chore(typst): clean up dead code and one more global leak

- parse_multiple was declared without `local`, leaking as a global on
  every module load. Made it `local function` (forward use in
  translate_border still works since the local is declared above).
- Removed `set_brand_mode = set_brand_mode,` from the export table:
  set_brand_mode is never defined in this module and has no callers
  anywhere, so the export silently resolved to nil — a phantom API
  surface.
- Removed dead `local mult = 1` initial assignment (immediately
  overwritten in every branch); now just `local mult` then assigned.
- Removed unused `local dash` in translate_border_style.
- Removed a duplicate `local function quote(s)` definition (two
  identical copies of the same function body, the first one dead).
- Removed a trailing-whitespace nit.

Two regression tests added in tests/unit-lua/typst-css.test.lua:
- TestModuleNoGlobalLeak.testParseMultipleNotGlobal — `_G.parse_multiple`
  must be nil after the module loads.
- TestModuleExports.testNoPhantomExports — every key listed on the LHS
  of the module's `return { ... }` block must resolve to a non-nil
  value on the loaded module. (pairs() can't see this because Lua
  tables drop nil-valued keys, so the test reads the source file.)

Author: gordonwoodhull

src/resources/filters/modules/typst_css.lua

@@ -357,7 +357,7 @@ local function output_color(color, opacity, warnings)
       end
       color = _quarto.format.typst.css.parse_color(cssColor)
     end
-    local mult = 1
+    local mult
     if opacity.unit == 'int' then
       mult = opacity.value / 255.9999
     elseif opacity.unit == 'percent' then
@@ -553,7 +553,7 @@ local function output_length(length, warnings)
   if not csf then
     output_warning(warnings, 'unit ' .. length.unit .. ' is not supported in ' .. length.csslen )
     return nil
-  end 
+  end
   return csf(length.value, length.unit, length.csslen, warnings)
 end
 
@@ -567,7 +567,7 @@ local border_styles = {
   'none', 'hidden', 'dotted', 'dashed', 'solid', 'double', 'groove', 'ridge', 'inset', 'outset', 'inherit', 'initial', 'revert', 'revert-layer', 'unset'
 }
 
-function parse_multiple(s, limit, callback)
+local function parse_multiple(s, limit, callback)
   local start = 0
   local count = 0
   repeat
@@ -593,10 +593,6 @@ local function translate_border_width(v, warnings)
   return thickness == '0pt' and 'delete' or thickness
 end
 
-local function quote(s)
-  return '"' .. s .. '"'
-end
-
 local same_weights = {
   'thin',
   'light',
@@ -660,7 +656,6 @@ end
 
 
 local function translate_border_style(v, _warnings)
-  local dash
   if v == 'none' then
     return 'delete'
   elseif tcontains({'dotted', 'dashed'}, v) then
@@ -777,7 +772,6 @@ end
 return {
   quote = quote,
   dequote = dequote,
-  set_brand_mode = set_brand_mode,
   parse_color = parse_color,
   parse_opacity = parse_opacity,
   output_color = output_color,

tests/unit-lua/typst-css.test.lua

@@ -226,4 +226,43 @@ function TestConsumeNoGlobalLeak:testConsumeStyleDoesNotLeak()
   lu.assertNil(rawget(_G, 'fend'), 'consume_style leaked global "fend"')
 end
 
+-- The module's `function parse_multiple(...)` declaration is missing
+-- `local`, so loading the module installs `parse_multiple` as a global.
+TestModuleNoGlobalLeak = {}
+
+function TestModuleNoGlobalLeak:testParseMultipleNotGlobal()
+  lu.assertNil(rawget(_G, 'parse_multiple'),
+    'loading typst_css leaked global "parse_multiple"')
+end
+
+-- Every key listed on the LHS of the module's `return { ... }` table
+-- should resolve to a non-nil value on the loaded module. A `K = V,`
+-- entry where `V` is undefined silently turns the export into nil
+-- (Lua tables drop nil-valued keys), so `pairs(typst_css)` cannot see
+-- the bug — we have to read the source.
+TestModuleExports = {}
+
+function TestModuleExports:testNoPhantomExports()
+  local source_path = package.searchpath('typst_css', package.path)
+  lu.assertNotNil(source_path, 'could not find typst_css.lua source')
+  local f = assert(io.open(source_path, 'r'))
+  local src = f:read('*all')
+  f:close()
+
+  -- Anchor on `\nreturn {` and `\n}` so we pick the top-level export
+  -- block, not an indented `return { ... }` inside a function body.
+  local export_body = src:match('\nreturn%s*{(.-)\n}%s*$')
+  lu.assertNotNil(export_body, 'could not locate top-level export table')
+
+  local nils = {}
+  for k in export_body:gmatch('([%w_]+)%s*=') do
+    if typst_css[k] == nil then
+      table.insert(nils, k)
+    end
+  end
+  lu.assertEquals(#nils, 0,
+    'phantom exports (LHS in source but nil on module): ' ..
+    table.concat(nils, ', '))
+end
+
 os.exit(lu.LuaUnit.run())