@rowsncolumns/toolkit 24.4.1

package/dist/cjs/excel-parser/cfb-decryptor.js

@@ -0,0 +1,553 @@
+import { __awaiter, __generator, __values } from "tslib";
+/// <reference path="../xlsx.d.ts" />
+import { CFB } from "xlsx/xlsx.mjs";
+import { sha1 } from "@noble/hashes/sha1";
+import { sha256 } from "@noble/hashes/sha256";
+import { sha384, sha512 } from "@noble/hashes/sha512";
+import { cbc, ecb } from "@noble/ciphers/aes";
+var BLOCK_KEY_VERIFIER_INPUT = new Uint8Array([
+    0xfe, 0xa7, 0xd2, 0x76, 0x3b, 0x4b, 0x9e, 0x79,
+]);
+var BLOCK_KEY_VERIFIER_HASH = new Uint8Array([
+    0xd7, 0xaa, 0x0f, 0x6d, 0x30, 0x61, 0x34, 0x4e,
+]);
+var BLOCK_KEY_ENCRYPTION_KEY = new Uint8Array([
+    0x14, 0x6e, 0x0b, 0xe7, 0xab, 0xac, 0xd0, 0xd6,
+]);
+export var LEGACY_XLS_UNSUPPORTED_MESSAGE = "This file is a legacy Excel 97-2003 (.xls) workbook, which is not supported. Please open it in Excel and save it as .xlsx, then try again.";
+/**
+ * Inspects a CFB container's directory to decide whether it is an
+ * Office-encrypted OOXML package (`EncryptionInfo` stream present) or an
+ * unencrypted legacy BIFF `.xls` workbook (`Workbook`/`Book` stream present
+ * without `EncryptionInfo`). Returns "unknown" for anything else, including
+ * containers that fail to parse — callers should fall back to their existing
+ * behavior in that case.
+ */
+export var detectCfbContainerKind = function (source) { return __awaiter(void 0, void 0, void 0, function () {
+    var buffer, _a, cfb, streamNames, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _c.trys.push([0, 4, , 5]);
+                if (!(source instanceof File)) return [3 /*break*/, 2];
+                return [4 /*yield*/, source.arrayBuffer()];
+            case 1:
+                _a = _c.sent();
+                return [3 /*break*/, 3];
+            case 2:
+                _a = source;
+                _c.label = 3;
+            case 3:
+                buffer = _a;
+                cfb = CFB.read(new Uint8Array(buffer), { type: "array" });
+                streamNames = new Set(cfb.FileIndex.map(function (entry) { return entry.name; }));
+                if (streamNames.has("EncryptionInfo")) {
+                    return [2 /*return*/, "encrypted-ooxml"];
+                }
+                if (streamNames.has("Workbook") || streamNames.has("Book")) {
+                    return [2 /*return*/, "legacy-xls"];
+                }
+                return [2 /*return*/, "unknown"];
+            case 4:
+                _b = _c.sent();
+                return [2 /*return*/, "unknown"];
+            case 5: return [2 /*return*/];
+        }
+    });
+}); };
+var CFBDecryptor = /** @class */ (function () {
+    function CFBDecryptor() {
+    }
+    /**
+     * Decrypts a CFB-encrypted XLSX file
+     * @param source The encrypted file or array buffer
+     * @param password The password to decrypt with
+     * @returns The decrypted XLSX data as ArrayBuffer
+     */
+    CFBDecryptor.decrypt = function (source, password) {
+        return __awaiter(this, void 0, void 0, function () {
+            var buffer, _a, uint8Array, cfb, infoContent, view, versionMajor, versionMinor, detail;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        if (!(source instanceof File)) return [3 /*break*/, 2];
+                        return [4 /*yield*/, source.arrayBuffer()];
+                    case 1:
+                        _a = _b.sent();
+                        return [3 /*break*/, 3];
+                    case 2:
+                        _a = source;
+                        _b.label = 3;
+                    case 3:
+                        buffer = _a;
+                        uint8Array = new Uint8Array(buffer);
+                        cfb = CFB.read(uint8Array, { type: "array" });
+                        infoContent = this.getEncryptionInfoContent(cfb);
+                        if (!infoContent) {
+                            throw new Error("Could not parse encryption information");
+                        }
+                        view = new DataView(infoContent.buffer, infoContent.byteOffset, infoContent.byteLength);
+                        versionMajor = view.getUint16(0, true);
+                        versionMinor = view.getUint16(2, true);
+                        if (versionMajor === 4 && versionMinor === 4) {
+                            return [2 /*return*/, this.decryptAgile(cfb, password)];
+                        }
+                        if (versionMinor === 2 && versionMajor >= 2 && versionMajor <= 4) {
+                            return [2 /*return*/, this.decryptStandardFamily(cfb, infoContent, password)];
+                        }
+                        detail = versionMinor === 3 ? " (extensible encryption)" : "";
+                        throw new Error("Unsupported workbook encryption version ".concat(versionMajor, ".").concat(versionMinor).concat(detail, ". ") +
+                            "Supported: agile (4.4), standard AES (x.2), RC4 CryptoAPI.");
+                }
+            });
+        });
+    };
+    CFBDecryptor.decryptAgile = function (cfb, password) {
+        var encryptionInfo = this.parseEncryptionInfo(cfb);
+        if (!encryptionInfo) {
+            throw new Error("Could not parse encryption information");
+        }
+        // Derive key from password
+        var passwordDerivedKey = this.deriveKey(password, encryptionInfo);
+        // Verify password by decrypting verifier
+        var isValid = this.verifyPassword(passwordDerivedKey, encryptionInfo);
+        if (!isValid) {
+            throw new Error("Incorrect password");
+        }
+        // Decrypt the encrypted key value to get the actual encryption key
+        var encryptionKey = this.decryptEncryptedKey(passwordDerivedKey, encryptionInfo);
+        // Decrypt the package using the decrypted encryption key
+        var encryptedPackage = this.getEncryptedPackage(cfb);
+        return this.decryptPackage(encryptedPackage, encryptionKey, encryptionInfo);
+    };
+    CFBDecryptor.getEncryptionInfoContent = function (cfb) {
+        var entry = cfb.FileIndex.find(function (e) { return e.name === "EncryptionInfo"; });
+        if (!entry || !entry.content) {
+            return null;
+        }
+        var contentArray = entry.content;
+        return contentArray instanceof Uint8Array
+            ? contentArray
+            : new Uint8Array(contentArray);
+    };
+    // ── Standard (MS-OFFCRYPTO §2.3.4.5-9) & RC4 CryptoAPI (§2.3.5) ──────────────────
+    CFBDecryptor.decryptStandardFamily = function (cfb, infoContent, password) {
+        // `body` begins at the EncryptionHeaderFlags dword (after the 4-byte version).
+        var body = infoContent.subarray(4);
+        var dv = new DataView(body.buffer, body.byteOffset, body.byteLength);
+        var headerSize = dv.getUint32(4, true);
+        var header = body.subarray(8, 8 + headerSize);
+        var hdv = new DataView(header.buffer, header.byteOffset, header.byteLength);
+        var algId = hdv.getUint32(8, true);
+        var keySizeBits = hdv.getUint32(16, true);
+        var verifier = body.subarray(8 + headerSize);
+        var salt = verifier.subarray(4, 20);
+        var encryptedVerifier = verifier.subarray(20, 36);
+        // AES uses a 32-byte encrypted verifier hash (SHA1 padded to two blocks); RC4 uses 20.
+        var isAes = (algId & 0xff00) === 0x6600;
+        var isRc4 = algId === 0x6801 || algId === 0;
+        if (!isAes && !isRc4) {
+            throw new Error("Unsupported workbook encryption cipher (algId 0x".concat(algId.toString(16), ")."));
+        }
+        var vhashLen = isAes ? 32 : 20;
+        var encryptedVerifierHash = verifier.subarray(40, 40 + vhashLen);
+        var encryptedPackage = this.getEncryptedPackage(cfb);
+        if (isAes) {
+            var keyBytes_1 = keySizeBits !== 0
+                ? keySizeBits / 8
+                : algId === 0x660e
+                    ? 16
+                    : algId === 0x660f
+                        ? 24
+                        : 32;
+            var key = this.standardKey(password, salt, keyBytes_1);
+            var verifierPlain_1 = this.aesEcbDecrypt(encryptedVerifier, key);
+            var expected = this.hash(verifierPlain_1, "SHA1");
+            var stored = this.aesEcbDecrypt(encryptedVerifierHash, key);
+            if (!this.bytesEqual(expected, stored.subarray(0, expected.length))) {
+                throw new Error("Incorrect password");
+            }
+            return this.decryptStandardPackage(encryptedPackage, key);
+        }
+        // RC4 CryptoAPI: 40-bit keys are 5 significant bytes zero-padded to 16.
+        var keyBytes = keySizeBits === 40 || keySizeBits === 0 ? 5 : keySizeBits / 8;
+        var key0 = this.rc4CryptoApiKey(password, salt, keyBytes, 0);
+        var combined = this.rc4(key0, this.concatArrays(encryptedVerifier, encryptedVerifierHash));
+        var verifierPlain = combined.subarray(0, encryptedVerifier.length);
+        var storedHash = combined.subarray(encryptedVerifier.length);
+        if (!this.bytesEqual(this.hash(verifierPlain, "SHA1"), storedHash)) {
+            throw new Error("Incorrect password");
+        }
+        return this.decryptRc4Package(encryptedPackage, password, salt, keyBytes);
+    };
+    /** Standard key derivation (MS-OFFCRYPTO §2.3.4.7): iterated SHA1 then the X1‖X2 final block. */
+    CFBDecryptor.standardKey = function (password, salt, keyBytes) {
+        var SPIN_COUNT = 50000;
+        var h = this.hash(this.concatArrays(salt, this.stringToUtf16LE(password)), "SHA1");
+        for (var i = 0; i < SPIN_COUNT; i++) {
+            h = this.hash(this.concatArrays(this.le32(i), h), "SHA1");
+        }
+        var hfinal = this.hash(this.concatArrays(h, this.le32(0)), "SHA1");
+        var buf1 = new Uint8Array(64).fill(0x36);
+        var buf2 = new Uint8Array(64).fill(0x5c);
+        for (var i = 0; i < 20; i++) {
+            buf1[i] ^= hfinal[i];
+            buf2[i] ^= hfinal[i];
+        }
+        var x1 = this.hash(buf1, "SHA1");
+        var x2 = this.hash(buf2, "SHA1");
+        return this.concatArrays(x1, x2).slice(0, keyBytes);
+    };
+    CFBDecryptor.decryptStandardPackage = function (encryptedPackage, key) {
+        var sizeView = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
+        var packageSize = Number(sizeView.getBigUint64(0, true));
+        var decrypted = this.aesEcbDecrypt(encryptedPackage.subarray(8), key);
+        var trimmed = decrypted.subarray(0, packageSize);
+        var result = new ArrayBuffer(trimmed.byteLength);
+        new Uint8Array(result).set(trimmed);
+        return result;
+    };
+    /** RC4 CryptoAPI key derivation (MS-OFFCRYPTO §2.3.5.2). */
+    CFBDecryptor.rc4CryptoApiKey = function (password, salt, keyBytes, block) {
+        var h0 = this.hash(this.concatArrays(salt, this.stringToUtf16LE(password)), "SHA1");
+        var hfinal = this.hash(this.concatArrays(h0, this.le32(block)), "SHA1");
+        if (keyBytes === 5) {
+            var key = new Uint8Array(16);
+            key.set(hfinal.subarray(0, 5));
+            return key;
+        }
+        return hfinal.subarray(0, keyBytes);
+    };
+    CFBDecryptor.decryptRc4Package = function (encryptedPackage, password, salt, keyBytes) {
+        var RC4_BLOCK_LENGTH = 512;
+        var sizeView = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
+        var packageSize = Number(sizeView.getBigUint64(0, true));
+        var data = encryptedPackage.subarray(8);
+        var out = new Uint8Array(data.length);
+        // RC4 re-keys every 512 bytes of the encrypted package, using the block index.
+        for (var block = 0; block * RC4_BLOCK_LENGTH < data.length; block++) {
+            var start = block * RC4_BLOCK_LENGTH;
+            var end = Math.min(start + RC4_BLOCK_LENGTH, data.length);
+            var key = this.rc4CryptoApiKey(password, salt, keyBytes, block);
+            out.set(this.rc4(key, data.subarray(start, end)), start);
+        }
+        var trimmed = out.subarray(0, packageSize);
+        var result = new ArrayBuffer(trimmed.byteLength);
+        new Uint8Array(result).set(trimmed);
+        return result;
+    };
+    /** AES-ECB block decrypt (no padding). Trailing sub-block bytes are ignored. */
+    CFBDecryptor.aesEcbDecrypt = function (data, key) {
+        var aligned = data.length - (data.length % 16);
+        var cipher = ecb(key, { disablePadding: true });
+        return cipher.decrypt(data.subarray(0, aligned));
+    };
+    /** RC4 stream cipher (KSA + PRGA). Symmetric — the same op encrypts and decrypts. */
+    CFBDecryptor.rc4 = function (key, data) {
+        var s = new Uint8Array(256);
+        for (var i = 0; i < 256; i++)
+            s[i] = i;
+        var j = 0;
+        for (var i = 0; i < 256; i++) {
+            j = (j + s[i] + key[i % key.length]) & 0xff;
+            var t = s[i];
+            s[i] = s[j];
+            s[j] = t;
+        }
+        var out = new Uint8Array(data.length);
+        var a = 0;
+        var b = 0;
+        for (var k = 0; k < data.length; k++) {
+            a = (a + 1) & 0xff;
+            b = (b + s[a]) & 0xff;
+            var t = s[a];
+            s[a] = s[b];
+            s[b] = t;
+            out[k] = data[k] ^ s[(s[a] + s[b]) & 0xff];
+        }
+        return out;
+    };
+    CFBDecryptor.le32 = function (n) {
+        var b = new Uint8Array(4);
+        new DataView(b.buffer).setUint32(0, n >>> 0, true);
+        return b;
+    };
+    CFBDecryptor.bytesEqual = function (a, b) {
+        if (a.length !== b.length)
+            return false;
+        for (var i = 0; i < a.length; i++) {
+            if (a[i] !== b[i])
+                return false;
+        }
+        return true;
+    };
+    CFBDecryptor.parseEncryptionInfo = function (cfb) {
+        // Find EncryptionInfo stream
+        var encInfoEntry = cfb.FileIndex.find(function (entry) { return entry.name === "EncryptionInfo"; });
+        if (!encInfoEntry || !encInfoEntry.content) {
+            return null;
+        }
+        // CFB library returns content as array, convert to Uint8Array with proper buffer
+        var contentArray = encInfoEntry.content;
+        var content = contentArray instanceof Uint8Array
+            ? contentArray
+            : new Uint8Array(contentArray);
+        // Create a new buffer to ensure we have a proper ArrayBuffer
+        var buffer = new ArrayBuffer(content.length);
+        var bufferView = new Uint8Array(buffer);
+        bufferView.set(content);
+        var view = new DataView(buffer);
+        // Read version info
+        var versionMajor = view.getUint16(0, true);
+        var versionMinor = view.getUint16(2, true);
+        // Only support Agile encryption (version 4.4)
+        if (versionMajor !== 4 || versionMinor !== 4) {
+            throw new Error("Unsupported encryption version: ".concat(versionMajor, ".").concat(versionMinor, ". Only Agile encryption (4.4) is supported."));
+        }
+        // Parse XML encryption descriptor (starts at byte 8)
+        var xmlBytes = content.slice(8);
+        var xmlString = new TextDecoder().decode(xmlBytes);
+        var encInfo = this.parseAgileEncryptionXml(xmlString);
+        return encInfo;
+    };
+    CFBDecryptor.parseAgileEncryptionXml = function (xml) {
+        // Simple XML parsing for encryption parameters
+        var getAttr = function (tag, attr) {
+            // Match tag with optional namespace prefix (p:, x:, etc.)
+            // Use non-greedy match to avoid consuming the target attribute
+            var regex = new RegExp("<(?:\\w+:)?".concat(tag, "[^>]*?\\s+").concat(attr, "=\"([^\"]*)\""), "i");
+            var match = xml.match(regex);
+            if (!match) {
+                console.warn("Failed to find attribute ".concat(attr, " on tag ").concat(tag));
+                // Try alternative: attribute might be first after tag name
+                var altRegex = new RegExp("<(?:\\w+:)?".concat(tag, "\\s+").concat(attr, "=\"([^\"]*)\""), "i");
+                var altMatch = xml.match(altRegex);
+                return altMatch ? altMatch[1] : "";
+            }
+            return match ? match[1] : "";
+        };
+        var getBase64 = function (tag, attr) {
+            var base64 = getAttr(tag, attr);
+            if (!base64) {
+                console.warn("No base64 value found for ".concat(tag, ".").concat(attr));
+                return new Uint8Array(0);
+            }
+            try {
+                var binary = atob(base64);
+                var bytes = new Uint8Array(binary.length);
+                for (var i = 0; i < binary.length; i++) {
+                    bytes[i] = binary.charCodeAt(i);
+                }
+                return bytes;
+            }
+            catch (error) {
+                console.error("Failed to decode base64 for ".concat(tag, ".").concat(attr, ":"), error);
+                return new Uint8Array(0);
+            }
+        };
+        var algorithm = getAttr("keyData", "cipherAlgorithm") || "AES";
+        var keySize = parseInt(getAttr("keyData", "keyBits") || "256") / 8;
+        var blockSize = parseInt(getAttr("keyData", "blockSize") || "16");
+        var hashAlgorithm = getAttr("keyData", "hashAlgorithm") || "SHA512";
+        var hashSize = parseInt(getAttr("keyData", "hashSize") || "64");
+        var saltSize = parseInt(getAttr("keyData", "saltSize") || "16");
+        // TWO different salts are used:
+        // 1. passwordSalt from encryptedKey - for password derivation and verification
+        // 2. packageSalt from keyData - for package decryption IVs
+        var passwordSalt = getBase64("encryptedKey", "saltValue");
+        var packageSalt = getBase64("keyData", "saltValue");
+        // Get values from p:encryptedKey element
+        var spinCount = parseInt(getAttr("encryptedKey", "spinCount") || "100000");
+        var encryptedVerifierHashInput = getBase64("encryptedKey", "encryptedVerifierHashInput");
+        var encryptedVerifierHashValue = getBase64("encryptedKey", "encryptedVerifierHashValue");
+        var encryptedKeyValue = getBase64("encryptedKey", "encryptedKeyValue");
+        // Validate that all required values were parsed
+        if (!passwordSalt.length || !packageSalt.length) {
+            throw new Error("Failed to parse salt values from encryption info");
+        }
+        if (!encryptedVerifierHashInput.length ||
+            !encryptedVerifierHashValue.length ||
+            !encryptedKeyValue.length) {
+            throw new Error("Failed to parse encrypted verifier values from encryption info");
+        }
+        return {
+            algorithm: algorithm,
+            keySize: keySize,
+            blockSize: blockSize,
+            hashAlgorithm: hashAlgorithm,
+            hashSize: hashSize,
+            saltSize: saltSize,
+            passwordSalt: passwordSalt,
+            packageSalt: packageSalt,
+            encryptedVerifierHashInput: encryptedVerifierHashInput,
+            encryptedVerifierHashValue: encryptedVerifierHashValue,
+            encryptedKeyValue: encryptedKeyValue,
+            spinCount: spinCount,
+        };
+    };
+    CFBDecryptor.deriveKey = function (password, info) {
+        // Convert password to UTF-16LE
+        var passwordBytes = this.stringToUtf16LE(password);
+        // Initial hash H0 = H(passwordSalt + password)
+        // Use passwordSalt from encryptedKey, NOT packageSalt from keyData
+        var hash = this.hash(this.concatArrays(info.passwordSalt, passwordBytes), info.hashAlgorithm);
+        // Spin iteration: H(iterator + H(n-1))
+        for (var i = 0; i < info.spinCount; i++) {
+            var iterator = new Uint8Array(4);
+            new DataView(iterator.buffer).setUint32(0, i, true);
+            hash = this.hash(this.concatArrays(iterator, hash), info.hashAlgorithm);
+        }
+        // Return H_final (the result after spin iterations)
+        // Individual keys are derived from this using block keys
+        return hash;
+    };
+    CFBDecryptor.decryptEncryptedKey = function (passwordDerivedKey, info) {
+        var keyForKeyValue = this.deriveAgileBlockKey(passwordDerivedKey, BLOCK_KEY_ENCRYPTION_KEY, info);
+        // Agile encryption uses raw CBC block decryption (no PKCS padding).
+        var decryptedKey = this.decryptAESNoPadding(info.encryptedKeyValue, keyForKeyValue, info.passwordSalt.slice(0, 16));
+        return decryptedKey.slice(0, info.keySize);
+    };
+    CFBDecryptor.verifyPassword = function (passwordDerivedKey, info) {
+        try {
+            var keyForVerifierInput = this.deriveAgileBlockKey(passwordDerivedKey, BLOCK_KEY_VERIFIER_INPUT, info);
+            // Decrypt verifier hash input
+            var verifierHashInput = this.decryptAESNoPadding(info.encryptedVerifierHashInput, keyForVerifierInput, info.passwordSalt.slice(0, 16));
+            // Hash the decrypted verifier
+            var verifierHash = this.hash(verifierHashInput.slice(0, 16), info.hashAlgorithm);
+            var keyForVerifierValue = this.deriveAgileBlockKey(passwordDerivedKey, BLOCK_KEY_VERIFIER_HASH, info);
+            // Decrypt verifier hash value
+            var decryptedVerifierHash = this.decryptAESNoPadding(info.encryptedVerifierHashValue, keyForVerifierValue, info.passwordSalt.slice(0, 16));
+            // Compare hashes
+            var expectedHashLength = Math.min(info.hashSize, verifierHash.length, decryptedVerifierHash.length);
+            for (var i = 0; i < expectedHashLength; i++) {
+                if (verifierHash[i] !== decryptedVerifierHash[i]) {
+                    return false;
+                }
+            }
+            return true;
+        }
+        catch (error) {
+            console.error("Password verification error:", error);
+            return false;
+        }
+    };
+    CFBDecryptor.getEncryptedPackage = function (cfb) {
+        var entry = cfb.FileIndex.find(function (e) { return e.name === "EncryptedPackage" || e.name === "0EncryptedPackage"; });
+        if (!entry || !entry.content) {
+            throw new Error("EncryptedPackage stream not found");
+        }
+        // CFB library returns content as array, convert to proper Uint8Array
+        var contentArray = entry.content;
+        return contentArray instanceof Uint8Array
+            ? contentArray
+            : new Uint8Array(contentArray);
+    };
+    CFBDecryptor.decryptPackage = function (encrypted, key, info) {
+        var e_1, _a;
+        // Read the package size from the first 8 bytes
+        var sizeView = new DataView(encrypted.buffer, encrypted.byteOffset, 8);
+        var packageSize = Number(sizeView.getBigUint64(0, true));
+        // Skip the first 8 bytes (package size) to get encrypted data
+        var encryptedData = encrypted.slice(8);
+        // MS-OFFCRYPTO uses segmented decryption with 4096-byte blocks
+        var SEGMENT_LENGTH = 4096;
+        var totalSegments = Math.ceil(encryptedData.length / SEGMENT_LENGTH);
+        var decryptedSegments = [];
+        for (var i = 0; i < totalSegments; i++) {
+            var start = i * SEGMENT_LENGTH;
+            var end = Math.min(start + SEGMENT_LENGTH, encryptedData.length);
+            var segment = encryptedData.slice(start, end);
+            // Generate IV for this segment: hash(packageSalt + block number)
+            // Use packageSalt from keyData, NOT passwordSalt from encryptedKey
+            var blockNumber = new Uint8Array(4);
+            new DataView(blockNumber.buffer).setUint32(0, i, true);
+            var ivInput = this.concatArrays(info.packageSalt, blockNumber);
+            var ivHash = this.hash(ivInput, info.hashAlgorithm);
+            var iv = ivHash.slice(0, 16); // Use first 16 bytes as IV
+            // Decrypt this segment
+            var decryptedSegment = this.decryptAESNoPadding(segment, key, iv);
+            decryptedSegments.push(decryptedSegment);
+        }
+        // Concatenate all decrypted segments
+        var totalLength = decryptedSegments.reduce(function (sum, seg) { return sum + seg.length; }, 0);
+        var allDecrypted = new Uint8Array(totalLength);
+        var offset = 0;
+        try {
+            for (var decryptedSegments_1 = __values(decryptedSegments), decryptedSegments_1_1 = decryptedSegments_1.next(); !decryptedSegments_1_1.done; decryptedSegments_1_1 = decryptedSegments_1.next()) {
+                var seg = decryptedSegments_1_1.value;
+                allDecrypted.set(seg, offset);
+                offset += seg.length;
+            }
+        }
+        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+        finally {
+            try {
+                if (decryptedSegments_1_1 && !decryptedSegments_1_1.done && (_a = decryptedSegments_1.return)) _a.call(decryptedSegments_1);
+            }
+            finally { if (e_1) throw e_1.error; }
+        }
+        // Trim to actual package size (remove padding)
+        var trimmed = allDecrypted.slice(0, packageSize);
+        // Create a proper ArrayBuffer from the decrypted data
+        var result = new ArrayBuffer(trimmed.byteLength);
+        new Uint8Array(result).set(trimmed);
+        return result;
+    };
+    CFBDecryptor.decryptAESNoPadding = function (data, key, iv) {
+        var cipher = cbc(key, iv, { disablePadding: true });
+        return cipher.decrypt(data);
+    };
+    CFBDecryptor.deriveAgileBlockKey = function (passwordDerivedKey, blockKey, info) {
+        return this.hash(this.concatArrays(passwordDerivedKey, blockKey), info.hashAlgorithm).slice(0, info.keySize);
+    };
+    CFBDecryptor.hash = function (data, algorithm) {
+        switch (algorithm.toUpperCase()) {
+            case "SHA1":
+                return sha1(data);
+            case "SHA256":
+                return sha256(data);
+            case "SHA384":
+                return sha384(data);
+            case "SHA512":
+                return sha512(data);
+            default:
+                throw new Error("Unsupported hash algorithm: ".concat(algorithm));
+        }
+    };
+    CFBDecryptor.stringToUtf16LE = function (str) {
+        var bytes = new Uint8Array(str.length * 2);
+        for (var i = 0; i < str.length; i++) {
+            var code = str.charCodeAt(i);
+            bytes[i * 2] = code & 0xff;
+            bytes[i * 2 + 1] = (code >> 8) & 0xff;
+        }
+        return bytes;
+    };
+    CFBDecryptor.concatArrays = function () {
+        var e_2, _a;
+        var arrays = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+            arrays[_i] = arguments[_i];
+        }
+        var totalLength = arrays.reduce(function (sum, arr) { return sum + arr.length; }, 0);
+        var result = new Uint8Array(totalLength);
+        var offset = 0;
+        try {
+            for (var arrays_1 = __values(arrays), arrays_1_1 = arrays_1.next(); !arrays_1_1.done; arrays_1_1 = arrays_1.next()) {
+                var arr = arrays_1_1.value;
+                result.set(arr, offset);
+                offset += arr.length;
+            }
+        }
+        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+        finally {
+            try {
+                if (arrays_1_1 && !arrays_1_1.done && (_a = arrays_1.return)) _a.call(arrays_1);
+            }
+            finally { if (e_2) throw e_2.error; }
+        }
+        return result;
+    };
+    return CFBDecryptor;
+}());
+export { CFBDecryptor };

package/dist/cjs/excel-parser/cfb-encryptor.d.ts

@@ -0,0 +1,23 @@
+type EncryptOptions = {
+    spinCount?: number;
+};
+export declare class CFBEncryptor {
+    static encrypt(source: ArrayBuffer | Uint8Array, password: string, options?: EncryptOptions): Promise<Uint8Array>;
+    private static buildEncryptionInfoStream;
+    private static buildEncryptedPackageStream;
+    private static encryptPackage;
+    private static buildEncryptionXml;
+    private static derivePasswordKey;
+    private static deriveAgileBlockKey;
+    private static encryptDataIntegrityValue;
+    private static encryptAESNoPadding;
+    private static sha512Hash;
+    private static hmacSha512;
+    private static toBase64;
+    private static padToBlockSize;
+    private static stringToUtf16LE;
+    private static concatArrays;
+    private static randomBytes;
+}
+export {};
+//# sourceMappingURL=cfb-encryptor.d.ts.map

package/dist/cjs/excel-parser/cfb-encryptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfb-encryptor.d.ts","sourceRoot":"","sources":["../../../excel-parser/cfb-encryptor.ts"],"names":[],"mappings":"AAMA,KAAK,cAAc,GAAG;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAwBF,qBAAa,YAAY;WACV,OAAO,CAClB,MAAM,EAAE,WAAW,GAAG,UAAU,EAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC;IA4FtB,OAAO,CAAC,MAAM,CAAC,yBAAyB;IAWxC,OAAO,CAAC,MAAM,CAAC,2BAA2B;IAW1C,OAAO,CAAC,MAAM,CAAC,cAAc;IA0B7B,OAAO,CAAC,MAAM,CAAC,kBAAkB;IA6CjC,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAehC,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAUlC,OAAO,CAAC,MAAM,CAAC,yBAAyB;IAiBxC,OAAO,CAAC,MAAM,CAAC,mBAAmB;IASlC,OAAO,CAAC,MAAM,CAAC,UAAU;IAIzB,OAAO,CAAC,MAAM,CAAC,UAAU;IAIzB,OAAO,CAAC,MAAM,CAAC,QAAQ;IAQvB,OAAO,CAAC,MAAM,CAAC,cAAc;IAW7B,OAAO,CAAC,MAAM,CAAC,eAAe;IAU9B,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B,OAAO,CAAC,MAAM,CAAC,WAAW;CAc3B"}