kordoc 1.9.0 → 2.0.0

package/dist/index.js

@@ -137,13 +137,83 @@ import JSZip2 from "jszip";
 import { inflateRawSync } from "zlib";
 import { DOMParser } from "@xmldom/xmldom";
 
-// src/table/builder.ts
+// src/utils.ts
+var VERSION = true ? "2.0.0" : "0.0.0-dev";
+function toArrayBuffer(buf) {
+  if (buf.byteOffset === 0 && buf.byteLength === buf.buffer.byteLength) {
+    return buf.buffer;
+  }
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+}
+var KordocError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "KordocError";
+  }
+};
+function isPathTraversal(name) {
+  if (name.includes("\0")) return true;
+  const normalized = name.replace(/\\/g, "/");
+  return normalized.includes("..") || normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized);
+}
+function precheckZipSize(buffer, maxUncompressedSize = 100 * 1024 * 1024, maxEntries = 500) {
+  try {
+    const data = new DataView(buffer);
+    const len = buffer.byteLength;
+    let eocdOffset = -1;
+    for (let i = len - 22; i >= Math.max(0, len - 65557); i--) {
+      if (data.getUint32(i, true) === 101010256) {
+        eocdOffset = i;
+        break;
+      }
+    }
+    if (eocdOffset < 0) return { totalUncompressed: 0, entryCount: 0 };
+    const entryCount = data.getUint16(eocdOffset + 10, true);
+    if (entryCount > maxEntries) {
+      throw new KordocError(`ZIP \uC5D4\uD2B8\uB9AC \uC218 \uCD08\uACFC: ${entryCount} (\uCD5C\uB300 ${maxEntries})`);
+    }
+    const cdSize = data.getUint32(eocdOffset + 12, true);
+    const cdOffset = data.getUint32(eocdOffset + 16, true);
+    if (cdOffset + cdSize > len) return { totalUncompressed: 0, entryCount };
+    let totalUncompressed = 0;
+    let pos = cdOffset;
+    for (let i = 0; i < entryCount && pos + 46 <= cdOffset + cdSize; i++) {
+      if (data.getUint32(pos, true) !== 33639248) break;
+      totalUncompressed += data.getUint32(pos + 24, true);
+      const nameLen = data.getUint16(pos + 28, true);
+      const extraLen = data.getUint16(pos + 30, true);
+      const commentLen = data.getUint16(pos + 32, true);
+      pos += 46 + nameLen + extraLen + commentLen;
+    }
+    if (totalUncompressed > maxUncompressedSize) {
+      throw new KordocError(`ZIP \uBE44\uC555\uCD95 \uD06C\uAE30 \uCD08\uACFC: ${(totalUncompressed / 1024 / 1024).toFixed(1)}MB (\uCD5C\uB300 ${maxUncompressedSize / 1024 / 1024}MB)`);
+    }
+    return { totalUncompressed, entryCount };
+  } catch (err) {
+    if (err instanceof KordocError) throw err;
+    return { totalUncompressed: 0, entryCount: 0 };
+  }
+}
 var SAFE_HREF_RE = /^(?:https?:|mailto:|tel:|#)/i;
 function sanitizeHref(href) {
   const trimmed = href.trim();
   if (!trimmed || !SAFE_HREF_RE.test(trimmed)) return null;
   return trimmed;
 }
+function classifyError(err) {
+  if (!(err instanceof Error)) return "PARSE_ERROR";
+  const msg = err.message;
+  if (msg.includes("\uC554\uD638\uD654")) return "ENCRYPTED";
+  if (msg.includes("DRM")) return "DRM_PROTECTED";
+  if (msg.includes("ZIP bomb") || msg.includes("ZIP \uBE44\uC555\uCD95 \uD06C\uAE30 \uCD08\uACFC") || msg.includes("ZIP \uC5D4\uD2B8\uB9AC \uC218 \uCD08\uACFC")) return "ZIP_BOMB";
+  if (msg.includes("bomb") || msg.includes("\uD06C\uAE30 \uCD08\uACFC") || msg.includes("\uC555\uCD95 \uD574\uC81C")) return "DECOMPRESSION_BOMB";
+  if (msg.includes("\uC774\uBBF8\uC9C0 \uAE30\uBC18")) return "IMAGE_BASED_PDF";
+  if (msg.includes("\uC139\uC158") && (msg.includes("\uCC3E\uC744 \uC218 \uC5C6") || msg.includes("\uC5C6\uC74C"))) return "NO_SECTIONS";
+  if (msg.includes("\uC2DC\uADF8\uB2C8\uCC98") || msg.includes("\uBCF5\uAD6C\uD560 \uC218 \uC5C6")) return "CORRUPTED";
+  return "PARSE_ERROR";
+}
+
+// src/table/builder.ts
 var MAX_COLS = 200;
 var MAX_ROWS = 1e4;
 function buildTable(rows) {
@@ -394,82 +464,6 @@ var HEADING_RATIO_H1 = 1.5;
 var HEADING_RATIO_H2 = 1.3;
 var HEADING_RATIO_H3 = 1.15;
 
-// src/utils.ts
-var VERSION = true ? "1.9.0" : "0.0.0-dev";
-function toArrayBuffer(buf) {
-  if (buf.byteOffset === 0 && buf.byteLength === buf.buffer.byteLength) {
-    return buf.buffer;
-  }
-  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
-}
-var KordocError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "KordocError";
-  }
-};
-function isPathTraversal(name) {
-  if (name.includes("\0")) return true;
-  const normalized = name.replace(/\\/g, "/");
-  return normalized.includes("..") || normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized);
-}
-function precheckZipSize(buffer, maxUncompressedSize = 100 * 1024 * 1024, maxEntries = 500) {
-  try {
-    const data = new DataView(buffer);
-    const len = buffer.byteLength;
-    let eocdOffset = -1;
-    for (let i = len - 22; i >= Math.max(0, len - 65557); i--) {
-      if (data.getUint32(i, true) === 101010256) {
-        eocdOffset = i;
-        break;
-      }
-    }
-    if (eocdOffset < 0) return { totalUncompressed: 0, entryCount: 0 };
-    const entryCount = data.getUint16(eocdOffset + 10, true);
-    if (entryCount > maxEntries) {
-      throw new KordocError(`ZIP \uC5D4\uD2B8\uB9AC \uC218 \uCD08\uACFC: ${entryCount} (\uCD5C\uB300 ${maxEntries})`);
-    }
-    const cdSize = data.getUint32(eocdOffset + 12, true);
-    const cdOffset = data.getUint32(eocdOffset + 16, true);
-    if (cdOffset + cdSize > len) return { totalUncompressed: 0, entryCount };
-    let totalUncompressed = 0;
-    let pos = cdOffset;
-    for (let i = 0; i < entryCount && pos + 46 <= cdOffset + cdSize; i++) {
-      if (data.getUint32(pos, true) !== 33639248) break;
-      totalUncompressed += data.getUint32(pos + 24, true);
-      const nameLen = data.getUint16(pos + 28, true);
-      const extraLen = data.getUint16(pos + 30, true);
-      const commentLen = data.getUint16(pos + 32, true);
-      pos += 46 + nameLen + extraLen + commentLen;
-    }
-    if (totalUncompressed > maxUncompressedSize) {
-      throw new KordocError(`ZIP \uBE44\uC555\uCD95 \uD06C\uAE30 \uCD08\uACFC: ${(totalUncompressed / 1024 / 1024).toFixed(1)}MB (\uCD5C\uB300 ${maxUncompressedSize / 1024 / 1024}MB)`);
-    }
-    return { totalUncompressed, entryCount };
-  } catch (err) {
-    if (err instanceof KordocError) throw err;
-    return { totalUncompressed: 0, entryCount: 0 };
-  }
-}
-var SAFE_HREF_RE2 = /^(?:https?:|mailto:|tel:|#)/i;
-function sanitizeHref2(href) {
-  const trimmed = href.trim();
-  if (!trimmed || !SAFE_HREF_RE2.test(trimmed)) return null;
-  return trimmed;
-}
-function classifyError(err) {
-  if (!(err instanceof Error)) return "PARSE_ERROR";
-  const msg = err.message;
-  if (msg.includes("\uC554\uD638\uD654")) return "ENCRYPTED";
-  if (msg.includes("DRM")) return "DRM_PROTECTED";
-  if (msg.includes("ZIP bomb") || msg.includes("ZIP \uBE44\uC555\uCD95 \uD06C\uAE30 \uCD08\uACFC") || msg.includes("ZIP \uC5D4\uD2B8\uB9AC \uC218 \uCD08\uACFC")) return "ZIP_BOMB";
-  if (msg.includes("bomb") || msg.includes("\uD06C\uAE30 \uCD08\uACFC") || msg.includes("\uC555\uCD95 \uD574\uC81C")) return "DECOMPRESSION_BOMB";
-  if (msg.includes("\uC774\uBBF8\uC9C0 \uAE30\uBC18")) return "IMAGE_BASED_PDF";
-  if (msg.includes("\uC139\uC158") && (msg.includes("\uCC3E\uC744 \uC218 \uC5C6") || msg.includes("\uC5C6\uC74C"))) return "NO_SECTIONS";
-  if (msg.includes("\uC2DC\uADF8\uB2C8\uCC98") || msg.includes("\uBCF5\uAD6C\uD560 \uC218 \uC5C6")) return "CORRUPTED";
-  return "PARSE_ERROR";
-}
-
 // src/hwpx/parser.ts
 init_page_range();
 var MAX_DECOMPRESS_SIZE = 100 * 1024 * 1024;
@@ -1076,7 +1070,7 @@ function extractParagraphInfo(para, styleMap) {
         case "hyperlink": {
           const url = child.getAttribute("url") || child.getAttribute("href") || "";
           if (url) {
-            const safe = sanitizeHref2(url);
+            const safe = sanitizeHref(url);
             if (safe) href = safe;
           }
           walk(child);
@@ -1169,13 +1163,16 @@ var TAG_TABLE = 77;
 var TAG_DOC_CHAR_SHAPE = 55;
 var TAG_DOC_STYLE = 58;
 var CHAR_LINE = 0;
+var CHAR_SECTION_BREAK = 10;
 var CHAR_PARA = 13;
 var CHAR_TAB = 9;
 var CHAR_HYPHEN = 30;
 var CHAR_NBSP = 31;
 var CHAR_FIXED_NBSP = 24;
+var CHAR_FIXED_WIDTH = 25;
 var FLAG_COMPRESSED = 1 << 0;
 var FLAG_ENCRYPTED = 1 << 1;
+var FLAG_DISTRIBUTION = 1 << 2;
 var FLAG_DRM = 1 << 4;
 var MAX_RECORDS = 5e5;
 function readRecords(data) {
@@ -1270,27 +1267,41 @@ function extractText(data) {
     const ch = data.readUInt16LE(i);
     i += 2;
     switch (ch) {
+      // ── char 타입 (2바이트만, 확장 데이터 없음) ──
       case CHAR_LINE:
         result += "\n";
         break;
-      case CHAR_PARA:
-        break;
-      case CHAR_TAB:
-        result += "	";
+      case CHAR_SECTION_BREAK:
+        result += "\n";
         if (i + 14 <= data.length) i += 14;
         break;
+      case CHAR_PARA:
+        break;
+      // 문단 끝
       case CHAR_HYPHEN:
         result += "-";
         break;
       case CHAR_NBSP:
+        result += " ";
+        break;
       case CHAR_FIXED_NBSP:
+        result += "\xA0";
+        break;
+      // 진짜 NBSP
+      case CHAR_FIXED_WIDTH:
         result += " ";
         break;
+      // 고정폭 공백
+      // ── inline 타입 (2바이트 + 14바이트 확장) ──
+      case CHAR_TAB:
+        result += "	";
+        if (i + 14 <= data.length) i += 14;
+        break;
       default:
         if (ch >= 1 && ch <= 31) {
-          const isExt = ch >= 1 && ch <= 3 || ch >= 10 && ch <= 18 || ch >= 21 && ch <= 23;
+          const isExtended = ch >= 1 && ch <= 3 || ch >= 11 && ch <= 12 || ch >= 14 && ch <= 18 || ch >= 21 && ch <= 23;
           const isInline = ch >= 4 && ch <= 9 || ch >= 19 && ch <= 20;
-          if ((isExt || isInline) && i + 14 <= data.length) i += 14;
+          if ((isExtended || isInline) && i + 14 <= data.length) i += 14;
         } else if (ch >= 32) {
           if (ch >= 55296 && ch <= 56319 && i + 1 < data.length) {
             const lo = data.readUInt16LE(i);
@@ -1309,6 +1320,886 @@ function extractText(data) {
   return result;
 }
 
+// src/hwp5/aes.ts
+var S_BOX = new Uint8Array([
+  99,
+  124,
+  119,
+  123,
+  242,
+  107,
+  111,
+  197,
+  48,
+  1,
+  103,
+  43,
+  254,
+  215,
+  171,
+  118,
+  202,
+  130,
+  201,
+  125,
+  250,
+  89,
+  71,
+  240,
+  173,
+  212,
+  162,
+  175,
+  156,
+  164,
+  114,
+  192,
+  183,
+  253,
+  147,
+  38,
+  54,
+  63,
+  247,
+  204,
+  52,
+  165,
+  229,
+  241,
+  113,
+  216,
+  49,
+  21,
+  4,
+  199,
+  35,
+  195,
+  24,
+  150,
+  5,
+  154,
+  7,
+  18,
+  128,
+  226,
+  235,
+  39,
+  178,
+  117,
+  9,
+  131,
+  44,
+  26,
+  27,
+  110,
+  90,
+  160,
+  82,
+  59,
+  214,
+  179,
+  41,
+  227,
+  47,
+  132,
+  83,
+  209,
+  0,
+  237,
+  32,
+  252,
+  177,
+  91,
+  106,
+  203,
+  190,
+  57,
+  74,
+  76,
+  88,
+  207,
+  208,
+  239,
+  170,
+  251,
+  67,
+  77,
+  51,
+  133,
+  69,
+  249,
+  2,
+  127,
+  80,
+  60,
+  159,
+  168,
+  81,
+  163,
+  64,
+  143,
+  146,
+  157,
+  56,
+  245,
+  188,
+  182,
+  218,
+  33,
+  16,
+  255,
+  243,
+  210,
+  205,
+  12,
+  19,
+  236,
+  95,
+  151,
+  68,
+  23,
+  196,
+  167,
+  126,
+  61,
+  100,
+  93,
+  25,
+  115,
+  96,
+  129,
+  79,
+  220,
+  34,
+  42,
+  144,
+  136,
+  70,
+  238,
+  184,
+  20,
+  222,
+  94,
+  11,
+  219,
+  224,
+  50,
+  58,
+  10,
+  73,
+  6,
+  36,
+  92,
+  194,
+  211,
+  172,
+  98,
+  145,
+  149,
+  228,
+  121,
+  231,
+  200,
+  55,
+  109,
+  141,
+  213,
+  78,
+  169,
+  108,
+  86,
+  244,
+  234,
+  101,
+  122,
+  174,
+  8,
+  186,
+  120,
+  37,
+  46,
+  28,
+  166,
+  180,
+  198,
+  232,
+  221,
+  116,
+  31,
+  75,
+  189,
+  139,
+  138,
+  112,
+  62,
+  181,
+  102,
+  72,
+  3,
+  246,
+  14,
+  97,
+  53,
+  87,
+  185,
+  134,
+  193,
+  29,
+  158,
+  225,
+  248,
+  152,
+  17,
+  105,
+  217,
+  142,
+  148,
+  155,
+  30,
+  135,
+  233,
+  206,
+  85,
+  40,
+  223,
+  140,
+  161,
+  137,
+  13,
+  191,
+  230,
+  66,
+  104,
+  65,
+  153,
+  45,
+  15,
+  176,
+  84,
+  187,
+  22
+]);
+var INV_S_BOX = new Uint8Array([
+  82,
+  9,
+  106,
+  213,
+  48,
+  54,
+  165,
+  56,
+  191,
+  64,
+  163,
+  158,
+  129,
+  243,
+  215,
+  251,
+  124,
+  227,
+  57,
+  130,
+  155,
+  47,
+  255,
+  135,
+  52,
+  142,
+  67,
+  68,
+  196,
+  222,
+  233,
+  203,
+  84,
+  123,
+  148,
+  50,
+  166,
+  194,
+  35,
+  61,
+  238,
+  76,
+  149,
+  11,
+  66,
+  250,
+  195,
+  78,
+  8,
+  46,
+  161,
+  102,
+  40,
+  217,
+  36,
+  178,
+  118,
+  91,
+  162,
+  73,
+  109,
+  139,
+  209,
+  37,
+  114,
+  248,
+  246,
+  100,
+  134,
+  104,
+  152,
+  22,
+  212,
+  164,
+  92,
+  204,
+  93,
+  101,
+  182,
+  146,
+  108,
+  112,
+  72,
+  80,
+  253,
+  237,
+  185,
+  218,
+  94,
+  21,
+  70,
+  87,
+  167,
+  141,
+  157,
+  132,
+  144,
+  216,
+  171,
+  0,
+  140,
+  188,
+  211,
+  10,
+  247,
+  228,
+  88,
+  5,
+  184,
+  179,
+  69,
+  6,
+  208,
+  44,
+  30,
+  143,
+  202,
+  63,
+  15,
+  2,
+  193,
+  175,
+  189,
+  3,
+  1,
+  19,
+  138,
+  107,
+  58,
+  145,
+  17,
+  65,
+  79,
+  103,
+  220,
+  234,
+  151,
+  242,
+  207,
+  206,
+  240,
+  180,
+  230,
+  115,
+  150,
+  172,
+  116,
+  34,
+  231,
+  173,
+  53,
+  133,
+  226,
+  249,
+  55,
+  232,
+  28,
+  117,
+  223,
+  110,
+  71,
+  241,
+  26,
+  113,
+  29,
+  41,
+  197,
+  137,
+  111,
+  183,
+  98,
+  14,
+  170,
+  24,
+  190,
+  27,
+  252,
+  86,
+  62,
+  75,
+  198,
+  210,
+  121,
+  32,
+  154,
+  219,
+  192,
+  254,
+  120,
+  205,
+  90,
+  244,
+  31,
+  221,
+  168,
+  51,
+  136,
+  7,
+  199,
+  49,
+  177,
+  18,
+  16,
+  89,
+  39,
+  128,
+  236,
+  95,
+  96,
+  81,
+  127,
+  169,
+  25,
+  181,
+  74,
+  13,
+  45,
+  229,
+  122,
+  159,
+  147,
+  201,
+  156,
+  239,
+  160,
+  224,
+  59,
+  77,
+  174,
+  42,
+  245,
+  176,
+  200,
+  235,
+  187,
+  60,
+  131,
+  83,
+  153,
+  97,
+  23,
+  43,
+  4,
+  126,
+  186,
+  119,
+  214,
+  38,
+  225,
+  105,
+  20,
+  99,
+  85,
+  33,
+  12,
+  125
+]);
+var RCON = new Uint8Array([1, 2, 4, 8, 16, 32, 64, 128, 27, 54]);
+function gmul(a, b) {
+  let p = 0;
+  for (let i = 0; i < 8; i++) {
+    if (b & 1) p ^= a;
+    const hi = a & 128;
+    a = a << 1 & 255;
+    if (hi) a ^= 27;
+    b >>= 1;
+  }
+  return p;
+}
+function expandKey(key) {
+  const w = new Uint32Array(44);
+  for (let i = 0; i < 4; i++) {
+    w[i] = key[4 * i] << 24 | key[4 * i + 1] << 16 | key[4 * i + 2] << 8 | key[4 * i + 3];
+  }
+  for (let i = 4; i < 44; i++) {
+    let temp = w[i - 1];
+    if (i % 4 === 0) {
+      temp = (temp << 8 | temp >>> 24) >>> 0;
+      temp = S_BOX[temp >>> 24 & 255] << 24 | S_BOX[temp >>> 16 & 255] << 16 | S_BOX[temp >>> 8 & 255] << 8 | S_BOX[temp & 255];
+      temp = (temp ^ RCON[i / 4 - 1] << 24) >>> 0;
+    }
+    w[i] = (w[i - 4] ^ temp) >>> 0;
+  }
+  return w;
+}
+function decryptBlock(block, roundKeys) {
+  const s = new Uint8Array(16);
+  for (let i = 0; i < 16; i++) s[i] = block[i];
+  addRoundKey(s, roundKeys, 10);
+  for (let round = 9; round >= 1; round--) {
+    invShiftRows(s);
+    invSubBytes(s);
+    addRoundKey(s, roundKeys, round);
+    invMixColumns(s);
+  }
+  invShiftRows(s);
+  invSubBytes(s);
+  addRoundKey(s, roundKeys, 0);
+  return s;
+}
+function addRoundKey(s, w, round) {
+  const base = round * 4;
+  for (let c = 0; c < 4; c++) {
+    const k = w[base + c];
+    s[c * 4] ^= k >>> 24 & 255;
+    s[c * 4 + 1] ^= k >>> 16 & 255;
+    s[c * 4 + 2] ^= k >>> 8 & 255;
+    s[c * 4 + 3] ^= k & 255;
+  }
+}
+function invSubBytes(s) {
+  for (let i = 0; i < 16; i++) s[i] = INV_S_BOX[s[i]];
+}
+function invShiftRows(s) {
+  let t = s[13];
+  s[13] = s[9];
+  s[9] = s[5];
+  s[5] = s[1];
+  s[1] = t;
+  t = s[2];
+  s[2] = s[10];
+  s[10] = t;
+  t = s[6];
+  s[6] = s[14];
+  s[14] = t;
+  t = s[3];
+  s[3] = s[7];
+  s[7] = s[11];
+  s[11] = s[15];
+  s[15] = t;
+}
+function invMixColumns(s) {
+  for (let c = 0; c < 4; c++) {
+    const i = c * 4;
+    const a0 = s[i], a1 = s[i + 1], a2 = s[i + 2], a3 = s[i + 3];
+    s[i] = gmul(a0, 14) ^ gmul(a1, 11) ^ gmul(a2, 13) ^ gmul(a3, 9);
+    s[i + 1] = gmul(a0, 9) ^ gmul(a1, 14) ^ gmul(a2, 11) ^ gmul(a3, 13);
+    s[i + 2] = gmul(a0, 13) ^ gmul(a1, 9) ^ gmul(a2, 14) ^ gmul(a3, 11);
+    s[i + 3] = gmul(a0, 11) ^ gmul(a1, 13) ^ gmul(a2, 9) ^ gmul(a3, 14);
+  }
+}
+function aes128EcbDecrypt(data, key) {
+  if (key.length !== 16) throw new Error("AES-128 \uD0A4\uB294 16\uBC14\uC774\uD2B8\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  if (data.length % 16 !== 0) throw new Error("AES ECB \uC785\uB825\uC740 16\uBC14\uC774\uD2B8\uC758 \uBC30\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  const roundKeys = expandKey(key);
+  const out = new Uint8Array(data.length);
+  for (let offset = 0; offset < data.length; offset += 16) {
+    const block = data.subarray(offset, offset + 16);
+    const decrypted = decryptBlock(block, roundKeys);
+    out.set(decrypted, offset);
+  }
+  return out;
+}
+
+// src/hwp5/crypto.ts
+var MsvcLcg = class {
+  seed;
+  constructor(seed) {
+    this.seed = seed >>> 0;
+  }
+  /** 0 ~ 0x7FFF 범위 난수 반환 (MSVC rand() 호환) */
+  rand() {
+    this.seed = Math.imul(this.seed, 214013) + 2531011 >>> 0;
+    return this.seed >>> 16 & 32767;
+  }
+};
+function decryptDistributePayload(payload) {
+  if (payload.length < 256) throw new Error("\uBC30\uD3EC\uC6A9 payload\uAC00 256\uBC14\uC774\uD2B8 \uBBF8\uB9CC\uC785\uB2C8\uB2E4");
+  const seed = (payload[0] | payload[1] << 8 | payload[2] << 16 | payload[3] << 24) >>> 0;
+  const lcg = new MsvcLcg(seed);
+  const result = new Uint8Array(256);
+  result[0] = payload[0];
+  result[1] = payload[1];
+  result[2] = payload[2];
+  result[3] = payload[3];
+  let i = 4;
+  while (i < 256) {
+    const keyByte = lcg.rand() & 255;
+    const n = (lcg.rand() & 15) + 1;
+    for (let j = 0; j < n && i < 256; j++, i++) {
+      result[i] = payload[i] ^ keyByte;
+    }
+  }
+  return result;
+}
+function extractAesKey(decryptedPayload) {
+  const offset = 4 + (decryptedPayload[0] & 15);
+  if (offset + 16 > decryptedPayload.length) {
+    throw new Error("AES \uD0A4 \uCD94\uCD9C \uC2E4\uD328: \uC624\uD504\uC14B\uC774 payload \uBC94\uC704\uB97C \uCD08\uACFC\uD569\uB2C8\uB2E4");
+  }
+  return decryptedPayload.slice(offset, offset + 16);
+}
+function parseRecordHeader(data, offset) {
+  if (offset + 4 > data.length) throw new Error("\uB808\uCF54\uB4DC \uD5E4\uB354 \uD30C\uC2F1 \uC2E4\uD328: \uB370\uC774\uD130 \uBD80\uC871");
+  const header = (data[offset] | data[offset + 1] << 8 | data[offset + 2] << 16 | data[offset + 3] << 24) >>> 0;
+  const tagId = header & 1023;
+  let size = header >>> 20 & 4095;
+  let headerSize = 4;
+  if (size === 4095) {
+    if (offset + 8 > data.length) throw new Error("\uD655\uC7A5 \uB808\uCF54\uB4DC \uD06C\uAE30 \uD30C\uC2F1 \uC2E4\uD328: \uB370\uC774\uD130 \uBD80\uC871");
+    size = (data[offset + 4] | data[offset + 5] << 8 | data[offset + 6] << 16 | data[offset + 7] << 24) >>> 0;
+    headerSize = 8;
+  }
+  return { tagId, size, headerSize };
+}
+var TAG_DISTRIBUTE_DOC_DATA = 16 + 28;
+function decryptViewText(viewTextRaw, compressed) {
+  const data = new Uint8Array(viewTextRaw);
+  const rec = parseRecordHeader(data, 0);
+  if (rec.tagId !== TAG_DISTRIBUTE_DOC_DATA) {
+    throw new Error(`\uBC30\uD3EC\uC6A9 \uBB38\uC11C\uC758 \uCCAB \uB808\uCF54\uB4DC\uAC00 DISTRIBUTE_DOC_DATA(${TAG_DISTRIBUTE_DOC_DATA})\uAC00 \uC544\uB2D9\uB2C8\uB2E4 (\uC2E4\uC81C: ${rec.tagId})`);
+  }
+  const payloadStart = rec.headerSize;
+  const payloadEnd = payloadStart + rec.size;
+  if (payloadEnd > data.length || rec.size < 256) {
+    throw new Error("\uBC30\uD3EC\uC6A9 payload\uAC00 \uC720\uD6A8\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4");
+  }
+  const payload = data.subarray(payloadStart, payloadStart + 256);
+  const decryptedPayload = decryptDistributePayload(payload);
+  const aesKey = extractAesKey(decryptedPayload);
+  const encryptedStart = payloadEnd;
+  const encryptedData = data.subarray(encryptedStart);
+  if (encryptedData.length === 0) {
+    throw new Error("\uBC30\uD3EC\uC6A9 \uBB38\uC11C\uC5D0 \uC554\uD638\uD654\uB41C \uBCF8\uBB38 \uB370\uC774\uD130\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4");
+  }
+  const alignedLen = encryptedData.length - encryptedData.length % 16;
+  if (alignedLen === 0) {
+    throw new Error("\uC554\uD638\uD654\uB41C \uB370\uC774\uD130\uAC00 \uB108\uBB34 \uC9E7\uC2B5\uB2C8\uB2E4 (16\uBC14\uC774\uD2B8 \uBBF8\uB9CC)");
+  }
+  const alignedData = encryptedData.subarray(0, alignedLen);
+  const decrypted = aes128EcbDecrypt(alignedData, aesKey);
+  if (compressed) {
+    try {
+      return decompressStream(Buffer.from(decrypted));
+    } catch {
+      return Buffer.from(decrypted);
+    }
+  }
+  return Buffer.from(decrypted);
+}
+
+// src/hwp5/cfb-lenient.ts
+var CFB_MAGIC = Buffer.from([208, 207, 17, 224, 161, 177, 26, 225]);
+var END_OF_CHAIN = 4294967294;
+var FREE_SECT = 4294967295;
+var MAX_CHAIN_LENGTH = 1e6;
+var MAX_DIR_ENTRIES = 1e5;
+var MAX_STREAM_SIZE = 100 * 1024 * 1024;
+function parseLenientCfb(data) {
+  if (data.length < 512) throw new Error("CFB \uD30C\uC77C\uC774 \uB108\uBB34 \uC9E7\uC2B5\uB2C8\uB2E4 (\uCD5C\uC18C 512\uBC14\uC774\uD2B8)");
+  if (!data.subarray(0, 8).equals(CFB_MAGIC)) throw new Error("CFB \uB9E4\uC9C1 \uBC14\uC774\uD2B8 \uBD88\uC77C\uCE58");
+  const sectorSizeShift = data.readUInt16LE(30);
+  if (sectorSizeShift < 7 || sectorSizeShift > 16) throw new Error("\uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uC139\uD130 \uD06C\uAE30 \uC2DC\uD504\uD2B8: " + sectorSizeShift);
+  const sectorSize = 1 << sectorSizeShift;
+  const miniSectorSizeShift = data.readUInt16LE(32);
+  if (miniSectorSizeShift > 16) throw new Error("\uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uBBF8\uB2C8 \uC139\uD130 \uD06C\uAE30 \uC2DC\uD504\uD2B8: " + miniSectorSizeShift);
+  const miniSectorSize = 1 << miniSectorSizeShift;
+  const fatSectorCount = data.readUInt32LE(44);
+  const firstDirSector = data.readUInt32LE(48);
+  const miniStreamCutoff = data.readUInt32LE(56);
+  const firstMiniFatSector = data.readUInt32LE(60);
+  const miniFatSectorCount = data.readUInt32LE(64);
+  const firstDifatSector = data.readUInt32LE(68);
+  const difatSectorCount = data.readUInt32LE(72);
+  function sectorOffset(id) {
+    return 512 + id * sectorSize;
+  }
+  function readSectorData(id) {
+    const off = sectorOffset(id);
+    if (off + sectorSize > data.length) return Buffer.alloc(0);
+    return data.subarray(off, off + sectorSize);
+  }
+  const fatSectors = [];
+  for (let i = 0; i < 109 && fatSectors.length < fatSectorCount; i++) {
+    const sid = data.readUInt32LE(76 + i * 4);
+    if (sid === FREE_SECT || sid === END_OF_CHAIN) break;
+    fatSectors.push(sid);
+  }
+  let difatSector = firstDifatSector;
+  const visitedDifat = /* @__PURE__ */ new Set();
+  for (let d = 0; d < difatSectorCount && difatSector !== END_OF_CHAIN && difatSector !== FREE_SECT; d++) {
+    if (visitedDifat.has(difatSector)) break;
+    visitedDifat.add(difatSector);
+    const buf = readSectorData(difatSector);
+    const entriesPerSector = sectorSize / 4 - 1;
+    for (let i = 0; i < entriesPerSector && fatSectors.length < fatSectorCount; i++) {
+      const sid = buf.readUInt32LE(i * 4);
+      if (sid === FREE_SECT || sid === END_OF_CHAIN) continue;
+      fatSectors.push(sid);
+    }
+    difatSector = buf.readUInt32LE(entriesPerSector * 4);
+  }
+  const entriesPerFatSector = sectorSize / 4;
+  const fatTable = new Uint32Array(fatSectors.length * entriesPerFatSector);
+  for (let fi = 0; fi < fatSectors.length; fi++) {
+    const buf = readSectorData(fatSectors[fi]);
+    for (let i = 0; i < entriesPerFatSector; i++) {
+      fatTable[fi * entriesPerFatSector + i] = i * 4 + 3 < buf.length ? buf.readUInt32LE(i * 4) : FREE_SECT;
+    }
+  }
+  function readChain(startSector, maxBytes) {
+    if (startSector === END_OF_CHAIN || startSector === FREE_SECT) return Buffer.alloc(0);
+    if (maxBytes > MAX_STREAM_SIZE) throw new Error("\uC2A4\uD2B8\uB9BC\uC774 \uB108\uBB34 \uD07D\uB2C8\uB2E4");
+    const chunks = [];
+    let current = startSector;
+    let totalRead = 0;
+    const visited = /* @__PURE__ */ new Set();
+    while (current !== END_OF_CHAIN && current !== FREE_SECT && totalRead < maxBytes) {
+      if (visited.has(current)) break;
+      if (visited.size > MAX_CHAIN_LENGTH) break;
+      visited.add(current);
+      const buf = readSectorData(current);
+      const remaining = maxBytes - totalRead;
+      chunks.push(remaining < sectorSize ? buf.subarray(0, remaining) : buf);
+      totalRead += Math.min(buf.length, remaining);
+      current = current < fatTable.length ? fatTable[current] : END_OF_CHAIN;
+    }
+    return Buffer.concat(chunks);
+  }
+  let miniFatTable = null;
+  function getMiniFatTable() {
+    if (miniFatTable) return miniFatTable;
+    if (miniFatSectorCount === 0 || firstMiniFatSector === END_OF_CHAIN) {
+      miniFatTable = new Uint32Array(0);
+      return miniFatTable;
+    }
+    const miniFatData = readChain(firstMiniFatSector, miniFatSectorCount * sectorSize);
+    const entries = miniFatData.length / 4;
+    miniFatTable = new Uint32Array(entries);
+    for (let i = 0; i < entries; i++) {
+      miniFatTable[i] = miniFatData.readUInt32LE(i * 4);
+    }
+    return miniFatTable;
+  }
+  const dirData = readChain(firstDirSector, MAX_DIR_ENTRIES * 128);
+  const dirEntries = [];
+  for (let offset = 0; offset + 128 <= dirData.length && dirEntries.length < MAX_DIR_ENTRIES; offset += 128) {
+    const nameLen = dirData.readUInt16LE(offset + 64);
+    if (nameLen <= 0 || nameLen > 64) {
+      dirEntries.push({ name: "", type: 0, startSector: 0, size: 0 });
+      continue;
+    }
+    const nameBytes = nameLen - 2;
+    const name = nameBytes > 0 ? dirData.subarray(offset, offset + nameBytes).toString("utf16le") : "";
+    const type = dirData[offset + 66];
+    const startSector = dirData.readUInt32LE(offset + 116);
+    const size = dirData.readUInt32LE(offset + 120);
+    dirEntries.push({ name, type, startSector, size });
+  }
+  let miniStreamData = null;
+  function getMiniStream() {
+    if (miniStreamData) return miniStreamData;
+    const root = dirEntries[0];
+    if (!root || root.type !== 5) {
+      miniStreamData = Buffer.alloc(0);
+      return miniStreamData;
+    }
+    miniStreamData = readChain(root.startSector, root.size || MAX_STREAM_SIZE);
+    return miniStreamData;
+  }
+  function readMiniStream(startSector, size) {
+    const mft = getMiniFatTable();
+    const ms = getMiniStream();
+    if (mft.length === 0 || ms.length === 0) return Buffer.alloc(0);
+    const chunks = [];
+    let current = startSector;
+    let totalRead = 0;
+    const visited = /* @__PURE__ */ new Set();
+    while (current !== END_OF_CHAIN && current !== FREE_SECT && totalRead < size) {
+      if (visited.has(current)) break;
+      if (visited.size > MAX_CHAIN_LENGTH) break;
+      visited.add(current);
+      const off = current * miniSectorSize;
+      const remaining = size - totalRead;
+      const chunkSize = Math.min(miniSectorSize, remaining);
+      if (off + chunkSize <= ms.length) {
+        chunks.push(ms.subarray(off, off + chunkSize));
+      }
+      totalRead += chunkSize;
+      current = current < mft.length ? mft[current] : END_OF_CHAIN;
+    }
+    return Buffer.concat(chunks);
+  }
+  function readStreamData(entry) {
+    if (entry.size === 0) return Buffer.alloc(0);
+    if (entry.size < miniStreamCutoff) {
+      const miniResult = readMiniStream(entry.startSector, entry.size);
+      if (miniResult.length > 0) return miniResult;
+    }
+    return readChain(entry.startSector, entry.size);
+  }
+  function findEntryByPath(path) {
+    const parts = path.replace(/^\//, "").split("/");
+    if (parts.length === 1) {
+      return dirEntries.find((e) => e.name === parts[0] && e.type === 2) ?? null;
+    }
+    const storageName = parts[0];
+    const streamName = parts.slice(1).join("/");
+    for (const e of dirEntries) {
+      if (e.type === 2 && e.name === streamName) {
+        return e;
+      }
+    }
+    const lastPart = parts[parts.length - 1];
+    return dirEntries.find((e) => e.type === 2 && e.name === lastPart) ?? null;
+  }
+  return {
+    findStream(path) {
+      const normalized = path.replace(/^\//, "");
+      const entry = findEntryByPath(normalized);
+      if (!entry || entry.type !== 2) return null;
+      const stream = readStreamData(entry);
+      return stream.length > 0 ? stream : null;
+    },
+    entries() {
+      return dirEntries.filter((e) => e.type === 2);
+    }
+  };
+}
+
 // src/hwp5/parser.ts
 init_page_range();
 import { createRequire } from "module";
@@ -1317,21 +2208,40 @@ var CFB = require2("cfb");
 var MAX_SECTIONS = 100;
 var MAX_TOTAL_DECOMPRESS = 100 * 1024 * 1024;
 function parseHwp5Document(buffer, options) {
-  const cfb = CFB.parse(buffer);
-  const headerEntry = CFB.find(cfb, "/FileHeader");
-  if (!headerEntry?.content) throw new KordocError("FileHeader \uC2A4\uD2B8\uB9BC \uC5C6\uC74C");
-  const header = parseFileHeader(Buffer.from(headerEntry.content));
+  let cfb = null;
+  let lenientCfb = null;
+  const warnings = [];
+  try {
+    cfb = CFB.parse(buffer);
+  } catch {
+    try {
+      lenientCfb = parseLenientCfb(buffer);
+      warnings.push({ message: "\uC190\uC0C1\uB41C CFB \uCEE8\uD14C\uC774\uB108 \u2014 lenient \uBAA8\uB4DC\uB85C \uBCF5\uAD6C", code: "LENIENT_CFB_RECOVERY" });
+    } catch {
+      throw new KordocError("CFB \uCEE8\uD14C\uC774\uB108 \uD30C\uC2F1 \uC2E4\uD328 (strict \uBC0F lenient \uBAA8\uB450)");
+    }
+  }
+  const findStream = (path) => {
+    if (cfb) {
+      const entry = CFB.find(cfb, path);
+      return entry?.content ? Buffer.from(entry.content) : null;
+    }
+    return lenientCfb.findStream(path);
+  };
+  const headerData = findStream("/FileHeader");
+  if (!headerData) throw new KordocError("FileHeader \uC2A4\uD2B8\uB9BC \uC5C6\uC74C");
+  const header = parseFileHeader(headerData);
   if (header.signature !== "HWP Document File") throw new KordocError("HWP \uC2DC\uADF8\uB2C8\uCC98 \uBD88\uC77C\uCE58");
   if (header.flags & FLAG_ENCRYPTED) throw new KordocError("\uC554\uD638\uD654\uB41C HWP\uB294 \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4");
   if (header.flags & FLAG_DRM) throw new KordocError("DRM \uBCF4\uD638\uB41C HWP\uB294 \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4");
   const compressed = (header.flags & FLAG_COMPRESSED) !== 0;
+  const distribution = (header.flags & FLAG_DISTRIBUTION) !== 0;
   const metadata = {
     version: `${header.versionMajor}.x`
   };
-  extractHwp5Metadata(cfb, metadata);
-  const docInfo = parseDocInfoStream(cfb, compressed);
-  const warnings = [];
-  const sections = findSections(cfb);
+  if (cfb) extractHwp5Metadata(cfb, metadata);
+  const docInfo = cfb ? parseDocInfoStream(cfb, compressed) : parseDocInfoFromStream(findStream("/DocInfo"), compressed);
+  const sections = distribution ? cfb ? findViewTextSections(cfb, compressed) : findViewTextSectionsLenient(lenientCfb, compressed) : cfb ? findSections(cfb) : findSectionsLenient(lenientCfb, compressed);
   if (sections.length === 0) throw new KordocError("\uC139\uC158 \uC2A4\uD2B8\uB9BC\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4");
   metadata.pageCount = sections.length;
   const pageFilter = options?.pages ? parsePageRange(options.pages, sections.length) : null;
@@ -1343,7 +2253,7 @@ function parseHwp5Document(buffer, options) {
     if (pageFilter && !pageFilter.has(si + 1)) continue;
     try {
       const sectionData = sections[si];
-      const data = compressed ? decompressStream(Buffer.from(sectionData)) : Buffer.from(sectionData);
+      const data = !distribution && compressed ? decompressStream(Buffer.from(sectionData)) : Buffer.from(sectionData);
       totalDecompressed += data.length;
       if (totalDecompressed > MAX_TOTAL_DECOMPRESS) throw new KordocError("\uCD1D \uC555\uCD95 \uD574\uC81C \uD06C\uAE30 \uCD08\uACFC (decompression bomb \uC758\uC2EC)");
       const records = readRecords(data);
@@ -1356,7 +2266,7 @@ function parseHwp5Document(buffer, options) {
       warnings.push({ page: si + 1, message: `\uC139\uC158 ${si + 1} \uD30C\uC2F1 \uC2E4\uD328: ${secErr instanceof Error ? secErr.message : "\uC54C \uC218 \uC5C6\uB294 \uC624\uB958"}`, code: "PARTIAL_PARSE" });
     }
   }
-  const images = extractHwp5Images(cfb, blocks, compressed, warnings);
+  const images = cfb ? extractHwp5Images(cfb, blocks, compressed, warnings) : extractHwp5ImagesLenient(lenientCfb, blocks, compressed, warnings);
   if (docInfo) {
     detectHwp5Headings(blocks, docInfo);
   }
@@ -1375,6 +2285,15 @@ function parseDocInfoStream(cfb, compressed) {
     return null;
   }
 }
+function parseDocInfoFromStream(raw, compressed) {
+  if (!raw) return null;
+  try {
+    const data = compressed ? decompressStream(raw) : raw;
+    return parseDocInfo(readRecords(data));
+  } catch {
+    return null;
+  }
+}
 function detectHwp5Headings(blocks, docInfo) {
   let baseFontSize = 0;
   for (const style of docInfo.styles) {
@@ -1454,6 +2373,20 @@ function extractHwp5Metadata(cfb, metadata) {
   } catch {
   }
 }
+function findViewTextSections(cfb, compressed) {
+  const sections = [];
+  for (let i = 0; i < MAX_SECTIONS; i++) {
+    const entry = CFB.find(cfb, `/ViewText/Section${i}`);
+    if (!entry?.content) break;
+    try {
+      const decrypted = decryptViewText(Buffer.from(entry.content), compressed);
+      sections.push({ idx: i, content: decrypted });
+    } catch {
+      break;
+    }
+  }
+  return sections.sort((a, b) => a.idx - b.idx).map((s) => s.content);
+}
 function findSections(cfb) {
   const sections = [];
   for (let i = 0; i < MAX_SECTIONS; i++) {
@@ -1472,6 +2405,38 @@ function findSections(cfb) {
   }
   return sections.sort((a, b) => a.idx - b.idx).map((s) => s.content);
 }
+function findSectionsLenient(lcfb, compressed) {
+  const sections = [];
+  for (let i = 0; i < MAX_SECTIONS; i++) {
+    const raw = lcfb.findStream(`/BodyText/Section${i}`) ?? lcfb.findStream(`Section${i}`);
+    if (!raw) break;
+    sections.push({ idx: i, content: compressed ? decompressStream(raw) : raw });
+  }
+  if (sections.length === 0) {
+    for (const e of lcfb.entries()) {
+      if (sections.length >= MAX_SECTIONS) break;
+      if (e.name.startsWith("Section")) {
+        const idx = parseInt(e.name.replace("Section", ""), 10) || 0;
+        const raw = lcfb.findStream(e.name);
+        if (raw) sections.push({ idx, content: compressed ? decompressStream(raw) : raw });
+      }
+    }
+  }
+  return sections.sort((a, b) => a.idx - b.idx).map((s) => s.content);
+}
+function findViewTextSectionsLenient(lcfb, compressed) {
+  const sections = [];
+  for (let i = 0; i < MAX_SECTIONS; i++) {
+    const raw = lcfb.findStream(`/ViewText/Section${i}`) ?? lcfb.findStream(`Section${i}`);
+    if (!raw) break;
+    try {
+      sections.push({ idx: i, content: decryptViewText(raw, compressed) });
+    } catch {
+      break;
+    }
+  }
+  return sections.sort((a, b) => a.idx - b.idx).map((s) => s.content);
+}
 var TAG_SHAPE_COMPONENT = 74;
 function extractBinDataId(records, ctrlIdx) {
   const ctrlLevel = records[ctrlIdx].level;
@@ -1546,6 +2511,53 @@ function extractHwp5Images(cfb, blocks, compressed, warnings) {
   }
   return images;
 }
+function extractHwp5ImagesLenient(lcfb, blocks, compressed, warnings) {
+  const binDataMap = /* @__PURE__ */ new Map();
+  const binRe = /^BIN(\d{4})/i;
+  for (const e of lcfb.entries()) {
+    const match = e.name.match(binRe);
+    if (!match) continue;
+    const idx = parseInt(match[1], 10);
+    let raw = lcfb.findStream(e.name);
+    if (!raw) continue;
+    if (compressed) {
+      try {
+        raw = decompressStream(raw);
+      } catch {
+      }
+    }
+    binDataMap.set(idx, { data: raw, name: e.name });
+  }
+  if (binDataMap.size === 0) return [];
+  const images = [];
+  let imageIndex = 0;
+  for (const block of blocks) {
+    if (block.type !== "image" || !block.text) continue;
+    const binId = parseInt(block.text, 10);
+    if (isNaN(binId)) continue;
+    const bin = binDataMap.get(binId);
+    if (!bin) {
+      warnings.push({ page: block.pageNumber, message: `BinData ${binId} \uFFFD\uFFFD\uFFFD\uC74C`, code: "SKIPPED_IMAGE" });
+      block.type = "paragraph";
+      block.text = `[\uC774\uBBF8\uC9C0: BinData ${binId}]`;
+      continue;
+    }
+    const mime = detectImageMime(bin.data);
+    if (!mime) {
+      warnings.push({ page: block.pageNumber, message: `BinData ${binId}: \uC54C \uC218 \uC5C6\uB294 \uC774\uBBF8\uC9C0 \uD615\uC2DD`, code: "SKIPPED_IMAGE" });
+      block.type = "paragraph";
+      block.text = `[\uC774\uBBF8\uC9C0: ${bin.name}]`;
+      continue;
+    }
+    imageIndex++;
+    const ext = mime.includes("jpeg") ? "jpg" : mime.includes("png") ? "png" : mime.includes("gif") ? "gif" : mime.includes("bmp") ? "bmp" : "bin";
+    const filename = `image_${String(imageIndex).padStart(3, "0")}.${ext}`;
+    images.push({ filename, data: new Uint8Array(bin.data), mimeType: mime });
+    block.text = filename;
+    block.imageData = { data: new Uint8Array(bin.data), mimeType: mime, filename: bin.name };
+  }
+  return images;
+}
 function parseSection(records, docInfo, warnings, sectionNum) {
   const blocks = [];
   let i = 0;
@@ -1582,12 +2594,61 @@ function parseSection(records, docInfo, warnings, sectionNum) {
         }
       } else if (ctrlId === " elo" || ctrlId === "ole ") {
         warnings.push({ page: sectionNum, message: `\uC2A4\uD0B5\uB41C \uC81C\uC5B4 \uC694\uC18C: ${ctrlId.trim()}`, code: "SKIPPED_IMAGE" });
+      } else if (ctrlId === "fn  " || ctrlId === " nf " || ctrlId === "en  " || ctrlId === " ne ") {
+        const noteText = extractNoteText(records, i);
+        if (noteText && blocks.length > 0) {
+          const lastBlock = blocks[blocks.length - 1];
+          if (lastBlock.type === "paragraph") {
+            lastBlock.footnoteText = lastBlock.footnoteText ? lastBlock.footnoteText + "; " + noteText : noteText;
+          }
+        }
+      } else if (ctrlId === "%tok" || ctrlId === "klnk") {
+        const url = extractHyperlinkUrl(rec.data);
+        if (url && blocks.length > 0) {
+          const lastBlock = blocks[blocks.length - 1];
+          if (lastBlock.type === "paragraph" && !lastBlock.href) {
+            lastBlock.href = sanitizeHref(url) ?? void 0;
+          }
+        }
       }
     }
     i++;
   }
   return blocks;
 }
+function extractNoteText(records, ctrlIdx) {
+  const ctrlLevel = records[ctrlIdx].level;
+  const texts = [];
+  for (let j = ctrlIdx + 1; j < records.length && j < ctrlIdx + 100; j++) {
+    const r = records[j];
+    if (r.level <= ctrlLevel) break;
+    if (r.tagId === TAG_PARA_TEXT) {
+      const t = extractText(r.data).trim();
+      if (t) texts.push(t);
+    }
+  }
+  return texts.length > 0 ? texts.join(" ") : null;
+}
+function extractHyperlinkUrl(data) {
+  try {
+    const httpSig = Buffer.from("http", "utf16le");
+    const idx = data.indexOf(httpSig);
+    if (idx >= 0) {
+      let end = idx;
+      while (end + 1 < data.length) {
+        const ch = data.readUInt16LE(end);
+        if (ch === 0) break;
+        end += 2;
+      }
+      const url = data.subarray(idx, end).toString("utf16le");
+      if (/^https?:\/\/.+/.test(url) && url.length < 2e3) {
+        return url;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 function resolveCharStyle(charShapeIds, docInfo) {
   if (charShapeIds.length === 0 || docInfo.charShapes.length === 0) return void 0;
   const freq = /* @__PURE__ */ new Map();