ooxml-core 0.9.0 → 0.10.0

package/README.md

@@ -35,19 +35,20 @@ import { parseXml } from 'ooxml-core/xml'; // one area
 import { xml, opc } from 'ooxml-core'; // or by namespace (shared building blocks)
 ```
 
-| Area       | What it is                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `xml`      | The shared XML model: strict DOM parsing and serialization, namespaces, namespace-aware helpers.                                                                                                                                                                                                                                                                                                                   |
-| `opc`      | Open Packaging Conventions: relationships, content types, part paths, zip helpers, safe hyperlinks.                                                                                                                                                                                                                                                                                                                |
-| `units`    | Branded EMU, twip and point types, constants and conversions.                                                                                                                                                                                                                                                                                                                                                      |
-| `color`    | Hex, RGB, HSL and linear colour primitives, OOXML percent and angle parsing.                                                                                                                                                                                                                                                                                                                                       |
-| `geometry` | DrawingML preset shapes, connection sites, clip paths, callouts and boolean shape operations.                                                                                                                                                                                                                                                                                                                      |
-| `diagram`  | SmartArt (DiagramML), format-neutral: data model, layout/colour/quick-style parts, the cached `dsp:drawing` shape tree, relationship resolution and a loader. Used by `docx`; `pptx` re-imports its parsers.                                                                                                                                                                                                       |
-| `digest`   | Synchronous pure-TypeScript SHA-1, SHA-256, SHA-384 and SHA-512, ECMA-376 digest name normalisation (`SHA-512`, `SHA512`, `sha_512`, ...) and the agile password hash Office protection elements store (`hashPassword`, `verifyPasswordHash`). No Web Crypto, so it works on `http://`. Used by `xlsx` sheet and workbook protection.                                                                              |
-| `collab`   | Format-neutral real-time collaboration on Yjs: session and provider lifecycle, awareness/presence, transport-neutral sync (WebSocket, in-memory, any byte channel), update codecs, ordering helpers, asset sync and the product adapter seam. See `docs/collab-area.md`.                                                                                                                                           |
-| `docx`     | WordprocessingML: model, parser, preserving serializer, editing, validation. Also `/docx/embedded`. `/docx/layout` is the DOM-free pagination engine (an approximation of Word, not parity) and `/docx/load` detects and loads DOCX and legacy .doc (ole2 inlined).                                                                                                                                                |
-| `pptx`     | PresentationML: model, parser, serializer, editing, charts, SmartArt, converters, CLI, signatures. Subpaths `/pptx/converter`, `/pptx/cli`, `/pptx/signature-node`.                                                                                                                                                                                                                                                |
-| `xlsx`     | SpreadsheetML: workbook model, `.xlsx`/`.xlsm` reader and preserving writer, formula engine (dependency graph, dynamic arrays, 380+ functions), Excel number formats, editing commands with undo, and the DOM-free grid layout (sizes, colours, conditional formats, charts as SVG). `/xlsx/load` detects and loads `.xlsx`, `.xlsm`, legacy `.xls` (ole2 inlined) and CSV. An approximation of Excel, not parity. |
+| Area       | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `xml`      | The shared XML model: strict DOM parsing and serialization, namespaces, namespace-aware helpers.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `opc`      | Open Packaging Conventions: relationships, content types, part paths, zip helpers, the hyperlink safety policy (`hyperlinkPolicy`) and document properties (core, app and custom, `opc/properties`) and digital signatures (`signature`: detection, the parts a writer strips, XML-DSig parsing and digest checks; the Node verifier is `/pptx/signature-node`).                                                                                                                                                                                                                                                                                                                                                                                    |
+| `units`    | Branded EMU, twip and point types, constants and conversions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `color`    | Hex, RGB, HSL and linear colour primitives, OOXML percent and angle parsing.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `geometry` | DrawingML preset shapes, connection sites, clip paths, callouts and boolean shape operations.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `diagram`  | SmartArt (DiagramML), format-neutral: data model, layout/colour/quick-style parts, the cached `dsp:drawing` shape tree, relationship resolution and a loader. Used by `docx`; `pptx` re-imports its parsers.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `digest`   | Synchronous pure-TypeScript SHA-1, SHA-256, SHA-384 and SHA-512, ECMA-376 digest name normalisation (`SHA-512`, `SHA512`, `sha_512`, ...) and the agile password hash Office protection elements store (`hashPassword`, `verifyPasswordHash`). No Web Crypto, so it works on `http://`. Used by `xlsx` sheet and workbook protection.                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `crypto`   | ECMA-376 package encryption ([MS-OFFCRYPTO]) for every format: `decryptOoxmlPackage`, `encryptOoxmlPackage` (agile AES-256/SHA-512 by default, or Standard), `isEncryptedOoxmlPackage`, and typed errors with a `code` (`password-required`, `incorrect-password`, `data-integrity`). The compound-file container comes from ole2 (inlined); not in the root entry.                                                                                                                                                                                                                                                                                                                                                                                 |
+| `collab`   | Format-neutral real-time collaboration on Yjs: session and provider lifecycle, awareness/presence, transport-neutral sync (WebSocket, in-memory, any byte channel), update codecs, ordering helpers, asset sync and the product adapter seam. See `docs/collab-area.md`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `docx`     | WordprocessingML: model, parser, preserving serializer, editing, validation. Also `/docx/embedded`. `/docx/layout` is the DOM-free pagination engine (an approximation of Word, not parity) and `/docx/load` detects and loads DOCX (also password-protected, `{ password }`) and legacy .doc (ole2 inlined).                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `pptx`     | PresentationML: model, parser, serializer, editing, charts, SmartArt, converters, CLI, signatures. Subpaths `/pptx/converter`, `/pptx/cli`, `/pptx/signature-node`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `xlsx`     | SpreadsheetML: workbook model, `.xlsx`/`.xlsm` reader and preserving writer, formula engine (dependency graph, dynamic arrays, 380+ functions), Excel number formats, editing commands with undo, and the DOM-free grid layout (sizes, colours, conditional formats, charts as SVG, drawing anchors). SmartArt is shown from the cached drawing (not re-laid out) and kept verbatim on save. `/xlsx/load` detects and loads `.xlsx`, `.xlsm` (also password-protected: `loadWorkbook(bytes, { password })`, `saveWorkbook(workbook, 'xlsx', { password })`), legacy `.xls` (ole2 inlined) and CSV, and refuses `.xlsb` with a typed error. Digital signatures are detected and reported, never kept on save. An approximation of Excel, not parity. |
 
 Legacy binary formats (`.doc`, `.xls`, `.ppt`) and the compound-file container live in the sibling package [`ole2`](https://github.com/ChristopherVR/ole2); this package never contains binary codecs, and `ole2` never contains modern OOXML.
 

package/dist/crypto/aes-ecb.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AES-ECB over Web Crypto, which only offers CBC: the ECMA-376 Standard scheme ([MS-OFFCRYPTO]
+ * 2.3.4.7-2.3.4.9) encrypts the password verifier and the package with AES in ECB mode.
+ *
+ * Decryption runs one CBC pass with a zero IV and then undoes the chaining (block i was XORed
+ * with ciphertext block i - 1). Encryption encrypts each block on its own (CBC with a zero IV over
+ * one block is ECB), in parallel batches.
+ */
+/** AES-ECB decryption of block-aligned `data` (a trailing partial block is zero-padded). */
+export declare function aesEcbDecrypt(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+/** AES-ECB encryption of `data`, zero-padded to the block size. */
+export declare function aesEcbEncrypt(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=aes-ecb.d.ts.map

package/dist/crypto/aes-ecb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes-ecb.d.ts","sourceRoot":"","sources":["../../src/crypto/aes-ecb.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,4FAA4F;AAC5F,wBAAsB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAM1F;AAED,mEAAmE;AACnE,wBAAsB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAwB1F"}

package/dist/crypto/decrypt.d.ts

@@ -0,0 +1,63 @@
+/**
+ * OOXML package decryption: password verification and package decryption for the agile
+ * (Office 2010+) and Standard (Office 2007) encryption schemes.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-decrypt.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo, StandardEncryptionInfo } from './types.js';
+/**
+ * Verify the password against agile encryption info and return the
+ * decryption key if valid.
+ *
+ * @param info - Parsed agile encryption info.
+ * @param password - The password to verify.
+ * @returns The document encryption key, or null if the password is wrong.
+ */
+export declare function verifyAgilePassword(info: EncryptionInfo, password: string): Promise<Uint8Array | null>;
+/**
+ * Verify the password against standard encryption info and return the
+ * decryption key if valid.
+ *
+ * @param info - Parsed standard encryption info.
+ * @param password - The password to verify.
+ * @returns The encryption key, or null if the password is wrong.
+ */
+export declare function verifyStandardPassword(info: StandardEncryptionInfo, password: string): Promise<Uint8Array | null>;
+/**
+ * Verify the data integrity HMAC of an agile-encrypted package.
+ *
+ * [MS-OFFCRYPTO] 2.3.7.1 -- The data integrity is verified by:
+ * 1. Decrypting the HMAC key from dataIntegrity.encryptedHmacKey
+ * 2. Decrypting the HMAC value from dataIntegrity.encryptedHmacValue
+ * 3. Computing HMAC of the encrypted package data (after the 8-byte size prefix)
+ * 4. Comparing the computed HMAC with the decrypted HMAC value
+ *
+ * @param info - Parsed agile encryption info.
+ * @param key - The document encryption key.
+ * @param encryptedPackage - Raw bytes of the EncryptedPackage stream.
+ * @throws DataIntegrityError if the data integrity check fails.
+ */
+export declare function verifyAgileDataIntegrity(info: EncryptionInfo, key: Uint8Array, encryptedPackage: Uint8Array): Promise<void>;
+/**
+ * Decrypt the EncryptedPackage stream using the agile encryption key.
+ *
+ * The encrypted package uses segment-based encryption:
+ * each 4096-byte segment is encrypted separately with a unique IV.
+ *
+ * @param encryptedPackage - Raw bytes of the EncryptedPackage stream.
+ * @param key - The document encryption key.
+ * @param info - Parsed agile encryption info.
+ * @returns The decrypted package as an ArrayBuffer.
+ */
+export declare function decryptAgilePackage(encryptedPackage: Uint8Array, key: Uint8Array, info: EncryptionInfo): Promise<ArrayBuffer>;
+/**
+ * Decrypt the EncryptedPackage stream using standard encryption key.
+ *
+ * Standard encryption uses AES-ECB over the whole package ([MS-OFFCRYPTO] 2.3.4.15).
+ *
+ * @param encryptedPackage - Raw bytes of the EncryptedPackage stream.
+ * @param key - The encryption key.
+ * @returns The decrypted package as an ArrayBuffer.
+ */
+export declare function decryptStandardPackage(encryptedPackage: Uint8Array, key: Uint8Array): Promise<ArrayBuffer>;
+//# sourceMappingURL=decrypt.d.ts.map

package/dist/crypto/decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../src/crypto/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzE;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgC5B;AAMD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC3C,IAAI,EAAE,sBAAsB,EAC5B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA6B5B;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,UAAU,EACf,gBAAgB,EAAE,UAAU,GAC1B,OAAO,CAAC,IAAI,CAAC,CA0Df;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACxC,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,WAAW,CAAC,CAqCtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC3C,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,GACb,OAAO,CAAC,WAAW,CAAC,CAatB"}

package/dist/crypto/detect.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Recognises an encrypted OOXML package: a compound file (CFB, magic D0 CF 11 E0 A1 B1 1A E1)
+ * holding `EncryptionInfo` and `EncryptedPackage` streams, as opposed to a plain OOXML zip or a
+ * legacy binary document (.xls, .doc, .ppt), which is a compound file too.
+ *
+ * Moved from `src/pptx/core/utils/encryption-detection.ts` (see PROVENANCE.md);
+ * {@link isEncryptedOoxmlPackage} and {@link openEncryptedPackage} are new.
+ */
+/** Bytes as a Uint8Array (no copy). */
+export declare const toBytes: (input: Uint8Array | ArrayBuffer) => Uint8Array;
+/** An ArrayBuffer holding exactly `bytes` (copied only when it is a view of a larger buffer). */
+export declare function toArrayBuffer(bytes: Uint8Array): ArrayBuffer;
+/** Whether the bytes start with the compound-file magic. */
+export declare function isCompoundFile(input: Uint8Array | ArrayBuffer): boolean;
+/** The two streams of an encrypted package. */
+export interface EncryptedPackageStreams {
+    encryptionInfo: Uint8Array;
+    encryptedPackage: Uint8Array;
+}
+/**
+ * The `EncryptionInfo` and `EncryptedPackage` streams of an encrypted OOXML package, or
+ * `undefined` when the bytes are not a compound file or lack either stream (a legacy binary
+ * document). Never throws.
+ */
+export declare function openEncryptedPackage(input: Uint8Array | ArrayBuffer): EncryptedPackageStreams | undefined;
+/**
+ * Whether the bytes are an encrypted OOXML package (.xlsx, .docx, .pptx and their macro and
+ * template variants saved with a password to open). A legacy .xls/.doc/.ppt is `false`.
+ */
+export declare function isEncryptedOoxmlPackage(input: Uint8Array | ArrayBuffer): boolean;
+/** A coarse container sniff: zip, compound file (possibly an encrypted package) or unknown. */
+export type FileFormatDetection = {
+    format: 'zip';
+    encrypted: false;
+} | {
+    format: 'ole';
+    encrypted: true;
+} | {
+    format: 'unknown';
+    encrypted: false;
+};
+/**
+ * Detect the container format from the magic bytes. A compound file is reported as
+ * `encrypted` without opening it (use {@link isEncryptedOoxmlPackage} to tell an encrypted
+ * package from a legacy binary document). Must be called before parsing as a zip.
+ */
+export declare function detectFileFormat(data: ArrayBuffer | Uint8Array): FileFormatDetection;
+/**
+ * Thrown when an encrypted file is detected where a plain package was expected. Callers can
+ * check `isEncrypted` (or `instanceof`) to tell it from generic parse failures.
+ */
+export declare class EncryptedFileError extends Error {
+    readonly isEncrypted = true;
+    constructor(message: string);
+}
+//# sourceMappingURL=detect.d.ts.map

package/dist/crypto/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/crypto/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,uCAAuC;AACvC,eAAO,MAAM,OAAO,GAAI,OAAO,UAAU,GAAG,WAAW,KAAG,UACE,CAAC;AAE7D,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAK5D;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAGvE;AAED,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACvC,cAAc,EAAE,UAAU,CAAC;IAC3B,gBAAgB,EAAE,UAAU,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,UAAU,GAAG,WAAW,GAC7B,uBAAuB,GAAG,SAAS,CAarC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAShF;AAED,+FAA+F;AAC/F,MAAM,MAAM,mBAAmB,GAC5B;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,KAAK,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAAC;AAE3C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,mBAAmB,CAMpF;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,WAAW,QAAQ;gBAEhB,OAAO,EAAE,MAAM;CAIlC"}

package/dist/crypto/encrypt.d.ts

@@ -0,0 +1,27 @@
+/**
+ * OOXML package encryption: the agile scheme (Office 2010+, the default) and the ECMA-376
+ * Standard scheme (Office 2007), each producing a compound file with `EncryptionInfo` and
+ * `EncryptedPackage` streams.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-encrypt.ts` and the agile half of
+ * `ooxml-crypto.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo, EncryptionOptions } from './types.js';
+/**
+ * Encrypt a package with the agile scheme: each 4096-byte segment is encrypted separately with
+ * an IV derived from the segment index. Returns the bytes with the 8-byte size prefix.
+ */
+export declare function encryptAgilePackage(packageData: Uint8Array, key: Uint8Array, info: EncryptionInfo): Promise<Uint8Array>;
+/**
+ * Encrypt a package with the ECMA-376 Standard scheme: AES-ECB under the password-derived key
+ * ([MS-OFFCRYPTO] 2.3.4.15). Returns the bytes with the 8-byte size prefix.
+ */
+export declare function encryptStandardPackage(packageData: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+/** The agile scheme (AES-CBC, SHA-512, 100,000 spins by default) as a compound file. */
+export declare function encryptAgile(packageData: Uint8Array, password: string, options?: EncryptionOptions): Promise<Uint8Array>;
+/**
+ * The ECMA-376 Standard scheme (Office 2007-compatible) as a compound file. There is no
+ * separate document key: the password-derived key encrypts the whole package (AES-ECB).
+ */
+export declare function encryptStandard(packageData: Uint8Array, password: string, options?: EncryptionOptions): Promise<Uint8Array>;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/crypto/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../src/crypto/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwBH,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAoCpE;;;GAGG;AACH,wBAAsB,mBAAmB,CACxC,WAAW,EAAE,UAAU,EACvB,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,UAAU,CAAC,CAerB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC3C,WAAW,EAAE,UAAU,EACvB,GAAG,EAAE,UAAU,GACb,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED,wFAAwF;AACxF,wBAAsB,YAAY,CACjC,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgErB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACpC,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgBrB"}

package/dist/crypto/encryption-info-write.d.ts

@@ -0,0 +1,46 @@
+/**
+ * EncryptionInfo stream writers for the agile ([MS-OFFCRYPTO] 2.3.4.10) and Standard (2.3.4.5)
+ * schemes.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-encrypt.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo } from './types.js';
+/**
+ * Generate EncryptionInfo XML for agile encryption.
+ *
+ * Builds the XML document that describes the encryption parameters,
+ * key data, data integrity values, and password key encryptor.
+ *
+ * @param keyData - Key data parameters.
+ * @param pke - Password key encryptor parameters.
+ * @param dataIntegrity - Data integrity HMAC values.
+ * @returns Serialized XML string.
+ */
+export declare function buildAgileEncryptionInfoXml(keyData: EncryptionInfo['keyData'], pke: EncryptionInfo['passwordKeyEncryptor'], dataIntegrity: NonNullable<EncryptionInfo['dataIntegrity']>): string;
+/**
+ * Build the EncryptionInfo stream bytes for agile encryption.
+ *
+ * Prepends the 8-byte header (version 4.4 + reserved flag) to the
+ * XML content.
+ *
+ * @param xmlString - The agile encryption info XML string.
+ * @returns Raw bytes of the EncryptionInfo stream.
+ */
+export declare function buildEncryptionInfoStream(xmlString: string): Uint8Array;
+/** AlgIDHash value for SHA-1, the only hash the Standard scheme uses. */
+export declare const STANDARD_ALG_ID_HASH_SHA1 = 32772;
+/**
+ * Build the binary EncryptionInfo stream for the ECMA-376 Standard scheme.
+ *
+ * Layout per [MS-OFFCRYPTO] 2.3.4.5-2.3.4.7: version + flags + header size,
+ * followed by the EncryptionHeader (algorithm/provider) and the
+ * EncryptionVerifier (salt + encrypted verifier + encrypted verifier hash).
+ *
+ * @param keyBits - Key size in bits (128, 192, or 256).
+ * @param salt - 16-byte verifier salt.
+ * @param encryptedVerifier - 16-byte AES-CBC encrypted random verifier.
+ * @param encryptedVerifierHash - 32-byte AES-CBC encrypted (padded) SHA-1 hash of the verifier.
+ * @returns Raw bytes of the EncryptionInfo stream.
+ */
+export declare function buildStandardEncryptionInfoStream(keyBits: number, salt: Uint8Array, encryptedVerifier: Uint8Array, encryptedVerifierHash: Uint8Array): Uint8Array;
+//# sourceMappingURL=encryption-info-write.d.ts.map

package/dist/crypto/encryption-info-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-info-write.d.ts","sourceRoot":"","sources":["../../src/crypto/encryption-info-write.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,EAClC,GAAG,EAAE,cAAc,CAAC,sBAAsB,CAAC,EAC3C,aAAa,EAAE,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,GACzD,MAAM,CAoCR;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAavE;AASD,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAWpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,UAAU,EAChB,iBAAiB,EAAE,UAAU,EAC7B,qBAAqB,EAAE,UAAU,GAC/B,UAAU,CAgDZ"}

package/dist/crypto/encryption-info.d.ts

@@ -0,0 +1,22 @@
+/**
+ * EncryptionInfo stream parsing ([MS-OFFCRYPTO] 2.3.4.5 Standard, 2.3.4.10 agile).
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-key-derivation.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo, StandardEncryptionInfo } from './types.js';
+/**
+ * Algorithm ID for RC4 in the [MS-OFFCRYPTO] EncryptionHeader `algId` field.
+ *
+ * RC4 is a stream cipher, so its encrypted verifier hash is stored at exactly
+ * `verifierHashSize` bytes with no block-alignment padding, unlike AES (a block cipher, padded
+ * up to a 16-byte boundary).
+ */
+export declare const RC4_ALG_ID = 26625;
+/**
+ * Parse the EncryptionInfo stream of an encrypted OOXML file: agile (version 4.4) or Standard
+ * (versions 2.2, 3.2 and 4.2).
+ *
+ * @throws Error if the encryption version is unsupported.
+ */
+export declare function parseEncryptionInfo(data: Uint8Array): EncryptionInfo | StandardEncryptionInfo;
+//# sourceMappingURL=encryption-info.d.ts.map

package/dist/crypto/encryption-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-info.d.ts","sourceRoot":"","sources":["../../src/crypto/encryption-info.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAS,CAAC;AAEjC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,sBAAsB,CAa7F"}

package/dist/crypto/errors.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Errors of OOXML package encryption. Each carries a stable `code`: every subpath bundle
+ * (`ooxml-core/crypto`, `/xlsx/load`, `/docx/load`, `/pptx`) inlines its own copy of these
+ * classes, so a UI should test `error.code` (or `name`) rather than `instanceof` across entries.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-errors.ts` (see PROVENANCE.md); `code` and
+ * {@link PasswordRequiredError} are new.
+ */
+/** The stable codes of the package encryption errors. */
+export type OoxmlCryptoErrorCode = 'password-required' | 'incorrect-password' | 'data-integrity';
+/**
+ * The file is an encrypted OOXML package (a compound file holding `EncryptionInfo` and
+ * `EncryptedPackage`) and no password was supplied.
+ */
+export declare class PasswordRequiredError extends Error {
+    readonly code: "password-required";
+    constructor(message?: string);
+}
+/**
+ * The supplied password did not match the password verifier stored in the encrypted file's
+ * EncryptionInfo stream.
+ */
+export declare class IncorrectPasswordError extends Error {
+    readonly code: "incorrect-password";
+    constructor(message?: string);
+}
+/**
+ * The HMAC computed over the encrypted package did not match the one stored in the
+ * EncryptionInfo stream: the file may be corrupted or tampered with.
+ */
+export declare class DataIntegrityError extends Error {
+    readonly code: "data-integrity";
+    constructor(message?: string);
+}
+/** Whether `error` is one of the package encryption errors (by `code`, across bundles). */
+export declare function isOoxmlCryptoError(error: unknown): error is Error & {
+    readonly code: OoxmlCryptoErrorCode;
+};
+//# sourceMappingURL=errors.d.ts.map

package/dist/crypto/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/crypto/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,yDAAyD;AACzD,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;AAEjG;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,SAAgB,IAAI,EAAG,mBAAmB,CAAU;gBAEjC,OAAO,SAAoE;CAI9F;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,SAAgB,IAAI,EAAG,oBAAoB,CAAU;gBAElC,OAAO,SAA+B;CAIzD;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,IAAI,EAAG,gBAAgB,CAAU;gBAGhD,OAAO,SAAuF;CAK/F;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,OAAO,GACZ,KAAK,IAAI,KAAK,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAI1D"}