feat: extract complete multi-cabinet sets

src/onenote/onepkg/cabinet-set.test.ts

@@ -0,0 +1,222 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+import { extractCabinet } from './cabinet.js';
+import { extractCabinetSet } from './cabinet-set.js';
+import { openOneNotePackageSet } from './package.js';
+import type { CabSetPart } from './types.js';
+
+const FIXTURE_HASHES = [
+  '3658aaf68b0d538a5b321919f1de3eb1bcc258cba44e97b07a1938230995c632',
+  'ce5fac4470fb850ae593de70ab03d3493069b77f8f81376216768bbf74e52321',
+  'e58b57f63ac0858effa75ceb6f242b447fbce6a910d3840c37228fdbc9e7bc95',
+  'fbcd45e503c3cffd5f5946ccc45bbc46b9884fe47abef7d09247154c7f8148fb',
+  '16ebbb274c8dc09f98415795212683b9ea8b2d6450080a79ab63cd5cdbac7cc4',
+] as const;
+
+function fixturePart(index: number): CabSetPart {
+  const encoded = readFileSync(
+    resolve(
+      process.cwd(),
+      `tests/fixtures/libmspack-multi-basic-pt${index}.cab.b64`
+    ),
+    'utf8'
+  );
+  const bytes = Uint8Array.from(
+    Buffer.from(encoded.replaceAll(/\s/gu, ''), 'base64')
+  );
+  expect(createHash('sha256').update(bytes).digest('hex')).toBe(
+    FIXTURE_HASHES[index - 1]
+  );
+  return { fileName: `cabd_multi_basic_pt${index}.cab`, bytes };
+}
+
+function fixtureSet(): CabSetPart[] {
+  return [1, 2, 3, 4, 5].map(fixturePart);
+}
+
+function mutateU16(
+  part: CabSetPart,
+  offset: number,
+  value: number
+): CabSetPart {
+  const bytes = part.bytes.slice();
+  new DataView(bytes.buffer).setUint16(offset, value, true);
+  return { ...part, bytes };
+}
+
+function withEmptyReserveLayout(part: CabSetPart): CabSetPart {
+  const original = part.bytes;
+  const insertAt = 36;
+  const addedBytes = 4;
+  const bytes = new Uint8Array(original.length + addedBytes);
+  bytes.set(original.subarray(0, insertAt));
+  bytes.set(original.subarray(insertAt), insertAt + addedBytes);
+  const view = new DataView(bytes.buffer);
+  view.setUint32(8, original.length + addedBytes, true);
+  view.setUint32(
+    16,
+    new DataView(original.buffer, original.byteOffset).getUint32(16, true) +
+      addedBytes,
+    true
+  );
+  view.setUint16(
+    30,
+    new DataView(original.buffer, original.byteOffset).getUint16(30, true) |
+      0x0004,
+    true
+  );
+  // cbCFHeader, cbCFFolder, and cbCFData are all zero.
+  bytes.fill(0, insertAt, insertAt + addedBytes);
+  // This fixture's only CFFOLDER begins at 0x8e before insertion.
+  view.setUint32(
+    0x8e + addedBytes,
+    new DataView(original.buffer, original.byteOffset).getUint32(0x8e, true) +
+      addedBytes,
+    true
+  );
+  return { ...part, bytes };
+}
+
+function expectedPart(index: number): string {
+  return `This is the data from cabinet part ${index}.\n`;
+}
+
+describe('multi-cabinet sets', () => {
+  it('sorts and extracts the pinned five-part libmspack split block', async () => {
+    const shuffled = fixtureSet();
+    [shuffled[0], shuffled[1], shuffled[2], shuffled[3], shuffled[4]] = [
+      shuffled[3]!,
+      shuffled[0]!,
+      shuffled[4]!,
+      shuffled[1]!,
+      shuffled[2]!,
+    ];
+    const result = await extractCabinetSet(shuffled);
+
+    expect(result.cabinetSetId).toBe(12_345);
+    expect(result.parts.map((part) => part.cabinetSetIndex)).toEqual([
+      0, 1, 2, 3, 4,
+    ]);
+    expect(result.folders).toEqual([
+      expect.objectContaining({
+        index: 0,
+        dataBlockCount: 1,
+        compressedSize: 190,
+        uncompressedSize: 190,
+        compression: expect.objectContaining({ kind: 'none' }),
+      }),
+    ]);
+    expect(result.entries.map((entry) => entry.normalizedPath)).toEqual([
+      'test1.txt',
+      'test2.txt',
+      'test3.txt',
+    ]);
+    expect(
+      result.extractedEntries.map((entry) =>
+        new TextDecoder().decode(entry.bytes)
+      )
+    ).toEqual([
+      expectedPart(1) + expectedPart(2),
+      expectedPart(3),
+      expectedPart(4) + expectedPart(5),
+    ]);
+  });
+
+  it('retains the single-cabinet API rejection for a spanning part', async () => {
+    await expect(extractCabinet(fixturePart(1).bytes)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-multipart-unsupported' },
+    });
+  });
+
+  it('rejects incomplete, misnamed, and mixed-ID cabinet selections', async () => {
+    const missing = fixtureSet();
+    missing.splice(2, 1);
+    await expect(extractCabinetSet(missing)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-set-index-gap' },
+    });
+
+    const misnamed = fixtureSet();
+    misnamed[2] = { ...misnamed[2]!, fileName: 'wrong-name.cab' };
+    await expect(extractCabinetSet(misnamed)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-set-link-name-mismatch' },
+    });
+
+    const mixed = fixtureSet();
+    mixed[2] = mutateU16(mixed[2]!, 32, 12_346);
+    await expect(extractCabinetSet(mixed)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-set-id-mismatch' },
+    });
+  });
+
+  it('rejects compression and spanning-record discontinuities', async () => {
+    const compression = fixtureSet();
+    // Part 3's CFFOLDER begins at 0x8e; typeCompress is at +6.
+    compression[2] = mutateU16(compression[2]!, 0x94, 1);
+    await expect(extractCabinetSet(compression)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-set-compression-mismatch' },
+    });
+
+    const records = fixtureSet();
+    // Part 3's first CFFILE cbFile begins at 0x96.
+    records[2] = mutateU16(records[2]!, 0x96, 75);
+    await expect(extractCabinetSet(records)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-set-file-continuation-mismatch' },
+    });
+
+    const reserve = fixtureSet();
+    reserve[2] = withEmptyReserveLayout(reserve[2]!);
+    await expect(extractCabinetSet(reserve)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-set-reserve-layout-mismatch' },
+    });
+
+    const incompleteBlock = fixtureSet();
+    // Part 5's last CFDATA cbUncomp is at 0xb5.
+    incompleteBlock[4] = mutateU16(incompleteBlock[4]!, 0xb5, 0);
+    await expect(extractCabinetSet(incompleteBlock)).rejects.toMatchObject({
+      diagnostic: { code: 'cab-invalid-split-data-block' },
+    });
+  });
+
+  it('opens the complete set through the package API', async () => {
+    const parts = fixtureSet();
+    const result = await openOneNotePackageSet(parts, {
+      sourceName: 'multi.onepkg',
+    });
+    expect(result.package).toMatchObject({
+      format: 'onepkg',
+      sourceName: 'multi.onepkg',
+      sourceSize: parts.reduce((sum, part) => sum + part.bytes.byteLength, 0),
+      entries: [
+        { path: 'test1.txt', kind: 'other' },
+        { path: 'test2.txt', kind: 'other' },
+        { path: 'test3.txt', kind: 'other' },
+      ],
+      sections: [],
+    });
+  });
+
+  it('enforces aggregate set, part, file, and cancellation limits', async () => {
+    await expect(
+      extractCabinetSet(fixtureSet(), {
+        limits: { maxCabinetSetBytes: 1_000 },
+      })
+    ).rejects.toMatchObject({ diagnostic: { code: 'cab-set-input-limit' } });
+    await expect(
+      extractCabinetSet(fixtureSet(), { limits: { maxCabinetParts: 4 } })
+    ).rejects.toMatchObject({
+      diagnostic: { code: 'cab-set-part-count-limit' },
+    });
+    await expect(
+      extractCabinetSet(fixtureSet(), { limits: { maxFiles: 2 } })
+    ).rejects.toMatchObject({ diagnostic: { code: 'cab-entry-count-limit' } });
+    await expect(
+      extractCabinetSet(fixtureSet(), {
+        cancellation: { isCancelled: () => true },
+      })
+    ).rejects.toMatchObject({ diagnostic: { code: 'onepkg-cancelled' } });
+  });
+});

src/onenote/onepkg/cabinet-set.ts

@@ -0,0 +1,860 @@
+/*
+ * SPDX-License-Identifier: LGPL-2.1-only
+ *
+ * Multi-cabinet folder/file merging follows libmspack `mspack/cabd.c` at
+ * commit 55d501976171397ccd5d5a7a1ca7da065b1d9a06.
+ * Copyright (C) 2003-2017 Stuart Caie, LGPL-2.1.
+ *
+ * Modified for immutable named browser inputs, strict complete-set/link and
+ * reserve validation, exact spanning-file records, aggregate limits, and the
+ * existing bounded TypeScript CAB decoders.
+ */
+
+import { checkCancellation, yieldForCancellation } from './cancellation.js';
+import {
+  FOLDER_CONTINUED_FROM_PREVIOUS,
+  FOLDER_CONTINUED_PREVIOUS_AND_NEXT,
+  FOLDER_CONTINUED_TO_NEXT,
+  FLAG_RESERVE_PRESENT,
+  parseCabinetInternal,
+  verifyDataBlockChecksumInternal,
+  type CabDataBlockInternal,
+  type CabFileRecordInternal,
+  type CabFolderInternal,
+  type ParsedCabinetInternal,
+} from './cabinet.js';
+import { fail } from './errors.js';
+import { LzxDecoder } from './lzx/decoder.js';
+import { MsZipDecoder } from './mszip/decoder.js';
+import { QuantumDecoder } from './quantum/decoder.js';
+import {
+  resolveLimits,
+  type CabCompressionMethod,
+  type CabFileEntry,
+  type CabFolderSummary,
+  type CabOpenOptions,
+  type CabSetExtractionResult,
+  type CabSetPart,
+  type ExtractedCabFile,
+  type OnePkgLimits,
+} from './types.js';
+
+const MAX_CAB_BLOCK_OUTPUT = 32 * 1024;
+const MAX_CAB_BLOCK_INPUT = MAX_CAB_BLOCK_OUTPUT + 6 * 1024;
+const MAX_MSZIP_BLOCK_INPUT = MAX_CAB_BLOCK_OUTPUT + 12;
+
+interface NamedCabinet {
+  fileName: string;
+  nameKey: string;
+  parsed: ParsedCabinetInternal;
+}
+
+interface LogicalBlock {
+  fragments: CabDataBlockInternal[];
+  compressedSize: number;
+  uncompressedSize: number;
+}
+
+interface LogicalFolder {
+  index: number;
+  compression: CabCompressionMethod;
+  segments: Array<{ cabinet: NamedCabinet; folder: CabFolderInternal }>;
+  blocks: LogicalBlock[];
+  compressedSize: number;
+  uncompressedSize: number;
+}
+
+interface LogicalCabinetSet {
+  cabinets: NamedCabinet[];
+  limits: OnePkgLimits;
+  cabinetSetId: number;
+  declaredSize: number;
+  folders: LogicalFolder[];
+  entries: CabFileEntry[];
+  diagnostics: ParsedCabinetInternal['result']['diagnostics'];
+}
+
+function checkedAdd(
+  left: number,
+  right: number,
+  code: string,
+  structure: string
+): number {
+  const sum = left + right;
+  if (!Number.isSafeInteger(sum)) {
+    fail(code, `Integer overflow while reading ${structure}.`, { structure });
+  }
+  return sum;
+}
+
+function bytesEqual(left: Uint8Array, right: Uint8Array): boolean {
+  return (
+    left.length === right.length &&
+    left.every((value, index) => value === right[index])
+  );
+}
+
+function cabinetNameKey(value: string, structure: string): string {
+  const normalized = value.normalize('NFC');
+  if (
+    normalized.length === 0 ||
+    normalized.length > 255 ||
+    normalized.includes('/') ||
+    normalized.includes('\\') ||
+    [...normalized].some((character) => {
+      const codePoint = character.codePointAt(0)!;
+      return codePoint <= 0x1f || codePoint === 0x7f;
+    })
+  ) {
+    fail('cab-set-invalid-part-name', `Unsafe cabinet part name: ${value}`, {
+      structure,
+    });
+  }
+  return normalized.toLocaleLowerCase('en-US');
+}
+
+function isContinuedFromPrevious(record: CabFileRecordInternal): boolean {
+  return (
+    record.rawFolderIndex === FOLDER_CONTINUED_FROM_PREVIOUS ||
+    record.rawFolderIndex === FOLDER_CONTINUED_PREVIOUS_AND_NEXT
+  );
+}
+
+function isContinuedToNext(record: CabFileRecordInternal): boolean {
+  return (
+    record.rawFolderIndex === FOLDER_CONTINUED_TO_NEXT ||
+    record.rawFolderIndex === FOLDER_CONTINUED_PREVIOUS_AND_NEXT
+  );
+}
+
+function sameSpanningFile(
+  left: CabFileRecordInternal,
+  right: CabFileRecordInternal
+): boolean {
+  return (
+    left.duplicateKey === right.duplicateKey &&
+    left.entry.normalizedPath === right.entry.normalizedPath &&
+    left.entry.uncompressedOffset === right.entry.uncompressedOffset &&
+    left.entry.uncompressedSize === right.entry.uncompressedSize &&
+    left.entry.attributes === right.entry.attributes &&
+    left.date === right.date &&
+    left.time === right.time
+  );
+}
+
+function validateBoundary(left: NamedCabinet, right: NamedCabinet): boolean {
+  const leftRecords = left.parsed.fileRecords.filter(isContinuedToNext);
+  const rightRecords = right.parsed.fileRecords.filter(isContinuedFromPrevious);
+  if ((leftRecords.length === 0) !== (rightRecords.length === 0)) {
+    fail(
+      'cab-set-folder-continuation-mismatch',
+      'Adjacent cabinets disagree about a continued folder.',
+      { structure: 'CFFILE.iFolder' }
+    );
+  }
+  if (leftRecords.length === 0) return false;
+  if (leftRecords.length !== rightRecords.length) {
+    fail(
+      'cab-set-file-continuation-mismatch',
+      'Adjacent cabinets list different numbers of spanning files.',
+      { structure: 'CFFILE' }
+    );
+  }
+  for (let index = 0; index < leftRecords.length; index += 1) {
+    if (!sameSpanningFile(leftRecords[index]!, rightRecords[index]!)) {
+      fail(
+        'cab-set-file-continuation-mismatch',
+        'Adjacent cabinets contain inconsistent spanning-file records.',
+        { structure: `CFFILE[${index}]` }
+      );
+    }
+  }
+
+  const leftFolder = left.parsed.folders.at(-1);
+  const rightFolder = right.parsed.folders[0];
+  if (!leftFolder || !rightFolder) {
+    fail(
+      'cab-set-folder-continuation-mismatch',
+      'A continued cabinet boundary is missing its folder segment.',
+      { structure: 'CFFOLDER' }
+    );
+  }
+  if (leftFolder.compression.raw !== rightFolder.compression.raw) {
+    fail(
+      'cab-set-compression-mismatch',
+      'Continued folder segments use different compression settings.',
+      { structure: 'CFFOLDER.typeCompress' }
+    );
+  }
+  if (!bytesEqual(leftFolder.reserve, rightFolder.reserve)) {
+    fail(
+      'cab-set-folder-reserve-mismatch',
+      'Continued folder segments have different reserved metadata.',
+      { structure: 'CFFOLDER.abReserve' }
+    );
+  }
+  return true;
+}
+
+function validateNamedCabinets(
+  parts: CabSetPart[],
+  options: CabOpenOptions,
+  limits: OnePkgLimits
+): NamedCabinet[] {
+  if (parts.length === 0) {
+    fail('cab-set-empty', 'At least one cabinet part is required.', {
+      structure: 'cabinet set',
+    });
+  }
+  if (parts.length > limits.maxCabinetParts) {
+    fail(
+      'cab-set-part-count-limit',
+      `Cabinet set has ${parts.length} parts; configured limit is ${limits.maxCabinetParts}.`,
+      { structure: 'cabinet set' }
+    );
+  }
+
+  let totalBytes = 0;
+  const seenNames = new Set<string>();
+  const cabinets = parts.map((part, inputIndex) => {
+    if (!(part.bytes instanceof Uint8Array)) {
+      throw new TypeError('Every CAB set part must contain Uint8Array bytes');
+    }
+    const nameKey = cabinetNameKey(
+      part.fileName,
+      `cabinet set part ${inputIndex}`
+    );
+    if (seenNames.has(nameKey)) {
+      fail(
+        'cab-set-duplicate-part-name',
+        `Cabinet part name is duplicated: ${part.fileName}`,
+        { structure: 'cabinet set' }
+      );
+    }
+    seenNames.add(nameKey);
+    totalBytes = checkedAdd(
+      totalBytes,
+      part.bytes.byteLength,
+      'cab-set-size-overflow',
+      'cabinet set bytes'
+    );
+    if (totalBytes > limits.maxCabinetSetBytes) {
+      fail(
+        'cab-set-input-limit',
+        `Cabinet set exceeds the configured ${limits.maxCabinetSetBytes}-byte input limit.`,
+        { structure: 'cabinet set' }
+      );
+    }
+    checkCancellation(options.cancellation);
+    return {
+      fileName: part.fileName.normalize('NFC'),
+      nameKey,
+      parsed: parseCabinetInternal(part.bytes, { ...options, limits }, true),
+    };
+  });
+
+  cabinets.sort(
+    (left, right) =>
+      left.parsed.result.cabinetSetIndex - right.parsed.result.cabinetSetIndex
+  );
+  const setId = cabinets[0]!.parsed.result.cabinetSetId;
+  const reserveTemplate = cabinets[0]!.parsed;
+  for (let index = 0; index < cabinets.length; index += 1) {
+    const cabinet = cabinets[index]!;
+    const parsed = cabinet.parsed;
+    if (parsed.result.cabinetSetId !== setId) {
+      fail(
+        'cab-set-id-mismatch',
+        'Selected cabinet parts do not share one setID.',
+        { structure: 'CFHEADER.setID' }
+      );
+    }
+    if (parsed.result.cabinetSetIndex !== index) {
+      fail(
+        'cab-set-index-gap',
+        `Expected cabinet index ${index}, found ${parsed.result.cabinetSetIndex}.`,
+        { structure: 'CFHEADER.iCabinet' }
+      );
+    }
+    if (
+      (parsed.flags & FLAG_RESERVE_PRESENT) !==
+        (reserveTemplate.flags & FLAG_RESERVE_PRESENT) ||
+      parsed.headerReserveSize !== reserveTemplate.headerReserveSize ||
+      parsed.folderReserveSize !== reserveTemplate.folderReserveSize ||
+      parsed.dataReserveSize !== reserveTemplate.dataReserveSize
+    ) {
+      fail(
+        'cab-set-reserve-layout-mismatch',
+        'Cabinet parts use inconsistent reserve-area layouts.',
+        { structure: 'CFHEADER reserve sizes' }
+      );
+    }
+  }
+
+  for (let index = 0; index < cabinets.length; index += 1) {
+    const cabinet = cabinets[index]!;
+    const parsed = cabinet.parsed;
+    const previous = cabinets[index - 1];
+    const next = cabinets[index + 1];
+    if (previous === undefined) {
+      if (parsed.previousCabinetName !== undefined) {
+        fail(
+          'cab-set-incomplete',
+          'The first selected cabinet refers to a missing previous part.',
+          { structure: 'CFHEADER.szCabinetPrev' }
+        );
+      }
+    } else {
+      if (
+        parsed.previousCabinetName === undefined ||
+        cabinetNameKey(parsed.previousCabinetName, 'CFHEADER.szCabinetPrev') !==
+          previous.nameKey
+      ) {
+        fail(
+          'cab-set-link-name-mismatch',
+          `Cabinet ${cabinet.fileName} does not name ${previous.fileName} as its previous part.`,
+          { structure: 'CFHEADER.szCabinetPrev' }
+        );
+      }
+    }
+    if (next === undefined) {
+      if (parsed.nextCabinetName !== undefined) {
+        fail(
+          'cab-set-incomplete',
+          'The last selected cabinet refers to a missing next part.',
+          { structure: 'CFHEADER.szCabinetNext' }
+        );
+      }
+    } else if (
+      parsed.nextCabinetName === undefined ||
+      cabinetNameKey(parsed.nextCabinetName, 'CFHEADER.szCabinetNext') !==
+        next.nameKey
+    ) {
+      fail(
+        'cab-set-link-name-mismatch',
+        `Cabinet ${cabinet.fileName} does not name ${next.fileName} as its next part.`,
+        { structure: 'CFHEADER.szCabinetNext' }
+      );
+    }
+  }
+  return cabinets;
+}
+
+function buildLogicalFolders(
+  cabinets: NamedCabinet[],
+  limits: OnePkgLimits,
+  options: CabOpenOptions
+): {
+  folders: LogicalFolder[];
+  folderBySegment: Map<CabFolderInternal, LogicalFolder>;
+} {
+  let rawFolderCount = 0;
+  let rawBlockCount = 0;
+  const joins = cabinets.slice(0, -1).map((cabinet, index) => {
+    checkCancellation(options.cancellation);
+    return validateBoundary(cabinet, cabinets[index + 1]!);
+  });
+  const folders: LogicalFolder[] = [];
+  const folderBySegment = new Map<CabFolderInternal, LogicalFolder>();
+
+  for (
+    let cabinetIndex = 0;
+    cabinetIndex < cabinets.length;
+    cabinetIndex += 1
+  ) {
+    const cabinet = cabinets[cabinetIndex]!;
+    rawFolderCount = checkedAdd(
+      rawFolderCount,
+      cabinet.parsed.folders.length,
+      'cab-set-folder-count-overflow',
+      'CFFOLDER'
+    );
+    if (rawFolderCount > limits.maxFolders) {
+      fail(
+        'cab-entry-count-limit',
+        `Cabinet set exceeds the configured ${limits.maxFolders}-folder-segment limit.`,
+        { structure: 'CFFOLDER' }
+      );
+    }
+    for (const folder of cabinet.parsed.folders) {
+      rawBlockCount = checkedAdd(
+        rawBlockCount,
+        folder.blocks.length,
+        'cab-data-block-count-overflow',
+        'CFDATA'
+      );
+      if (rawBlockCount > limits.maxDataBlocks) {
+        fail(
+          'cab-data-block-count-limit',
+          `Cabinet set exceeds the configured ${limits.maxDataBlocks}-fragment limit.`,
+          { structure: 'CFDATA' }
+        );
+      }
+      const mergePrevious =
+        folder.index === 0 && cabinetIndex > 0 && joins[cabinetIndex - 1];
+      const logical = mergePrevious
+        ? folders.at(-1)
+        : {
+            index: folders.length,
+            compression: folder.compression,
+            segments: [],
+            blocks: [],
+            compressedSize: 0,
+            uncompressedSize: 0,
+          };
+      if (!logical) {
+        fail(
+          'cab-set-folder-continuation-mismatch',
+          'Continued folder has no preceding logical folder.',
+          { structure: 'CFFOLDER' }
+        );
+      }
+      if (!mergePrevious) folders.push(logical);
+      logical.segments.push({ cabinet, folder });
+      folderBySegment.set(folder, logical);
+    }
+  }
+
+  let totalFolderOutput = 0;
+  let totalLzxOutput = 0;
+  let totalQuantumOutput = 0;
+  for (const folder of folders) {
+    let pending: CabDataBlockInternal[] = [];
+    for (
+      let segmentIndex = 0;
+      segmentIndex < folder.segments.length;
+      segmentIndex += 1
+    ) {
+      const segment = folder.segments[segmentIndex]!.folder;
+      for (
+        let blockIndex = 0;
+        blockIndex < segment.blocks.length;
+        blockIndex += 1
+      ) {
+        const block = segment.blocks[blockIndex]!;
+        if (pending.length > 0 && blockIndex !== 0) {
+          fail(
+            'cab-set-split-block-order',
+            'A split CFDATA block is not continued by the first block in the next cabinet.',
+            { structure: 'CFDATA' }
+          );
+        }
+        pending.push(block);
+        if (block.uncompressedSize === 0) continue;
+
+        let compressedSize = 0;
+        for (const fragment of pending) {
+          compressedSize = checkedAdd(
+            compressedSize,
+            fragment.compressedSize,
+            'cab-data-block-size-overflow',
+            'CFDATA.cbData'
+          );
+        }
+        if (compressedSize > MAX_CAB_BLOCK_INPUT) {
+          fail(
+            'cab-invalid-compressed-block-size',
+            `Reassembled CAB data block exceeds ${MAX_CAB_BLOCK_INPUT} bytes.`,
+            { structure: 'CFDATA.cbData' }
+          );
+        }
+        if (
+          folder.compression.kind === 'mszip' &&
+          compressedSize > MAX_MSZIP_BLOCK_INPUT
+        ) {
+          fail(
+            'cab-invalid-mszip-block-size',
+            `Reassembled MSZIP block exceeds ${MAX_MSZIP_BLOCK_INPUT} bytes.`,
+            { structure: 'CFDATA.cbData' }
+          );
+        }
+        if (
+          folder.compression.kind === 'none' &&
+          compressedSize !== block.uncompressedSize
+        ) {
+          fail(
+            'cab-uncompressed-size-mismatch',
+            'Reassembled uncompressed CAB block has different input and output sizes.',
+            { structure: 'CFDATA' }
+          );
+        }
+        folder.blocks.push({
+          fragments: pending,
+          compressedSize,
+          uncompressedSize: block.uncompressedSize,
+        });
+        folder.compressedSize = checkedAdd(
+          folder.compressedSize,
+          compressedSize,
+          'cab-folder-size-overflow',
+          'CFDATA.cbData'
+        );
+        folder.uncompressedSize = checkedAdd(
+          folder.uncompressedSize,
+          block.uncompressedSize,
+          'cab-folder-size-overflow',
+          'CFDATA.cbUncomp'
+        );
+        pending = [];
+      }
+      if (pending.length > 0 && segmentIndex === folder.segments.length - 1) {
+        fail(
+          'cab-set-incomplete-split-block',
+          'Cabinet set ends before a split CFDATA block is complete.',
+          { structure: 'CFDATA.cbUncomp' }
+        );
+      }
+    }
+    if (folder.uncompressedSize > limits.maxFolderUncompressedBytes) {
+      fail(
+        'cab-folder-size-limit',
+        `Merged CAB folder exceeds the configured ${limits.maxFolderUncompressedBytes}-byte output limit.`,
+        { structure: 'CFDATA.cbUncomp' }
+      );
+    }
+    if (
+      folder.uncompressedSize / folder.compressedSize >
+      limits.maxCompressionRatio
+    ) {
+      fail(
+        'cab-compression-ratio-limit',
+        `Merged CAB folder exceeds the configured ${limits.maxCompressionRatio}:1 compression ratio.`,
+        { structure: 'CFFOLDER/CFDATA' }
+      );
+    }
+    totalFolderOutput = checkedAdd(
+      totalFolderOutput,
+      folder.uncompressedSize,
+      'cab-total-size-overflow',
+      'CFDATA.cbUncomp'
+    );
+    if (folder.compression.kind === 'lzx') {
+      totalLzxOutput = checkedAdd(
+        totalLzxOutput,
+        folder.uncompressedSize,
+        'lzx-operation-limit',
+        'CFDATA.cbUncomp'
+      );
+    }
+    if (folder.compression.kind === 'quantum') {
+      totalQuantumOutput = checkedAdd(
+        totalQuantumOutput,
+        folder.uncompressedSize,
+        'quantum-operation-limit',
+        'CFDATA.cbUncomp'
+      );
+    }
+  }
+  if (totalFolderOutput > limits.maxTotalUncompressedBytes) {
+    fail(
+      'cab-total-size-limit',
+      `Cabinet set output exceeds the configured ${limits.maxTotalUncompressedBytes}-byte limit.`,
+      { structure: 'CFDATA.cbUncomp' }
+    );
+  }
+  if (totalLzxOutput > limits.maxDecodeOperations) {
+    fail(
+      'lzx-operation-limit',
+      'Merged LZX output exceeds the configured operation limit.',
+      { structure: 'CFDATA.cbUncomp' }
+    );
+  }
+  if (totalQuantumOutput > limits.maxDecodeOperations) {
+    fail(
+      'quantum-operation-limit',
+      'Merged Quantum output exceeds the configured operation limit.',
+      { structure: 'CFDATA.cbUncomp' }
+    );
+  }
+  return { folders, folderBySegment };
+}
+
+function buildLogicalEntries(
+  cabinets: NamedCabinet[],
+  folders: LogicalFolder[],
+  folderBySegment: Map<CabFolderInternal, LogicalFolder>,
+  limits: OnePkgLimits,
+  options: CabOpenOptions
+): CabFileEntry[] {
+  const entries: CabFileEntry[] = [];
+  const byPath = new Map<
+    string,
+    { record: CabFileRecordInternal; logicalFolder: LogicalFolder }
+  >();
+  let extractedBytes = 0;
+
+  for (const cabinet of cabinets) {
+    for (const record of cabinet.parsed.fileRecords) {
+      checkCancellation(options.cancellation);
+      const segment = cabinet.parsed.folders[record.entry.folderIndex];
+      const logicalFolder = segment ? folderBySegment.get(segment) : undefined;
+      if (!logicalFolder) {
+        fail(
+          'cab-folder-index-out-of-range',
+          'CAB set file has no merged folder.',
+          { offset: record.entryOffset + 8, structure: 'CFFILE.iFolder' }
+        );
+      }
+      const existing = byPath.get(record.duplicateKey);
+      if (existing) {
+        if (
+          record.rawFolderIndex < FOLDER_CONTINUED_FROM_PREVIOUS ||
+          existing.record.rawFolderIndex < FOLDER_CONTINUED_FROM_PREVIOUS ||
+          existing.logicalFolder !== logicalFolder ||
+          !sameSpanningFile(existing.record, record)
+        ) {
+          fail(
+            'cab-duplicate-path',
+            `Cabinet set contains a conflicting duplicate path: ${record.entry.normalizedPath}`,
+            { offset: record.entryOffset, structure: 'CFFILE.szName' }
+          );
+        }
+        continue;
+      }
+
+      if (entries.length >= limits.maxFiles) {
+        fail(
+          'cab-entry-count-limit',
+          `Cabinet set exceeds the configured ${limits.maxFiles}-file limit.`,
+          { structure: 'CFFILE' }
+        );
+      }
+      const fileEnd = checkedAdd(
+        record.entry.uncompressedOffset,
+        record.entry.uncompressedSize,
+        'cab-file-range-overflow',
+        'CFFILE'
+      );
+      if (fileEnd > logicalFolder.uncompressedSize) {
+        fail(
+          'cab-file-range-out-of-bounds',
+          `CAB file ${record.entry.normalizedPath} extends beyond its merged folder data.`,
+          { offset: record.entryOffset, structure: 'CFFILE' }
+        );
+      }
+      extractedBytes = checkedAdd(
+        extractedBytes,
+        record.entry.uncompressedSize,
+        'cab-extracted-size-overflow',
+        'CFFILE.cbFile'
+      );
+      if (extractedBytes > limits.maxExtractedBytes) {
+        fail(
+          'cab-extracted-size-limit',
+          `Cabinet set files exceed the configured ${limits.maxExtractedBytes}-byte extraction limit.`,
+          { structure: 'CFFILE.cbFile' }
+        );
+      }
+      const entry: CabFileEntry = {
+        ...record.entry,
+        index: entries.length,
+        folderIndex: logicalFolder.index,
+        compression: logicalFolder.compression,
+      };
+      entries.push(entry);
+      byPath.set(record.duplicateKey, { record, logicalFolder });
+    }
+  }
+
+  // Keep this assertion close to the mapping so malformed internal indexes
+  // cannot silently select a different logical folder.
+  for (const entry of entries) {
+    if (!folders[entry.folderIndex]) {
+      fail('cab-folder-index-out-of-range', 'Merged folder index is invalid.', {
+        structure: 'CFFILE.iFolder',
+      });
+    }
+  }
+  return entries;
+}
+
+function buildLogicalSet(
+  parts: CabSetPart[],
+  options: CabOpenOptions
+): LogicalCabinetSet {
+  const limits = resolveLimits(options.limits);
+  const cabinets = validateNamedCabinets(parts, options, limits);
+  const { folders, folderBySegment } = buildLogicalFolders(
+    cabinets,
+    limits,
+    options
+  );
+  const entries = buildLogicalEntries(
+    cabinets,
+    folders,
+    folderBySegment,
+    limits,
+    options
+  );
+  let declaredSize = 0;
+  for (const cabinet of cabinets) {
+    declaredSize = checkedAdd(
+      declaredSize,
+      cabinet.parsed.result.declaredSize,
+      'cab-set-size-overflow',
+      'CFHEADER.cbCabinet'
+    );
+  }
+  return {
+    cabinets,
+    limits,
+    cabinetSetId: cabinets[0]!.parsed.result.cabinetSetId,
+    declaredSize,
+    folders,
+    entries,
+    diagnostics: cabinets.flatMap(
+      (cabinet) => cabinet.parsed.result.diagnostics
+    ),
+  };
+}
+
+function compressedBlockBytes(block: LogicalBlock): Uint8Array {
+  for (const fragment of block.fragments) {
+    verifyDataBlockChecksumInternal(fragment.sourceBytes, fragment);
+  }
+  if (block.fragments.length === 1) {
+    const fragment = block.fragments[0]!;
+    return fragment.sourceBytes.subarray(
+      fragment.dataOffset,
+      fragment.dataOffset + fragment.compressedSize
+    );
+  }
+  const compressed = new Uint8Array(block.compressedSize);
+  let offset = 0;
+  for (const fragment of block.fragments) {
+    compressed.set(
+      fragment.sourceBytes.subarray(
+        fragment.dataOffset,
+        fragment.dataOffset + fragment.compressedSize
+      ),
+      offset
+    );
+    offset += fragment.compressedSize;
+  }
+  return compressed;
+}
+
+async function extractLogicalFolder(
+  folder: LogicalFolder,
+  limits: OnePkgLimits,
+  options: CabOpenOptions
+): Promise<Uint8Array> {
+  const output = new Uint8Array(folder.uncompressedSize);
+  const lzx =
+    folder.compression.kind === 'lzx'
+      ? new LzxDecoder(folder.compression.windowBits, {
+          maxOperations: limits.maxDecodeOperations,
+          checkCancellation: () => checkCancellation(options.cancellation),
+        })
+      : undefined;
+  const mszip =
+    folder.compression.kind === 'mszip' ? new MsZipDecoder() : undefined;
+  const quantum =
+    folder.compression.kind === 'quantum'
+      ? new QuantumDecoder(folder.compression.memoryBits, {
+          maxOperations: limits.maxDecodeOperations,
+          checkCancellation: () => checkCancellation(options.cancellation),
+        })
+      : undefined;
+  let quantumQueuedBlock = -1;
+  let outputOffset = 0;
+
+  for (let blockIndex = 0; blockIndex < folder.blocks.length; blockIndex += 1) {
+    checkCancellation(options.cancellation);
+    const block = folder.blocks[blockIndex]!;
+    if (quantum) {
+      const lookahead = Math.min(blockIndex + 1, folder.blocks.length - 1);
+      while (quantumQueuedBlock < lookahead) {
+        quantumQueuedBlock += 1;
+        quantum.appendCabBlock(
+          compressedBlockBytes(folder.blocks[quantumQueuedBlock]!),
+          quantumQueuedBlock === folder.blocks.length - 1
+        );
+      }
+    }
+    const compressed = quantum ? undefined : compressedBlockBytes(block);
+    const blockOutput = lzx
+      ? lzx.decompressNext(compressed!, block.uncompressedSize)
+      : mszip
+        ? mszip.decompressNext(compressed!, block.uncompressedSize)
+        : quantum
+          ? quantum.decompressNext(
+              block.uncompressedSize,
+              blockIndex === folder.blocks.length - 1
+            )
+          : compressed!;
+    if (blockOutput.length !== block.uncompressedSize) {
+      fail(
+        'cab-output-size-mismatch',
+        `CAB decoder returned ${blockOutput.length} bytes; expected ${block.uncompressedSize}.`,
+        { structure: 'CFDATA.cbUncomp' }
+      );
+    }
+    output.set(blockOutput, outputOffset);
+    outputOffset += blockOutput.length;
+    await yieldForCancellation(options.cancellation);
+  }
+  lzx?.finish();
+  if (outputOffset !== output.length) {
+    fail(
+      'cab-folder-output-size-mismatch',
+      'Merged CAB folder output is incomplete.',
+      { structure: `CFFOLDER[${folder.index}]` }
+    );
+  }
+  return output;
+}
+
+export async function extractCabinetSet(
+  parts: CabSetPart[],
+  options: CabOpenOptions = {}
+): Promise<CabSetExtractionResult> {
+  const set = buildLogicalSet(parts, options);
+  const entriesByFolder = new Map<number, CabFileEntry[]>();
+  for (const entry of set.entries) {
+    const current = entriesByFolder.get(entry.folderIndex);
+    if (current) current.push(entry);
+    else entriesByFolder.set(entry.folderIndex, [entry]);
+  }
+
+  const extractedEntries: ExtractedCabFile[] = [];
+  for (const folder of set.folders) {
+    checkCancellation(options.cancellation);
+    const folderOutput = await extractLogicalFolder(
+      folder,
+      set.limits,
+      options
+    );
+    for (const entry of entriesByFolder.get(folder.index) ?? []) {
+      const start = entry.uncompressedOffset;
+      extractedEntries.push({
+        ...entry,
+        bytes: folderOutput.slice(start, start + entry.uncompressedSize),
+      });
+    }
+  }
+  extractedEntries.sort((left, right) => left.index - right.index);
+  const folders: CabFolderSummary[] = set.folders.map((folder) => ({
+    index: folder.index,
+    dataBlockCount: folder.blocks.length,
+    compressedSize: folder.compressedSize,
+    uncompressedSize: folder.uncompressedSize,
+    compression: folder.compression,
+  }));
+  return {
+    cabinetSetId: set.cabinetSetId,
+    cabinetSetIndex: 0,
+    declaredSize: set.declaredSize,
+    parts: set.cabinets.map((cabinet) => ({
+      fileName: cabinet.fileName,
+      declaredSize: cabinet.parsed.result.declaredSize,
+      cabinetSetIndex: cabinet.parsed.result.cabinetSetIndex,
+      previousCabinetName: cabinet.parsed.previousCabinetName,
+      nextCabinetName: cabinet.parsed.nextCabinetName,
+    })),
+    entries: set.entries,
+    folders,
+    diagnostics: set.diagnostics,
+    extractedEntries,
+  };
+}

src/onenote/onepkg/cabinet.ts

@@ -29,39 +29,68 @@ import {
 const CAB_SIGNATURE = 0x4643_534d;
 const FLAG_PREVIOUS_CABINET = 0x0001;
 const FLAG_NEXT_CABINET = 0x0002;
-const FLAG_RESERVE_PRESENT = 0x0004;
+export const FLAG_RESERVE_PRESENT = 0x0004;
 const ATTRIBUTE_NAME_IS_UTF8 = 0x0080;
 const MAX_CAB_BLOCK_OUTPUT = 32 * 1024;
+const MAX_CAB_BLOCK_INPUT = MAX_CAB_BLOCK_OUTPUT + 6 * 1024;
 const MAX_MSZIP_BLOCK_INPUT = 32 * 1024 + 12;
+export const FOLDER_CONTINUED_FROM_PREVIOUS = 0xfffd;
+export const FOLDER_CONTINUED_TO_NEXT = 0xfffe;
+export const FOLDER_CONTINUED_PREVIOUS_AND_NEXT = 0xffff;
+const STRICT_UTF8 = new TextDecoder('utf-8', { fatal: true });
 
-interface CabDataBlock {
+export interface CabDataBlockInternal {
   headerOffset: number;
   checksum: number;
   compressedSize: number;
   uncompressedSize: number;
   reserve: Uint8Array;
   dataOffset: number;
+  sourceBytes: Uint8Array;
 }
 
-interface CabFolderInternal {
+export interface CabFolderInternal {
   index: number;
   firstDataBlockOffset: number;
   dataBlockCount: number;
   compression: CabCompressionMethod;
-  blocks: CabDataBlock[];
+  reserve: Uint8Array;
+  blocks: CabDataBlockInternal[];
   compressedSize: number;
   uncompressedSize: number;
   dataEnd: number;
 }
 
-interface ParsedCabinet {
+export interface CabFileRecordInternal {
+  entry: CabFileEntry;
+  rawFolderIndex: number;
+  duplicateKey: string;
+  date: number;
+  time: number;
+  entryOffset: number;
+}
+
+export interface ParsedCabinetInternal {
   bytes: Uint8Array;
   limits: OnePkgLimits;
+  flags: number;
+  previousCabinetName?: string;
+  previousDiskName?: string;
+  nextCabinetName?: string;
+  nextDiskName?: string;
+  headerReserveSize: number;
+  folderReserveSize: number;
+  dataReserveSize: number;
+  headerReserve: Uint8Array;
   folders: CabFolderInternal[];
+  fileRecords: CabFileRecordInternal[];
   result: CabEnumerationResult;
 }
 
-function verifyDataBlockChecksum(bytes: Uint8Array, block: CabDataBlock): void {
+export function verifyDataBlockChecksumInternal(
+  bytes: Uint8Array,
+  block: CabDataBlockInternal
+): void {
   if (block.checksum === 0) return;
   const compressed = bytes.subarray(
     block.dataOffset,
@@ -95,6 +124,31 @@ function checkedAdd(
   return sum;
 }
 
+function readLinkedCabinetString(
+  reader: BinaryReader,
+  limits: OnePkgLimits,
+  structure: string,
+  allowEmpty: boolean
+): string {
+  const offset = reader.offset;
+  const bytes = reader.readNullTerminatedBytes(limits.maxNameBytes, structure);
+  if (!allowEmpty && bytes.length === 0) {
+    fail('cab-linked-name-empty', 'Linked cabinet name cannot be empty.', {
+      offset,
+      structure,
+    });
+  }
+  try {
+    return STRICT_UTF8.decode(bytes).normalize('NFC');
+  } catch (error) {
+    fail(
+      'cab-linked-name-invalid-utf8',
+      `Linked cabinet metadata is not valid UTF-8${error instanceof Error ? `: ${error.message}` : '.'}`,
+      { offset, structure }
+    );
+  }
+}
+
 function parseCompression(
   raw: number,
   limits: OnePkgLimits,
@@ -201,10 +255,11 @@ function parseCompression(
   );
 }
 
-function parseCabinet(
+export function parseCabinetInternal(
   bytes: Uint8Array,
-  options: CabOpenOptions
-): ParsedCabinet {
+  options: CabOpenOptions,
+  allowMultipart = false
+): ParsedCabinetInternal {
   if (!(bytes instanceof Uint8Array)) {
     throw new TypeError('CAB input must be a Uint8Array');
   }
@@ -276,7 +331,10 @@ function parseCabinet(
       }
     );
   }
-  if ((flags & (FLAG_PREVIOUS_CABINET | FLAG_NEXT_CABINET)) !== 0) {
+  if (
+    !allowMultipart &&
+    (flags & (FLAG_PREVIOUS_CABINET | FLAG_NEXT_CABINET)) !== 0
+  ) {
     fail(
       'cab-multipart-unsupported',
       'Multi-cabinet archives are not supported for local .onepkg files.',
@@ -293,15 +351,41 @@ function parseCabinet(
 
   // Re-bind reads to the trusted cbCabinet boundary before parsing variable data.
   const reader = new BinaryReader(bytes, header.offset, declaredSize);
+  let headerReserveSize = 0;
   let folderReserveSize = 0;
   let dataReserveSize = 0;
+  let headerReserve: Uint8Array = new Uint8Array(0);
   if ((flags & FLAG_RESERVE_PRESENT) !== 0) {
-    const headerReserveSize = reader.readU16('CFHEADER.cbCFHeader');
+    headerReserveSize = reader.readU16('CFHEADER.cbCFHeader');
     folderReserveSize = reader.readU8('CFHEADER.cbCFFolder');
     dataReserveSize = reader.readU8('CFHEADER.cbCFData');
-    reader.skip(headerReserveSize, 'CFHEADER.abReserve');
+    if (headerReserveSize > 60_000) {
+      fail(
+        'cab-header-reserve-limit',
+        'CAB header reserve area exceeds the 60,000-byte format limit.',
+        { offset: header.offset, structure: 'CFHEADER.cbCFHeader' }
+      );
+    }
+    headerReserve = reader.readBytes(headerReserveSize, 'CFHEADER.abReserve');
   }
 
+  const previousCabinetName =
+    (flags & FLAG_PREVIOUS_CABINET) !== 0
+      ? readLinkedCabinetString(reader, limits, 'CFHEADER.szCabinetPrev', false)
+      : undefined;
+  const previousDiskName =
+    (flags & FLAG_PREVIOUS_CABINET) !== 0
+      ? readLinkedCabinetString(reader, limits, 'CFHEADER.szDiskPrev', true)
+      : undefined;
+  const nextCabinetName =
+    (flags & FLAG_NEXT_CABINET) !== 0
+      ? readLinkedCabinetString(reader, limits, 'CFHEADER.szCabinetNext', false)
+      : undefined;
+  const nextDiskName =
+    (flags & FLAG_NEXT_CABINET) !== 0
+      ? readLinkedCabinetString(reader, limits, 'CFHEADER.szDiskNext', true)
+      : undefined;
+
   const folders: CabFolderInternal[] = [];
   let totalDataBlocks = 0;
   for (let index = 0; index < folderCount; index += 1) {
@@ -315,7 +399,7 @@ function parseCabinet(
       limits,
       compressionRawOffset
     );
-    reader.skip(folderReserveSize, 'CFFOLDER.abReserve');
+    const reserve = reader.readBytes(folderReserveSize, 'CFFOLDER.abReserve');
     totalDataBlocks = checkedAdd(
       totalDataBlocks,
       dataBlockCount,
@@ -334,6 +418,7 @@ function parseCabinet(
       firstDataBlockOffset,
       dataBlockCount,
       compression,
+      reserve,
       blocks: [],
       compressedSize: 0,
       uncompressedSize: 0,
@@ -349,6 +434,7 @@ function parseCabinet(
   }
   const fileReader = new BinaryReader(bytes, firstFileOffset, declaredSize);
   const entries: CabFileEntry[] = [];
+  const fileRecords: CabFileRecordInternal[] = [];
   const diagnostics = [];
   const duplicatePaths = new Set<string>();
   let extractedByteTotal = 0;
@@ -357,9 +443,9 @@ function parseCabinet(
     const entryOffset = fileReader.offset;
     const uncompressedSize = fileReader.readU32('CFFILE.cbFile');
     const uncompressedOffset = fileReader.readU32('CFFILE.uoffFolderStart');
-    const folderIndex = fileReader.readU16('CFFILE.iFolder');
-    fileReader.readU16('CFFILE.date');
-    fileReader.readU16('CFFILE.time');
+    const rawFolderIndex = fileReader.readU16('CFFILE.iFolder');
+    const date = fileReader.readU16('CFFILE.date');
+    const time = fileReader.readU16('CFFILE.time');
     const attributes = fileReader.readU16('CFFILE.attribs');
     const nameOffset = fileReader.offset;
     const nameBytes = fileReader.readNullTerminatedBytes(
@@ -367,12 +453,42 @@ function parseCabinet(
       'CFFILE.szName'
     );
 
-    if (folderIndex >= 0xfffd) {
-      fail(
-        'cab-multipart-file-unsupported',
-        'CAB file spans another cabinet; multi-cabinet files are unsupported.',
-        { offset: entryOffset + 8, structure: 'CFFILE.iFolder' }
-      );
+    let folderIndex = rawFolderIndex;
+    if (rawFolderIndex >= FOLDER_CONTINUED_FROM_PREVIOUS) {
+      if (!allowMultipart) {
+        fail(
+          'cab-multipart-file-unsupported',
+          'CAB file spans another cabinet; multi-cabinet files are unsupported.',
+          { offset: entryOffset + 8, structure: 'CFFILE.iFolder' }
+        );
+      }
+      const continuesFromPrevious =
+        rawFolderIndex === FOLDER_CONTINUED_FROM_PREVIOUS ||
+        rawFolderIndex === FOLDER_CONTINUED_PREVIOUS_AND_NEXT;
+      const continuesToNext =
+        rawFolderIndex === FOLDER_CONTINUED_TO_NEXT ||
+        rawFolderIndex === FOLDER_CONTINUED_PREVIOUS_AND_NEXT;
+      if (
+        (continuesFromPrevious && (flags & FLAG_PREVIOUS_CABINET) === 0) ||
+        (continuesToNext && (flags & FLAG_NEXT_CABINET) === 0)
+      ) {
+        fail(
+          'cab-spanning-file-flag-mismatch',
+          'CAB spanning file marker does not match its prev/next header flags.',
+          { offset: entryOffset + 8, structure: 'CFFILE.iFolder' }
+        );
+      }
+      if (
+        rawFolderIndex === FOLDER_CONTINUED_PREVIOUS_AND_NEXT &&
+        folders.length !== 1
+      ) {
+        fail(
+          'cab-spanning-folder-ambiguous',
+          'A folder continued from both cabinets must be the only folder in this cabinet.',
+          { offset: entryOffset + 8, structure: 'CFFILE.iFolder' }
+        );
+      }
+      folderIndex = continuesFromPrevious ? 0 : folders.length - 1;
     }
     const folder = folders[folderIndex];
     if (folder === undefined) {
@@ -392,18 +508,20 @@ function parseCabinet(
         { offset: entryOffset, structure: 'CFFILE.cbFile' }
       );
     }
-    extractedByteTotal = checkedAdd(
-      extractedByteTotal,
-      uncompressedSize,
-      'cab-extracted-size-overflow',
-      'CFFILE.cbFile'
-    );
-    if (extractedByteTotal > limits.maxExtractedBytes) {
-      fail(
-        'cab-extracted-size-limit',
-        `Extracted files exceed the configured ${limits.maxExtractedBytes}-byte limit.`,
-        { offset: entryOffset, structure: 'CFFILE.cbFile' }
+    if (!allowMultipart) {
+      extractedByteTotal = checkedAdd(
+        extractedByteTotal,
+        uncompressedSize,
+        'cab-extracted-size-overflow',
+        'CFFILE.cbFile'
       );
+      if (extractedByteTotal > limits.maxExtractedBytes) {
+        fail(
+          'cab-extracted-size-limit',
+          `Extracted files exceed the configured ${limits.maxExtractedBytes}-byte limit.`,
+          { offset: entryOffset, structure: 'CFFILE.cbFile' }
+        );
+      }
     }
 
     const path = decodeCabFileName(
@@ -432,7 +550,7 @@ function parseCabinet(
       );
     }
     duplicatePaths.add(normalized.duplicateKey);
-    entries.push({
+    const entry: CabFileEntry = {
       index,
       path: normalized.path,
       normalizedPath: normalized.normalizedPath,
@@ -441,6 +559,15 @@ function parseCabinet(
       uncompressedSize,
       attributes,
       compression: folder.compression,
+    };
+    entries.push(entry);
+    fileRecords.push({
+      entry,
+      rawFolderIndex,
+      duplicateKey: normalized.duplicateKey,
+      date,
+      time,
+      entryOffset,
     });
   }
   const metadataEnd = fileReader.offset;
@@ -449,6 +576,12 @@ function parseCabinet(
   let totalLzxOutput = 0;
   let totalQuantumOutput = 0;
   for (const folder of folders) {
+    const folderContinuesToNext = fileRecords.some(
+      (record) =>
+        record.entry.folderIndex === folder.index &&
+        (record.rawFolderIndex === FOLDER_CONTINUED_TO_NEXT ||
+          record.rawFolderIndex === FOLDER_CONTINUED_PREVIOUS_AND_NEXT)
+    );
     if (folder.firstDataBlockOffset > declaredSize) {
       fail(
         'cab-invalid-data-offset',
@@ -493,17 +626,32 @@ function parseCabinet(
       );
       const dataOffset = blockReader.offset;
       blockReader.skip(compressedSize, 'CFDATA.ab');
-      if (
-        compressedSize === 0 ||
-        uncompressedSize === 0 ||
-        uncompressedSize > MAX_CAB_BLOCK_OUTPUT
-      ) {
+      if (compressedSize === 0 || uncompressedSize > MAX_CAB_BLOCK_OUTPUT) {
         fail(
           'cab-invalid-data-block-size',
           `Invalid CAB data block sizes ${compressedSize}/${uncompressedSize}.`,
           { offset: headerOffset + 4, structure: 'CFDATA' }
         );
       }
+      if (
+        uncompressedSize === 0 &&
+        (!allowMultipart ||
+          blockIndex !== folder.dataBlockCount - 1 ||
+          !folderContinuesToNext)
+      ) {
+        fail(
+          'cab-invalid-split-data-block',
+          'A zero-output CFDATA fragment must be the final block of a folder continued in the next cabinet.',
+          { offset: headerOffset + 6, structure: 'CFDATA.cbUncomp' }
+        );
+      }
+      if (compressedSize > MAX_CAB_BLOCK_INPUT) {
+        fail(
+          'cab-invalid-compressed-block-size',
+          `CAB data block size ${compressedSize} exceeds ${MAX_CAB_BLOCK_INPUT} bytes.`,
+          { offset: headerOffset + 4, structure: 'CFDATA.cbData' }
+        );
+      }
       if (
         folder.compression.kind === 'mszip' &&
         compressedSize > MAX_MSZIP_BLOCK_INPUT
@@ -516,6 +664,7 @@ function parseCabinet(
       }
       if (
         folder.compression.kind === 'none' &&
+        !allowMultipart &&
         compressedSize !== uncompressedSize
       ) {
         fail(
@@ -550,12 +699,14 @@ function parseCabinet(
         uncompressedSize,
         reserve,
         dataOffset,
+        sourceBytes: bytes,
       });
     }
     folder.dataEnd = blockReader.offset;
     if (
+      !allowMultipart &&
       folder.uncompressedSize / folder.compressedSize >
-      limits.maxCompressionRatio
+        limits.maxCompressionRatio
     ) {
       fail(
         'cab-compression-ratio-limit',
@@ -624,20 +775,22 @@ function parseCabinet(
     }
   }
 
-  for (const entry of entries) {
-    const folder = folders[entry.folderIndex]!;
-    const fileEnd = checkedAdd(
-      entry.uncompressedOffset,
-      entry.uncompressedSize,
-      'cab-file-range-overflow',
-      'CFFILE'
-    );
-    if (fileEnd > folder.uncompressedSize) {
-      fail(
-        'cab-file-range-out-of-bounds',
-        `CAB file ${entry.normalizedPath} extends beyond its folder data.`,
-        { structure: 'CFFILE' }
+  if (!allowMultipart) {
+    for (const entry of entries) {
+      const folder = folders[entry.folderIndex]!;
+      const fileEnd = checkedAdd(
+        entry.uncompressedOffset,
+        entry.uncompressedSize,
+        'cab-file-range-overflow',
+        'CFFILE'
       );
+      if (fileEnd > folder.uncompressedSize) {
+        fail(
+          'cab-file-range-out-of-bounds',
+          `CAB file ${entry.normalizedPath} extends beyond its folder data.`,
+          { structure: 'CFFILE' }
+        );
+      }
     }
   }
 
@@ -662,7 +815,17 @@ function parseCabinet(
   return {
     bytes,
     limits,
+    flags,
+    previousCabinetName,
+    previousDiskName,
+    nextCabinetName,
+    nextDiskName,
+    headerReserveSize,
+    folderReserveSize,
+    dataReserveSize,
+    headerReserve,
     folders,
+    fileRecords,
     result: {
       cabinetSetId,
       cabinetSetIndex,
@@ -684,14 +847,14 @@ export function enumerateCabinet(
   bytes: Uint8Array,
   options: CabOpenOptions = {}
 ): CabEnumerationResult {
-  return parseCabinet(bytes, options).result;
+  return parseCabinetInternal(bytes, options).result;
 }
 
 export async function extractCabinet(
   bytes: Uint8Array,
   options: CabOpenOptions = {}
 ): Promise<CabExtractionResult> {
-  const parsed = parseCabinet(bytes, options);
+  const parsed = parseCabinetInternal(bytes, options);
   const byFolder = new Map<number, CabFileEntry[]>();
   for (const entry of parsed.result.entries) {
     const current = byFolder.get(entry.folderIndex);
@@ -728,7 +891,7 @@ export async function extractCabinet(
         while (quantumQueuedBlock < lookahead) {
           quantumQueuedBlock += 1;
           const queued = folder.blocks[quantumQueuedBlock]!;
-          verifyDataBlockChecksum(parsed.bytes, queued);
+          verifyDataBlockChecksumInternal(parsed.bytes, queued);
           quantumDecoder.appendCabBlock(
             parsed.bytes.subarray(
               queued.dataOffset,
@@ -743,7 +906,7 @@ export async function extractCabinet(
         block.dataOffset + block.compressedSize
       );
       if (quantumDecoder === undefined) {
-        verifyDataBlockChecksum(parsed.bytes, block);
+        verifyDataBlockChecksumInternal(parsed.bytes, block);
       }
       const output =
         decoder !== undefined

src/onenote/onepkg/index.ts

@@ -1,6 +1,7 @@
 export { enumerateCabinet, extractCabinet } from './cabinet.js';
+export { extractCabinetSet } from './cabinet-set.js';
 export { OnePkgError } from './errors.js';
-export { openOneNotePackage } from './package.js';
+export { openOneNotePackage, openOneNotePackageSet } from './package.js';
 export type {
   OneNotePackageOpenOptions,
   OneNotePackageOpenResult,
@@ -17,6 +18,9 @@ export {
   type CabFileEntry,
   type CabFolderSummary,
   type CabOpenOptions,
+  type CabSetExtractionResult,
+  type CabSetPart,
+  type CabSetPartSummary,
   type ExtractedCabFile,
   type OnePkgCancellation,
   type OnePkgLimits,

src/onenote/onepkg/package.ts

@@ -7,10 +7,13 @@ import type {
 import type { ParserDiagnostic } from '../model/diagnostics.js';
 import { checkCancellation } from './cancellation.js';
 import { extractCabinet } from './cabinet.js';
+import { extractCabinetSet } from './cabinet-set.js';
 import { diagnosticFromUnknown, OnePkgError, warning } from './errors.js';
 import { buildOneNotePackageTree } from './toc-hierarchy.js';
 import type {
   CabOpenOptions,
+  CabExtractionResult,
+  CabSetPart,
   ExtractedCabFile,
   OnePkgCancellation,
 } from './types.js';
@@ -84,6 +87,34 @@ export async function openOneNotePackage(
 ): Promise<OneNotePackageOpenResult> {
   const sourceName = options.sourceName ?? 'notebook.onepkg';
   const extraction = await extractCabinet(bytes, options);
+  return buildOpenedPackage(extraction, sourceName, bytes.byteLength, options);
+}
+
+export async function openOneNotePackageSet(
+  parts: CabSetPart[],
+  options: OneNotePackageOpenOptions = {}
+): Promise<OneNotePackageOpenResult> {
+  const extraction = await extractCabinetSet(parts, options);
+  const sourceName =
+    options.sourceName ??
+    parts.find((part) => part.fileName.toLowerCase().endsWith('.onepkg'))
+      ?.fileName ??
+    extraction.parts[0]?.fileName ??
+    'notebook.onepkg';
+  return buildOpenedPackage(
+    extraction,
+    sourceName,
+    parts.reduce((sum, part) => sum + part.bytes.byteLength, 0),
+    options
+  );
+}
+
+async function buildOpenedPackage(
+  extraction: CabExtractionResult,
+  sourceName: string,
+  sourceSize: number,
+  options: OneNotePackageOpenOptions
+): Promise<OneNotePackageOpenResult> {
   const diagnostics = [...extraction.diagnostics];
   const packageEntries: OneNotePackageEntryDto[] =
     extraction.extractedEntries.map((entry) => ({
@@ -173,7 +204,7 @@ export async function openOneNotePackage(
     package: {
       format: 'onepkg',
       sourceName,
-      sourceSize: bytes.byteLength,
+      sourceSize,
       entries: packageEntries,
       sections: packagedSections,
       tree: treeResult.tree,

src/onenote/onepkg/types.ts

@@ -55,6 +55,24 @@ export interface CabExtractionResult extends CabEnumerationResult {
   extractedEntries: ExtractedCabFile[];
 }
 
+export interface CabSetPart {
+  /** Selected local basename. Used only to validate CAB prev/next links. */
+  fileName: string;
+  bytes: Uint8Array;
+}
+
+export interface CabSetPartSummary {
+  fileName: string;
+  declaredSize: number;
+  cabinetSetIndex: number;
+  previousCabinetName?: string;
+  nextCabinetName?: string;
+}
+
+export interface CabSetExtractionResult extends CabExtractionResult {
+  parts: CabSetPartSummary[];
+}
+
 export interface OnePkgCancellation {
   signal?: AbortSignal;
   isCancelled?: () => boolean;
@@ -64,6 +82,8 @@ export interface OnePkgCancellation {
 
 export interface OnePkgLimits {
   maxCabinetBytes: number;
+  maxCabinetSetBytes: number;
+  maxCabinetParts: number;
   maxFolders: number;
   maxFiles: number;
   maxDataBlocks: number;
@@ -83,6 +103,8 @@ export interface OnePkgLimits {
 
 export const DEFAULT_ONEPKG_LIMITS: Readonly<OnePkgLimits> = {
   maxCabinetBytes: 512 * 1024 * 1024,
+  maxCabinetSetBytes: 512 * 1024 * 1024,
+  maxCabinetParts: 256,
   maxFolders: 1_024,
   maxFiles: 10_000,
   maxDataBlocks: 131_072,