@patrickdk77/office-defuse 0.1.1 → 0.2.1

package/dist/flat.js

@@ -0,0 +1,555 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FLAT_OPC_FORMAT = exports.FLAT_ODF_PART = exports.PKG_NS = void 0;
+exports.startsAsXml = startsAsXml;
+exports.inspectFlat = inspectFlat;
+exports.nameFlat = nameFlat;
+exports.writeFlatOdf = writeFlatOdf;
+exports.writeFlatOpc = writeFlatOpc;
+const node_util_1 = require("node:util");
+const contained_1 = require("./contained");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
+const odf_1 = require("./odf");
+const ooxml_1 = require("./ooxml");
+const rewrite_xml_1 = require("./rewrite-xml");
+const rewrite_zip_1 = require("./rewrite-zip");
+const types_1 = require("./types");
+const xml_1 = require("./xml");
+const zip_1 = require("./zip");
+const zip_writer_1 = require("./zip-writer");
+/** The namespace of a Flat OPC package, the single-file form of OOXML that Word, Excel and PowerPoint save as XML. */
+exports.PKG_NS = 'http://schemas.microsoft.com/office/2006/xmlPackage';
+/** The name findings give the one part of a flat OpenDocument file. */
+exports.FLAT_ODF_PART = 'office:document';
+/** The name findings give the wrapper of a Flat OPC package. */
+const FLAT_OPC_PART = 'pkg:package';
+const LOEXT_NS = 'urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0';
+/** Flat OpenDocument formats, by the media type in office:mimetype. */
+const FLAT_ODF = new Map([
+    ['text', 'fodt'],
+    ['spreadsheet', 'fods'],
+    ['presentation', 'fodp'],
+    ['graphics', 'fodg'],
+].map(([kind, ext]) => [`application/vnd.oasis.opendocument.${kind}`, { format: ext, mimeType: `application/vnd.oasis.opendocument.${kind}-flat-xml` }]));
+/** Flat OPC has no media type of its own, and Office saves it with the .xml extension. */
+exports.FLAT_OPC_FORMAT = { format: 'xml', mimeType: 'application/xml' };
+const CHUNK = 65536;
+/** A source's bytes in chunks, checking the deadline before each. */
+async function* chunksOf(src, size, deadline) {
+    for (let at = 0; at < size; at += CHUNK) {
+        (0, errors_1.checkTime)(deadline);
+        yield await src.read(at, Math.min(CHUNK, size - at));
+    }
+}
+/** Whether the first bytes of a file read as XML: a byte order mark, white space and then "<". */
+function startsAsXml(head) {
+    const found = (0, xml_1.detectEncoding)(head);
+    if (!found)
+        return false;
+    const text = new node_util_1.TextDecoder(found.encoding, { fatal: false }).decode(head.subarray(found.bom));
+    return text.trimStart().startsWith('<');
+}
+/** Decodes base64 that arrives in pieces of any size, white space and line ends included. */
+class Base64 {
+    rest = '';
+    push(t) {
+        const s = this.rest + t.replace(/\s+/g, '');
+        const n = s.length - (s.length % 4);
+        this.rest = s.slice(n);
+        return Buffer.from(s.slice(0, n), 'base64');
+    }
+    end() {
+        const r = this.rest;
+        this.rest = '';
+        return Buffer.from(r, 'base64');
+    }
+}
+/** Decoded bytes the handlers gather while the tokenizer runs, which go to their sinks between chunks. */
+class Pending {
+    queue = [];
+    closing = [];
+    add(sink, b) {
+        if (b.length)
+            this.queue.push([sink, b]);
+    }
+    close(sink) {
+        this.closing.push(sink);
+    }
+    async flush() {
+        for (const [sink, b] of this.queue.splice(0))
+            await sink.write(b);
+        for (const sink of this.closing.splice(0))
+            await sink.close();
+    }
+}
+/**
+ * The rules of a flat OpenDocument file: the OpenDocument rules over its one part, and the files it holds in
+ * office:binary-data, such as pictures and OLE objects, which go to the plugins.
+ */
+class FlatOdf {
+    run;
+    pending;
+    rules;
+    binaries = [];
+    stack = [];
+    current;
+    constructor(ctx, run, pending) {
+        this.run = run;
+        this.pending = pending;
+        this.rules = new odf_1.EntryRules(ctx, exports.FLAT_ODF_PART, new Map(), true);
+    }
+    start(el) {
+        this.rules.start(el);
+        if (!this.current && (0, odf_1.odfNamespace)(el.ns) === odf_1.NS.office && el.local === 'binary-data') {
+            const sink = new io_1.SpillSink(this.run.temp, this.run.threshold);
+            this.run.held.push(sink);
+            this.current = { binary: { parent: this.stack[this.stack.length - 1], data: el, sink }, b64: new Base64() };
+        }
+        this.stack.push(el);
+    }
+    text(t) {
+        if (this.current)
+            this.pending.add(this.current.binary.sink, this.current.b64.push(t));
+        else
+            this.rules.text(t);
+    }
+    end(el) {
+        this.stack.pop();
+        const c = this.current;
+        if (c && c.binary.data.index === el.index) {
+            this.pending.add(c.binary.sink, c.b64.end());
+            this.pending.close(c.binary.sink);
+            this.binaries.push(c.binary);
+            this.current = undefined;
+        }
+        this.rules.end(el);
+    }
+}
+/** The parts of a Flat OPC package. XML parts are cut from the text in a second reading, by their offsets. */
+class FlatOpc {
+    run;
+    pending;
+    keep;
+    parts = [];
+    /** Where the pkg:package start tag begins, which is where the prolog ends. */
+    rootStart = 0;
+    part;
+    xmlDepth = 0;
+    b64;
+    scopes = [];
+    constructor(run, pending, 
+    /** The parts whose content is kept, by name. The others keep only their name, content type and attributes. */
+    keep = () => true) {
+        this.run = run;
+        this.pending = pending;
+        this.keep = keep;
+    }
+    start(el) {
+        this.scopes.push(el.namespaces);
+        if (el.depth === 1)
+            this.rootStart = el.start;
+        if (this.xmlDepth) {
+            const xml = this.part?.xml;
+            // The part's root inherits the namespaces in scope, and the ones it declares itself it does not need.
+            if (xml && el.depth === this.xmlDepth + 1)
+                for (const [prefix] of el.namespaces)
+                    xml.inherited.delete(prefix);
+            return;
+        }
+        if (el.ns !== exports.PKG_NS)
+            return;
+        if (el.depth === 2 && el.local === 'part') {
+            const name = el.attributes.find(a => a.ns === exports.PKG_NS && a.local === 'name')?.value;
+            if (name === undefined || name.replace(/^\//, '') === '')
+                throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'A Flat OPC part has no name', { reason: 'a part without a name' });
+            const contentType = el.attributes.find(a => a.ns === exports.PKG_NS && a.local === 'contentType')?.value ?? '';
+            const extra = el.attributes.filter(a => !(a.ns === exports.PKG_NS && (a.local === 'name' || a.local === 'contentType'))).map((a) => [a.qname, a.value]);
+            this.part = { name: name.replace(/^\//, ''), contentType, extra };
+        }
+        else if (el.depth === 3 && this.part && el.local === 'xmlData') {
+            const inherited = new Map();
+            for (const scope of this.scopes)
+                for (const [prefix, uri] of scope)
+                    inherited.set(prefix, uri);
+            this.part.xml = { start: el.end, end: el.end, inherited };
+            this.xmlDepth = el.depth;
+        }
+        else if (el.depth === 3 && this.part && el.local === 'binaryData' && this.keep(this.part.name)) {
+            const sink = new io_1.SpillSink(this.run.temp, this.run.threshold);
+            this.run.held.push(sink);
+            this.part.binary = sink;
+            this.b64 = new Base64();
+        }
+    }
+    text(t) {
+        if (this.b64 && this.part?.binary)
+            this.pending.add(this.part.binary, this.b64.push(t));
+    }
+    end(el, start) {
+        this.scopes.pop();
+        if (this.xmlDepth === el.depth && this.part?.xml) {
+            this.part.xml.end = start;
+            this.xmlDepth = 0;
+        }
+        else if (this.b64 && el.depth === 3 && this.part?.binary) {
+            this.pending.add(this.part.binary, this.b64.end());
+            this.pending.close(this.part.binary);
+            this.b64 = undefined;
+        }
+        else if (el.depth === 2 && this.part) {
+            this.parts.push(this.part);
+            this.part = undefined;
+        }
+    }
+}
+/**
+ * The format a flat file's root element names: a flat OpenDocument format by its office:mimetype, or 'opc' for a Flat
+ * OPC package, whose format the package its parts make names. Throws for any other root, or a flat OpenDocument media
+ * type this package does not read.
+ */
+function flatRoot(el) {
+    if ((0, odf_1.odfNamespace)(el.ns) === odf_1.NS.office && el.local === 'document') {
+        const type = (0, odf_1.oattr)(el, odf_1.NS.office, 'mimetype') ?? '';
+        const format = FLAT_ODF.get(type);
+        if (!format)
+            throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The flat OpenDocument media type is not one this package reads', { mediaType: (0, context_1.clip)(type) });
+        return format;
+    }
+    if (el.ns === exports.PKG_NS && el.local === 'package')
+        return 'opc';
+    throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The XML file is neither flat OpenDocument nor Flat OPC', { root: (0, context_1.clip)(el.qname), namespace: (0, context_1.clip)(el.ns) });
+}
+/** Reads the root element and hands everything to the rules of the flat format it names. */
+class FlatReader {
+    ctx;
+    pending;
+    odf;
+    opc;
+    format;
+    constructor(ctx, pending) {
+        this.ctx = ctx;
+        this.pending = pending;
+    }
+    start(el) {
+        if (el.depth === 1) {
+            const format = flatRoot(el);
+            if (format === 'opc')
+                this.opc = new FlatOpc(this.ctx.run, this.pending);
+            else {
+                this.format = format;
+                this.ctx.format = format;
+                this.odf = new FlatOdf(this.ctx, this.ctx.run, this.pending);
+            }
+        }
+        this.odf?.start(el);
+        this.opc?.start(el);
+    }
+    text(t) {
+        this.odf?.text(t);
+        this.opc?.text(t);
+    }
+    end(el, start) {
+        this.odf?.end(el);
+        this.opc?.end(el, start);
+    }
+}
+/** Base64 of everything a sink holds. */
+async function base64Of(sink) {
+    const chunks = [];
+    for await (const c of sink.read())
+        chunks.push(Buffer.from(c));
+    return Buffer.concat(chunks).toString('base64');
+}
+/**
+ * The plugins' verdicts on the files a flat OpenDocument file holds. A file a plugin removed goes with the element
+ * that holds it, and one a plugin rewrote goes back in as base64. An OLE object a plugin kept stays, and one no plugin
+ * took gets the rule EMBEDDED/OLE_OBJECT gives it. A picture no plugin took stays, since no rule names it.
+ */
+async function decideBinaries(ctx, odf) {
+    const plan = ctx.plan;
+    const decided = new Set();
+    let n = 0;
+    for (const b of odf.binaries) {
+        n++;
+        const parent = b.parent;
+        if (!parent)
+            continue;
+        const declaredType = (0, odf_1.oattr)(parent, odf_1.NS.draw, 'mime-type') ?? parent.attributes.find(a => a.ns === LOEXT_NS && a.local === 'mime-type')?.value;
+        const decision = await (0, contained_1.decideContained)(ctx, { location: `${exports.FLAT_ODF_PART} > ${parent.qname} ${n}`, declaredType, chunks: () => b.sink.read() });
+        const object = plan.objects.find(o => o.index === parent.index);
+        if (object) {
+            decided.add(parent.index);
+            if (decision?.keep) {
+                if (object.finding) {
+                    object.finding.action = 'info';
+                    ctx.run.superseded.add(object.finding);
+                }
+            }
+            else if (decision || object.strips)
+                plan.element(exports.FLAT_ODF_PART, parent.index, { remove: true });
+        }
+        else if (decision && !decision.keep)
+            plan.element(exports.FLAT_ODF_PART, parent.index, { remove: true });
+        if (decision?.keep && decision.replacement)
+            plan.element(exports.FLAT_ODF_PART, b.data.index, { content: await base64Of(decision.replacement) });
+    }
+    // An object with no data of its own gets its rule alone.
+    for (const o of plan.objects)
+        if (!decided.has(o.index) && o.strips)
+            plan.element(exports.FLAT_ODF_PART, o.index, { remove: true });
+}
+/** The ranges of the decoded text that `wanted` names, cut in one reading in order, and the text before `prolog`. */
+async function cutText(src, size, deadline, prolog, wanted) {
+    const order = wanted.map((w, i) => ({ ...w, i })).sort((a, b) => a.start - b.start);
+    const texts = wanted.map(() => '');
+    let head = '';
+    let pos = 0;
+    let decoder;
+    let k = 0;
+    const take = (s) => {
+        if (pos < prolog)
+            head += s.slice(0, Math.max(0, prolog - pos));
+        for (let j = k; j < order.length && order[j].start < pos + s.length; j++) {
+            const w = order[j];
+            const from = Math.max(w.start, pos) - pos;
+            const to = Math.min(w.end, pos + s.length) - pos;
+            if (to > from)
+                texts[w.i] += s.slice(from, to);
+        }
+        pos += s.length;
+        while (k < order.length && order[k].end <= pos)
+            k++;
+    };
+    let first = true;
+    for await (const c of chunksOf(src, size, deadline)) {
+        if (first) {
+            first = false;
+            const found = (0, xml_1.detectEncoding)(c) ?? { encoding: 'utf-8', bom: 0 };
+            decoder = new node_util_1.TextDecoder(found.encoding, { fatal: true, ignoreBOM: true });
+            take(decoder.decode(c.subarray(found.bom), { stream: true }));
+            continue;
+        }
+        take(decoder.decode(c, { stream: true }));
+    }
+    if (decoder)
+        take(decoder.decode());
+    return { prolog: head, texts };
+}
+const escapeAttribute = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
+/** A part's XML, cut from a Flat OPC package, as a part of its own: with an XML declaration and the namespaces it inherited. */
+function partXml(text, inherited) {
+    let body = text.trim();
+    if (inherited.size) {
+        // The root's start tag is the first "<" that does not open a comment or a processing instruction.
+        const m = /^(?:\s|<!--[\s\S]*?-->|<\?[\s\S]*?\?>)*<[^\s/>]+/.exec(body);
+        if (m) {
+            const decls = [...inherited].map(([prefix, uri]) => ` ${prefix ? `xmlns:${prefix}` : 'xmlns'}="${escapeAttribute(uri)}"`).join('');
+            body = body.slice(0, m[0].length) + decls + body.slice(m[0].length);
+        }
+    }
+    return Buffer.from(`<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n${body}`, 'utf8');
+}
+/**
+ * Inspects a flat XML file: flat OpenDocument, read with the OpenDocument rules over its one part, or Flat OPC,
+ * which is unpacked into a package of its parts and read with the OOXML rules. Returns what the rewrite needs.
+ */
+async function inspectFlat(ctx, src, size, zipLimits) {
+    const pctx = ctx.withPlan();
+    const pending = new Pending();
+    const reader = new FlatReader(pctx, pending);
+    // A finding about the document type comes before the root element, so the first bytes pick the name it gives.
+    const head = await src.read(0, Math.min(CHUNK, size));
+    const found = (0, xml_1.detectEncoding)(head) ?? { encoding: 'utf-8', bom: 0 };
+    const opcHead = new node_util_1.TextDecoder(found.encoding, { fatal: false }).decode(head.subarray(found.bom)).includes(exports.PKG_NS);
+    await pctx.parseXml(opcHead ? FLAT_OPC_PART : exports.FLAT_ODF_PART, chunksOf(src, size, ctx.settings.deadline), reader, false, pctx.plan, () => pending.flush());
+    if (reader.odf) {
+        await decideBinaries(pctx, reader.odf);
+        return { kind: 'flatodf', plan: pctx.plan };
+    }
+    const opc = reader.opc;
+    if (!opc)
+        return undefined;
+    const { zip, prolog } = await packFlatOpc(ctx, src, size, opc, zipLimits);
+    const zctx = ctx.withZip(zip);
+    const contentTypes = zip.get('[Content_Types].xml');
+    if (!contentTypes)
+        return undefined;
+    const inner = await (0, ooxml_1.inspectOoxml)(zctx, contentTypes, exports.FLAT_OPC_FORMAT);
+    const layout = {
+        instructions: [...prolog.matchAll(/<\?mso-application\s[^?]*\?>/g)].map(m => m[0]),
+        extra: new Map(opc.parts.map(p => [(0, zip_1.nameKey)(p.name), p.extra])),
+    };
+    return { kind: 'flatopc', zip, plan: zctx.plan, format: inner, layout };
+}
+/**
+ * Packs the parts of a Flat OPC package into a ZIP archive, with a [Content_Types].xml that gives each its content
+ * type, and returns it with the text before the package element. A part the reader did not keep goes in empty.
+ */
+async function packFlatOpc(ctx, src, size, opc, zipLimits) {
+    const run = ctx.run;
+    const xmlParts = opc.parts.filter(p => p.xml && opc.keep(p.name));
+    const cut = await cutText(src, size, ctx.settings.deadline, opc.rootStart, xmlParts.map(p => p.xml ?? { start: 0, end: 0 }));
+    // The parts go into a package of their own, with a [Content_Types].xml that gives each its content type.
+    const packed = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(packed);
+    const writer = new zip_writer_1.ZipWriter(packed);
+    const seen = new Set();
+    for (const p of opc.parts) {
+        const k = (0, zip_1.nameKey)(p.name);
+        if (seen.has(k) || k === (0, zip_1.nameKey)('[Content_Types].xml'))
+            throw new errors_1.StopError(types_1.OfficeCategory.Container, types_1.OfficeDetail.DuplicateName, `Two Flat OPC parts are named ${(0, context_1.clip)(p.name)}`, { name: (0, context_1.clip)(p.name) });
+        seen.add(k);
+    }
+    const types = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<Types xmlns="${ooxml_1.CONTENT_TYPES_NS}">${opc.parts.map(p => `<Override PartName="/${escapeAttribute(p.name)}" ContentType="${escapeAttribute(p.contentType)}"/>`).join('')}</Types>`;
+    await writer.add('[Content_Types].xml', Buffer.from(types, 'utf8'), { compress: false });
+    for (const p of opc.parts) {
+        (0, errors_1.checkTime)(ctx.settings.deadline);
+        let data = new Uint8Array(0);
+        const cutAt = xmlParts.indexOf(p);
+        if (p.xml && cutAt >= 0)
+            data = partXml(cut.texts[cutAt], p.xml.inherited);
+        else if (p.binary) {
+            const chunks = [];
+            for await (const c of p.binary.read())
+                chunks.push(Buffer.from(c));
+            data = Buffer.concat(chunks);
+        }
+        await writer.add(p.name, data, { compress: false });
+    }
+    await writer.finish();
+    await packed.close();
+    const packedSource = packed.source();
+    run.sources.push(packedSource);
+    return { zip: await zip_1.ZipArchive.open(packedSource, zipLimits, ctx.settings.deadline), prolog: cut.prolog };
+}
+/** Stops the reading of a flat file once its root has named a flat OpenDocument format. */
+const ROOT_NAMED = new Error('The root names the format');
+/**
+ * Reads a flat file as far as naming its format needs: its root element, and for a Flat OPC package, every part's
+ * name, content type and attributes, with the content of the package relationships alone.
+ */
+class FlatNamer {
+    run;
+    pending;
+    format;
+    opc;
+    constructor(run, pending) {
+        this.run = run;
+        this.pending = pending;
+    }
+    start(el) {
+        if (el.depth === 1) {
+            const format = flatRoot(el);
+            if (format !== 'opc') {
+                this.format = format;
+                throw ROOT_NAMED;
+            }
+            this.opc = new FlatOpc(this.run, this.pending, name => (0, ooxml_1.relsSource)(name) === '');
+        }
+        this.opc?.start(el);
+    }
+    text(t) {
+        this.opc?.text(t);
+    }
+    end(el, start) {
+        this.opc?.end(el, start);
+    }
+}
+/**
+ * Names a flat file's format as its inspection does, without the rules: flat OpenDocument by its root element, and a
+ * Flat OPC package once the package its parts make names an OOXML format.
+ */
+async function nameFlat(ctx, src, size, zipLimits) {
+    const pending = new Pending();
+    const namer = new FlatNamer(ctx.run, pending);
+    try {
+        await ctx.parseXml(FLAT_OPC_PART, chunksOf(src, size, ctx.settings.deadline), namer, false, undefined, () => pending.flush());
+    }
+    catch (e) {
+        if (e !== ROOT_NAMED)
+            throw e;
+    }
+    if (namer.format)
+        return namer.format;
+    const opc = namer.opc;
+    if (!opc)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The XML file has no root element', { reason: 'no root element' });
+    const { zip } = await packFlatOpc(ctx, src, size, opc, zipLimits);
+    const contentTypes = zip.get('[Content_Types].xml');
+    if (!contentTypes)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The Flat OPC package has no [Content_Types].xml', { reason: 'no [Content_Types].xml' });
+    await (0, ooxml_1.nameOoxml)(ctx.withZip(zip), contentTypes);
+    return exports.FLAT_OPC_FORMAT;
+}
+/** Writes a flat OpenDocument file without what the plan removes. */
+async function writeFlatOdf(run, src, plan, limits, sink) {
+    const size = await src.size();
+    const r = await (0, rewrite_xml_1.partEdits)(chunksOf(src, size, run.deadline), exports.FLAT_ODF_PART, limits, false, plan.parts.get(exports.FLAT_ODF_PART), { element: () => undefined });
+    for await (const c of (0, rewrite_xml_1.splice)(chunksOf(src, size, run.deadline), r.edits))
+        await sink.write(c);
+}
+/** The content types of a package's parts, by key, from its [Content_Types].xml. */
+async function contentTypesOf(zip, limits) {
+    const defaults = new Map();
+    const overrides = new Map();
+    const entry = zip.get('[Content_Types].xml');
+    if (entry) {
+        const t = new xml_1.XmlTokenizer({
+            start(el) {
+                if (el.ns.toLowerCase() !== ooxml_1.CONTENT_TYPES_NS)
+                    return;
+                const type = (0, xml_1.attr)(el, '', 'ContentType') ?? '';
+                if (el.local === 'Default')
+                    defaults.set(((0, xml_1.attr)(el, '', 'Extension') ?? '').toLowerCase(), type);
+                else if (el.local === 'Override')
+                    overrides.set((0, zip_1.nameKey)(((0, xml_1.attr)(el, '', 'PartName') ?? '').replace(/^\//, '')), type);
+            },
+        }, limits, entry.name);
+        for await (const c of zip.read(entry))
+            t.write(c);
+        t.end();
+    }
+    return name => overrides.get((0, zip_1.nameKey)(name)) ?? defaults.get(/\.([^./]*)$/.exec(name)?.[1]?.toLowerCase() ?? '') ?? '';
+}
+/** A part's XML as it goes inside pkg:xmlData: decoded, without its byte order mark and XML declaration. */
+function embeddedXml(bytes) {
+    const found = (0, xml_1.detectEncoding)(bytes) ?? { encoding: 'utf-8', bom: 0 };
+    const text = new node_util_1.TextDecoder(found.encoding, { fatal: true }).decode(bytes.subarray(found.bom));
+    return text.replace(/^\s*<\?xml[\s\S]*?\?>\s*/, '');
+}
+/**
+ * Writes a Flat OPC package without what the plan removes: the package is rewritten as any OOXML package is, and its
+ * parts are written back into one XML file, each with its name, content type and attributes.
+ */
+async function writeFlatOpc(run, output, limits, zipLimits, sink) {
+    const packed = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(packed);
+    await (0, rewrite_zip_1.writePackage)(run, output.zip, output.plan, output.format, limits, packed);
+    await packed.close();
+    const packedSource = packed.source();
+    run.sources.push(packedSource);
+    const zip = await zip_1.ZipArchive.open(packedSource, zipLimits, run.deadline);
+    const typeOf = await contentTypesOf(zip, limits);
+    const put = (s) => sink.write(Buffer.from(s, 'utf8'));
+    await put(`<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n${output.layout.instructions.map(i => `${i}\n`).join('')}<pkg:package xmlns:pkg="${exports.PKG_NS}">`);
+    for (const e of zip.entries) {
+        (0, errors_1.checkTime)(run.deadline);
+        if (e.directory || e.name === '[Content_Types].xml')
+            continue;
+        const chunks = [];
+        for await (const c of zip.read(e))
+            chunks.push(Buffer.from(c));
+        const bytes = Buffer.concat(chunks);
+        const type = typeOf(e.name);
+        const extra = (output.layout.extra.get((0, zip_1.nameKey)(e.name)) ?? []).map(([q, v]) => ` ${q}="${escapeAttribute(v)}"`).join('');
+        await put(`<pkg:part pkg:name="/${escapeAttribute(e.name)}" pkg:contentType="${escapeAttribute(type)}"${extra}>`);
+        if ((0, ooxml_1.isXmlType)(type.toLowerCase()) || type.toLowerCase().endsWith('xml'))
+            await put(`<pkg:xmlData>${embeddedXml(bytes)}</pkg:xmlData>`);
+        else
+            await put(`<pkg:binaryData>${(bytes.toString('base64').match(/.{1,76}/g) ?? []).join('\n')}</pkg:binaryData>`);
+        await put('</pkg:part>');
+    }
+    await put('</pkg:package>');
+}

package/dist/formats.d.ts

@@ -6,5 +6,14 @@ export interface Format {
 }
 /** OOXML formats by the content type of the main part, lowercased. */
 export declare const OOXML_FORMATS: Map<string, Format>;
+/** The content type of an XPS package's FixedDocumentSequence, which XPS and OpenXPS share. */
+export declare const XPS_SEQUENCE = "application/vnd.ms-package.xps-fixeddocumentsequence+xml";
+/** XPS formats, told apart by the relationship type that names the FixedDocumentSequence. */
+export declare const XPS_FORMATS: {
+    xps: Format;
+    oxps: Format;
+};
 /** OpenDocument formats by the media type in the mimetype entry or the manifest, exactly as written. */
 export declare const ODF_FORMATS: Map<string, Format>;
+/** RTF, which Word reads in any file that starts with {\rt. */
+export declare const RTF_FORMAT: Format;

package/dist/formats.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ODF_FORMATS = exports.OOXML_FORMATS = void 0;
+exports.RTF_FORMAT = exports.ODF_FORMATS = exports.XPS_FORMATS = exports.XPS_SEQUENCE = exports.OOXML_FORMATS = void 0;
 const f = (format, mimeType) => ({ format, mimeType });
 /** OOXML formats by the content type of the main part, lowercased. */
 exports.OOXML_FORMATS = new Map([
@@ -30,6 +30,10 @@ exports.OOXML_FORMATS = new Map([
     ['application/vnd.ms-visio.stencil.main+xml', f('vssx', 'application/vnd.ms-visio.stencil')],
     ['application/vnd.ms-visio.stencil.macroenabled.main+xml', f('vssm', 'application/vnd.ms-visio.stencil.macroEnabled.12')],
 ]);
+/** The content type of an XPS package's FixedDocumentSequence, which XPS and OpenXPS share. */
+exports.XPS_SEQUENCE = 'application/vnd.ms-package.xps-fixeddocumentsequence+xml';
+/** XPS formats, told apart by the relationship type that names the FixedDocumentSequence. */
+exports.XPS_FORMATS = { xps: f('xps', 'application/vnd.ms-xpsdocument'), oxps: f('oxps', 'application/oxps') };
 /** OpenDocument formats by the media type in the mimetype entry or the manifest, exactly as written. */
 exports.ODF_FORMATS = new Map([
     ['text', 'odt'],
@@ -44,3 +48,5 @@ exports.ODF_FORMATS = new Map([
     ['text-master', 'odm'],
     ['base', 'odb'],
 ].map(([kind, ext]) => [`application/vnd.oasis.opendocument.${kind}`, f(ext, `application/vnd.oasis.opendocument.${kind}`)]));
+/** RTF, which Word reads in any file that starts with {\rt. */
+exports.RTF_FORMAT = f('rtf', 'application/rtf');

package/dist/formulas.d.ts

@@ -8,6 +8,33 @@ export declare class Quotes {
     /** Takes the next character and tells whether it stands outside quotes. */
     outside(c: string): boolean;
 }
+/** What a function a formula calls does outside the file, or undefined when it does nothing there. */
+export declare function riskyFunction(name: string): 'fetch' | 'run' | undefined;
+/** The functions, outside quotes, that a formula's text calls and that reach outside the file, as its text arrives. */
+export declare class FunctionCalls {
+    private readonly quotes;
+    private word;
+    private spaced;
+    readonly found: Map<string, "fetch" | "run">;
+    write(t: string): void;
+}
+/** The functions a formula's whole text calls that reach outside the file. */
+export declare function formulaCalls(formula: string): Map<string, 'fetch' | 'run'>;
+/** A name a BIFF formula token refers to: a defined name by index, or an external name through an XTI. */
+export type BiffNameRef = {
+    kind: 'name';
+    index: number;
+} | {
+    kind: 'namex';
+    ixti: number;
+    index: number;
+};
+/**
+ * The functions a BIFF8 formula (MS-XLS 2.5.198) calls that reach outside the file: built-in ones by index, and
+ * add-in and newer ones by the name the formula names them with, such as `_xlfn.WEBSERVICE`. The walk stops at a
+ * token it does not know the size of.
+ */
+export declare function biffCalls(rgce: Uint8Array, nameOf: (ref: BiffNameRef) => string | undefined): Map<string, 'fetch' | 'run'>;
 /** Whether an OpenDocument formula calls the DDE function. */
 export declare function callsDde(formula: string): boolean;
 /** One word of a Word field code. A switch is an unquoted word that starts with a backslash. */