Merge remote-tracking branch 'upstream/main' into feat/tiff-image-support

# Conflicts:
#	packages/super-editor/src/core/DocxZipper.js

Author: gpardhivvarma

.github/workflows/ci-sdk.yml

@@ -45,8 +45,8 @@ jobs:
       - name: Generate all artifacts
         run: pnpm run generate:all
 
-      - name: Validate SDK
-        run: node packages/sdk/scripts/sdk-validate.mjs
-
       - name: Build Node SDK
         run: pnpm --prefix packages/sdk/langs/node run build
+
+      - name: Validate SDK
+        run: node packages/sdk/scripts/sdk-validate.mjs

.github/workflows/risk-label.yml .github/workflows/pr-labels.yml.github/workflows/risk-label.yml renamed to .github/workflows/pr-labels.yml

@@ -1,4 +1,4 @@
-name: PR Risk Label
+name: PR Labels
 
 on:
   pull_request:
@@ -85,3 +85,28 @@ jobs:
                 labels: [LABELS[level].name],
               });
             }
+
+      - name: Add community label
+        if: >-
+          github.event.action == 'opened' &&
+          github.event.pull_request.author_association != 'MEMBER' &&
+          github.event.pull_request.author_association != 'OWNER'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const label = { name: 'community', color: '7057ff' };
+
+            try {
+              await github.rest.issues.getLabel({ owner, repo, name: label.name });
+            } catch {
+              await github.rest.issues.createLabel({ owner, repo, ...label });
+            }
+
+            await github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: context.issue.number,
+              labels: [label.name],
+            });

.github/workflows/release-sdk.yml

@@ -82,15 +82,15 @@ jobs:
       - name: Generate all artifacts
         run: pnpm run generate:all
 
-      - name: Validate SDK
-        run: node packages/sdk/scripts/sdk-validate.mjs
-
       # ---------------------------------------------------------------
       # Node SDK
       # ---------------------------------------------------------------
       - name: Build Node SDK
         run: pnpm --prefix packages/sdk/langs/node run build
 
+      - name: Validate SDK
+        run: node packages/sdk/scripts/sdk-validate.mjs
+
       - name: Publish Node SDK
         if: ${{ !inputs.dry-run }}
         run: npm publish --access public --tag latest

.github/workflows/risk-assess.yml

@@ -2,6 +2,7 @@ name: AI Risk Assessment
 
 # Runs AFTER risk-label.yml applies the file-path label.
 # Only triggers for critical/sensitive PRs — low-risk PRs skip AI entirely.
+# Fork PRs skip AI (no access to ANTHROPIC_API_KEY) — file-path label still applies.
 #
 # - Updates the risk label if AI disagrees with file-path classification
 # - Logs full details to workflow output (visible in Actions tab)
@@ -45,27 +46,36 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # Skip AI for low-risk PRs
-      - name: Skip AI for low-risk
-        if: steps.filepath.outputs.level == 'low'
-        run: echo "Low risk — skipping AI assessment"
-
-      # Install Agent SDK (only for non-low PRs)
+      # Skip AI when low-risk or API key unavailable (e.g. fork PRs)
+      - name: Check AI eligibility
+        id: ai
+        run: |
+          if [ "${{ steps.filepath.outputs.level }}" = "low" ]; then
+            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "Skipping AI — low risk"
+          elif [ -z "${{ secrets.ANTHROPIC_API_KEY }}" ]; then
+            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "Skipping AI — no API key (fork PR)"
+          else
+            echo "skip=false" >> $GITHUB_OUTPUT
+          fi
+
+      # Install Agent SDK (only when AI will run)
       - name: Setup Node and Agent SDK
-        if: steps.filepath.outputs.level != 'low'
+        if: steps.ai.outputs.skip != 'true'
         uses: actions/setup-node@v4
         with:
           node-version: 20
 
       - name: Install Agent SDK
-        if: steps.filepath.outputs.level != 'low'
+        if: steps.ai.outputs.skip != 'true'
         run: npm install --prefix .github/scripts @anthropic-ai/claude-agent-sdk
         env:
           NODE_ENV: production
 
       # Layer 2+3: AI assessment
       - name: Run tiered AI assessment
-        if: steps.filepath.outputs.level != 'low'
+        if: steps.ai.outputs.skip != 'true'
         id: assess
         run: node .github/scripts/risk-assess.mjs ${{ env.PR_NUMBER }}
         env:
@@ -77,7 +87,7 @@ jobs:
 
       # Update risk label if AI disagrees with file-path classification
       - name: Update risk label from AI
-        if: steps.filepath.outputs.level != 'low'
+        if: steps.ai.outputs.skip != 'true'
         uses: actions/github-script@v7
         with:
           script: |

.github/workflows/update-contributors.yml

@@ -33,13 +33,10 @@ jobs:
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             PR_NUMBER="${{ inputs.pr_number }}"
             AUTHOR=$(gh api "repos/${{ github.repository }}/pulls/$PR_NUMBER" --jq '.user.login')
-            ASSOCIATION=$(gh api "repos/${{ github.repository }}/pulls/$PR_NUMBER" --jq '.author_association')
           else
             AUTHOR="${{ github.event.pull_request.user.login }}"
-            ASSOCIATION="${{ github.event.pull_request.author_association }}"
           fi
           echo "author=$AUTHOR" >> "$GITHUB_OUTPUT"
-          echo "association=$ASSOCIATION" >> "$GITHUB_OUTPUT"
 
       - name: Check if author is a bot
         id: check-bot
@@ -54,10 +51,10 @@ jobs:
         if: steps.check-bot.outputs.skip == 'false'
         id: check-excluded
         env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
           EXCLUDED_CONTRIBUTORS: ${{ vars.EXCLUDED_CONTRIBUTORS }}
         run: |
           AUTHOR="${{ steps.resolve.outputs.author }}"
-          ASSOCIATION="${{ steps.resolve.outputs.association }}"
 
           # Check if author is in the exclusion list (comma-separated GitHub variable)
           if [[ -n "$EXCLUDED_CONTRIBUTORS" ]] && echo ",$EXCLUDED_CONTRIBUTORS," | grep -qi ",$AUTHOR,"; then
@@ -66,15 +63,15 @@ jobs:
             exit 0
           fi
 
-          # Check if author is a repo member/collaborator via PR author_association
-          # MEMBER = org member, OWNER = repo/org owner, COLLABORATOR = direct collaborator
-          if [[ "$ASSOCIATION" == "MEMBER" || "$ASSOCIATION" == "OWNER" || "$ASSOCIATION" == "COLLABORATOR" ]]; then
-            echo "$AUTHOR is a $ASSOCIATION (skipping)"
+          # Check if author has write access to the repo (more reliable than author_association)
+          PERMISSION=$(gh api "repos/${{ github.repository }}/collaborators/$AUTHOR/permission" --jq '.permission' 2>/dev/null || echo "none")
+          if [[ "$PERMISSION" == "admin" || "$PERMISSION" == "maintain" || "$PERMISSION" == "write" ]]; then
+            echo "$AUTHOR has $PERMISSION access (skipping)"
             echo "skip=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          echo "$AUTHOR is a $ASSOCIATION (not excluded)"
+          echo "$AUTHOR has $PERMISSION access (not excluded)"
           echo "skip=false" >> "$GITHUB_OUTPUT"
 
       - name: Checkout

apps/cli/package.json

@@ -37,6 +37,7 @@
   },
   "devDependencies": {
     "@superdoc/document-api": "workspace:*",
+    "@superdoc/pm-adapter": "workspace:*",
     "@superdoc/super-editor": "workspace:*",
     "@types/bun": "catalog:",
     "@types/node": "catalog:",

apps/cli/scripts/export-sdk-contract.ts

@@ -16,7 +16,7 @@ import { resolve, dirname } from 'node:path';
 import { createHash } from 'node:crypto';
 import { tmpdir } from 'node:os';
 
-import { COMMAND_CATALOG } from '@superdoc/document-api';
+import { COMMAND_CATALOG, INLINE_PROPERTY_REGISTRY } from '@superdoc/document-api';
 
 import { CLI_OPERATION_METADATA } from '../src/cli/operation-params';
 import {
@@ -60,12 +60,35 @@ const INTENT_NAMES = {
   'doc.delete': 'delete_content',
   'doc.blocks.delete': 'delete_block',
   'doc.format.apply': 'format_apply',
-  'doc.format.fontSize': 'format_font_size',
-  'doc.format.fontFamily': 'format_font_family',
-  'doc.format.color': 'format_color',
+  ...Object.fromEntries(
+    INLINE_PROPERTY_REGISTRY.map((entry) => [
+      `doc.format.${entry.key}`,
+      `format_${entry.key.replace(/[A-Z]/g, (char) => `_${char.toLowerCase()}`)}`,
+    ]),
+  ),
   'doc.format.align': 'format_align',
+  'doc.styles.apply': 'styles_apply',
   'doc.create.paragraph': 'create_paragraph',
   'doc.create.heading': 'create_heading',
+  'doc.create.sectionBreak': 'create_section_break',
+  'doc.sections.list': 'list_sections',
+  'doc.sections.get': 'get_section',
+  'doc.sections.setBreakType': 'set_section_break_type',
+  'doc.sections.setPageMargins': 'set_section_page_margins',
+  'doc.sections.setHeaderFooterMargins': 'set_section_header_footer_margins',
+  'doc.sections.setPageSetup': 'set_section_page_setup',
+  'doc.sections.setColumns': 'set_section_columns',
+  'doc.sections.setLineNumbering': 'set_section_line_numbering',
+  'doc.sections.setPageNumbering': 'set_section_page_numbering',
+  'doc.sections.setTitlePage': 'set_section_title_page',
+  'doc.sections.setOddEvenHeadersFooters': 'set_section_odd_even_headers_footers',
+  'doc.sections.setVerticalAlign': 'set_section_vertical_align',
+  'doc.sections.setSectionDirection': 'set_section_direction',
+  'doc.sections.setHeaderFooterRef': 'set_section_header_footer_reference',
+  'doc.sections.clearHeaderFooterRef': 'clear_section_header_footer_reference',
+  'doc.sections.setLinkToPrevious': 'set_section_link_to_previous',
+  'doc.sections.setPageBorders': 'set_section_page_borders',
+  'doc.sections.clearPageBorders': 'clear_section_page_borders',
   'doc.lists.list': 'list_lists',
   'doc.lists.get': 'get_list',
   'doc.lists.insert': 'insert_list',
@@ -85,6 +108,46 @@ const INTENT_NAMES = {
   'doc.query.match': 'query_match',
   'doc.mutations.preview': 'preview_mutations',
   'doc.mutations.apply': 'apply_mutations',
+  'doc.create.table': 'create_table',
+  'doc.tables.convertFromText': 'convert_text_to_table',
+  'doc.tables.delete': 'delete_table',
+  'doc.tables.clearContents': 'clear_table_contents',
+  'doc.tables.move': 'move_table',
+  'doc.tables.split': 'split_table',
+  'doc.tables.convertToText': 'convert_table_to_text',
+  'doc.tables.setLayout': 'set_table_layout',
+  'doc.tables.insertRow': 'insert_table_row',
+  'doc.tables.deleteRow': 'delete_table_row',
+  'doc.tables.setRowHeight': 'set_table_row_height',
+  'doc.tables.distributeRows': 'distribute_table_rows',
+  'doc.tables.setRowOptions': 'set_table_row_options',
+  'doc.tables.insertColumn': 'insert_table_column',
+  'doc.tables.deleteColumn': 'delete_table_column',
+  'doc.tables.setColumnWidth': 'set_table_column_width',
+  'doc.tables.distributeColumns': 'distribute_table_columns',
+  'doc.tables.insertCell': 'insert_table_cell',
+  'doc.tables.deleteCell': 'delete_table_cell',
+  'doc.tables.mergeCells': 'merge_table_cells',
+  'doc.tables.unmergeCells': 'unmerge_table_cells',
+  'doc.tables.splitCell': 'split_table_cell',
+  'doc.tables.setCellProperties': 'set_table_cell_properties',
+  'doc.tables.sort': 'sort_table',
+  'doc.tables.setAltText': 'set_table_alt_text',
+  'doc.tables.setStyle': 'set_table_style',
+  'doc.tables.clearStyle': 'clear_table_style',
+  'doc.tables.setStyleOption': 'set_table_style_option',
+  'doc.tables.setBorder': 'set_table_border',
+  'doc.tables.clearBorder': 'clear_table_border',
+  'doc.tables.applyBorderPreset': 'apply_table_border_preset',
+  'doc.tables.setShading': 'set_table_shading',
+  'doc.tables.clearShading': 'clear_table_shading',
+  'doc.tables.setTablePadding': 'set_table_padding',
+  'doc.tables.setCellPadding': 'set_table_cell_padding',
+  'doc.tables.setCellSpacing': 'set_table_cell_spacing',
+  'doc.tables.clearCellSpacing': 'clear_table_cell_spacing',
+  'doc.tables.get': 'get_table',
+  'doc.tables.getCells': 'get_table_cells',
+  'doc.tables.getProperties': 'get_table_properties',
 } as const satisfies Record<DocBackedCliOpId, string>;
 
 // ---------------------------------------------------------------------------