@patrickdk77/office-defuse 0.1.1 → 0.2.0

package/dist/cfb-writer.js

@@ -0,0 +1,314 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCfb = writeCfb;
+const errors_1 = require("./errors");
+const MINI_SECTOR = 64;
+const MINI_CUTOFF = 4096;
+const FREE = 0xffffffff;
+const END_OF_CHAIN = 0xfffffffe;
+const FAT_SECTOR = 0xfffffffd;
+const DIFAT_SECTOR = 0xfffffffc;
+const NO_STREAM = 0xffffffff;
+const HEADER_FAT = 109;
+/** A GUID as Windows shows it, back to its 16 bytes. '' gives zeros. */
+function guidBytes(clsid) {
+    const out = new Uint8Array(16);
+    const h = clsid.replace(/-/g, '');
+    if (h.length !== 32)
+        return out;
+    const byte = (i) => Number.parseInt(h.slice(i * 2, i * 2 + 2), 16);
+    const order = [3, 2, 1, 0, 5, 4, 7, 6, 8, 9, 10, 11, 12, 13, 14, 15];
+    for (const [i, from] of order.entries())
+        out[i] = byte(from);
+    return out;
+}
+/** MS-CFB's order of names in a storage: the shorter first, then by their upper-case code units. */
+function compareNames(a, b) {
+    if (a.length !== b.length)
+        return a.length - b.length;
+    const ua = a.toUpperCase();
+    const ub = b.toUpperCase();
+    return ua < ub ? -1 : ua > ub ? 1 : 0;
+}
+class Bytes {
+    b;
+    constructor(n) {
+        this.b = Buffer.alloc(n);
+    }
+    u16(at, v) {
+        this.b.writeUInt16LE(v, at);
+    }
+    u32(at, v) {
+        this.b.writeUInt32LE(v >>> 0, at);
+    }
+}
+/**
+ * Writes a compound file (MS-CFB, version 3 with 512-byte sectors) to an append-only sink. The children of each
+ * storage go into a balanced tree in MS-CFB's name order, colored as a valid red-black tree. Streams under 4,096 bytes
+ * go into the mini stream. The writer holds the allocation tables and the directory, and reads each stream once, in
+ * order, from its source.
+ */
+async function writeCfb(tree, sink, deadline) {
+    const ss = 512;
+    const per = ss / 4;
+    // The directory: the root, then every storage's children, depth first.
+    const entries = [{ name: 'Root Entry', type: 5, clsid: guidBytes(tree.clsid), left: NO_STREAM, right: NO_STREAM, child: NO_STREAM, red: false, start: END_OF_CHAIN, size: 0 }];
+    const place = (children) => {
+        const sorted = [...children].sort((a, b) => compareNames(a.name, b.name));
+        const ids = [];
+        for (const c of sorted) {
+            ids.push(entries.length);
+            entries.push({
+                name: c.name,
+                type: c.kind === 'storage' ? 1 : 2,
+                clsid: c.kind === 'storage' ? guidBytes(c.clsid) : new Uint8Array(16),
+                left: NO_STREAM,
+                right: NO_STREAM,
+                child: NO_STREAM,
+                red: false,
+                start: END_OF_CHAIN,
+                size: c.kind === 'stream' ? c.size : 0,
+                node: c,
+            });
+        }
+        // A median split puts every leaf on the last two levels. The deepest level is red and the rest black, so every
+        // path from the root down passes the same number of black entries.
+        const height = Math.ceil(Math.log2(sorted.length + 1));
+        const build = (lo, hi, depth) => {
+            if (lo > hi)
+                return NO_STREAM;
+            const mid = (lo + hi) >>> 1;
+            const e = entries[ids[mid]];
+            e.left = build(lo, mid - 1, depth + 1);
+            e.right = build(mid + 1, hi, depth + 1);
+            e.red = depth === height - 1 && height > 1;
+            return ids[mid];
+        };
+        const root = build(0, sorted.length - 1, 0);
+        for (const [i, c] of sorted.entries())
+            if (c.kind === 'storage')
+                entries[ids[i]].child = place(c.children);
+        return root;
+    };
+    entries[0].child = place(tree.children);
+    // Sectors: the FAT and the DIFAT, then the mini stream, the large streams, the directory and the mini FAT, then any
+    // free sectors the tail needs. The first sector after the header is always a FAT sector, whose sector numbers can
+    // never spell a signature, so no stream lands where PDF readers look for a header.
+    // Version 3 keeps sizes in 32 bits.
+    if (entries.some(e => e.size > 0xffffffff))
+        throw new Error('A stream is too large for a version 3 compound file');
+    const small = entries.filter(e => e.type === 2 && e.size > 0 && e.size < MINI_CUTOFF);
+    const large = entries.filter(e => e.type === 2 && e.size >= MINI_CUTOFF);
+    let miniSectors = 0;
+    const miniStart = new Map();
+    for (const e of small) {
+        miniStart.set(e, miniSectors);
+        miniSectors += Math.ceil(e.size / MINI_SECTOR);
+    }
+    const miniStreamSize = miniSectors * MINI_SECTOR;
+    const miniStreamSectors = Math.ceil(miniStreamSize / ss);
+    const largeSectors = large.reduce((t, e) => t + Math.ceil(e.size / ss), 0);
+    const dirSectors = Math.ceil(entries.length / (ss / 128));
+    const miniFatSectors = Math.ceil(miniSectors / per);
+    const content = miniStreamSectors + largeSectors + dirSectors + miniFatSectors;
+    /** Where everything goes with `pad` free sectors at the end. */
+    const layout = (pad) => {
+        // The FAT must describe its own sectors and the DIFAT's, so their counts grow together until they fit.
+        let fatSectors = 0;
+        let difatSectors = 0;
+        for (;;) {
+            const total = content + pad + fatSectors + difatSectors;
+            const needFat = Math.ceil(total / per);
+            const needDifat = needFat > HEADER_FAT ? Math.ceil((needFat - HEADER_FAT) / (per - 1)) : 0;
+            if (needFat === fatSectors && needDifat === difatSectors)
+                break;
+            fatSectors = needFat;
+            difatSectors = needDifat;
+        }
+        const base = fatSectors + difatSectors;
+        let next = base + miniStreamSectors;
+        const starts = new Map();
+        for (const e of large) {
+            starts.set(e, next);
+            next += Math.ceil(e.size / ss);
+        }
+        const dirStart = next;
+        const miniFatStart = miniSectors ? dirStart + dirSectors : END_OF_CHAIN;
+        const sectors = base + content + pad;
+        return { fatSectors, difatSectors, base, starts, dirStart, miniFatStart, pad, sectors, size: (sectors + 1) * ss };
+    };
+    const apply = (l) => {
+        for (const e of small)
+            e.start = miniStart.get(e) ?? 0;
+        for (const e of large)
+            e.start = l.starts.get(e) ?? 0;
+        entries[0].start = miniStreamSectors ? l.base : END_OF_CHAIN;
+        entries[0].size = miniStreamSize;
+    };
+    const fatOf = (l) => {
+        const fat = new Uint32Array(l.fatSectors * per).fill(FREE);
+        const chain = (start, count) => {
+            for (let i = 0; i < count; i++)
+                fat[start + i] = i === count - 1 ? END_OF_CHAIN : start + i + 1;
+        };
+        for (let i = 0; i < l.fatSectors; i++)
+            fat[i] = FAT_SECTOR;
+        for (let i = 0; i < l.difatSectors; i++)
+            fat[l.fatSectors + i] = DIFAT_SECTOR;
+        if (miniStreamSectors)
+            chain(l.base, miniStreamSectors);
+        for (const e of large)
+            chain(e.start, Math.ceil(e.size / ss));
+        chain(l.dirStart, dirSectors);
+        if (miniFatSectors)
+            chain(l.miniFatStart, miniFatSectors);
+        return fat;
+    };
+    const directoryOf = () => {
+        const dir = new Bytes(dirSectors * ss);
+        for (let id = 0; id < dirSectors * (ss / 128); id++) {
+            const at = id * 128;
+            const e = entries[id];
+            if (!e) {
+                dir.u32(at + 0x44, NO_STREAM);
+                dir.u32(at + 0x48, NO_STREAM);
+                dir.u32(at + 0x4c, NO_STREAM);
+                continue;
+            }
+            const name = Buffer.from(e.name, 'utf16le').subarray(0, 62);
+            name.copy(dir.b, at);
+            dir.u16(at + 0x40, name.length + 2);
+            dir.b[at + 0x42] = e.type;
+            dir.b[at + 0x43] = e.red ? 0 : 1;
+            dir.u32(at + 0x44, e.left);
+            dir.u32(at + 0x48, e.right);
+            dir.u32(at + 0x4c, e.child);
+            Buffer.from(e.clsid).copy(dir.b, at + 0x50);
+            dir.u32(at + 0x74, e.type === 1 ? 0 : e.size === 0 && e.type === 2 ? END_OF_CHAIN : e.start);
+            dir.u32(at + 0x78, e.size);
+        }
+        return dir.b;
+    };
+    const miniFat = new Uint32Array(miniFatSectors * per).fill(FREE);
+    for (const e of small) {
+        const first = miniStart.get(e) ?? 0;
+        const n = Math.ceil(e.size / MINI_SECTOR);
+        for (let i = 0; i < n; i++)
+            miniFat[first + i] = i === n - 1 ? END_OF_CHAIN : first + i + 1;
+    }
+    /**
+     * The bytes the file holds in [from, to), with streams read from their sources. The header and the DIFAT read as
+     * zeros, since what the header holds is fixed and the DIFAT holds only sector numbers.
+     */
+    const bytesAt = async (l, from, to) => {
+        const out = Buffer.alloc(Math.max(0, to - from));
+        const put = (at, b) => {
+            const s = Math.max(at, from);
+            const e = Math.min(at + b.length, to);
+            if (e > s)
+                out.set(b.subarray(s - at, e - at), s - from);
+        };
+        const putStream = async (at, e) => {
+            const node = e.node;
+            const s = Math.max(at, from);
+            const end = Math.min(at + e.size, to);
+            if (end <= s || node?.kind !== 'stream')
+                return;
+            put(s, await node.source.read(s - at, end - s));
+        };
+        const fat = fatOf(l);
+        put(ss, Buffer.from(fat.buffer));
+        for (const e of small)
+            await putStream((l.base + 1) * ss + (miniStart.get(e) ?? 0) * MINI_SECTOR, e);
+        for (const e of large)
+            await putStream((e.start + 1) * ss, e);
+        put((l.dirStart + 1) * ss, directoryOf());
+        if (miniFatSectors)
+            put((l.miniFatStart + 1) * ss, Buffer.from(miniFat.buffer));
+        return out;
+    };
+    // ZIP readers look for an end record in the last 65,557 bytes. A stream that ends with one, such as an embedded
+    // package, would make the file open as that archive too, so free sectors of zeros push it out of their reach.
+    const ZIP_WINDOW = 22 + 0xffff;
+    const END_RECORD = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
+    const lastEndRecord = async (l) => {
+        const from = Math.max(ss, l.size - ZIP_WINDOW);
+        const found = (await bytesAt(l, from, l.size)).lastIndexOf(END_RECORD);
+        return found < 0 ? -1 : from + found;
+    };
+    let plan = layout(0);
+    apply(plan);
+    const endAt = await lastEndRecord(plan);
+    if (endAt >= 0) {
+        plan = layout(Math.ceil((endAt + 1 - (plan.size - ZIP_WINDOW)) / ss));
+        apply(plan);
+    }
+    // Both rules hold by construction. Checking them costs two small reads and turns a mistake into a failed write.
+    if ((await lastEndRecord(plan)) >= 0)
+        throw new Error('A ZIP end record is still within reach of ZIP readers');
+    if ((await bytesAt(plan, 0, Math.min(1024, plan.size))).includes('%PDF-'))
+        throw new Error('A PDF header is within the first 1024 bytes');
+    const { fatSectors, difatSectors, dirStart, miniFatStart } = plan;
+    const fatStart = 0;
+    const difatStart = fatSectors;
+    const fat = fatOf(plan);
+    const header = new Bytes(ss);
+    Buffer.from('d0cf11e0a1b11ae1', 'hex').copy(header.b, 0);
+    header.u16(0x18, 0x3e);
+    header.u16(0x1a, 3);
+    header.u16(0x1c, 0xfffe);
+    header.u16(0x1e, 9);
+    header.u16(0x20, 6);
+    header.u32(0x2c, fatSectors);
+    header.u32(0x30, dirStart);
+    header.u32(0x38, MINI_CUTOFF);
+    header.u32(0x3c, miniFatStart);
+    header.u32(0x40, miniFatSectors);
+    header.u32(0x44, difatSectors ? difatStart : END_OF_CHAIN);
+    header.u32(0x48, difatSectors);
+    for (let i = 0; i < HEADER_FAT; i++)
+        header.u32(0x4c + 4 * i, i < fatSectors ? fatStart + i : FREE);
+    await sink.write(header.b);
+    await sink.write(Buffer.from(fat.buffer));
+    if (difatSectors) {
+        const d = new Bytes(difatSectors * ss);
+        const rest = Math.max(0, fatSectors - HEADER_FAT);
+        for (let k = 0; k < difatSectors; k++) {
+            for (let i = 0; i < per - 1; i++) {
+                const n = k * (per - 1) + i;
+                d.u32(k * ss + 4 * i, n < rest ? fatStart + HEADER_FAT + n : FREE);
+            }
+            d.u32(k * ss + 4 * (per - 1), k === difatSectors - 1 ? END_OF_CHAIN : difatStart + k + 1);
+        }
+        await sink.write(d.b);
+    }
+    /** Copies a stream's bytes and pads them to `unit`. */
+    const copy = async (e, unit) => {
+        const node = e.node;
+        if (node?.kind !== 'stream')
+            return;
+        for (let at = 0; at < e.size; at += 262144) {
+            (0, errors_1.checkTime)(deadline);
+            const want = Math.min(262144, e.size - at);
+            const b = await node.source.read(at, want);
+            if (b.length !== want)
+                throw Object.assign(new Error(`A stream returned ${b.length} bytes where ${want} were expected`), { code: 'EIO' });
+            await sink.write(b);
+        }
+        const pad = (unit - (e.size % unit)) % unit;
+        if (pad)
+            await sink.write(new Uint8Array(pad));
+    };
+    for (const e of small)
+        await copy(e, MINI_SECTOR);
+    const miniPad = miniStreamSectors * ss - miniStreamSize;
+    if (miniPad)
+        await sink.write(new Uint8Array(miniPad));
+    for (const e of large)
+        await copy(e, ss);
+    await sink.write(directoryOf());
+    if (miniFatSectors)
+        await sink.write(Buffer.from(miniFat.buffer));
+    for (let i = 0; i < plan.pad; i++)
+        await sink.write(new Uint8Array(ss));
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function main(argv: string[]): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,357 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = main;
+const fs = __importStar(require("node:fs"));
+const fsp = __importStar(require("node:fs/promises"));
+const path = __importStar(require("node:path"));
+const promises_1 = require("node:stream/promises");
+const node_url_1 = require("node:url");
+const engine_1 = require("./engine");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
+const plugins_1 = require("./plugins");
+const USAGE = `Usage:
+  office-defuse inspect <file> [options]
+  office-defuse defuse <in> <out> [options]
+
+Options:
+  --password-file <path>   read passwords from a file, one per line; OFFICE_DEFUSE_PASSWORD holds one
+  --plugin <module>        load file plugins from a file or an installed package, repeatable
+  --config <module>        load a whole options object, repeatable; the other options apply on top
+  --defuse-embedded-office defuse Office files inside the file with office-defuse and keep them
+  --limit <name>=<value>   fileSize, entries, decompressedBytes, totalDecompressedBytes, xmlDepth,
+                           xmlTokenSize, xmlEntityDepth, xmlEntityExpansions, xmlEntitySize, rtfDepth,
+                           nestingDepth, timeMs; sizes accept kb, mb, gb
+  --json                   print the result as JSON
+
+Use - for stdin or stdout.
+Exit codes: 0 clean, 1 stripped or strippable, 2 rejected, 3 usage or I/O error.`;
+class UsageError extends Error {
+}
+const SIZES = new Set(['fileSize', 'decompressedBytes', 'totalDecompressedBytes']);
+const COUNTS = new Set(['entries', 'xmlDepth', 'xmlTokenSize', 'xmlEntityDepth', 'xmlEntityExpansions', 'xmlEntitySize', 'rtfDepth', 'nestingDepth', 'timeMs']);
+function parseSize(v) {
+    const m = /^(\d+(?:\.\d+)?)\s*(b|kb|k|mb|m|gb|g)?$/i.exec(v.trim());
+    if (!m)
+        throw new UsageError(`Bad size "${v}"`);
+    const mult = { b: 1, k: 1024, kb: 1024, m: 1024 ** 2, mb: 1024 ** 2, g: 1024 ** 3, gb: 1024 ** 3 };
+    return Math.round(Number(m[1]) * mult[(m[2] ?? 'b').toLowerCase()]);
+}
+// A real dynamic import. TypeScript would compile import() to require() for CommonJS output,
+// and require() cannot load ES modules or file URLs.
+const dynamicImport = new Function('specifier', 'return import(specifier)');
+/** Reads `key` from `v` the way `v?.[key]` does, for a value whose shape is not known. */
+function prop(v, key) {
+    return (typeof v === 'object' && v !== null) || typeof v === 'function' ? v[key] : undefined;
+}
+const isObject = (v) => typeof v === 'object' && v !== null;
+async function loadModule(spec) {
+    // A bare name ending in .js can be a file in the working directory or a package with that name. The file wins.
+    const looksLikePath = spec.startsWith('.') || path.isAbsolute(spec) || (/\.(c|m)?js$/.test(spec) && fs.statSync(spec, { throwIfNoEntry: false })?.isFile() === true);
+    let resolved;
+    if (looksLikePath)
+        resolved = path.resolve(process.cwd(), spec);
+    else {
+        try {
+            resolved = require.resolve(spec, { paths: [process.cwd()] });
+        }
+        catch (e) {
+            // require.resolve applies only the "require" condition, so a package that exports only "import" ends up here.
+            if (e.code !== 'ERR_PACKAGE_PATH_NOT_EXPORTED')
+                throw e;
+            const name = spec
+                .split('/')
+                .slice(0, spec.startsWith('@') ? 2 : 1)
+                .join('/');
+            const subpath = `.${spec.slice(name.length)}`;
+            for (let dir = process.cwd(); resolved === undefined; dir = path.dirname(dir)) {
+                const pkg = path.join(dir, 'node_modules', name);
+                if (fs.existsSync(path.join(pkg, 'package.json'))) {
+                    const exp = JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'), 'utf8')).exports;
+                    const isMap = isObject(exp) && Object.keys(exp).some(k => k.startsWith('.'));
+                    let target;
+                    let match;
+                    if (!isMap)
+                        target = subpath === '.' ? exp : undefined;
+                    else if (Object.hasOwn(exp, subpath) && !subpath.includes('*'))
+                        target = exp[subpath];
+                    else {
+                        // A pattern key holds one "*". Node prefers the longest text before the "*", then the longest key, and puts
+                        // what the "*" matched into the target.
+                        let best = '';
+                        for (const k of Object.keys(exp)) {
+                            const star = k.indexOf('*');
+                            const trailer = k.slice(star + 1);
+                            if (star < 0 || trailer.includes('*') || !subpath.startsWith(k.slice(0, star)) || subpath.length === star)
+                                continue;
+                            if (trailer && (!subpath.endsWith(trailer) || subpath.length < k.length))
+                                continue;
+                            if (!best || star > best.indexOf('*') || (star === best.indexOf('*') && k.length > best.length))
+                                best = k;
+                        }
+                        if (best) {
+                            target = exp[best];
+                            match = subpath.slice(best.indexOf('*'), subpath.length - (best.length - best.indexOf('*') - 1));
+                            // Node refuses a match that would step outside the pattern's directory.
+                            if (match.split(/[/\\]/).some(s => s === '' || s === '.' || s === '..' || s.toLowerCase() === 'node_modules'))
+                                throw e;
+                        }
+                    }
+                    // Node takes the first condition it supports, in the order the package lists them.
+                    while (isObject(target) && !Array.isArray(target))
+                        target = target[Object.keys(target).find(k => k === 'node' || k === 'import' || k === 'default') ?? ''];
+                    if (typeof target !== 'string')
+                        throw e;
+                    resolved = path.resolve(pkg, match === undefined ? target : target.replaceAll('*', match));
+                }
+                else if (path.dirname(dir) === dir)
+                    throw e;
+            }
+        }
+    }
+    return dynamicImport((0, node_url_1.pathToFileURL)(resolved).href);
+}
+function pluginsFrom(mod) {
+    // import() gives a CommonJS module a default export holding module.exports, so the named exports come first.
+    const value = prop(mod, 'plugins') ?? prop(prop(mod, 'default'), 'plugins') ?? prop(mod, 'plugin') ?? prop(prop(mod, 'default'), 'plugin') ?? prop(mod, 'default');
+    const list = Array.isArray(value) ? value : [value];
+    for (const p of list)
+        if (!p || prop(p, 'kind') !== 'file')
+            throw new UsageError('A plugin module must export plugins with kind "file"');
+    // The loop above checked each entry's kind, which is as far as a plugin's shape can be checked here.
+    return list;
+}
+async function parse(argv) {
+    const [command, ...rest] = argv;
+    if (command !== 'inspect' && command !== 'defuse')
+        throw new UsageError(command ? `Unknown command "${command}"` : 'No command');
+    const positional = [];
+    // Every --config module goes in first and the flags apply on top, wherever they sit on the command line.
+    const options = {};
+    const ordered = [];
+    const limits = {};
+    let password = process.env.OFFICE_DEFUSE_PASSWORD;
+    let json = false;
+    for (let i = 0; i < rest.length; i++) {
+        const a = rest[i];
+        const next = () => {
+            const v = rest[++i];
+            if (v === undefined)
+                throw new UsageError(`${a} needs a value`);
+            return v;
+        };
+        switch (a) {
+            case '--password-file':
+                // A blank line holds no password, so it adds nothing to the list.
+                password = (await fsp.readFile(next(), 'utf8'))
+                    .split('\n')
+                    .map(line => line.replace(/\r$/, ''))
+                    .filter(line => line !== '');
+                break;
+            case '--plugin':
+                ordered.push(...pluginsFrom(await loadModule(next())));
+                break;
+            case '--config': {
+                const mod = await loadModule(next());
+                // The module's shape is the caller's to get right, as OfficeOptions documents it.
+                const cfg = (prop(mod, 'default') ?? mod);
+                // Modules combine: plugin lists join in order and limits merge. For any other option the later module wins.
+                Object.assign(options, cfg, {
+                    filePlugins: [...(options.filePlugins ?? []), ...(cfg.filePlugins ?? [])],
+                    limits: { ...options.limits, ...cfg.limits },
+                });
+                break;
+            }
+            case '--defuse-embedded-office':
+                ordered.push((0, plugins_1.officePlugin)());
+                break;
+            case '--limit': {
+                const [name, value] = next().split('=');
+                if (value === undefined)
+                    throw new UsageError('--limit expects name=value');
+                if (SIZES.has(name))
+                    limits[name] = parseSize(value);
+                else if (COUNTS.has(name)) {
+                    // Number('abc') is NaN, and no comparison with NaN is true, so the limit would never apply.
+                    if (!/^\d+$/.test(value.trim()))
+                        throw new UsageError(`Bad value for ${name}: "${value}"`);
+                    limits[name] = Number(value);
+                }
+                else
+                    throw new UsageError(`Unknown limit "${name}"`);
+                break;
+            }
+            case '--json':
+                json = true;
+                break;
+            default:
+                if (a === '--password' || a.startsWith('--password='))
+                    throw new UsageError('Pass the password with --password-file or OFFICE_DEFUSE_PASSWORD, not on the command line');
+                // What follows "=" can be a secret typed in the wrong place, and stderr often ends up in a log.
+                if (a.startsWith('--'))
+                    throw new UsageError(`Unknown option ${a.replace(/=.*/s, '=...')}`);
+                positional.push(a);
+        }
+    }
+    if (ordered.length)
+        options.filePlugins = [...(options.filePlugins ?? []), ...ordered];
+    if (Object.keys(limits).length)
+        options.limits = { ...(options.limits ?? {}), ...limits };
+    if (password !== undefined)
+        options.password = password;
+    return { command, positional, options, json };
+}
+/**
+ * The input as a source. stdin is copied to a temporary file first. The copy stops one byte past `fileSize`, so the
+ * engine rejects the upload as too large without the rest being read, and at the deadline, where the source then
+ * fails the run for time.
+ */
+async function inputSource(p, tempDir, fileSize, deadline) {
+    if (p !== '-') {
+        return {
+            source: (0, io_1.fileSource)(p),
+            cleanup: async () => {
+                // The caller's own file stays.
+            },
+        };
+    }
+    const temp = new io_1.TempDir(tempDir);
+    try {
+        const file = await temp.file('.office');
+        let room = (fileSize ?? Number.POSITIVE_INFINITY) + 1;
+        try {
+            await (0, promises_1.pipeline)(process.stdin, async function* (chunks) {
+                for await (const c of chunks) {
+                    yield c.subarray(0, room);
+                    room -= c.length;
+                    if (room <= 0)
+                        return;
+                }
+            }, fs.createWriteStream(file), { signal: deadline === undefined ? undefined : AbortSignal.timeout(Math.max(0, deadline - Date.now())) });
+        }
+        catch (e) {
+            if (e.name !== 'AbortError')
+                throw e;
+            const late = () => Promise.reject(new errors_1.TimeLimitError('Time limit exceeded'));
+            return { source: { size: late, read: late }, cleanup: () => temp.cleanup() };
+        }
+        return { source: (0, io_1.fileSource)(file), cleanup: () => temp.cleanup() };
+    }
+    catch (e) {
+        await temp.cleanup();
+        throw e;
+    }
+}
+/** Writes a control character as a JSON escape, since text from the file could otherwise drive the terminal. */
+const escaped = (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`;
+function report(label, i) {
+    const lines = [`${label}: ${i.status}, risk ${i.risk}${i.score === null ? '' : ` (score ${i.score})`}, ${i.format ? i.format.toUpperCase() : '?'}`];
+    for (const f of i.findings)
+        lines.push(`  ${f.action.padEnd(6)} ${f.category}/${f.detail}${f.location ? ` [${f.location}]` : ''}: ${f.description}`);
+    // A location can hold a part name, a field code or a link from the file. A line break in one would print a line of
+    // its own.
+    return lines.map(l => l.replace(/\p{Cc}/gu, escaped)).join('\n');
+}
+async function main(argv) {
+    let parsed;
+    try {
+        parsed = await parse(argv);
+    }
+    catch (e) {
+        process.stderr.write(`${e.message}\n\n${USAGE}\n`);
+        return 3;
+    }
+    const { command, positional, options, json } = parsed;
+    try {
+        if (command === 'inspect' && positional.length !== 1)
+            throw new UsageError('inspect takes one file');
+        if (command === 'defuse' && positional.length !== 2)
+            throw new UsageError('defuse takes an input and an output');
+        const toStdout = command === 'defuse' && positional[1] === '-';
+        if (command === 'defuse' && positional[0] !== '-' && !toStdout) {
+            // A failed write deletes the partial output, which here would be the only copy of the input.
+            const [a, b] = await Promise.all([fsp.stat(positional[0]), fsp.stat(positional[1]).catch(() => undefined)]);
+            if (b && a.dev === b.dev && a.ino === b.ino)
+                throw new UsageError('The input and the output are the same file');
+        }
+        // Reading stdin counts toward the time limit, so the run gets what is left of it.
+        const deadline = options.limits?.timeMs === undefined ? undefined : Date.now() + options.limits.timeMs;
+        const input = await inputSource(positional[0], options.tempDir, options.limits?.fileSize, deadline);
+        const runOptions = deadline === undefined ? options : { ...options, limits: { ...options.limits, timeMs: deadline - Date.now() } };
+        let text;
+        let code;
+        try {
+            if (command === 'inspect') {
+                const r = await (0, engine_1.inspectOfficeSource)(input.source, runOptions);
+                text = json ? JSON.stringify(r, null, 2) : report('inspection', r);
+                code = r.status === 'clean' ? 0 : r.status === 'strippable' ? 1 : 2;
+            }
+            else {
+                const r = await (0, engine_1.disarmOfficeSource)(input.source, toStdout ? (0, io_1.writableSink)(process.stdout) : (0, io_1.fileSink)(positional[1]), runOptions);
+                text = json ? JSON.stringify(r, null, 2) : [`result: ${r.status}`, report('before', r.before), ...(r.after && r.status === 'defused' ? [report('after', r.after)] : [])].join('\n');
+                code = r.status === 'clean' ? 0 : r.status === 'defused' ? 1 : 2;
+            }
+        }
+        finally {
+            await input.source.close?.();
+            await input.cleanup();
+        }
+        // JSON.stringify escapes C0 controls but not DEL or the C1 range.
+        if (json)
+            text = text.replace(/[\u007f-\u009f]/g, escaped);
+        // The report shares stdout only when the file goes elsewhere. A report nobody can read is an I/O error.
+        const out = toStdout ? process.stderr : process.stdout;
+        await new Promise((resolve, reject) => out.write(`${text}\n`, e => (e ? reject(e) : resolve())));
+        return code;
+    }
+    catch (e) {
+        process.stderr.write(`${e instanceof UsageError ? `${e.message}\n\n${USAGE}` : `Error: ${e.message}`}\n`);
+        return 3;
+    }
+}
+if (require.main === module) {
+    // main() learns of a failed write from its callback. Node emits the failure as an 'error' event as well, which
+    // with no listener would end the process with exit code 1.
+    for (const stream of [process.stdout, process.stderr]) {
+        stream.on('error', () => {
+            process.exitCode = 3;
+        });
+    }
+    main(process.argv.slice(2)).then(code => {
+        process.exitCode = code;
+    });
+}