@openpresentation/opf-pptx 0.20.3 → 0.22.0

package/dist/input-safety.js

@@ -0,0 +1,115 @@
+// Internal import safety policy, shared by PPTX and nested workbook/introspection readers.
+// No caller-provided limits and no claim that ZIP CRC/provenance authenticates the source.
+import {unzipSync, Unzip, UnzipInflate} from 'fflate';
+import {OPFPptxError} from './errors.js';
+const MiB=1024*1024;
+export const INPUT_LIMITS=Object.freeze({compressedBytes:64*MiB,members:10000,memberBytes:64*MiB,expandedBytes:256*MiB,xmlBytes:16*MiB,xmlDepth:256,nestedDepth:16});
+const states=new WeakMap();
+const xmlPart=name=>/\.(?:xml|rels)$/i.test(name);
+const invalid=(message,path)=>new OPFPptxError('invalid-pptx',message,path===undefined?{}:{path});
+function limit(name,actual,path){
+ const maximum=INPUT_LIMITS[name];
+ if(actual>maximum)throw new OPFPptxError('pptx-limit-exceeded',`PPTX ${name} exceeds the supported limit (${maximum}).`,{limit:name,maximum,actual,...(path===undefined?{}:{path})});
+}
+function memberName(name){
+ if(typeof name!=='string'||!name||/[\\\x00-\x1f]/.test(name)||name.startsWith('/')||/^[a-z]:/i.test(name)||name.split('/').some((p,i,a)=>p==='.'||p==='..'||p===''&&i!==a.length-1))throw invalid('PPTX contains a noncanonical ZIP member name.',name);
+}
+function checkXml(bytes,path){
+ limit('xmlBytes',bytes.length,path);
+ // Check nesting before any recursive parser/tree walk; skip comments, CDATA and PIs.
+ // Reject DTDs entirely: OOXML parts do not need document entities or external declarations.
+ let text;
+ const encoding=bytes[0]===0xff&&bytes[1]===0xfe?'utf-16le':bytes[0]===0xfe&&bytes[1]===0xff?'utf-16be':'utf-8';
+ try{text=new TextDecoder(encoding,{fatal:true}).decode(bytes);}catch{throw invalid('PPTX XML is not valid encoded text.',path);}
+ const declarations=text.replace(/<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>/g,'');
+ if(/<!DOCTYPE\b|<!ENTITY\b/i.test(declarations))throw invalid('PPTX XML document entities are not supported.',path);
+ const stack=[];
+ // Count broad XML name tokens, including Unicode/namespace names the OOXML parser
+ // accepts. This is a resource preflight, not a replacement XML grammar validator.
+ const tokens=/<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<\/?[^\s<>\/"'=!?]+(?:[^<>"']|"[^"]*"|'[^']*')*>/g;
+ for(const [token]of text.matchAll(tokens)){
+  if(token.startsWith('<?')||token.startsWith('<!'))continue;
+  const name=/^<\/?([^\s<>\/"'=!?]+)/.exec(token)[1];
+  if(token.startsWith('</')){if(stack.pop()!==name)throw invalid('PPTX XML has an unmatched closing element.',path);}
+  else {limit('xmlDepth',stack.length+1,path);if(!/\/\s*>$/.test(token))stack.push(name);}
+ }
+ if(stack.length)throw invalid('PPTX XML has unclosed elements.',path);
+}
+function stateOf(entries){
+ let state=states.get(entries);
+ if(!state){
+  const budget={members:0,expanded:0};state={budget,depth:0,cache:new Map()};
+  for(const [name,bytes]of Object.entries(entries)){
+   memberName(name);if(!(bytes instanceof Uint8Array))throw invalid('PPTX member is not bytes.',name);
+   limit('members',++budget.members,name);limit('memberBytes',bytes.length,name);budget.expanded+=bytes.length;limit('expandedBytes',budget.expanded,name);
+   if(xmlPart(name))checkXml(bytes,name);
+  }
+  states.set(entries,state);
+ }
+ return state;
+}
+export function checkInputEntries(entries){stateOf(entries);return entries;}
+
+export function readInputZip(input,{budget={members:0,expanded:0},depth=0,path}={}){
+ const bytes=input instanceof ArrayBuffer?new Uint8Array(input):input;
+ if(!(bytes instanceof Uint8Array))throw invalid('PPTX input must be a Uint8Array or ArrayBuffer.',path);
+ limit('compressedBytes',bytes.length,path);limit('nestedDepth',depth,path);
+ const metadata=new Map();let declared=0;
+ try{
+  // fflate's central-directory iterator supplies names/sizes without allocating expanded data
+  // when filter always returns false. Do not use its fixed-size inflate output for untrusted data:
+  // a dishonest originalSize can silently truncate a DEFLATE stream in unzipSync.
+  unzipSync(bytes,{filter(file){
+   memberName(file.name);
+   if(metadata.has(file.name))throw invalid('PPTX repeats a ZIP member name.',file.name);
+   limit('members',budget.members+metadata.size+1,file.name);
+   if(!Number.isSafeInteger(file.size)||file.size<0||file.size>bytes.length||!Number.isSafeInteger(file.originalSize)||file.originalSize<0)throw invalid('PPTX has invalid ZIP member sizes.',file.name);
+   if(![0,8].includes(file.compression))throw invalid('PPTX uses an unsupported ZIP compression method.',file.name);
+   limit('memberBytes',file.originalSize,file.name);
+   if(xmlPart(file.name))limit('xmlBytes',file.originalSize,file.name);
+   declared+=file.originalSize;limit('expandedBytes',budget.expanded+declared,file.name);
+   metadata.set(file.name,file);return false;
+  }});
+  const entries=Object.create(null),seen=new Set();let failure;
+  const unzip=new Unzip(file=>{
+   const expected=metadata.get(file.name);
+   if(!expected||seen.has(file.name))throw invalid('PPTX local ZIP members do not match its directory.',file.name);
+   seen.add(file.name);
+   if(file.compression!==expected.compression||file.size!==undefined&&file.size!==expected.size||file.originalSize!==undefined&&file.originalSize!==expected.originalSize)throw invalid('PPTX local and directory sizes or methods disagree.',file.name);
+   let count=0;const chunks=[];
+   file.ondata=(error,chunk,final)=>{
+    if(failure)return;
+    try{
+     if(error)throw error;
+     count+=chunk.length;limit('memberBytes',count,file.name);
+     if(count>expected.originalSize)throw invalid('PPTX expands beyond its declared member size.',file.name);
+     budget.expanded+=chunk.length;limit('expandedBytes',budget.expanded,file.name);
+     chunks.push(chunk);
+     if(final){
+      if(count!==expected.originalSize)throw invalid('PPTX expanded member size differs from its directory.',file.name);
+      const data=new Uint8Array(count);let at=0;for(const part of chunks){data.set(part,at);at+=part.length;}chunks.length=0;
+      if(xmlPart(file.name))checkXml(data,file.name);
+      entries[file.name]=data;
+     }
+    }catch(error){failure=error;}
+   };
+   file.start();
+  });
+  unzip.register(UnzipInflate);
+  // A 4KiB compressed feed bounds an individual inflater emission (~4MiB at DEFLATE's
+  // maximum expansion) before our actual-output counter can reject dishonest metadata.
+  for(let at=0;at<bytes.length;at+=4096){unzip.push(bytes.subarray(at,at+4096),at+4096>=bytes.length);if(failure)throw failure;}
+  if(seen.size!==metadata.size||Object.keys(entries).length!==metadata.size)throw invalid('PPTX ZIP members are missing or incomplete.',path);
+  budget.members+=metadata.size;states.set(entries,{budget,depth,cache:new Map()});return entries;
+ }catch(error){
+  if(error instanceof OPFPptxError)throw error;
+  throw new OPFPptxError('invalid-pptx','PPTX input is not a readable ZIP archive.',{...(path===undefined?{}:{path}),cause:error instanceof Error?error.message:String(error)});
+ }
+}
+export function readNestedInputZip(entries,path){
+ const state=stateOf(entries);
+ const cached=state.cache.get(path),source=entries[path];
+ if(cached?.source===source)return cached.entries;
+ const nested=readInputZip(source,{budget:state.budget,depth:state.depth+1,path});
+ state.cache.set(path,{source,entries:nested});return nested;
+}

package/dist/metric-provenance.js

@@ -1,6 +1,6 @@
 import {XMLParser} from 'fast-xml-parser';
 import {isValidFormat} from './format-check.js';
-import {attachTextTags,decodeTextTag} from './code-provenance.js';
+import {attachTextTags,decodeTextTag,groupUnchanged} from './code-provenance.js';
 
 const TAG='OPF_METRIC_V1',REL='http://schemas.openxmlformats.org/officeDocument/2006/relationships/tags';
 const parser=new XMLParser({ignoreAttributes:false,attributeNamePrefix:'',parseTagValue:false,trimValues:false});
@@ -14,7 +14,7 @@ export function metricManifest(value,layout,group) {
   return {v:1,group,role:'anchor',part:0,line:0,value,parts:layout.parts.map(part=>({role:part.role,visible:part.visible,
     lines:part.fit?.sourceLines.map(({start,end,nextStart,boundary})=>({start,end,nextStart,boundary}))??[]}))};
 }
-export function attachMetricTags(entries,records,descriptions) {return attachTextTags(entries,records,TAG,'opfMetric','metric',{descriptions});}
+export function attachMetricTags(entries,records,descriptions) {return attachTextTags(entries,records,TAG,'opfMetric','metric',{descriptions,signed:true});}
 
 function validateManifest(manifest) {
   if (!isValidFormat({slides:[{metric:manifest.value}]})) throw new Error('Invalid metric source.');
@@ -50,7 +50,7 @@ export function importMetricGroups(shapes,paragraphs,relationships,entries,repor
         const data=decodeTextTag(tag.val);
         if (data.v!==1||typeof data.group!=='string'||!/^\d+$/.test(data.group)) throw new Error('Invalid metric identity.');
         const group=groups.get(data.group)??[];
-        group.push({data,shape,text:(paragraphs[index]??[]).map(p=>p.text).join('\n')});groups.set(data.group,group);
+        group.push({data,shape,index,text:(paragraphs[index]??[]).map(p=>p.text).join('\n')});groups.set(data.group,group);
       } catch {report({code:'invalid-metric-provenance',message:'Invalid metric tags; visible native shapes were retained.'});}
     }
   }
@@ -91,7 +91,7 @@ export function importMetricGroups(shapes,paragraphs,relationships,entries,repor
     for (const item of group) consumed.add(item.shape);
     items.push({shape:anchor.shape,payload:{type:'metric',metric}});
     if (typeChanges.length) report({code:'metric-value-type-changed',message:`Edited numeric ${typeChanges.join(', ')} retained as literal text to avoid discarding spelling or precision.`});
-    report({code:'metric-import-reflow',message:'Metric fields, source boundaries and native text were recovered. Native formatting, positioning, alignment and font theme are not reconstructed; review the reflowed OPF.'});
+    if(!groupUnchanged(group,paragraphs))report({code:'metric-import-reflow',message:'Metric fields, source boundaries and native text were recovered. Native formatting, positioning, alignment and font theme are not reconstructed; review the reflowed OPF.'});
   } catch (error) {report({code:'invalid-metric-provenance',message:`${error.message} Visible native shapes were retained without restoring old source text.`});}
   return {consumed,items};
 }

package/dist/native-body.js

@@ -0,0 +1,147 @@
+// RR-86 opt-in prototype. Native paragraphs trade measured line positions for a
+// single editable body. No source words or per-line recovery tags are stored.
+import {paragraphDirection, resolveTextStyle} from '@openpresentation/opf/composition';
+import {autoNumScheme} from './numbered-list.js';
+
+const FIELDS = new Set(['text', 'items', 'bullets']);
+const RUN_KEYS = new Set(['text', 'bold', 'italic', 'underline', 'strikethrough', 'color', 'fontFamily', 'fontSize', 'lang', 'link']);
+const runsOf = value => typeof value === 'string' ? [{text: value}] : value;
+const ownText = value => Array.isArray(value) ? value.map(run => typeof run === 'string' ? run : run?.text ?? '').join('') : value;
+const richSupported = value => typeof value === 'string' || Array.isArray(value) && value.every(run => typeof run === 'string' || run && typeof run.text === 'string' && Object.keys(run).every(key => RUN_KEYS.has(key)) && (run.link === undefined || /^(https?:|mailto:|tel:)/i.test(run.link)));
+// An LTR deck does not ask core for paragraph directions. Conservatively reject
+// RTL letters anywhere (including an embedded phrase), using core's own script rule.
+const hasRtl = text => [...text].some(char => /\p{L}/u.test(char) && paragraphDirection(char, 'rtl') === 'rtl');
+const escapeXml = value => String(value).replace(/[&<>"']/g, char => ({'&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;'}[char]));
+
+/**
+ * Plan the native bodies of one slide: every text, list or bullets item that can be one editable body, in composition order.
+ * The first is returned with the rest as `others`; the first alone binds to the Body placeholder, each other one is an ordinary
+ * native text box at its region (RR-88). An item that cannot be a native body falls back to measured shapes with a visible diagnostic.
+ */
+export function planNativeBody(slide, geometry, {automatic = false, report = () => {}} = {}) {
+  const candidates = geometry.items.filter(item => FIELDS.has(item.field));
+  const reject = (item, reason) => report({code: 'native-body-fallback', path: item.path, reason,
+    message: `Native body export cannot represent this ${reason.replaceAll('-', ' ')}; the current measured shapes were exported.`});
+  if (!candidates.length) return undefined;
+  if (geometry.groups.length) {
+    candidates.forEach(item => reject(item, 'complex-composition'));
+    return undefined;
+  }
+  const plans = [];
+  for (const item of candidates) {
+    const plan = planOne(item, geometry, automatic, reason => reject(item, reason));
+    if (plan) plans.push(plan);
+  }
+  return plans.length ? {...plans[0], others: plans.slice(1)} : undefined;
+}
+
+function planOne(item, geometry, automatic, reject) {
+  const region = geometry.regions?.find(region => region.name === item.region);
+  if (!/^slides\.\d+\.(?:blocks\.\d+\.|[A-Za-z][A-Za-z0-9+_-]*\.)?(?:text|items|bullets)$/.test(item.path) || !automatic && (!region || region.collapsed || region.content.length !== 1 || region.overflow?.length) || item.frameBox) {
+    reject('complex-composition'); return undefined;
+  }
+  if (item.listColumns?.length > 1) { reject('multi-column'); return undefined; }
+  if (item.text?.overflow) { reject('overflow'); return undefined; }
+  if (geometry.direction === 'rtl' || item.text?.directions?.includes('rtl')) { reject('unsupported-text'); return undefined; }
+  const list = item.field !== 'text';
+  let values, numbering;
+  if (list) {
+    const entries = item.text?.listEntries;
+    if (item.bulletImage || !entries?.length || entries.some(entry => entry.level !== 0 || entry.description) ||
+      item.value.some(entry => entry && !Array.isArray(entry) && typeof entry === 'object' && Object.keys(entry).some(key => key !== 'text' && key !== 'level'))) {
+      reject('unsupported-list'); return undefined;
+    }
+    if (item.payload?.numbering !== undefined) {
+      // One native numbered sequence: every entry has a number of one style and suffix, counting up from the first by one.
+      numbering = nativeNumbering(entries);
+      if (!numbering) { reject('unsupported-list'); return undefined; }
+    }
+    values = item.value.map(entry => entry && !Array.isArray(entry) && typeof entry === 'object' ? entry.text : entry);
+    if (values.some(value => /[\r\n]/.test(ownText(value)))) { reject('unsupported-list'); return undefined; }
+  } else values = [item.value];
+  if (values.some(value => !richSupported(value))) {
+    reject(values.some(value => Array.isArray(value) && value.some(run => run?.cite !== undefined || run?.footnote !== undefined)) ? 'annotated-text' : 'unsupported-text');
+    return undefined;
+  }
+  if (values.some(value => hasRtl(ownText(value)) || /\t|[\u0000-\u0008\u000B\u000C\u000E-\u001F\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/.test(ownText(value))) || !values.some(value => ownText(value).length)) {
+    reject('unsupported-text'); return undefined;
+  }
+  return {item, values, list, ...(numbering ? {numbering} : {}), region: region?.name ?? 'Body', box: {...(region?.box ?? item.box)}, anchor: region?.anchor ?? 'top'};
+}
+
+// RR-88: the native auto-number (`a:buAutoNum`) that reproduces core's markers, or undefined when the entries are not one sequence.
+function nativeNumbering(entries) {
+  const first = entries[0]?.marker?.number;
+  if (!first || !Number.isInteger(first.value) || first.value < 1) return undefined;
+  const scheme = autoNumScheme(first.style, first.suffix);
+  return entries.every((entry, index) => {
+    const number = entry.marker?.number;
+    return number && number.value === first.value + index && autoNumScheme(number.style, number.suffix) === scheme;
+  }) ? {style: scheme, startAt: first.value} : undefined;
+}
+
+/** Whole authored paragraphs, retaining hard breaks only. Styling uses selected native families. */
+export function addNativeBody(slide, plan, context, options, helpers) {
+  const {item, values, list, box, anchor} = plan;
+  const base = item.textStyle;
+  const baseFont = helpers.nativeFontOptions(base);
+  const paragraphs = [];
+  for (const value of values) {
+    let paragraph = [];
+    paragraphs.push(paragraph);
+    for (const source of runsOf(value)) {
+      const run = typeof source === 'string' ? {text: source} : source;
+      const style = resolveTextStyle({...base, fontFamily: run.fontFamily ?? base.fontFamily,
+        fontWeight: run.bold === undefined ? base.fontWeight : run.bold ? 700 : 400, italic: run.italic ?? base.italic}, options.textMeasurement);
+      const hex = helpers.exportColor(run.color, context, context.colors.text);
+      const color = helpers.linkColor(run, helpers.nativeColor(run.color, hex, context, context.textColor), context);
+      const runOptions = {...helpers.nativeFontOptions(style), fontSize: run.fontSize ?? item.text.fontSize * .75,
+        color, transparency: hex.length === 8 ? (1 - parseInt(hex.slice(6), 16) / 255) * 100 : 0,
+        underline: run.underline ? {style: 'sng', color} : {style: 'none'}, strike: run.strikethrough ? 'sngStrike' : undefined,
+        hyperlink: run.link && /^(https?:|mailto:|tel:)/i.test(run.link) ? {url: run.link} : undefined, ...helpers.langOptions(context, run.lang)};
+      const pieces = run.text.split(/\r\n|\r|\n/);
+      pieces.forEach((text, index) => {
+        if (index) { paragraph = []; paragraphs.push(paragraph); }
+        paragraph.push({text, options: {...runOptions}});
+      });
+    }
+  }
+  const indent = list ? item.text.listEntries[0].marker.indent * .75 : undefined;
+  const paragraphOptions = !list ? {bullet: false} : plan.numbering ? {bullet: {type: 'number', style: plan.numbering.style, startAt: plan.numbering.startAt, indent}, hanging: indent / 4, indentLevel: 0}
+    : {bullet: {characterCode: '2022', indent}, hanging: indent / 4, indentLevel: 0};
+  const runs = paragraphs.flatMap((paragraph, index) => {
+    if (!paragraph.length) paragraph = [{text: '', options: {}}];
+    return paragraph.map((run, position) => ({...run, options: {...run.options, ...paragraphOptions,
+      breakLine: position === paragraph.length - 1 && index < paragraphs.length - 1}}));
+  });
+  const objectName = `OPF native body ${item.path}`;
+  slide.addText(runs, {...helpers.textBoxOptions({x: box.x / 96, y: box.y / 96, w: box.width / 96, h: box.height / 96}, context, item.text.fontSize * .75),
+    ...baseFont, ...paragraphOptions, objectName, align: item.alignment ?? 'left', valign: {top: 'top', middle: 'mid', bottom: 'bottom'}[anchor],
+    fit: 'none', wrap: true, lineSpacingMultiple: 1.22, bold: false, italic: false});
+  // Defaults for blank/appended paragraphs must name the selected family too.
+  const defaults = `<a:defRPr sz="${Math.round(item.text.fontSize * 75)}" b="${baseFont.bold ? 1 : 0}" i="${baseFont.italic ? 1 : 0}"><a:solidFill>${helpers.solidColorXml(context.textColor)}</a:solidFill><a:latin typeface="${escapeXml(baseFont.fontFace)}"/></a:defRPr>`;
+  return {objectName, defaults};
+}
+
+/** RR-88: a native title is written with an explicit no-autofit body, so the Title placeholder's own autofit cannot shrink or move it. */
+export function nativeTitleAutofit(xml, names) {
+  if (!names?.size) return xml;
+  return xml.replace(/<p:sp>[\s\S]*?<\/p:sp>/g, shape => names.has(shape.match(/<p:cNvPr\b[^>]*\bname="([^"]*)"/)?.[1])
+    ? shape.replace(/(<a:bodyPr\b[^>]*>)[\s\S]*?<\/a:bodyPr>/, '$1<a:noAutofit/></a:bodyPr>') : shape);
+}
+
+/** Only prototype objects receive explicit no-autofit and paragraph typing defaults. */
+export function nativeBodyDefaults(xml, records) {
+  if (!records?.size) return xml;
+  return xml.replace(/<p:sp>[\s\S]*?<\/p:sp>/g, shape => {
+    const name = shape.match(/<p:cNvPr\b[^>]*\bname="([^"]*)"/)?.[1];
+    const defaults = records.get(name);
+    if (!defaults) return shape;
+    shape = shape.replace(/(<a:bodyPr\b[^>]*>)[\s\S]*?<\/a:bodyPr>/, '$1<a:noAutofit/></a:bodyPr>');
+    const pPr = shape.match(/<a:pPr\b[^>]*(?:\/>|>[\s\S]*?<\/a:pPr>)/)?.[0] ?? '<a:pPr/>';
+    const paragraphDefault = pPr.replace(/<a:pPr\b/, '<a:defPPr').replace(/<\/a:pPr>/, '</a:defPPr>').replace(/<a:defRPr\b[^>]*(?:\/>|>[\s\S]*?<\/a:defRPr>)/g, '');
+    const withDefaults = paragraphDefault.endsWith('/>') ? paragraphDefault.slice(0, -2) + `>${defaults}</a:defPPr>` : paragraphDefault.replace('</a:defPPr>', `${defaults}</a:defPPr>`);
+    shape = shape.replace(/<a:lstStyle\s*\/>/, `<a:lstStyle>${withDefaults}</a:lstStyle>`);
+    return shape.replace(/<a:endParaRPr\b[^>]*(?:\/>|>[\s\S]*?<\/a:endParaRPr>)/g, defaults.replaceAll('a:defRPr', 'a:endParaRPr'));
+  });
+}

package/dist/native-footer-classification.js

@@ -0,0 +1,104 @@
+// Bounded current-native fallback for generated literals whose ftr role was
+// stripped. No source words, tags, geometry or fonts are replayed.
+import {escapeLiteralTokens} from './furniture-fields.js';
+
+const array = value => value === undefined ? [] : Array.isArray(value) ? value : [value];
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const nameOf = shape => shape?.['p:nvSpPr']?.['p:cNvPr']?.name;
+const generatedName = name => {
+  const match = typeof name === 'string' && /^OPF furniture (0|[1-9]\d*) part (0|[1-9]\d*) line 0$/.exec(name);
+  return match && match.slice(1).every(value => Number.isSafeInteger(Number(value))) ? {group: match[1], part: match[2]} : undefined;
+};
+const contains = (node, keys) => object(node) ? Object.entries(node).some(([key, value]) => keys.includes(key) || contains(value, keys)) : Array.isArray(node) && node.some(value => contains(value, keys));
+const integer = value => (typeof value === 'number' || typeof value === 'string' && /^-?\d+$/.test(value)) && Number.isSafeInteger(Number(value));
+const disabled = value => value === undefined || ['0','false','off'].includes(String(value));
+
+function frame(shape, width, height) {
+  const transform = shape['p:spPr']?.['a:xfrm'];
+  if (!object(transform) || transform.rot !== undefined && (!integer(transform.rot) || Number(transform.rot) !== 0) || !disabled(transform.flipH) || !disabled(transform.flipV)) return undefined;
+  if (![transform['a:off']?.x, transform['a:off']?.y, transform['a:ext']?.cx, transform['a:ext']?.cy].every(integer)) return undefined;
+  const x = Number(transform['a:off']?.x), y = Number(transform['a:off']?.y), cx = Number(transform['a:ext']?.cx), cy = Number(transform['a:ext']?.cy);
+  if (![x,y,cx,cy,width,height].every(Number.isSafeInteger) || !(cx > 0 && cy > 0 && width > 0 && height > 0)) return undefined;
+  const [X,Y,CX,CY,W,H] = [x,y,cx,cy,width,height].map(BigInt);
+  if (X < 0n || Y < 0n || X + CX > W || Y + CY > H || 10n * Y < 9n * H || 20n * CY > H || 3n * CX > W) return undefined;
+  const center = 3n * (2n * X + CX);
+  return {x,y,cx,cy,zone: center < 2n * W ? 'left' : center > 4n * W ? 'right' : 'center'};
+}
+
+function plainFrame(shape) {
+  const body = shape['p:txBody'], raw = body?.['a:bodyPr'], props = raw === '' ? {} : raw;
+  if (!object(body) || !object(props) || props.rot !== undefined && (!integer(props.rot) || Number(props.rot) !== 0) || ![undefined,'horz'].includes(props.vert) || ![undefined,'none'].includes(props.wrap) ||
+    ['lIns','tIns','rIns','bIns'].some(key => !Number.isFinite(Number(props[key] ?? 0)) || Number(props[key] ?? 0) < 0) ||
+    !disabled(shape['p:nvSpPr']?.['p:cNvPr']?.hidden) || contains(shape, ['a:hlinkClick','a:hlinkMouseOver','a:br','a:tab','a:fld','a:effectLst','a:effectDag','a14:m','m:oMath','m:oMathPara','mc:AlternateContent'])) return false;
+  return true;
+}
+
+function plainShape(shape, context) {
+  if (!plainFrame(shape) || shape['p:txBody']['a:bodyPr'].wrap !== 'none') return undefined;
+  const body = shape['p:txBody'];
+  const paragraphs = array(body['a:p']);
+  if (paragraphs.length !== 1 || !object(paragraphs[0])) return undefined;
+  const paragraph = paragraphs[0], run = paragraph['a:r'], pPr = paragraph['a:pPr'];
+  if ([pPr, body['a:lstStyle'], run?.['a:rPr']].some(value => value !== undefined && value !== '' && !object(value))) return undefined;
+  if (!object(run) || paragraph['a:fld'] !== undefined || Number(pPr?.lvl ?? 0) !== 0) return undefined;
+  const text = typeof run['a:t'] === 'string' ? run['a:t'] : object(run['a:t']) && typeof run['a:t']['#text'] === 'string' ? run['a:t']['#text'] : undefined;
+  if (text === undefined || /[\r\n\t]/.test(text)) return undefined;
+  const other = context.inherited?.().master?.root?.['p:txStyles']?.['p:otherStyle'];
+  const defaults = style => style === undefined || style === '' || object(style)
+    ? [style?.['a:lvl1pPr'], style?.['a:defPPr']] : [style];
+  const sources = [pPr, ...defaults(body['a:lstStyle']), ...defaults(other), ...defaults(context.defaultTextStyle)];
+  for (const source of sources) {
+    if (source === undefined || source === '') continue;
+    if (!object(source)) return undefined;
+    const membership = ['a:buNone','a:buChar','a:buAutoNum','a:buBlip'].filter(key => Object.hasOwn(source, key));
+    if (membership.length) return membership.length === 1 && membership[0] === 'a:buNone' ? text : undefined;
+  }
+  return undefined;
+}
+
+/** Native number witnesses must already have passed higher-priority collision checks. */
+export function classifyNativeFooters(context, claimed, accepted, occupied, report) {
+  const result = [], candidates = [], topLevel = new Set(array(context.root?.['p:cSld']?.['p:spTree']?.['p:sp']));
+  const names = new Map();
+  const inventory = node => {
+    if (Array.isArray(node)) return node.forEach(inventory);
+    if (!object(node)) return;
+    for (const [key, value] of Object.entries(node)) {
+      if (key === 'p:cNvPr' && typeof value?.name === 'string') names.set(value.name, (names.get(value.name) ?? 0) + 1);
+      inventory(value);
+    }
+  };
+  inventory(context.root);
+  // No complete cross-role ownership registry exists here. Any surviving
+  // customer binding conservatively reserves the whole slide from this fallback.
+  const tagged = contains(context.root, ['p:custDataLst']);
+  const witnesses = accepted.filter(field => field.ph === 'sldNum').map(field => {
+    const shape = context.shapes[field.index], name = nameOf(shape), identity = generatedName(name);
+    const p = shape?.['p:txBody']?.['a:p'], fld = p?.['a:fld'];
+    const withoutField = object(p) ? {...p} : {};
+    delete withoutField['a:fld'];
+    const bounds = shape && frame(shape, context.slideWidth, context.slideHeight);
+    return !claimed.has(field.index) && !contains(fld, ['a:hlinkClick','a:hlinkMouseOver','a:br','a:tab','a14:m','m:oMath','m:oMathPara']) && identity && names.get(name) === 1 && topLevel.has(shape) && object(p) && object(fld) && plainFrame({...shape, 'p:txBody': {...shape['p:txBody'], 'a:p': withoutField}}) && fld.type === 'slidenum' && p['a:r'] === undefined && bounds
+      ? {identity, bounds, index: field.index} : undefined;
+  }).filter(Boolean);
+  for (const [index, shape] of context.shapes.entries()) {
+    const name = nameOf(shape), identity = generatedName(name);
+    if (!identity || claimed.has(index) || shape['p:nvSpPr']?.['p:nvPr']?.['p:ph'] !== undefined) continue;
+    const refuse = reason => report({code: 'unclassified-native-footer', path: `shapes.${index}`, message: `The current generated-name literal remains content: ${reason}.`});
+    // A cleared shape is not a reason to recover words or warn about absence.
+    const current = (context.paragraphs[index] ?? []).map(value => value.text).join('\n');
+    if (!current.trim()) continue;
+    if (tagged) {refuse('a current customer-tag binding reserves ownership'); continue;}
+    const bounds = frame(shape, context.slideWidth, context.slideHeight), text = plainShape(shape, context);
+    if (names.get(name) !== 1 || !topLevel.has(shape) || !bounds || text === undefined) {refuse('identity, own footer-band frame or plain unbulleted text is unsupported'); continue;}
+    const anchors = witnesses.filter(anchor => anchor.identity.group === identity.group && anchor.identity.part !== identity.part && anchor.bounds.y === bounds.y && anchor.bounds.cy === bounds.cy);
+    if (anchors.length !== 1) {refuse('there is no unique accepted same-group live-number row'); continue;}
+    if (occupied.has(bounds.zone)) {refuse('higher-priority furniture already owns this zone'); continue;}
+    candidates.push({index, identity, bounds, text, refuse});
+  }
+  for (const item of candidates) {
+    if (candidates.filter(other => other.identity.group === item.identity.group).length !== 1 || candidates.filter(other => other.bounds.zone === item.bounds.zone).length !== 1) {item.refuse('several current literal candidates are ambiguous'); continue;}
+    result.push({index: item.index, zone: item.bounds.zone, ph: 'ftr', field: 'text', value: escapeLiteralTokens(item.text), settings: {}});
+  }
+  return result;
+}

package/dist/native-furniture.js

@@ -16,7 +16,7 @@
 // or where core would draw a default footer when no slide has one.
 
 import {XMLParser} from 'fast-xml-parser';
-import {DEFAULT_DATE_FORMAT, NATIVE_DATE_FIELDS, formatDate, hasSlideNumberField, slideNumberTemplate} from './furniture-fields.js';
+import {DEFAULT_DATE_FORMAT, NATIVE_DATE_FIELDS, formatDate, hasSlideNumberField, isBareSlideNumber, slideNumberTemplate} from './furniture-fields.js';
 
 const enc = new TextEncoder(), dec = new TextDecoder('utf-8', {fatal: true});
 const parser = new XMLParser({ignoreAttributes: false, attributeNamePrefix: '', parseTagValue: false, trimValues: false});
@@ -35,11 +35,14 @@ export const isNativePlaceholderType = value => Object.hasOwn(NATIVE_PLACEHOLDER
 /**
  * The placeholder type a core footer part maps to: a date is `dt`; a zone `text` with a slide-number field
  * (`{{slide.number}}`) is `sldNum`, its words around the field fixed runs; any other zone `text` is `ftr`.
+ * With `staticNumbers` (`slideNumberFields: 'static'`, the default, RR-91) a number with words around it is written as fixed text in an
+ * ordinary shape, so it has no placeholder: Keynote shows only the number of a slide-number placeholder or field.
  */
-export function nativePlaceholderForPart(part) {
+export function nativePlaceholderForPart(part, {staticNumbers = false} = {}) {
   if (part.type !== 'text') return undefined;
   if (part.field === 'date') return 'dt';
   if (part.field !== 'text') return undefined;
+  if (staticNumbers && hasSlideNumberField(part) && !isBareSlideNumber(part)) return undefined;
   return hasSlideNumberField(part) ? 'sldNum' : 'ftr';
 }
 const ZONES = ['left', 'center', 'right'];
@@ -50,10 +53,10 @@ const ALIGN = {left: 'l', center: 'ctr', right: 'r'};
  * footer text, the first footer date and the first footer text with a slide-number
  * field whose text fits one accepted line. Returns Map<partIndex, 'dt'|'ftr'|'sldNum'>.
  */
-export function nativeFurnitureParts(layout) {
+export function nativeFurnitureParts(layout, options) {
   const chosen = new Map(), taken = new Set();
   for (const [index, part] of (layout?.parts ?? []).entries()) {
-    const ph = nativePlaceholderForPart(part);
+    const ph = nativePlaceholderForPart(part, options);
     if (part.kind !== 'footer' || !ph || taken.has(ph)) continue;
     // One native shape holds one line; a part that wraps or breaks stays tagged shapes.
     if (part.fit?.sourceLines?.length !== 1 || part.fit.lines?.length !== 1 || !part.text || part.links?.length) continue;
@@ -79,9 +82,11 @@ const guid = (kind, n) => `{0F0F2701-${kind}-4000-8000-${n.toString(16).toUpperC
  * attached: the shape keeps its name, geometry, runs, fields and tags, and gains
  * `p:ph` (a placeholder is a text shape the layout can supply defaults for).
  * `bands` maps a generated object name to its zone's band (`{x, width}` in pixels) for a part narrower than its zone.
+ * `footerText: 'shape'` omits only the slide-local literal ftr binding. Keep locks, selection and master/layout bookkeeping
+ * unchanged: the measured shape stays on its slide and all other generated package parts retain their normal semantics.
  * Returns the placeholders in use and the first geometry/alignment seen per type.
  */
-export function attachNativePlaceholders(entries, records, bands = new Map()) {
+export function attachNativePlaceholders(entries, records, bands = new Map(), footerText = 'native') {
   const used = new Set(), first = new Map(), seen = new Set();
   if (!records.size) return {used, first};
   const slides = Object.keys(entries).filter(path => /^ppt\/slides\/slide\d+\.xml$/.test(path)).sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0]));
@@ -97,7 +102,7 @@ export function attachNativePlaceholders(entries, records, bands = new Map()) {
       if (!/<p:cNvSpPr\b[^>]*\/>/.test(shape)) throw new Error('Generated furniture shape has no plain shape properties.');
       shape = shape.replace(/<p:cNvSpPr\b([^>]*)\/>/, '<p:cNvSpPr$1><a:spLocks noGrp="1"/></p:cNvSpPr>').replace(/<p:nvPr\s*\/>/, '<p:nvPr></p:nvPr>');
       if (!shape.includes('<p:nvPr>')) throw new Error('Generated furniture shape has no native application properties.');
-      shape = shape.replace('<p:nvPr>', `<p:nvPr><p:ph type="${ph}" sz="${properties.sz}" idx="${properties.idx}"/>`);
+      if (ph !== 'ftr' || footerText !== 'shape') shape = shape.replace('<p:nvPr>', `<p:nvPr><p:ph type="${ph}" sz="${properties.sz}" idx="${properties.idx}"/>`);
       used.add(ph);
       if (!first.has(ph)) {
         const geometry = shape.match(/<a:off x="(-?\d+)" y="(-?\d+)"\/><a:ext cx="(\d+)" cy="(\d+)"\/>/);
@@ -235,28 +240,58 @@ function xfrmBounds(xfrm) {
   return [x, y, cx, cy].every(Number.isFinite) && cx > 0 ? {x, y, cx, cy} : undefined;
 }
 
-// A placeholder without its own xfrm inherits it: slide -> layout (same idx, else same
+// A placeholder without its own xfrm (or alignment) inherits it: slide -> layout (same idx, else same
 // type) -> master (same type). Parsed layout/master trees are cached per package read.
-function inheritedBounds(shape, ph, slidePath, relationships, readPart) {
-  const own = xfrmBounds(shape['p:spPr']?.['a:xfrm']);
-  if (own) return own;
+function placeholderChain(shape, ph, slidePath, relationships, readPart) {
+  const chain = [shape];
   const index = shape['p:nvSpPr']?.['p:nvPr']?.['p:ph']?.idx;
   const find = (path, byIdx) => {
     const tree = readPart(path)?.[path.includes('slideMaster') ? 'p:sldMaster' : 'p:sldLayout']?.['p:cSld']?.['p:spTree'];
     const candidates = array(tree?.['p:sp']).filter(candidate => candidate['p:nvSpPr']?.['p:nvPr']?.['p:ph']?.type === ph);
-    const match = (byIdx && index !== undefined ? candidates.find(candidate => candidate['p:nvSpPr']['p:nvPr']['p:ph'].idx === index) : undefined) ?? candidates[0];
-    return match ? xfrmBounds(match['p:spPr']?.['a:xfrm']) : undefined;
+    return (byIdx && index !== undefined ? candidates.find(candidate => candidate['p:nvSpPr']['p:nvPr']['p:ph'].idx === index) : undefined) ?? candidates[0];
   };
   const layout = [...relationships(slidePath).values()].find(relationship => relationship.type === REL_LAYOUT)?.path;
-  if (!layout) return undefined;
+  if (!layout) return chain;
   const fromLayout = find(layout, true);
-  if (fromLayout) return fromLayout;
+  if (fromLayout) chain.push(fromLayout);
   const master = [...relationships(layout).values()].find(relationship => relationship.type === REL_MASTER)?.path;
-  return master ? find(master, false) : undefined;
+  const fromMaster = master ? find(master, false) : undefined;
+  if (fromMaster) chain.push(fromMaster);
+  return chain;
 }
 
-function zoneOf(bounds, slideWidth, fallback) {
+function inheritedBounds(chain) {
+  for (const shape of chain) {
+    const bounds = xfrmBounds(shape['p:spPr']?.['a:xfrm']);
+    if (bounds) return bounds;
+  }
+  return undefined;
+}
+
+const ALIGN_ZONES = {l: 'left', ctr: 'center', r: 'right'};
+// The paragraph alignment of a footer shape: its first paragraph, else its list style, else what the layout and master
+// placeholder say. Read as the physical edge, as the exporter writes it (an RTL zone is `algn="r"` with `rtl="1"`).
+function inheritedAlignment(chain) {
+  for (const shape of chain) {
+    const body = shape['p:txBody'];
+    const paragraph = array(body?.['a:p']).find(item => item?.['a:pPr']?.algn !== undefined);
+    const algn = paragraph?.['a:pPr']?.algn ?? body?.['a:lstStyle']?.['a:lvl1pPr']?.algn;
+    if (ALIGN_ZONES[algn]) return ALIGN_ZONES[algn];
+  }
+  return undefined;
+}
+
+/** A box wider than this share of the slide spans more than one zone, so its centre says nothing about the zone. */
+const WIDE_ZONE_SHARE = .36;
+// A narrow box keeps the zone its centre is in; a box wider than a zone (core gives a lone zone the content width) takes the
+// zone its paragraphs align to, and keeps the centre when nothing says how they align.
+function zoneOf(chain, slideWidth, fallback) {
+  const bounds = inheritedBounds(chain);
   if (!bounds || !(slideWidth > 0)) return fallback;
+  if (bounds.cx / slideWidth > WIDE_ZONE_SHARE) {
+    const aligned = inheritedAlignment(chain);
+    if (aligned) return aligned;
+  }
   const center = (bounds.x + bounds.cx / 2) / slideWidth;
   return center < 1 / 3 ? 'left' : center > 2 / 3 ? 'right' : 'center';
 }
@@ -282,7 +317,7 @@ export function readNativePlaceholders(context, claimed, relationships, readPart
       for (const field of paragraph.fields ?? []) nativeFields.push({...field, start: base + (field.start ?? text.indexOf(field.text, base) - base)});
       base += paragraph.text.length + 1;
     }
-    const zone = zoneOf(inheritedBounds(shape, ph, context.path, relationships, readPart), context.slideWidth, NATIVE_PLACEHOLDERS[ph].zone);
+    const zone = zoneOf(placeholderChain(shape, ph, context.path, relationships, readPart), context.slideWidth, NATIVE_PLACEHOLDERS[ph].zone);
     const properties = NATIVE_PLACEHOLDERS[ph];
     if (ph === 'sldNum') {
       // The words around a native slide-number field are the zone text and the field is `{{slide.number}}`.

package/dist/native-text-style.js

@@ -5,6 +5,12 @@ const boolean = value => ['1','true','on'].includes(value) ? true : ['0','false'
 
 const themeFamilies = context => ['a:majorFont', 'a:minorFont'].map(key => context.fonts?.[key]?.['a:latin']?.typeface?.trim().toLowerCase()).filter(Boolean);
 
+export function nativeTypeface(font, context) {
+  if (typeof font !== 'string') return undefined;
+  const match = font.match(/^\+(mj|mn)-(lt|ea|cs)$/);
+  return match ? context.fonts?.[match[1] === 'mj' ? 'a:majorFont' : 'a:minorFont']?.[{lt:'a:latin',ea:'a:ea',cs:'a:cs'}[match[2]]]?.typeface : font;
+}
+
 // A run painted with a bare theme slot (a:schemeClr, no color transform) remembers the slot as the OPF color name: the
 // transient `_opfScheme` marker is read, and always removed, by restoreRunColors (run-colors.js) once the document's own
 // colour scheme can confirm the slot holds that colour.
@@ -36,8 +42,7 @@ export function nativeRunStyle(properties, context, relationships, report, kind
   const font = properties['a:latin']?.typeface;
   if (properties['a:latin'] && !font) report(`unsupported-${kind}-font`, 'The native text font has no usable Latin face or theme reference.');
   if (font) {
-    const match = font.match(/^\+(mj|mn)-(lt|ea|cs)$/);
-    const family = match ? context.fonts?.[match[1] === 'mj' ? 'a:majorFont' : 'a:minorFont']?.[{lt:'a:latin',ea:'a:ea',cs:'a:cs'}[match[2]]]?.typeface : font;
+    const family = nativeTypeface(font, context);
     if (family) {
       result.fontFamily = family;
       // The exporter writes a bundled family's weight faces (Roboto SemiBold) under their

package/dist/quote-provenance.js

@@ -1,6 +1,6 @@
 import {XMLParser} from 'fast-xml-parser';
 import {isValidFormat} from './format-check.js';
-import {attachTextTags,decodeTextTag} from './code-provenance.js';
+import {attachTextTags,decodeTextTag,groupUnchanged} from './code-provenance.js';
 import {sourceLineParagraphs} from './text-provenance.js';
 import {cleanBase,headingValue,joinRichLines,unwrapQuoteRuns} from './rich-heading.js';
 
@@ -18,7 +18,7 @@ const FOOTERS=['["attribution"]','["role"]','["source"]','["attribution","role"]
 const separatorBefore=field=>field==='role'?'\n':SEPARATOR;
 const parser=new XMLParser({ignoreAttributes:false,attributeNamePrefix:'',parseTagValue:false,trimValues:false});
 const decoder=new TextDecoder('utf-8',{fatal:true}),array=value=>value===undefined?[]:Array.isArray(value)?value:[value];
-export const attachQuoteTags=(entries,records)=>attachTextTags(entries,records,TAG,'opfQuote','quote',{pictures:true});
+export const attachQuoteTags=(entries,records)=>attachTextTags(entries,records,TAG,'opfQuote','quote',{pictures:true,signed:true});
 export const quotePhotoName=group=>`OPF quote photo ${group}`;
 
 // The manifest rides on the first body line. `footer` lists which fields the footer part joins (core writes the attribution, the role
@@ -127,7 +127,7 @@ export function importQuoteGroups(shapes,paragraphs,relationships,entries,report
     for(const item of photos)consumedPictures.add(item.picture);
     items.push({shapes:group.map(item=>item.shape),pictures:photos.map(item=>item.picture),payload:{type:'quote',quote}});
     for(const diagnostic of local)report(diagnostic);
-    report({code:'quote-import-reflow',message:'Quote text, attribution, role, source and photo were recovered from the current native text and picture. Native formatting, positions and font theme are not reconstructed; review the reflowed quote.'});
+    if(!groupUnchanged(group,paragraphs))report({code:'quote-import-reflow',message:'Quote text, attribution, role, source and photo were recovered from the current native text and picture. Native formatting, positions and font theme are not reconstructed; review the reflowed quote.'});
   }catch(error){report({code:'invalid-quote-provenance',message:`${error.message} Ordinary import retains current native text without restoring old source words.`});}
   return {consumed,consumedPictures,items};
 }

package/dist/svg-image.js

@@ -153,7 +153,9 @@ function sanitize(input, text) {
       } else if (!skipping) {
         if (chunk.includes(']]>')) malformed('a stray CDATA terminator');
         const style = stack.at(-1).name === 'style';
-        out.push(references(style ? filterCss(chunk) : chunk));
+        const filtered = style ? filterCss(chunk) : chunk;
+        if (filtered !== chunk) removed.add('external references');
+        out.push(references(filtered));
       }
       continue;
     }
@@ -167,7 +169,12 @@ function sanitize(input, text) {
       const end = text.indexOf(']]>', index + 9);
       if (end < 0) malformed('an unterminated CDATA section');
       if (!stack.length) malformed('CDATA outside the root element');
-      if (!skipping) out.push(`<![CDATA[${stack.at(-1).name === 'style' ? filterCss(text.slice(index + 9, end)) : text.slice(index + 9, end)}]]>`);
+      if (!skipping) {
+        const chunk = text.slice(index + 9, end);
+        const filtered = stack.at(-1).name === 'style' ? filterCss(chunk) : chunk;
+        if (filtered !== chunk) removed.add('external references');
+        out.push(`<![CDATA[${filtered}]]>`);
+      }
       index = end + 3;
       continue;
     }