ooxml-core 1.16.0 → 1.17.0

package/dist/{chunk-WEFFRYXN.mjs → chunk-XTSHZGSM.mjs}

@@ -29118,15 +29118,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at2 = xml.indexOf("<");
+  while (at2 !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at2));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at2 + skip[0].length);
+      if (end === -1) return;
+      at2 = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at2;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at2 = xml.indexOf("<", at2 + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at2 = xml.indexOf("<", at2 + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/{chunk-C2Y6SZDN.mjs → chunk-YS43OMM3.mjs}

@@ -1,6 +1,6 @@
-import { findText, replaceText, replaceTextInSlide, mergePresentation } from './chunk-KOX5Y5E5.mjs';
-import { PresentationBuilder, PptxHandler, SlideBuilder, validateSeriesIndex, removeEmptyDataPoint, ensureDataPoint, ensureChartData, assertChartGradientSupported, toChartGradientFill, isLineDrawnChartType, chartFormatTargetKey, applyChartGroupOptionsInput, STANDARD_LAYOUTS, createTextElement, createShapeElement, createImageElement, createTableElement, createChartElement, createConnectorElement, createMediaElement, createGroupElement, relationshipsPartFor, parseRelationships, resolvePartPath, clonePartGraph, buildRelationshipsXml, buildBlankPresentationArchive, nextRelationshipId, relativePartTarget, PptxXmlBuilder } from './chunk-WBCV52YV.mjs';
-import { escAttr, EMU_PER_PIXEL, EMU_PER_INCH, parseXml, first, elements, buildXml, bytesToBase64, base64ToBytes, hasTextProperties } from './chunk-LM6VBPQJ.mjs';
+import { findText, replaceText, replaceTextInSlide, mergePresentation } from './chunk-UFGJNXRG.mjs';
+import { PresentationBuilder, PptxHandler, SlideBuilder, validateSeriesIndex, removeEmptyDataPoint, ensureDataPoint, ensureChartData, assertChartGradientSupported, toChartGradientFill, isLineDrawnChartType, chartFormatTargetKey, applyChartGroupOptionsInput, STANDARD_LAYOUTS, createTextElement, createShapeElement, createImageElement, createTableElement, createChartElement, createConnectorElement, createMediaElement, createGroupElement, relationshipsPartFor, parseRelationships, resolvePartPath, clonePartGraph, buildRelationshipsXml, buildBlankPresentationArchive, nextRelationshipId, relativePartTarget, PptxXmlBuilder } from './chunk-IM5LFEA2.mjs';
+import { escAttr, EMU_PER_PIXEL, EMU_PER_INCH, parseXml, first, elements, buildXml, bytesToBase64, base64ToBytes, hasTextProperties } from './chunk-HLZIALC5.mjs';
 import { openPptxZip } from './chunk-M4XLF4R7.mjs';
 import { cloneSlide, cloneElement } from './chunk-54S5A5PZ.mjs';
 
@@ -14957,7 +14957,7 @@ async function setPresentationRunText(bytes, slideIndex, elementId, runIndex, te
 async function createPresentationFromOutline(slides, options = {}) {
   if (!(slides instanceof Array) || !slides.length || slides.length > 200)
     throw new Error("A presentation outline has 1 to 200 slides");
-  const { PresentationBuilder: PresentationBuilder2 } = await import('./PresentationBuilder-Y6DJK6H2.mjs');
+  const { PresentationBuilder: PresentationBuilder2 } = await import('./PresentationBuilder-OK526SZ4.mjs');
   const { handler, data, createSlide } = await PresentationBuilder2.create({
     ...options.title ? { title: options.title } : {}
   });

package/dist/collab/broadcast-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broadcast-transport.d.ts","sourceRoot":"","sources":["../../collab/broadcast-transport.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAG/D,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACpC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACxC,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACvD;AACD,MAAM,MAAM,2BAA2B,GAAG,KAAK,IAAI,EAAE,MAAM,KAAK,oBAAoB,CAAC;AAErF,MAAM,WAAW,yBAAyB;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAC/C;AAiBD,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,KAAK,GAAE,MAAmB,GAAG,OAAO,CAEhE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,SAAS,CAmDtF"}
+{"version":3,"file":"broadcast-transport.d.ts","sourceRoot":"","sources":["../../collab/broadcast-transport.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAI/D,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACpC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACxC,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACvD;AACD,MAAM,MAAM,2BAA2B,GAAG,KAAK,IAAI,EAAE,MAAM,KAAK,oBAAoB,CAAC;AAErF,MAAM,WAAW,yBAAyB;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAC/C;AAiBD,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,KAAK,GAAE,MAAmB,GAAG,OAAO,CAEhE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,SAAS,CAmDtF"}

package/dist/collab/identity.d.ts

@@ -14,6 +14,8 @@ export declare function assignUserColor(seed: number | string, palette?: readonl
 export declare function formatCursorLabel(userName: string, maxChars?: number): string;
 /** Up to two uppercase initials: first+last for multi-word names, otherwise the first two letters. */
 export declare function getUserInitials(name: string): string;
+/** Eight random base-36 characters from the platform CSPRNG, or a counter when it is missing. */
+export declare function randomToken(): string;
 /** A random-enough client id for a session; `crypto.randomUUID` when present. */
 export declare function createClientId(): string;
 /**

package/dist/collab/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../collab/identity.ts"],"names":[],"mappings":"AAKA,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,CAAC;AAEpE,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAI3D,CAAC;AAEF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAI1E;AAED,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAS3C,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,4FAA4F;AAC5F,wBAAgB,eAAe,CAC9B,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,GAAE,SAAS,MAAM,EAAmB,GACzC,MAAM,CAMR;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAwB,GAAG,MAAM,CAG9F;AAED,sGAAsG;AACtG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED,iFAAiF;AACjF,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAOD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAO5F;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IAC1B,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,MAAM,EAAE;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;CACxC,GAAG,UAAU,EAAE,CAuBf"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../collab/identity.ts"],"names":[],"mappings":"AAKA,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,CAAC;AAEpE,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAI3D,CAAC;AAEF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAI1E;AAED,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAS3C,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,4FAA4F;AAC5F,wBAAgB,eAAe,CAC9B,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,GAAE,SAAS,MAAM,EAAmB,GACzC,MAAM,CAMR;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAwB,GAAG,MAAM,CAG9F;AAED,sGAAsG;AACtG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED,iGAAiG;AACjG,wBAAgB,WAAW,IAAI,MAAM,CAWpC;AAGD,iFAAiF;AACjF,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAOD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAO5F;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IAC1B,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,MAAM,EAAE;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;CACxC,GAAG,UAAU,EAAE,CAuBf"}

package/dist/collab/index.cjs

@@ -205,10 +205,18 @@ function getUserInitials(name) {
   if (parts.length >= 2 && first && last) return (first[0] + last[0]).toUpperCase();
   return trimmed.slice(0, 2).toUpperCase();
 }
+function randomToken() {
+  const cryptoApi = globalThis.crypto;
+  if (cryptoApi?.getRandomValues) {
+    return cryptoApi.getRandomValues(new Uint32Array(2)).reduce((s, n) => s + n.toString(36), "").slice(0, 8);
+  }
+  return (fallbackCounter++).toString(36).padStart(8, "0");
+}
+var fallbackCounter = 0;
 function createClientId() {
   const cryptoApi = globalThis.crypto;
   if (cryptoApi?.randomUUID) return cryptoApi.randomUUID();
-  return `c${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`;
+  return `c${Date.now().toString(36)}${randomToken()}`;
 }
 function clientKey(clientId) {
   if (!isValidId(clientId)) throw new Error("Invalid collaboration client ID");
@@ -505,7 +513,7 @@ function canBroadcast(scope = globalThis) {
 function createBroadcastTransport(options) {
   const roomId = validateRoomId(options.roomId);
   const Channel = options.BroadcastChannel ?? globalThis.BroadcastChannel;
-  const self = Math.random().toString(36).slice(2) + Date.now().toString(36);
+  const self = randomToken() + Date.now().toString(36);
   let channel = null;
   let handlers = null;
   const close = () => {
@@ -1459,6 +1467,7 @@ exports.mergeUpdates = mergeUpdates2;
 exports.observeExternalSession = observeExternalSession;
 exports.packageAdapter = packageAdapter;
 exports.presenceToCursors = presenceToCursors;
+exports.randomToken = randomToken;
 exports.registerTeardown = registerTeardown;
 exports.removeAwarenessStatesLocally = removeAwarenessStatesLocally;
 exports.restoreSnapshot = restoreSnapshot;

package/dist/collab/index.mjs

@@ -181,10 +181,18 @@ function getUserInitials(name) {
   if (parts.length >= 2 && first && last) return (first[0] + last[0]).toUpperCase();
   return trimmed.slice(0, 2).toUpperCase();
 }
+function randomToken() {
+  const cryptoApi = globalThis.crypto;
+  if (cryptoApi?.getRandomValues) {
+    return cryptoApi.getRandomValues(new Uint32Array(2)).reduce((s, n) => s + n.toString(36), "").slice(0, 8);
+  }
+  return (fallbackCounter++).toString(36).padStart(8, "0");
+}
+var fallbackCounter = 0;
 function createClientId() {
   const cryptoApi = globalThis.crypto;
   if (cryptoApi?.randomUUID) return cryptoApi.randomUUID();
-  return `c${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`;
+  return `c${Date.now().toString(36)}${randomToken()}`;
 }
 function clientKey(clientId) {
   if (!isValidId(clientId)) throw new Error("Invalid collaboration client ID");
@@ -481,7 +489,7 @@ function canBroadcast(scope = globalThis) {
 function createBroadcastTransport(options) {
   const roomId = validateRoomId(options.roomId);
   const Channel = options.BroadcastChannel ?? globalThis.BroadcastChannel;
-  const self = Math.random().toString(36).slice(2) + Date.now().toString(36);
+  const self = randomToken() + Date.now().toString(36);
   let channel = null;
   let handlers = null;
   const close = () => {
@@ -1370,4 +1378,4 @@ function trimTrailingSlashes(value) {
   return value.slice(0, end);
 }
 
-export { BROADCAST_THROTTLE_MS, BoundedMap, COLLABORATION_ROLES, COLLAB_LEAVE_MESSAGE, CONNECTION_TIMEOUT_MS, CURSOR_PALETTE, DEFAULT_COLOR, DEFAULT_MAX_PACKAGE_BYTES, DEPARTURE_CHANNEL, Emitter, INITIAL_SYNC_GRACE_MS, IdempotencyCache, LEGACY_PPTX_DEPARTURE_CHANNEL, LEGACY_PPTX_LEAVE_MESSAGE, LOCAL_ORIGIN, MAX_LABEL_CHARS, MAX_UPDATE_BYTES, MESSAGE_AWARENESS, MESSAGE_QUERY_AWARENESS, MESSAGE_SYNC, PRESENCE_FIELD, PRESENCE_HEARTBEAT_MS, STALE_PRESENCE_MS, SequenceTracker, adaptYjsProvider, applyUpdateSafe, asSelectionIds, assignUserColor, bindDocument, borrowAwareness, buildRoster, canBroadcast, canWrite, clampCoordinate, classifyVersion, clearLocalAwareness, createAssetSync, createBroadcastTransport, createClientId, createCollabSession, createDepartureChannel, createIdGenerator, createMemoryHub, createPresencePublisher, createSyncGate, createTransportProvider, createWebSocketTransport, deriveCanvasPresence, derivePresence, encodeDiff, encodeSnapshot, encodeStateVector2 as encodeStateVector, formatCursorLabel, freezeDeep, fromBase64, getUserInitials, isMixedContentBlocked, isNonNegativeSafeInteger, isPresenceFresh, isValidId, isValidRoomId, mergeUpdates2 as mergeUpdates, observeExternalSession, packageAdapter, presenceToCursors, registerTeardown, removeAwarenessStatesLocally, restoreSnapshot, roomUrl, sanitizeAvatarUrl, sanitizeCanvasPayload, sanitizeColor, sanitizeIdentity, sanitizeIndex, sanitizeRole, sanitizeUserName, shouldAutoFollowBroadcaster, shouldRoomReplaceLoad, stripHtmlTags, toBase64, transportProvider, validateDisplayName, validateRoomId, validateUpdate };
+export { BROADCAST_THROTTLE_MS, BoundedMap, COLLABORATION_ROLES, COLLAB_LEAVE_MESSAGE, CONNECTION_TIMEOUT_MS, CURSOR_PALETTE, DEFAULT_COLOR, DEFAULT_MAX_PACKAGE_BYTES, DEPARTURE_CHANNEL, Emitter, INITIAL_SYNC_GRACE_MS, IdempotencyCache, LEGACY_PPTX_DEPARTURE_CHANNEL, LEGACY_PPTX_LEAVE_MESSAGE, LOCAL_ORIGIN, MAX_LABEL_CHARS, MAX_UPDATE_BYTES, MESSAGE_AWARENESS, MESSAGE_QUERY_AWARENESS, MESSAGE_SYNC, PRESENCE_FIELD, PRESENCE_HEARTBEAT_MS, STALE_PRESENCE_MS, SequenceTracker, adaptYjsProvider, applyUpdateSafe, asSelectionIds, assignUserColor, bindDocument, borrowAwareness, buildRoster, canBroadcast, canWrite, clampCoordinate, classifyVersion, clearLocalAwareness, createAssetSync, createBroadcastTransport, createClientId, createCollabSession, createDepartureChannel, createIdGenerator, createMemoryHub, createPresencePublisher, createSyncGate, createTransportProvider, createWebSocketTransport, deriveCanvasPresence, derivePresence, encodeDiff, encodeSnapshot, encodeStateVector2 as encodeStateVector, formatCursorLabel, freezeDeep, fromBase64, getUserInitials, isMixedContentBlocked, isNonNegativeSafeInteger, isPresenceFresh, isValidId, isValidRoomId, mergeUpdates2 as mergeUpdates, observeExternalSession, packageAdapter, presenceToCursors, randomToken, registerTeardown, removeAwarenessStatesLocally, restoreSnapshot, roomUrl, sanitizeAvatarUrl, sanitizeCanvasPayload, sanitizeColor, sanitizeIdentity, sanitizeIndex, sanitizeRole, sanitizeUserName, shouldAutoFollowBroadcaster, shouldRoomReplaceLoad, stripHtmlTags, toBase64, transportProvider, validateDisplayName, validateRoomId, validateUpdate };

package/dist/crypto/index.cjs

@@ -3210,15 +3210,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/crypto/index.mjs

@@ -3208,15 +3208,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/diagram/index.cjs

@@ -22539,15 +22539,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/diagram/index.mjs

@@ -22537,15 +22537,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/docx/embedded.cjs

@@ -35,15 +35,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/docx/embedded.mjs

@@ -29,15 +29,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/docx/index.cjs

@@ -35,15 +35,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;
@@ -26938,7 +26957,7 @@ function shapeSvg(spec, widthPx, heightPx, theme) {
     spec.flipH || spec.flipV ? `translate(${spec.flipH ? w : 0} ${spec.flipV ? h : 0}) scale(${spec.flipH ? -1 : 1} ${spec.flipV ? -1 : 1})` : ""
   ].filter(Boolean).join(" ");
   const label = escapeXml(lookupPresetShape(spec.preset) ? spec.preset : "Shape");
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform2 ? ` transform="${transform2}"` : ""}>${paths}${text3}</g></svg>`;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform2 ? ` transform="${escapeXml(transform2)}"` : ""}>${paths}${text3}</g></svg>`;
 }
 
 exports.CHART_GRAPHIC_URI = CHART_GRAPHIC_URI;

package/dist/docx/index.mjs

@@ -29,15 +29,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;
@@ -26932,7 +26951,7 @@ function shapeSvg(spec, widthPx, heightPx, theme) {
     spec.flipH || spec.flipV ? `translate(${spec.flipH ? w : 0} ${spec.flipV ? h : 0}) scale(${spec.flipH ? -1 : 1} ${spec.flipV ? -1 : 1})` : ""
   ].filter(Boolean).join(" ");
   const label = escapeXml(lookupPresetShape(spec.preset) ? spec.preset : "Shape");
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform2 ? ` transform="${transform2}"` : ""}>${paths}${text3}</g></svg>`;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform2 ? ` transform="${escapeXml(transform2)}"` : ""}>${paths}${text3}</g></svg>`;
 }
 
 export { CHART_GRAPHIC_URI, CHART_NOTICE, DEFAULT_DRAWN_SHAPE, DEFAULT_SHAPE_FILL, DEFAULT_SHAPE_LINE, DEFAULT_SHAPE_LINE_EMU, DEFAULT_STYLES_XML, DEFAULT_TABLE_BORDERS, DEFAULT_TOC_INSTRUCTION, DIAGRAM_GRAPHIC_URI, DocxModelValidationError, EMPTY_FIGURES_TEXT, EMPTY_TOC_TEXT, EMU_PER_INCH, EMU_PER_PIXEL, EMU_PER_POINT, LIGATURE_VALUES, PAGE_SIZES, PAGE_SIZE_OPTIONS, PIXELS_PER_INCH, PROPERTY_FIELDS, SHAPE_PALETTE, SHAPE_PALETTE_NAMES, ST_AlgClass, ST_AlgType, ST_AnnotationVMerge, ST_Border, ST_BrClear, ST_BrType, ST_CalendarType, ST_CaptionPos, ST_ChapterSep, ST_CharacterSpacing, ST_CombineBrackets, ST_ConformanceClass, ST_CryptProv, ST_Direction, ST_DisplacedByCustomXml, ST_DocGrid, ST_DocPartBehavior, ST_DocPartGallery, ST_DocPartType, ST_DocProtect, ST_DropCap, ST_EdGrp, ST_EdnPos, ST_Em, ST_FFTextType, ST_FldCharType, ST_FontFamily, ST_FrameLayout, ST_FrameScrollbar, ST_FtnEdn, ST_FtnPos, ST_HAnchor, ST_HdrFtr, ST_HeightRule, ST_HexColorAuto, ST_HighlightColor, ST_Hint, ST_InfoTextType, ST_Jc, ST_JcTable, ST_LevelSuffix, ST_LineNumberRestart, ST_LineSpacingRule, ST_Lock, ST_MailMergeDest, ST_MailMergeDocType, ST_MailMergeOdsoFMDFieldType, ST_MailMergeSourceType, ST_Merge, ST_MultiLevelType, ST_NumberFormat, ST_ObjectDrawAspect, ST_ObjectUpdateMode, ST_OnOff1, ST_PTabAlignment, ST_PTabLeader, ST_PTabRelativeTo, ST_PageBorderDisplay, ST_PageBorderOffset, ST_PageBorderZOrder, ST_PageOrientation, ST_Pitch, ST_Proof, ST_ProofErr, ST_RelFromH, ST_RelFromV, ST_RestartNumber, ST_RubyAlign, ST_SchemeColorVal, ST_SdtDateMappingType, ST_SectionMark, ST_Shd, ST_StyleSort, ST_StyleType, ST_TabJc, ST_TabTlc, ST_TargetScreenSz, ST_TblLayoutType, ST_TblOverlap, ST_TblStyleOverrideType, ST_TblWidth, ST_TextAlignment, ST_TextDirection, ST_TextEffect, ST_TextboxTightWrap, ST_Theme, ST_ThemeColor, ST_TrueFalse, ST_TrueFalseBlank, ST_Underline, ST_VAnchor, ST_VerticalAlignRun, ST_VerticalJc, ST_View, ST_WmlColorSchemeIndex, ST_Wrap, ST_XAlign, ST_YAlign, ST_Zoom, TWIPS_PER_INCH, TWIPS_PER_POINT, WORD, WORD_HIGHLIGHT_TOKENS, WORD_UNDERLINE_TOKENS, acceptAllRevisions, acceptRevision, alignFromJustification, applyPageSetup, applyThemeShade, applyThemeTint, assertValidDocumentModel, buildTableOfContents, canDeleteControl, canEditControlContent, captionParagraphs, cellSourceBlocks, changeColumnGap, changeColumnWidth, chartsIn, checkboxState, columnPreset, columnTextWidth, computeListLabels, controlDate, createDocument, createListDefinition, dateFieldResult, datePicture, defaultPlaceholder, defaultStyleCatalogs, diagramColorTheme, diagramsIn, displayListLabel, documentStats, docxChartPaint, eighthPoints, eighthPointsFromPoints, eighthPointsToPoints, emu, emuFromPixels, emuToPixels, ensureListDefinition, enumValue, equalColumnDraft, fieldName, findRevision, findTableOfContents, formatListNumber, formatNoteNumber, formatWordDate, fullDateOf, halfPoints, halfPointsFromPoints, halfPointsToPoints, headingLevel, headingListLevels, isCaptionOf, isDirectionalPreset, isFieldLocked, isHeadingListKind, isLigatures, isLinePreset, isRunHiddenForReview, isStAlgClass, isStAlgType, isStAnnotationVMerge, isStBorder, isStBrClear, isStBrType, isStCalendarType, isStCaptionPos, isStChapterSep, isStCharacterSpacing, isStCombineBrackets, isStConformanceClass, isStCryptProv, isStDirection, isStDisplacedByCustomXml, isStDocGrid, isStDocPartBehavior, isStDocPartGallery, isStDocPartType, isStDocProtect, isStDropCap, isStEdGrp, isStEdnPos, isStEm, isStFFTextType, isStFldCharType, isStFontFamily, isStFrameLayout, isStFrameScrollbar, isStFtnEdn, isStFtnPos, isStHAnchor, isStHdrFtr, isStHeightRule, isStHexColorAuto, isStHighlightColor, isStHint, isStInfoTextType, isStJc, isStJcTable, isStLevelSuffix, isStLineNumberRestart, isStLineSpacingRule, isStLock, isStMailMergeDest, isStMailMergeDocType, isStMailMergeOdsoFMDFieldType, isStMailMergeSourceType, isStMerge, isStMultiLevelType, isStNumberFormat, isStObjectDrawAspect, isStObjectUpdateMode, isStOnOff1, isStPTabAlignment, isStPTabLeader, isStPTabRelativeTo, isStPageBorderDisplay, isStPageBorderOffset, isStPageBorderZOrder, isStPageOrientation, isStPitch, isStProof, isStProofErr, isStRelFromH, isStRelFromV, isStRestartNumber, isStRubyAlign, isStSchemeColorVal, isStSdtDateMappingType, isStSectionMark, isStShd, isStStyleSort, isStStyleType, isStTabJc, isStTabTlc, isStTargetScreenSz, isStTblLayoutType, isStTblOverlap, isStTblStyleOverrideType, isStTblWidth, isStTextAlignment, isStTextDirection, isStTextEffect, isStTextboxTightWrap, isStTheme, isStThemeColor, isStTrueFalse, isStTrueFalseBlank, isStUnderline, isStVAnchor, isStVerticalAlignRun, isStVerticalJc, isStView, isStWmlColorSchemeIndex, isStWrap, isStXAlign, isStYAlign, isStZoom, isThemeColorToken, isValidLanguageTag, isWordHighlightToken, isWordUnderlineStyle, lineSpacingLabel, lineSpacingOptions, lineSpacingValue, linkStylesToList, listRevisions, loadDocx, newShape, numberNotesInOrder, onOffAttribute, onOffElement, pageSizeOf, paragraphTwipsFromAttrs, parseColorSchemeMapping, parseContentControl, parseEighthPoints, parseHalfPoints, parseHexColor, parseInteger, parseJustification, parseLineSpacingValue, parseNumberingCatalog, parseOnOff, parseParagraphStyleCatalog, parseRgbColor, parseRunStyleCatalog, parseSignedHalfPoints, parseSignedTwips, parseTableStyleCatalog, parseTextScale, parseTheme2 as parseTheme, parseTintShade, parseTwips, parseUnsignedInteger, plainText2 as plainText, presetOf, readColumnDraft, readPageSetup, rejectAllRevisions, rejectRevision, reportParseWarning, resolveCellVisuals, resolveDiagramColor, resolveNumberingLevel, resolveParagraphFormatting, resolveParagraphNumbering, resolveRunFormatting, resolveStyleNumbering, resolveTableStyleFormatting, resolveThemeColorReference, resolveThemeColorToken, reviewDocumentFormatting, reviewFormattingWarnings, reviewParagraphFormatting, reviewRunFormatting, roundEighthPoints, roundEmu, roundHalfPoints, roundSignedTwips, roundTwips, saveDocx, sectionLayoutJson, sectionsFromLayout, sectionsOf, selectListItem, setColumns, setControlDate, setLineNumbering, setListStartOverride, setMargins, setOrientation, setPageNumbering, setPageSize, setTitlePage, setVerticalAlign, shapeAppearance, shapeColorCss, shapeSvg, shapeTextColor, signedTwips, signedTwipsAttr, signedTwipsFromPixels, signedTwipsFromPoints, tableOfFiguresInstruction, themeCatalogColorScheme, tocBookmarks, tocCaptionLabel, tocEntries, tocHyperlinks, tocLevels, toggleCheckbox, transformCase, twips, twipsAttr, twipsFromInches, twipsFromPixels, twipsFromPoints, twipsToInches, twipsToPixels, twipsToPoints, unequalColumnPreset, universalMeasureToTwips, updateTableOfContents, validColumnDraft, validateDocumentModel, validatePageSetup, withParseWarnings, withSection, withTocBookmarks, withValue };

package/dist/docx/layout/index.cjs

@@ -12,15 +12,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;
@@ -15310,7 +15329,7 @@ function shapeSvg(spec, widthPx, heightPx, theme) {
     spec.flipH || spec.flipV ? `translate(${spec.flipH ? w : 0} ${spec.flipV ? h : 0}) scale(${spec.flipH ? -1 : 1} ${spec.flipV ? -1 : 1})` : ""
   ].filter(Boolean).join(" ");
   const label = escapeXml(lookupPresetShape(spec.preset) ? spec.preset : "Shape");
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform ? ` transform="${transform}"` : ""}>${paths}${text2}</g></svg>`;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform ? ` transform="${escapeXml(transform)}"` : ""}>${paths}${text2}</g></svg>`;
 }
 
 // docx/layout/units.ts

package/dist/docx/layout/index.mjs

@@ -10,15 +10,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;
@@ -15308,7 +15327,7 @@ function shapeSvg(spec, widthPx, heightPx, theme) {
     spec.flipH || spec.flipV ? `translate(${spec.flipH ? w : 0} ${spec.flipV ? h : 0}) scale(${spec.flipH ? -1 : 1} ${spec.flipV ? -1 : 1})` : ""
   ].filter(Boolean).join(" ");
   const label = escapeXml(lookupPresetShape(spec.preset) ? spec.preset : "Shape");
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform ? ` transform="${transform}"` : ""}>${paths}${text2}</g></svg>`;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform ? ` transform="${escapeXml(transform)}"` : ""}>${paths}${text2}</g></svg>`;
 }
 
 // docx/layout/units.ts