mixdog 0.9.174 → 1.0.0

package/src/runtime/office/portable/font-provisioner.mjs

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { existsSync, promises as fsp } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { join } from 'node:path';
@@ -7,86 +8,100 @@ import { GlobalFonts } from '@napi-rs/canvas';
 
 const execFileAsync = promisify(execFile);
 
+// google/fonts commit the font URLs and sha256 digests below were taken from.
+const GOOGLE_FONTS_COMMIT = '23e54b51ddffbc7713c583748e3bd86f62b1fa4a';
+const GOOGLE_FONTS_RAW = `https://raw.githubusercontent.com/google/fonts/${GOOGLE_FONTS_COMMIT}/ofl`;
+
 export const NOTO_FONT_DEFINITIONS = Object.freeze([
   {
     id: 'noto-sans-latin',
     family: 'Noto Sans',
     fileName: 'NotoSans-Variable.ttf',
     registryName: 'Noto Sans (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosans/NotoSans%5Bwdth%2Cwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosans/NotoSans%5Bwdth%2Cwght%5D.ttf`,
     bytes: 2049096,
+    sha256: 'bfb7bb691513f12e734dc346c03a03f784912432d7e3fa8e56efcf906fe86b3d',
   },
   {
     id: 'noto-sans-kr',
     family: 'Noto Sans KR',
     fileName: 'NotoSansKR-Variable.ttf',
     registryName: 'Noto Sans KR (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosanskr/NotoSansKR%5Bwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosanskr/NotoSansKR%5Bwght%5D.ttf`,
     bytes: 10414588,
+    sha256: '194018e6b2b293a7964f037b25c0249ce1418bc9ab3c971060a03aa57861e252',
   },
   {
     id: 'noto-sans-sc',
     family: 'Noto Sans SC',
     fileName: 'NotoSansSC-Variable.ttf',
     registryName: 'Noto Sans SC (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosanssc/NotoSansSC%5Bwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosanssc/NotoSansSC%5Bwght%5D.ttf`,
     bytes: 17772300,
+    sha256: 'a3041811a78c361b1de50f953c805e0244951c21c5bd412f7232ef0d899af0da',
   },
   {
     id: 'noto-sans-jp',
     family: 'Noto Sans JP',
     fileName: 'NotoSansJP-Variable.ttf',
     registryName: 'Noto Sans JP (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosansjp/NotoSansJP%5Bwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosansjp/NotoSansJP%5Bwght%5D.ttf`,
     bytes: 9589900,
+    sha256: 'c2f3b4d463500a2ddcd3849cded1fceeb9fd6d1c32e6cbecd568453ba50fc68f',
   },
   {
     id: 'noto-sans-tc',
     family: 'Noto Sans TC',
     fileName: 'NotoSansTC-Variable.ttf',
     registryName: 'Noto Sans TC (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosanstc/NotoSansTC%5Bwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosanstc/NotoSansTC%5Bwght%5D.ttf`,
     bytes: 11941968,
+    sha256: '864727d210d54f2537bbe23b3a839436c3992af72de9322af5270897246bd44f',
   },
   {
     id: 'noto-sans-arabic',
     family: 'Noto Sans Arabic',
     fileName: 'NotoSansArabic-Variable.ttf',
     registryName: 'Noto Sans Arabic (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosansarabic/NotoSansArabic%5Bwdth%2Cwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosansarabic/NotoSansArabic%5Bwdth%2Cwght%5D.ttf`,
     bytes: 844676,
+    sha256: '63111b5b2e074dd48cc67692e0a2726d86ee94c1c37fe8598257b7b4e87e869e',
   },
   {
     id: 'noto-sans-devanagari',
     family: 'Noto Sans Devanagari',
     fileName: 'NotoSansDevanagari-Variable.ttf',
     registryName: 'Noto Sans Devanagari (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosansdevanagari/NotoSansDevanagari%5Bwdth%2Cwght%5D.ttf',
-    bytes: 647144,
+    url: `${GOOGLE_FONTS_RAW}/notosansdevanagari/NotoSansDevanagari%5Bwdth%2Cwght%5D.ttf`,
+    bytes: 641944,
+    sha256: '14ec4af41f27482216d1c2229f417ff9b1425e1babb014e57d1d40d03229853e',
   },
   {
     id: 'noto-sans-thai',
     family: 'Noto Sans Thai',
     fileName: 'NotoSansThai-Variable.ttf',
     registryName: 'Noto Sans Thai (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosansthai/NotoSansThai%5Bwdth%2Cwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosansthai/NotoSansThai%5Bwdth%2Cwght%5D.ttf`,
     bytes: 218652,
+    sha256: '5a1c559bb539583c8a1fd99d1c5b9491e5e14478c9cd2bd0970d5c3096cc9ef8',
   },
   {
     id: 'noto-sans-hebrew',
     family: 'Noto Sans Hebrew',
     fileName: 'NotoSansHebrew-Variable.ttf',
     registryName: 'Noto Sans Hebrew (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosanshebrew/NotoSansHebrew%5Bwdth%2Cwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosanshebrew/NotoSansHebrew%5Bwdth%2Cwght%5D.ttf`,
     bytes: 112640,
+    sha256: '7ef36a2c3593758cdb622e1bdef4f84523e92fbc3ccc667438dd80ff54c2de88',
   },
   {
     id: 'noto-sans-bengali',
     family: 'Noto Sans Bengali',
     fileName: 'NotoSansBengali-Variable.ttf',
     registryName: 'Noto Sans Bengali (TrueType)',
-    url: 'https://raw.githubusercontent.com/google/fonts/main/ofl/notosansbengali/NotoSansBengali%5Bwdth%2Cwght%5D.ttf',
+    url: `${GOOGLE_FONTS_RAW}/notosansbengali/NotoSansBengali%5Bwdth%2Cwght%5D.ttf`,
     bytes: 463668,
+    sha256: 'dcd42978094e584a849c84a51450eeac40c8826057d566ea6d4b9627a403a05a',
   },
 ]);
 
@@ -163,6 +178,16 @@ function registerFontInProcess(fontPath, family) {
   return false;
 }
 
+export function verifyFontBuffer(fontDef, buffer) {
+  if (buffer.length !== fontDef.bytes) {
+    throw new Error(`Font ${fontDef.family} size mismatch: expected ${fontDef.bytes} bytes, got ${buffer.length}`);
+  }
+  const digest = createHash('sha256').update(buffer).digest('hex');
+  if (digest !== fontDef.sha256) {
+    throw new Error(`Font ${fontDef.family} sha256 mismatch: expected ${fontDef.sha256}, got ${digest}`);
+  }
+}
+
 async function installFont(fontDef) {
   const status = isFontInstalled(fontDef);
   if (status.installed) {
@@ -182,6 +207,7 @@ async function installFont(fontDef) {
   }
 
   const buffer = Buffer.from(await response.arrayBuffer());
+  verifyFontBuffer(fontDef, buffer);
   await fsp.writeFile(tempPath, buffer);
   await fsp.rename(tempPath, targetPath);
 

package/src/runtime/office/portable/portable-cells.mjs

@@ -118,12 +118,8 @@ export function computedCellValues(xml, strings) {
     if (!value) continue;
     const type = /\bt="([^"]*)"/.exec(cell.attributes)?.[1] || '';
     const text = value[1] || '';
-    computed.set(
-      cell.ref,
-      type === 's'
-        ? { type: 'str', text: xmlEncode(strings[Number(text)] ?? '') }
-        : { type: type === 'n' ? '' : type, text }
-    );
+    if (type === 's') computed.set(cell.ref, { type: 'str', text: xmlEncode(strings[Number(text)] ?? '') });
+    else computed.set(cell.ref, { type: type === 'n' ? '' : type, text });
   }
   return computed;
 }

package/src/runtime/office/portable/portable-chart.mjs

@@ -1,9 +1,11 @@
-import { xmlEncode } from './portable-xml.mjs';
+import {
+  DRAWING_MAIN_NS as DRAWING_NAMESPACE,
+  OFFICE_RELATIONSHIP_BASE as RELATIONSHIP_NAMESPACE,
+  xmlEncode,
+} from './portable-xml.mjs';
 import { contrastRatio } from './text-metrics.mjs';
 
 const CHART_NAMESPACE = 'http://schemas.openxmlformats.org/drawingml/2006/chart';
-const DRAWING_NAMESPACE = 'http://schemas.openxmlformats.org/drawingml/2006/main';
-const RELATIONSHIP_NAMESPACE = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships';
 const CATEGORY_AXIS_ID = 111_111_111;
 const VALUE_AXIS_ID = 222_222_222;
 
@@ -305,9 +307,7 @@ export function chartXml({
     (zeroBaseline == null ? family.element === 'barChart' || family.element === 'areaChart' : zeroBaseline === true);
   // The order the categories read in: a bar chart lists them top-down, unless the chart being rebuilt was authored the
   // other way (PowerPoint's own bottom-up default, a template's), which it keeps as PowerPoint's refresh keeps it.
-  const reversed = axis?.categoryOrientation
-    ? axis.categoryOrientation === 'maxMin'
-    : family.direction === 'bar';
+  const reversed = axis?.categoryOrientation ? axis.categoryOrientation === 'maxMin' : family.direction === 'bar';
   const sheet = references?.sheet || 'Sheet1';
   const categoryFormula = references?.category || `${sheet}!$A$2:$A$${rows.length + 1}`;
   const plots = entries

package/src/runtime/office/portable/portable-docx-edits.mjs

@@ -71,6 +71,7 @@ import {
   wordTableXml,
   wordTableProperties,
   wordTextContent,
+  wordTextElement,
   withFirstRunText,
 } from './portable-docx-xml.mjs';
 import { documentStyleId } from './portable-docx-styles.mjs';
@@ -119,16 +120,12 @@ function replaceBodyParagraph(current, model, paragraph, nextParagraph) {
   return `${current.slice(0, model.body.start)}${nextInner}${current.slice(model.body.end)}`;
 }
 
-function preserveSpace(text) {
-  return /^\s|\s$/.test(text) ? ' xml:space="preserve"' : '';
-}
-
 function commentEntryXml(id, op, text, stamp) {
   return (
     `<w:comment w:id="${id}" w:author="${xmlEncode(op.author || 'Mixdog')}"` +
     ` w:date="${stamp}" w:initials="${xmlEncode(op.initials || 'MD')}">` +
     `<w:p xmlns:w14="${WORD_2010_NS}" w14:paraId="${commentParagraphId(id)}">` +
-    `<w:r><w:t${preserveSpace(text)}>${xmlEncode(text)}</w:t></w:r></w:p></w:comment>`
+    `<w:r>${wordTextElement(text)}</w:r></w:p></w:comment>`
   );
 }
 
@@ -589,9 +586,7 @@ export async function addDocxHyperlink(zip, op) {
         'External'
       )
     : '';
-  const run =
-    '<w:r><w:rPr><w:color w:val="0563C1"/><w:u w:val="single"/></w:rPr>' +
-    `<w:t${preserveSpace(display)}>${xmlEncode(display)}</w:t></w:r>`;
+  const run = `<w:r><w:rPr><w:color w:val="0563C1"/><w:u w:val="single"/></w:rPr>${wordTextElement(display)}</w:r>`;
   const link =
     `<w:hyperlink${relationshipId ? ` r:id="${relationshipId}"` : ''}` +
     `${op.subAddress ? ` w:anchor="${xmlEncode(op.subAddress)}"` : ''}>${run}</w:hyperlink>`;
@@ -725,7 +720,7 @@ export async function deleteDocxComment(zip, op) {
     .replace(new RegExp(`<w:commentRangeEnd\\b[^>]*\\bw:id="${id}"[^>]*\\/>`, 'g'), '')
     .replace(
       new RegExp(
-        `<w:r>(?:(?!<\\/w:r>)[\\s\\S])*?<w:commentReference\\b[^>]*\\bw:id="${id}"[^>]*\\/>[\\s\\S]*?<\\/w:r>`,
+        `<w:r\\b[^>]*>(?:(?!<\\/w:r>)[\\s\\S])*?<w:commentReference\\b[^>]*\\bw:id="${id}"[^>]*\\/>[\\s\\S]*?<\\/w:r>`,
         'g'
       ),
       ''

package/src/runtime/office/portable/portable-docx-operations.mjs

@@ -29,6 +29,7 @@ import {
   wordJustification,
   wordTableProperties,
   wordTextContent,
+  wordTextElement,
   withFirstRunText,
 } from './portable-docx-xml.mjs';
 import { docxRevisionTree, flattenDocxRevisions } from './docx-revisions.mjs';
@@ -106,15 +107,14 @@ export function docxTocEntries(documentXml, lower, upper, headingLevels = new Ma
 // An entry carries its page after a tab once a render has measured it (numberDocxTableOfContents); the tab stop
 // on the paragraph sets it on the right margin behind a dot leader, the way Word draws its own contents.
 export function docxTocCacheRuns(entries, lower) {
-  return entries.length
-    ? entries
-        .map(
-          (entry) =>
-            `<w:r><w:t xml:space="preserve">${xmlEncode(`${'    '.repeat(entry.level - lower)}${entry.text}`)}</w:t></w:r>` +
-            (entry.page ? `<w:r><w:tab/></w:r><w:r><w:t>${Number(entry.page)}</w:t></w:r>` : '')
-        )
-        .join('<w:r><w:br/></w:r>')
-    : '<w:r><w:t>Update this field in Word to build the table of contents.</w:t></w:r>';
+  if (!entries.length) return '<w:r><w:t>Update this field in Word to build the table of contents.</w:t></w:r>';
+  const pageRun = (entry) => (entry.page ? `<w:r><w:tab/></w:r><w:r><w:t>${Number(entry.page)}</w:t></w:r>` : '');
+  return entries
+    .map(
+      (entry) =>
+        `<w:r><w:t xml:space="preserve">${xmlEncode(`${'    '.repeat(entry.level - lower)}${entry.text}`)}</w:t></w:r>${pageRun(entry)}`
+    )
+    .join('<w:r><w:br/></w:r>');
 }
 
 const TOC_FIELD = /<w:fldSimple\b([^>]*\bw:instr="([^"]*TOC[^"]*)"[^>]*)>([\s\S]*?)<\/w:fldSimple>/g;
@@ -560,7 +560,7 @@ export async function fitDocxTable(zip, op) {
 function controlFilledWith(control, contentInner, text) {
   const first = /<w:r(?:\s[^>]*)?>[\s\S]*?<\/w:r>/.exec(contentInner);
   const runProperties = first ? /<w:rPr(?:\s[^>]*)?>[\s\S]*?<\/w:rPr>/.exec(first[0])?.[0] || '' : '';
-  const run = `<w:r>${runProperties}<w:t${/^\s|\s$/.test(text) ? ' xml:space="preserve"' : ''}>${xmlEncode(text)}</w:t></w:r>`;
+  const run = `<w:r>${runProperties}${wordTextElement(text)}</w:r>`;
   const [firstParagraph] = contentInner.match(/<w:p(?:\s[^>]*)?>[\s\S]*?<\/w:p>/) || [];
   const paragraph = firstParagraph
     ? `${/^<w:p(?:\s[^>]*)?>(?:<w:pPr(?:\s[^>]*)?>[\s\S]*?<\/w:pPr>)?/.exec(firstParagraph)?.[0] || '<w:p>'}${run}</w:p>`
@@ -704,7 +704,10 @@ function styledDocxCell(cell, op) {
   const eastAsiaFontAttrs = cellEastAsia ? ` w:eastAsia="${cellEastAsia}"` : '';
   // bold:false and italic:false switch the weight off, as the Word backend's Font.Bold = 0 does: a data row inserted
   // before a total copies the total's bold, and asking for it back to regular changed nothing here.
-  const toggled = (tag, value) => (value === undefined ? '' : value ? `<w:${tag}/><w:${tag}Cs/>` : `<w:${tag} w:val="0"/><w:${tag}Cs w:val="0"/>`);
+  const toggled = (tag, value) => {
+    if (value === undefined) return '';
+    return value ? `<w:${tag}/><w:${tag}Cs/>` : `<w:${tag} w:val="0"/><w:${tag}Cs w:val="0"/>`;
+  };
   const runFormat = [
     cellFont || cellEastAsia ? `<w:rFonts${latinFontAttrs}${eastAsiaFontAttrs}/>` : '',
     toggled('b', op.properties?.bold),
@@ -760,7 +763,7 @@ function mergedCellXml(joined, spans) {
 // Merges the located cell across colSpan columns (dropping the absorbed
 // cells) and rowSpan rows (continuation cells become vMerge, spanning the same columns: a block merge left the
 // continuation rows' absorbed cells in place, one grid column too many a cell).
-function mergedDocxTable({ table, rows, row, cells, cell }, op) {
+function mergedDocxTable({ table, rows, row, cells }, op) {
   const colSpan = Math.max(1, Number(op.colSpan) || 1);
   const rowSpan = Math.max(1, Number(op.rowSpan) || 1);
   const gridSpan = colSpan > 1 ? `<w:gridSpan w:val="${colSpan}"/>` : '';
@@ -807,7 +810,7 @@ export async function styleOrMergeDocxTableCell(zip, op) {
   const nextTable =
     op.op === 'set_table_cell_style'
       ? table[0].replace(cell[0], styledDocxCell(cell[0], op))
-      : mergedDocxTable({ table, rows, row, cells, cell }, op);
+      : mergedDocxTable({ table, rows, row, cells }, op);
   current = replaceDocxTable(current, table, nextTable);
   zip.file('word/document.xml', current);
   return {

package/src/runtime/office/portable/portable-docx-parts.mjs

@@ -6,6 +6,7 @@ import {
   ensureContentTypeOverride,
   ensureDefaultContentType,
   imagePixelSize,
+  partFromTarget,
   partRelationshipPath,
   zipText,
 } from './portable-opc.mjs';
@@ -463,7 +464,7 @@ export async function writeHeaderFooterPart(zip, { header, body, documentXml = '
       .map((match) => match[0])
       .find((element) => new RegExp(`\\bId="${referencedId}"`).test(element));
     const path = target ? /\bTarget="([^"]+)"/.exec(target)?.[1] || '' : '';
-    const existing = path ? `word/${path.replace(/^\.?\//, '')}` : '';
+    const existing = path ? partFromTarget('word', path) : '';
     if (existing && zip.file(existing)) {
       // The story keeps its own root: Word's declares the w14, mc and wp prefixes its paragraphs use, and page
       // numbers added into Word's footer under a root naming only w and r left a document Word would not open.
@@ -717,7 +718,11 @@ export async function ensureNumbering(zip, kind, { restart = false } = {}) {
 // its own at 1.
 export async function appendedNumbering(zip, documentXml, options = {}) {
   const trailing = documentXml.lastIndexOf('<w:sectPr');
-  return numberingAfter(zip, documentXml.slice(0, trailing >= 0 ? trailing : documentXml.lastIndexOf('</w:body>')), options);
+  return numberingAfter(
+    zip,
+    documentXml.slice(0, trailing >= 0 ? trailing : documentXml.lastIndexOf('</w:body>')),
+    options
+  );
 }
 
 // The same choice for an item anywhere in the body, `before` being the body up to it: set_list and

package/src/runtime/office/portable/portable-docx-xml.mjs

@@ -213,7 +213,7 @@ export function alignWordTableColumns(tableXml, columnAlignments = []) {
 // nothing marks its edges, so its cell padding shows as an indent — "시니어 엔지니어" started 5 pt right of the "경력"
 // heading above it and "2023 – 현재" stopped 5 pt short of the rule. Its outer cells drop the padding on the page
 // side, so the text registers with the paragraphs around it; the padding between columns stays.
-export function isLayoutTable(properties = {}) {
+function isLayoutTable(properties = {}) {
   if (properties.style || properties.shading) return false;
   const borders = properties.borders;
   if (!borders || typeof borders !== 'object') return false;
@@ -247,7 +247,7 @@ export function naturalTableColumnWidths(values, properties = {}, available = 0)
     fontName: properties.fontName || properties.fontNameEastAsia || 'Calibri',
     fontSize: Number(properties.fontSize) > 0 ? Number(properties.fontSize) : 11,
   };
-  const headerBold = rows.length > 1 && properties.headerBold !== false && properties.repeatHeader !== false;
+  const headerBold = tableHeaderBold(properties, rows.length);
   const headers = tableHeaderRows(properties, rows.length);
   const gutters = isLayoutTable(properties) ? [] : gutterColumns(properties);
   const measure = (text, rowIndex, column) =>
@@ -268,7 +268,9 @@ function gutterColumns(properties) {
   );
 }
 const gutterMargin = (gutter) =>
-  gutter ? `<w:tcMar><w:left w:w="${pointsToTwips(CELL_PADDING_POINTS / 2 + GUTTER_POINTS)}" w:type="dxa"/></w:tcMar>` : '';
+  gutter
+    ? `<w:tcMar><w:left w:w="${pointsToTwips(CELL_PADDING_POINTS / 2 + GUTTER_POINTS)}" w:type="dxa"/></w:tcMar>`
+    : '';
 
 // The rows a table's header takes: one, or more for a header of several levels — a group label over the columns it
 // spans ("3분기 처리량" over 7월 · 8월 · 9월) is two. At least one row stays data.
@@ -276,10 +278,18 @@ function tableHeaderRows(properties, rows) {
   return Math.max(1, Math.min(rows - 1, Math.floor(Number(properties?.headerRows) || 1)));
 }
 
-const flushCellMargins = (first, last) =>
-  first || last
-    ? `<w:tcMar>${first ? '<w:left w:w="0" w:type="dxa"/>' : ''}${last ? '<w:right w:w="0" w:type="dxa"/>' : ''}</w:tcMar>`
-    : '';
+// The header row is set apart by weight unless the caller opts out (headerBold, or repeatHeader: false for a table
+// whose first row is data); a one-row table has no header to set apart.
+function tableHeaderBold(properties, rows) {
+  return rows > 1 && properties?.headerBold !== false && properties?.repeatHeader !== false;
+}
+
+const flushCellMargins = (first, last) => {
+  if (!first && !last) return '';
+  const left = first ? '<w:left w:w="0" w:type="dxa"/>' : '';
+  const right = last ? '<w:right w:w="0" w:type="dxa"/>' : '';
+  return `<w:tcMar>${left}${right}</w:tcMar>`;
+};
 
 // `available` is the text width, in points, of the section the table lands in.
 export function wordTableXml(operation, { available = 0 } = {}) {
@@ -298,8 +308,7 @@ export function wordTableXml(operation, { available = 0 } = {}) {
   const runProperties = wordTableRunProperties(operation.properties);
   // The header row is set apart by weight, on both backends, unless the caller
   // says otherwise; a header a reader cannot tell from the data is not one.
-  const headerBold =
-    rows > 1 && operation.properties?.headerBold !== false && operation.properties?.repeatHeader !== false;
+  const headerBold = tableHeaderBold(operation.properties, rows);
   const headerRunProperties = headerBold ? wordTableRunProperties(operation.properties, { bold: true }) : runProperties;
   const headers = tableHeaderRows(operation.properties, rows);
   const gutters = layout ? [] : gutterColumns(operation.properties);
@@ -334,10 +343,7 @@ export function wordTableXml(operation, { available = 0 } = {}) {
         // run together on a single line.
         const runs = text
           .split(/\r?\n/)
-          .map(
-            (line, lineIndex) =>
-              `${lineIndex ? '<w:br/>' : ''}<w:t${/^\s|\s$/.test(line) ? ' xml:space="preserve"' : ''}>${xmlEncode(line)}</w:t>`
-          )
+          .map((line, lineIndex) => `${lineIndex ? '<w:br/>' : ''}${wordTextElement(line)}`)
           .join('');
         // Schema order inside pPr: style and spacing before justification.
         const cellParagraphProperties = `${paragraphProperties(row)}${justifications[column] ? `<w:jc w:val="${justifications[column]}"/>` : ''}`;
@@ -494,6 +500,11 @@ function wordRunFontsXml(name, nameEastAsia) {
   return `<w:rFonts${latin}${eastAsia}/>`;
 }
 
+/** `<w:t>` for one string; edge whitespace is kept with `xml:space="preserve"`, which Word otherwise drops. */
+export function wordTextElement(text, { preserve = false } = {}) {
+  return `<w:t${preserve || /^\s|\s$/.test(text) ? ' xml:space="preserve"' : ''}>${xmlEncode(text)}</w:t>`;
+}
+
 /** `<w:tag w:val="…"/>` for a tri-state property: '' when undefined, else its on/off value. */
 function toggleXml(tag, value, on = '1', off = '0') {
   if (value === undefined) return '';
@@ -522,11 +533,10 @@ export function wordParagraph(text, { alignment = '', style = '', runProperties
     style ? `<w:pStyle w:val="${xmlEncode(style)}"/>` : '',
     justification ? `<w:jc w:val="${justification}"/>` : '',
   ].join('');
-  const value = String(text ?? '');
   return (
     `<w:p>${properties ? `<w:pPr>${properties}</w:pPr>` : ''}` +
     `<w:r>${runProperties ? `<w:rPr>${runProperties}</w:rPr>` : ''}` +
-    `<w:t${/^\s|\s$/.test(value) ? ' xml:space="preserve"' : ''}>${xmlEncode(value)}</w:t></w:r></w:p>`
+    `${wordTextElement(String(text ?? ''))}</w:r></w:p>`
   );
 }
 
@@ -627,14 +637,14 @@ export function docxTables(current) {
   });
 }
 
-// A table as a caller can pick it out of the page: its size and the words it starts with. A report's metric strip is
-// a table too, and "table 1" named it where the results table was meant; the errors now say which table is which.
 // The grid's columns, as Word counts a table's columns whatever its merges.
 function tableColumnCount(tableXml, rows = tableRowMatches(tableXml)) {
   const grid = /<w:tblGrid\b[\s\S]*?<\/w:tblGrid>/.exec(tableXml)?.[0] || '';
   return (grid.match(/<w:gridCol\b/g) || []).length || (rows.length ? rowCellMatches(rows[0][0]).length : 0);
 }
 
+// A table as a caller can pick it out of the page: its size and the words it starts with. A report's metric strip is
+// a table too, and "table 1" named it where the results table was meant; the errors now say which table is which.
 function tableSummary(tableXml) {
   const rows = tableRowMatches(tableXml);
   const columns = tableColumnCount(tableXml, rows);
@@ -655,7 +665,9 @@ export function docxTable(current, number) {
       .slice(0, 6)
       .map((table, index) => `${index + 1}: ${tableSummary(table[0])}`)
       .join('; ');
-    throw new Error(`DOCX table ${number} not found: the document holds ${tables.length} table(s)${held ? ` (${held})` : ''}`);
+    throw new Error(
+      `DOCX table ${number} not found: the document holds ${tables.length} table(s)${held ? ` (${held})` : ''}`
+    );
   }
   return match;
 }
@@ -763,12 +775,10 @@ function paragraphIndentXml({ indentLeft, indentRight, indentFirstLine }) {
   // w:hanging: a w:firstLine never goes below zero, and clamped there the mark sat inside the indent and every
   // wrapped line started under it.
   const first = Number(indentFirstLine);
-  const firstLine =
-    indentFirstLine === undefined
-      ? ''
-      : first < 0
-        ? ` w:hanging="${twips(-first)}"`
-        : ` w:firstLine="${twips(first)}"`;
+  let firstLine = '';
+  if (indentFirstLine !== undefined) {
+    firstLine = first < 0 ? ` w:hanging="${twips(-first)}"` : ` w:firstLine="${twips(first)}"`;
+  }
   return `<w:ind${left}${right}${firstLine}/>`;
 }
 
@@ -778,13 +788,11 @@ function paragraphIndentXml({ indentLeft, indentRight, indentFirstLine }) {
  * right-aligned figure, a dot leader) never see it.
  */
 export function wordTextContent(text, { preserve = false } = {}) {
-  const textXml = (part) =>
-    `<w:t${preserve || /^\s|\s$/.test(part) ? ' xml:space="preserve"' : ''}>${xmlEncode(part)}</w:t>`;
   const value = String(text ?? '');
-  if (!value.includes('\t')) return textXml(value);
+  if (!value.includes('\t')) return wordTextElement(value, { preserve });
   return value
     .split('\t')
-    .map((part) => (part ? textXml(part) : ''))
+    .map((part) => (part ? wordTextElement(part, { preserve }) : ''))
     .join('<w:tab/>');
 }
 

package/src/runtime/office/portable/portable-opc.mjs

@@ -80,7 +80,7 @@ export async function fillTemplateParts(zip, parts, tag, operation, { replace =
     changed: Object.keys(filled).length > 0,
     filled,
     unfilledTokens,
-    strict: operation.strict === true,
+    strict: Boolean(operation.strict),
   };
 }
 
@@ -267,10 +267,7 @@ export function relationshipTargetsByType(relationshipsXml, owner, type) {
     const id = xmlAttribute(attributes, 'Id');
     const target = xmlAttribute(attributes, 'Target');
     if (!id || !target) continue;
-    targets.set(
-      id,
-      target.startsWith('/') ? target.slice(1) : posix.normalize(posix.join(posix.dirname(owner), target))
-    );
+    targets.set(id, partFromTarget(posix.dirname(owner), target));
   }
   return targets;
 }
@@ -291,7 +288,7 @@ function* internalRelationships(xml) {
 
 // The part a relationship target names: absolute from the package root,
 // relative from the directory of the part that declares it.
-function partFromTarget(directory, target) {
+export function partFromTarget(directory, target) {
   return target.startsWith('/') ? target.slice(1) : posix.normalize(posix.join(directory, target));
 }
 
@@ -425,7 +422,6 @@ async function clonePartTree(zip, sourcePath, cache = new Map()) {
 
 // The relationships a copied slide must own outright before it is editable on
 // its own: everything else stays shared with the slide it was copied from.
-
 export async function cloneOwnedSlideParts(zip, relationshipsPath) {
   const xml = await zipText(zip, relationshipsPath);
   if (!xml) return [];
@@ -453,11 +449,6 @@ export async function cloneOwnedSlideParts(zip, relationshipsPath) {
   return copied;
 }
 
-// A page borrowed from another deck was drawn on that deck's layout. When this
-// deck already holds the same layout the import points at it; when the two were
-// cut from different templates the layout is copied in and adopted by this
-// deck's master, so the page keeps the geometry it was built with and the
-// master still lists every layout under it.
 // Slide layout ids live above 2^31 by the OOXML convention PowerPoint writes.
 const FIRST_SLIDE_LAYOUT_ID = 2_147_483_648;
 
@@ -501,6 +492,11 @@ async function registerLayoutOnMaster(zip, master, targetPath) {
   );
 }
 
+// A page borrowed from another deck was drawn on that deck's layout. When this
+// deck already holds the same layout the import points at it; when the two were
+// cut from different templates the layout is copied in and adopted by this
+// deck's master, so the page keeps the geometry it was built with and the
+// master still lists every layout under it.
 async function adoptImportedLayout(source, zip, layoutPath, cache) {
   const master = Object.keys(zip.files)
     .filter((name) => /^ppt\/slideMasters\/slideMaster\d+\.xml$/.test(name))
@@ -571,7 +567,9 @@ export function relationshipTarget(relPath, target) {
   let decoded = xmlDecode(target).split('#')[0].split('?')[0];
   try {
     decoded = decodeURIComponent(decoded);
-  } catch {}
+  } catch {
+    // A malformed percent escape is a literal part name: keep the text as written.
+  }
   const owner = relationshipOwner(relPath);
   const base = owner ? posix.dirname(owner) : '';
   return posix.normalize(decoded.startsWith('/') ? decoded.slice(1) : posix.join(base, decoded));

package/src/runtime/office/portable/portable-package.mjs

@@ -472,9 +472,8 @@ function worksheetWithRows(rows) {
         .map((value, columnIndex) => {
           if (value == null || value === '') return '';
           const reference = `${columnLabel(columnIndex + 1)}${rowIndex + 1}`;
-          const numeric = Number(value);
-          if (typeof value === 'number' && Number.isFinite(numeric)) {
-            return `<c r="${reference}"><v>${numeric}</v></c>`;
+          if (typeof value === 'number' && Number.isFinite(value)) {
+            return `<c r="${reference}"><v>${value}</v></c>`;
           }
           return `<c r="${reference}" t="inlineStr"><is><t>${xmlEncode(value)}</t></is></c>`;
         })
@@ -511,7 +510,7 @@ export function portableCreateSupported(fileKind) {
 
 export async function createPortableOoxmlDocument(path, { fileKind, title = '', sheetName = 'Sheet1' } = {}) {
   const kind = String(fileKind || '').toLowerCase();
-  const family = Object.hasOwn(FILE_KIND_FAMILIES, kind) ? FILE_KIND_FAMILIES[kind] : '';
+  const family = portableCreateSupported(kind) ? FILE_KIND_FAMILIES[kind] : '';
   if (!family) {
     throw new Error(
       `Portable Office creation supports ${Object.keys(FILE_KIND_FAMILIES).join(', ')}; .${kind || 'unknown'} requires Microsoft Office`

package/src/runtime/office/portable/portable-pivot.mjs

@@ -1,13 +1,17 @@
 import { posix } from 'node:path';
 import { addPackageRelationship, ensureContentTypeOverride, partRelationshipPath, zipText } from './portable-opc.mjs';
 import { columnLabel, columnNumber, parseCellRef, setCellInSheet } from './portable-cells.mjs';
-import { SPREADSHEET_MAIN, XML_HEADER, xmlEncode } from './portable-xml.mjs';
+import {
+  OFFICE_RELATIONSHIP_BASE as RELATIONSHIP_BASE,
+  SPREADSHEET_MAIN,
+  XML_HEADER,
+  xmlEncode,
+} from './portable-xml.mjs';
 
 const CACHE_DEFINITION_CONTENT_TYPE =
   'application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml';
 const CACHE_RECORDS_CONTENT_TYPE = 'application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml';
 const PIVOT_TABLE_CONTENT_TYPE = 'application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml';
-const RELATIONSHIP_BASE = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships';
 
 // axes: the field indexes laid out as rows or columns. A numeric field on an axis is still a set of items — "Year"
 // across the top is 2013 and 2014, not a sum — so its values are listed as numeric items; left as a bare number
@@ -116,7 +120,7 @@ function cacheRecordsXml(fields, records) {
 // autofit, or a fit audit to read, so the computed grid is written as cells.
 // The captions a pivot prints, in the language of its fields: Korean Excel heads a sum "합계 : 매출" and its totals
 // "총합계"; written in English beside Hangul fields, a pivot read "Sum of 매출" over "Grand Total".
-export function pivotCaptions(fields) {
+function pivotCaptions(fields) {
   const korean = /[\uac00-\ud7af]/.test(fields.map((field) => field?.name ?? '').join(''));
   return korean
     ? { sum: (name) => `합계 : ${name}`, grand: '총합계', total: '합계' }