@poe-platform/safe-bash 0.1.806 → 0.1.807

package/dist/safe-bash/command-chunks/chunk-LHL6RWGJ.js

@@ -0,0 +1,548 @@
+import {
+  openDocumentLocations,
+  resolveDocxSelection
+} from "./chunk-LHDB4QO5.js";
+import {
+  measurePackageResourceSerialization
+} from "./chunk-W6DV2CLS.js";
+import {
+  validateDocxInvocation
+} from "./chunk-DE66JRWJ.js";
+import {
+  publishDocumentFiles
+} from "./chunk-HPKUFWHW.js";
+import {
+  PublicationError
+} from "./chunk-JGGRMERW.js";
+import {
+  DocumentPackage
+} from "./chunk-GLPIFP7N.js";
+import {
+  documentDialects
+} from "./chunk-MG7AJD5E.js";
+import {
+  docxOperationSchemas
+} from "./chunk-R4TYL2G6.js";
+import {
+  MarkupCompatibility,
+  compatibilityProfileForPart
+} from "./chunk-GZ2N24A2.js";
+import {
+  SelectionError,
+  closedRecord,
+  decodeLocation,
+  encodeGeneratedLocation
+} from "./chunk-LQOKYG3O.js";
+import {
+  isXmlContentType,
+  parseDocumentXml,
+  parseMediaType
+} from "./chunk-MWAAMNAM.js";
+import {
+  DocxUsageError
+} from "./chunk-2P7BLWWI.js";
+import {
+  CancellationError,
+  archiveSettings
+} from "./chunk-IQFRPIXH.js";
+
+// packages/safe-bash-docx-engine/src/objects.ts
+import { resolvePath } from "@poe-platform/safe-fs/core";
+var ObjectExtractionPublicationError = class extends PublicationError {
+  constructor(error, data) {
+    super(error.code, error.message, error.published, error.stdoutMayBePartial, { cause: error });
+    this.data = data;
+  }
+  data;
+};
+var ObjectExtractionCancellationError = class extends CancellationError {
+  constructor(error, data, published) {
+    super(error.message, { cause: error });
+    this.data = data;
+    this.published = published;
+  }
+  data;
+  published;
+};
+var office = "urn:schemas-microsoft-com:office:office";
+var vml = "urn:schemas-microsoft-com:vml";
+var oleContentType = "application/vnd.openxmlformats-officedocument.oleobject";
+var embeddedMacroContentTypes = /* @__PURE__ */ new Set([
+  "application/vnd.ms-excel.sheet.macroenabled.12",
+  "application/vnd.ms-excel.template.macroenabled.12",
+  "application/vnd.ms-excel.sheet.binary.macroenabled.12",
+  "application/vnd.ms-excel.addin.macroenabled.12",
+  "application/vnd.ms-powerpoint.presentation.macroenabled.12",
+  "application/vnd.ms-powerpoint.slideshow.macroenabled.12",
+  "application/vnd.ms-powerpoint.template.macroenabled.12",
+  "application/vnd.ms-powerpoint.addin.macroenabled.12",
+  "application/vnd.ms-word.document.macroenabled.12",
+  "application/vnd.ms-word.template.macroenabled.12"
+]);
+var attribute = (node, name, namespace = "") => node.attributes.find((a) => a.localName === name && a.namespace === namespace)?.value;
+var role = (type) => {
+  for (const dialect of Object.values(documentDialects)) {
+    if (type === dialect.r + "/oleObject") return "ole";
+    if (type === dialect.r + "/package") return "package";
+  }
+  return "unknown";
+};
+async function hash(bytes, budget) {
+  budget.charge("retainedBytes", bytes.length + 128);
+  budget.charge("work", bytes.length);
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)));
+  budget.check("work", 0);
+  return [...digest].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var contains = (owner, path) => owner.length <= path.length && owner.every((n, i) => path[i] === n);
+async function inventory(input, operation, options, context) {
+  const settings = archiveSettings(context), invocation = validateDocxInvocation(
+    { operation, inputs: ["document"], options },
+    settings.budget
+  );
+  const opts = invocation.options;
+  const budget = settings.budget.lower(
+    Object.fromEntries((opts.limit ?? []).map((limit) => [limit.name, limit.value]))
+  );
+  const document = await openDocumentLocations(input, { ...settings, budget }, "inventory"), graph = new DocumentPackage(document.snapshot(), settings.limits, budget);
+  const sourceSha256 = document.list("part")[0].value.sourceSha256;
+  const warnings = [], descriptors = /* @__PURE__ */ new Map(), items = [];
+  const warning = (code, message) => {
+    if (warnings.some((w) => w.code === code)) return;
+    budget.charge("diagnosticBytes", code.length + message.length + 16);
+    budget.charge("retainedBytes", (code.length + message.length) * 4);
+    warnings.push({ code, message });
+  };
+  const resource = async (part) => {
+    let result = descriptors.get(part.partname);
+    if (result) return result;
+    budget.check("embeddedMediaBytes", part.bytes.length);
+    budget.charge("retainedBytes", 256 + (part.partname.length + part.content_type.length) * 4);
+    result = {
+      part: part.partname,
+      contentType: part.content_type,
+      bytes: part.bytes.length,
+      sha256: await hash(part.bytes, budget)
+    };
+    descriptors.set(part.partname, result);
+    return result;
+  };
+  const reference = (owner, edge) => ({
+    owner,
+    id: edge.rId,
+    type: edge.reltype,
+    target: edge.is_external ? "[redacted external target]" : edge.target_ref,
+    external: edge.is_external
+  });
+  const allEdges = [];
+  for (const owner of [
+    "/",
+    ...graph.parts.filter((p) => p.content_type.toLowerCase() !== "application/vnd.openxmlformats-package.relationships+xml").map((p) => p.partname)
+  ]) {
+    for (const edge of graph.relationships(owner)) {
+      budget.charge("work", 1);
+      budget.charge("retainedBytes", 64);
+      allEdges.push({ owner, edge });
+    }
+  }
+  const consumed = /* @__PURE__ */ new Set(), inventoried = /* @__PURE__ */ new Set();
+  const binding = async (owner, id, preview = false) => {
+    budget.charge("work", allEdges.length);
+    const edge = allEdges.find((value) => value.owner === owner && value.edge.rId === id)?.edge;
+    const status = id === void 0 ? "missing-id" : !edge ? "missing-relationship" : (preview ? !Object.values(documentDialects).some((d) => edge.reltype === d.r + "/image") : role(edge.reltype) === "unknown") ? "wrong-relationship-type" : edge.is_external ? "external" : "internal";
+    if (status !== "internal")
+      warning(
+        "unresolved-object-binding",
+        "Object or preview bindings are external, unresolved or ambiguous; no resource is fetched or fabricated."
+      );
+    return {
+      edge,
+      status,
+      resource: status === "internal" ? await resource(edge.target_part) : null
+    };
+  };
+  const add = async (owner, path, edge, status, target, previews) => {
+    budget.charge("matches", 1);
+    budget.charge("retainedBytes", 1024 + path.length * 16);
+    if (edge) consumed.add(edge);
+    if (target) inventoried.add(target.part);
+    const value = {
+      version: 1,
+      sourceSha256,
+      generation: 0,
+      part: owner,
+      story: owner,
+      path,
+      range: null
+    };
+    const location = {
+      kind: "part",
+      value,
+      token: encodeGeneratedLocation(value),
+      positions: {}
+    };
+    const visited = /* @__PURE__ */ new Set(), pending = [
+      ...target ? [target.part] : [],
+      ...previews.flatMap((preview) => preview.resource ? [preview.resource.part] : [])
+    ], graphParts = [], references = [];
+    while (pending.length) {
+      await budget.checkpoint(1);
+      const name = pending.pop();
+      if (visited.has(name)) continue;
+      visited.add(name);
+      budget.charge("retainedBytes", 128);
+      graphParts.push(await resource(graph.getPart(name)));
+      for (const child of graph.relationships(name)) {
+        budget.charge("work", 1);
+        if (!child.is_external && !visited.has(child.target_part.partname)) {
+          budget.charge("retainedBytes", 16);
+          pending.push(child.target_part.partname);
+        }
+      }
+    }
+    for (const record of allEdges) {
+      budget.charge("work", 1);
+      if (record.edge === edge || record.owner === owner && previews.some((preview) => preview.relationshipId === record.edge.rId) || visited.has(record.owner) || !record.edge.is_external && (record.edge.target_part.partname === target?.part || previews.some(
+        (preview) => preview.resource?.part === record.edge.target_part.partname
+      ))) {
+        budget.charge(
+          "retainedBytes",
+          128 + (record.owner.length + record.edge.rId.length + record.edge.reltype.length + (record.edge.is_external ? 32 : record.edge.target_ref.length)) * 4
+        );
+        references.push(reference(record.owner, record.edge));
+      }
+    }
+    graphParts.sort((a, b) => a.part < b.part ? -1 : a.part > b.part ? 1 : 0);
+    const details = {
+      kind: "objects",
+      role: edge ? role(edge.reltype) : target && parseMediaType(target.contentType) === oleContentType ? "ole" : "unknown",
+      status,
+      resource: target,
+      previews,
+      owners: [],
+      graphParts,
+      security: {
+        macro: target && embeddedMacroContentTypes.has(parseMediaType(target.contentType)) ? "declared" : "unknown",
+        protected: "unknown",
+        content: "opaque"
+      }
+    };
+    items.push({
+      kind: "objects",
+      location,
+      ...target ? { name: target.part } : {},
+      properties: [],
+      references,
+      support: "preserve",
+      details
+    });
+  };
+  let protectedDocument = false;
+  const matchedObjects = /* @__PURE__ */ new WeakSet();
+  for (const part of graph.parts) {
+    const mime = parseMediaType(part.content_type);
+    if (!isXmlContentType(mime) || mime === "application/vnd.openxmlformats-package.relationships+xml")
+      continue;
+    await budget.checkpoint(1);
+    const root = parseDocumentXml(part.bytes, {}, budget).root;
+    const projected = /* @__PURE__ */ new Map();
+    const collectProjection = (content) => {
+      for (const item of content) if ("source" in item) {
+        budget.charge("work", item.content.length + 1);
+        budget.charge("retainedBytes", 96 + item.content.length * 8);
+        projected.set(item.source, item.content.filter((child) => "source" in child).map((child) => child.source));
+        collectProjection(item.content);
+      }
+    };
+    collectProjection(new MarkupCompatibility(root, compatibilityProfileForPart(part.partname), budget).content);
+    const visit = async (node, path, object) => {
+      await budget.checkpoint(1);
+      const word = Object.values(documentDialects).some((d) => node.namespace === d.w);
+      if (word && node.localName === "documentProtection" && !["0", "false", "off"].includes(attribute(node, "enforcement", node.namespace) ?? ""))
+        protectedDocument = true;
+      if (word && node.localName === "object") object = node;
+      if (node.namespace === office && node.localName === "OLEObject" || word && ["objectEmbed", "objectLink"].includes(node.localName)) {
+        if (object) matchedObjects.add(object);
+        const id = Object.values(documentDialects).map((d) => attribute(node, "id", d.r)).find((id2) => id2 !== void 0), resolved = await binding(part.partname, id);
+        const previews = [], shapes = [];
+        const collect = (current) => {
+          budget.charge("work", 1);
+          if (current.namespace === vml && current.localName === "shape") shapes.push(current);
+          for (const child of current.children) collect(child);
+        };
+        if (object) collect(object);
+        const shapeId = word ? attribute(node, "shapeId", node.namespace) : attribute(node, "ShapeID"), matching = shapeId ? shapes.filter((shape) => attribute(shape, "id") === shapeId) : [];
+        if (matching.length === 1) {
+          const scan = async (current) => {
+            await budget.checkpoint(1);
+            if (current.namespace === vml && current.localName === "imagedata") {
+              const previewId = Object.values(documentDialects).map((d) => attribute(current, "id", d.r)).find((id2) => id2 !== void 0), image = await binding(part.partname, previewId, true);
+              previews.push({
+                relationshipId: previewId ?? null,
+                status: image.status,
+                resource: image.resource
+              });
+              budget.charge("retainedBytes", 128);
+            }
+            for (const child of current.children) await scan(child);
+          };
+          await scan(matching[0]);
+        } else if (shapes.length) {
+          previews.push({ relationshipId: null, status: "ambiguous", resource: null });
+          warning(
+            "ambiguous-object-preview",
+            "Preview shape ownership cannot be verified; no association is invented."
+          );
+        }
+        if (word && object) {
+          const dialect = Object.values(documentDialects).find((d) => d.w === node.namespace);
+          let candidates = [object];
+          const ancestry = [
+            [dialect.w, ["drawing"]],
+            [dialect.wp, ["inline", "anchor"]],
+            [dialect.a, ["graphic"]],
+            [dialect.a, ["graphicData"]],
+            [dialect.pic, ["pic"]],
+            [dialect.pic, ["blipFill"]],
+            [dialect.a, ["blip"]]
+          ];
+          for (const [namespace, names] of ancestry) {
+            const next = [];
+            for (const candidate of candidates) {
+              const children = projected.get(candidate) ?? candidate.children;
+              budget.charge("work", children.length);
+              for (const child of children) {
+                if (child.namespace !== namespace || !names.includes(child.localName) || child.namespace === dialect.a && child.localName === "graphicData" && attribute(child, "uri") !== dialect.pic) continue;
+                budget.charge("retainedBytes", 8);
+                next.push(child);
+              }
+            }
+            candidates = next;
+          }
+          for (const blip of candidates) {
+            budget.charge("work", blip.attributes.length);
+            const ids = blip.attributes.filter((a) => a.namespace === dialect.r && ["embed", "link"].includes(a.localName));
+            for (const id2 of ids.length ? ids.map((a) => a.value) : [void 0]) {
+              const image = await binding(part.partname, id2, true);
+              budget.charge("retainedBytes", 128);
+              previews.push({ relationshipId: id2 ?? null, status: image.status, resource: image.resource });
+            }
+          }
+        }
+        await add(part.partname, path, resolved.edge, resolved.status, resolved.resource, previews);
+      }
+      for (let i = 0; i < node.children.length; i++)
+        await visit(node.children[i], [...path, i], object);
+      if (word && node.localName === "object" && !matchedObjects.has(node)) {
+        warning(
+          "unknown-object-carrier",
+          "Unrecognized object content remains opaque; stored content is not exposed or activated."
+        );
+        await add(part.partname, path, void 0, "missing-id", null, []);
+      }
+    };
+    await visit(root, []);
+  }
+  for (const record of allEdges)
+    if (role(record.edge.reltype) !== "unknown" && !consumed.has(record.edge)) {
+      const resolved = await binding(record.owner, record.edge.rId);
+      await add(
+        record.owner === "/" ? record.edge.is_external ? "/[Content_Types].xml" : record.edge.target_part.partname : record.owner,
+        [],
+        record.edge,
+        resolved.status,
+        resolved.resource,
+        []
+      );
+    }
+  for (const part of graph.parts)
+    if (!inventoried.has(part.partname) && part.content_type.toLowerCase() !== "application/vnd.openxmlformats-package.relationships+xml" && (parseMediaType(part.content_type) === oleContentType || part.partname.toLowerCase().startsWith("/word/embeddings/")))
+      await add(part.partname, [], void 0, "internal", await resource(part), []);
+  const ownerGroups = /* @__PURE__ */ new Map();
+  for (const item of items)
+    if (item.details.resource) {
+      const group = ownerGroups.get(item.details.resource.part) ?? [];
+      group.push(item.location);
+      ownerGroups.set(item.details.resource.part, group);
+      budget.charge("retainedBytes", 32);
+    }
+  let finalized = items.map((item) => ({
+    ...item,
+    details: {
+      ...item.details,
+      owners: item.details.resource ? ownerGroups.get(item.details.resource.part) : [item.location]
+    }
+  }));
+  if (opts.select !== void 0) {
+    const selected = decodeLocation(opts.select);
+    if (selected.sourceSha256 !== sourceSha256 || selected.generation !== 0)
+      throw new SelectionError("stale-selection");
+    if (selected.range !== null)
+      throw new DocxUsageError("Object inventory requires whole resource or owner tokens.");
+    const own = items.some((item) => item.location.token === opts.select);
+    if (!own) document.resolve(opts.select);
+    finalized = finalized.filter(
+      (item) => item.location.value.part === selected.part && contains(selected.path, item.location.value.path)
+    );
+  } else if (Object.keys(opts).some(
+    (key) => !["json", "limit", "outputDir", "force", "allowPartialOutput"].includes(key)
+  )) {
+    const selection = Object.fromEntries(
+      Object.entries(opts).filter(
+        ([key]) => !["json", "limit", "outputDir", "force", "allowPartialOutput"].includes(key)
+      )
+    );
+    const owners = resolveDocxSelection(document, {
+      operation: "text.get",
+      inputs: ["document"],
+      options: selection
+    });
+    finalized = finalized.filter(
+      (item) => owners.some(
+        (owner) => owner.value.part === item.location.value.part && contains(owner.value.path, item.location.value.path)
+      )
+    );
+  }
+  warning(
+    "opaque-object-content",
+    "Embedded content remains opaque and inert; macro and protection state is unknown unless explicitly declared. No object is activated or decoded."
+  );
+  if (protectedDocument)
+    warning(
+      "protected-document",
+      "Stored document protection is present; no protection values are exposed or bypassed."
+    );
+  const data = {
+    items: finalized,
+    warnings: items.length || protectedDocument ? warnings : [],
+    document: { protected: protectedDocument }
+  };
+  if (operation === "objects.list" && opts.json) measurePackageResourceSerialization(data, budget);
+  return { data, graph, budget };
+}
+async function inspectDocumentObjects(input, options, context) {
+  return (await inventory(input, "objects.list", options, context)).data;
+}
+async function extractDocumentObjects(input, options, context) {
+  const declaration = docxOperationSchemas["objects.extract"];
+  closedRecord(options, [
+    "input",
+    ...Object.keys(declaration.fields),
+    ...declaration.commonOptions
+  ]);
+  const { input: identity, ...selection } = options;
+  if (identity !== void 0) {
+    closedRecord(identity, ["path", "stat"]);
+    if (typeof identity.path !== "string" || !identity.path || !identity.stat)
+      throw new DocxUsageError("Object input identity requires a path and stat.");
+  }
+  const directory = selection.outputDir;
+  if (!directory || !directory.startsWith("/") || directory.includes("\0") || resolvePath("/", directory) !== directory)
+    throw new DocxUsageError(
+      "Object extraction requires a canonical absolute VFS output directory."
+    );
+  if (!context.filesystem)
+    throw new PublicationError(
+      "unsupported-publication",
+      "Object extraction requires an explicitly supplied publication filesystem."
+    );
+  const result = await inventory(input, "objects.extract", selection, context), entries = [], files = [];
+  for (const item of result.data.items) {
+    const resource = item.details.resource;
+    if (!resource) continue;
+    result.budget.charge("retainedBytes", resource.bytes);
+    result.budget.charge("work", resource.bytes);
+    const path = resolvePath(directory, `object-${entries.length + 1}.bin`);
+    entries.push({
+      path,
+      part: resource.part,
+      bytes: resource.bytes,
+      sha256: resource.sha256,
+      locations: [item.location],
+      published: false
+    });
+    files.push({ path, bytes: new Uint8Array(result.graph.getPart(resource.part).bytes) });
+  }
+  const manifestValue = {
+    version: 1,
+    kind: "objects",
+    entries: entries.map(({ path, part, bytes, sha256, locations }) => ({
+      path: path.slice(directory === "/" ? 1 : directory.length + 1),
+      part,
+      bytes,
+      sha256,
+      locations
+    }))
+  };
+  const size = measurePackageResourceSerialization(manifestValue, result.budget);
+  result.budget.charge("retainedBytes", size * 6);
+  const manifestBytes = new TextEncoder().encode(JSON.stringify(manifestValue)), manifest = {
+    path: resolvePath(directory, "manifest.json"),
+    bytes: manifestBytes.length,
+    sha256: await hash(manifestBytes, result.budget),
+    published: false
+  };
+  files.push({ path: manifest.path, bytes: manifestBytes });
+  const data = {
+    complete: result.data.items.every((item) => item.details.resource !== null),
+    inventory: null,
+    manifest,
+    entries,
+    warnings: result.data.warnings
+  };
+  if (selection.json) measurePackageResourceSerialization(data, result.budget);
+  if (context.admitPublication) {
+    result.budget.charge("retainedBytes", entries.length * 128 + 128);
+    const planned = Object.freeze({
+      ...data,
+      manifest: Object.freeze({ ...manifest }),
+      entries: Object.freeze(
+        entries.map(
+          (entry) => Object.freeze({ ...entry, locations: Object.freeze([...entry.locations]) })
+        )
+      ),
+      warnings: Object.freeze([...data.warnings])
+    });
+    const admitted = context.admitPublication(planned);
+    if (admitted !== void 0) {
+      void Promise.resolve(admitted).catch(() => {
+      });
+      throw new DocxUsageError(
+        "Object publication admission must be synchronous and return undefined."
+      );
+    }
+  }
+  const receipt = (published) => {
+    const paths = new Set(published.map((file) => file.path));
+    return {
+      ...data,
+      manifest: { ...manifest, published: paths.has(manifest.path) },
+      entries: entries.map((entry) => ({ ...entry, published: paths.has(entry.path) }))
+    };
+  };
+  try {
+    const published = await publishDocumentFiles(
+      files,
+      {
+        ...identity ? { input: identity } : {},
+        ...selection.force === void 0 ? {} : { force: selection.force },
+        ...selection.allowPartialOutput === void 0 ? {} : { allowPartialOutput: selection.allowPartialOutput }
+      },
+      { ...context, filesystem: context.filesystem, budget: result.budget }
+    );
+    return receipt(published.published);
+  } catch (error) {
+    if (!(error instanceof PublicationError) && !(error instanceof CancellationError)) throw error;
+    const published = "published" in error && Array.isArray(error.published) ? error.published : [], partial = { ...receipt(published), complete: false };
+    if (error instanceof CancellationError)
+      throw new ObjectExtractionCancellationError(error, partial, published);
+    throw new ObjectExtractionPublicationError(error, partial);
+  }
+}
+
+export {
+  ObjectExtractionPublicationError,
+  ObjectExtractionCancellationError,
+  inspectDocumentObjects,
+  extractDocumentObjects
+};