@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/ooxml.js

@@ -1,24 +1,37 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.relsSource = exports.R_NS = exports.SHEET_NS = exports.WORD_NS = exports.isXmlType = exports.TYPE = exports.REL = exports.XPS_NS = exports.XPS_MAIN = exports.RELS_NS = exports.CONTENT_TYPES_NS = void 0;
+exports.resolveTarget = resolveTarget;
+exports.resolvePartRef = resolvePartRef;
+exports.xpsResources = xpsResources;
+exports.readRelationships = readRelationships;
 exports.inspectOoxml = inspectOoxml;
+const biff_1 = require("./biff");
+const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
+const fields_1 = require("./fields");
 const formats_1 = require("./formats");
 const formulas_1 = require("./formulas");
 const links_1 = require("./links");
+const plan_1 = require("./plan");
 const types_1 = require("./types");
 const xlsb_1 = require("./xlsb");
 const xml_1 = require("./xml");
 const zip_1 = require("./zip");
-const CONTENT_TYPES_NS = 'http://schemas.openxmlformats.org/package/2006/content-types';
-const RELS_NS = 'http://schemas.openxmlformats.org/package/2006/relationships';
+exports.CONTENT_TYPES_NS = 'http://schemas.openxmlformats.org/package/2006/content-types';
+exports.RELS_NS = 'http://schemas.openxmlformats.org/package/2006/relationships';
 const T = 'http://schemas.openxmlformats.org/officedocument/2006/relationships/';
 const S = 'http://purl.oclc.org/ooxml/officedocument/relationships/';
 const MS = 'http://schemas.microsoft.com/office/2006/relationships/';
 const both = (name) => [T + name, S + name];
+/** The relationship types that name an XPS package's FixedDocumentSequence, lowercased. */
+exports.XPS_MAIN = { xps: 'http://schemas.microsoft.com/xps/2005/06/fixedrepresentation', oxps: 'http://schemas.openxps.org/oxps/v1.0/fixedrepresentation' };
+/** The XPS and OpenXPS markup namespaces, lowercased. */
+exports.XPS_NS = new Set(['http://schemas.microsoft.com/xps/2005/06', 'http://schemas.openxps.org/oxps/v1.0']);
 /** Relationship types, lowercased, as OPC compares them without regard to case. */
-const REL = {
-    main: new Set([...both('officedocument'), 'http://schemas.microsoft.com/visio/2010/relationships/document']),
+exports.REL = {
+    main: new Set([...both('officedocument'), 'http://schemas.microsoft.com/visio/2010/relationships/document', exports.XPS_MAIN.xps, exports.XPS_MAIN.oxps]),
     hyperlink: new Set(both('hyperlink')),
     template: new Set(both('attachedtemplate')),
     image: new Set([...both('image'), 'http://schemas.microsoft.com/office/2007/relationships/hdphoto']),
@@ -44,7 +57,7 @@ const REACHED_AS = new Map([
     [`${MS}activexcontrolbinary`, AS.controlBinary],
 ]);
 /** Content types, lowercased. */
-const TYPE = {
+exports.TYPE = {
     vba: new Set(['application/vnd.ms-office.vbaproject']),
     macrosheet: new Set(['application/vnd.ms-excel.macrosheet+xml', 'application/vnd.ms-excel.intlmacrosheet+xml', 'application/vnd.ms-excel.macrosheet', 'application/vnd.ms-excel.intlmacrosheet']),
     ole: new Set(['application/vnd.openxmlformats-officedocument.oleobject']),
@@ -53,32 +66,50 @@ const TYPE = {
     vml: 'application/vnd.openxmlformats-officedocument.vmldrawing',
     xlsbExternalLink: 'application/vnd.ms-excel.externallink',
 };
+/** Whether the rules read a part of this content type as XML. */
+const isXmlType = (ct) => ct !== undefined && (ct.endsWith('+xml') || ct === 'application/xml' || ct === 'text/xml' || ct === exports.TYPE.vml);
+exports.isXmlType = isXmlType;
+/**
+ * Binary parts that belong to the package's own format rather than being files of their own: the records of a binary
+ * workbook, printer settings, obfuscated fonts, VBA project signatures and the origin of digital signatures.
+ */
+const formatBinary = (ct) => ct.startsWith('application/vnd.ms-excel.') ||
+    ct.endsWith('.printersettings') ||
+    ct === 'application/vnd.openxmlformats-officedocument.obfuscatedfont' ||
+    ct === 'application/vnd.ms-package.obfuscated-opentype' ||
+    ct.startsWith('application/vnd.ms-office.vbaprojectsignature') ||
+    ct === 'application/vnd.openxmlformats-package.digital-signature-origin';
 /** Relationship types that leave the package, by the finding they make. Any other is EXTERNAL/OTHER. */
 const EXTERNAL_KINDS = [
-    [REL.template, types_1.OfficeDetail.Template],
+    [exports.REL.template, types_1.OfficeDetail.Template],
     [new Set([...both('oleobject'), ...both('package')]), types_1.OfficeDetail.Object],
-    [REL.image, types_1.OfficeDetail.Image],
-    [REL.frame, types_1.OfficeDetail.Frame],
-    [REL.subDocument, types_1.OfficeDetail.Include],
-    [REL.workbook, types_1.OfficeDetail.Workbook],
+    [exports.REL.image, types_1.OfficeDetail.Image],
+    [exports.REL.frame, types_1.OfficeDetail.Frame],
+    [exports.REL.subDocument, types_1.OfficeDetail.Include],
+    [exports.REL.workbook, types_1.OfficeDetail.Workbook],
 ];
-const WORD_NS = new Set(['http://schemas.openxmlformats.org/wordprocessingml/2006/main', 'http://purl.oclc.org/ooxml/wordprocessingml/main']);
-const SHEET_NS = new Set(['http://schemas.openxmlformats.org/spreadsheetml/2006/main', 'http://purl.oclc.org/ooxml/spreadsheetml/main']);
+exports.WORD_NS = new Set(['http://schemas.openxmlformats.org/wordprocessingml/2006/main', 'http://purl.oclc.org/ooxml/wordprocessingml/main']);
+exports.SHEET_NS = new Set(['http://schemas.openxmlformats.org/spreadsheetml/2006/main', 'http://purl.oclc.org/ooxml/spreadsheetml/main']);
 const XDR_NS = new Set(['http://schemas.openxmlformats.org/drawingml/2006/spreadsheetdrawing', 'http://purl.oclc.org/ooxml/drawingml/spreadsheetdrawing']);
-const R_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/relationships', 'http://purl.oclc.org/ooxml/officedocument/relationships']);
+exports.R_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/relationships', 'http://purl.oclc.org/ooxml/officedocument/relationships']);
 const CUSTOM_UI_NS = new Set(['http://schemas.microsoft.com/office/2006/01/customui', 'http://schemas.microsoft.com/office/2009/07/customui']);
 const VML_EXCEL_NS = 'urn:schemas-microsoft-com:office:excel';
 const VISIO_NS = 'http://schemas.microsoft.com/office/visio/2012/main';
+const EXTENDED_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/extended-properties', 'http://purl.oclc.org/ooxml/officedocument/extendedproperties']);
+/**
+ * The attributes of a SpreadsheetML data connection that name where it loads from (ECMA-376 18.13): an ODC file or an
+ * offline cube on the connection, a connection string and command, a web query's URL, or a text file.
+ */
+const CONNECTION_SOURCES = { connection: ['odcFile', 'sourceFile'], dbPr: ['connection', 'command'], webPr: ['url'], textPr: ['sourceFile'] };
 const VISIO_CODE = /\b(RUNADDON|RUNADDONWARGS|CALLTHIS|RUNMACRO|OPENFILE|DOOLEVERB)\s*\(/i;
-/** How much of a field code is kept, counted from its first word, which names the field. */
-const MAX_FIELD_CODE = 4096;
 /** A Word attribute, qualified as Word writes it or unqualified. */
-const wordAttr = (el, local) => el.attributes.find(a => a.local === local && (a.ns === '' || WORD_NS.has(a.ns.toLowerCase())))?.value;
+const wordAttr = (el, local) => el.attributes.find(a => a.local === local && (a.ns === '' || exports.WORD_NS.has(a.ns.toLowerCase())))?.value;
 /** The key of the part a relationships part belongs to, '' for the package, or undefined for any other part. */
 const relsSource = (relsName) => {
     const m = /^(.*?)_rels\/([^/]*)\.rels$/i.exec(relsName);
     return m ? (0, zip_1.nameKey)(m[1] + m[2]) : undefined;
 };
+exports.relsSource = relsSource;
 /**
  * Resolves an internal target against the folder of the part it belongs to, as RFC 3986 resolves a relative
  * reference: a ".." at the root of the package stays at the root. LibreOffice writes "../customXml/item1.xml" in the
@@ -96,6 +127,52 @@ function resolveTarget(relsName, target) {
     }
     return (0, zip_1.nameKey)(out.join('/'));
 }
+/** A reference in an XPS part to another part: an absolute part name, or a path relative to the part's folder. */
+function resolvePartRef(part, ref) {
+    const folder = part.includes('/') ? part.slice(0, part.lastIndexOf('/') + 1) : '';
+    const path = (ref.startsWith('/') ? ref.slice(1) : folder + ref).split('#')[0];
+    const out = [];
+    for (const seg of path.split('/')) {
+        if (seg === '..')
+            out.pop();
+        else if (seg !== '.' && seg !== '')
+            out.push(seg);
+    }
+    return (0, zip_1.nameKey)(out.join('/'));
+}
+/** The URIs an XPS ImageSource names: the value itself, or a ColorConvertedBitmap's image and color profile. */
+function imageSourceUris(value) {
+    const t = value.trim();
+    if (!t.startsWith('{'))
+        return [t];
+    const words = t
+        .replace(/^\{|\}$/g, '')
+        .trim()
+        .split(/\s+/);
+    return words[0] === 'ColorConvertedBitmap' ? words.slice(1) : [];
+}
+/**
+ * The resources an XPS element names in its attributes, as the attribute and the URI: a document, page or resource
+ * dictionary's Source, a font's FontUri, an image brush's image and profile, and a ContextColor's profile.
+ */
+function xpsResources(el) {
+    const out = [];
+    for (const a of el.attributes) {
+        if (a.ns !== '')
+            continue;
+        if (a.local === 'Source' || a.local === 'FontUri')
+            out.push([a.local, a.value.trim()]);
+        else if (a.local === 'ImageSource')
+            for (const uri of imageSourceUris(a.value))
+                out.push([a.local, uri]);
+        else {
+            const m = /^\s*ContextColor\s+(\S+)/.exec(a.value);
+            if (m)
+                out.push([a.local, m[1]]);
+        }
+    }
+    return out.filter(([, uri]) => uri !== '');
+}
 const duplicate = (ctx, location, kind, name) => ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, location, { kind, name: (0, context_1.clip)(name) });
 /**
  * The defaults and overrides of [Content_Types].xml. Only those that type an entry of the archive are kept, so a
@@ -108,7 +185,7 @@ async function readContentTypes(ctx, entry) {
     const overrides = new Map();
     await ctx.parse(entry, {
         start(el) {
-            if (el.ns.toLowerCase() !== CONTENT_TYPES_NS)
+            if (el.ns.toLowerCase() !== exports.CONTENT_TYPES_NS)
                 return;
             const type = (0, xml_1.attr)(el, '', 'ContentType')?.trim().toLowerCase();
             if (type === undefined)
@@ -141,7 +218,7 @@ async function readRelationships(ctx, entry, each) {
     const ids = new Set();
     await ctx.parse(entry, {
         start(el) {
-            if (el.ns.toLowerCase() !== RELS_NS || el.local !== 'Relationship')
+            if (el.ns.toLowerCase() !== exports.RELS_NS || el.local !== 'Relationship')
                 return;
             const id = (0, xml_1.attr)(el, '', 'Id') ?? '';
             if (ids.has(id))
@@ -155,93 +232,51 @@ async function readRelationships(ctx, entry, each) {
         },
     });
 }
-/** Word field codes, followed through nested fields, as one part's fields run. */
+/**
+ * Word field codes in WordprocessingML: fldSimple, and fldChar marks around instrText. A field a strip finding names
+ * goes into the plan by the element numbers of its marks.
+ */
 class Fields {
-    ctx;
-    part;
-    stack = [];
+    stack;
     capture = false;
+    /** Inside a w:t, whose text is part of a field's result when a field's code has ended. */
+    shown = false;
     constructor(ctx, part) {
-        this.ctx = ctx;
-        this.part = part;
-    }
-    /** A field starts. One that starts before its parent's code has a word in it makes that code at run time. */
-    nest() {
-        const top = this.stack[this.stack.length - 1];
-        if (top?.inCode && top.code === '')
-            top.computed = true;
+        this.stack = new fields_1.FieldStack(ctx, part, marks => ctx.plan.part(part).fields.push(marks));
     }
     start(el) {
-        if (el.local === 'fldSimple') {
-            this.nest();
-            this.evaluate(wordAttr(el, 'instr') ?? '', false);
-        }
+        if (el.local === 'fldSimple')
+            this.stack.simpleBegin(wordAttr(el, 'instr') ?? '', el.index);
         else if (el.local === 'fldChar') {
             const kind = wordAttr(el, 'fldCharType');
-            if (kind === 'begin') {
-                this.nest();
-                this.stack.push({ code: '', inCode: true, computed: false });
-            }
-            else if (kind === 'separate') {
-                const top = this.stack[this.stack.length - 1];
-                if (top)
-                    top.inCode = false;
-            }
-            else if (kind === 'end') {
-                const f = this.stack.pop();
-                if (f)
-                    this.evaluate(f.code, f.computed);
-            }
+            if (kind === 'begin')
+                this.stack.begin(el.index);
+            else if (kind === 'separate')
+                this.stack.separate(el.index);
+            else if (kind === 'end')
+                this.stack.end(el.index);
         }
         else if (el.local === 'instrText' || el.local === 'delInstrText')
             this.capture = true;
+        else if (el.local === 't')
+            this.shown = true;
     }
     end(el) {
         if (el.local === 'instrText' || el.local === 'delInstrText')
             this.capture = false;
+        else if (el.local === 't')
+            this.shown = false;
+        else if (el.local === 'fldSimple')
+            this.stack.simpleEnd();
     }
-    /** White space before the first word counts for nothing, so no amount of it can push the field's name out. */
     text(t) {
-        const top = this.stack[this.stack.length - 1];
-        if (this.capture && top?.inCode && top.code.length < MAX_FIELD_CODE)
-            top.code = top.code ? top.code + t : t.trimStart();
+        if (this.capture)
+            this.stack.text(t);
+        else if (this.shown)
+            this.stack.result(t);
     }
-    /** A part can end inside a field. Word still reads the code it has. */
     finish() {
-        for (let f = this.stack.pop(); f; f = this.stack.pop())
-            this.evaluate(f.code, f.computed);
-    }
-    /**
-     * Reports a field by its code. A field whose name holds the content of an external entity has a type the file does
-     * not say, as one whose name another field builds does.
-     */
-    evaluate(code, computed) {
-        const data = { code: (0, context_1.clip)(code.trim()) };
-        const words = (0, formulas_1.fieldWords)(code);
-        const first = words[0]?.text ?? '';
-        const entity = (0, xml_1.unknownEntity)(first);
-        if (computed || entity !== undefined)
-            this.ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Computed, this.part, entity === undefined ? data : { ...data, entity: (0, context_1.clip)(entity) });
-        const name = first.toUpperCase();
-        // An argument comes before any switch, and a switch is an unquoted word starting with a backslash.
-        const switchAt = words.findIndex(w => !w.quoted && w.text.startsWith('\\'));
-        const arg = (n) => (words[n] !== undefined && (switchAt < 0 || n < switchAt) ? words[n].text : undefined);
-        if (name === 'DDE' || name === 'DDEAUTO')
-            this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, this.part, data);
-        else if (name === 'MACROBUTTON')
-            this.ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, this.part, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') });
-        else if (name === 'INCLUDETEXT' || name === 'INCLUDEPICTURE' || name === 'IMPORT' || name === 'LINK') {
-            const target = arg(name === 'LINK' ? 2 : 1);
-            if (target === undefined)
-                this.ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, this.part, data);
-            else
-                this.ctx.external(types_1.OfficeDetail.Include, target, this.part, data, 'field');
-        }
-        else if (name === 'HYPERLINK') {
-            const target = arg(1);
-            if (target !== undefined && !(0, links_1.isFragment)(target))
-                this.ctx.link(target, this.part, { ...data, source: 'HYPERLINK field' });
-        }
+        this.stack.finish();
     }
 }
 /** Text that may run long. Detection needs only whether it holds more than white space; the report shows its start. */
@@ -266,6 +301,19 @@ class PartRules {
      */
     formula;
     macroText;
+    /** The part is an Excel 4.0 macro sheet, whose formulas are its macros and which its own finding covers. */
+    macroSheet = false;
+    /** Word's hyperlink base, in the extended properties, which relative hyperlinks resolve against. */
+    hyperlinkBase;
+    /** The parts this XPS part names in its markup, by key, which count as reached from it. */
+    refs = new Set();
+    /**
+     * The labels of the hyperlinks the part names by relationship Id: their text, tooltips and display text. The
+     * relationships part comes after the part, so the targets are compared with these as it is read.
+     */
+    labels = new Map();
+    /** A hyperlink whose text is being read, with the depth of the element whose end ends it. */
+    label;
     /** The last namespace seen and its lowercase form. Neighboring elements share one, and this spares a copy each. */
     ns = '';
     lower = '';
@@ -274,6 +322,11 @@ class PartRules {
         this.part = part;
         this.fields = new Fields(ctx, part);
     }
+    /** Records that the rewrite removes the element, when the finding strips. */
+    remove(r, el) {
+        if (r.action === 'strip')
+            this.ctx.plan.element(this.part, el.index, { remove: true });
+    }
     lowerNs(el) {
         if (el.ns !== this.ns) {
             this.ns = el.ns;
@@ -281,38 +334,88 @@ class PartRules {
         }
         return this.lower;
     }
+    /** Adds labels for the hyperlink a relationship Id names. */
+    addLabels(id, labels) {
+        const list = this.labels.get(id) ?? [];
+        for (const l of labels)
+            if (l?.trim())
+                list.push(l);
+        if (list.length)
+            this.labels.set(id, list);
+    }
+    /** The labels a hyperlink element gives: the text of `textDepth`'s element, its tooltip, and an Excel display name. */
+    hyperlink(el, textDepth, also) {
+        const id = el.attributes.find(a => a.local === 'id' && exports.R_NS.has(a.ns.toLowerCase()))?.value;
+        if (id === undefined)
+            return;
+        if (textDepth === undefined || this.label)
+            this.addLabels(id, also);
+        else
+            this.label = { id, depth: textDepth, text: '', also: also.filter((l) => l !== undefined) };
+    }
     start(el) {
         const ns = this.lowerNs(el);
         if (CUSTOM_UI_NS.has(ns)) {
             if (el.depth === 1)
                 this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Ribbon, this.part);
             for (const a of el.attributes) {
-                if (a.ns === '' && a.value.trim() && /^(on[A-Z]|get[A-Z]|loadImage$)/.test(a.local))
-                    this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` });
+                if (a.ns !== '' || !a.value.trim() || !/^(on[A-Z]|get[A-Z]|loadImage$)/.test(a.local))
+                    continue;
+                // The callback goes and the control stays, doing nothing.
+                if (this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` }).action === 'strip') {
+                    this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', a.local)]) });
+                }
             }
             return;
         }
-        if (WORD_NS.has(ns))
+        if (el.depth === 1 && el.local === 'macrosheet')
+            this.macroSheet = true;
+        if (exports.WORD_NS.has(ns)) {
             this.fields.start(el);
-        else if (SHEET_NS.has(ns)) {
+            if (el.local === 'hyperlink')
+                this.hyperlink(el, el.depth, [wordAttr(el, 'tooltip')]);
+        }
+        else if (exports.SHEET_NS.has(ns)) {
+            if (el.local === 'hyperlink')
+                this.hyperlink(el, undefined, [(0, xml_1.attr)(el, '', 'display'), (0, xml_1.attr)(el, '', 'tooltip')]);
             if (el.local === 'f' || el.local === 'definedName')
-                this.formula = { shown: new Shown(), quotes: new formulas_1.Quotes(), ddeBar: false };
+                this.formula = { shown: new Shown(), quotes: new formulas_1.Quotes(), ddeBar: false, index: el.index, calls: new formulas_1.FunctionCalls() };
+            if (el.local === 'definedName') {
+                // Excel runs the macro a name like _xlnm.Auto_Open refers to, as it does in a binary workbook.
+                const name = (0, xml_1.attr)(el, '', 'name') ?? '';
+                const auto = (0, biff_1.autoName)(name);
+                if (auto)
+                    this.remove(this.ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, this.part, { event: auto.event, name: (0, context_1.clip)(name) }), el);
+            }
             else if (el.local === 'ddeLink')
-                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, this.part, { application: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeService') ?? ''), topic: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeTopic') ?? '') });
+                this.remove(this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, this.part, { application: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeService') ?? ''), topic: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeTopic') ?? '') }), el);
+            else if (Object.hasOwn(CONNECTION_SOURCES, el.local))
+                this.connection(el);
         }
         else if (XDR_NS.has(ns)) {
             const macro = (0, xml_1.attr)(el, '', 'macro');
-            if (macro?.trim())
-                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) });
+            // The shape stays, and clicking it runs nothing.
+            if (macro?.trim() && this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }).action === 'strip') {
+                this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', 'macro')]) });
+            }
         }
         else if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro')
-            this.macroText = new Shown();
+            this.macroText = { shown: new Shown(), index: el.index };
         else if (ns === VISIO_NS && el.local === 'Cell')
             this.visioCell(el);
-        if (el.local === 'hlinkClick' || el.local === 'hlinkHover' || el.local === 'hlinkMouseOver')
+        else if (exports.XPS_NS.has(ns))
+            this.xps(el);
+        else if (EXTENDED_NS.has(ns) && el.local === 'HyperlinkBase')
+            this.hyperlinkBase = { shown: new Shown(), index: el.index };
+        if (el.local === 'hlinkClick' || el.local === 'hlinkHover' || el.local === 'hlinkMouseOver') {
             this.drawingAction(el);
+            // In a text run the link sits in the run's properties, and the run's text is what the reader sees.
+            this.hyperlink(el, el.depth >= 2 ? el.depth - 2 : undefined, [(0, xml_1.attr)(el, '', 'tooltip')]);
+        }
     }
     text(t) {
+        if (this.label && this.label.text.length < 4096)
+            this.label.text += t;
         this.fields.text(t);
         const f = this.formula;
         if (f) {
@@ -321,58 +424,120 @@ class PartRules {
             for (const c of t)
                 if (f.quotes.outside(c) && c === '|')
                     f.ddeBar = true;
+            f.calls.write(t);
             if (f.entity === undefined && t.includes(xml_1.UNKNOWN))
                 f.entity = (0, xml_1.unknownEntity)(t);
         }
-        this.macroText?.add(t);
+        this.macroText?.shown.add(t);
+        this.hyperlinkBase?.shown.add(t);
     }
     end(el) {
         const ns = this.lowerNs(el);
-        if (WORD_NS.has(ns))
+        if (this.label && el.depth === this.label.depth) {
+            this.addLabels(this.label.id, [this.label.text, ...this.label.also]);
+            this.label = undefined;
+        }
+        if (exports.WORD_NS.has(ns))
             this.fields.end(el);
-        if (SHEET_NS.has(ns) && (el.local === 'f' || el.local === 'definedName') && this.formula) {
-            const { ddeBar, entity, shown } = this.formula;
+        if (exports.SHEET_NS.has(ns) && (el.local === 'f' || el.local === 'definedName') && this.formula) {
+            // A cell keeps its cached value without the formula. A defined name goes whole.
+            const { ddeBar, entity, shown, calls } = this.formula;
             if (ddeBar)
-                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text) });
+                this.remove(this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text) }), this.formula);
             else if (entity !== undefined)
-                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text), entity: (0, context_1.clip)(entity) });
+                this.remove(this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text), entity: (0, context_1.clip)(entity) }), this.formula);
+            if (!this.macroSheet)
+                for (const [fn, kind] of calls.found)
+                    this.remove(this.ctx.report(kind === 'fetch' ? types_1.OfficeCategory.External : types_1.OfficeCategory.Macro, types_1.OfficeDetail.Formula, this.part, { function: (0, context_1.clip)(fn), formula: (0, context_1.clip)(shown.text) }), this.formula);
             this.formula = undefined;
         }
         if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro' && this.macroText) {
-            if (this.macroText.content)
-                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(this.macroText.text.trim()) });
+            if (this.macroText.shown.content)
+                this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(this.macroText.shown.text.trim()) }), this.macroText);
             this.macroText = undefined;
         }
+        if (this.hyperlinkBase && EXTENDED_NS.has(ns) && el.local === 'HyperlinkBase') {
+            const base = this.hyperlinkBase.shown.text.trim();
+            if (base && !(0, links_1.isFragment)(base))
+                this.remove(this.ctx.link(base, this.part, { source: 'hyperlink base' }), this.hyperlinkBase);
+            this.hyperlinkBase = undefined;
+        }
         if (el.depth === 1)
             this.fields.finish();
     }
+    /**
+     * A data connection's source. Each source a connection names is a finding, and the rewrite empties it, so the
+     * connection stays for the query tables and pivot caches that name it and loads nothing.
+     */
+    connection(el) {
+        const set = new Map();
+        for (const name of CONNECTION_SOURCES[el.local]) {
+            const a = el.attributes.find(x => x.ns === '' && x.local === name);
+            if (!a?.value.trim())
+                continue;
+            const data = { element: (0, context_1.clip)(el.qname), attribute: name, target: (0, context_1.clip)(a.value, 2000) };
+            if (this.ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.DataConnection, this.part, data).action === 'strip')
+                set.set(a.qname, '');
+        }
+        if (set.size)
+            this.ctx.plan.element(this.part, el.index, { set });
+    }
     /** PowerPoint action settings, in a DrawingML hyperlink's action attribute. The relationship it names is reported on its own. */
     drawingAction(el) {
         const written = ((0, xml_1.attr)(el, '', 'action') ?? '').trim();
         const action = written.toLowerCase();
         if (!action)
             return;
-        const id = el.attributes.find(a => a.local === 'id' && R_NS.has(a.ns.toLowerCase()))?.value;
+        const id = el.attributes.find(a => a.local === 'id' && exports.R_NS.has(a.ns.toLowerCase()))?.value;
         const data = { trigger: el.local, action: (0, context_1.clip)(written), ...(id === undefined ? {} : { relationship: (0, context_1.clip)(id) }) };
         if (action.startsWith('ppaction://program'))
-            this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, this.part, data);
+            this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, this.part, data), el);
         else if (action.startsWith('ppaction://macro'))
-            this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data);
+            this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data), el);
         else if (action.startsWith('ppaction://ole'))
-            this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, this.part, data);
+            this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, this.part, data), el);
     }
     visioCell(el) {
         const n = (0, xml_1.attr)(el, '', 'N') ?? '';
         const formula = (0, xml_1.attr)(el, '', 'F') ?? '';
         if (VISIO_CODE.test(formula)) {
             if (n.startsWith('Event'))
-                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Event, this.part, { event: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) });
+                this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Event, this.part, { event: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) }), el);
             else
-                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { cell: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) });
+                this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { cell: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) }), el);
         }
         const v = (0, xml_1.attr)(el, '', 'V');
         if (n === 'Address' && v?.trim() && !(0, links_1.isFragment)(v))
-            this.ctx.link(v, this.part, { source: 'Visio hyperlink' });
+            this.remove(this.ctx.link(v, this.part, { source: 'Visio hyperlink' }), el);
+    }
+    /**
+     * XPS markup, which names the parts it uses in attributes rather than in relationships. A resource inside the
+     * package counts as reached from this part. One outside it loads from outside, and the element that names it goes.
+     * A link with a scheme or a network path gets the link checks and loses its target. A relative link moves inside
+     * the document.
+     */
+    xps(el) {
+        for (const a of el.attributes) {
+            if (a.ns !== '' || (a.local !== 'FixedPage.NavigateUri' && a.local !== 'OutlineTarget'))
+                continue;
+            if ((0, links_1.isFragment)(a.value) || !(0, links_1.isAbsoluteTarget)(a.value))
+                continue;
+            const data = { element: (0, context_1.clip)(el.qname) };
+            let r = this.ctx.link(a.value, this.part, data);
+            // The characters of a Glyphs element are what the reader sees.
+            if (r.action !== 'strip' && el.local === 'Glyphs')
+                r = this.ctx.labelMismatch(a.value, [(0, xml_1.attr)(el, '', 'UnicodeString')], this.part, data) ?? r;
+            if (r.action === 'strip')
+                this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', a.local)]) });
+        }
+        for (const [name, uri] of xpsResources(el)) {
+            if (!(0, links_1.isAbsoluteTarget)(uri)) {
+                this.refs.add(resolvePartRef(this.part, uri));
+                continue;
+            }
+            const detail = name === 'ImageSource' ? types_1.OfficeDetail.Image : name === 'Source' ? types_1.OfficeDetail.Include : types_1.OfficeDetail.Other;
+            this.remove(this.ctx.external(detail, uri, this.part, { element: (0, context_1.clip)(el.qname), attribute: name }, name), el);
+        }
     }
 }
 /**
@@ -384,6 +549,7 @@ async function inspectOoxml(ctx, contentTypes) {
     const { defaults, overrides } = await readContentTypes(ctx, contentTypes);
     const parts = new Map();
     const relsOf = new Map();
+    const plan = ctx.plan;
     for (const entry of ctx.zip.entries) {
         if (entry === contentTypes)
             continue;
@@ -392,7 +558,7 @@ async function inspectOoxml(ctx, contentTypes) {
             await ctx.drain(entry);
             continue;
         }
-        const source = relsSource(entry.name);
+        const source = (0, exports.relsSource)(entry.name);
         if (source !== undefined) {
             relsOf.set(source, entry);
             continue;
@@ -403,30 +569,45 @@ async function inspectOoxml(ctx, contentTypes) {
     }
     const roots = new Set();
     const mains = [];
+    /** The labels each part gives its hyperlinks, by part key and relationship Id. */
+    const labelsOf = new Map();
     const relate = (rels, from, r) => {
         const location = `${rels.name}, ${(0, context_1.clip)(r.id)}`;
         const part = r.external ? undefined : parts.get(resolveTarget(rels.name, r.target));
         if (part) {
             part.reachedAs |= REACHED_AS.get(r.type) ?? 0;
-            if (TYPE.control.has(from?.contentType ?? ''))
+            if (exports.TYPE.control.has(from?.contentType ?? ''))
                 part.claimed = true;
             (from?.targets ?? roots).add(part);
         }
-        // A hyperlink to a part of the package, or to a place in the document, goes nowhere else.
-        if (REL.hyperlink.has(r.type)) {
-            if (!part && !(0, links_1.isFragment)(r.target))
-                ctx.link(r.target, location);
+        // A hyperlink to a part of the package, or to a place in the document, goes nowhere else. A relationship a strip
+        // finding names goes, and so does every element that refers to it.
+        let reported;
+        if (exports.REL.hyperlink.has(r.type)) {
+            if (!part && !(0, links_1.isFragment)(r.target)) {
+                reported = ctx.link(r.target, location);
+                const labels = from ? labelsOf.get((0, zip_1.nameKey)(from.entry.name))?.get(r.id) : undefined;
+                if (labels && reported.action !== 'strip')
+                    reported = ctx.labelMismatch(r.target, labels, location) ?? reported;
+            }
         }
         else if (r.external) {
             const kind = EXTERNAL_KINDS.find(([types]) => types.has(r.type))?.[1] ?? types_1.OfficeDetail.Other;
-            ctx.external(kind, r.target, location, { type: (0, context_1.clip)(r.type) }, (0, context_1.clip)(r.type.slice(r.type.lastIndexOf('/') + 1)));
+            reported = ctx.external(kind, r.target, location, { type: (0, context_1.clip)(r.type) }, (0, context_1.clip)(r.type.slice(r.type.lastIndexOf('/') + 1)));
         }
+        if (reported?.action === 'strip')
+            plan.dropRelationship(rels.name, r.id);
     };
     const packageRels = relsOf.get('');
+    let strict = false;
+    let mainType = '';
     if (packageRels) {
         await readRelationships(ctx, packageRels, r => {
-            if (REL.main.has(r.type))
+            if (exports.REL.main.has(r.type)) {
                 mains.push(r.external ? undefined : parts.get(resolveTarget(packageRels.name, r.target)));
+                strict = r.type.startsWith(S);
+                mainType = r.type;
+            }
             relate(packageRels, undefined, r);
         });
     }
@@ -435,25 +616,38 @@ async function inspectOoxml(ctx, contentTypes) {
     const main = mains[0];
     if (!main)
         throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The package has no main part', { reason: 'no main document part' });
-    const format = formats_1.OOXML_FORMATS.get(main.contentType ?? '');
+    const xps = mainType === exports.XPS_MAIN.xps || mainType === exports.XPS_MAIN.oxps;
+    // XPS and OpenXPS share their content types, so the relationship type tells them apart.
+    const format = xps ? (main.contentType === formats_1.XPS_SEQUENCE ? formats_1.XPS_FORMATS[mainType === exports.XPS_MAIN.oxps ? 'oxps' : 'xps'] : undefined) : formats_1.OOXML_FORMATS.get(main.contentType ?? '');
     if (!format)
         throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The main part has an unknown content type', { contentType: (0, context_1.clip)(main.contentType ?? '') });
     ctx.format = format;
     for (const [key, p] of parts) {
         const ct = p.contentType;
         if (ct === undefined) {
-            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UntypedPart, p.entry.name, { part: p.entry.name });
+            if (ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UntypedPart, p.entry.name, { part: p.entry.name }).action === 'strip')
+                plan.drop.add(key);
             p.ole = await ctx.drain(p.entry);
         }
-        else if (ct.endsWith('+xml') || ct === 'application/xml' || ct === 'text/xml' || ct === TYPE.vml) {
-            await ctx.parse(p.entry, new PartRules(ctx, p.entry.name), ct === TYPE.vml);
+        else if ((0, exports.isXmlType)(ct)) {
+            const rules = new PartRules(ctx, p.entry.name);
+            await ctx.parse(p.entry, rules, ct === exports.TYPE.vml);
+            if (rules.labels.size)
+                labelsOf.set(key, rules.labels);
+            for (const k of rules.refs) {
+                const t = parts.get(k);
+                if (t && t !== p)
+                    p.targets.add(t);
+            }
         }
-        else if (ct === TYPE.xlsbExternalLink) {
+        else if (ct === exports.TYPE.xlsbExternalLink) {
             // The binary form of an Excel ddeLink.
             const links = new xlsb_1.XlsbLinks();
             p.ole = await ctx.drain(p.entry, c => links.write(c));
+            // The binary part is the link, so it goes whole.
             for (const l of links.dde)
-                ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, p.entry.name, { application: (0, context_1.clip)(l.application), topic: (0, context_1.clip)(l.topic) });
+                if (ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, p.entry.name, { application: (0, context_1.clip)(l.application), topic: (0, context_1.clip)(l.topic) }).action === 'strip')
+                    plan.drop.add(key);
         }
         else
             p.ole = await ctx.drain(p.entry);
@@ -466,32 +660,50 @@ async function inspectOoxml(ctx, contentTypes) {
         if (source !== '' && !parts.has(source))
             await readRelationships(ctx, rels, r => relate(rels, undefined, r));
     for (const p of parts.values())
-        partRules(ctx, p);
+        await partRules(ctx, p);
     unreferenced(ctx, parts, relsOf, roots);
+    plan.graph = { contentTypes, parts, relsOf, roots, strict, xps };
 }
-/** Findings about a whole part, from its content type and the relationships that reach it. */
-function partRules(ctx, p) {
+/**
+ * Findings about a whole part, from its content type and the relationships that reach it. The files inside the
+ * package, its OLE parts and embedded packages, go to the plugins first. A plugin's verdict decides whether such a
+ * part stays, and when no plugin takes it, the findings of this function do.
+ */
+async function partRules(ctx, p) {
     const ct = p.contentType ?? '';
     const loc = p.entry.name;
+    const key = (0, zip_1.nameKey)(loc);
     const data = { part: loc, contentType: (0, context_1.clip)(ct) };
     const as = (bit) => (p.reachedAs & bit) !== 0;
-    const vba = TYPE.vba.has(ct) || as(AS.vba);
-    const ole = TYPE.ole.has(ct) || as(AS.ole);
-    const control = TYPE.control.has(ct) || as(AS.control);
-    const controlBinary = TYPE.controlBinary.has(ct) || as(AS.controlBinary);
+    const vba = exports.TYPE.vba.has(ct) || as(AS.vba);
+    const ole = exports.TYPE.ole.has(ct) || as(AS.ole);
+    const control = exports.TYPE.control.has(ct) || as(AS.control);
+    const controlBinary = exports.TYPE.controlBinary.has(ct) || as(AS.controlBinary);
     const pkg = as(AS.package);
+    // Besides OLE parts and packages, every part that is a whole file in a format of its own, such as an image, goes
+    // to the plugins. Such a part has no rule of its own, so one no plugin takes stays.
+    const wholeFile = !(0, exports.isXmlType)(p.contentType) && !formatBinary(ct);
+    const contained = vba || ole || pkg || controlBinary || p.ole || wholeFile;
+    const decision = contained ? await (0, contained_1.decideContained)(ctx, { name: loc, declaredType: ct || undefined, location: loc, chunks: () => ctx.zip.read(p.entry) }) : undefined;
+    const act = (0, contained_1.presence)(decision);
+    const found = [];
     if (vba)
-        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data);
-    if (TYPE.macrosheet.has(ct) || as(AS.macrosheet))
-        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, loc, data);
+        found.push(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data, act));
+    // A macro sheet becomes an empty worksheet, so the indexes of the sheets after it stay right.
+    if ((exports.TYPE.macrosheet.has(ct) || as(AS.macrosheet)) && ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, loc, data).action === 'strip')
+        ctx.plan.sheets.add(key);
     if (ole)
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data);
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data, act));
     if (pkg)
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data);
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data, act));
     if (control || (controlBinary && !p.claimed))
-        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, data);
+        found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, data, control ? undefined : act));
     if (p.ole && !vba && !ole && !control && !controlBinary && !pkg)
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data);
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data, act));
+    if (decision ? !decision.keep : found.some(f => f.action === 'strip'))
+        ctx.plan.drop.add(key);
+    else if (decision?.replacement)
+        ctx.plan.replace.set(key, decision.replacement);
 }
 /** Parts that no chain of internal relationships reaches from the package. */
 function unreferenced(ctx, parts, relsOf, roots) {
@@ -505,12 +717,13 @@ function unreferenced(ctx, parts, relsOf, roots) {
             queue.push(t);
         }
     }
-    for (const p of parts.values())
-        if (!reached.has(p))
-            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, p.entry.name, { part: p.entry.name });
+    for (const p of parts.values()) {
+        if (!reached.has(p) && ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, p.entry.name, { part: p.entry.name }).action === 'strip')
+            ctx.plan.drop.add((0, zip_1.nameKey)(p.entry.name));
+    }
     for (const [source, rels] of relsOf) {
         const owner = parts.get(source);
-        if (source !== '' && !(owner && reached.has(owner)))
-            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, rels.name, { part: rels.name });
+        if (source !== '' && !(owner && reached.has(owner)) && ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, rels.name, { part: rels.name }).action === 'strip')
+            ctx.plan.drop.add((0, zip_1.nameKey)(rels.name));
     }
 }