reamkit 1.18.0 → 1.20.0

package/dist/esm/core/converter/ream.d.ts

@@ -14,8 +14,10 @@ export interface ReamParseOptions {
     /** Reader registry override; defaults to the built-in docx + xlsx readers. */
     readonly readers?: ReadonlyArray<DocumentReader<SourceDoc>>;
     /**
-     * The user password for an encrypted PDF source (ISO 32000 §7.6). Defaults to
-     * the empty string, which opens the common permissions-only encryption (EP14).
+     * The password an encrypted source is opened with: a PDF's user password
+     * (ISO 32000 §7.6) or an OOXML package's (ECMA-376 §2.3, MS-OFFCRYPTO).
+     * Defaults to the empty string, which opens a PDF's common permissions-only
+     * encryption (EP14); an encrypted OOXML package always names a password.
      */
     readonly password?: string;
 }

package/dist/esm/core/converter/ream.js

@@ -13,8 +13,8 @@ import { writeXlsx } from "../../excel/xlsx-writer.js";
 import { writeHtml } from "../../html/html-writer.js";
 import { writeSvg } from "../../svg/svg-writer.js";
 import { resolveDocxAutoFonts } from "../../word/docx-to-pdf.js";
-import { isCfb, openCfb } from "../ole/cfb.js";
 import { DEFAULT_READERS, resolveFontsViaChain, toFlowDoc } from "./facade.js";
+import { decryptPackage, isEncryptedPackage } from "../crypto/offcrypto.js";
 //#region src/core/converter/ream.ts
 /**
 * The point size Excel's column-width unit is quoted at — its default theme
@@ -77,12 +77,14 @@ var Ream = class Ream {
 	*/
 	static parse(bytes, options = {}) {
 		const readers = options.readers ?? DEFAULT_READERS;
-		const reader = readers.find((r) => r.sniff(bytes));
-		if (!reader) {
-			if (isEncryptedOoxml(bytes)) throw new Error("Password-protected OOXML document (ECMA-376 §2.3 EncryptedPackage) — re-save it without a password");
-			throw new Error(`Unrecognized document format (readers: ${readers.map((r) => r.id).join(", ")})`);
+		let source = bytes;
+		if (isEncryptedPackage(bytes)) {
+			if (options.password === void 0) throw new Error("Password-protected OOXML document (ECMA-376 §2.3 EncryptedPackage) — pass the password as `password`");
+			source = decryptPackage(bytes, options.password);
 		}
-		const { doc, losses } = reader.read(bytes, { password: options.password });
+		const reader = readers.find((r) => r.sniff(source));
+		if (!reader) throw new Error(`Unrecognized document format (readers: ${readers.map((r) => r.id).join(", ")})`);
+		const { doc, losses } = reader.read(source, { password: options.password });
 		const sheet = doc.kind === "sheet" ? doc : void 0;
 		return new Ream(toFlowDoc(doc), sheet, losses, bytes, reader.id);
 	}
@@ -232,13 +234,5 @@ var Ream = class Ream {
 		if (options.strict && losses.length > 0) throw new ConversionLossError(losses[0]);
 	}
 };
-function isEncryptedOoxml(bytes) {
-	if (!isCfb(bytes)) return false;
-	try {
-		return openCfb(bytes).hasStream("EncryptedPackage");
-	} catch {
-		return false;
-	}
-}
 //#endregion
 export { Ream };

package/dist/esm/core/crypto/offcrypto.d.ts

@@ -0,0 +1,16 @@
+/** Thrown when the bytes are encrypted and the password does not open them. */
+export declare class WrongPasswordError extends Error {
+    constructor(message?: string);
+}
+/** Whether the bytes are an OOXML package encrypted per ECMA-376 §2.3. */
+export declare function isEncryptedPackage(bytes: Uint8Array): boolean;
+/**
+ * Decrypt an encrypted OOXML package into the plain OPC zip inside it.
+ *
+ * @param bytes    The compound file (`EncryptionInfo` + `EncryptedPackage`).
+ * @param password The password to open it with.
+ * @returns The decrypted package bytes — an ordinary `.docx`/`.xlsx` zip.
+ * @throws WrongPasswordError when the password fails the document's own
+ * verifier, and Error when the encryption is one this reader does not know.
+ */
+export declare function decryptPackage(bytes: Uint8Array, password: string): Uint8Array;

package/dist/esm/core/crypto/offcrypto.js

@@ -0,0 +1,222 @@
+import { openCfb } from "../ole/cfb.js";
+import { aesCbcDecrypt, aesEcbDecrypt, sha1, sha256, sha384, sha512 } from "./primitives.js";
+//#region src/core/crypto/offcrypto.ts
+/** Thrown when the bytes are encrypted and the password does not open them. */
+var WrongPasswordError = class extends Error {
+	constructor(message = "Wrong password for this document") {
+		super(message);
+		this.name = "WrongPasswordError";
+	}
+};
+/** Whether the bytes are an OOXML package encrypted per ECMA-376 §2.3. */
+function isEncryptedPackage(bytes) {
+	try {
+		const cfb = openCfb(bytes);
+		return cfb.hasStream("EncryptedPackage") && cfb.hasStream("EncryptionInfo");
+	} catch {
+		return false;
+	}
+}
+/**
+* Decrypt an encrypted OOXML package into the plain OPC zip inside it.
+*
+* @param bytes    The compound file (`EncryptionInfo` + `EncryptedPackage`).
+* @param password The password to open it with.
+* @returns The decrypted package bytes — an ordinary `.docx`/`.xlsx` zip.
+* @throws WrongPasswordError when the password fails the document's own
+* verifier, and Error when the encryption is one this reader does not know.
+*/
+function decryptPackage(bytes, password) {
+	const cfb = openCfb(bytes);
+	const info = cfb.readStream("EncryptionInfo");
+	const payload = cfb.readStream("EncryptedPackage");
+	if (!info || !payload) throw new Error("Not an encrypted OOXML package");
+	const v = new DataView(info.buffer, info.byteOffset, info.byteLength);
+	const major = v.getUint16(0, true);
+	const minor = v.getUint16(2, true);
+	if (major === 4 && minor === 4) return agile(info, payload, password);
+	if ((major === 3 || major === 4) && minor === 2) return standard(info, payload, password);
+	throw new Error(`Unsupported OOXML encryption (version ${String(major)}.${String(minor)})`);
+}
+function packageSize(payload) {
+	const v = new DataView(payload.buffer, payload.byteOffset, payload.byteLength);
+	const lo = v.getUint32(0, true);
+	return v.getUint32(4, true) * 4294967296 + lo;
+}
+function standard(info, payload, password) {
+	const v = new DataView(info.buffer, info.byteOffset, info.byteLength);
+	const headerSize = v.getUint32(8, true);
+	const algId = v.getUint32(20, true);
+	const keyBits = v.getUint32(28, true);
+	let at = 12 + headerSize;
+	const saltSize = v.getUint32(at, true);
+	at += 4;
+	const salt = info.subarray(at, at + saltSize);
+	at += saltSize;
+	const encryptedVerifier = info.subarray(at, at + 16);
+	at += 16;
+	const verifierHashSize = v.getUint32(at, true);
+	at += 4;
+	const encryptedVerifierHash = info.subarray(at, at + (verifierHashSize <= 20 ? 32 : 32));
+	if (algId !== 0 && (algId < 26126 || algId > 26128)) throw new Error(`Unsupported OOXML cipher (algId 0x${algId.toString(16)})`);
+	const key = standardKey(password, salt, Math.max(16, Math.floor((keyBits || 128) / 8)));
+	const verifier = aesEcbDecrypt(key, encryptedVerifier);
+	const expected = aesEcbDecrypt(key, encryptedVerifierHash).subarray(0, 20);
+	if (!sameBytes(sha1(verifier), expected)) throw new WrongPasswordError();
+	const plain = aesEcbDecrypt(key, payload.subarray(8));
+	return plain.subarray(0, Math.min(packageSize(payload), plain.length));
+}
+function standardKey(password, salt, keyLength) {
+	let h = sha1(concat(salt, utf16le(password)));
+	const counter = new Uint8Array(4);
+	for (let i = 0; i < 5e4; i++) {
+		new DataView(counter.buffer).setUint32(0, i, true);
+		h = sha1(concat(counter, h));
+	}
+	h = sha1(concat(h, new Uint8Array(4)));
+	return concat(sha1(padded(h, 54)), sha1(padded(h, 92))).subarray(0, keyLength);
+}
+function padded(h, byte) {
+	const buf = new Uint8Array(64).fill(byte);
+	for (let i = 0; i < h.length && i < 64; i++) buf[i] = buf[i] ^ h[i];
+	return buf;
+}
+var BLOCK_VERIFIER_INPUT = Uint8Array.of(254, 167, 210, 118, 59, 75, 158, 121);
+var BLOCK_VERIFIER_VALUE = Uint8Array.of(215, 170, 15, 109, 48, 97, 52, 78);
+var BLOCK_KEY_VALUE = Uint8Array.of(20, 110, 11, 231, 171, 172, 208, 214);
+var SEGMENT = 4096;
+function agile(info, payload, password) {
+	const xml = new TextDecoder().decode(info.subarray(8));
+	const keyData = agileKeyData(attrsOf(xml, "keyData"));
+	const encAttrs = passwordKeyEncryptor(xml);
+	const enc = agileKeyData(encAttrs);
+	const spinCount = Number(encAttrs["spinCount"] ?? "0");
+	const encryptedKeyValue = b64(encAttrs["encryptedKeyValue"] ?? "");
+	const encryptedVerifierHashInput = b64(encAttrs["encryptedVerifierHashInput"] ?? "");
+	const encryptedVerifierHashValue = b64(encAttrs["encryptedVerifierHashValue"] ?? "");
+	const spun = agileSpin(password, enc, spinCount);
+	const keyFor = (block) => agileBlockKey(spun, enc, block);
+	const verifier = decryptAgile(keyFor(BLOCK_VERIFIER_INPUT), enc.saltValue, encryptedVerifierHashInput, enc.cbc);
+	const expected = decryptAgile(keyFor(BLOCK_VERIFIER_VALUE), enc.saltValue, encryptedVerifierHashValue, enc.cbc);
+	const actual = enc.hash(verifier.subarray(0, enc.saltValue.length));
+	if (!sameBytes(actual, expected.subarray(0, actual.length))) throw new WrongPasswordError();
+	const packageKey = decryptAgile(keyFor(BLOCK_KEY_VALUE), enc.saltValue, encryptedKeyValue, enc.cbc).subarray(0, keyData.keyBits / 8);
+	const cipher = payload.subarray(8);
+	const out = new Uint8Array(cipher.length);
+	const counter = new Uint8Array(4);
+	for (let i = 0; i * SEGMENT < cipher.length; i++) {
+		new DataView(counter.buffer).setUint32(0, i, true);
+		const iv = keyData.hash(concat(keyData.saltValue, counter)).subarray(0, keyData.blockSize || 16);
+		const block = cipher.subarray(i * SEGMENT, Math.min((i + 1) * SEGMENT, cipher.length));
+		out.set(decryptAgile(packageKey, iv, block, keyData.cbc), i * SEGMENT);
+	}
+	return out.subarray(0, Math.min(packageSize(payload), out.length));
+}
+function agileSpin(password, enc, spinCount) {
+	let h = enc.hash(concat(enc.saltValue, utf16le(password)));
+	const counter = new Uint8Array(4);
+	for (let i = 0; i < spinCount; i++) {
+		new DataView(counter.buffer).setUint32(0, i, true);
+		h = enc.hash(concat(counter, h));
+	}
+	return h;
+}
+function agileBlockKey(spun, enc, block) {
+	const keyLength = enc.keyBits / 8;
+	const derived = enc.hash(concat(spun, block));
+	if (derived.length >= keyLength) return derived.subarray(0, keyLength);
+	const out = new Uint8Array(keyLength).fill(54);
+	out.set(derived);
+	return out;
+}
+function decryptAgile(key, iv, data, cbc) {
+	if (!cbc) return aesEcbDecrypt(key, data);
+	return aesCbcDecrypt(key, iv.length >= 16 ? iv.subarray(0, 16) : concat(iv, new Uint8Array(16 - iv.length)), data, false);
+}
+var HASHES = new Map([
+	["sha1", sha1],
+	["sha-1", sha1],
+	["sha256", sha256],
+	["sha-256", sha256],
+	["sha384", sha384],
+	["sha-384", sha384],
+	["sha512", sha512],
+	["sha-512", sha512]
+]);
+function agileKeyData(attrs) {
+	const name = (attrs["hashAlgorithm"] ?? "sha512").toLowerCase();
+	const hash = HASHES.get(name);
+	if (!hash) throw new Error(`Unsupported OOXML hash (${name})`);
+	const cipher = (attrs["cipherAlgorithm"] ?? "AES").toUpperCase();
+	if (!cipher.startsWith("AES")) throw new Error(`Unsupported OOXML cipher (${cipher})`);
+	return {
+		saltValue: b64(attrs["saltValue"] ?? ""),
+		blockSize: Number(attrs["blockSize"] ?? "16"),
+		keyBits: Number(attrs["keyBits"] ?? "256"),
+		hash,
+		cbc: (attrs["cipherChaining"] ?? "ChainingModeCBC") !== "ChainingModeECB"
+	};
+}
+function passwordKeyEncryptor(xml) {
+	const re = /<[A-Za-z0-9]*:?encryptedKey\b([^>]*)\/?>/gu;
+	let m = re.exec(xml);
+	while (m) {
+		const attrs = parseAttrs(m[1] ?? "");
+		if (attrs["spinCount"] !== void 0) return attrs;
+		m = re.exec(xml);
+	}
+	throw new Error("No password key encryptor in the encryption descriptor");
+}
+function attrsOf(xml, tag) {
+	const m = new RegExp(`<[A-Za-z0-9]*:?${tag}\\b([^>]*)/?>`, "u").exec(xml);
+	return m ? parseAttrs(m[1] ?? "") : {};
+}
+function parseAttrs(raw) {
+	const out = {};
+	const re = /([A-Za-z0-9_:]+)\s*=\s*"([^"]*)"/gu;
+	let m = re.exec(raw);
+	while (m) {
+		out[m[1].replace(/^.*:/u, "")] = m[2];
+		m = re.exec(raw);
+	}
+	return out;
+}
+function utf16le(s) {
+	const out = new Uint8Array(s.length * 2);
+	const v = new DataView(out.buffer);
+	for (let i = 0; i < s.length; i++) v.setUint16(i * 2, s.charCodeAt(i), true);
+	return out;
+}
+function concat(a, b) {
+	const out = new Uint8Array(a.length + b.length);
+	out.set(a);
+	out.set(b, a.length);
+	return out;
+}
+function sameBytes(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function b64(s) {
+	const clean = s.replace(/[^A-Za-z0-9+/]/gu, "");
+	const out = new Uint8Array(Math.floor(clean.length * 3 / 4));
+	let acc = 0;
+	let bits = 0;
+	let at = 0;
+	for (const ch of clean) {
+		const v = B64.indexOf(ch);
+		if (v < 0) continue;
+		acc = acc << 6 | v;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			out[at++] = acc >> bits & 255;
+		}
+	}
+	return out.subarray(0, at);
+}
+//#endregion
+export { decryptPackage, isEncryptedPackage };

package/dist/esm/{pdf-reader/crypto.d.ts → core/crypto/primitives.d.ts}

@@ -5,8 +5,18 @@
 export declare function rc4(key: Uint8Array, data: Uint8Array): Uint8Array;
 /** MD5 digest (RFC 1321) → 16 bytes; the key-derivation hash for V1/V2/V4. */
 export declare function md5(input: Uint8Array): Uint8Array;
+/**
+ * SHA-1. Used by MS-OFFCRYPTO's standard encryption for its key derivation and
+ * password verifier, and by agile encryption when the descriptor names it.
+ */
+export declare function sha1(input: Uint8Array): Uint8Array;
 export declare function sha256(input: Uint8Array): Uint8Array;
 export declare function sha512(input: Uint8Array): Uint8Array;
 export declare function sha384(input: Uint8Array): Uint8Array;
 export declare function aesCbcDecrypt(key: Uint8Array, iv: Uint8Array, data: Uint8Array, stripPad: boolean): Uint8Array;
+/**
+ * AES-ECB decrypt — every block on its own key, no chaining. MS-OFFCRYPTO's
+ * standard encryption uses it for both the verifier and the package.
+ */
+export declare function aesEcbDecrypt(key: Uint8Array, data: Uint8Array): Uint8Array;
 export declare function aesCbcEncrypt(key: Uint8Array, iv: Uint8Array, data: Uint8Array): Uint8Array;

package/dist/esm/{pdf-reader/crypto.js → core/crypto/primitives.js}

@@ -1,4 +1,4 @@
-//#region src/pdf-reader/crypto.ts
+//#region src/core/crypto/primitives.ts
 /**
 * RC4 stream cipher (§7.6.2). Symmetric, so the same call both encrypts and
 * decrypts; used by the legacy V1/V2/V4 Standard security handlers.
@@ -217,6 +217,58 @@ var SHA256_K = [
 	3204031479,
 	3329325298
 ];
+/**
+* SHA-1. Used by MS-OFFCRYPTO's standard encryption for its key derivation and
+* password verifier, and by agile encryption when the descriptor names it.
+*/
+function sha1(input) {
+	const ml = input.length * 8;
+	const withPad = new Uint8Array((input.length + 8 >> 6 << 6) + 64);
+	withPad.set(input);
+	withPad[input.length] = 128;
+	const view = new DataView(withPad.buffer);
+	view.setUint32(withPad.length - 4, ml >>> 0, false);
+	view.setUint32(withPad.length - 8, Math.floor(ml / 4294967296), false);
+	let h0 = 1732584193;
+	let h1 = 4023233417;
+	let h2 = 2562383102;
+	let h3 = 271733878;
+	let h4 = 3285377520;
+	const w = new Uint32Array(80);
+	for (let off = 0; off < withPad.length; off += 64) {
+		for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4, false);
+		for (let i = 16; i < 80; i++) {
+			const x = w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16];
+			w[i] = x << 1 | x >>> 31;
+		}
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		for (let i = 0; i < 80; i++) {
+			const [f, k] = i < 20 ? [b & c | ~b & d, 1518500249] : i < 40 ? [b ^ c ^ d, 1859775393] : i < 60 ? [b & c | b & d | c & d, 2400959708] : [b ^ c ^ d, 3395469782];
+			const t = (a << 5 | a >>> 27) + f + e + k + w[i] >>> 0;
+			e = d;
+			d = c;
+			c = (b << 30 | b >>> 2) >>> 0;
+			b = a;
+			a = t;
+		}
+		h0 = h0 + a >>> 0;
+		h1 = h1 + b >>> 0;
+		h2 = h2 + c >>> 0;
+		h3 = h3 + d >>> 0;
+		h4 = h4 + e >>> 0;
+	}
+	const out = new Uint8Array(20);
+	new DataView(out.buffer).setUint32(0, h0, false);
+	new DataView(out.buffer).setUint32(4, h1, false);
+	new DataView(out.buffer).setUint32(8, h2, false);
+	new DataView(out.buffer).setUint32(12, h3, false);
+	new DataView(out.buffer).setUint32(16, h4, false);
+	return out;
+}
 function sha256(input) {
 	const h = [
 		1779033703,
@@ -275,7 +327,6 @@ function sha256(input) {
 	for (let i = 0; i < 8; i++) new DataView(out.buffer).setUint32(i * 4, h[i] >>> 0);
 	return out;
 }
-var MASK64 = (1n << 64n) - 1n;
 var SHA512_K = [
 	4794697086780616226n,
 	8158064640168781261n,
@@ -358,62 +409,130 @@ var SHA512_K = [
 	6902733635092675308n,
 	7801388544844847127n
 ];
+var SHA512_KH = new Int32Array(80);
+var SHA512_KL = new Int32Array(80);
+for (let i = 0; i < 80; i++) {
+	SHA512_KH[i] = Number(SHA512_K[i] >> 32n & 4294967295n) | 0;
+	SHA512_KL[i] = Number(SHA512_K[i] & 4294967295n) | 0;
+}
 function sha512Core(iv, input, outLen) {
-	const rotr = (x, n) => (x >> n | x << 64n - n) & MASK64;
-	const h = [...iv];
+	const hh = new Int32Array(8);
+	const hl = new Int32Array(8);
+	for (let i = 0; i < 8; i++) {
+		hh[i] = Number(iv[i] >> 32n & 4294967295n) | 0;
+		hl[i] = Number(iv[i] & 4294967295n) | 0;
+	}
 	const len = input.length;
 	const blocks = (len + 16 >> 7) + 1;
 	const msg = new Uint8Array(blocks * 128);
 	msg.set(input);
 	msg[len] = 128;
-	let bitLen = BigInt(len) * 8n;
-	for (let i = 0; i < 16; i++) {
-		msg[msg.length - 1 - i] = Number(bitLen & 255n);
-		bitLen >>= 8n;
-	}
-	const w = new Array(80);
+	const view = new DataView(msg.buffer);
+	const bits = len * 8;
+	view.setUint32(msg.length - 4, bits >>> 0, false);
+	view.setUint32(msg.length - 8, Math.floor(bits / 4294967296), false);
+	const wh = new Int32Array(80);
+	const wl = new Int32Array(80);
 	for (let off = 0; off < msg.length; off += 128) {
 		for (let i = 0; i < 16; i++) {
-			let v = 0n;
-			for (let b = 0; b < 8; b++) v = v << 8n | BigInt(msg[off + i * 8 + b]);
-			w[i] = v;
+			wh[i] = view.getInt32(off + i * 8, false);
+			wl[i] = view.getInt32(off + i * 8 + 4, false);
 		}
 		for (let i = 16; i < 80; i++) {
-			const s0 = rotr(w[i - 15], 1n) ^ rotr(w[i - 15], 8n) ^ w[i - 15] >> 7n;
-			const s1 = rotr(w[i - 2], 19n) ^ rotr(w[i - 2], 61n) ^ w[i - 2] >> 6n;
-			w[i] = w[i - 16] + s0 + w[i - 7] + s1 & MASK64;
+			const x15h = wh[i - 15];
+			const x15l = wl[i - 15];
+			const s0h = (x15h >>> 1 | x15l << 31) ^ (x15h >>> 8 | x15l << 24) ^ x15h >>> 7;
+			const s0l = (x15l >>> 1 | x15h << 31) ^ (x15l >>> 8 | x15h << 24) ^ (x15l >>> 7 | x15h << 25);
+			const x2h = wh[i - 2];
+			const x2l = wl[i - 2];
+			const s1h = (x2h >>> 19 | x2l << 13) ^ (x2l >>> 29 | x2h << 3) ^ x2h >>> 6;
+			const s1l = (x2l >>> 19 | x2h << 13) ^ (x2h >>> 29 | x2l << 3) ^ (x2l >>> 6 | x2h << 26);
+			let lo = (wl[i - 16] >>> 0) + (s0l >>> 0);
+			let hi = (wh[i - 16] >>> 0) + (s0h >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (wl[i - 7] >>> 0);
+			hi = hi + (wh[i - 7] >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (s1l >>> 0);
+			hi = hi + (s1h >>> 0) + (lo > 4294967295 ? 1 : 0);
+			wh[i] = hi | 0;
+			wl[i] = lo | 0;
 		}
-		let [a, b, c, d, e, f, g, hh] = h;
+		let ah = hh[0];
+		let al = hl[0];
+		let bh = hh[1];
+		let bl = hl[1];
+		let ch = hh[2];
+		let cl = hl[2];
+		let dh = hh[3];
+		let dl = hl[3];
+		let eh = hh[4];
+		let el = hl[4];
+		let fh = hh[5];
+		let fl = hl[5];
+		let gh = hh[6];
+		let gl = hl[6];
+		let xh = hh[7];
+		let xl = hl[7];
 		for (let i = 0; i < 80; i++) {
-			const S1 = rotr(e, 14n) ^ rotr(e, 18n) ^ rotr(e, 41n);
-			const ch = e & f ^ ~e & MASK64 & g;
-			const t1 = hh + S1 + ch + SHA512_K[i] + w[i] & MASK64;
-			const t2 = (rotr(a, 28n) ^ rotr(a, 34n) ^ rotr(a, 39n)) + (a & b ^ a & c ^ b & c) & MASK64;
-			hh = g;
-			g = f;
-			f = e;
-			e = d + t1 & MASK64;
-			d = c;
-			c = b;
-			b = a;
-			a = t1 + t2 & MASK64;
+			const S1h = (eh >>> 14 | el << 18) ^ (eh >>> 18 | el << 14) ^ (el >>> 9 | eh << 23);
+			const S1l = (el >>> 14 | eh << 18) ^ (el >>> 18 | eh << 14) ^ (eh >>> 9 | el << 23);
+			const chh = eh & fh ^ ~eh & gh;
+			const chl = el & fl ^ ~el & gl;
+			const S0h = (ah >>> 28 | al << 4) ^ (al >>> 2 | ah << 30) ^ (al >>> 7 | ah << 25);
+			const S0l = (al >>> 28 | ah << 4) ^ (ah >>> 2 | al << 30) ^ (ah >>> 7 | al << 25);
+			const majh = ah & bh ^ ah & ch ^ bh & ch;
+			const majl = al & bl ^ al & cl ^ bl & cl;
+			let lo = (xl >>> 0) + (S1l >>> 0);
+			let hi = (xh >>> 0) + (S1h >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (chl >>> 0);
+			hi = hi + (chh >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (SHA512_KL[i] >>> 0);
+			hi = hi + (SHA512_KH[i] >>> 0) + (lo > 4294967295 ? 1 : 0);
+			lo = (lo >>> 0) + (wl[i] >>> 0);
+			hi = hi + (wh[i] >>> 0) + (lo > 4294967295 ? 1 : 0);
+			const t1h = hi | 0;
+			const t1l = lo | 0;
+			const lo2 = (S0l >>> 0) + (majl >>> 0);
+			const t2h = (S0h >>> 0) + (majh >>> 0) + (lo2 > 4294967295 ? 1 : 0) | 0;
+			const t2l = lo2 | 0;
+			xh = gh;
+			xl = gl;
+			gh = fh;
+			gl = fl;
+			fh = eh;
+			fl = el;
+			lo = (dl >>> 0) + (t1l >>> 0);
+			eh = (dh >>> 0) + (t1h >>> 0) + (lo > 4294967295 ? 1 : 0) | 0;
+			el = lo | 0;
+			dh = ch;
+			dl = cl;
+			ch = bh;
+			cl = bl;
+			bh = ah;
+			bl = al;
+			lo = (t1l >>> 0) + (t2l >>> 0);
+			ah = (t1h >>> 0) + (t2h >>> 0) + (lo > 4294967295 ? 1 : 0) | 0;
+			al = lo | 0;
 		}
-		h[0] = h[0] + a & MASK64;
-		h[1] = h[1] + b & MASK64;
-		h[2] = h[2] + c & MASK64;
-		h[3] = h[3] + d & MASK64;
-		h[4] = h[4] + e & MASK64;
-		h[5] = h[5] + f & MASK64;
-		h[6] = h[6] + g & MASK64;
-		h[7] = h[7] + hh & MASK64;
+		const add = (i, addH, addL) => {
+			const lo = (hl[i] >>> 0) + (addL >>> 0);
+			hh[i] = (hh[i] >>> 0) + (addH >>> 0) + (lo > 4294967295 ? 1 : 0) | 0;
+			hl[i] = lo | 0;
+		};
+		add(0, ah, al);
+		add(1, bh, bl);
+		add(2, ch, cl);
+		add(3, dh, dl);
+		add(4, eh, el);
+		add(5, fh, fl);
+		add(6, gh, gl);
+		add(7, xh, xl);
+	}
+	const out = new Uint8Array(64);
+	const ov = new DataView(out.buffer);
+	for (let i = 0; i < 8; i++) {
+		ov.setInt32(i * 8, hh[i], false);
+		ov.setInt32(i * 8 + 4, hl[i], false);
 	}
-	const out = new Uint8Array(h.length * 8);
-	h.forEach((v, i) => {
-		for (let b = 7; b >= 0; b--) {
-			out[i * 8 + b] = Number(v & 255n);
-			v >>= 8n;
-		}
-	});
 	return out.slice(0, outLen);
 }
 function sha512(input) {
@@ -559,6 +678,18 @@ function aesCbcDecrypt(key, iv, data, stripPad) {
 	const pad = out[out.length - 1];
 	return pad >= 1 && pad <= 16 && pad <= out.length ? out.subarray(0, out.length - pad) : out;
 }
+/**
+* AES-ECB decrypt — every block on its own key, no chaining. MS-OFFCRYPTO's
+* standard encryption uses it for both the verifier and the package.
+*/
+function aesEcbDecrypt(key, data) {
+	const w = expandKey(key);
+	const nr = key.length / 4 + 6;
+	const blocks = Math.floor(data.length / 16);
+	const out = new Uint8Array(blocks * 16);
+	for (let i = 0; i < blocks; i++) decryptBlock(data.subarray(i * 16, i * 16 + 16), w, nr, out, i * 16);
+	return out;
+}
 function aesCbcEncrypt(key, iv, data) {
 	const w = expandKey(key);
 	const nr = key.length / 4 + 6;
@@ -611,4 +742,4 @@ function mixColumns(s) {
 	}
 }
 //#endregion
-export { aesCbcDecrypt, aesCbcEncrypt, md5, rc4, sha256, sha384, sha512 };
+export { aesCbcDecrypt, aesCbcEncrypt, aesEcbDecrypt, md5, rc4, sha1, sha256, sha384, sha512 };

package/dist/esm/core/document-model/types.d.ts

@@ -992,6 +992,12 @@ export interface ShapeFill {
     readonly kind: ShapeFillKind;
     readonly colorHex?: string;
     readonly gradient?: ShapeGradient;
+    /**
+     * §14.1.2.5 `@type="tile"` — the picture REPEATS at its own size rather than
+     * stretching over the box. A parchment behind a page, a texture behind a
+     * text box: stretched, such a fill is a blur where it should be a pattern.
+     */
+    readonly tiled?: boolean;
     /**
      * §20.1.8.14 `a:blipFill` — the picture painted across the shape's box. A
      * DrawingML picture IS a shape with one of these, which is how a `pic:pic`

package/dist/esm/core/drawingml/colors.js

@@ -69,6 +69,13 @@ function hslToRgb(h, s, l) {
 		b + m
 	];
 }
+function toLinear(c) {
+	return c <= .04045 ? c / 12.92 : Math.pow((c + .055) / 1.055, 2.4);
+}
+function toSrgb(c) {
+	const v = clamp01(c);
+	return v <= .0031308 ? v * 12.92 : 1.055 * Math.pow(v, 1 / 2.4) - .055;
+}
 /**
 * Apply DrawingML colour transforms ({@link ColorMod}s) to a 6-hex value,
 * returning a 6-hex value. `shade`/`tint` scale in RGB; `lumMod`/`lumOff` adjust
@@ -85,13 +92,13 @@ function applyColorMods(hex, mods) {
 	let g = (n >> 8 & 255) / 255;
 	let b = (n & 255) / 255;
 	for (const m of mods) if (m.kind === "shade") {
-		r *= m.val;
-		g *= m.val;
-		b *= m.val;
+		r = toSrgb(toLinear(r) * m.val);
+		g = toSrgb(toLinear(g) * m.val);
+		b = toSrgb(toLinear(b) * m.val);
 	} else if (m.kind === "tint") {
-		r = r * m.val + (1 - m.val);
-		g = g * m.val + (1 - m.val);
-		b = b * m.val + (1 - m.val);
+		r = toSrgb(toLinear(r) * m.val + (1 - m.val));
+		g = toSrgb(toLinear(g) * m.val + (1 - m.val));
+		b = toSrgb(toLinear(b) * m.val + (1 - m.val));
 	} else if (m.kind === "lumMod" || m.kind === "lumOff") {
 		const [h, s, l] = rgbToHsl(r, g, b);
 		const l2 = m.kind === "lumMod" ? l * m.val : clamp01(l + m.val);

package/dist/esm/core/po-helpers.d.ts

@@ -34,6 +34,15 @@ export declare function poAttrLocal(node: PoNode | undefined, name: string): str
 export declare function poIsLocal(node: PoNode | undefined, name: string): boolean;
 /** {@link poAttr} parsed as a finite number, or undefined when absent/non-numeric. */
 export declare function poIntAttr(node: PoNode | undefined, name: string): number | undefined;
+/**
+ * §22.9.2.15 ST_UniversalMeasure — a number with a UNIT (`"28.35pt"`, `"1cm"`)
+ * as twips. Producers write whole page geometries, tab stops and indents this
+ * way; read as a plain number they are nothing at all.
+ *
+ * @param raw The attribute value.
+ * @returns The measure in twips, or undefined when it names no unit.
+ */
+export declare function universalMeasureTwips(raw: string): number | undefined;
 /** Shorthand for the `val` attribute (`@w:val`/…). */
 export declare function poVal(node: PoNode | undefined): string | undefined;
 /**

package/dist/esm/core/po-helpers.js

@@ -76,6 +76,14 @@ var MEASURE_TWIPS = new Map([
 	["cm", 1440 / 2.54],
 	["mm", 144 / 2.54]
 ]);
+/**
+* §22.9.2.15 ST_UniversalMeasure — a number with a UNIT (`"28.35pt"`, `"1cm"`)
+* as twips. Producers write whole page geometries, tab stops and indents this
+* way; read as a plain number they are nothing at all.
+*
+* @param raw The attribute value.
+* @returns The measure in twips, or undefined when it names no unit.
+*/
 function universalMeasureTwips(raw) {
 	const m = /^\s*(-?[0-9]+(?:\.[0-9]+)?)(pt|pc|pi|in|cm|mm)\s*$/iu.exec(raw);
 	if (!m) return void 0;
@@ -134,4 +142,4 @@ function poFindDescendant(node, tag) {
 	}
 }
 //#endregion
-export { poAttr, poAttrLocal, poChildren, poChildrenWith, poFindByPath, poFindDescendant, poFirstChild, poIntAttr, poIs, poIsLocal, poTag, poText, poToggle, poVal };
+export { poAttr, poAttrLocal, poChildren, poChildrenWith, poFindByPath, poFindDescendant, poFirstChild, poIntAttr, poIs, poIsLocal, poTag, poText, poToggle, poVal, universalMeasureTwips };

package/dist/esm/layout/styled-layout.js

@@ -432,7 +432,7 @@ function layoutStyledDocument(body, options) {
 	const commentNotes = options.commentAnnotations && options.comments ? buildCommentNotes(noteAssigned.comments, options.comments) : void 0;
 	const reflowParagraph = (paragraph, width, widths) => layoutParagraphBlock(paragraph, options, fontResources, imageResources, width, widths);
 	return {
-		pages: paginateSections(blocks, sectionCtxs, structBuilder, options.language ?? "en-US", notePlan, bookmarks, reflowParagraph, options.pageBackgroundFill?.imageResource !== void 0 ? imageResources.get(options.pageBackgroundFill.imageResource)?.resourceName : void 0),
+		pages: paginateSections(blocks, sectionCtxs, structBuilder, options.language ?? "en-US", notePlan, bookmarks, reflowParagraph, backgroundImageOf(options, imageResources)),
 		resources: options.resources ?? new ResourceStore(),
 		fontResources,
 		imageResources,
@@ -609,7 +609,7 @@ function balancedColumnHeight(bandHeightPt, colCount, roomPt) {
 /** Total laid-out height of a run of blocks, paragraph spacing included. */
 function blocksHeight(blocks) {
 	return blocks.reduce((sum, b) => {
-		if (b.kind !== "paragraph" && b.kind !== "table" && isOutOfFlowFloat(b.float)) return sum;
+		if (b.kind !== "paragraph" && isOutOfFlowFloat(b.float)) return sum;
 		return sum + (b.kind === "paragraph" ? b.spacingBeforePt + b.heightPt + b.spacingAfterPt : b.heightPt);
 	}, 0);
 }
@@ -1024,7 +1024,12 @@ function layoutShapeBlock(shape, options, fontResources, imageResources, content
 		heightPt = maxHeight;
 	}
 	const fillGradient = shape.fill.kind === "gradient" ? shape.fill.gradient : void 0;
-	const fillImageResourceName = shape.fill.kind === "picture" && shape.fill.imageResource !== void 0 ? imageResources?.get(shape.fill.imageResource)?.resourceName : void 0;
+	const fillImage = shape.fill.kind === "picture" && shape.fill.imageResource !== void 0 ? imageResources?.get(shape.fill.imageResource) : void 0;
+	const fillImageResourceName = fillImage?.resourceName;
+	const fillImageTile = shape.fill.kind === "picture" && shape.fill.tiled === true && fillImage?.prepared ? {
+		widthPt: fillImage.prepared.widthPx * 72 / 96,
+		heightPt: fillImage.prepared.heightPx * 72 / 96
+	} : void 0;
 	const fillColorHex = shape.fill.kind === "solid" ? shape.fill.colorHex : fillGradient ? gradientToSolid(fillGradient) : void 0;
 	const stroke = buildStroke(shape.line);
 	const t = shape.transform;
@@ -1178,6 +1183,7 @@ function layoutShapeBlock(shape, options, fontResources, imageResources, content
 		paths,
 		...markerPaths.length > 0 ? { markerPaths } : {},
 		...fillImageResourceName ? { fillImageResourceName } : {},
+		...fillImageTile ? { fillImageTile } : {},
 		...fillImageResourceName && shape.fill.imageCrop ? { fillImageCrop: shape.fill.imageCrop } : {},
 		...fillColorHex ? { fillColorHex } : {},
 		...fillGradient ? { fillGradient } : {},
@@ -1612,6 +1618,21 @@ function makeChartLabelLine(text, font, sizePt, colorHex) {
 		isLastInParagraph: true
 	};
 }
+/**
+* §17.2.1 — the page background's picture, with the size a TILE of it is drawn
+* at: the picture's own pixels read at 96 dpi, which is the resolution Office
+* measures a picture in.
+*/
+function backgroundImageOf(options, imageResources) {
+	const id = options.pageBackgroundFill?.imageResource;
+	const res = id === void 0 ? void 0 : imageResources.get(id);
+	if (!res?.resourceName || !res.prepared) return void 0;
+	return {
+		name: res.resourceName,
+		widthPt: res.prepared.widthPx * 72 / 96,
+		heightPt: res.prepared.heightPx * 72 / 96
+	};
+}
 function collectImageResources(body, headersFooters, options) {
 	const out = /* @__PURE__ */ new Map();
 	if (!options.resources || options.resources.size === 0) return out;
@@ -1794,20 +1815,38 @@ function emitCellFloat(cf, ctx, frame) {
 	if (float.wrap !== "none") ctx.exclude(float, x, topYUp, cf.block.widthPt, cf.block.heightPt);
 }
 function emitShapeItems(sh, x, bottomYUp, sink, pageHeight, figId) {
-	if (sh.fillImageResourceName) sink.push({
-		type: "image",
-		x: pt(x),
-		y: pt(pageHeight - (bottomYUp + sh.heightPt)),
-		width: pt(sh.widthPt),
-		height: pt(sh.heightPt),
-		imageResourceName: sh.fillImageResourceName,
-		...sh.fillImageCrop ? { crop: sh.fillImageCrop } : {},
-		clip: {
+	if (sh.fillImageResourceName) {
+		const clip = {
 			paths: sh.paths,
 			transform: flipTransform(buildShapeTransform(x, bottomYUp, sh.widthPt, sh.heightPt, sh.rotation60k, sh.flipH, sh.flipV), pageHeight)
-		},
-		...figId !== void 0 ? { structId: figId } : {}
-	});
+		};
+		const fig = figId !== void 0 ? { structId: figId } : {};
+		const tile = sh.fillImageTile;
+		if (tile) for (const item of PageAssembler.tileItems(sh.fillImageResourceName, tile, {
+			x,
+			y: pageHeight - (bottomYUp + sh.heightPt),
+			width: sh.widthPt,
+			height: sh.heightPt
+		})) {
+			if (item.type !== "image") continue;
+			sink.push({
+				...item,
+				clip,
+				...fig
+			});
+		}
+		else sink.push({
+			type: "image",
+			x: pt(x),
+			y: pt(pageHeight - (bottomYUp + sh.heightPt)),
+			width: pt(sh.widthPt),
+			height: pt(sh.heightPt),
+			imageResourceName: sh.fillImageResourceName,
+			...sh.fillImageCrop ? { crop: sh.fillImageCrop } : {},
+			clip,
+			...fig
+		});
+	}
 	if (sh.markerPaths && sh.stroke) sink.push({
 		type: "shape",
 		shape: {
@@ -1906,6 +1945,15 @@ function drawBlocksSequentially(blocks, startX, startY, pageHeight, contentWidth
 	const ordered = blocks.some(isBehind) ? [...blocks.filter(isBehind), ...blocks.filter((b) => !isBehind(b))] : blocks;
 	for (const block of ordered) {
 		if (block.kind === "table") {
+			const anchored = isOutOfFlowFloat(block.float) ? bandAnchor(block.float, block.totalWidthPt, contentWidth, startX) : void 0;
+			if (anchored !== void 0 && block.float) {
+				let rowY = bandAnchorTop(block.float, cursorY, pageHeight, block.heightPt, bandMargins);
+				for (const row of block.rows) {
+					emitRowChunk(out, row, startX + anchored, rowY, pageHeight, block.colCount);
+					rowY -= row.heightPt;
+				}
+				continue;
+			}
 			const tableX = startX + block.xOffsetPt;
 			for (const row of block.rows) {
 				emitRowChunk(out, row, tableX, cursorY, pageHeight, block.colCount);
@@ -3211,9 +3259,67 @@ function alignmentOffset(alignment, lineWidth, available) {
 	if (alignment === "center") return Math.max(0, (available - lineWidth) / 2);
 	return 0;
 }
+/**
+* §17.4.85 `w:vMerge` — a vertical merge is ONE cell, so its continuation rows
+* are painted with the START cell's shading. Word writes the fill on the cell
+* that opens the merge and nothing on the rest; painting only what is written,
+* tdf123104.docx's three-row banner came out a staircase of yellow with white
+* notches where every merged cell continued.
+*/
+function withMergedShading(table, roles) {
+	const columnOf = table.rows.map((row) => {
+		const at = [];
+		let col = row.properties.gridBefore ?? 0;
+		for (const cell of row.cells) {
+			at.push(col);
+			col += Math.max(1, cell.properties.colSpan ?? 1);
+		}
+		return at;
+	});
+	let changed = false;
+	const rows = table.rows.map((row, r) => {
+		const cells = row.cells.map((cell, c) => {
+			const role = roles[r]?.[c] ?? "standalone";
+			if (role !== "middle" && role !== "end") return cell;
+			if (cell.properties.shading?.colorHex) return cell;
+			const col = columnOf[r]?.[c];
+			if (col === void 0) return cell;
+			for (let up = r - 1; up >= 0; up--) {
+				const idx = columnOf[up]?.indexOf(col) ?? -1;
+				if (idx < 0) break;
+				const above = table.rows[up]?.cells[idx];
+				const aboveRole = roles[up]?.[idx] ?? "standalone";
+				if (!above) break;
+				if (aboveRole === "start") {
+					const shading = above.properties.shading;
+					if (!shading?.colorHex) break;
+					changed = true;
+					return {
+						...cell,
+						properties: {
+							...cell.properties,
+							shading
+						}
+					};
+				}
+				if (aboveRole !== "middle") break;
+			}
+			return cell;
+		});
+		return {
+			...row,
+			cells
+		};
+	});
+	return changed ? {
+		...table,
+		rows
+	} : table;
+}
 function layoutTableBlock(table, options, fontResources, imageResources, contentWidth) {
 	const columnWidthsPt = computeColumnWidths(table, options, fontResources, contentWidth);
 	const mergeRoles = table.rows.map((r) => r.cells.map((c) => c.properties.merge ?? "standalone"));
+	table = withMergedShading(table, mergeRoles);
 	const rows = [];
 	const colCount = columnWidthsPt.length;
 	let aboveBordersByCol = [];
@@ -3792,12 +3898,12 @@ var PageAssembler = class PageAssembler {
 	*                         `undefined` when there are none.
 	* @param bookmarkPositions Out-param: bookmark name → its GoTo destination.
 	*/
-	constructor(sectionCtxs, builder, notes, bookmarkPositions, backgroundImageName) {
+	constructor(sectionCtxs, builder, notes, bookmarkPositions, backgroundImage) {
 		this.sectionCtxs = sectionCtxs;
 		this.builder = builder;
 		this.notes = notes;
 		this.bookmarkPositions = bookmarkPositions;
-		this.backgroundImageName = backgroundImageName;
+		this.backgroundImage = backgroundImage;
 		this.ctx = sectionCtxs[0];
 		this.pageStartCtx = this.ctx;
 		this.pageNumber = this.ctx.properties.pageNumberStart ?? 1;
@@ -4305,19 +4411,49 @@ var PageAssembler = class PageAssembler {
 	*
 	* @returns The background items for this page (at most one).
 	*/
+	/**
+	* §14.1.2.5 `@type="tile"` — the picture repeated over a box at its own size,
+	* as image items. A tile is a texture, so its natural size is what makes it
+	* one: stretched over the page it is a blur, and its 128 pixels are 96 points
+	* at the resolution Office measures a picture in.
+	*/
+	static tileItems = (resourceName, natural, box) => {
+		const tw = Math.max(1, natural.widthPt);
+		const th = Math.max(1, natural.heightPt);
+		const cols = Math.min(200, Math.ceil(box.width / tw));
+		const rows = Math.min(200, Math.ceil(box.height / th));
+		const out = [];
+		for (let r = 0; r < rows; r++) for (let c = 0; c < cols; c++) out.push({
+			type: "image",
+			x: pt(box.x + c * tw),
+			y: pt(box.y + r * th),
+			width: pt(tw),
+			height: pt(th),
+			imageResourceName: resourceName
+		});
+		return out;
+	};
 	pageBackgroundItems = () => {
 		const options = this.ctx.options;
 		const w = this.ctx.pageWidth;
 		const h = this.ctx.pageHeight;
 		const fill = options?.pageBackgroundFill;
-		if (fill?.kind === "picture" && this.backgroundImageName !== void 0) return [{
-			type: "image",
-			x: pt(0),
-			y: pt(0),
-			width: pt(w),
-			height: pt(h),
-			imageResourceName: this.backgroundImageName
-		}];
+		if (fill?.kind === "picture" && this.backgroundImage !== void 0) {
+			const bg = this.backgroundImage;
+			return fill.tiled ? PageAssembler.tileItems(bg.name, bg, {
+				x: 0,
+				y: 0,
+				width: w,
+				height: h
+			}) : [{
+				type: "image",
+				x: pt(0),
+				y: pt(0),
+				width: pt(w),
+				height: pt(h),
+				imageResourceName: bg.name
+			}];
+		}
 		if (fill?.kind === "gradient" && fill.gradient) return [{
 			type: "shape",
 			shape: {
@@ -4401,9 +4537,9 @@ var PageAssembler = class PageAssembler {
 		this.balanceHeightPt = 0;
 	};
 };
-function paginateSections(blocks, sectionCtxs, builder, defaultLang = "en-US", notes, bookmarkPositions, reflowParagraph, backgroundImageName) {
+function paginateSections(blocks, sectionCtxs, builder, defaultLang = "en-US", notes, bookmarkPositions, reflowParagraph, backgroundImage) {
 	if (sectionCtxs.length === 0) return [];
-	const asm = new PageAssembler(sectionCtxs, builder, notes, bookmarkPositions, backgroundImageName);
+	const asm = new PageAssembler(sectionCtxs, builder, notes, bookmarkPositions, backgroundImage);
 	const balanceIfEndsContinuous = (fromBlock) => {
 		const here = asm.ctx;
 		const next = sectionCtxs[asm.secIdx + 1];

package/dist/esm/pdf-reader/decrypt.js

@@ -1,5 +1,5 @@
 import { PdfHexString, PdfName, PdfStream } from "../pdf/objects.js";
-import { aesCbcDecrypt, aesCbcEncrypt, md5, rc4, sha256, sha384, sha512 } from "./crypto.js";
+import { aesCbcDecrypt, aesCbcEncrypt, md5, rc4, sha256, sha384, sha512 } from "../core/crypto/primitives.js";
 //#region src/pdf-reader/decrypt.ts
 var PAD = Uint8Array.from([
 	40,

package/dist/esm/word/drawing-parser.js

@@ -838,11 +838,13 @@ function vmlFill(shape, shapeType, resolveImage) {
 	const fillEl = poChildren(shape).find((c) => poIs(c, "v:fill"));
 	if (fillEl && (poAttr(fillEl, "type") === "none" || poAttr(fillEl, "on") === "f")) return { kind: "none" };
 	const base = vmlColor(poAttr(shape, "fillcolor")) ?? (fillEl ? vmlColor(poAttr(fillEl, "color")) : void 0) ?? vmlColor(shapeType ? poAttr(shapeType, "fillcolor") : void 0) ?? "FFFFFF";
-	const fillRelId = fillEl && poAttr(fillEl, "type") === "frame" ? poAttr(fillEl, "r:id") : void 0;
+	const fillType = fillEl ? poAttr(fillEl, "type") : void 0;
+	const fillRelId = fillType === "frame" || fillType === "tile" ? poAttr(fillEl, "r:id") : void 0;
 	const picture = fillRelId !== void 0 ? resolveImage?.(fillRelId) : void 0;
 	if (picture !== void 0) return {
 		kind: "picture",
-		imageResource: picture
+		imageResource: picture,
+		...fillType === "tile" ? { tiled: true } : {}
 	};
 	const gradient = fillEl ? vmlGradient(fillEl, base) : void 0;
 	if (gradient) return {
@@ -1802,6 +1804,7 @@ function fillFromNode(child, resolveColor, resolveImage) {
 		return {
 			kind: "picture",
 			imageResource: resource,
+			...poChildren(child).some((c) => poIs(c, "a:tile")) ? { tiled: true } : {},
 			...crop ? { imageCrop: crop } : {}
 		};
 	}

package/dist/esm/word/paragraph-properties.js

@@ -131,8 +131,8 @@ function parseParagraphProperties(pPr, autoSpacingPt = 0) {
 	}
 	if ("w:ind" in el) {
 		const node = el["w:ind"];
-		const left = parseIntAttr(node, "left");
-		const right = parseIntAttr(node, "right");
+		const left = parseIntAttr(node, "left") ?? parseIntAttr(node, "start");
+		const right = parseIntAttr(node, "right") ?? parseIntAttr(node, "end");
 		const firstLine = parseIntAttr(node, "firstLine");
 		const hanging = parseIntAttr(node, "hanging");
 		if (left !== void 0) out.indentLeft = twipsToPt(left);

package/dist/esm/word/run-properties.js

@@ -1,5 +1,5 @@
 import { halfPtToPt, twipsToPt } from "../core/ir/units.js";
-import { asElement, getAttr, getVal, parseIntAttr, parseToggle } from "./xml-helpers.js";
+import { asElement, getAttr, getVal, parseHalfPointAttr, parseToggle } from "./xml-helpers.js";
 import { shadingFillHex } from "./shading.js";
 //#region src/word/run-properties.ts
 var UNDERLINE_STYLES = new Set([
@@ -81,7 +81,7 @@ function parseRunProperties(rPr) {
 		if (c && /^[0-9A-Fa-f]{6}$/u.test(c)) out.underlineColorHex = c.toUpperCase();
 	}
 	if ("w:sz" in el) {
-		const v = parseIntAttr(el["w:sz"], "val");
+		const v = parseHalfPointAttr(el["w:sz"], "val");
 		if (v !== void 0) out.fontSizePt = halfPtToPt(v);
 	}
 	if ("w:color" in el) {

package/dist/esm/word/xml-helpers.d.ts

@@ -36,6 +36,18 @@ export declare function getVal(node: unknown): string | undefined;
  * @param name The local attribute name.
  * @returns The parsed number, or `undefined` when absent or not finite.
  */
+/**
+ * §17.3.2.38 ST_HpsMeasure — a size in HALF-POINTS, or the same universal
+ * measure with a unit on it ("20pt"). The two units differ by a factor of ten
+ * from the twips a length is written in, so a size is read here rather than
+ * through {@link parseIntAttr}: tdf108408.docx writes `w:sz w:val="20pt"` and
+ * read as twips it set its sample text 200 points tall.
+ *
+ * @param node The element carrying the attribute.
+ * @param name The attribute name.
+ * @returns The size in half-points, or undefined.
+ */
+export declare function parseHalfPointAttr(node: unknown, name: string): number | undefined;
 export declare function parseIntAttr(node: unknown, name: string): number | undefined;
 /**
  * Parse a toggle (boolean) property per ECMA-376 Part 1 §17.17.4:

package/dist/esm/word/xml-helpers.js

@@ -1,3 +1,4 @@
+import { universalMeasureTwips } from "../core/po-helpers.js";
 //#region src/word/xml-helpers.ts
 /**
 * Narrow an arbitrary parsed value to an {@link XmlElement}.
@@ -47,12 +48,31 @@ function getVal(node) {
 * @param name The local attribute name.
 * @returns The parsed number, or `undefined` when absent or not finite.
 */
+/**
+* §17.3.2.38 ST_HpsMeasure — a size in HALF-POINTS, or the same universal
+* measure with a unit on it ("20pt"). The two units differ by a factor of ten
+* from the twips a length is written in, so a size is read here rather than
+* through {@link parseIntAttr}: tdf108408.docx writes `w:sz w:val="20pt"` and
+* read as twips it set its sample text 200 points tall.
+*
+* @param node The element carrying the attribute.
+* @param name The attribute name.
+* @returns The size in half-points, or undefined.
+*/
+function parseHalfPointAttr(node, name) {
+	const v = getAttr(node, name);
+	if (v === void 0) return void 0;
+	const n = Number(v);
+	if (Number.isFinite(n)) return n;
+	const twips = universalMeasureTwips(v);
+	return twips === void 0 ? void 0 : twips / 10;
+}
 function parseIntAttr(node, name) {
 	const v = getAttr(node, name);
 	if (v === void 0) return void 0;
 	const n = Number(v);
-	if (!Number.isFinite(n)) return void 0;
-	return n;
+	if (Number.isFinite(n)) return n;
+	return universalMeasureTwips(v);
 }
 /**
 * Parse a toggle (boolean) property per ECMA-376 Part 1 §17.17.4:
@@ -71,4 +91,4 @@ function parseToggle(node) {
 	return !(v === "false" || v === "0" || v === "off");
 }
 //#endregion
-export { asArray, asElement, getAttr, getVal, parseIntAttr, parseToggle };
+export { asArray, asElement, getAttr, getVal, parseHalfPointAttr, parseIntAttr, parseToggle };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reamkit",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Ream — convert DOCX, XLSX, PPTX and PDF to PDF, SVG, HTML, DOCX and XLSX, built from scratch on the ECMA-376 and ISO 32000 specifications. Parse once, convert anywhere.",
   "license": "MIT",
   "author": "Alex Krassavin <info@reamkit.dev>",