@bongos/core 1.19.1061 → 1.19.1063

package/modules/copy-desk/tests/copy_docx.mjs

@@ -0,0 +1,347 @@
+// modules/copy-desk/tests/copy_docx.mjs — the Word round trip, pure (task
+// 1004320 / BV2.TW09, ADR 0341 D12).
+//
+// What docx.js must do before any route is involved: write a file Word can
+// open with one tagged paragraph per line; read an upload the way Word stores
+// an edit (runs split across <w:r> elements, proofing marks, smart quotes,
+// tracked changes, a data-descriptor zip); map it back by tag or by position;
+// merge it into a draft without losing a rewrite made after the download; and
+// refuse by name every change of structure. And bound every read of an
+// upload, which is someone else's input.
+//
+// The whole path (the routes, the holder check, the draft block on the task)
+// is tests/copy_desk_page_docx.mjs (root).
+
+import { strict as assert } from 'node:assert';
+import zlib from 'node:zlib';
+import { createRequire } from 'node:module';
+import { unzipAll, wordZip, resave, typeInto, wordRuns, trackedInsert, trackedDelete, stripControls, lineParagraph } from './fixtures/word-docx.mjs';
+
+const require = createRequire(import.meta.url);
+const docx = require('../docx.js');
+const pages = require('../pages.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const L = (key, section, text, placement, row) => ({ key, section, text, placement, ...(row || {}) });
+const READING = {
+  id: 'builders:studio',
+  title: 'Studio',
+  reading_hash: 'h-now',
+  lines: [
+    L('L0001', 'top bar', 'Studio', 'shared', { file: 'shell.js', line: 40, string_id: 'sh01' }),
+    L('L0002', 'greeting', 'Welcome back', 'placed', { file: 'studio.html', line: 12, string_id: 'st02' }),
+    L('L0003', 'greeting', '{…} pages tweaked', 'placed', { file: 'studio.js', line: 88, string_id: 'st03' }),
+    L('L0004', 'greeting', 'Your desk is quiet today', 'unplaced'),
+    L('L0005', 'greeting', 'It\u2019s your turn', 'placed', { file: 'studio.js', line: 90, string_id: 'st05' }),
+    L('L0006', 'footer', 'Resume', 'placed', { file: 'studio.html', line: 99, string_id: 'st06' }),
+    // A section that recurs later on the page gets its heading again.
+    L('L0007', 'greeting', 'Take the next page', 'placed', { file: 'studio.html', line: 120, string_id: 'st07' }),
+  ],
+};
+const download = (draft = null) => docx.composeDownload({ readingPage: READING, title: 'Studio', draft });
+const upload = (buf) => {
+  const u = docx.readUpload(buf);
+  assert.equal(u.ok, true, JSON.stringify(u));
+  return u;
+};
+const roundTrip = (buf, draft = null) => {
+  const u = upload(buf);
+  const m = docx.mapUpload({ readingPage: READING, upload: u });
+  if (!m.ok) return { mapped: m };
+  return { mapped: m, merged: docx.mergeUpload({ readingPage: READING, texts: m.texts, baseline: u.baseline, draft }) };
+};
+const draftOf = (lines) => ({ page_id: READING.id, reading_hash: READING.reading_hash, saved_at: 't', lines });
+
+console.log('copy-desk: the Word round trip');
+
+// ---------------------------------------------------------------------------
+// The zip, both directions, and the bounds on an upload.
+// ---------------------------------------------------------------------------
+
+test('the zip writer and reader agree, and the reader takes a Word-shaped zip (data descriptors)', () => {
+  const entries = [{ name: 'a.xml', data: '<a>é…</a>' }, { name: 'dir/b.xml', data: 'x'.repeat(5000) }];
+  const z = docx.readZip(docx.writeZip(entries));
+  assert.equal(z.ok, true);
+  assert.deepEqual([...z.parts].map(([k, v]) => [k, v.toString('utf8')]), entries.map((e) => [e.name, e.data]));
+  const w = docx.readZip(wordZip([['one.xml', '<one/>'], ['two.xml', 'two'.repeat(99)]]));
+  assert.equal(w.ok, true, JSON.stringify(w));
+  assert.equal(w.parts.get('two.xml').toString(), 'two'.repeat(99));
+  assert.equal(docx.crc32(Buffer.from('123456789')), 0xCBF43926, 'the standard CRC-32 check value');
+});
+
+test('the same page makes the same bytes', () => {
+  assert.equal(Buffer.compare(download(), download()), 0);
+});
+
+test('an upload that is not a zip, or a broken one, is not_a_docx', () => {
+  for (const bad of [Buffer.from('{"lines":[]}'), Buffer.from('PK\u0003\u0004 not really'), Buffer.alloc(0)]) {
+    assert.equal(docx.readUpload(bad).code, 'not_a_docx', bad.toString());
+  }
+  // A flipped byte inside the document part's deflated data fails its CRC (or
+  // its inflate). The first match is the local header's copy of the name.
+  const buf = Buffer.from(download());
+  const at = buf.indexOf('word/document.xml') + 'word/document.xml'.length + 40;
+  buf[at] ^= 0xFF;
+  assert.equal(docx.readUpload(buf).code, 'not_a_docx');
+  // A zip that is not a Word document.
+  assert.equal(docx.readUpload(docx.writeZip([{ name: 'hello.txt', data: 'hi' }])).detail.reason, 'the file has no Word document part');
+});
+
+test('an encrypted entry is refused, never guessed at', () => {
+  const buf = Buffer.from(download());
+  // Set the encryption flag on every central directory entry.
+  for (let i = 0; i < buf.length - 4; i++) if (buf.readUInt32LE(i) === 0x02014b50) buf.writeUInt16LE(buf.readUInt16LE(i + 8) | 1, i + 8);
+  const r = docx.readUpload(buf);
+  assert.equal(r.code, 'not_a_docx');
+  assert.match(r.detail.reason, /encrypted/);
+});
+
+test('a zip bomb stops at the part cap, and an oversized file is refused before it is read', () => {
+  // 9 MB of zeros deflates to a few kilobytes: the declared size is refused,
+  // and a lying declared size is stopped by the inflate cap itself.
+  const zeros = Buffer.alloc(docx.MAX_PART_BYTES + 1024 * 1024);
+  const honest = docx.writeZip([{ name: 'word/document.xml', data: zeros }]);
+  assert.ok(honest.length < 100 * 1024);
+  assert.equal(docx.readUpload(honest).code, 'upload_too_large');
+  const liar = Buffer.from(honest);
+  for (let i = 0; i < liar.length - 4; i++) if (liar.readUInt32LE(i) === 0x02014b50) liar.writeUInt32LE(10, i + 24);
+  assert.equal(docx.readZip(liar).code, 'upload_too_large');
+  assert.equal(docx.readUpload(Buffer.alloc(docx.MAX_UPLOAD_BYTES + 1, 1)).code, 'upload_too_large');
+});
+
+test('a DOCTYPE (an entity expansion) is refused, and entities are not expanded', () => {
+  const doctype = resave(download(), { document: (xml) => xml.replace('<w:document', '<!DOCTYPE d [<!ENTITY x "boom">]><w:document') });
+  assert.equal(docx.readUpload(doctype).code, 'not_a_docx');
+  assert.equal(docx.parseXml('<a>&amp;lt; &#x2019; &unknown;</a>').children[0], '&lt; \u2019 &unknown;');
+});
+
+// ---------------------------------------------------------------------------
+// The download.
+// ---------------------------------------------------------------------------
+
+test('the download: title, a Heading 2 per run of a section, one tagged plain-text control per line', () => {
+  const doc = unzipAll(download()).get('word/document.xml');
+  const paras = [...doc.matchAll(/<w:p>(.*?)<\/w:p>/gs)].map((m) => m[1]);
+  const style = (p) => (/<w:pStyle w:val="([^"]+)"/.exec(p) || [])[1] || null;
+  const text = (p) => [...p.matchAll(/<w:t[^>]*>([^<]*)<\/w:t>/g)].map((m) => m[1]).join('');
+  assert.deepEqual([style(paras[0]), text(paras[0])], ['Title', 'Studio']);
+  assert.equal(style(paras[1]), 'TweakNote');
+  const headings = paras.filter((p) => style(p) === 'Heading2').map(text);
+  assert.deepEqual(headings, ['top bar', 'greeting', 'footer', 'greeting']);
+  const lines = paras.filter((p) => /<w:tag /.test(p));
+  assert.deepEqual(lines.map((p) => /<w:tag w:val="([^"]+)"/.exec(p)[1]), READING.lines.map((l) => l.key));
+  for (const p of lines) assert.match(p, /<w:sdtPr><w:tag w:val="L\d{4}"\/><w:id w:val="\d+"\/><w:text\/><\/w:sdtPr>/, 'a plain-text control');
+  assert.equal(text(lines[4]), 'It\u2019s your turn');
+});
+
+test('shared and unplaced lines carry their own style and a margin comment', () => {
+  const parts = unzipAll(download());
+  const doc = parts.get('word/document.xml');
+  assert.match(lineParagraph(doc, 'L0001'), /<w:pStyle w:val="TweakShared"\/>.*<w:commentReference w:id="0"\/>/s);
+  assert.match(lineParagraph(doc, 'L0004'), /<w:pStyle w:val="TweakUnplaced"\/>.*<w:commentReference w:id="1"\/>/s);
+  assert.doesNotMatch(lineParagraph(doc, 'L0002'), /pStyle|comment/);
+  const comments = [...parts.get('word/comments.xml').matchAll(/<w:comment w:id="(\d)".*?<w:t[^>]*>([^<]*)<\/w:t>/gs)].map((m) => [m[1], m[2]]);
+  assert.deepEqual(comments, [['0', 'changes this on every page'], ['1', 'goes to an engineer']]);
+  assert.match(parts.get('word/styles.xml'), /w:styleId="TweakShared"/);
+  assert.match(parts.get('word/styles.xml'), /w:styleId="Heading2"><w:name w:val="heading 2"\/>/, 'the built-in Heading 2, so Word lists it as one');
+});
+
+test('page_id and reading_hash are custom document properties', () => {
+  const u = upload(download());
+  assert.equal(u.page_id, 'builders:studio');
+  assert.equal(u.reading_hash, 'h-now');
+  assert.match(unzipAll(download()).get('docProps/custom.xml'), /name="page_id"><vt:lpwstr>builders:studio<\/vt:lpwstr>/);
+});
+
+test('the download shows the draft over the reading, and ignores a draft saved on another reading', () => {
+  const draft = draftOf([{ key: 'L0002', section: 'greeting', before: 'Welcome back', after: 'Welcome home', placement: 'placed' }]);
+  assert.equal(upload(download(draft)).baseline.get('L0002'), 'Welcome home');
+  assert.match(unzipAll(download(draft)).get('word/document.xml'), />Welcome home</);
+  const stale = { ...draft, reading_hash: 'h-old' };
+  assert.doesNotMatch(unzipAll(download(stale)).get('word/document.xml'), />Welcome home</);
+});
+
+test('an untouched round trip changes nothing on every line', () => {
+  const { mapped, merged } = roundTrip(download());
+  assert.equal(mapped.mode, 'tag');
+  assert.deepEqual(merged.from_file, []);
+  const resolved = pages.resolveDraft({ readingPage: READING, body: { reading_hash: 'h-now', lines: merged.lines }, savedAt: 't' });
+  assert.deepEqual(resolved.draft.lines, []);
+});
+
+// ---------------------------------------------------------------------------
+// Reading an edit the way Word stores it.
+// ---------------------------------------------------------------------------
+
+test('Word splits one edited line across many runs: the upload reads the whole sentence', () => {
+  const edited = resave(download(), { document: (xml) => typeInto(xml, 'L0002', wordRuns(['Wel', 'come ', 'ho', 'me, ', 'friend'])) });
+  const { merged } = roundTrip(edited);
+  assert.deepEqual(merged.from_file, ['L0002']);
+  assert.equal(merged.lines.find((l) => l.key === 'L0002').after, 'Welcome home, friend');
+});
+
+test('smart quotes: folded back on a line the page writes with straight quotes, kept on one written curly', () => {
+  const edited = resave(download(), {
+    document: (xml) => typeInto(typeInto(xml, 'L0002', wordRuns(['Welcome back, it\u2019s \u201Cyour\u201D desk'])),
+      'L0005', wordRuns(['It\u2019s ', 'your go'])),
+  });
+  const { merged } = roundTrip(edited);
+  const after = (k) => merged.lines.find((l) => l.key === k).after;
+  assert.equal(after('L0002'), 'Welcome back, it\'s "your" desk');
+  assert.equal(after('L0005'), 'It\u2019s your go');
+  // An autocorrect alone (a quote retyped, nothing else) is not a change.
+  const retyped = resave(download(), { document: (xml) => typeInto(xml, 'L0005', wordRuns(['It\'s your turn'])) });
+  assert.deepEqual(roundTrip(retyped).merged.from_file, []);
+});
+
+test('tracked changes read as accepted: an insertion is text, a deletion is not', () => {
+  const edited = resave(download(), {
+    document: (xml) => typeInto(xml, 'L0006', `${wordRuns(['Resume '])}${trackedDelete('now')}${trackedInsert('where you left off')}`),
+  });
+  assert.equal(roundTrip(edited).merged.lines.find((l) => l.key === 'L0006').after, 'Resume where you left off');
+});
+
+test('a tab, a line break and a different namespace prefix still read as the words', () => {
+  const edited = resave(download(), {
+    document: (xml) => typeInto(xml, 'L0002', '<w:r><w:t>Welcome</w:t><w:tab/><w:t>in</w:t><w:br/><w:t>here</w:t></w:r>')
+      .replace(/xmlns:w=/, 'xmlns:ww=').replace(/<(\/?)w:/g, '<$1ww:').replace(/ w:/g, ' ww:'),
+  });
+  assert.equal(roundTrip(edited).merged.lines.find((l) => l.key === 'L0002').after, 'Welcome in here');
+});
+
+// ---------------------------------------------------------------------------
+// The merge.
+// ---------------------------------------------------------------------------
+
+test('the merge keeps a rewrite made in the studio after the download', () => {
+  const file = download(); // shows the page's own text everywhere
+  const edited = resave(file, { document: (xml) => typeInto(xml, 'L0006', wordRuns(['Pick up ', 'where you were'])) });
+  // Since the download, the artist rewrote L0002 in the studio.
+  const draft = draftOf([{ key: 'L0002', section: 'greeting', before: 'Welcome back', after: 'Hello again', placement: 'placed' }]);
+  const { merged } = roundTrip(edited, draft);
+  const after = (k) => merged.lines.find((l) => l.key === k).after;
+  assert.equal(after('L0002'), 'Hello again', 'the file did not touch L0002, so the draft keeps it');
+  assert.equal(after('L0006'), 'Pick up where you were');
+  assert.deepEqual(merged.from_file, ['L0006']);
+  assert.deepEqual(merged.kept_from_draft, ['L0002']);
+});
+
+test('a line changed in Word wins over the draft; without the file\'s baseline the file is the whole state', () => {
+  const draft = draftOf([{ key: 'L0002', section: 'greeting', before: 'Welcome back', after: 'Hello again', placement: 'placed' }]);
+  const edited = resave(download(), { document: (xml) => typeInto(xml, 'L0002', wordRuns(['Hi there'])) });
+  assert.equal(roundTrip(edited, draft).merged.lines.find((l) => l.key === 'L0002').after, 'Hi there');
+  // An editor that drops the custom XML part: every line is what the file says,
+  // so the studio rewrite of L0002 is replaced by the page text the file shows.
+  const noBaseline = resave(download(), { drop: ['customXml/item1.xml'] });
+  const u = upload(noBaseline);
+  assert.equal(u.baseline, null);
+  const { merged } = roundTrip(noBaseline, draft);
+  assert.equal(merged.lines.find((l) => l.key === 'L0002').after, 'Welcome back');
+  assert.deepEqual(merged.from_file, ['L0002']);
+});
+
+// ---------------------------------------------------------------------------
+// Structure changes are refused, by name.
+// ---------------------------------------------------------------------------
+
+const refusal = (buf) => {
+  const { mapped } = roundTrip(buf);
+  assert.equal(mapped.ok, false);
+  assert.equal(mapped.code, 'structure_changed');
+  return mapped.detail.moved;
+};
+
+test('an added paragraph is named by its section and first words', () => {
+  const buf = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0002'); return xml.replace(p, () => `${p}<w:p><w:r><w:t>A brand new line nobody asked for today</w:t></w:r></w:p>`); },
+  });
+  assert.deepEqual(refusal(buf), [{ change: 'added', key: null, section: 'greeting', first_words: 'A brand new line nobody asked…' }]);
+});
+
+test('a dropped line is named by its key, section and first words', () => {
+  const buf = resave(download(), { document: (xml) => xml.replace(lineParagraph(xml, 'L0004'), '') });
+  assert.deepEqual(refusal(buf), [{ change: 'dropped', key: 'L0004', section: 'greeting', first_words: 'Your desk is quiet today' }]);
+});
+
+test('a moved line is named, and only the line that moved', () => {
+  const buf = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0002'); return xml.replace(p, '').replace(lineParagraph(xml, 'L0004'), (q) => `${q}${p}`); },
+  });
+  assert.deepEqual(refusal(buf), [{ change: 'reordered', key: 'L0002', section: 'greeting', first_words: 'Welcome back' }]);
+});
+
+test('a copied control is an added line; two lines joined into one paragraph drop the second', () => {
+  const copied = resave(download(), { document: (xml) => { const p = lineParagraph(xml, 'L0006'); return xml.replace(p, () => `${p}${p}`); } });
+  assert.deepEqual(refusal(copied), [{ change: 'added', key: 'L0006', section: 'footer', first_words: 'Resume' }]);
+  const joined = resave(download(), {
+    document: (xml) => {
+      const a = lineParagraph(xml, 'L0002');
+      const b = lineParagraph(xml, 'L0003');
+      const sdtB = /<w:sdt>.*<\/w:sdt>/s.exec(b)[0];
+      return xml.replace(b, '').replace(a, () => a.replace('</w:p>', `${sdtB}</w:p>`));
+    },
+  });
+  assert.deepEqual(refusal(joined), [{ change: 'dropped', key: 'L0003', section: 'greeting', first_words: '{…} pages tweaked', joined_to: 'L0002' }]);
+});
+
+test('a changed section heading is refused', () => {
+  const buf = resave(download(), { document: (xml) => xml.replace('<w:t xml:space="preserve">footer</w:t>', '<w:t>Footer bits</w:t>') });
+  assert.deepEqual(refusal(buf), [{ change: 'heading_changed', expected: 'footer', found: 'Footer bits' }]);
+});
+
+test('empty paragraphs (spacing) and the title and note are not lines', () => {
+  const buf = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0002'); return xml.replace(p, () => `<w:p/>${p}<w:p><w:r><w:t> </w:t></w:r></w:p>`).replace('>Studio</w:t></w:r></w:p>', '>My studio notes</w:t></w:r></w:p>'); },
+  });
+  const { mapped } = roundTrip(buf);
+  assert.equal(mapped.ok, true, JSON.stringify(mapped.detail));
+});
+
+// ---------------------------------------------------------------------------
+// When every tag is gone: by position.
+// ---------------------------------------------------------------------------
+
+test('with the controls stripped, lines map by position under the same headings', () => {
+  const buf = resave(download(), { document: (xml) => stripControls(typeInto(xml, 'L0006', wordRuns(['Carry ', 'on']))) });
+  assert.doesNotMatch(unzipAll(buf).get('word/document.xml'), /<w:tag /);
+  const { mapped, merged } = roundTrip(buf);
+  assert.equal(mapped.mode, 'position');
+  assert.deepEqual(merged.from_file, ['L0006']);
+  assert.equal(merged.lines.find((l) => l.key === 'L0006').after, 'Carry on');
+});
+
+test('by position, a section with a line more or a line fewer is refused and named', () => {
+  const extra = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0006'); return stripControls(xml.replace(p, () => `${p}<w:p><w:r><w:t>Another line</w:t></w:r></w:p>`)); },
+  });
+  assert.deepEqual(refusal(extra), [{ change: 'added', key: null, section: 'footer', first_words: 'Another line' }]);
+  const fewer = resave(download(), { document: (xml) => stripControls(xml.replace(lineParagraph(xml, 'L0006'), '')) });
+  assert.deepEqual(refusal(fewer), [{ change: 'dropped', key: 'L0006', section: 'footer', first_words: 'Resume' }]);
+  const heading = resave(download(), { document: (xml) => stripControls(xml.replace('<w:t xml:space="preserve">top bar</w:t>', '<w:t>Top</w:t>')) });
+  assert.equal(refusal(heading)[0].change, 'heading_changed');
+});
+
+// ---------------------------------------------------------------------------
+// Every page the inventory reads round-trips untouched.
+// ---------------------------------------------------------------------------
+
+test('every committed page reading round-trips with no change', () => {
+  const readings = require('../../../docs/page-readings.json');
+  for (const p of readings.pages) {
+    const u = docx.readUpload(docx.composeDownload({ readingPage: p, title: p.title, draft: null }));
+    assert.equal(u.ok, true, p.id);
+    const m = docx.mapUpload({ readingPage: p, upload: u });
+    assert.equal(m.ok, true, `${p.id}: ${JSON.stringify(m.detail)}`);
+    assert.deepEqual(docx.mergeUpload({ readingPage: p, texts: m.texts, baseline: u.baseline, draft: null }).from_file, [], p.id);
+  }
+  assert.ok(zlib, 'node:zlib is the only dependency');
+});
+
+console.log(`\ncopy_docx: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/modules/copy-desk/tests/copy_no_cms.mjs

@@ -21,8 +21,9 @@
 // which no renderer reads — and the wording reaches a person only after somebody
 // claims that task and ships the diff. So the four things pinned here are:
 //
-//   * the write surface is EXACTLY the verbs the module defines (seven since
-//     TW08: the page draft and submit write the round TASK, never a row),
+//   * the write surface is EXACTLY the verbs the module defines (eight since
+//     TW09: the page draft, its Word upload and the submit write the round
+//     TASK, never a row),
 //   * no column on copy_desk_flags could hold replacement text,
 //   * nothing in this module writes a file, and
 //   * the ONLY thing that writes a surface file is the applier, it lives outside
@@ -64,7 +65,8 @@ const stripComments = (src) => src
 // reads: pages.js (the page-tweak block format), page-status.js (the derived
 // status, drift and tally) and page-data.js (the read side of the page
 // inventory and readings). They are held to the same two rules as the rest.
-const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'routes/copy-desk.js'];
+// TW09 (task 1004320) added docx.js, the Word round trip over Buffers.
+const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'docx.js', 'routes/copy-desk.js'];
 
 console.log('copy-desk: NO LIVE CMS');
 
@@ -81,6 +83,10 @@ await test('the write surface is exactly the verbs the module defines', () => {
     // flag row whose target is a page id. Neither stores wording.
     'POST /copy-desk/pages/:pageId/asks',
     'POST /copy-desk/pages/:pageId/claim',
+    // TW09 (task 1004320, ADR 0341 D11, D12): the Word upload. It lands in the
+    // round's DRAFT through the autosave's own port call and resolver, never a
+    // row here, a file, or the site.
+    'POST /copy-desk/pages/:pageId/draft.docx',
     // TW08 (task 1004319, ADR 0341 D4, D11): the draft autosave and the
     // submit. Both write the page round's TASK DESCRIPTION through the
     // lifecycle port, the place ADR 0233 lets wording rest; neither writes a
@@ -220,6 +226,29 @@ await test('the draft and the submit write only the round task, through the port
   assert.equal(/\b(before|section|placement|file|string_id)\s*:/.test(schemas), false, 'the draft and submit schemas name no target field');
 });
 
+await test('the Word round trip is pure over Buffers, and its upload writes only the draft, through the port', () => {
+  // docx.js handles an artist's wording like pages.js does, so it is held to
+  // the same shape: its one require is node:zlib (a zip is deflate), and it
+  // reaches no fs, pool or network.
+  const lib = stripComments(read('docx.js'));
+  assert.deepEqual([...lib.matchAll(/require\(\s*'([^']+)'\s*\)/g)].map((m) => m[1]), ['node:zlib'],
+    'docx.js may require node:zlib and nothing else');
+  for (const forbidden of ['fs.', 'pool', 'fetch(']) {
+    assert.equal(lib.includes(forbidden), false, `docx.js must stay pure — it must not reach for ${forbidden}`);
+  }
+  const src = stripComments(read('routes/copy-desk.js'));
+  const start = src.indexOf("router.post('/copy-desk/pages/:pageId/draft.docx'");
+  assert.ok(start >= 0, 'the upload is mounted');
+  const next = src.indexOf('router.', start + 1);
+  const h = src.slice(start, next === -1 ? undefined : next);
+  assert.ok(/lifecycle\.updateHeldTaskDescription\(/.test(h), 'the upload lands on the task via the autosave\'s port call (holder only)');
+  assert.ok(/pages\.resolveDraft\(\{ readingPage,/.test(h), 'the upload is resolved from the reading by the autosave\'s resolver');
+  assert.ok(/pages\.saveDraftInto\(/.test(h), 'the upload writes the draft block through the autosave\'s writer');
+  assert.ok(/readingPageOrFail\(res, pageId\)/.test(h), 'the upload resolves against the page reading');
+  assert.equal(/insertFlag|closeFlag|INSERT INTO|UPDATE |composeBatchBlock|submitPageTweak/i.test(h), false,
+    'the upload writes the draft and nothing else: no row, and never the frozen batch');
+});
+
 await test('the module manifest declares no seam another module could write copy through', () => {
   const manifest = JSON.parse(read('module.json'));
   assert.deepEqual(manifest.provides, [], 'a provided port here would be a copy write path for every other module');

package/modules/copy-desk/tests/fixtures/word-docx.mjs

@@ -0,0 +1,131 @@
+// modules/copy-desk/tests/fixtures/word-docx.mjs — edit a downloaded page .docx
+// the way Word stores an edit (task 1004320 / BV2.TW09, ADR 0341 D12).
+//
+// The Word round-trip tests must not prove the reader against its own writer
+// only. So this fixture re-packs a file the way Word does, with its OWN zip
+// writer (data descriptors after each entry, zero sizes in the local headers,
+// entries in another order), and rewrites a line's paragraph the way Word
+// leaves one after typing: the text split across several runs with their own
+// properties and revision ids, proofing marks between them, smart quotes, and
+// tracked insertions and deletions.
+//
+// Shared by modules/copy-desk/tests/copy_docx.mjs and
+// tests/copy_desk_page_docx.mjs (a fixture, not a test: the runner discovers
+// tests/*.mjs only, not this folder).
+
+import zlib from 'node:zlib';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const docx = require('../../docx.js');
+
+// Every entry of a zip, by the module's own reader (reading is not what these
+// tests doubt; the re-pack below is independent of the module's writer).
+export function unzipAll(buf) {
+  const z = docx.readZip(buf);
+  if (!z.ok) throw new Error(`unzip: ${z.code} ${JSON.stringify(z.detail)}`);
+  return new Map([...z.parts].map(([k, v]) => [k, v.toString('utf8')]));
+}
+
+// Pack entries the way Word writes a .docx: general-purpose flag bit 3 (sizes
+// and CRC in a data descriptor after the data, zeros in the local header),
+// deflated, in the order given.
+export function wordZip(entries) {
+  const out = [];
+  const central = [];
+  let offset = 0;
+  for (const [name, text] of entries) {
+    const data = Buffer.from(text, 'utf8');
+    const packed = zlib.deflateRawSync(data, { level: 6 });
+    const crc = docx.crc32(data);
+    const nameBuf = Buffer.from(name, 'utf8');
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0x0008 | 0x0800, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt16LE(0x6000, 10);
+    local.writeUInt16LE(0x5b3c, 12);
+    local.writeUInt16LE(nameBuf.length, 26);
+    const desc = Buffer.alloc(16);
+    desc.writeUInt32LE(0x08074b50, 0);
+    desc.writeUInt32LE(crc, 4);
+    desc.writeUInt32LE(packed.length, 8);
+    desc.writeUInt32LE(data.length, 12);
+    const c = Buffer.alloc(46);
+    c.writeUInt32LE(0x02014b50, 0);
+    c.writeUInt16LE(45, 4);
+    c.writeUInt16LE(20, 6);
+    c.writeUInt16LE(0x0008 | 0x0800, 8);
+    c.writeUInt16LE(8, 10);
+    c.writeUInt16LE(0x6000, 12);
+    c.writeUInt16LE(0x5b3c, 14);
+    c.writeUInt32LE(crc, 16);
+    c.writeUInt32LE(packed.length, 20);
+    c.writeUInt32LE(data.length, 24);
+    c.writeUInt16LE(nameBuf.length, 28);
+    c.writeUInt32LE(offset, 42);
+    out.push(local, nameBuf, packed, desc);
+    central.push(c, nameBuf);
+    offset += 30 + nameBuf.length + packed.length + 16;
+  }
+  const cd = Buffer.concat(central);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(cd.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...out, cd, end]);
+}
+
+// Re-pack a downloaded file after changing its document part (and optionally
+// other parts), in reverse entry order, the way a save by another program
+// reorders them.
+export function resave(buf, { document, drop = [], parts = {} } = {}) {
+  const all = unzipAll(buf);
+  if (document) all.set('word/document.xml', document(all.get('word/document.xml')));
+  for (const [k, v] of Object.entries(parts)) all.set(k, v);
+  for (const k of drop) all.delete(k);
+  return wordZip([...all].reverse());
+}
+
+// The paragraph that holds a line's content control, as it stands.
+const LINE_PARA = (key) => new RegExp(`<w:p>(?:(?!<w:p>).)*?<w:tag w:val="${key}"/>.*?</w:p>`, 's');
+const LINE_PARA_STYLED = (key) => new RegExp(`<w:p><w:pPr>(?:(?!<w:p>).)*?<w:tag w:val="${key}"/>.*?</w:p>`, 's');
+export function lineParagraph(xml, key) {
+  const m = LINE_PARA_STYLED(key).exec(xml) || LINE_PARA(key).exec(xml);
+  if (!m) throw new Error(`no paragraph for ${key}`);
+  return m[0];
+}
+
+// Replace the runs inside a line's content control with Word-shaped runs.
+export function typeInto(xml, key, runsXml) {
+  const para = lineParagraph(xml, key);
+  const edited = para.replace(/<w:sdtContent>[\s\S]*?<\/w:sdtContent>/, () => `<w:sdtContent>${runsXml}</w:sdtContent>`);
+  return xml.replace(para, () => edited);
+}
+
+// Word's runs for a typed sentence: each part its own run, some with
+// properties and revision ids, proofing marks between them.
+export function wordRuns(parts) {
+  return parts.map((p, i) => {
+    const rPr = i % 2 ? '<w:rPr><w:rFonts w:ascii="Calibri"/><w:lang w:val="en-GB"/></w:rPr>' : '';
+    const proof = i === 1 ? '<w:proofErr w:type="spellStart"/>' : i === 2 ? '<w:proofErr w:type="spellEnd"/>' : '';
+    return `${proof}<w:r w:rsidR="00A1B2C${i}" w:rsidRPr="00D4E5F${i}">${rPr}<w:t xml:space="preserve">${p}</w:t></w:r>`;
+  }).join('');
+}
+
+// A tracked change: the insertion is text now, the deletion is not.
+export function trackedInsert(text) {
+  return `<w:ins w:id="91" w:author="Artist" w:date="2026-09-28T10:00:00Z"><w:r><w:t xml:space="preserve">${text}</w:t></w:r></w:ins>`;
+}
+export function trackedDelete(text) {
+  return `<w:del w:id="92" w:author="Artist" w:date="2026-09-28T10:00:00Z"><w:r><w:delText xml:space="preserve">${text}</w:delText></w:r></w:del>`;
+}
+
+// Remove every content control, keeping its runs: what an editor that does
+// not keep controls leaves behind (the upload then maps by position).
+export function stripControls(xml) {
+  return xml.replace(/<w:sdt><w:sdtPr>[\s\S]*?<\/w:sdtPr><w:sdtContent>([\s\S]*?)<\/w:sdtContent><\/w:sdt>/g, (m, inner) => inner);
+}