@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/fields.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldStack = void 0;
+exports.evaluateField = evaluateField;
+const context_1 = require("./context");
+const formulas_1 = require("./formulas");
+const links_1 = require("./links");
+const types_1 = require("./types");
+const xml_1 = require("./xml");
+/** How much of a field code is kept, counted from its first word, which names the field. */
+const MAX_FIELD_CODE = 4096;
+/**
+ * Reports a Word field by its code, and tells whether any of its findings strips it. A field whose name holds the
+ * content of an external entity has a type the file does not say, as one whose name another field builds does. A
+ * HYPERLINK field's result is the text the reader sees, and goes with its tooltip into the label check.
+ */
+function evaluateField(ctx, location, code, computed, result = '') {
+    const data = { code: (0, context_1.clip)(code.trim()) };
+    const words = (0, formulas_1.fieldWords)(code);
+    const first = words[0]?.text ?? '';
+    const entity = (0, xml_1.unknownEntity)(first);
+    const actions = [];
+    if (computed || entity !== undefined)
+        actions.push(ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Computed, location, entity === undefined ? data : { ...data, entity: (0, context_1.clip)(entity) }).action);
+    const name = first.toUpperCase();
+    // An argument comes before any switch, and a switch is an unquoted word starting with a backslash.
+    const switchAt = words.findIndex(w => !w.quoted && w.text.startsWith('\\'));
+    const arg = (n) => (words[n] !== undefined && (switchAt < 0 || n < switchAt) ? words[n].text : undefined);
+    if (name === 'DDE' || name === 'DDEAUTO')
+        actions.push(ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, location, data).action);
+    else if (name === 'MACROBUTTON')
+        actions.push(ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, location, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') }).action);
+    else if (name === 'INCLUDETEXT' || name === 'INCLUDEPICTURE' || name === 'IMPORT' || name === 'LINK') {
+        const target = arg(name === 'LINK' ? 2 : 1);
+        if (target === undefined)
+            actions.push(ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, location, data).action);
+        else
+            actions.push(ctx.external(types_1.OfficeDetail.Include, target, location, data, 'field').action);
+    }
+    else if (name === 'HYPERLINK') {
+        const target = arg(1);
+        if (target !== undefined && !(0, links_1.isFragment)(target)) {
+            const r = ctx.link(target, location, { ...data, source: 'HYPERLINK field' });
+            actions.push(r.action);
+            // The \o switch gives the tooltip.
+            const tip = words.findIndex(w => !w.quoted && w.text.toLowerCase() === '\\o');
+            const labels = [result, tip >= 0 ? words[tip + 1]?.text : undefined];
+            if (r.action !== 'strip') {
+                const m = ctx.labelMismatch(target, labels, location, { ...data, source: 'HYPERLINK field' });
+                if (m)
+                    actions.push(m.action);
+            }
+        }
+    }
+    return actions.includes('strip');
+}
+/**
+ * Word field codes, followed through nested fields as the text of a document arrives: a field begins, its code
+ * comes, a separator starts its result, and it ends. Each format says where those marks are.
+ */
+/** The most of a field's result that is kept, for the label check. */
+const MAX_RESULT = 4096;
+class FieldStack {
+    ctx;
+    location;
+    onStrip;
+    stack = [];
+    /**
+     * `onStrip` hears of each field a strip finding names, with the marks the format gave its begin, separator and end,
+     * so the rewrite can find the field again.
+     */
+    constructor(ctx, location, onStrip) {
+        this.ctx = ctx;
+        this.location = location;
+        this.onStrip = onStrip;
+    }
+    /** A field starts. One that starts before its parent's code has a word in it makes that code at run time. */
+    begin(mark = -1) {
+        this.nest();
+        this.stack.push({ code: '', inCode: true, computed: false, marks: { begin: mark, simple: false }, result: '' });
+    }
+    /** A field whose code is given whole, such as OOXML's fldSimple, whose result follows until simpleEnd(). */
+    simpleBegin(code, mark = -1) {
+        this.nest();
+        this.stack.push({ code, inCode: false, computed: false, marks: { begin: mark, simple: true }, result: '' });
+    }
+    simpleEnd() {
+        const top = this.stack[this.stack.length - 1];
+        if (!top?.marks.simple)
+            return;
+        this.stack.pop();
+        this.decide(top);
+    }
+    separate(mark = -1) {
+        const top = this.stack[this.stack.length - 1];
+        if (!top)
+            return;
+        top.inCode = false;
+        top.marks.separate ??= mark;
+    }
+    end(mark = -1) {
+        const f = this.stack.pop();
+        if (!f)
+            return;
+        f.marks.end = mark;
+        this.decide(f);
+    }
+    decide(f) {
+        if (evaluateField(this.ctx, this.location, f.code, f.computed, f.result))
+            this.onStrip?.(f.marks);
+    }
+    /** Whether a field's code is being read now. */
+    get inCode() {
+        return this.stack[this.stack.length - 1]?.inCode === true;
+    }
+    /** Text of the innermost field's code. White space before the first word counts for nothing, so no amount of it can push the field's name out. */
+    text(t) {
+        const top = this.stack[this.stack.length - 1];
+        if (top?.inCode && top.code.length < MAX_FIELD_CODE)
+            top.code = top.code ? top.code + t : t.trimStart();
+    }
+    /** Text of the innermost field's result, the text the reader sees. */
+    result(t) {
+        const top = this.stack[this.stack.length - 1];
+        if (top && !top.inCode && top.result.length < MAX_RESULT)
+            top.result += t;
+    }
+    /** A document can end inside a field. Word still reads the code it has. */
+    finish() {
+        for (let f = this.stack.pop(); f; f = this.stack.pop())
+            this.decide(f);
+    }
+    nest() {
+        const top = this.stack[this.stack.length - 1];
+        if (top?.inCode && top.code === '')
+            top.computed = true;
+    }
+}
+exports.FieldStack = FieldStack;

package/dist/findings.d.ts

@@ -19,7 +19,8 @@ export declare function allFindingSpecs(): Array<{
 export declare class FindingFactory {
     private readonly overrides;
     constructor(overrides?: OfficeActionOverride[]);
-    private actionFor;
+    /** The action of a kind of finding, after the caller's overrides. */
+    actionFor(category: C, detail: D): OfficeFindingAction;
     make(category: C, detail: D, location?: string, data?: Record<string, string | number>): OfficeFinding;
 }
 export {};

package/dist/findings.js

@@ -13,8 +13,8 @@ def(types_1.OfficeCategory.Container, types_1.OfficeDetail.NotZip, 'reject', 0,
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.AmbiguousEnd, 'reject', 0, 'The archive has more than one end record a reader could pick');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.MultiDisk, 'reject', 0, 'The archive claims to span several disks');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DirectoryMismatch, 'reject', 0, "The archive's end record disagrees with its central directory");
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.OutOfRange, 'reject', 0, 'An entry or the central directory lies outside the file');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.Overlap, 'reject', 0, 'Two entries in the archive share bytes');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.OutOfRange, 'reject', 0, 'An entry, a sector or a directory lies outside the file');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.Overlap, 'reject', 0, 'Two entries or streams of the file share bytes');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HeaderMismatch, 'reject', 0, 'A local header contradicts the central directory<: {name}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DuplicateName, 'reject', 0, 'Two entries have the same name, ignoring case<: {name}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.UnsafeName, 'reject', 0, 'An entry name is unsafe to use as a path<: {name}|>');
@@ -23,10 +23,16 @@ def(types_1.OfficeCategory.Container, types_1.OfficeDetail.EncryptedEntry, 'reje
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.UnsupportedMethod, 'reject', 0, 'An entry uses a compression method other than stored or deflate<: {name}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.Zip64Mismatch, 'reject', 0, 'ZIP64 fields disagree with the fields they extend');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadExtraField, 'reject', 0, 'An extra field block does not parse<: {name}|>');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DataError, 'reject', 0, "An entry's data does not match its declared size and checksum<: {name}|>");
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DataError, 'reject', 0, "An entry's data does not match its declared size or checksum<: {name}|>");
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes, 'strip', 10, 'Data before the first entry of the archive');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData, 'strip', 20, 'Data between entries of the archive that no entry covers');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, 'strip', 10, 'Data after the end of the archive');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData, 'strip', 20, 'Data in the file that no entry or stream covers');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenEntry, 'strip', 40, 'A local file header the central directory does not list, which a reader that walks the file in order extracts<: at offset {offset}|>');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, 'strip', 10, 'Data after the end of the archive or compound file');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadHeader, 'reject', 0, 'The compound file header is invalid<: {reason}|>');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BrokenChain, 'reject', 0, 'A sector chain of the compound file runs into a free or reserved sector');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.ChainLoop, 'reject', 0, 'A sector chain of the compound file loops');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DirectoryLoop, 'reject', 0, 'The compound file directory reaches one entry twice');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadEntry, 'reject', 0, 'A compound file directory entry is invalid<: {reason}|>');
 // XML. MALFORMED and ENCODING stop the run.
 def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Doctype, 'info', 0, 'An XML part declares a document type<: {part}|>');
 def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.InternalSubset, 'strip', 20, 'An XML part declares entities or other markup in its document type<: {part}|>');
@@ -35,28 +41,42 @@ def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Malformed, 'reject', 0, 'An
 def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Encoding, 'reject', 0, 'An XML part is not in valid UTF-8 or UTF-16<: {part}|>');
 // LIMIT
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.FileSize, 'reject', 0, 'The file exceeds the file size limit');
-def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.EntryCount, 'reject', 0, 'The archive exceeds the entry count limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.EntryCount, 'reject', 0, 'The file exceeds the entry count limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.DecompressedSize, 'reject', 0, 'An entry exceeds the decompressed size limit');
-def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.TotalDecompressedSize, 'reject', 0, 'The archive exceeds the total decompressed size limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.TotalDecompressedSize, 'reject', 0, 'The file exceeds the total decompressed size limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlDepth, 'reject', 0, 'An XML part exceeds the element depth limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlTokenSize, 'reject', 0, 'An XML part exceeds the token size limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntityDepth, 'reject', 0, 'An XML part exceeds the entity nesting limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntityExpansions, 'reject', 0, 'The file exceeds the entity expansion limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntitySize, 'reject', 0, 'The file exceeds the expanded entity size limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.RtfDepth, 'reject', 0, 'The RTF file exceeds the group nesting limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.NestingDepth, 'reject', 0, 'The file sits deeper in the upload than the nesting limit allows');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.Time, 'reject', 0, 'The file exceeds the time limit');
 // PACKAGE
-def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'reject', 0, 'The file is not a recognized Office or OpenDocument package');
+def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'reject', 0, 'The file is not a recognized Office or OpenDocument file');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'reject', 0, 'The file can be read as more than one format');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unreadable, 'reject', 0, 'The file could not be read');
+def(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreadableBody, 'strip', 10, "An Outlook message's RTF body does not decompress<: {stream}|>");
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, 'reject', 0, 'The package names one thing twice, and readers may pick either');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.UntypedPart, 'strip', 10, 'A part has no content type<: {part}|>');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, 'strip', 0, 'A part nothing in the package refers to<: {part}|>');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.OdfLayout, 'strip', 10, 'The OpenDocument package layout is irregular<: {reason}|>');
 // ENCRYPTED
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, 'reject', 0, 'The document is encrypted with a password');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.DefaultPassword, 'strip', 10, 'The file is encrypted with <{password}|VelvetSweatshop>, the password <{application}|Excel> opens it with without asking');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.UserPassword, 'strip', 0, 'The file was decrypted with the supplied password');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4_40, 'info', 0, 'Encryption is RC4 with a 40-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4_128, 'info', 0, 'Encryption is RC4 with a 128-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4Other, 'info', 0, 'Encryption is RC4 with a <{bits}|longer>-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes128, 'info', 0, 'Encryption is AES with a 128-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes192, 'info', 0, 'Encryption is AES with a 192-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes256, 'info', 0, 'Encryption is AES with a 256-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.XorObfuscation, 'info', 0, 'Encryption is XOR obfuscation');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.UnsupportedAlgorithm, 'reject', 0, 'The file is encrypted with an algorithm office-defuse does not decrypt<: {algorithm}|>');
 // MACRO
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, 'strip', 70, 'The document holds VBA macros');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, 'strip', 70, 'The workbook holds an Excel 4.0 macro sheet');
+def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.WordBasic, 'strip', 70, 'The Word 6.0 or 95 document holds WordBasic macros, which Word runs as VBA');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.OdfBasic, 'strip', 70, 'The document holds Basic macros');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.OdfScripts, 'strip', 70, 'The document holds scripts');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.OdfDialogs, 'strip', 30, 'The document holds Basic dialogs, which call macros');
@@ -69,7 +89,9 @@ def(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, 'strip', 30, 'The
 def(types_1.OfficeCategory.Ui, types_1.OfficeDetail.OdfConfiguration, 'strip', 10, 'The document carries its own menu, toolbar or key settings, which can call macros');
 // ACTION
 def(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, 'strip', 80, 'A click or hover runs a program or opens a file');
+def(types_1.OfficeCategory.Action, types_1.OfficeDetail.SubmitForm, 'strip', 40, 'A form sends its data to a URL<: {target}|>');
 def(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, 'strip', 40, 'A click or hover activates an embedded object');
+def(types_1.OfficeCategory.Action, types_1.OfficeDetail.ObjectUpdate, 'strip', 50, 'An embedded object updates itself as the document opens, which starts the program it belongs to');
 // DDE
 def(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, 'strip', 70, 'A field runs a command through DDE');
 def(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, 'strip', 70, 'A DDE link asks another program for data<: {application}|>');
@@ -86,6 +108,7 @@ def(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, 'strip', 40,
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.Workbook, 'strip', 30, 'Formulas read another workbook at <{target}|another location>');
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.Reload, 'strip', 40, 'The document loads <{target}|another address> on its own after a delay');
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.Other, 'strip', 30, 'The document refers to <{target}|something outside the file>');
+def(types_1.OfficeCategory.External, types_1.OfficeDetail.DataConnection, 'strip', 40, 'A data connection loads from outside the file<: {target}|>');
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.LocalFile, 'strip', 5, 'The document refers to a local file<: {target}|>');
 // LINK
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.Safe, 'info', 0, 'Web or email link');
@@ -99,14 +122,25 @@ def(types_1.OfficeCategory.Link, types_1.OfficeDetail.IpHost, 'strip', 40, 'A li
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.LookalikeHost, 'strip', 40, "A link's host uses punycode or mixed scripts");
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.EncodedHost, 'strip', 40, "A link's host is percent-encoded");
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.Relative, 'strip', 30, "A relative link, which resolves against the file's own location");
+def(types_1.OfficeCategory.Link, types_1.OfficeDetail.TextMismatch, 'strip', 40, "A link's text or tooltip names a different site than it opens");
+def(types_1.OfficeCategory.External, types_1.OfficeDetail.Formula, 'strip', 40, 'A formula fetches from outside the file when it is calculated<: {function}|>');
+def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Formula, 'strip', 60, 'A formula runs code outside the file when it is calculated<: {function}|>');
 // EMBEDDED
-def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, 'strip', 40, 'An embedded OLE object');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, 'strip', 40, 'An embedded OLE object<, which holds the file {fileName}|>');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, 'strip', 30, 'An embedded document<: {contentType}|>');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, 'strip', 40, 'A part holds an OLE file that nothing declares as an object');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, 'strip', 60, 'An embedded Java applet');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, 'strip', 50, 'An embedded browser plug-in object');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, 'strip', 70, 'An Equation Editor 3.0 object, which CVE-2017-11882 and CVE-2018-0802 exploit');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, 'strip', 30, '<An attached file "{name}"|An attached file> (<{type}|unknown type>)');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginPassed, 'info', 20, 'An embedded file was kept by <plugin {plugin}|a plugin> with nothing removed');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginScrubbed, 'info', 10, 'An embedded file was cleaned and kept by <plugin {plugin}|a plugin>');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginFailed, 'strip', 0, '<Plugin {plugin}|A plugin> failed, so the embedded file was removed');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginRemoved, 'strip', 0, 'An embedded file was removed by <plugin {plugin}|a plugin>');
 // CONTROL
 def(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, 'strip', 50, 'An ActiveX control');
+// PROCESSING
+def(types_1.OfficeCategory.Processing, types_1.OfficeDetail.VerificationFailed, 'reject', 0, 'The defused output did not pass its own inspection, so nothing was written');
 /** The built-in spec for a kind of finding, or undefined for a kind office-defuse does not make, such as one from another package. */
 function findingSpec(category, detail) {
     return specs.get(`${category}/${detail}`);
@@ -132,6 +166,7 @@ class FindingFactory {
     constructor(overrides = []) {
         this.overrides = overrides;
     }
+    /** The action of a kind of finding, after the caller's overrides. */
     actionFor(category, detail) {
         const exact = this.overrides.find(o => o.category === category && o.detail === detail);
         if (exact)

package/dist/flat.d.ts

@@ -0,0 +1,33 @@
+import { type Output, type RunContext, type RunState } from './context';
+import type { Format } from './formats';
+import type { PackagePlan } from './plan';
+import { type ByteSink, type ByteSource } from './types';
+import { type XmlLimits } from './xml';
+import { type ZipLimits } from './zip';
+/** The namespace of a Flat OPC package, the single-file form of OOXML that Word, Excel and PowerPoint save as XML. */
+export declare const PKG_NS = "http://schemas.microsoft.com/office/2006/xmlPackage";
+/** The name findings give the one part of a flat OpenDocument file. */
+export declare const FLAT_ODF_PART = "office:document";
+/** Flat OPC has no media type of its own, and Office saves it with the .xml extension. */
+export declare const FLAT_OPC_FORMAT: Format;
+/** Whether the first bytes of a file read as XML: a byte order mark, white space and then "<". */
+export declare function startsAsXml(head: Uint8Array): boolean;
+/**
+ * Whether the start of an XML file names a flat OpenDocument document or a Flat OPC package as its root element. The
+ * reading of the whole file decides; this tells a router which package to try.
+ */
+export declare function isFlatHead(text: string): boolean;
+/**
+ * Inspects a flat XML file: flat OpenDocument, read with the OpenDocument rules over its one part, or Flat OPC,
+ * which is unpacked into a package of its parts and read with the OOXML rules. Returns what the rewrite needs.
+ */
+export declare function inspectFlat(ctx: RunContext, src: ByteSource, size: number, zipLimits: ZipLimits): Promise<Output | undefined>;
+/** Writes a flat OpenDocument file without what the plan removes. */
+export declare function writeFlatOdf(run: RunState, src: ByteSource, plan: PackagePlan, limits: XmlLimits, sink: ByteSink): Promise<void>;
+/**
+ * Writes a Flat OPC package without what the plan removes: the package is rewritten as any OOXML package is, and its
+ * parts are written back into one XML file, each with its name, content type and attributes.
+ */
+export declare function writeFlatOpc(run: RunState, output: Extract<Output, {
+    kind: 'flatopc';
+}>, limits: XmlLimits, zipLimits: ZipLimits, sink: ByteSink): Promise<void>;