chore(deps): upgrade docx to 9.15.2 - #9895

Summary

• Upgrades docx 9.7.1 → 9.15.2 (apps/sim). The upstream changes: charts, shapes, layout, docx/html, macros. 9.13 replaced xml/xml-js with docx's own XML reader/writer. 9.15 replaced jszip/hash.js with fflate and docx's own hashing. Transitive deps dropped: xml, xml-js, hash.js, minimalistic-assert. Added: fflate@0.8.3.
• Fixes a break the upgrade would otherwise ship: 9.15 encodes Packer.toBase64String with the global btoa. The isolated-vm sandbox doesn't have btoa, so docx-generate's finalize threw ReferenceError: btoa is not defined, which means every in-app docx generation would fail. The finalize now packs with Packer.toArrayBuffer, the same way the pptx/pdf tasks return raw bytes. That also removes the hand-rolled base64 decoder, which only existed because JSZip's browser build had no binary output.
• New regression test in bundles/verify.test.ts: it runs the checked-in docx.cjs with the real docxGenerateTask bootstrap and finalize in a bare, isolate-shaped context. createBareSandboxContext is now factored out of verify.ts. The test fails on the old finalize (btoa is not defined) and passes on the new one. The existing bundle check only asserts constructors exist, so it couldn't catch this.
• docx now drops the control characters XML 1.0 forbids by itself, so the Word block's pre-strip in buildDocxFromContent is removed. The existing test that asserts this behavior still passes. stripInvalidXmlChars is still used for the hand-written append/replace XML.
• Regenerated bundles/docx.cjs (448 KB → 330 KB). The bundle no longer contains the esbuild __require shim, so I reworded the comments that blamed docx for it. The polyfill itself is unchanged, because it's inlined into every bundle.

Type of Change

• Bug fix
• Other: dependency upgrade

Testing

• Proof script (scratchpad, not committed): drives Sim's real code on staging (9.7.1) vs this branch (9.15.2). Paths covered: buildDocxFromContent plus appendParagraphsToDocx, replaceTextInDocx and extractDocxText on its output, and runSandboxTask('docx-generate') through the real isolated-vm worker. Content: headings, bullets, numbered lists, a table with shading, two images (with and without alt text), an external hyperlink, a footer page-number field, two sections, & < > " ', accents, CJK/Arabic, ZWJ emoji, control chars, and long text.
  • Every XML part in every output was parsed strictly with lxml, and each file was opened with python-docx. The new outputs all pass.
  • Word block: word/document.xml is byte-identical before and after for build, append and replace. Extracted text and the append/replace counts are also identical.
  • Sandbox, before (9.7.1): the output is malformed. A raw \x01 lands in document.xml, so lxml and python-docx both reject it. Both images also got wp:docPr id="1", which is a duplicate. After (9.15.2): well-formed, opens in python-docx, the control char is stripped, docPr ids are unique (1, 2) and the empty alt text is omitted. Text, tables, 2 inline images and 2 sections all read back correctly.
  • The remaining structural differences are all intended upstream changes:
    • a theme1.xml part is added
    • comments.xml is only written when the document has comments
    • styles.xml gains a default Normal paragraph style, plus TableNormal, Caption, Bibliography and TOC1–TOC9
    • w:defaultTabStop=720 is added to settings
    • w15:tentative → w:tentative in numbering
    • a section's sectPr goes into its last paragraph instead of an extra empty paragraph
    • each page-field part gets its own run
    • media is named image1.png instead of a hash
    • zip directory entries are dropped
• vitest: microsoft-word/document.server.test.ts, sandbox/bundles/verify.test.ts, file-parsers/registry.test.ts, file-parsers/sniff.test.ts, mothership/vfs/document-style.test.ts: 82 passed.
• bun install --frozen-lockfile is clean. check:test-patterns and check:comment-hygiene pass. Biome is clean on the changed files.
• Not covered here: the E2B doc-sandbox path (compile.ts, require('docx')) uses the docx installed in the E2B template, not this lockfile.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code