ooxml-core 0.9.0 → 0.11.0

package/dist/automation/node.cjs

@@ -0,0 +1,103 @@
+'use strict';
+
+var promises = require('fs/promises');
+var path = require('path');
+var crypto = require('crypto');
+
+// src/automation/node.ts
+function createFileOperations(rootDir = process.cwd()) {
+  const pending = /* @__PURE__ */ new Map();
+  const maxBytes = 64 * 1024 * 1024;
+  async function pathFor(file, extensions) {
+    const root = await promises.realpath(path.resolve(rootDir));
+    const path$1 = path.resolve(root, file);
+    const parent = await promises.realpath(path.dirname(path$1));
+    let actual = path.resolve(parent, path.basename(path$1));
+    const inside = (target) => {
+      const rel = path.relative(root, target);
+      if (rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || path.isAbsolute(rel))
+        throw new Error("Path is outside the configured root");
+    };
+    inside(actual);
+    try {
+      actual = await promises.realpath(actual);
+      inside(actual);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (!extensions.includes(path.extname(actual).toLowerCase()))
+      throw new Error("Unsupported file extension");
+    return actual;
+  }
+  async function read(path) {
+    const handle = await promises.open(path, "r");
+    try {
+      if ((await handle.stat()).size > maxBytes) throw new Error("File exceeds 64 MiB");
+      const bytes = await handle.readFile();
+      if (bytes.length > maxBytes) throw new Error("File exceeds 64 MiB");
+      return new Uint8Array(bytes);
+    } finally {
+      await handle.close();
+    }
+  }
+  async function write(path, bytes, replace) {
+    if (bytes.length > maxBytes) throw new Error("Output exceeds 64 MiB");
+    const temp = `${path}.${crypto.randomUUID()}.tmp`;
+    const handle = await promises.open(temp, "wx", 384);
+    try {
+      await handle.writeFile(bytes);
+      await handle.sync();
+    } catch (error) {
+      await handle.close();
+      await promises.unlink(temp).catch(() => {
+      });
+      throw error;
+    }
+    await handle.close();
+    try {
+      if (replace) await promises.rename(temp, path);
+      else await promises.link(temp, path);
+    } finally {
+      await promises.unlink(temp).catch(() => {
+      });
+    }
+  }
+  async function serial(path, action) {
+    if (process.platform === "win32") path = path.toLowerCase();
+    const before = pending.get(path) ?? Promise.resolve();
+    const current = before.catch(() => {
+    }).then(action);
+    pending.set(path, current);
+    try {
+      return await current;
+    } finally {
+      if (pending.get(path) === current) pending.delete(path);
+    }
+  }
+  return {
+    async inspect(file, extensions, inspect) {
+      const path = await pathFor(file, extensions);
+      return serial(path, async () => inspect(await read(path)));
+    },
+    async create(file, extensions, create) {
+      const path = await pathFor(file, extensions);
+      return serial(path, async () => {
+        await write(path, await create(), false);
+        return { filePath: path, saved: true };
+      });
+    },
+    async edit(file, extensions, edit, outputPath) {
+      const path$1 = await pathFor(file, extensions);
+      const output = outputPath ? await pathFor(outputPath, extensions) : path$1;
+      if (path.extname(output).toLowerCase() !== path.extname(path$1).toLowerCase())
+        throw new Error("Save-as must keep the source file extension");
+      return serial(path$1, async () => {
+        const { bytes, ...result } = await edit(await read(path$1));
+        await write(output, bytes, output === path$1);
+        return { ...result, filePath: output, saved: true };
+      });
+    }
+  };
+}
+
+exports.createFileOperations = createFileOperations;

package/dist/automation/node.d.ts

@@ -0,0 +1,16 @@
+export interface ByteEditResult {
+    bytes: Uint8Array;
+}
+/** Local filesystem boundary used by the repository-owned MCP adapters. */
+export declare function createFileOperations(rootDir?: string): {
+    inspect<T>(file: string, extensions: readonly string[], inspect: (bytes: Uint8Array) => Promise<T>): Promise<T>;
+    create(file: string, extensions: readonly string[], create: () => Promise<Uint8Array>): Promise<{
+        filePath: string;
+        saved: boolean;
+    }>;
+    edit<T extends ByteEditResult>(file: string, extensions: readonly string[], edit: (bytes: Uint8Array) => Promise<T>, outputPath?: string): Promise<Omit<T, "bytes"> & {
+        filePath: string;
+        saved: boolean;
+    }>;
+};
+//# sourceMappingURL=node.d.ts.map

package/dist/automation/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/automation/node.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,UAAU,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,OAAO,SAAgB;YAmE5C,CAAC,QACR,MAAM,cACA,SAAS,MAAM,EAAE,WACpB,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC;iBAKxB,MAAM,cAAc,SAAS,MAAM,EAAE,UAAU,MAAM,OAAO,CAAC,UAAU,CAAC;;;;SAOhF,CAAC,SAAS,cAAc,QAC5B,MAAM,cACA,SAAS,MAAM,EAAE,QACvB,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,eAC1B,MAAM;;;;EAarB"}

package/dist/automation/node.mjs

@@ -0,0 +1,101 @@
+import { realpath, open, unlink, rename, link } from 'fs/promises';
+import { extname, resolve, dirname, basename, relative, isAbsolute } from 'path';
+import { randomUUID } from 'crypto';
+
+// src/automation/node.ts
+function createFileOperations(rootDir = process.cwd()) {
+  const pending = /* @__PURE__ */ new Map();
+  const maxBytes = 64 * 1024 * 1024;
+  async function pathFor(file, extensions) {
+    const root = await realpath(resolve(rootDir));
+    const path = resolve(root, file);
+    const parent = await realpath(dirname(path));
+    let actual = resolve(parent, basename(path));
+    const inside = (target) => {
+      const rel = relative(root, target);
+      if (rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute(rel))
+        throw new Error("Path is outside the configured root");
+    };
+    inside(actual);
+    try {
+      actual = await realpath(actual);
+      inside(actual);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (!extensions.includes(extname(actual).toLowerCase()))
+      throw new Error("Unsupported file extension");
+    return actual;
+  }
+  async function read(path) {
+    const handle = await open(path, "r");
+    try {
+      if ((await handle.stat()).size > maxBytes) throw new Error("File exceeds 64 MiB");
+      const bytes = await handle.readFile();
+      if (bytes.length > maxBytes) throw new Error("File exceeds 64 MiB");
+      return new Uint8Array(bytes);
+    } finally {
+      await handle.close();
+    }
+  }
+  async function write(path, bytes, replace) {
+    if (bytes.length > maxBytes) throw new Error("Output exceeds 64 MiB");
+    const temp = `${path}.${randomUUID()}.tmp`;
+    const handle = await open(temp, "wx", 384);
+    try {
+      await handle.writeFile(bytes);
+      await handle.sync();
+    } catch (error) {
+      await handle.close();
+      await unlink(temp).catch(() => {
+      });
+      throw error;
+    }
+    await handle.close();
+    try {
+      if (replace) await rename(temp, path);
+      else await link(temp, path);
+    } finally {
+      await unlink(temp).catch(() => {
+      });
+    }
+  }
+  async function serial(path, action) {
+    if (process.platform === "win32") path = path.toLowerCase();
+    const before = pending.get(path) ?? Promise.resolve();
+    const current = before.catch(() => {
+    }).then(action);
+    pending.set(path, current);
+    try {
+      return await current;
+    } finally {
+      if (pending.get(path) === current) pending.delete(path);
+    }
+  }
+  return {
+    async inspect(file, extensions, inspect) {
+      const path = await pathFor(file, extensions);
+      return serial(path, async () => inspect(await read(path)));
+    },
+    async create(file, extensions, create) {
+      const path = await pathFor(file, extensions);
+      return serial(path, async () => {
+        await write(path, await create(), false);
+        return { filePath: path, saved: true };
+      });
+    },
+    async edit(file, extensions, edit, outputPath) {
+      const path = await pathFor(file, extensions);
+      const output = outputPath ? await pathFor(outputPath, extensions) : path;
+      if (extname(output).toLowerCase() !== extname(path).toLowerCase())
+        throw new Error("Save-as must keep the source file extension");
+      return serial(path, async () => {
+        const { bytes, ...result } = await edit(await read(path));
+        await write(output, bytes, output === path);
+        return { ...result, filePath: output, saved: true };
+      });
+    }
+  };
+}
+
+export { createFileOperations };

package/dist/automation/visio.d.ts

@@ -0,0 +1,30 @@
+import type { VisioShape } from '../visio/model.js';
+/** JSON-safe scene inspection without embedding binary images in tool responses. */
+export interface VisioShapeSummary {
+    id: string;
+    name: string;
+    kind: VisioShape['kind'];
+    width: number;
+    height: number;
+    transform: VisioShape['transform'];
+    text: string;
+    hidden: boolean;
+    shapeData: VisioShape['shapeData'];
+    hyperlinks: VisioShape['hyperlinks'];
+    children: VisioShapeSummary[];
+}
+export declare function inspectVisio(bytes: Uint8Array): Promise<{
+    pages: {
+        id: string;
+        name: string;
+        width: number;
+        height: number;
+        isBackground: boolean;
+        backgroundPageId: string | undefined;
+        shapes: VisioShapeSummary[];
+        connectors: import("../visio/model.js").VisioConnection[];
+        layers: import("../visio/model.js").VisioLayer[] | undefined;
+    }[];
+    diagnostics: import("../visio/model.js").VisioDiagnostic[];
+}>;
+//# sourceMappingURL=visio.d.ts.map

package/dist/automation/visio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visio.d.ts","sourceRoot":"","sources":["../../src/automation/visio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IACrC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAkBD,wBAAsB,YAAY,CAAC,KAAK,EAAE,UAAU;;;;;;;;;;;;;GAgBnD"}

package/dist/automation/xlsx.d.ts

@@ -0,0 +1,25 @@
+export declare function inspectXlsx(bytes: Uint8Array): Promise<{
+    sheets: {
+        index: number;
+        name: string;
+    }[];
+    properties: import("../xlsx/model.js").WorkbookProperties;
+    warnings: string[];
+}>;
+export declare function createXlsx(names: readonly string[]): Promise<Uint8Array>;
+export declare function readXlsxRange(bytes: Uint8Array, sheetIndex: number, reference: string): Promise<{
+    cells: {
+        address: string;
+        value: string | number | boolean | import("../xlsx/model.js").CellError | null;
+        formula: string | undefined;
+    }[];
+    warnings: string[];
+}>;
+export declare function setXlsxCells(bytes: Uint8Array, sheetIndex: number, cells: readonly {
+    address: string;
+    input: string;
+}[]): Promise<{
+    bytes: Uint8Array<ArrayBufferLike>;
+    warnings: string[];
+}>;
+//# sourceMappingURL=xlsx.d.ts.map

package/dist/automation/xlsx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xlsx.d.ts","sourceRoot":"","sources":["../../src/automation/xlsx.ts"],"names":[],"mappings":"AAOA,wBAAsB,WAAW,CAAC,KAAK,EAAE,UAAU;;;;;;;GAOlD;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAW9E;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;GAoB3F;AAED,wBAAsB,YAAY,CACjC,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE;;;GAgBpD"}

package/dist/crypto/aes-ecb.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AES-ECB over Web Crypto, which only offers CBC: the ECMA-376 Standard scheme ([MS-OFFCRYPTO]
+ * 2.3.4.7-2.3.4.9) encrypts the password verifier and the package with AES in ECB mode.
+ *
+ * Decryption runs one CBC pass with a zero IV and then undoes the chaining (block i was XORed
+ * with ciphertext block i - 1). Encryption encrypts each block on its own (CBC with a zero IV over
+ * one block is ECB), in parallel batches.
+ */
+/** AES-ECB decryption of block-aligned `data` (a trailing partial block is zero-padded). */
+export declare function aesEcbDecrypt(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+/** AES-ECB encryption of `data`, zero-padded to the block size. */
+export declare function aesEcbEncrypt(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=aes-ecb.d.ts.map

package/dist/crypto/aes-ecb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes-ecb.d.ts","sourceRoot":"","sources":["../../src/crypto/aes-ecb.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,4FAA4F;AAC5F,wBAAsB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAM1F;AAED,mEAAmE;AACnE,wBAAsB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAwB1F"}

package/dist/crypto/decrypt.d.ts

@@ -0,0 +1,63 @@
+/**
+ * OOXML package decryption: password verification and package decryption for the agile
+ * (Office 2010+) and Standard (Office 2007) encryption schemes.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-decrypt.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo, StandardEncryptionInfo } from './types.js';
+/**
+ * Verify the password against agile encryption info and return the
+ * decryption key if valid.
+ *
+ * @param info - Parsed agile encryption info.
+ * @param password - The password to verify.
+ * @returns The document encryption key, or null if the password is wrong.
+ */
+export declare function verifyAgilePassword(info: EncryptionInfo, password: string): Promise<Uint8Array | null>;
+/**
+ * Verify the password against standard encryption info and return the
+ * decryption key if valid.
+ *
+ * @param info - Parsed standard encryption info.
+ * @param password - The password to verify.
+ * @returns The encryption key, or null if the password is wrong.
+ */
+export declare function verifyStandardPassword(info: StandardEncryptionInfo, password: string): Promise<Uint8Array | null>;
+/**
+ * Verify the data integrity HMAC of an agile-encrypted package.
+ *
+ * [MS-OFFCRYPTO] 2.3.7.1 -- The data integrity is verified by:
+ * 1. Decrypting the HMAC key from dataIntegrity.encryptedHmacKey
+ * 2. Decrypting the HMAC value from dataIntegrity.encryptedHmacValue
+ * 3. Computing HMAC of the encrypted package data (after the 8-byte size prefix)
+ * 4. Comparing the computed HMAC with the decrypted HMAC value
+ *
+ * @param info - Parsed agile encryption info.
+ * @param key - The document encryption key.
+ * @param encryptedPackage - Raw bytes of the EncryptedPackage stream.
+ * @throws DataIntegrityError if the data integrity check fails.
+ */
+export declare function verifyAgileDataIntegrity(info: EncryptionInfo, key: Uint8Array, encryptedPackage: Uint8Array): Promise<void>;
+/**
+ * Decrypt the EncryptedPackage stream using the agile encryption key.
+ *
+ * The encrypted package uses segment-based encryption:
+ * each 4096-byte segment is encrypted separately with a unique IV.
+ *
+ * @param encryptedPackage - Raw bytes of the EncryptedPackage stream.
+ * @param key - The document encryption key.
+ * @param info - Parsed agile encryption info.
+ * @returns The decrypted package as an ArrayBuffer.
+ */
+export declare function decryptAgilePackage(encryptedPackage: Uint8Array, key: Uint8Array, info: EncryptionInfo): Promise<ArrayBuffer>;
+/**
+ * Decrypt the EncryptedPackage stream using standard encryption key.
+ *
+ * Standard encryption uses AES-ECB over the whole package ([MS-OFFCRYPTO] 2.3.4.15).
+ *
+ * @param encryptedPackage - Raw bytes of the EncryptedPackage stream.
+ * @param key - The encryption key.
+ * @returns The decrypted package as an ArrayBuffer.
+ */
+export declare function decryptStandardPackage(encryptedPackage: Uint8Array, key: Uint8Array): Promise<ArrayBuffer>;
+//# sourceMappingURL=decrypt.d.ts.map

package/dist/crypto/decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../src/crypto/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzE;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgC5B;AAMD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC3C,IAAI,EAAE,sBAAsB,EAC5B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA6B5B;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,UAAU,EACf,gBAAgB,EAAE,UAAU,GAC1B,OAAO,CAAC,IAAI,CAAC,CA0Df;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACxC,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,WAAW,CAAC,CAqCtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC3C,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,GACb,OAAO,CAAC,WAAW,CAAC,CAatB"}

package/dist/crypto/detect.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Recognises an encrypted OOXML package: a compound file (CFB, magic D0 CF 11 E0 A1 B1 1A E1)
+ * holding `EncryptionInfo` and `EncryptedPackage` streams, as opposed to a plain OOXML zip or a
+ * legacy binary document (.xls, .doc, .ppt), which is a compound file too.
+ *
+ * Moved from `src/pptx/core/utils/encryption-detection.ts` (see PROVENANCE.md);
+ * {@link isEncryptedOoxmlPackage} and {@link openEncryptedPackage} are new.
+ */
+/** Bytes as a Uint8Array (no copy). */
+export declare const toBytes: (input: Uint8Array | ArrayBuffer) => Uint8Array;
+/** An ArrayBuffer holding exactly `bytes` (copied only when it is a view of a larger buffer). */
+export declare function toArrayBuffer(bytes: Uint8Array): ArrayBuffer;
+/** Whether the bytes start with the compound-file magic. */
+export declare function isCompoundFile(input: Uint8Array | ArrayBuffer): boolean;
+/** The two streams of an encrypted package. */
+export interface EncryptedPackageStreams {
+    encryptionInfo: Uint8Array;
+    encryptedPackage: Uint8Array;
+}
+/**
+ * The `EncryptionInfo` and `EncryptedPackage` streams of an encrypted OOXML package, or
+ * `undefined` when the bytes are not a compound file or lack either stream (a legacy binary
+ * document). Never throws.
+ */
+export declare function openEncryptedPackage(input: Uint8Array | ArrayBuffer): EncryptedPackageStreams | undefined;
+/**
+ * Whether the bytes are an encrypted OOXML package (.xlsx, .docx, .pptx and their macro and
+ * template variants saved with a password to open). A legacy .xls/.doc/.ppt is `false`.
+ */
+export declare function isEncryptedOoxmlPackage(input: Uint8Array | ArrayBuffer): boolean;
+/** A coarse container sniff: zip, compound file (possibly an encrypted package) or unknown. */
+export type FileFormatDetection = {
+    format: 'zip';
+    encrypted: false;
+} | {
+    format: 'ole';
+    encrypted: true;
+} | {
+    format: 'unknown';
+    encrypted: false;
+};
+/**
+ * Detect the container format from the magic bytes. A compound file is reported as
+ * `encrypted` without opening it (use {@link isEncryptedOoxmlPackage} to tell an encrypted
+ * package from a legacy binary document). Must be called before parsing as a zip.
+ */
+export declare function detectFileFormat(data: ArrayBuffer | Uint8Array): FileFormatDetection;
+/**
+ * Thrown when an encrypted file is detected where a plain package was expected. Callers can
+ * check `isEncrypted` (or `instanceof`) to tell it from generic parse failures.
+ */
+export declare class EncryptedFileError extends Error {
+    readonly isEncrypted = true;
+    constructor(message: string);
+}
+//# sourceMappingURL=detect.d.ts.map

package/dist/crypto/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/crypto/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,uCAAuC;AACvC,eAAO,MAAM,OAAO,GAAI,OAAO,UAAU,GAAG,WAAW,KAAG,UACE,CAAC;AAE7D,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAK5D;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAGvE;AAED,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACvC,cAAc,EAAE,UAAU,CAAC;IAC3B,gBAAgB,EAAE,UAAU,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,UAAU,GAAG,WAAW,GAC7B,uBAAuB,GAAG,SAAS,CAarC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAShF;AAED,+FAA+F;AAC/F,MAAM,MAAM,mBAAmB,GAC5B;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,KAAK,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAAC;AAE3C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,mBAAmB,CAMpF;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,WAAW,QAAQ;gBAEhB,OAAO,EAAE,MAAM;CAIlC"}

package/dist/crypto/encrypt.d.ts

@@ -0,0 +1,27 @@
+/**
+ * OOXML package encryption: the agile scheme (Office 2010+, the default) and the ECMA-376
+ * Standard scheme (Office 2007), each producing a compound file with `EncryptionInfo` and
+ * `EncryptedPackage` streams.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-encrypt.ts` and the agile half of
+ * `ooxml-crypto.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo, EncryptionOptions } from './types.js';
+/**
+ * Encrypt a package with the agile scheme: each 4096-byte segment is encrypted separately with
+ * an IV derived from the segment index. Returns the bytes with the 8-byte size prefix.
+ */
+export declare function encryptAgilePackage(packageData: Uint8Array, key: Uint8Array, info: EncryptionInfo): Promise<Uint8Array>;
+/**
+ * Encrypt a package with the ECMA-376 Standard scheme: AES-ECB under the password-derived key
+ * ([MS-OFFCRYPTO] 2.3.4.15). Returns the bytes with the 8-byte size prefix.
+ */
+export declare function encryptStandardPackage(packageData: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+/** The agile scheme (AES-CBC, SHA-512, 100,000 spins by default) as a compound file. */
+export declare function encryptAgile(packageData: Uint8Array, password: string, options?: EncryptionOptions): Promise<Uint8Array>;
+/**
+ * The ECMA-376 Standard scheme (Office 2007-compatible) as a compound file. There is no
+ * separate document key: the password-derived key encrypts the whole package (AES-ECB).
+ */
+export declare function encryptStandard(packageData: Uint8Array, password: string, options?: EncryptionOptions): Promise<Uint8Array>;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/crypto/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../src/crypto/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwBH,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAoCpE;;;GAGG;AACH,wBAAsB,mBAAmB,CACxC,WAAW,EAAE,UAAU,EACvB,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,UAAU,CAAC,CAerB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC3C,WAAW,EAAE,UAAU,EACvB,GAAG,EAAE,UAAU,GACb,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED,wFAAwF;AACxF,wBAAsB,YAAY,CACjC,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgErB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACpC,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgBrB"}

package/dist/crypto/encryption-info-write.d.ts

@@ -0,0 +1,46 @@
+/**
+ * EncryptionInfo stream writers for the agile ([MS-OFFCRYPTO] 2.3.4.10) and Standard (2.3.4.5)
+ * schemes.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-encrypt.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo } from './types.js';
+/**
+ * Generate EncryptionInfo XML for agile encryption.
+ *
+ * Builds the XML document that describes the encryption parameters,
+ * key data, data integrity values, and password key encryptor.
+ *
+ * @param keyData - Key data parameters.
+ * @param pke - Password key encryptor parameters.
+ * @param dataIntegrity - Data integrity HMAC values.
+ * @returns Serialized XML string.
+ */
+export declare function buildAgileEncryptionInfoXml(keyData: EncryptionInfo['keyData'], pke: EncryptionInfo['passwordKeyEncryptor'], dataIntegrity: NonNullable<EncryptionInfo['dataIntegrity']>): string;
+/**
+ * Build the EncryptionInfo stream bytes for agile encryption.
+ *
+ * Prepends the 8-byte header (version 4.4 + reserved flag) to the
+ * XML content.
+ *
+ * @param xmlString - The agile encryption info XML string.
+ * @returns Raw bytes of the EncryptionInfo stream.
+ */
+export declare function buildEncryptionInfoStream(xmlString: string): Uint8Array;
+/** AlgIDHash value for SHA-1, the only hash the Standard scheme uses. */
+export declare const STANDARD_ALG_ID_HASH_SHA1 = 32772;
+/**
+ * Build the binary EncryptionInfo stream for the ECMA-376 Standard scheme.
+ *
+ * Layout per [MS-OFFCRYPTO] 2.3.4.5-2.3.4.7: version + flags + header size,
+ * followed by the EncryptionHeader (algorithm/provider) and the
+ * EncryptionVerifier (salt + encrypted verifier + encrypted verifier hash).
+ *
+ * @param keyBits - Key size in bits (128, 192, or 256).
+ * @param salt - 16-byte verifier salt.
+ * @param encryptedVerifier - 16-byte AES-CBC encrypted random verifier.
+ * @param encryptedVerifierHash - 32-byte AES-CBC encrypted (padded) SHA-1 hash of the verifier.
+ * @returns Raw bytes of the EncryptionInfo stream.
+ */
+export declare function buildStandardEncryptionInfoStream(keyBits: number, salt: Uint8Array, encryptedVerifier: Uint8Array, encryptedVerifierHash: Uint8Array): Uint8Array;
+//# sourceMappingURL=encryption-info-write.d.ts.map

package/dist/crypto/encryption-info-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-info-write.d.ts","sourceRoot":"","sources":["../../src/crypto/encryption-info-write.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,EAClC,GAAG,EAAE,cAAc,CAAC,sBAAsB,CAAC,EAC3C,aAAa,EAAE,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,GACzD,MAAM,CAoCR;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAavE;AASD,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAWpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,UAAU,EAChB,iBAAiB,EAAE,UAAU,EAC7B,qBAAqB,EAAE,UAAU,GAC/B,UAAU,CAgDZ"}

package/dist/crypto/encryption-info.d.ts

@@ -0,0 +1,22 @@
+/**
+ * EncryptionInfo stream parsing ([MS-OFFCRYPTO] 2.3.4.5 Standard, 2.3.4.10 agile).
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-key-derivation.ts` (see PROVENANCE.md).
+ */
+import type { EncryptionInfo, StandardEncryptionInfo } from './types.js';
+/**
+ * Algorithm ID for RC4 in the [MS-OFFCRYPTO] EncryptionHeader `algId` field.
+ *
+ * RC4 is a stream cipher, so its encrypted verifier hash is stored at exactly
+ * `verifierHashSize` bytes with no block-alignment padding, unlike AES (a block cipher, padded
+ * up to a 16-byte boundary).
+ */
+export declare const RC4_ALG_ID = 26625;
+/**
+ * Parse the EncryptionInfo stream of an encrypted OOXML file: agile (version 4.4) or Standard
+ * (versions 2.2, 3.2 and 4.2).
+ *
+ * @throws Error if the encryption version is unsupported.
+ */
+export declare function parseEncryptionInfo(data: Uint8Array): EncryptionInfo | StandardEncryptionInfo;
+//# sourceMappingURL=encryption-info.d.ts.map

package/dist/crypto/encryption-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-info.d.ts","sourceRoot":"","sources":["../../src/crypto/encryption-info.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAS,CAAC;AAEjC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,sBAAsB,CAa7F"}

package/dist/crypto/errors.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Errors of OOXML package encryption. Each carries a stable `code`: every subpath bundle
+ * (`ooxml-core/crypto`, `/xlsx/load`, `/docx/load`, `/pptx`) inlines its own copy of these
+ * classes, so a UI should test `error.code` (or `name`) rather than `instanceof` across entries.
+ *
+ * Moved from `src/pptx/core/utils/ooxml-crypto-errors.ts` (see PROVENANCE.md); `code` and
+ * {@link PasswordRequiredError} are new.
+ */
+/** The stable codes of the package encryption errors. */
+export type OoxmlCryptoErrorCode = 'password-required' | 'incorrect-password' | 'data-integrity';
+/**
+ * The file is an encrypted OOXML package (a compound file holding `EncryptionInfo` and
+ * `EncryptedPackage`) and no password was supplied.
+ */
+export declare class PasswordRequiredError extends Error {
+    readonly code: "password-required";
+    constructor(message?: string);
+}
+/**
+ * The supplied password did not match the password verifier stored in the encrypted file's
+ * EncryptionInfo stream.
+ */
+export declare class IncorrectPasswordError extends Error {
+    readonly code: "incorrect-password";
+    constructor(message?: string);
+}
+/**
+ * The HMAC computed over the encrypted package did not match the one stored in the
+ * EncryptionInfo stream: the file may be corrupted or tampered with.
+ */
+export declare class DataIntegrityError extends Error {
+    readonly code: "data-integrity";
+    constructor(message?: string);
+}
+/** Whether `error` is one of the package encryption errors (by `code`, across bundles). */
+export declare function isOoxmlCryptoError(error: unknown): error is Error & {
+    readonly code: OoxmlCryptoErrorCode;
+};
+//# sourceMappingURL=errors.d.ts.map

package/dist/crypto/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/crypto/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,yDAAyD;AACzD,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;AAEjG;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,SAAgB,IAAI,EAAG,mBAAmB,CAAU;gBAEjC,OAAO,SAAoE;CAI9F;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,SAAgB,IAAI,EAAG,oBAAoB,CAAU;gBAElC,OAAO,SAA+B;CAIzD;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,IAAI,EAAG,gBAAgB,CAAU;gBAGhD,OAAO,SAAuF;CAK/F;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,OAAO,GACZ,KAAK,IAAI,KAAK,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAI1D"}