kordoc 4.3.1 → 4.4.0

package/dist/{chunk-RO4Y4BFI.js → chunk-YOZ7ZRCD.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   inlineImagesIntoMarkdown
-} from "./chunk-W34QSJFF.js";
+} from "./chunk-7FCNOKOR.js";
 import {
   HEADING_RATIO_H1,
   HEADING_RATIO_H2,
   HEADING_RATIO_H3
-} from "./chunk-ZSL6MQVE.js";
+} from "./chunk-A73RMJ6B.js";
 import {
   parsePageRange
 } from "./chunk-MOL7MDBG.js";
@@ -22,7 +22,7 @@ import {
   paraTextPureT,
   patchZipEntries,
   scanSectionXml
-} from "./chunk-BYEQDLZS.js";
+} from "./chunk-RZURSA4N.js";
 import {
   MAX_COLS,
   MAX_ROWS,
@@ -32,14 +32,14 @@ import {
   dedupeRunningHeaders,
   flattenLayoutTables,
   mapPuaText
-} from "./chunk-BPJSTJBN.js";
+} from "./chunk-QXYB74QF.js";
 import {
   SPACE_EM_FIXED,
   charWidthEm1000,
   fitRatioForFewerLines,
   measureTextWidth,
   simulateWrap
-} from "./chunk-SA22NK56.js";
+} from "./chunk-65DYCXGC.js";
 import {
   MAX_DECOMPRESS_SIZE,
   MAX_XML_DEPTH,
@@ -55,7 +55,7 @@ import {
   findChildByLocalName,
   localName,
   rawTextContent
-} from "./chunk-HZU7Y22R.js";
+} from "./chunk-5KLE3U23.js";
 import {
   KordocError,
   classifyError,
@@ -67,7 +67,7 @@ import {
   sanitizeHref,
   stripDtd,
   toArrayBuffer
-} from "./chunk-ZJ75YDW7.js";
+} from "./chunk-P7YPCK7C.js";
 
 // src/index.ts
 import { readFile } from "fs/promises";
@@ -446,6 +446,91 @@ function comResultToParseResult(pages, pageCount, warnings) {
   };
 }
 
+// src/hwpx/crypto.ts
+import { createDecipheriv, createHash, pbkdf2Sync, timingSafeEqual } from "crypto";
+import { inflateRawSync } from "zlib";
+var MAX_ITERATION_COUNT = 1e6;
+var AES256_CBC = "http://www.w3.org/2001/04/xmlenc#aes256-cbc";
+var START_KEY_SHA256 = "http://www.w3.org/2000/09/xmldsig#sha256";
+var CHECKSUM_SHA256_1K = "sha256-1k";
+var CHECKSUM_PREFIX_BYTES = 1024;
+var attrOf = (xml, name) => xml.match(new RegExp(`${name}="([^"]*)"`))?.[1];
+function parseEncryptionManifest(manifestXml) {
+  const entries = [];
+  const entryRe = /<[^:>\s]*:?file-entry\b([^>]*)>([\s\S]*?)<\/[^:>\s]*:?file-entry>/g;
+  let m;
+  while ((m = entryRe.exec(manifestXml)) !== null) {
+    const [, attrs, inner] = m;
+    if (!inner.includes("encryption-data")) continue;
+    const path = attrOf(attrs, "full-path");
+    if (!path) continue;
+    const algorithm = attrOf(inner, "algorithm-name");
+    const startKey = attrOf(inner, "start-key-generation-name");
+    const checksumType = attrOf(inner, "checksum-type");
+    if (algorithm !== AES256_CBC) {
+      throw new KordocError(`\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 HWPX \uC554\uD638\uD654 \uBC29\uC2DD\uC785\uB2C8\uB2E4: ${algorithm ?? "(\uBBF8\uC0C1)"}`);
+    }
+    if (startKey !== START_KEY_SHA256) {
+      throw new KordocError(`\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 HWPX \uC2DC\uC791\uD0A4 \uC0DD\uC131 \uBC29\uC2DD\uC785\uB2C8\uB2E4: ${startKey ?? "(\uBBF8\uC0C1)"}`);
+    }
+    if (!checksumType?.endsWith(CHECKSUM_SHA256_1K)) {
+      throw new KordocError(`\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 HWPX \uCCB4\uD06C\uC12C \uBC29\uC2DD\uC785\uB2C8\uB2E4: ${checksumType ?? "(\uBBF8\uC0C1)"}`);
+    }
+    const iterations = parseInt(attrOf(inner, "iteration-count") ?? "", 10);
+    const keySize = parseInt(attrOf(inner, "key-size") ?? "", 10);
+    const iv = Buffer.from(attrOf(inner, "initialisation-vector") ?? "", "base64");
+    const salt = Buffer.from(attrOf(inner, "salt") ?? "", "base64");
+    const checksum = Buffer.from(attrOf(inner, "checksum") ?? "", "base64");
+    if (!(iterations > 0 && iterations <= MAX_ITERATION_COUNT)) {
+      throw new KordocError(`HWPX \uC554\uD638\uD654 \uBC18\uBCF5 \uD69F\uC218\uAC00 \uD5C8\uC6A9 \uBC94\uC704\uB97C \uBC97\uC5B4\uB0AC\uC2B5\uB2C8\uB2E4: ${iterations}`);
+    }
+    if (keySize !== 32 || iv.length !== 16 || salt.length === 0 || checksum.length !== 32) {
+      throw new KordocError(`HWPX \uC554\uD638\uD654 \uD30C\uB77C\uBBF8\uD130\uAC00 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4 (${path})`);
+    }
+    entries.push({ path, checksum, iv, salt, iterations, keySize });
+  }
+  return entries;
+}
+function stripEncryptionData(manifestXml) {
+  return manifestXml.replace(/<([^:>\s]*:?)encryption-data\b[\s\S]*?<\/\1encryption-data>/g, "");
+}
+function decryptEntry(cipher, entry, startKey) {
+  if (cipher.length === 0 || cipher.length % 16 !== 0) return void 0;
+  for (const prf of ["sha1", "sha256"]) {
+    try {
+      const key = pbkdf2Sync(startKey, entry.salt, entry.iterations, entry.keySize, prf);
+      const decipher = createDecipheriv("aes-256-cbc", key, entry.iv);
+      decipher.setAutoPadding(false);
+      const raw = Buffer.concat([decipher.update(cipher), decipher.final()]);
+      const plain = inflateRawSync(raw, { maxOutputLength: MAX_DECOMPRESS_SIZE });
+      const sum = createHash("sha256").update(plain.subarray(0, Math.min(CHECKSUM_PREFIX_BYTES, plain.length))).digest();
+      if (sum.length === entry.checksum.length && timingSafeEqual(sum, entry.checksum)) return plain;
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function decryptHwpxInPlace(zip, manifestXml, password) {
+  const entries = parseEncryptionManifest(manifestXml);
+  if (entries.length === 0) return 0;
+  const startKey = createHash("sha256").update(Buffer.from(password, "utf8")).digest();
+  const decrypted = [];
+  for (const entry of entries) {
+    const file = zip.file(entry.path);
+    if (!file) {
+      throw new KordocError(`\uC554\uD638 \uBAA9\uB85D\uC5D0 \uC788\uB294 \uD30C\uC77C\uC774 \uBB38\uC11C\uC5D0 \uC5C6\uC2B5\uB2C8\uB2E4: ${entry.path}`);
+    }
+    const plain = decryptEntry(await file.async("nodebuffer"), entry, startKey);
+    if (!plain) {
+      throw new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");
+    }
+    decrypted.push({ path: entry.path, plain });
+  }
+  for (const { path, plain } of decrypted) zip.file(path, plain);
+  zip.file("META-INF/manifest.xml", stripEncryptionData(manifestXml));
+  return decrypted.length;
+}
+
 // src/hwpx/styles.ts
 function isRealStrikeShape(shape) {
   switch (shape) {
@@ -1140,8 +1225,8 @@ function hmlToLatex(hmlEqStr) {
   let tokens = s.split(" ");
   for (let i = 0; i < tokens.length; i++) {
     const t = tokens[i];
-    if (t in CONVERT_MAP) tokens[i] = CONVERT_MAP[t];
-    else if (t in MIDDLE_CONVERT_MAP) tokens[i] = MIDDLE_CONVERT_MAP[t];
+    if (Object.hasOwn(CONVERT_MAP, t)) tokens[i] = CONVERT_MAP[t];
+    else if (Object.hasOwn(MIDDLE_CONVERT_MAP, t)) tokens[i] = MIDDLE_CONVERT_MAP[t];
     else {
       const quoted = /^"(.+)"$/.exec(t);
       if (quoted) tokens[i] = `\\text{${quoted[1]}}`;
@@ -2002,7 +2087,7 @@ function extractParagraphInfo(para2, styleMap, ctx) {
     if (!children) return;
     for (let i = 0; i < children.length; i++) {
       const child = children[i];
-      if (child.nodeType === 3) {
+      if (child.nodeType === 3 || child.nodeType === 4) {
         const t = child.textContent || "";
         if (isInDeletedRange(ctx)) {
           if (t && ctx && !ctx.shared.track.warned) {
@@ -2213,7 +2298,7 @@ function extractRunSpans(para2, ctx, mode, requireMixed) {
         const tkids = rc.childNodes;
         for (let k = 0; k < (tkids?.length ?? 0); k++) {
           const tk = tkids[k];
-          if (tk.nodeType === 3) text += tk.textContent || "";
+          if (tk.nodeType === 3 || tk.nodeType === 4) text += tk.textContent || "";
           else if (tk.nodeType === 1) return null;
         }
       } else if (rtag === "secPr" || rtag === "colPr") {
@@ -2271,7 +2356,7 @@ function gongmunDepthFromIndent(para2, left, ctx) {
 }
 
 // src/hwp5/record.ts
-import { inflateRawSync, inflateSync } from "zlib";
+import { inflateRawSync as inflateRawSync2, inflateSync } from "zlib";
 var TAG_PARA_HEADER = 66;
 var TAG_PARA_TEXT = 67;
 var TAG_CHAR_SHAPE = 68;
@@ -2329,7 +2414,7 @@ function decompressStream(data) {
     } catch {
     }
   }
-  return inflateRawSync(data, opts);
+  return inflateRawSync2(data, opts);
 }
 function parseFileHeader(data) {
   if (data.length < 40) throw new KordocError("FileHeader\uAC00 \uB108\uBB34 \uC9E7\uC2B5\uB2C8\uB2E4 (\uCD5C\uC18C 40\uBC14\uC774\uD2B8)");
@@ -2850,7 +2935,7 @@ async function extractImagesFromZip(zip, blocks, decompressed, warnings, sweepUn
 import JSZip2 from "jszip";
 
 // src/hwpx/zip-sections.ts
-import { inflateRawSync as inflateRawSync2 } from "zlib";
+import { inflateRawSync as inflateRawSync3 } from "zlib";
 function extractFromBrokenZip(buffer) {
   const data = new Uint8Array(buffer);
   const view = new DataView(buffer);
@@ -2901,7 +2986,7 @@ function extractFromBrokenZip(buffer) {
       if (method === 0) {
         content = new TextDecoder().decode(fileData);
       } else if (method === 8) {
-        const decompressed = inflateRawSync2(Buffer.from(fileData), { maxOutputLength: MAX_DECOMPRESS_SIZE });
+        const decompressed = inflateRawSync3(Buffer.from(fileData), { maxOutputLength: MAX_DECOMPRESS_SIZE });
         content = new TextDecoder().decode(decompressed);
       } else {
         continue;
@@ -3039,13 +3124,19 @@ async function parseHwpxDocument(buffer, options) {
   if (manifestFile) {
     const manifestXml = await manifestFile.async("text");
     if (isEncryptedHwpx(manifestXml)) {
-      if (isComFallbackAvailable() && options?.filePath) {
-        const { pages, pageCount, warnings: warnings2 } = extractTextViaCom(options.filePath);
-        if (pages.some((p) => p && p.trim().length > 0)) {
-          return comResultToParseResult(pages, pageCount, warnings2);
+      if (options?.password) {
+        await decryptHwpxInPlace(zip, manifestXml, options.password);
+      } else {
+        if (isComFallbackAvailable() && options?.filePath) {
+          const { pages, pageCount, warnings: warnings2 } = extractTextViaCom(options.filePath);
+          if (pages.some((p) => p && p.trim().length > 0)) {
+            return comResultToParseResult(pages, pageCount, warnings2);
+          }
         }
+        throw new KordocError(
+          "\uC554\uD638\uB85C \uBCF4\uD638\uB41C HWPX \uD30C\uC77C\uC785\uB2C8\uB2E4. password \uC635\uC158\uC5D0 \uC5F4\uAE30 \uC554\uD638\uB97C \uC9C0\uC815\uD558\uC138\uC694."
+        );
       }
-      throw new KordocError("DRM \uC554\uD638\uD654\uB41C HWPX \uD30C\uC77C\uC785\uB2C8\uB2E4. Windows + \uD55C\uCEF4 \uC624\uD53C\uC2A4 \uC124\uCE58 \uC2DC \uC790\uB3D9 \uCD94\uCD9C\uB429\uB2C8\uB2E4.");
     }
   }
   const decompressed = { total: 0 };
@@ -4000,11 +4091,11 @@ var WORD_ALIASES = {
 var STRUCTURAL_FOLD = /* @__PURE__ */ new Set(["over", "root", "of"]);
 function normalizeWords(input) {
   return input.replace(/(?<![\\A-Za-z0-9])([A-Za-z][A-Za-z0-9]*)(?![A-Za-z0-9])/g, (word) => {
-    if (word in CONVERT_MAP || word in MIDDLE_CONVERT_MAP) return word;
+    if (Object.hasOwn(CONVERT_MAP, word) || Object.hasOwn(MIDDLE_CONVERT_MAP, word)) return word;
     const lower = word.toLowerCase();
     if (STRUCTURAL_FOLD.has(lower)) return lower;
-    if (lower in WORD_ALIASES) return WORD_ALIASES[lower];
-    if (lower !== word && (lower in CONVERT_MAP || lower in MIDDLE_CONVERT_MAP)) return lower;
+    if (Object.hasOwn(WORD_ALIASES, lower)) return WORD_ALIASES[lower];
+    if (lower !== word && (Object.hasOwn(CONVERT_MAP, lower) || Object.hasOwn(MIDDLE_CONVERT_MAP, lower))) return lower;
     return word;
   });
 }
@@ -4024,6 +4115,84 @@ function hwpEquationToLatex(equation) {
   return hmlToLatex(s).replace(/\s+/g, " ").trim();
 }
 
+// src/hwp5/pw-crypto.ts
+import { createCipheriv, createHash as createHash2 } from "crypto";
+var ENCRYPT_VERSION_OFFSET = 44;
+var SUPPORTED_ENCRYPT_VERSION = 4;
+var KEY_SEED = 236;
+function readEncryptVersion(fileHeader) {
+  if (fileHeader.length < ENCRYPT_VERSION_OFFSET + 4) return 0;
+  return (fileHeader[ENCRYPT_VERSION_OFFSET] | fileHeader[ENCRYPT_VERSION_OFFSET + 1] << 8 | fileHeader[ENCRYPT_VERSION_OFFSET + 2] << 16 | fileHeader[ENCRYPT_VERSION_OFFSET + 3] << 24) >>> 0;
+}
+function derivePasswordKey(password) {
+  const buf = Buffer.alloc(password.length * 2);
+  for (let i = 0; i < password.length; i++) {
+    const prev = i === 0 ? KEY_SEED : password[i - 1];
+    buf[i * 2] = (prev << 1 | prev >> 7) & 255;
+    buf[i * 2 + 1] = password[i];
+  }
+  return createHash2("sha1").update(buf).digest().subarray(0, 16);
+}
+function padToBlock(data) {
+  const rem = data.length % 16;
+  if (rem === 0) return Buffer.from(data);
+  const amount = 16 - rem;
+  return Buffer.concat([Buffer.from(data), Buffer.alloc(amount, amount)]);
+}
+function shiftRegister(reg, feedbackBit) {
+  for (let i = 0; i < 15; i++) {
+    reg[i] = (reg[i] << 1 | reg[i + 1] >> 7) & 255;
+  }
+  reg[15] = (reg[15] << 1 | feedbackBit & 1) & 255;
+}
+function decryptAesCfb1(data, key) {
+  const cipher = createCipheriv("aes-128-ecb", key, null);
+  cipher.setAutoPadding(false);
+  const register = new Uint8Array(16);
+  const registerBuf = Buffer.alloc(16);
+  const out = Buffer.alloc(data.length);
+  for (let offset = 0; offset < data.length; offset += 16) {
+    const len = Math.min(16, data.length - offset);
+    const chunk = Buffer.alloc(16);
+    data.copy(chunk, 0, offset, offset + len);
+    for (let i = 0; i < 128; i++) {
+      registerBuf.set(register);
+      const keystreamMsb = cipher.update(registerBuf)[0];
+      const byteIdx = i >> 3;
+      const bitInByte = i & 7;
+      const cipherBit = chunk[byteIdx] >> 7 - bitInByte & 1;
+      shiftRegister(register, cipherBit);
+      chunk[byteIdx] ^= (keystreamMsb & 128) >> bitInByte;
+    }
+    chunk.copy(out, offset, 0, len);
+  }
+  return out;
+}
+function decryptPasswordStream(raw, password) {
+  const key = derivePasswordKey(Buffer.from(password, "utf8"));
+  return decryptAesCfb1(padToBlock(raw), key).subarray(0, raw.length);
+}
+var TAG_DOCUMENT_PROPERTIES = 16;
+var TAG_ID_MAPPINGS = 17;
+function assertDecryptedDocInfo(data, readRecords3) {
+  const wrong = () => new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");
+  let records;
+  try {
+    records = readRecords3(data);
+  } catch {
+    throw wrong();
+  }
+  if (records[0]?.tagId !== TAG_DOCUMENT_PROPERTIES) throw wrong();
+  if (!records.some((r) => r.tagId === TAG_ID_MAPPINGS)) throw wrong();
+}
+function assertSupportedEncryptVersion(version) {
+  if (version !== SUPPORTED_ENCRYPT_VERSION) {
+    throw new KordocError(
+      `\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 HWP \uC554\uD638\uD654 \uBC84\uC804\uC785\uB2C8\uB2E4 (EncryptVersion=${version}, \uC9C0\uC6D0: ${SUPPORTED_ENCRYPT_VERSION})`
+    );
+  }
+}
+
 // src/hwp5/parser.ts
 import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
@@ -4104,27 +4273,50 @@ function parseHwp5Document(buffer, options) {
       throw new KordocError("CFB \uCEE8\uD14C\uC774\uB108 \uD30C\uC2F1 \uC2E4\uD328 (strict \uBC0F lenient \uBAA8\uB450)");
     }
   }
-  const findStream = (path) => {
+  const readRawStream = (path) => {
     if (cfb) {
       const entry = CFB.find(cfb, path);
       return entry?.content ? Buffer.from(entry.content) : null;
     }
     return lenientCfb.findStream(path);
   };
-  const headerData = findStream("/FileHeader");
+  const headerData = readRawStream("/FileHeader");
   if (!headerData) throw new KordocError("FileHeader \uC2A4\uD2B8\uB9BC \uC5C6\uC74C");
   const header = parseFileHeader(headerData);
   if (header.signature !== "HWP Document File") throw new KordocError("HWP \uC2DC\uADF8\uB2C8\uCC98 \uBD88\uC77C\uCE58");
-  if (header.flags & FLAG_ENCRYPTED) throw new KordocError("\uC554\uD638\uD654\uB41C HWP\uB294 \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4");
   if (header.flags & FLAG_DRM) throw new KordocError("DRM \uBCF4\uD638\uB41C HWP\uB294 \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4");
+  const encrypted = (header.flags & FLAG_ENCRYPTED) !== 0;
+  if (encrypted) {
+    if (!options?.password) {
+      throw new KordocError("\uC554\uD638\uB85C \uBCF4\uD638\uB41C HWP \uBB38\uC11C\uC785\uB2C8\uB2E4. password \uC635\uC158\uC5D0 \uC5F4\uAE30 \uC554\uD638\uB97C \uC9C0\uC815\uD558\uC138\uC694.");
+    }
+    assertSupportedEncryptVersion(readEncryptVersion(headerData));
+  }
+  const password = encrypted ? options.password : void 0;
+  const findStream = (path) => {
+    const raw = readRawStream(path);
+    if (!raw || !password) return raw;
+    return decryptPasswordStream(raw, password);
+  };
   const compressed = (header.flags & FLAG_COMPRESSED) !== 0;
   const distribution = (header.flags & FLAG_DISTRIBUTION) !== 0;
   const metadata = {
     version: `${header.versionMajor}.x`
   };
   if (cfb) extractHwp5Metadata(cfb, metadata);
-  const docInfo = cfb ? parseDocInfoStream(cfb, compressed) : parseDocInfoFromStream(findStream("/DocInfo"), compressed);
-  const sections = distribution ? cfb ? findViewTextSections(cfb, compressed) : findViewTextSectionsLenient(lenientCfb, compressed) : cfb ? findSections(cfb) : findSectionsLenient(lenientCfb, compressed);
+  if (encrypted) {
+    const rawDocInfo = findStream("/DocInfo");
+    if (!rawDocInfo) throw new KordocError("DocInfo \uC2A4\uD2B8\uB9BC \uC5C6\uC74C");
+    let docInfoData;
+    try {
+      docInfoData = compressed ? decompressStream(rawDocInfo) : rawDocInfo;
+    } catch {
+      throw new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");
+    }
+    assertDecryptedDocInfo(docInfoData, readRecords);
+  }
+  const docInfo = cfb && !encrypted ? parseDocInfoStream(cfb, compressed) : parseDocInfoFromStream(findStream("/DocInfo"), compressed);
+  const sections = distribution ? cfb ? findViewTextSections(cfb, compressed) : findViewTextSectionsLenient(lenientCfb, compressed) : encrypted ? findSectionsVia(findStream) : cfb ? findSections(cfb) : findSectionsLenient(lenientCfb, compressed);
   if (sections.length === 0) throw new KordocError("\uC139\uC158 \uC2A4\uD2B8\uB9BC\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4");
   metadata.pageCount = sections.length;
   const pageFilter = options?.pages ? parsePageRange(options.pages, sections.length) : null;
@@ -4306,6 +4498,15 @@ function findViewTextSections(cfb, compressed) {
   }
   return sections.sort((a, b) => a.idx - b.idx).map((s) => s.content);
 }
+function findSectionsVia(read) {
+  const sections = [];
+  for (let i = 0; i < MAX_SECTIONS; i++) {
+    const raw = read(`/BodyText/Section${i}`);
+    if (!raw) break;
+    sections.push(raw);
+  }
+  return sections;
+}
 function findSections(cfb) {
   const sections = [];
   for (let i = 0; i < MAX_SECTIONS; i++) {
@@ -4911,7 +5112,7 @@ function hasRealStrike(attrFlags) {
 }
 
 // src/hwp3/parser.ts
-import { inflateRawSync as inflateRawSync3 } from "zlib";
+import { inflateRawSync as inflateRawSync5 } from "zlib";
 
 // src/hwp3/johab-symbols.ts
 var JOHAB_SYMBOLS = Object.freeze([
@@ -16819,6 +17020,23 @@ function lookupSymbol(ch) {
   return null;
 }
 var JOHAB_UNMAPPED = -1;
+var JUNG_ARAEA = 30;
+var ARAEA_JAMO = 4510;
+function decodeAraeaSyllable(ch) {
+  if (ch < 32768) return null;
+  if ((ch >> 5 & 31) !== JUNG_ARAEA) return null;
+  const cho = CHO_MAP[ch >> 10 & 31];
+  const jong = JONG_MAP[ch & 31];
+  if (cho === -1 || jong === -1) return null;
+  const out = String.fromCodePoint(4352 + cho) + String.fromCodePoint(ARAEA_JAMO);
+  return jong === 0 ? out : out + String.fromCodePoint(4519 + jong);
+}
+function decodeJohabText(ch) {
+  const araea = decodeAraeaSyllable(ch);
+  if (araea) return araea;
+  const cp = decodeJohab(ch);
+  return cp === JOHAB_UNMAPPED ? null : String.fromCodePoint(cp);
+}
 function decodeJohab(ch) {
   if (ch < 128) return ch;
   if (ch >= 32768) {
@@ -16840,6 +17058,7 @@ function decodeJohab(ch) {
 function decodeHwp3Extra(ch) {
   if (ch >= 13712 && ch <= 13721) return 8544 + (ch - 13712);
   if (ch >= 14055 && ch <= 14064) return 9312 + (ch - 14055);
+  if (ch >= 14272 && ch <= 14277) return "\uD55C\uAE00\uACFC\uCEF4\uD4E8\uD130".codePointAt(ch - 14272);
   switch (ch) {
     case 129:
       return 8220;
@@ -16874,6 +17093,9 @@ function decodeHwp3Extra(ch) {
     case 13434:
       return 9654;
     // ▶
+    case 12135:
+      return 9656;
+    // ▸ 표 셀 글머리표 (rhwp 16db8260 — HWP5 변환본·한컴 PDF 대조)
     default:
       return JOHAB_UNMAPPED;
   }
@@ -16884,8 +17106,7 @@ function decodeHcharString(bytes) {
   while (i + 1 < bytes.length) {
     const ch = bytes[i] | bytes[i + 1] << 8;
     if (ch === 0) break;
-    const cp = decodeJohab(ch);
-    if (cp !== JOHAB_UNMAPPED) out += String.fromCodePoint(cp);
+    out += decodeJohabText(ch) ?? "";
     i += 2;
   }
   return out;
@@ -16990,6 +17211,87 @@ function readHeader(reader) {
   return { compressed, encrypted, infoBlockLength, title, subject, author, date };
 }
 
+// src/hwp3/crypto.ts
+import { createDecipheriv as createDecipheriv2 } from "crypto";
+import { inflateRawSync as inflateRawSync4 } from "zlib";
+var FIXED_HEADER_BYTES = SIGNATURE_LEN + DOC_INFO_SIZE + DOC_SUMMARY_SIZE;
+var PASSWORD_FLAG_OFFSET = SIGNATURE_LEN + 96;
+var COMPRESSION_FLAG_OFFSET = SIGNATURE_LEN + 124;
+var INFO_BLOCK_LENGTH_OFFSET = SIGNATURE_LEN + 126;
+var PASSWORD_PREFIX_BYTES = 256;
+var MAX_DECOMPRESSED_BYTES = 100 * 1024 * 1024;
+function isEncryptedHwp3(data) {
+  if (data.length < FIXED_HEADER_BYTES) return false;
+  return (data[PASSWORD_FLAG_OFFSET] | data[PASSWORD_FLAG_OFFSET + 1] << 8) !== 0;
+}
+function deriveDesKey(password) {
+  const rolling = new Uint8Array(7);
+  let index = 0;
+  for (let i = 0; i < password.length; i++) {
+    const unit = password.charCodeAt(i);
+    for (const byte of [unit & 255, unit >> 8 & 255]) {
+      const slot = index % rolling.length;
+      const mixed = rolling[slot] ^ byte;
+      rolling[slot] = (mixed << 1 | mixed >> 7) & 255;
+      index++;
+    }
+  }
+  const key = Buffer.alloc(8);
+  for (let bit = 0; bit < 56; bit++) {
+    const sourceBit = rolling[Math.floor(bit / 8)] >> 7 - bit % 8 & 1;
+    key[Math.floor(bit / 7)] |= sourceBit << 7 - bit % 7;
+  }
+  return key;
+}
+function desEcbDecrypt(data, key) {
+  const decipher = createDecipheriv2("des-ede3-ecb", Buffer.concat([key, key, key]), null);
+  decipher.setAutoPadding(false);
+  return Buffer.concat([decipher.update(data), decipher.final()]);
+}
+function readLayout(data) {
+  if (data.length < FIXED_HEADER_BYTES) {
+    throw new KordocError("HWP3 \uC554\uD638 \uBB38\uC11C: \uD5E4\uB354\uAC00 \uC798\uB838\uC2B5\uB2C8\uB2E4");
+  }
+  const infoBlockLength = data[INFO_BLOCK_LENGTH_OFFSET] | data[INFO_BLOCK_LENGTH_OFFSET + 1] << 8;
+  const payloadOffset = FIXED_HEADER_BYTES + infoBlockLength;
+  if (payloadOffset >= data.length) {
+    throw new KordocError("HWP3 \uC554\uD638 \uBB38\uC11C: \uBCF8\uBB38\uC774 \uC5C6\uC2B5\uB2C8\uB2E4");
+  }
+  return { payloadOffset, compressed: data[COMPRESSION_FLAG_OFFSET] !== 0 };
+}
+function decryptHwp3Document(input, password) {
+  const { payloadOffset, compressed } = readLayout(input);
+  if (!compressed) {
+    throw new KordocError("\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 HWP3 \uC554\uD638\uD654 \uBC29\uC2DD\uC785\uB2C8\uB2E4 (\uC555\uCD95\uB418\uC9C0 \uC54A\uC740 \uC554\uD638 \uBCF8\uBB38)");
+  }
+  const source = Buffer.from(input);
+  const payload = source.subarray(payloadOffset);
+  const aligned = payload.subarray(0, payload.length - payload.length % 8);
+  if (aligned.length === 0) {
+    throw new KordocError("HWP3 \uC554\uD638 \uBB38\uC11C: \uBCF8\uBB38\uC774 \uB108\uBB34 \uC9E7\uC2B5\uB2C8\uB2E4");
+  }
+  const decrypted = desEcbDecrypt(aligned, deriveDesKey(password));
+  let inflated;
+  try {
+    inflated = inflateRawSync4(decrypted, { maxOutputLength: MAX_DECOMPRESSED_BYTES });
+  } catch (err) {
+    if (err?.code === "ERR_BUFFER_TOO_LARGE") {
+      throw new KordocError(
+        `HWP3 \uC554\uD638 \uBCF8\uBB38\uC758 \uC555\uCD95 \uD574\uC81C \uACB0\uACFC\uAC00 \uCD5C\uB300 \uD5C8\uC6A9 \uD06C\uAE30(${MAX_DECOMPRESSED_BYTES / 1024 / 1024}MB)\uB97C \uCD08\uACFC\uD588\uC2B5\uB2C8\uB2E4`
+      );
+    }
+    throw new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");
+  }
+  if (inflated.length <= PASSWORD_PREFIX_BYTES) {
+    throw new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");
+  }
+  const body = inflated.subarray(PASSWORD_PREFIX_BYTES);
+  const out = Buffer.concat([source.subarray(0, payloadOffset), body]);
+  out.writeUInt16LE(0, PASSWORD_FLAG_OFFSET);
+  out[COMPRESSION_FLAG_OFFSET] = 0;
+  return out;
+}
+
 // src/hwp3/parser.ts
 var MAX_DECOMPRESS_SIZE3 = 100 * 1024 * 1024;
 var PARA_SHAPE_SIZE = 187;
@@ -17012,19 +17314,25 @@ var SIMPLE_CTRL = /* @__PURE__ */ new Map([
   [30, { extraBytes: 2, extraHchar: 1, emit: "\xA0" }],
   [31, { extraBytes: 2, extraHchar: 1, emit: " " }]
 ]);
-function parseHwp3Document(buffer, _options) {
-  const headReader = new Reader(Buffer.from(buffer));
-  const header = readHeader(headReader);
-  if (header.encrypted !== 0) {
-    throw new KordocError("\uC554\uD638\uD654\uB41C HWP3 \uBB38\uC11C \u2014 \uBCF8\uBB38\uC774 \uC554\uD638\uB85C \uBCF4\uD638\uB418\uC5B4 \uC788\uC5B4 \uCD94\uCD9C\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.");
+function parseHwp3Document(buffer, options) {
+  let source = Buffer.from(buffer);
+  if (isEncryptedHwp3(source)) {
+    if (!options?.password) {
+      throw new KordocError(
+        "\uC554\uD638\uB85C \uBCF4\uD638\uB41C HWP3 \uBB38\uC11C\uC785\uB2C8\uB2E4. password \uC635\uC158\uC5D0 \uC5F4\uAE30 \uC554\uD638\uB97C \uC9C0\uC815\uD558\uC138\uC694."
+      );
+    }
+    source = decryptHwp3Document(source, options.password);
   }
+  const headReader = new Reader(source);
+  const header = readHeader(headReader);
   headReader.skip(header.infoBlockLength);
   const tail = headReader.readToEnd();
   let body;
   const warnings = [];
   if (header.compressed !== 0) {
     try {
-      body = inflateRawSync3(tail, { maxOutputLength: MAX_DECOMPRESS_SIZE3 });
+      body = inflateRawSync5(tail, { maxOutputLength: MAX_DECOMPRESS_SIZE3 });
     } catch (err) {
       if (err?.code === "ERR_BUFFER_TOO_LARGE") {
         throw new KordocError(`HWP3 \uC555\uCD95 \uD574\uC81C \uACB0\uACFC\uAC00 \uCD5C\uB300 \uD5C8\uC6A9 \uD06C\uAE30(${MAX_DECOMPRESS_SIZE3 / 1024 / 1024}MB)\uB97C \uCD08\uACFC\uD588\uC2B5\uB2C8\uB2E4`);
@@ -17127,8 +17435,7 @@ function parseCharStream(reader, charCount, ctx) {
       continue;
     }
     if (ch >= 32) {
-      const cp = decodeJohab(ch);
-      if (cp !== JOHAB_UNMAPPED) out += String.fromCodePoint(cp);
+      out += decodeJohabText(ch) ?? "";
       continue;
     }
     const simple = SIMPLE_CTRL.get(ch);
@@ -17196,7 +17503,7 @@ function parseCharStream(reader, charCount, ctx) {
 function parseTableLike(reader, ctx) {
   const info = reader.readBytes(84);
   const cellCount = info.readUInt16LE(80) || 1;
-  if (cellCount > 256) {
+  if (27 * cellCount > reader.remaining()) {
     ctx.warnings.push({
       code: "PARTIAL_PARSE",
       message: `HWP3 \uD45C cell_count=${cellCount} \uBE44\uC815\uC0C1 \u2014 \uD45C \uBCF8\uBB38 \uCD94\uCD9C \uD3EC\uAE30`
@@ -17210,10 +17517,11 @@ function parseTableLike(reader, ctx) {
   parseParagraphList2(reader, ctx);
   return "";
 }
-function parsePicture(reader, _ctx) {
+function parsePicture(reader, ctx) {
   const info = reader.readBytes(348);
   const nExt = info.readUInt32LE(0);
   if (nExt > 0 && nExt < 100 * 1024 * 1024) reader.skip(nExt);
+  parseParagraphList2(reader, ctx);
 }
 
 // src/hwp5/sentinel.ts
@@ -19922,7 +20230,9 @@ async function fillWithUniqueGuard(values, run) {
   const first = await run(values);
   const counts = /* @__PURE__ */ new Map();
   for (const f of first.filled) {
-    if (f.key) counts.set(f.key, (counts.get(f.key) ?? 0) + 1);
+    if (f.key && f.source !== "clickhere") {
+      counts.set(f.key, (counts.get(f.key) ?? 0) + 1);
+    }
   }
   const isArrayValue = (normKey) => {
     for (const [label, raw] of Object.entries(values)) {
@@ -20383,7 +20693,7 @@ import JSZip7 from "jszip";
 // src/form/click-here.ts
 import JSZip6 from "jszip";
 var FIELD_BEGIN_RE = /<([A-Za-z0-9_]+:)?fieldBegin\b([^>]*?)(\/?)>/g;
-function attrOf(attrs, name) {
+function attrOf2(attrs, name) {
   const m = attrs.match(new RegExp(`(?:^|\\s)${name}="([^"]*)"`));
   return m ? m[1] : void 0;
 }
@@ -20409,10 +20719,10 @@ function scanClickHereRegions(xml) {
     const prefix = m[1] ?? "";
     const attrs = m[2];
     const selfClosed = m[3] === "/";
-    if ((attrOf(attrs, "type") ?? "").toUpperCase() !== "CLICK_HERE") continue;
-    const name = attrOf(attrs, "name");
+    if ((attrOf2(attrs, "type") ?? "").toUpperCase() !== "CLICK_HERE") continue;
+    const name = attrOf2(attrs, "name");
     if (name === void 0) continue;
-    const id = attrOf(attrs, "id");
+    const id = attrOf2(attrs, "id");
     let beginElemEnd;
     if (selfClosed) {
       beginElemEnd = FIELD_BEGIN_RE.lastIndex;
@@ -20435,7 +20745,7 @@ function scanClickHereRegions(xml) {
     let end = -1;
     let fe;
     while ((fe = feRe.exec(xml)) !== null) {
-      const ref = attrOf(fe[0], "beginIDRef");
+      const ref = attrOf2(fe[0], "beginIDRef");
       if (id !== void 0 && ref !== void 0 && ref !== id) continue;
       end = fe.index;
       break;
@@ -20476,7 +20786,7 @@ function fillClickHereInXml(xml, cursor, blockedLabels) {
     const replacement = valueXml(value, region.prefix);
     const current = xml.slice(region.start, region.end);
     matchedKeys.add(key);
-    filled.push({ label: region.name, value, row: -1, col: -1, key });
+    filled.push({ label: region.name, value, row: -1, col: -1, key, source: "clickhere" });
     if (current === replacement) continue;
     splices.push({ start: region.start, end: region.end, replacement });
   }
@@ -20487,6 +20797,7 @@ function fillClickHereInXml(xml, cursor, blockedLabels) {
   };
 }
 async function extractClickHereFields(hwpxBuffer) {
+  precheckZipSize(hwpxBuffer);
   const zip = await JSZip6.loadAsync(hwpxBuffer);
   const sectionPaths = Object.keys(zip.files).filter((name) => /[Ss]ection\d+\.xml$/i.test(name)).sort();
   const fields = [];
@@ -20507,6 +20818,7 @@ async function extractClickHereFields(hwpxBuffer) {
 // src/form/filler-hwpx.ts
 async function fillHwpx(hwpxBuffer, values, blockedLabels) {
   const u8 = new Uint8Array(hwpxBuffer);
+  precheckZipSize(hwpxBuffer);
   const zip = await JSZip7.loadAsync(hwpxBuffer);
   const sectionPaths = Object.keys(zip.files).filter((name) => /[Ss]ection\d+\.xml$/i.test(name)).sort();
   if (sectionPaths.length === 0) {
@@ -25770,6 +26082,9 @@ function applyCellEdit(table2, scanTable, gridR, gridC, newLines, ctx, before, a
     const xml = ctx.scans[target.sectionIndex]?.xml;
     const rawT = xml ? paraTText(target, xml) : null;
     let sp;
+    if (xml && rawT === null) {
+      return skip("\uBE48 \uC140 \uBB38\uB2E8\uC5D0 \uC5D4\uD2F0\uD2F0\xB7\uD0DC\uADF8\uAC00 \uC788\uC5B4 \uC0BD\uC785 \uACBD\uACC4\uB97C \uD2B9\uC815\uD560 \uC218 \uC5C6\uC74C \u2014 \uC6D0\uBB38 \uC190\uC2E4 \uBC29\uC9C0\uB85C \uBBF8\uC801\uC6A9");
+    }
     if (xml && rawT !== null && rawT.length > 0 && rawT.trim() === "") {
       sp = buildRangeSplices(target, xml, 0, 0, value);
       if (sp === null) return skip("\uBE48 \uC140 \uACF5\uBC31 \uBCF4\uC874 \uC0BD\uC785 \uACBD\uACC4 \uBAA8\uD638 \u2014 \uC6D0\uBB38 \uC190\uC2E4 \uBC29\uC9C0\uB85C \uBBF8\uC801\uC6A9");
@@ -28012,7 +28327,7 @@ async function parse(input, options) {
 }
 async function parseImage(buffer, options) {
   try {
-    const { parseImageDocument } = await import("./image-ocr-TWUU2RNG.js");
+    const { parseImageDocument } = await import("./image-ocr-XC52AQDV.js");
     const { blocks, warnings } = await parseImageDocument(buffer, options);
     return {
       success: true,
@@ -28071,7 +28386,7 @@ async function parseHwp(buffer, options) {
 async function parsePdf(buffer, options) {
   let parsePdfDocument;
   try {
-    const mod = await import("./parser-VR2BTUT7.js");
+    const mod = await import("./parser-ESGFWWCT.js");
     parsePdfDocument = mod.parsePdfDocument;
   } catch {
     return {
@@ -28217,4 +28532,4 @@ export {
   parseHwpml,
   fillForm
 };
-//# sourceMappingURL=chunk-RO4Y4BFI.js.map
+//# sourceMappingURL=chunk-YOZ7ZRCD.js.map