {
+      if (!KV_FALSE_POSITIVE_RE.test(text) && !text.includes("(") && !text.includes(")")) {
+        const colonIdx = text.indexOf(":");
+        const key = text.slice(0, colonIdx).trim();
+        if (/^[가-힣]+$/.test(key) && key.length >= 2 && key.length <= 8) {
+          kvLines.push({
+            key,
+            value: text.slice(colonIdx + 1).trim(),
+            block
+          });
+          continue;
+        }
       }
     }
     flushKvTable();
@@ -2630,6 +2931,62 @@ function detectSpecialKoreanTables(blocks) {
   flushKvTable();
   return result;
 }
+function removeHeaderFooterBlocks(blocks, pageHeights, warnings) {
+  const ZONE_RATIO = 0.1;
+  const MIN_REPEAT = 3;
+  const headerTexts = /* @__PURE__ */ new Map();
+  const footerTexts = /* @__PURE__ */ new Map();
+  for (let bi = 0; bi < blocks.length; bi++) {
+    const b = blocks[bi];
+    if (!b.bbox || !b.pageNumber || !b.text?.trim()) continue;
+    const ph = pageHeights.get(b.bbox.page) || pageHeights.get(b.pageNumber);
+    if (!ph) continue;
+    const blockTop = ph - (b.bbox.y + b.bbox.height);
+    const blockBottom = ph - b.bbox.y;
+    if (blockBottom <= ph * ZONE_RATIO) {
+      const arr = footerTexts.get(b.pageNumber) || [];
+      arr.push(b.text.trim());
+      footerTexts.set(b.pageNumber, arr);
+    } else if (blockTop >= ph * (1 - ZONE_RATIO)) {
+      const arr = headerTexts.get(b.pageNumber) || [];
+      arr.push(b.text.trim());
+      headerTexts.set(b.pageNumber, arr);
+    }
+  }
+  const repeatedPatterns = /* @__PURE__ */ new Set();
+  for (const textsMap of [headerTexts, footerTexts]) {
+    const patternCount = /* @__PURE__ */ new Map();
+    for (const [, texts] of textsMap) {
+      for (const t of texts) {
+        const normalized = t.replace(/\d+/g, "#");
+        patternCount.set(normalized, (patternCount.get(normalized) || 0) + 1);
+      }
+    }
+    for (const [pattern, count] of patternCount) {
+      if (count >= MIN_REPEAT) repeatedPatterns.add(pattern);
+    }
+  }
+  if (repeatedPatterns.size === 0) return [];
+  const removeIndices = [];
+  for (let bi = 0; bi < blocks.length; bi++) {
+    const b = blocks[bi];
+    if (!b.bbox || !b.pageNumber || !b.text?.trim()) continue;
+    const ph = pageHeights.get(b.bbox.page) || pageHeights.get(b.pageNumber);
+    if (!ph) continue;
+    const blockTop = ph - (b.bbox.y + b.bbox.height);
+    const blockBottom = ph - b.bbox.y;
+    const inZone = blockBottom <= ph * ZONE_RATIO || blockTop >= ph * (1 - ZONE_RATIO);
+    if (!inZone) continue;
+    const normalized = b.text.trim().replace(/\d+/g, "#");
+    if (repeatedPatterns.has(normalized)) {
+      removeIndices.push(bi);
+    }
+  }
+  if (removeIndices.length > 0) {
+    warnings.push({ message: `${removeIndices.length}\uAC1C \uBA38\uB9AC\uAE00/\uBC14\uB2E5\uAE00 \uC694\uC18C \uC81C\uAC70\uB428`, code: "HIDDEN_TEXT_FILTERED" });
+  }
+  return removeIndices;
+}
 function mergeKoreanLines(text) {
   if (!text) return "";
   const lines = text.split("\n");
@@ -2642,7 +2999,7 @@ function mergeKoreanLines(text) {
       result.push(curr);
       continue;
     }
-    if (/[가-힣·,\-]$/.test(prev) && /^[가-힣(]/.test(curr) && !startsWithMarker(curr) && !isStandaloneHeader(prev)) {
+    if (/[가-힣·,\-]$/.test(prev) && /^[가-힣(]/.test(curr) && !curr.trimStart().startsWith("|") && !startsWithMarker(curr) && !isStandaloneHeader(prev)) {
       result[result.length - 1] = prev + " " + curr;
     } else {
       result.push(curr);
@@ -2665,7 +3022,9 @@ function normalizedSimilarity(a, b) {
 function normalize(s) {
   return s.replace(/\s+/g, " ").trim();
 }
+var MAX_LEVENSHTEIN_LEN = 1e4;
 function levenshtein(a, b) {
+  if (a.length + b.length > MAX_LEVENSHTEIN_LEN) return Math.abs(a.length - b.length);
   if (a.length > b.length) [a, b] = [b, a];
   const m = a.length;
   const n = b.length;
@@ -2978,7 +3337,7 @@ function parseMarkdownToBlocks(md) {
       const tableRows = [];
       while (i < lines.length && lines[i].trimStart().startsWith("|")) {
         const row = lines[i];
-        if (/^\|[\s\-:]+\|/.test(row) && !row.includes("---") === false && /^[\s|:\-]+$/.test(row)) {
+        if (/^[\s|:\-]+$/.test(row)) {
           i++;
           continue;
         }
@@ -3042,7 +3401,21 @@ function generateManifest() {
 }
 
 // src/index.ts
-async function parse(buffer, options) {
+async function parse(input, options) {
+  let buffer;
+  if (typeof input === "string") {
+    try {
+      const buf = await (0, import_promises.readFile)(input);
+      buffer = toArrayBuffer(buf);
+    } catch (err) {
+      const msg = err instanceof Error && "code" in err && err.code === "ENOENT" ? `\uD30C\uC77C\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${input}` : `\uD30C\uC77C \uC77D\uAE30 \uC2E4\uD328: ${input}`;
+      return { success: false, fileType: "unknown", error: msg, code: "PARSE_ERROR" };
+    }
+  } else if (Buffer.isBuffer(input)) {
+    buffer = toArrayBuffer(input);
+  } else {
+    buffer = input;
+  }
   if (!buffer || buffer.byteLength === 0) {
     return { success: false, fileType: "unknown", error: "\uBE48 \uBC84\uD37C\uC774\uAC70\uB098 \uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uC785\uB825\uC785\uB2C8\uB2E4.", code: "EMPTY_INPUT" };
   }
@@ -3060,16 +3433,16 @@ async function parse(buffer, options) {
 }
 async function parseHwpx(buffer, options) {
   try {
-    const { markdown, blocks, metadata, outline, warnings } = await parseHwpxDocument(buffer, options);
-    return { success: true, fileType: "hwpx", markdown, blocks, metadata, outline, warnings };
+    const { markdown, blocks, metadata, outline, warnings, images } = await parseHwpxDocument(buffer, options);
+    return { success: true, fileType: "hwpx", markdown, blocks, metadata, outline, warnings, images: images?.length ? images : void 0 };
   } catch (err) {
     return { success: false, fileType: "hwpx", error: err instanceof Error ? err.message : "HWPX \uD30C\uC2F1 \uC2E4\uD328", code: classifyError(err) };
   }
 }
 async function parseHwp(buffer, options) {
   try {
-    const { markdown, blocks, metadata, outline, warnings } = parseHwp5Document(Buffer.from(buffer), options);
-    return { success: true, fileType: "hwp", markdown, blocks, metadata, outline, warnings };
+    const { markdown, blocks, metadata, outline, warnings, images } = parseHwp5Document(Buffer.from(buffer), options);
+    return { success: true, fileType: "hwp", markdown, blocks, metadata, outline, warnings, images: images?.length ? images : void 0 };
   } catch (err) {
     return { success: false, fileType: "hwp", error: err instanceof Error ? err.message : "HWP \uD30C\uC2F1 \uC2E4\uD328", code: classifyError(err) };
   }