clear-excel 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vladislav Ivanov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,180 @@
+# clear-excel
+
+`clear-excel` safely removes drawing-backed content and unused cell styles from
+OOXML `.xlsx` workbooks while preserving worksheet data and structure. It is a
+plain Node.js library with no framework or build-time requirement.
+
+## What it removes
+
+- drawings and images;
+- classic and threaded comments;
+- controls, OLE objects, VML drawings, and worksheet pictures;
+- threaded-comment person metadata;
+- unused `cellXfs` style records.
+
+Values, formulas and cached results, merged cells, worksheets, and styles that
+are still referenced by cells, rows, or columns are retained.
+
+## Requirements
+
+- Node.js 22 or newer;
+- OOXML `.xlsx` input.
+
+Legacy `.xls` files and macro-enabled `.xlsm` workbooks are intentionally not
+supported.
+
+## Installation
+
+```sh
+npm install clear-excel
+```
+
+## Buffer API
+
+ES modules:
+
+```js
+import { readFile, writeFile } from "node:fs/promises";
+import { sanitizeExcel } from "clear-excel";
+
+const input = await readFile("report.xlsx");
+const output = await sanitizeExcel(input);
+await writeFile("report.cleaned.xlsx", output);
+```
+
+CommonJS:
+
+```js
+const { readFile, writeFile } = require("node:fs/promises");
+const { sanitizeExcel } = require("clear-excel");
+
+const input = await readFile("report.xlsx");
+const output = await sanitizeExcel(input);
+await writeFile("report.cleaned.xlsx", output);
+```
+
+`sanitizeExcel` accepts a Node.js `Buffer`, returns a new `Buffer`, and never
+modifies the input buffer.
+
+## File API
+
+```js
+import { sanitizeExcelFile } from "clear-excel";
+
+await sanitizeExcelFile("report.xlsx", "report.cleaned.xlsx");
+```
+
+The input and output paths must be different and end in `.xlsx`. The output
+directory must already exist. An existing output file is not replaced unless
+`overwrite: true` is explicitly supplied:
+
+```js
+await sanitizeExcelFile("report.xlsx", "report.cleaned.xlsx", {
+  overwrite: true,
+  requireSingleWorksheet: true,
+});
+```
+
+## Options
+
+Both sanitizing functions accept these options:
+
+| Option | Type | Default | Description |
+| --- | --- | --- | --- |
+| `requireSingleWorksheet` | `boolean` | `false` | Reject workbooks that do not contain exactly one sheet. |
+| `limits` | `object` | See below | Override individual ZIP/XML safety limits. |
+
+`sanitizeExcelFile` additionally accepts `overwrite`, which defaults to
+`false`.
+
+The exported `DEFAULT_LIMITS` object contains the defaults:
+
+| Limit | Default |
+| --- | ---: |
+| `maxEntryCount` | 10,000 entries |
+| `maxUncompressedBytes` | 512 MiB |
+| `maxXmlBytes` | 512 MiB aggregate XML output |
+| `maxWorksheetXmlBytes` | 256 MiB per worksheet |
+| `maxStylesXmlBytes` | 64 MiB |
+| `maxMetadataXmlBytes` | 16 MiB per metadata part |
+| `maxRelationshipsXmlBytes` | 8 MiB per relationships part |
+
+Only specified values are overridden:
+
+```js
+const output = await sanitizeExcel(input, {
+  limits: {
+    maxUncompressedBytes: 128 * 1024 * 1024,
+    maxWorksheetXmlBytes: 64 * 1024 * 1024,
+  },
+});
+```
+
+Every limit must be a positive safe integer. Raising limits can significantly
+increase memory usage.
+
+## Errors
+
+Public functions reject with `ExcelSanitizationError`. Use its stable `code`
+instead of matching the English message:
+
+```js
+import { ExcelSanitizationError, sanitizeExcel } from "clear-excel";
+
+try {
+  await sanitizeExcel(input);
+} catch (error) {
+  if (error instanceof ExcelSanitizationError) {
+    console.error(error.code, error.details);
+  }
+  throw error;
+}
+```
+
+| Code | Meaning |
+| --- | --- |
+| `ERR_INVALID_ARGUMENT` | An argument or option has an invalid type or value. |
+| `ERR_UNSUPPORTED_EXTENSION` | A file path does not end in `.xlsx`. |
+| `ERR_INVALID_XLSX` | The ZIP/OOXML package is malformed or unsupported. |
+| `ERR_LIMIT_EXCEEDED` | A configured ZIP or XML limit was exceeded. |
+| `ERR_WORKSHEET_COUNT` | Exactly one worksheet was required. |
+| `ERR_SAME_PATH` | Input and output resolve to the same path. |
+| `ERR_OUTPUT_EXISTS` | Output exists and `overwrite` is false. |
+| `ERR_FILE_READ` | The input could not be read. |
+| `ERR_FILE_WRITE` | The sanitized output could not be written. |
+
+The original technical error is available through `error.cause` when one
+exists. Limit and worksheet-count failures also include structured `details`.
+
+## Security and memory model
+
+Before loading an archive, `clear-excel` validates the ZIP central directory,
+rejects ZIP64 and multi-disk archives, rejects unsafe entry paths, and checks
+declared entry counts and expansion sizes. Required XML parts are inflated
+lazily with both per-part and aggregate runtime budgets, including protection
+when ZIP size metadata has been forged.
+
+JSZip still loads the ZIP directory and regenerates the complete workbook in
+memory. Plan for memory usage above the input size, especially when increasing
+the defaults. The sanitizer does not evaluate formulas or execute embedded
+content.
+
+## Publishing
+
+Maintainers can verify the package locally with:
+
+```sh
+npm ci
+npm run check
+npm login
+npm publish
+```
+
+`npm run check` validates syntax, runs the tests, inspects `npm pack --dry-run`,
+and installs a temporary tarball to smoke-test both ESM and CommonJS exports.
+`prepublishOnly` runs the same checks automatically. npm credentials and
+publishing automation are deliberately not stored in this repository.
+
+## License
+
+MIT

package/index.cjs

@@ -0,0 +1,3 @@
+"use strict";
+
+module.exports = require("./src/index.cjs");

package/index.d.ts

@@ -0,0 +1,62 @@
+/// <reference types="node" />
+
+export interface ExcelSanitizationLimits {
+  maxEntryCount: number;
+  maxUncompressedBytes: number;
+  maxXmlBytes: number;
+  maxWorksheetXmlBytes: number;
+  maxStylesXmlBytes: number;
+  maxMetadataXmlBytes: number;
+  maxRelationshipsXmlBytes: number;
+}
+
+export interface SanitizeExcelOptions {
+  requireSingleWorksheet?: boolean;
+  limits?: Partial<ExcelSanitizationLimits>;
+}
+
+export interface SanitizeExcelFileOptions extends SanitizeExcelOptions {
+  overwrite?: boolean;
+}
+
+export type ExcelSanitizationErrorCode =
+  | "ERR_INVALID_ARGUMENT"
+  | "ERR_UNSUPPORTED_EXTENSION"
+  | "ERR_INVALID_XLSX"
+  | "ERR_LIMIT_EXCEEDED"
+  | "ERR_WORKSHEET_COUNT"
+  | "ERR_SAME_PATH"
+  | "ERR_OUTPUT_EXISTS"
+  | "ERR_FILE_READ"
+  | "ERR_FILE_WRITE";
+
+export interface ExcelSanitizationErrorOptions {
+  cause?: unknown;
+  details?: Readonly<Record<string, unknown>>;
+}
+
+export class ExcelSanitizationError extends Error {
+  constructor(
+    code: ExcelSanitizationErrorCode,
+    message: string,
+    options?: ExcelSanitizationErrorOptions,
+  );
+  readonly name: "ExcelSanitizationError";
+  readonly code: ExcelSanitizationErrorCode;
+  readonly details?: Readonly<Record<string, unknown>>;
+}
+
+export const DEFAULT_LIMITS: Readonly<ExcelSanitizationLimits>;
+
+export function isXlsxFilename(name: unknown): name is string;
+
+export function sanitizeExcel(
+  buffer: Buffer,
+  options?: SanitizeExcelOptions,
+): Promise<Buffer>;
+
+export function sanitizeExcelFile(
+  inputPath: string,
+  outputPath: string,
+  options?: SanitizeExcelFileOptions,
+): Promise<void>;

package/index.js

@@ -0,0 +1,7 @@
+import api from "./src/index.cjs";
+
+export const DEFAULT_LIMITS = api.DEFAULT_LIMITS;
+export const ExcelSanitizationError = api.ExcelSanitizationError;
+export const isXlsxFilename = api.isXlsxFilename;
+export const sanitizeExcel = api.sanitizeExcel;
+export const sanitizeExcelFile = api.sanitizeExcelFile;

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "clear-excel",
+  "version": "0.1.0",
+  "description": "Safely remove drawings, comments, embedded objects, and unused styles from XLSX workbooks.",
+  "author": "Vladislav Ivanov",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js",
+      "require": "./index.cjs"
+    }
+  },
+  "files": [
+    "index.js",
+    "index.cjs",
+    "index.d.ts",
+    "src/index.cjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Vlad1slav1vanov/clear-excel.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Vlad1slav1vanov/clear-excel/issues"
+  },
+  "homepage": "https://github.com/Vlad1slav1vanov/clear-excel#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "excel",
+    "xlsx",
+    "ooxml",
+    "sanitize",
+    "comments",
+    "images",
+    "styles"
+  ],
+  "scripts": {
+    "check:syntax": "node --check index.js && node --check index.cjs && node --check src/index.cjs",
+    "test": "node --test",
+    "pack:dry-run": "npm pack --dry-run",
+    "test:package": "node scripts/verify-package.cjs",
+    "check": "npm run check:syntax && npm test && npm run pack:dry-run && npm run test:package",
+    "prepublishOnly": "npm run check"
+  },
+  "dependencies": {
+    "jszip": "^3.10.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "exceljs": "^4.4.0"
+  },
+  "overrides": {
+    "uuid": "^11.1.1"
+  }
+}

package/src/index.cjs

@@ -0,0 +1,894 @@
+"use strict";
+
+const { randomUUID } = require("node:crypto");
+const fs = require("node:fs/promises");
+const { posix: packagePath, resolve: resolveFilePath, dirname } = require("node:path");
+const JSZip = require("jszip");
+
+const DRAWING_RELATIONSHIP_SUFFIXES = [
+  "/comments",
+  "/control",
+  "/drawing",
+  "/image",
+  "/oleObject",
+  "/threadedComment",
+  "/vmlDrawing",
+];
+const PERSON_RELATIONSHIP_SUFFIXES = ["/person"];
+const DRAWING_ELEMENTS = [
+  "controls",
+  "drawing",
+  "legacyDrawing",
+  "legacyDrawingHF",
+  "oleObjects",
+  "picture",
+];
+
+const ERROR_MESSAGES = Object.freeze({
+  ERR_INVALID_ARGUMENT: "Invalid argument",
+  ERR_UNSUPPORTED_EXTENSION: "Only .xlsx files are supported",
+  ERR_INVALID_XLSX: "Invalid or unsupported XLSX workbook",
+  ERR_LIMIT_EXCEEDED: "XLSX workbook exceeds a configured safety limit",
+  ERR_WORKSHEET_COUNT: "The workbook must contain exactly one worksheet",
+  ERR_SAME_PATH: "Input and output paths must be different",
+  ERR_OUTPUT_EXISTS: "The output file already exists",
+  ERR_FILE_READ: "Unable to read the input XLSX file",
+  ERR_FILE_WRITE: "Unable to write the sanitized XLSX file",
+});
+
+const DEFAULT_LIMITS = Object.freeze({
+  maxEntryCount: 10_000,
+  maxUncompressedBytes: 512 * 1024 * 1024,
+  maxXmlBytes: 512 * 1024 * 1024,
+  maxWorksheetXmlBytes: 256 * 1024 * 1024,
+  maxStylesXmlBytes: 64 * 1024 * 1024,
+  maxMetadataXmlBytes: 16 * 1024 * 1024,
+  maxRelationshipsXmlBytes: 8 * 1024 * 1024,
+});
+
+const SANITIZE_OPTION_NAMES = new Set(["requireSingleWorksheet", "limits"]);
+const FILE_OPTION_NAMES = new Set([
+  "requireSingleWorksheet",
+  "limits",
+  "overwrite",
+]);
+const LIMIT_NAMES = new Set(Object.keys(DEFAULT_LIMITS));
+
+class ExcelSanitizationError extends Error {
+  constructor(code, message, options = {}) {
+    super(message, options.cause === undefined ? undefined : { cause: options.cause });
+    this.name = "ExcelSanitizationError";
+    this.code = code;
+    if (options.details !== undefined) {
+      this.details = Object.freeze({ ...options.details });
+    }
+  }
+}
+
+function createError(code, options = {}) {
+  return new ExcelSanitizationError(
+    code,
+    options.message ?? ERROR_MESSAGES[code] ?? "Excel sanitization failed",
+    options,
+  );
+}
+
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function validateKnownKeys(value, knownKeys, label) {
+  for (const key of Object.keys(value)) {
+    if (!knownKeys.has(key)) {
+      throw createError("ERR_INVALID_ARGUMENT", {
+        message: `Unknown ${label}: ${key}`,
+        details: { key },
+      });
+    }
+  }
+}
+
+function normalizeLimits(overrides) {
+  if (overrides === undefined) {
+    return DEFAULT_LIMITS;
+  }
+  if (!isRecord(overrides)) {
+    throw createError("ERR_INVALID_ARGUMENT", {
+      message: "options.limits must be an object",
+    });
+  }
+  validateKnownKeys(overrides, LIMIT_NAMES, "limit");
+  const limits = { ...DEFAULT_LIMITS };
+  for (const [name, value] of Object.entries(overrides)) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw createError("ERR_INVALID_ARGUMENT", {
+        message: `options.limits.${name} must be a positive safe integer`,
+        details: { limit: name, value },
+      });
+    }
+    limits[name] = value;
+  }
+  return Object.freeze(limits);
+}
+
+function normalizeOptions(options, fileOptions = false) {
+  if (options === undefined) {
+    return {
+      requireSingleWorksheet: false,
+      limits: DEFAULT_LIMITS,
+      ...(fileOptions ? { overwrite: false } : {}),
+    };
+  }
+  if (!isRecord(options)) {
+    throw createError("ERR_INVALID_ARGUMENT", {
+      message: "options must be an object",
+    });
+  }
+  validateKnownKeys(
+    options,
+    fileOptions ? FILE_OPTION_NAMES : SANITIZE_OPTION_NAMES,
+    "option",
+  );
+  if (
+    options.requireSingleWorksheet !== undefined &&
+    typeof options.requireSingleWorksheet !== "boolean"
+  ) {
+    throw createError("ERR_INVALID_ARGUMENT", {
+      message: "options.requireSingleWorksheet must be a boolean",
+    });
+  }
+  if (
+    fileOptions &&
+    options.overwrite !== undefined &&
+    typeof options.overwrite !== "boolean"
+  ) {
+    throw createError("ERR_INVALID_ARGUMENT", {
+      message: "options.overwrite must be a boolean",
+    });
+  }
+  return {
+    requireSingleWorksheet: options.requireSingleWorksheet ?? false,
+    limits: normalizeLimits(options.limits),
+    ...(fileOptions ? { overwrite: options.overwrite ?? false } : {}),
+  };
+}
+
+function isXlsxFilename(name) {
+  return typeof name === "string" && name.toLowerCase().endsWith(".xlsx");
+}
+
+async function sanitizeExcel(buffer, options) {
+  if (!Buffer.isBuffer(buffer)) {
+    throw createError("ERR_INVALID_ARGUMENT", {
+      message: "buffer must be a Node.js Buffer",
+    });
+  }
+  const normalized = normalizeOptions(options);
+  try {
+    return await sanitizeOoxmlWorkbook(buffer, normalized);
+  } catch (error) {
+    if (error instanceof ExcelSanitizationError) {
+      throw error;
+    }
+    throw createError("ERR_INVALID_XLSX", { cause: error });
+  }
+}
+
+async function sanitizeExcelFile(inputPath, outputPath, options) {
+  if (
+    typeof inputPath !== "string" ||
+    inputPath.length === 0 ||
+    typeof outputPath !== "string" ||
+    outputPath.length === 0
+  ) {
+    throw createError("ERR_INVALID_ARGUMENT", {
+      message: "inputPath and outputPath must be non-empty strings",
+    });
+  }
+  if (!isXlsxFilename(inputPath) || !isXlsxFilename(outputPath)) {
+    throw createError("ERR_UNSUPPORTED_EXTENSION", {
+      details: { inputPath, outputPath },
+    });
+  }
+  const normalized = normalizeOptions(options, true);
+  const absoluteInputPath = resolveFilePath(inputPath);
+  const absoluteOutputPath = resolveFilePath(outputPath);
+  if (absoluteInputPath === absoluteOutputPath) {
+    throw createError("ERR_SAME_PATH", {
+      details: { inputPath: absoluteInputPath, outputPath: absoluteOutputPath },
+    });
+  }
+
+  let input;
+  try {
+    input = await fs.readFile(absoluteInputPath);
+  } catch (error) {
+    throw createError("ERR_FILE_READ", {
+      cause: error,
+      details: { inputPath: absoluteInputPath },
+    });
+  }
+
+  const sanitized = await sanitizeExcel(input, {
+    requireSingleWorksheet: normalized.requireSingleWorksheet,
+    limits: normalized.limits,
+  });
+
+  if (!normalized.overwrite) {
+    try {
+      await fs.writeFile(absoluteOutputPath, sanitized, { flag: "wx" });
+      return;
+    } catch (error) {
+      if (error?.code === "EEXIST") {
+        throw createError("ERR_OUTPUT_EXISTS", {
+          cause: error,
+          details: { outputPath: absoluteOutputPath },
+        });
+      }
+      await fs.unlink(absoluteOutputPath).catch(() => undefined);
+      throw createError("ERR_FILE_WRITE", {
+        cause: error,
+        details: { outputPath: absoluteOutputPath },
+      });
+    }
+  }
+
+  const temporaryPath = `${absoluteOutputPath}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(temporaryPath, sanitized, { flag: "wx" });
+    await fs.rename(temporaryPath, absoluteOutputPath);
+  } catch (error) {
+    await fs.unlink(temporaryPath).catch(() => undefined);
+    throw createError("ERR_FILE_WRITE", {
+      cause: error,
+      details: { outputPath: absoluteOutputPath },
+    });
+  }
+}
+
+async function sanitizeOoxmlWorkbook(buffer, options) {
+  const { limits, requireSingleWorksheet } = options;
+  if (!hasZipSignature(buffer)) {
+    throw new Error("Invalid OOXML ZIP container");
+  }
+  validateZipCentralDirectory(buffer, limits);
+  const readBudget = { consumedBytes: 0, limitBytes: limits.maxXmlBytes };
+
+  // CRC verification eagerly inflates every archive entry. Required XML parts
+  // are instead inflated lazily below and constrained by per-part budgets.
+  const zip = await JSZip.loadAsync(buffer);
+  const workbookXml = await requireXml(
+    zip,
+    "xl/workbook.xml",
+    readBudget,
+    limits.maxMetadataXmlBytes,
+  );
+  const workbookRelsPath = "xl/_rels/workbook.xml.rels";
+  const workbookRelsXml = await requireXml(
+    zip,
+    workbookRelsPath,
+    readBudget,
+    limits.maxRelationshipsXmlBytes,
+  );
+  const workbookRels = parseRelationships(workbookRelsXml, "xl/workbook.xml");
+  await requireXml(
+    zip,
+    "[Content_Types].xml",
+    readBudget,
+    limits.maxMetadataXmlBytes,
+  );
+
+  const sheetTags = workbookXml.match(/<(?:\w+:)?sheet\b[^>]*\/?>/gi) ?? [];
+  enforceWorksheetCount(sheetTags.length, requireSingleWorksheet);
+  if (sheetTags.length === 0) {
+    throw new Error("Workbook contains no sheets");
+  }
+  const relsById = new Map(workbookRels.map((relationship) => [relationship.id, relationship]));
+  const worksheetPaths = sheetTags.flatMap((sheetTag) => {
+    const id = getAttribute(sheetTag, "r:id");
+    const relationship = id ? relsById.get(id) : undefined;
+    return relationship?.type.endsWith("/worksheet")
+      ? [relationship.target]
+      : [];
+  });
+
+  const detachedRoots = new Set();
+  const cleanedWorkbookRels = removeRelationships(
+    workbookRelsXml,
+    "xl/workbook.xml",
+    PERSON_RELATIONSHIP_SUFFIXES,
+  );
+  zip.file(workbookRelsPath, cleanedWorkbookRels.xml);
+  for (const target of cleanedWorkbookRels.targets) {
+    detachedRoots.add(target);
+  }
+
+  const worksheetXmlByPath = new Map();
+  for (const worksheetPath of worksheetPaths) {
+    const worksheetXml = await requireXml(
+      zip,
+      worksheetPath,
+      readBudget,
+      limits.maxWorksheetXmlBytes,
+    );
+    const cleanedWorksheetXml = removeThreadedCommentExtensions(
+      removeWorksheetDrawingMarkup(worksheetXml),
+    );
+    worksheetXmlByPath.set(worksheetPath, cleanedWorksheetXml);
+    zip.file(worksheetPath, cleanedWorksheetXml);
+
+    const relationshipsPath = relationshipFileForPart(worksheetPath);
+    const relationshipsFile = zip.file(relationshipsPath);
+    if (relationshipsFile) {
+      const cleaned = removeRelationships(
+        await readXmlPart(
+          relationshipsFile,
+          relationshipsPath,
+          readBudget,
+          limits.maxRelationshipsXmlBytes,
+        ),
+        worksheetPath,
+        DRAWING_RELATIONSHIP_SUFFIXES,
+      );
+      zip.file(relationshipsPath, cleaned.xml);
+      for (const target of cleaned.targets) {
+        detachedRoots.add(target);
+      }
+    }
+  }
+
+  await removeUnreachableParts(zip, detachedRoots, readBudget, limits);
+  await removeUnusedCellStyles(zip, worksheetXmlByPath, readBudget, limits);
+  return zip.generateAsync({
+    type: "nodebuffer",
+    compression: "DEFLATE",
+    compressionOptions: { level: 6 },
+  });
+}
+
+function hasZipSignature(buffer) {
+  return buffer.length >= 2 && buffer[0] === 0x50 && buffer[1] === 0x4b;
+}
+
+function validateZipCentralDirectory(buffer, limits) {
+  const endOffset = findEndOfCentralDirectory(buffer);
+  if (endOffset === undefined || endOffset + 22 > buffer.length) {
+    throw new Error("ZIP end-of-central-directory record is missing");
+  }
+  const diskNumber = buffer.readUInt16LE(endOffset + 4);
+  const centralDirectoryDisk = buffer.readUInt16LE(endOffset + 6);
+  const entriesOnDisk = buffer.readUInt16LE(endOffset + 8);
+  const totalEntries = buffer.readUInt16LE(endOffset + 10);
+  const centralDirectorySize = buffer.readUInt32LE(endOffset + 12);
+  const centralDirectoryOffset = buffer.readUInt32LE(endOffset + 16);
+  const commentLength = buffer.readUInt16LE(endOffset + 20);
+  if (endOffset + 22 + commentLength > buffer.length) {
+    throw new Error("Truncated ZIP comment");
+  }
+  if (
+    diskNumber !== 0 ||
+    centralDirectoryDisk !== 0 ||
+    entriesOnDisk !== totalEntries
+  ) {
+    throw new Error("Multi-disk ZIP files are not supported");
+  }
+  if (
+    totalEntries === 0xffff ||
+    centralDirectorySize === 0xffffffff ||
+    centralDirectoryOffset === 0xffffffff ||
+    (endOffset >= 20 && buffer.readUInt32LE(endOffset - 20) === 0x07064b50)
+  ) {
+    throw new Error("ZIP64 files are not supported");
+  }
+  if (totalEntries > limits.maxEntryCount) {
+    throw limitExceeded("maxEntryCount", limits.maxEntryCount, totalEntries);
+  }
+
+  const centralDirectoryEnd = centralDirectoryOffset + centralDirectorySize;
+  if (
+    centralDirectoryOffset > endOffset ||
+    centralDirectoryEnd > endOffset ||
+    centralDirectoryEnd > buffer.length
+  ) {
+    throw new Error("Invalid ZIP central-directory bounds");
+  }
+
+  let entryOffset = centralDirectoryOffset;
+  let totalUncompressedSize = 0;
+  for (let index = 0; index < totalEntries; index += 1) {
+    if (
+      entryOffset + 46 > centralDirectoryEnd ||
+      buffer.readUInt32LE(entryOffset) !== 0x02014b50
+    ) {
+      throw new Error("Malformed ZIP central-directory entry");
+    }
+    const compressedSize = buffer.readUInt32LE(entryOffset + 20);
+    const uncompressedSize = buffer.readUInt32LE(entryOffset + 24);
+    const fileNameLength = buffer.readUInt16LE(entryOffset + 28);
+    const extraLength = buffer.readUInt16LE(entryOffset + 30);
+    const fileCommentLength = buffer.readUInt16LE(entryOffset + 32);
+    const entryDisk = buffer.readUInt16LE(entryOffset + 34);
+    const localHeaderOffset = buffer.readUInt32LE(entryOffset + 42);
+    if (
+      compressedSize === 0xffffffff ||
+      uncompressedSize === 0xffffffff ||
+      localHeaderOffset === 0xffffffff ||
+      entryDisk !== 0
+    ) {
+      throw new Error("ZIP64 or multi-disk entries are not supported");
+    }
+
+    const fileNameOffset = entryOffset + 46;
+    const extraOffset = fileNameOffset + fileNameLength;
+    const nextEntryOffset = extraOffset + extraLength + fileCommentLength;
+    if (nextEntryOffset > centralDirectoryEnd) {
+      throw new Error("Truncated ZIP central-directory entry");
+    }
+    validatePackageEntryName(
+      buffer.subarray(fileNameOffset, extraOffset).toString("utf8"),
+    );
+    rejectZip64ExtraFields(buffer, extraOffset, extraLength);
+    if (localHeaderOffset >= centralDirectoryOffset) {
+      throw new Error("Invalid ZIP local-header offset");
+    }
+
+    totalUncompressedSize += uncompressedSize;
+    if (totalUncompressedSize > limits.maxUncompressedBytes) {
+      throw limitExceeded(
+        "maxUncompressedBytes",
+        limits.maxUncompressedBytes,
+        totalUncompressedSize,
+      );
+    }
+    entryOffset = nextEntryOffset;
+  }
+  if (entryOffset !== centralDirectoryEnd) {
+    throw new Error("ZIP central-directory entry count is inconsistent");
+  }
+}
+
+function validatePackageEntryName(name) {
+  const normalized = name.replaceAll("\\", "/");
+  if (
+    normalized.includes("\0") ||
+    normalized.startsWith("/") ||
+    /^[A-Za-z]:\//.test(normalized) ||
+    normalized.split("/").includes("..")
+  ) {
+    throw new Error(`Unsafe ZIP entry name: ${name}`);
+  }
+}
+
+function findEndOfCentralDirectory(buffer) {
+  const minimumOffset = Math.max(0, buffer.length - 65_557);
+  for (let offset = buffer.length - 22; offset >= minimumOffset; offset -= 1) {
+    if (
+      buffer.readUInt32LE(offset) === 0x06054b50 &&
+      offset + 22 + buffer.readUInt16LE(offset + 20) === buffer.length
+    ) {
+      return offset;
+    }
+  }
+  return undefined;
+}
+
+function rejectZip64ExtraFields(buffer, extraOffset, extraLength) {
+  const extraEnd = extraOffset + extraLength;
+  let offset = extraOffset;
+  while (offset < extraEnd) {
+    if (offset + 4 > extraEnd) {
+      throw new Error("Malformed ZIP extra field");
+    }
+    const headerId = buffer.readUInt16LE(offset);
+    const fieldLength = buffer.readUInt16LE(offset + 2);
+    offset += 4;
+    if (offset + fieldLength > extraEnd) {
+      throw new Error("Truncated ZIP extra field");
+    }
+    if (headerId === 0x0001) {
+      throw new Error("ZIP64 files are not supported");
+    }
+    offset += fieldLength;
+  }
+}
+
+function limitExceeded(limit, configured, actual, partName) {
+  return createError("ERR_LIMIT_EXCEEDED", {
+    details: {
+      limit,
+      configured,
+      actual,
+      ...(partName === undefined ? {} : { partName }),
+    },
+  });
+}
+
+function enforceWorksheetCount(count, required) {
+  if (required && count !== 1) {
+    throw createError("ERR_WORKSHEET_COUNT", {
+      details: { expected: 1, actual: count },
+    });
+  }
+}
+
+async function requireXml(zip, partName, budget, partLimitBytes) {
+  const file = zip.file(partName);
+  if (!file) {
+    throw new Error(`Required workbook part is missing: ${partName}`);
+  }
+  return readXmlPart(file, partName, budget, partLimitBytes);
+}
+
+function readXmlPart(file, partName, budget, partLimitBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    const stream = file.internalStream("nodebuffer");
+    let partBytes = 0;
+    let settled = false;
+
+    const fail = (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      stream.pause();
+      reject(error);
+    };
+
+    stream
+      .on("data", (chunk) => {
+        if (settled) {
+          return;
+        }
+        partBytes += chunk.length;
+        budget.consumedBytes += chunk.length;
+        if (partBytes > partLimitBytes) {
+          fail(limitExceeded("partBytes", partLimitBytes, partBytes, partName));
+          return;
+        }
+        if (budget.consumedBytes > budget.limitBytes) {
+          fail(
+            limitExceeded(
+              "maxXmlBytes",
+              budget.limitBytes,
+              budget.consumedBytes,
+              partName,
+            ),
+          );
+          return;
+        }
+        chunks.push(Buffer.from(chunk));
+      })
+      .on("error", (error) => fail(error))
+      .on("end", () => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        resolve(Buffer.concat(chunks, partBytes).toString("utf8"));
+      })
+      .resume();
+  });
+}
+
+function removeWorksheetDrawingMarkup(xml) {
+  return DRAWING_ELEMENTS.reduce((result, name) => {
+    const element = new RegExp(
+      `<(?:\\w+:)?${name}\\b[^>]*(?:\\/\\s*>|>[\\s\\S]*?<\\/(?:\\w+:)?${name}\\s*>)`,
+      "gi",
+    );
+    return result.replace(element, "");
+  }, xml);
+}
+
+function removeThreadedCommentExtensions(xml) {
+  return xml.replace(
+    /<(?:\w+:)?ext\b[^>]*>[\s\S]*?<\/(?:\w+:)?ext\s*>/gi,
+    (extension) =>
+      /<(?:\w+:)?threadedComments?\b/i.test(extension) ? "" : extension,
+  );
+}
+
+function removeRelationships(xml, source, relationshipSuffixes) {
+  const targets = new Set();
+  const cleaned = xml.replace(
+    /<(?:\w+:)?Relationship\b[^>]*?(?:\/\s*>|>\s*<\/(?:\w+:)?Relationship\s*>)/gi,
+    (tag) => {
+      const type = getAttribute(tag, "Type") ?? "";
+      const target = getAttribute(tag, "Target");
+      const targetMode = getAttribute(tag, "TargetMode");
+      if (
+        !target ||
+        targetMode?.toLowerCase() === "external" ||
+        !relationshipSuffixes.some((suffix) => type.endsWith(suffix))
+      ) {
+        return tag;
+      }
+      targets.add(resolveTarget(source, target));
+      return "";
+    },
+  );
+  return { xml: cleaned, targets };
+}
+
+function parseRelationships(xml, source) {
+  return Array.from(
+    xml.matchAll(
+      /<(?:\w+:)?Relationship\b([^>]*?)(?:\/\s*>|>\s*<\/(?:\w+:)?Relationship\s*>)/gi,
+    ),
+  ).flatMap((match) => {
+    const attributes = match[1];
+    const id = getAttribute(attributes, "Id");
+    const target = getAttribute(attributes, "Target");
+    const type = getAttribute(attributes, "Type");
+    if (!id || !target || !type) {
+      return [];
+    }
+    const targetMode = getAttribute(attributes, "TargetMode");
+    return [
+      {
+        id,
+        target:
+          targetMode?.toLowerCase() === "external"
+            ? target
+            : resolveTarget(source, target),
+        targetMode,
+        type,
+      },
+    ];
+  });
+}
+
+function getAttribute(xml, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = xml.match(
+    new RegExp(`(?:^|\\s)${escaped}\\s*=\\s*(["'])(.*?)\\1`, "i"),
+  );
+  return match ? decodeXml(match[2]) : undefined;
+}
+
+function decodeXml(value) {
+  return value
+    .replaceAll("&amp;", "&")
+    .replaceAll("&quot;", '"')
+    .replaceAll("&apos;", "'")
+    .replaceAll("&lt;", "<")
+    .replaceAll("&gt;", ">");
+}
+
+function resolveTarget(source, target) {
+  const resolved = target.startsWith("/")
+    ? packagePath.normalize(target.slice(1))
+    : packagePath.normalize(packagePath.join(packagePath.dirname(source), target));
+  if (resolved === ".." || resolved.startsWith("../")) {
+    throw new Error(`Relationship target escapes package: ${target}`);
+  }
+  return resolved;
+}
+
+function relationshipFileForPart(partName) {
+  return packagePath.join(
+    packagePath.dirname(partName),
+    "_rels",
+    `${packagePath.basename(partName)}.rels`,
+  );
+}
+
+function sourcePartForRelationshipFile(fileName) {
+  if (fileName === "_rels/.rels") {
+    return "";
+  }
+  const match = fileName.match(/^(.*\/)_rels\/([^/]+)\.rels$/);
+  return match ? `${match[1]}${match[2]}` : undefined;
+}
+
+async function removeUnreachableParts(zip, detachedRoots, readBudget, limits) {
+  if (detachedRoots.size === 0) {
+    return;
+  }
+  const graph = new Map();
+  for (const fileName of Object.keys(zip.files)) {
+    if (!fileName.endsWith(".rels")) {
+      continue;
+    }
+    const source = sourcePartForRelationshipFile(fileName);
+    const file = zip.file(fileName);
+    if (source !== undefined && file) {
+      graph.set(
+        source,
+        parseRelationships(
+          await readXmlPart(
+            file,
+            fileName,
+            readBudget,
+            limits.maxRelationshipsXmlBytes,
+          ),
+          source,
+        ),
+      );
+    }
+  }
+
+  const candidates = collectReachableParts(detachedRoots, graph);
+  const packageReachable = collectReachableParts(new Set([""]), graph);
+  packageReachable.delete("");
+  const deletedParts = new Set(
+    [...candidates].filter((partName) => !packageReachable.has(partName)),
+  );
+  for (const partName of deletedParts) {
+    zip.remove(partName);
+    zip.remove(relationshipFileForPart(partName));
+  }
+
+  const contentTypes = await requireXml(
+    zip,
+    "[Content_Types].xml",
+    readBudget,
+    limits.maxMetadataXmlBytes,
+  );
+  zip.file(
+    "[Content_Types].xml",
+    contentTypes.replace(/<(?:\w+:)?Override\b[^>]*\/>/gi, (tag) => {
+      const partName = getAttribute(tag, "PartName")?.replace(/^\//, "");
+      return partName && deletedParts.has(partName) ? "" : tag;
+    }),
+  );
+}
+
+function collectReachableParts(initial, graph) {
+  const reachable = new Set(initial);
+  const pending = [...initial];
+  while (pending.length > 0) {
+    const source = pending.pop();
+    if (source === undefined) {
+      continue;
+    }
+    for (const relationship of graph.get(source) ?? []) {
+      if (
+        relationship.targetMode?.toLowerCase() !== "external" &&
+        !reachable.has(relationship.target)
+      ) {
+        reachable.add(relationship.target);
+        pending.push(relationship.target);
+      }
+    }
+  }
+  return reachable;
+}
+
+async function removeUnusedCellStyles(zip, worksheets, readBudget, limits) {
+  const stylesFile = zip.file("xl/styles.xml");
+  if (!stylesFile) {
+    return;
+  }
+  const usedStyles = new Set([0]);
+  for (const xml of worksheets.values()) {
+    collectStyleReferences(xml, usedStyles);
+  }
+
+  const stylesXml = await readXmlPart(
+    stylesFile,
+    "xl/styles.xml",
+    readBudget,
+    limits.maxStylesXmlBytes,
+  );
+  const cellXfs = findCollection(stylesXml, "cellXfs");
+  if (!cellXfs) {
+    return;
+  }
+  const xfs = matchElements(cellXfs.body, "xf");
+  const retainedIndexes = [...usedStyles].sort((left, right) => left - right);
+  if (
+    retainedIndexes.some(
+      (index) => !Number.isInteger(index) || index < 0 || index >= xfs.length,
+    )
+  ) {
+    throw new Error(
+      `Worksheet references an invalid style index (${retainedIndexes.join(",")} of ${xfs.length})`,
+    );
+  }
+  const indexMap = new Map(
+    retainedIndexes.map((oldIndex, newIndex) => [oldIndex, newIndex]),
+  );
+  zip.file(
+    "xl/styles.xml",
+    replaceCollection(
+      stylesXml,
+      "cellXfs",
+      retainedIndexes.map((index) => xfs[index]).join(""),
+      retainedIndexes.length,
+    ),
+  );
+  for (const [worksheetPath, xml] of worksheets) {
+    zip.file(worksheetPath, remapWorksheetStyles(xml, indexMap));
+  }
+}
+
+function collectStyleReferences(xml, references) {
+  for (const tag of xml.match(/<(?:\w+:)?(?:c|row)\b[^>]*>/gi) ?? []) {
+    const value = getAttribute(tag, "s");
+    if (value !== undefined) {
+      references.add(Number(value));
+    }
+  }
+  for (const tag of xml.match(/<(?:\w+:)?col\b[^>]*>/gi) ?? []) {
+    const value = getAttribute(tag, "style");
+    if (value !== undefined) {
+      references.add(Number(value));
+    }
+  }
+}
+
+function remapWorksheetStyles(xml, indexMap) {
+  return xml
+    .replace(/<(?:\w+:)?(?:c|row)\b[^>]*>/gi, (tag) =>
+      remapNumericAttribute(tag, "s", indexMap),
+    )
+    .replace(/<(?:\w+:)?col\b[^>]*>/gi, (tag) =>
+      remapNumericAttribute(tag, "style", indexMap),
+    );
+}
+
+function remapNumericAttribute(tag, attributeName, indexMap) {
+  const expression = new RegExp(
+    `(\\s${attributeName}\\s*=\\s*)(["'])(\\d+)\\2`,
+    "i",
+  );
+  return tag.replace(expression, (match, prefix, quote, value) => {
+    const remapped = indexMap.get(Number(value));
+    return remapped === undefined
+      ? match
+      : `${prefix}${quote}${remapped}${quote}`;
+  });
+}
+
+function findCollection(xml, name) {
+  const match = xml.match(
+    new RegExp(
+      `<(?:\\w+:)?${name}\\b[^>]*>([\\s\\S]*?)<\\/(?:\\w+:)?${name}\\s*>`,
+      "i",
+    ),
+  );
+  if (!match) {
+    return undefined;
+  }
+  return {
+    body: match[1],
+    full: match[0],
+    opening: match[0].slice(0, match[0].indexOf(">") + 1),
+  };
+}
+
+function replaceCollection(xml, name, body, count) {
+  const collection = findCollection(xml, name);
+  if (!collection) {
+    return xml;
+  }
+  const opening = /\bcount\s*=/.test(collection.opening)
+    ? collection.opening.replace(
+        /(\bcount\s*=\s*)(["'])\d+\2/i,
+        `$1"${count}"`,
+      )
+    : collection.opening.replace(/>$/, ` count="${count}">`);
+  const prefix = collection.opening.match(/^<(\w+:)/)?.[1] ?? "";
+  return xml.replace(collection.full, `${opening}${body}</${prefix}${name}>`);
+}
+
+function matchElements(xml, name) {
+  return (
+    xml.match(
+      new RegExp(
+        `<(?:\\w+:)?${name}\\b[^>]*\\/\\s*>|<(?:\\w+:)?${name}\\b[^>]*>[\\s\\S]*?<\\/(?:\\w+:)?${name}\\s*>`,
+        "gi",
+      ),
+    ) ?? []
+  );
+}
+
+module.exports = {
+  DEFAULT_LIMITS,
+  ExcelSanitizationError,
+  isXlsxFilename,
+  sanitizeExcel,
+  sanitizeExcelFile,
+};