@patrickdk77/office-defuse 0.0.0-stage → 0.1.0

package/dist/links.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAbsoluteTarget = exports.isInsidePackage = exports.isLocalTarget = exports.isFragment = void 0;
+exports.checkLink = checkLink;
+const types_1 = require("./types");
+const xml_1 = require("./xml");
+const IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/;
+const SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
+/** A browser drops control characters from a URL, and so does this before reading one. */
+const clean = (s) => s.replace(/\p{Cc}/gu, '').trim();
+const networkPrefix = (s) => s.startsWith('\\\\') || s.startsWith('//') || s.startsWith('\\/') || s.startsWith('/\\');
+/** A target that names the same document or a place in it. RFC 3986 reads an empty reference as the document itself. */
+const isFragment = (target) => {
+    const t = clean(target);
+    return t === '' || t.startsWith('#');
+};
+exports.isFragment = isFragment;
+/**
+ * Classifies a hyperlink target with pdf-defuse's checks, without the comparison of the target with the link's text.
+ * Call it only for targets that are more than a fragment. A target that holds the content of an external entity
+ * cannot be read, and reads as the empty string: a relative link, which is what pdf-defuse makes of a URI it cannot
+ * resolve.
+ */
+function checkLink(rawTarget) {
+    const uri = rawTarget.includes(xml_1.UNKNOWN) ? '' : clean(rawTarget);
+    const link = (detail, site) => ({ category: types_1.OfficeCategory.Link, detail, host: site });
+    if (networkPrefix(uri))
+        return link(types_1.OfficeDetail.NetworkPath);
+    const m = SCHEME.exec(uri);
+    if (!m)
+        return link(types_1.OfficeDetail.Relative);
+    const scheme = m[1].toLowerCase();
+    // C:\path is a drive, not a scheme.
+    if (scheme.length === 1)
+        return link(types_1.OfficeDetail.FileUrl);
+    if (scheme === 'javascript' || scheme === 'vbscript')
+        return link(types_1.OfficeDetail.ScriptUrl);
+    if (scheme === 'vnd.sun.star.script' || scheme === 'macro')
+        return { category: types_1.OfficeCategory.Macro, detail: types_1.OfficeDetail.Link };
+    if (scheme === 'data')
+        return link(types_1.OfficeDetail.DataUrl);
+    if (scheme === 'smb' || scheme === 'cifs' || scheme === 'afp' || scheme === 'nfs')
+        return link(types_1.OfficeDetail.NetworkPath);
+    if (scheme === 'file') {
+        let host = '';
+        try {
+            host = new URL(uri).hostname;
+        }
+        catch {
+            // A file: URL the parser refuses is read as a local path.
+        }
+        return link(host && host.toLowerCase() !== 'localhost' ? types_1.OfficeDetail.NetworkPath : types_1.OfficeDetail.FileUrl);
+    }
+    if (scheme === 'mailto') {
+        let addr = uri.slice(7).split('?')[0];
+        try {
+            addr = decodeURIComponent(addr);
+        }
+        catch {
+            // The address stays as written.
+        }
+        const domain = addr.includes('@') ? addr.slice(addr.lastIndexOf('@') + 1).toLowerCase() : '';
+        return link(hostVerdict(domain, domain) ?? types_1.OfficeDetail.Safe, domain);
+    }
+    if (scheme !== 'http' && scheme !== 'https')
+        return link(types_1.OfficeDetail.OtherScheme);
+    // The authority as written, before the URL parser normalizes it.
+    const rawAuth = uri
+        .slice(m[0].length)
+        .replace(/^[\\/]*/, '')
+        .split(/[/\\?#]/, 1)[0];
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return link(types_1.OfficeDetail.OtherScheme);
+    }
+    if (parsed.username || parsed.password || rawAuth.includes('@'))
+        return link(types_1.OfficeDetail.Credentials);
+    // The parser lowercases, punycodes and turns every IPv4 shorthand into dotted form, as browsers do.
+    const host = parsed.hostname.replace(/\.$/, '');
+    return link(hostVerdict(host, rawAuth) ?? types_1.OfficeDetail.Safe, host);
+}
+function hostVerdict(host, raw) {
+    if (!host)
+        return types_1.OfficeDetail.OtherScheme;
+    if (raw.includes('%'))
+        return types_1.OfficeDetail.EncodedHost;
+    if (host.startsWith('[') || IPV4.test(host))
+        return types_1.OfficeDetail.IpHost;
+    if (/^\d+$/.test(host) || /^0x[0-9a-f]+$/i.test(host))
+        return types_1.OfficeDetail.IpHost;
+    if (/\P{ASCII}/u.test(host) || host.split('.').some(label => label.startsWith('xn--')))
+        return types_1.OfficeDetail.LookalikeHost;
+    return undefined;
+}
+/**
+ * The target with every %XX turned into its character. A target can percent-encode its scheme, as `%73cript:` does in
+ * a CVE-2017-0199 sample, so the checks below hold a target local or inside the package only when both forms are.
+ */
+const decoded = (s) => s.replace(/%([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+function local(t) {
+    if (networkPrefix(t))
+        return false;
+    const m = SCHEME.exec(t);
+    if (!m || m[1].length === 1)
+        return true;
+    if (m[1].toLowerCase() !== 'file')
+        return false;
+    try {
+        const host = new URL(t).hostname;
+        return !host || host.toLowerCase() === 'localhost';
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Whether a target outside the file is on this machine: a drive path, a file: URL without a host, an absolute path or
+ * a relative one. A UNC path, a file: URL with a host and every other scheme reach elsewhere, and so can a target that
+ * holds the content of an external entity.
+ */
+const isLocalTarget = (rawTarget) => !rawTarget.includes(xml_1.UNKNOWN) && local(clean(rawTarget)) && local(clean(decoded(rawTarget)));
+exports.isLocalTarget = isLocalTarget;
+function inside(t) {
+    if (t === '' || networkPrefix(t) || SCHEME.test(t) || t.startsWith('/') || t.startsWith('\\'))
+        return false;
+    let depth = 0;
+    for (const seg of t.split(/[/\\]/)) {
+        if (seg === '..')
+            depth--;
+        else if (seg !== '.' && seg !== '')
+            depth++;
+        if (depth < 0)
+            return false;
+    }
+    return true;
+}
+/** Whether an ODF reference names an entry inside the package: a relative path that does not climb out of it. */
+const isInsidePackage = (rawHref) => inside(clean(rawHref)) && inside(clean(decoded(rawHref)));
+exports.isInsidePackage = isInsidePackage;
+/** Whether an OOXML relationship target is not a part name, whatever TargetMode says: a scheme, a drive or a network path. */
+const isAbsoluteTarget = (rawTarget) => [rawTarget, decoded(rawTarget)].some(t => SCHEME.test(clean(t)) || t.startsWith('\\') || t.startsWith('//'));
+exports.isAbsoluteTarget = isAbsoluteTarget;

package/dist/odf.d.ts

@@ -0,0 +1,3 @@
+import { type RunContext } from './context';
+/** Inspects an OpenDocument package. */
+export declare function inspectOdf(ctx: RunContext): Promise<void>;

package/dist/odf.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectOdf = inspectOdf;
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const formats_1 = require("./formats");
+const formulas_1 = require("./formulas");
+const links_1 = require("./links");
+const types_1 = require("./types");
+const zip_1 = require("./zip");
+const NS = {
+    manifest: 'urn:oasis:names:tc:opendocument:xmlns:manifest:1.0',
+    office: 'urn:oasis:names:tc:opendocument:xmlns:office:1.0',
+    script: 'urn:oasis:names:tc:opendocument:xmlns:script:1.0',
+    presentation: 'urn:oasis:names:tc:opendocument:xmlns:presentation:1.0',
+    text: 'urn:oasis:names:tc:opendocument:xmlns:text:1.0',
+    draw: 'urn:oasis:names:tc:opendocument:xmlns:drawing:1.0',
+    table: 'urn:oasis:names:tc:opendocument:xmlns:table:1.0',
+    form: 'urn:oasis:names:tc:opendocument:xmlns:form:1.0',
+    meta: 'urn:oasis:names:tc:opendocument:xmlns:meta:1.0',
+    style: 'urn:oasis:names:tc:opendocument:xmlns:style:1.0',
+    database: 'urn:oasis:names:tc:opendocument:xmlns:database:1.0',
+    xlink: 'http://www.w3.org/1999/xlink',
+};
+/**
+ * Folders of code and settings. Each is reported by name, as a whole, so the files in them are inflated and checked
+ * but not parsed.
+ */
+const FOLDERS = [
+    ['basic', types_1.OfficeDetail.OdfBasic, types_1.OfficeCategory.Macro],
+    ['scripts', types_1.OfficeDetail.OdfScripts, types_1.OfficeCategory.Macro],
+    ['dialogs', types_1.OfficeDetail.OdfDialogs, types_1.OfficeCategory.Macro],
+    ['configurations2', types_1.OfficeDetail.OdfConfiguration, types_1.OfficeCategory.Ui],
+];
+/** Event names that fire as the document opens. Focus and activation count only for the document's own events. */
+const ON_OPEN = new Set(['load', 'new', 'create', 'loadfinished', 'viewcreated']);
+const ON_OPEN_DOCUMENT = new Set(['focus', 'activate']);
+const LINK_ELEMENTS = new Set([`${NS.text} a`, `${NS.draw} a`, `${NS.draw} area-rectangle`, `${NS.draw} area-circle`, `${NS.draw} area-polygon`]);
+const EXTERNAL_KIND = new Map([
+    [`${NS.meta} template`, types_1.OfficeDetail.Template],
+    [`${NS.meta} auto-reload`, types_1.OfficeDetail.Reload],
+    [`${NS.draw} image`, types_1.OfficeDetail.Image],
+    [`${NS.draw} fill-image`, types_1.OfficeDetail.Image],
+    [`${NS.style} background-image`, types_1.OfficeDetail.Image],
+    [`${NS.text} section-source`, types_1.OfficeDetail.Include],
+    [`${NS.table} table-source`, types_1.OfficeDetail.Include],
+    [`${NS.draw} object`, types_1.OfficeDetail.Object],
+    [`${NS.draw} object-ole`, types_1.OfficeDetail.Object],
+    [`${NS.draw} floating-frame`, types_1.OfficeDetail.Frame],
+]);
+/** Elements whose reference always leaves the package: it resolves against the document's own location. */
+const ALWAYS_OUTSIDE = new Set([`${NS.meta} template`, `${NS.meta} auto-reload`, `${NS.text} section-source`, `${NS.table} table-source`]);
+/**
+ * LibreOffice reads urn:oasis:names:tc:<any>:xmlns:<name>:1.<any> as the OpenDocument namespace <name> 1.0, so this
+ * does too. The comparison ignores case, which can only find more.
+ */
+function odfNs(ns) {
+    const m = /^urn:oasis:names:tc:[^:]*:xmlns:([^:]*):1\.[^:]+$/i.exec(ns);
+    return m ? `urn:oasis:names:tc:opendocument:xmlns:${m[1].toLowerCase()}:1.0` : ns;
+}
+/** An attribute by normalized namespace and local name. */
+function oattr(el, ns, local) {
+    for (const a of el.attributes)
+        if (a.local === local && odfNs(a.ns) === ns)
+            return a.value;
+    return undefined;
+}
+/** A path inside the package as the manifest and the zip name it: without "./" and leading slashes. */
+const packagePath = (href) => (0, zip_1.nameKey)(href.trim().replace(/^(\.\/)+/, ''));
+/** The rules that read inside one XML entry of an ODF package. */
+class EntryRules {
+    ctx;
+    entry;
+    oleRefs;
+    /** Depth of the office:scripts element being read, 0 outside one. */
+    scriptsDepth = 0;
+    /** An office:script element being read, with whether it holds anything. */
+    script;
+    constructor(ctx, entry, 
+    /** Whether an object refers to each entry, by key. Only entries are kept, so a part full of references costs no memory. */
+    oleRefs) {
+        this.ctx = ctx;
+        this.entry = entry;
+        this.oleRefs = oleRefs;
+    }
+    report(category, detail, data) {
+        this.ctx.report(category, detail, this.entry, data);
+    }
+    start(raw) {
+        if (this.script)
+            this.script.content = true;
+        const el = { ...raw, ns: odfNs(raw.ns) };
+        const key = `${el.ns} ${el.local}`;
+        const href = oattr(el, NS.xlink, 'href');
+        if (el.ns === NS.office && el.local === 'scripts' && !this.scriptsDepth)
+            this.scriptsDepth = el.depth;
+        else if (el.ns === NS.office && el.local === 'script')
+            this.script = { depth: el.depth, language: oattr(el, NS.script, 'language') ?? '', content: false };
+        else if (el.ns === NS.script && el.local === 'event-listener')
+            this.scriptEvent(el, href);
+        else if (el.ns === NS.presentation && el.local === 'event-listener')
+            this.presentationEvent(el, href);
+        else if ((el.ns === NS.text && el.local === 'dde-connection-decl') || (el.ns === NS.office && el.local === 'dde-source')) {
+            this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, { application: (0, context_1.clip)(oattr(el, NS.office, 'dde-application') ?? ''), topic: (0, context_1.clip)(oattr(el, NS.office, 'dde-topic') ?? '') });
+        }
+        else if (el.ns === NS.draw && el.local === 'applet') {
+            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, { code: (0, context_1.clip)(oattr(el, NS.draw, 'code') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) });
+            return;
+        }
+        else if (el.ns === NS.draw && el.local === 'plugin') {
+            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, { mimeType: (0, context_1.clip)(oattr(el, NS.draw, 'mime-type') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) });
+            return;
+        }
+        else if (el.ns === NS.draw && el.local === 'object-ole' && (href === undefined || (0, links_1.isInsidePackage)(href))) {
+            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, href ? { target: (0, context_1.clip)(href) } : undefined);
+            if (href && this.oleRefs.has(packagePath(href)))
+                this.oleRefs.set(packagePath(href), true);
+        }
+        for (const a of el.attributes) {
+            if (odfNs(a.ns) === NS.table && (a.local === 'formula' || a.local === 'expression') && (0, formulas_1.callsDde)(a.value))
+                this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, { formula: (0, context_1.clip)(a.value) });
+        }
+        if (href === undefined || (0, links_1.isFragment)(href) || (el.ns === NS.script && el.local === 'event-listener') || (el.ns === NS.presentation && el.local === 'event-listener'))
+            return;
+        // A database document names its own embedded database this way.
+        if (el.ns === NS.database && el.local === 'connection-resource' && /^sdbc:embedded:/i.test(href.trim()))
+            return;
+        if (LINK_ELEMENTS.has(key) || (el.ns === NS.form && el.local !== 'form'))
+            this.ctx.link(href, this.entry, { element: (0, context_1.clip)(el.qname) });
+        else if ((ALWAYS_OUTSIDE.has(key) || !(0, links_1.isInsidePackage)(href)) && !(el.ns === NS.form && el.local === 'form')) {
+            this.ctx.external(EXTERNAL_KIND.get(key) ?? types_1.OfficeDetail.Other, href, this.entry, { element: (0, context_1.clip)(el.qname) }, (0, context_1.clip)(el.local));
+        }
+    }
+    text(t) {
+        if (this.script && t.trim())
+            this.script.content = true;
+    }
+    end(el) {
+        if (this.scriptsDepth === el.depth && odfNs(el.ns) === NS.office && el.local === 'scripts')
+            this.scriptsDepth = 0;
+        if (this.script && this.script.depth === el.depth) {
+            if (this.script.content)
+                this.report(types_1.OfficeCategory.Macro, /basic/i.test(this.script.language) ? types_1.OfficeDetail.OdfBasic : types_1.OfficeDetail.OdfScripts, { language: (0, context_1.clip)(this.script.language) });
+            this.script = undefined;
+        }
+    }
+    scriptEvent(el, href) {
+        const event = oattr(el, NS.script, 'event-name') ?? '';
+        // LibreOffice runs nothing for a listener whose script URL and macro name are both empty. An empty href does not
+        // hide a macro name.
+        const target = [href, oattr(el, NS.script, 'macro-name')].find(v => v !== undefined && v !== '');
+        if (target === undefined)
+            return;
+        const name = event
+            .slice(event.lastIndexOf(':') + 1)
+            .toLowerCase()
+            .replace(/^on/, '')
+            .replace(/-/g, '');
+        const onOpen = ON_OPEN.has(name) || (this.scriptsDepth > 0 && ON_OPEN_DOCUMENT.has(name));
+        const data = { event: (0, context_1.clip)(event), target: (0, context_1.clip)(target), language: (0, context_1.clip)(oattr(el, NS.script, 'language') ?? '') };
+        if (onOpen)
+            this.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.EventOnOpen, data);
+        else
+            this.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Event, data);
+    }
+    presentationEvent(el, href) {
+        const action = oattr(el, NS.presentation, 'action') ?? '';
+        const data = { event: (0, context_1.clip)(oattr(el, NS.script, 'event-name') ?? ''), action: (0, context_1.clip)(action), ...(href ? { target: (0, context_1.clip)(href) } : {}) };
+        if (action === 'execute')
+            this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, data);
+        else if (action === 'verb')
+            this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, data);
+        else if (href !== undefined && !(0, links_1.isFragment)(href))
+            this.ctx.link(href, this.entry, data);
+    }
+}
+/** The manifest. Only paths that name an entry of the archive are kept, so a manifest of millions costs no memory. */
+async function readManifest(ctx, entry) {
+    const keys = new Set(ctx.zip.entries.map(e => (0, zip_1.nameKey)(e.name)));
+    const m = { paths: new Set(), encrypted: false };
+    await ctx.parse(entry, {
+        start(el) {
+            if (odfNs(el.ns) !== NS.manifest)
+                return;
+            if (el.local === 'encryption-data')
+                m.encrypted = true;
+            if (el.local !== 'file-entry')
+                return;
+            const path = oattr(el, NS.manifest, 'full-path');
+            if (path === undefined)
+                return;
+            if (path === '/') {
+                if (m.root !== undefined)
+                    ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, entry.name, { kind: 'manifest path', name: '/' });
+                m.root = oattr(el, NS.manifest, 'media-type') ?? '';
+                return;
+            }
+            const key = packagePath(path);
+            if (!keys.has(key))
+                return;
+            if (m.paths.has(key))
+                ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, entry.name, { kind: 'manifest path', name: (0, context_1.clip)(path) });
+            m.paths.add(key);
+        },
+    });
+    return m;
+}
+/** The code folder an entry sits in, as the folder's path and its finding. */
+function folderOf(name) {
+    const segs = name.split('/');
+    for (let i = 0; i < segs.length - 1; i++) {
+        const hit = FOLDERS.find(([folder]) => folder === segs[i].toLowerCase());
+        if (hit)
+            return { prefix: `${segs.slice(0, i + 1).join('/')}/`, detail: hit[1], category: hit[2] };
+    }
+    return undefined;
+}
+/** The most of the mimetype entry that is kept. The longest media type in the table is 56 characters. */
+const MAX_MIMETYPE = 256;
+/** Inspects an OpenDocument package. */
+async function inspectOdf(ctx) {
+    const zip = ctx.zip;
+    const mimetype = zip.entries.find(e => e.name === 'mimetype');
+    const manifestEntry = zip.get('META-INF/manifest.xml');
+    const layout = (reason) => ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.OdfLayout, mimetype?.name ?? 'META-INF/manifest.xml', { reason });
+    let declared;
+    if (mimetype) {
+        let head = Buffer.alloc(0);
+        await ctx.drain(mimetype, c => {
+            if (head.length < MAX_MIMETYPE)
+                head = Buffer.concat([head, c.subarray(0, MAX_MIMETYPE - head.length)]);
+        });
+        // A longer entry holds no media type this package reads, whatever its start says.
+        declared = head.toString('latin1') + (mimetype.size > MAX_MIMETYPE ? '...' : '');
+        const first = zip.entries.reduce((a, b) => (b.localOffset < a.localOffset ? b : a));
+        if (first !== mimetype)
+            layout('mimetype is not the first entry');
+        if (mimetype.method !== 0)
+            layout('mimetype is compressed');
+        if (mimetype.localExtra)
+            layout('mimetype has an extra field');
+        if (declared !== declared.trim())
+            layout('mimetype has white space around the media type');
+        declared = declared.trim();
+    }
+    else
+        layout('there is no mimetype entry');
+    const manifest = manifestEntry ? await readManifest(ctx, manifestEntry) : undefined;
+    if (!manifest)
+        layout('there is no manifest');
+    const root = manifest?.root;
+    if (declared !== undefined && root !== undefined && declared !== root && formats_1.ODF_FORMATS.has(declared) && formats_1.ODF_FORMATS.has(root)) {
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'The mimetype entry and the manifest name different formats', { mimetype: (0, context_1.clip)(declared), manifest: (0, context_1.clip)(root) });
+    }
+    const type = declared ?? root ?? '';
+    const format = formats_1.ODF_FORMATS.get(type);
+    if (!format)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The OpenDocument media type is not one this package reads', { mediaType: (0, context_1.clip)(type) });
+    ctx.format = format;
+    if (manifest?.encrypted)
+        throw new errors_1.StopError(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, 'The manifest lists encrypted entries');
+    const folders = new Map();
+    const oleRefs = new Map(zip.entries.map(e => [(0, zip_1.nameKey)(e.name), false]));
+    const oleEntries = [];
+    for (const entry of zip.entries) {
+        if (entry === mimetype || entry === manifestEntry)
+            continue;
+        const folder = folderOf(entry.name);
+        if (folder) {
+            // LibreOffice writes an empty Configurations2/accelerator/current.xml into the documents it saves. An empty
+            // file holds no code or setting.
+            if (entry.size > 0) {
+                const f = folders.get(folder.prefix) ?? { detail: folder.detail, category: folder.category, entries: 0 };
+                f.entries++;
+                folders.set(folder.prefix, f);
+            }
+            await ctx.drain(entry);
+        }
+        else if (!entry.directory && /\.xml$/i.test(entry.name))
+            await ctx.parse(entry, new EntryRules(ctx, entry.name, oleRefs));
+        else if (await ctx.drain(entry))
+            oleEntries.push(entry);
+    }
+    for (const [prefix, f] of folders)
+        ctx.report(f.category, f.detail, prefix, { entries: f.entries });
+    for (const e of oleEntries)
+        if (!oleRefs.get((0, zip_1.nameKey)(e.name)))
+            ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name });
+    if (manifest) {
+        for (const e of zip.entries) {
+            if (e.directory || e === mimetype || e === manifestEntry || /^meta-inf\//i.test(e.name))
+                continue;
+            if (!manifest.paths.has((0, zip_1.nameKey)(e.name)))
+                ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, e.name, { part: e.name });
+        }
+    }
+}

package/dist/ooxml.d.ts

@@ -0,0 +1,8 @@
+import { type RunContext } from './context';
+import { type ZipEntry } from './zip';
+/**
+ * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
+ * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
+ * leave behind only which parts they reach and how.
+ */
+export declare function inspectOoxml(ctx: RunContext, contentTypes: ZipEntry): Promise<void>;