stegdoc 5.5.0 → 5.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stegdoc",
-  "version": "5.5.0",
+  "version": "5.7.0",
   "description": "Hide files inside Office documents (XLSX/DOCX) with AES-256 encryption and steganography",
   "main": "src/index.js",
   "bin": {
@@ -50,7 +50,6 @@
     "chalk": "^4.1.2",
     "commander": "^14.0.2",
     "docx": "^9.5.1",
-    "exceljs": "^4.4.0",
     "fast-xml-parser": "^5.3.3",
     "file-type": "^16.5.4",
     "inquirer": "^8.2.6",

package/src/commands/encode.js

@@ -5,7 +5,7 @@ const chalk = require('chalk');
 const ora = require('ora');
 const AdmZip = require('adm-zip');
 const { createDocxWithBase64, createDocxV5 } = require('../lib/docx-handler');
-const { createXlsxPartStreaming, createXlsxPartV5 } = require('../lib/xlsx-handler');
+const { createXlsxPartV5 } = require('../lib/xlsx-handler');
 const { createMetadata, serializeMetadata } = require('../lib/metadata');
 const crypto = require('crypto');
 const { generateHash, parseSizeToBytes, formatBytes, generateFilename } = require('../lib/utils');
@@ -143,7 +143,7 @@ async function encodeCommand(inputFile, options) {
       if (format === 'docx') {
         await encodeLegacyDocx(streamSource, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles);
       } else {
-        await encodeLegacyXlsx(streamSource, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles);
+        throw new Error('Legacy XLSX format (--legacy) is no longer supported. Use v5 format (default) or legacy DOCX (-f docx --legacy).');
       }
       if (tempZipPath) cleanupTemp(tempZipPath);
       return;
@@ -356,168 +356,6 @@ async function encodeCommand(inputFile, options) {
   }
 }
 
-// ─── Legacy v4 XLSX Pipeline ────────────────────────────────────────────────
-
-async function encodeLegacyXlsx(inputPath, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles) {
-  const hash = generateHash();
-  const outputDir = options.outputDir || process.cwd();
-  const format = 'xlsx';
-  const chunkInput = (options.chunkSize || '').toString().trim();
-
-  // Parse chunk size
-  const chunkInputLower = chunkInput.toLowerCase();
-  let chunkSizeBytes;
-
-  if (chunkInputLower === '0' || chunkInputLower === 'max' || chunkInputLower === 'single' || chunkInputLower === 'none' || chunkInputLower === '') {
-    chunkSizeBytes = Infinity;
-  } else if (/^\d+\s*parts?$/i.test(chunkInput)) {
-    const numParts = parseInt(chunkInput, 10);
-    if (numParts < 1) throw new Error('Number of parts must be at least 1');
-    const estimatedBase64Size = Math.ceil(fileSize * 4 / 3);
-    chunkSizeBytes = Math.ceil(estimatedBase64Size / numParts);
-    spinner.info && spinner.info(`Splitting into ~${numParts} parts (~${formatBytes(chunkSizeBytes)} content each)`);
-  } else if (chunkInput) {
-    chunkSizeBytes = parseSizeToBytes(chunkInput);
-  } else {
-    chunkSizeBytes = 5 * 1024 * 1024;
-  }
-
-  spinner.text = 'Computing file hash...';
-  const contentHash = await computeFileHash(inputPath);
-
-  const sessionSalt = useEncryption ? generateSalt() : null;
-
-  spinner.text = useCompression ? 'Compressing and encoding (legacy v4)...' : 'Encoding (legacy v4)...';
-
-  const partFiles = [];
-
-  if (useEncryption) {
-    const binaryChunkSize = chunkSizeBytes === Infinity ? Infinity : Math.floor(chunkSizeBytes * 3 / 4);
-
-    const onBinaryChunkReady = async (binaryBuffer, index) => {
-      const partNumber = index + 1;
-      const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
-
-      const { stream: cipher, iv, salt, getAuthTag } = createEncryptStream(options.password, sessionSalt);
-      const encrypted = Buffer.concat([cipher.update(binaryBuffer), cipher.final()]);
-      const authTag = getAuthTag();
-      const base64Chunk = encrypted.toString('base64');
-
-      const metadata = createMetadata({
-        originalFilename: filename,
-        originalExtension: extension,
-        hash,
-        partNumber,
-        totalParts: null,
-        originalSize: fileSize,
-        format,
-        encrypted: true,
-        compressed: useCompression,
-        contentHash,
-      });
-
-      const encryptionMeta = packEncryptionMeta({ iv, salt, authTag });
-      const outputFilename = generateFilename(hash, partNumber, null, format);
-      const outputPath = path.join(outputDir, outputFilename);
-
-      if (fs.existsSync(outputPath) && !options.force) {
-        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-      }
-
-      await createXlsxPartStreaming({
-        base64Content: base64Chunk,
-        encryptionMeta,
-        metadataJson: serializeMetadata(metadata),
-        outputPath,
-      });
-
-      partFiles.push(outputPath);
-      createdFiles.push(outputPath);
-      partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
-    };
-
-    const collector = new BinaryChunkCollector(binaryChunkSize, onBinaryChunkReady);
-    const streams = [fs.createReadStream(inputPath)];
-    if (!quiet) {
-      streams.push(new ProgressTransform(fileSize, (processed, total) => {
-        const pct = Math.min(100, Math.round((processed / total) * 100));
-        spinner.text = `Compressing (legacy v4)... ${formatBytes(processed)} / ${formatBytes(total)} (${pct}%)`;
-      }));
-    }
-    if (useCompression) streams.push(createCompressStream());
-    streams.push(collector);
-    await pipeline(...streams);
-  } else {
-    const onChunkReady = async (base64Chunk, index) => {
-      const partNumber = index + 1;
-      const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
-
-      const metadata = createMetadata({
-        originalFilename: filename,
-        originalExtension: extension,
-        hash,
-        partNumber,
-        totalParts: null,
-        originalSize: fileSize,
-        format,
-        encrypted: false,
-        compressed: useCompression,
-        contentHash,
-      });
-
-      const outputFilename = generateFilename(hash, partNumber, null, format);
-      const outputPath = path.join(outputDir, outputFilename);
-
-      if (fs.existsSync(outputPath) && !options.force) {
-        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-      }
-
-      await createXlsxPartStreaming({
-        base64Content: base64Chunk,
-        encryptionMeta: '',
-        metadataJson: serializeMetadata(metadata),
-        outputPath,
-      });
-
-      partFiles.push(outputPath);
-      createdFiles.push(outputPath);
-      partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
-    };
-
-    const collector = new ChunkCollector(chunkSizeBytes, onChunkReady);
-    const streams = [fs.createReadStream(inputPath)];
-    if (!quiet) {
-      streams.push(new ProgressTransform(fileSize, (processed, total) => {
-        const pct = Math.min(100, Math.round((processed / total) * 100));
-        spinner.text = `Encoding (legacy v4)... ${formatBytes(processed)} / ${formatBytes(total)} (${pct}%)`;
-      }));
-    }
-    if (useCompression) streams.push(createCompressStream());
-    streams.push(new Base64EncodeTransform());
-    streams.push(collector);
-    await pipeline(...streams);
-  }
-
-  const totalParts = partFiles.length;
-  spinner.succeed && spinner.succeed('Encoding complete!');
-
-  if (!quiet) {
-    console.log();
-    console.log(chalk.green.bold('✓ File encoded successfully!'));
-    console.log(chalk.cyan(`  Format: XLSX (v4 legacy)`));
-    console.log(chalk.cyan(`  Hash: ${hash}`));
-    if (totalParts > 1) {
-      console.log(chalk.cyan(`  Parts: ${totalParts}`));
-    }
-    console.log(chalk.cyan(`  Encrypted: ${useEncryption ? 'Yes' : 'No'}`));
-    console.log(chalk.cyan(`  Compressed: ${useCompression ? 'Yes (gzip)' : 'No'}`));
-    console.log(chalk.cyan(`  Location: ${outputDir}`));
-    if (useEncryption) {
-      console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
-    }
-  }
-}
-
 // ─── Legacy v4 DOCX Pipeline ────────────────────────────────────────────────
 
 async function encodeLegacyDocx(inputPath, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles) {

package/src/index.js

@@ -11,7 +11,7 @@ const verifyCommand = require('./commands/verify');
 program
   .name('stegdoc')
   .description('CLI tool to encode files into Office documents with AES-256 encryption')
-  .version('5.5.0');
+  .version('5.6.0');
 
 // Encode command
 program

package/src/lib/log-generator.js

@@ -46,23 +46,22 @@ const IP_POOL_RARE = [
 // ─── User-Agent Pool ────────────────────────────────────────────────────────
 
 const USER_AGENTS = [
-  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36',
-  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36',
-  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36',
-  'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0',
-  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15',
-  'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36',
-  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/122.0.0.0 Safari/537.36',
-  'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0',
-  'Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1',
-  'Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36',
-  // Bots (occasional)
-  'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',
-  'Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)',
+  'node-fetch/3.3.2',
+  'axios/1.7.2',
+  'python-httpx/0.27.0',
+  'Go-http-client/2.0',
+  'curl/8.5.0',
+  'python-requests/2.31.0',
+  'okhttp/4.12.0',
+  'got/14.2.1',
+  'undici/6.13.0',
+  'httpie/3.2.2',
+  'wget/1.21.4',
+  'PostmanRuntime/7.36.3',
 ];
 
-// Weights for UA selection (frequent browsers appear more)
-const UA_WEIGHTS = [20, 15, 12, 10, 8, 7, 6, 5, 4, 3, 1, 1];
+// Weights for UA selection (common API clients appear more)
+const UA_WEIGHTS = [20, 18, 15, 12, 10, 8, 6, 4, 3, 2, 1, 1];
 
 // ─── URL Path Templates (for data lines) ───────────────────────────────────
 
@@ -620,8 +619,8 @@ function encodePayloadToLogLines(payloadBuffer, metadataJson, encryptionMeta) {
     dataRows.push(generateDataLogLine(chunk));
   }
 
-  // Generate filler lines for realism
-  const fillerCount = Math.max(30, Math.floor(dataLineCount * 0.2));
+  // Generate filler lines for realism (3% — enough for variation, minimal overhead)
+  const fillerCount = Math.max(10, Math.floor(dataLineCount * 0.03));
   const fillerRows = [];
   for (let i = 0; i < fillerCount; i++) {
     fillerRows.push(generateFillerLogLine());

package/src/lib/xlsx-handler.js

@@ -1,16 +1,11 @@
-const ExcelJS = require('exceljs');
 const fs = require('fs');
 const path = require('path');
 const AdmZip = require('adm-zip');
-const { generateDecoyHeaders, generateDecoyData, calculateDecoyRowCount, rowToArray, resetTimeWindow } = require('./decoy-generator');
 const { generateLogHeaders, encodePayloadToLogLines, decodeLogLines, resetTimeState } = require('./log-generator');
 const { parseXmlFromZip, ensureArray, extractTextContent } = require('./xml-utils');
+const { createXlsxRaw } = require('./xlsx-writer');
 
-// Constants for data storage
-const HIDDEN_SHEET_NAME = 'Data';
-const VISIBLE_SHEET_NAME = 'Server Metrics';
 const V5_SHEET_NAME = 'Access Logs';
-const CELL_CHUNK_SIZE = 32000; // Max characters per cell (~32KB)
 
 // ─── v5 Log-Embed Format ───────────────────────────────────────────────────
 
@@ -29,88 +24,23 @@ const CELL_CHUNK_SIZE = 32000; // Max characters per cell (~32KB)
 async function createXlsxPartV5(options) {
   const { payloadBuffer, encryptionMeta, metadataJson, outputPath } = options;
 
-  // Ensure output directory exists
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  const workbook = new ExcelJS.stream.xlsx.WorkbookWriter({
-    filename: outputPath,
-    useSharedStrings: false,
-  });
-
-  workbook.creator = 'Microsoft Excel';
-  workbook.lastModifiedBy = 'Microsoft Excel';
-  workbook.created = new Date();
-  workbook.modified = new Date();
-
-  // === Single Sheet: Access Logs ===
-  const sheet = workbook.addWorksheet(V5_SHEET_NAME, {
-    properties: { tabColor: { argb: '2F5496' } },
-  });
-
-  // Column widths for log data
-  sheet.columns = [
-    { width: 16 },  // Remote Address
-    { width: 28 },  // Timestamp
-    { width: 8 },   // Method
-    { width: 90 },  // Request (contains URL with payload)
-    { width: 7 },   // Status
-    { width: 8 },   // Bytes
-    { width: 65 },  // Referer
-    { width: 85 },  // User-Agent
-    { width: 38 },  // X-Request-ID
-    { width: 34 },  // X-Trace-ID
-  ];
-
-  // Header row with styling
-  const headers = generateLogHeaders();
-  const headerRow = sheet.addRow(headers);
-  for (let col = 1; col <= headers.length; col++) {
-    const cell = headerRow.getCell(col);
-    cell.font = { bold: true, size: 10, color: { argb: 'FFFFFF' }, name: 'Consolas' };
-    cell.fill = {
-      type: 'pattern',
-      pattern: 'solid',
-      fgColor: { argb: '2F5496' },
-    };
-  }
-  headerRow.commit();
-
   // Generate all log lines (header + data + filler)
   const { headerRows, dataRows, fillerRows } = encodePayloadToLogLines(
     payloadBuffer, metadataJson, encryptionMeta
   );
 
-  // Write header lines (metadata)
-  for (const row of headerRows) {
-    const r = sheet.addRow(row);
-    r.commit();
-  }
-
-  // Write data lines (payload)
-  for (const row of dataRows) {
-    const r = sheet.addRow(row);
-    r.commit();
-  }
-
-  // Write filler lines (realistic padding)
-  for (const row of fillerRows) {
-    const r = sheet.addRow(row);
-    r.commit();
-  }
-
-  const totalRows = headerRows.length + dataRows.length + fillerRows.length;
-
-  // Add filters
-  sheet.autoFilter = {
-    from: 'A1',
-    to: `J${totalRows + 1}`,
-  };
-
-  await sheet.commit();
-  await workbook.commit();
+  const headers = generateLogHeaders();
+  const allRows = [...headerRows, ...dataRows, ...fillerRows];
+
+  // Build XLSX from raw XML (no ExcelJS — passes air gap filters)
+  createXlsxRaw({
+    headers,
+    rows: allRows,
+    sheetName: V5_SHEET_NAME,
+    outputPath,
+    colWidths: [16, 28, 8, 90, 7, 8, 65, 85, 38, 34],
+    autoFilter: true,
+  });
 
   return outputPath;
 }
@@ -130,17 +60,17 @@ async function readXlsxV5(xlsxPath) {
   const fileBuffer = fs.readFileSync(xlsxPath);
   const zip = new AdmZip(fileBuffer);
 
-  // Parse shared strings (only if present — v5 files created with useSharedStrings:false may not have them)
+  // Parse shared strings — handles both normal and namespace-prefixed XML (ns0:si, ns0:t)
   let sharedStrings = null;
   const ssEntry = zip.getEntry('xl/sharedStrings.xml');
   if (ssEntry) {
     sharedStrings = [];
     const ssXml = ssEntry.getData().toString('utf8');
-    // Fast extract: match each <si><t>...</t></si> or <si><t ...>...</t></si>
-    const siRegex = /<si><t[^>]*>([^<]*)<\/t><\/si>/g;
+    // Match <si><t>...</t></si> or <ns0:si><ns0:t>...</ns0:t></ns0:si> (any nsN prefix)
+    const siRegex = /<(?:\w+:)?si><(?:\w+:)?t[^>]*>([^<]*)<\/(?:\w+:)?t><\/(?:\w+:)?si>/g;
     let match;
     while ((match = siRegex.exec(ssXml)) !== null) {
-      sharedStrings.push(match[1]);
+      sharedStrings.push(decodeXmlEntities(match[1]));
     }
   }
 
@@ -151,10 +81,10 @@ async function readXlsxV5(xlsxPath) {
   }
   const sheetXml = sheetEntry.getData().toString('utf8');
 
-  // Fast row extraction using regex — much faster than full DOM parsing
+  // Fast row extraction using regex — handles both normal and namespace-prefixed XML
   const allRows = [];
-  const rowRegex = /<row [^>]*>(.*?)<\/row>/gs;
-  const cellRegex = /<c r="([A-Z]+)\d+"(?: t="([^"]*)")?[^>]*>(?:<v>([^<]*)<\/v>|<is><t[^>]*>([^<]*)<\/t><\/is>)?<\/c>/g;
+  const rowRegex = /<(?:\w+:)?row [^>]*>(.*?)<\/(?:\w+:)?row>/gs;
+  const cellRegex = /<(?:\w+:)?c r="([A-Z]+)\d+"(?: t="([^"]*)")?[^>]*>(?:<(?:\w+:)?v>([^<]*)<\/(?:\w+:)?v>|<(?:\w+:)?is><(?:\w+:)?t[^>]*>([^<]*)<\/(?:\w+:)?t><\/(?:\w+:)?is>)?<\/(?:\w+:)?c>/g;
 
   let rowMatch;
   while ((rowMatch = rowRegex.exec(sheetXml)) !== null) {
@@ -251,201 +181,7 @@ function detectXlsxVersion(xlsxPath) {
   return 'v5';
 }
 
-// ─── v3/v4 Legacy Format ────────────────────────────────────────────────────
-
-/**
- * Create an XLSX file using streaming WorkbookWriter (v4 format).
- * Memory-efficient: rows are freed after commit.
- * @param {object} options
- * @param {string} options.base64Content - Base64 content to store in this part
- * @param {string} options.encryptionMeta - Packed encryption metadata (iv:salt:authTag) or ''
- * @param {string} options.metadataJson - Serialized metadata JSON string
- * @param {string} options.outputPath - Output file path
- * @returns {Promise<string>} Path to created file
- */
-async function createXlsxPartStreaming(options) {
-  const { base64Content, encryptionMeta, metadataJson, outputPath } = options;
-
-  // Ensure output directory exists
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  const workbook = new ExcelJS.stream.xlsx.WorkbookWriter({
-    filename: outputPath,
-    useSharedStrings: false, // Inline strings for easier post-processing
-  });
-
-  workbook.creator = 'Microsoft Excel';
-  workbook.lastModifiedBy = 'Microsoft Excel';
-  workbook.created = new Date();
-  workbook.modified = new Date();
-
-  // === Sheet 1: Visible decoy data (server metrics) ===
-  const visibleSheet = workbook.addWorksheet(VISIBLE_SHEET_NAME, {
-    properties: { tabColor: { argb: '4472C4' } },
-  });
-
-  // Set column widths before adding rows
-  visibleSheet.columns = [
-    { width: 20 }, // Timestamp
-    { width: 16 }, // Server ID
-    { width: 12 }, // Status
-    { width: 8 },  // CPU %
-    { width: 10 }, // Memory %
-    { width: 8 },  // Disk %
-    { width: 14 }, // Network (MB/s)
-    { width: 10 }, // Requests
-    { width: 14 }, // Resp Time (ms)
-    { width: 12 }, // Uptime (hrs)
-  ];
-
-  // Add headers
-  const headers = generateDecoyHeaders();
-  const headerRow = visibleSheet.addRow(headers);
-
-  const headerCount = headers.length;
-  for (let col = 1; col <= headerCount; col++) {
-    const cell = headerRow.getCell(col);
-    cell.font = { bold: true, size: 11, color: { argb: 'FFFFFF' } };
-    cell.fill = {
-      type: 'pattern',
-      pattern: 'solid',
-      fgColor: { argb: '2E7D32' },
-    };
-  }
-  headerRow.commit();
-
-  // Generate and write decoy data rows, committing each to free memory
-  const payloadSize = base64Content.length;
-  const rowCount = calculateDecoyRowCount(payloadSize);
-  const decoyData = generateDecoyData(rowCount);
-
-  for (const row of decoyData) {
-    const dataRow = visibleSheet.addRow(rowToArray(row));
-    dataRow.commit();
-  }
-
-  // Add filters
-  visibleSheet.autoFilter = {
-    from: 'A1',
-    to: `J${rowCount + 1}`,
-  };
-
-  await visibleSheet.commit();
-
-  // === Sheet 2: Hidden payload (veryHidden) ===
-  const hiddenSheet = workbook.addWorksheet(HIDDEN_SHEET_NAME, {
-    state: 'veryHidden',
-  });
-
-  // Split base64 content into cell-sized chunks
-  const chunks = splitIntoChunks(base64Content, CELL_CHUNK_SIZE);
-
-  // Row 1: metadata
-  const metaRow = hiddenSheet.getRow(1);
-  metaRow.getCell(1).value = encryptionMeta;
-  metaRow.getCell(2).value = metadataJson;
-  metaRow.getCell(3).value = chunks.length.toString();
-  metaRow.commit();
-
-  // Write cell chunks in rows starting from row 2, columns A-Z
-  const totalChunks = chunks.length;
-  const totalRows = Math.ceil(totalChunks / 26);
-
-  for (let rowIdx = 0; rowIdx < totalRows; rowIdx++) {
-    const sheetRow = hiddenSheet.getRow(rowIdx + 2);
-    const startChunk = rowIdx * 26;
-    const endChunk = Math.min(startChunk + 26, totalChunks);
-
-    for (let i = startChunk; i < endChunk; i++) {
-      const col = (i % 26) + 1;
-      sheetRow.getCell(col).value = chunks[i];
-    }
-    sheetRow.commit();
-  }
-
-  await hiddenSheet.commit();
-  await workbook.commit();
-
-  // WorkbookWriter natively supports veryHidden state — no post-processing needed.
-  return outputPath;
-}
-
-/**
- * Create an XLSX file with encrypted base64 content hidden in a veryHidden sheet (legacy v3)
- */
-async function createXlsxWithBase64(options) {
-  const { base64Content, encryptionMeta, metadata, outputPath } = options;
-
-  const workbook = new ExcelJS.Workbook();
-
-  workbook.creator = 'Microsoft Excel';
-  workbook.lastModifiedBy = 'Microsoft Excel';
-  workbook.created = new Date();
-  workbook.modified = new Date();
-
-  const visibleSheet = workbook.addWorksheet(VISIBLE_SHEET_NAME, {
-    properties: { tabColor: { argb: '4472C4' } },
-  });
-
-  const headers = generateDecoyHeaders();
-  const headerRow = visibleSheet.addRow(headers);
-
-  const headerCount = headers.length;
-  for (let col = 1; col <= headerCount; col++) {
-    const cell = headerRow.getCell(col);
-    cell.font = { bold: true, size: 11, color: { argb: 'FFFFFF' } };
-    cell.fill = {
-      type: 'pattern',
-      pattern: 'solid',
-      fgColor: { argb: '2E7D32' },
-    };
-  }
-
-  const payloadSize = base64Content.length;
-  const rowCount = calculateDecoyRowCount(payloadSize);
-
-  const decoyData = generateDecoyData(rowCount);
-  decoyData.forEach((row) => {
-    visibleSheet.addRow(rowToArray(row));
-  });
-
-  visibleSheet.columns = [
-    { width: 20 }, { width: 16 }, { width: 12 }, { width: 8 },
-    { width: 10 }, { width: 8 }, { width: 14 }, { width: 10 },
-    { width: 14 }, { width: 12 },
-  ];
-
-  visibleSheet.autoFilter = { from: 'A1', to: `J${rowCount + 1}` };
-
-  const hiddenSheet = workbook.addWorksheet(HIDDEN_SHEET_NAME, {
-    state: 'veryHidden',
-  });
-
-  hiddenSheet.getCell('A1').value = encryptionMeta;
-  hiddenSheet.getCell('B1').value = metadata;
-
-  const chunks = splitIntoChunks(base64Content, CELL_CHUNK_SIZE);
-  hiddenSheet.getCell('C1').value = chunks.length.toString();
-
-  chunks.forEach((chunk, index) => {
-    const row = Math.floor(index / 26) + 2;
-    const col = (index % 26) + 1;
-    hiddenSheet.getCell(row, col).value = chunk;
-  });
-
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  await workbook.xlsx.writeFile(outputPath);
-  await ensureVeryHidden(outputPath);
-
-  return outputPath;
-}
+// ─── v3/v4 Legacy XLSX Creation (removed — no longer passes air gap filters)
 
 // ─── Unified Reader ─────────────────────────────────────────────────────────
 
@@ -561,38 +297,6 @@ async function extractFromXml(xlsxPath) {
 
 // ─── Helpers ────────────────────────────────────────────────────────────────
 
-async function ensureVeryHidden(xlsxPath) {
-  const zip = new AdmZip(xlsxPath);
-
-  const workbookEntry = zip.getEntry('xl/workbook.xml');
-  if (workbookEntry) {
-    let workbookXml = workbookEntry.getData().toString('utf8');
-
-    workbookXml = workbookXml.replace(
-      /(<sheet[^>]*name="Data"[^>]*)\s+state="[^"]*"([^>]*\/>)/gi,
-      '$1 state="veryHidden"$2'
-    );
-
-    if (!workbookXml.match(/<sheet[^>]*name="Data"[^>]*state="/i)) {
-      workbookXml = workbookXml.replace(
-        /(<sheet[^>]*name="Data")([^>]*\/>)/gi,
-        '$1 state="veryHidden"$2'
-      );
-    }
-
-    zip.updateFile('xl/workbook.xml', Buffer.from(workbookXml, 'utf8'));
-    zip.writeZip(xlsxPath);
-  }
-}
-
-function splitIntoChunks(str, size) {
-  const chunks = [];
-  for (let i = 0; i < str.length; i += size) {
-    chunks.push(str.slice(i, i + size));
-  }
-  return chunks;
-}
-
 function columnToLetter(col) {
   let letter = '';
   while (col > 0) {
@@ -608,9 +312,6 @@ module.exports = {
   createXlsxPartV5,
   readXlsxV5,
   detectXlsxVersion,
-  // v3/v4 legacy
-  createXlsxPartStreaming,
-  createXlsxWithBase64,
-  // Unified reader
+  // Unified reader (auto-detects v5 vs legacy)
   readXlsxBase64,
 };

package/src/lib/xlsx-writer.js

@@ -0,0 +1,298 @@
+/**
+ * Raw XLSX Writer (v5.x)
+ *
+ * Builds XLSX files from raw XML — no ExcelJS dependency.
+ * Produces output identical to genuine Microsoft Excel, which passes
+ * air gap filters that reject programmatically-generated files.
+ *
+ * Architecture: XML templates + shared string table + AdmZip packaging.
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+
+// ─── XML Escape ──────────────────────────────────────────────────────────────
+
+function escapeXml(s) {
+  return String(s)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+
+// ─── Column Letter Helper ───────────────────────────────────────────────────
+
+function colLetter(idx) {
+  let s = '', n = idx + 1;
+  while (n > 0) { n--; s = String.fromCharCode(65 + (n % 26)) + s; n = Math.floor(n / 26); }
+  return s;
+}
+
+// ─── Shared Strings Table ───────────────────────────────────────────────────
+
+function buildSharedStrings(allValues) {
+  // Collect string values in order, build index map
+  let count = 0;
+  const unique = [];
+  const map = new Map();
+  for (const val of allValues) {
+    if (typeof val !== 'number') {
+      const s = String(val);
+      count++;
+      if (!map.has(s)) {
+        map.set(s, unique.length);
+        unique.push(s);
+      }
+    }
+  }
+
+  // Build XML using array join to avoid O(n²) string concatenation
+  const parts = [`<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="${count}" uniqueCount="${unique.length}">`];
+  for (const s of unique) {
+    parts.push(`<si><t>${escapeXml(s)}</t></si>`);
+  }
+  parts.push('</sst>');
+  return { xml: parts.join(''), map };
+}
+
+// ─── Sheet XML Builder ──────────────────────────────────────────────────────
+
+function buildSheetXml(headers, rows, ssMap, opts = {}) {
+  const totalRows = rows.length + 1;
+  const totalCols = headers.length;
+  const lastCol = colLetter(totalCols - 1);
+  const uid = `{${crypto.randomUUID().toUpperCase()}}`;
+
+  // Pre-compute column letters for all columns
+  const colLetters = [];
+  for (let i = 0; i < totalCols; i++) colLetters.push(colLetter(i));
+
+  // Build XML using array join for O(n) performance
+  const parts = [];
+  parts.push(`<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xr:uid="${uid}">`);
+  parts.push(`<dimension ref="A1:${lastCol}${totalRows}"/>`);
+  parts.push(`<sheetViews><sheetView tabSelected="1" workbookViewId="0"><selection activeCell="A1" sqref="A1"/></sheetView></sheetViews>`);
+  parts.push(`<sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/>`);
+
+  if (opts.colWidths) {
+    parts.push('<cols>');
+    opts.colWidths.forEach((w, i) => parts.push(`<col min="${i + 1}" max="${i + 1}" width="${w}" customWidth="1"/>`));
+    parts.push('</cols>');
+  }
+
+  parts.push('<sheetData>');
+
+  // Header row
+  parts.push(`<row r="1" spans="1:${totalCols}" x14ac:dyDescent="0.25">`);
+  for (let i = 0; i < totalCols; i++) {
+    parts.push(`<c r="${colLetters[i]}1" t="s"><v>${ssMap.get(String(headers[i]))}</v></c>`);
+  }
+  parts.push('</row>');
+
+  // Data rows
+  for (let ri = 0; ri < rows.length; ri++) {
+    const row = rows[ri];
+    const rowNum = ri + 2;
+    parts.push(`<row r="${rowNum}" spans="1:${totalCols}" x14ac:dyDescent="0.25">`);
+    for (let ci = 0; ci < row.length; ci++) {
+      const val = row[ci];
+      const ref = `${colLetters[ci]}${rowNum}`;
+      if (typeof val === 'number') {
+        parts.push(`<c r="${ref}"><v>${val}</v></c>`);
+      } else {
+        const si = ssMap.get(String(val));
+        if (si !== undefined) {
+          parts.push(`<c r="${ref}" t="s"><v>${si}</v></c>`);
+        }
+      }
+    }
+    parts.push('</row>');
+  }
+
+  parts.push('</sheetData>');
+  if (opts.autoFilter) parts.push(`<autoFilter ref="A1:${lastCol}${totalRows}"/>`);
+  parts.push('<pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/>');
+  parts.push('</worksheet>');
+  return parts.join('');
+}
+
+// ─── Static OOXML Parts ─────────────────────────────────────────────────────
+
+const CONTENT_TYPES = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/><Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/><Override PartName="/xl/theme/theme1.xml" ContentType="application/vnd.openxmlformats-officedocument.theme+xml"/><Override PartName="/xl/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml"/><Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/><Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/><Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/></Types>`;
+
+const RELS = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/></Relationships>`;
+
+const WORKBOOK_RELS = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/></Relationships>`;
+
+function makeWorkbook(sheetName) {
+  const docId = `8_{${crypto.randomUUID().toUpperCase()}}`;
+  const viewUid = `{${crypto.randomUUID().toUpperCase()}}`;
+  return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x15 xr xr6 xr10 xr2" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xmlns:xr10="http://schemas.microsoft.com/office/spreadsheetml/2016/revision10" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"><fileVersion appName="xl" lastEdited="7" lowestEdited="7" rupBuild="29725"/><workbookPr defaultThemeVersion="202300"/><xr:revisionPtr revIDLastSave="0" documentId="${docId}" xr6:coauthVersionLast="47" xr6:coauthVersionMax="47" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="29040" windowHeight="17520" xr2:uid="${viewUid}"/></bookViews><sheets><sheet name="${escapeXml(sheetName)}" sheetId="1" r:id="rId1"/></sheets><calcPr calcId="191029"/><extLst><ext uri="{140A7094-0E35-4892-8432-C4D2E57EDEB5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:workbookPr chartTrackingRefBase="1"/></ext><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:Single"/><xcalcf:feature name="microsoft.com:FV"/><xcalcf:feature name="microsoft.com:CNMTM"/><xcalcf:feature name="microsoft.com:LET_WF"/><xcalcf:feature name="microsoft.com:LAMBDA_WF"/><xcalcf:feature name="microsoft.com:ARRAYTEXT_WF"/></xcalcf:calcFeatures></ext></extLst></workbook>`;
+}
+
+const STYLES = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<styleSheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac x16r2 xr" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:x16r2="http://schemas.microsoft.com/office/spreadsheetml/2015/02/main" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision"><fonts count="1" x14ac:knownFonts="1"><font><sz val="11"/><color theme="1"/><name val="Aptos Narrow"/><family val="2"/><scheme val="minor"/></font></fonts><fills count="2"><fill><patternFill patternType="none"/></fill><fill><patternFill patternType="gray125"/></fill></fills><borders count="1"><border><left/><right/><top/><bottom/><diagonal/></border></borders><cellStyleXfs count="1"><xf numFmtId="0" fontId="0" fillId="0" borderId="0"/></cellStyleXfs><cellXfs count="1"><xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0"/></cellXfs><cellStyles count="1"><cellStyle name="Normal" xfId="0" builtinId="0"/></cellStyles><dxfs count="0"/><tableStyles count="0" defaultTableStyle="TableStyleMedium2" defaultPivotStyle="PivotStyleLight16"/><extLst><ext uri="{EB79DEF2-80B8-43e5-95BD-54CBDDF9020C}" xmlns:x14="http://schemas.microsoft.com/office/spreadsheetml/2009/9/main"><x14:slicerStyles defaultSlicerStyle="SlicerStyleLight1"/></ext><ext uri="{9260A510-F301-46a8-8635-F512D64BE5F5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:timelineStyles defaultTimelineStyle="TimeSlicerStyleLight1"/></ext></extLst></styleSheet>`;
+
+// Theme extracted from genuine Microsoft Excel 2024 output
+const THEME = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Office Theme"><a:themeElements><a:clrScheme name="Office"><a:dk1><a:sysClr val="windowText" lastClr="000000"/></a:dk1><a:lt1><a:sysClr val="window" lastClr="FFFFFF"/></a:lt1><a:dk2><a:srgbClr val="0E2841"/></a:dk2><a:lt2><a:srgbClr val="E8E8E8"/></a:lt2><a:accent1><a:srgbClr val="156082"/></a:accent1><a:accent2><a:srgbClr val="E97132"/></a:accent2><a:accent3><a:srgbClr val="196B24"/></a:accent3><a:accent4><a:srgbClr val="0F9ED5"/></a:accent4><a:accent5><a:srgbClr val="A02B93"/></a:accent5><a:accent6><a:srgbClr val="4EA72E"/></a:accent6><a:hlink><a:srgbClr val="467886"/></a:hlink><a:folHlink><a:srgbClr val="96607D"/></a:folHlink></a:clrScheme><a:fontScheme name="Office"><a:majorFont><a:latin typeface="Aptos Display" panose="02110004020202020204"/><a:ea typeface=""/><a:cs typeface=""/><a:font script="Jpan" typeface="&#28216;&#12468;&#12471;&#12483;&#12463; Light"/><a:font script="Hang" typeface="&#47569;&#51008; &#44256;&#46357;"/><a:font script="Hans" typeface="&#31561;&#32447; Light"/><a:font script="Hant" typeface="&#26032;&#32048;&#26126;&#39636;"/><a:font script="Arab" typeface="Times New Roman"/><a:font script="Hebr" typeface="Times New Roman"/><a:font script="Thai" typeface="Tahoma"/><a:font script="Ethi" typeface="Nyala"/><a:font script="Beng" typeface="Vrinda"/><a:font script="Gujr" typeface="Shruti"/><a:font script="Khmr" typeface="MoolBoran"/><a:font script="Knda" typeface="Tunga"/><a:font script="Guru" typeface="Raavi"/><a:font script="Cans" typeface="Euphemia"/><a:font script="Cher" typeface="Plantagenet Cherokee"/><a:font script="Yiii" typeface="Microsoft Yi Baiti"/><a:font script="Tibt" typeface="Microsoft Himalaya"/><a:font script="Thaa" typeface="MV Boli"/><a:font script="Deva" typeface="Mangal"/><a:font script="Telu" typeface="Gautami"/><a:font script="Taml" typeface="Latha"/><a:font script="Syrc" typeface="Estrangelo Edessa"/><a:font script="Orya" typeface="Kalinga"/><a:font script="Mlym" typeface="Kartika"/><a:font script="Laoo" typeface="DokChampa"/><a:font script="Sinh" typeface="Iskoola Pota"/><a:font script="Mong" typeface="Mongolian Baiti"/><a:font script="Viet" typeface="Times New Roman"/><a:font script="Uigh" typeface="Microsoft Uighur"/><a:font script="Geor" typeface="Sylfaen"/><a:font script="Armn" typeface="Arial"/><a:font script="Bugi" typeface="Leelawadee UI"/><a:font script="Bopo" typeface="Microsoft JhengHei"/><a:font script="Java" typeface="Javanese Text"/><a:font script="Lisu" typeface="Segoe UI"/><a:font script="Mymr" typeface="Myanmar Text"/><a:font script="Nkoo" typeface="Ebrima"/><a:font script="Olck" typeface="Nirmala UI"/><a:font script="Osma" typeface="Ebrima"/><a:font script="Phag" typeface="Phagspa"/><a:font script="Syrn" typeface="Estrangelo Edessa"/><a:font script="Syrj" typeface="Estrangelo Edessa"/><a:font script="Syre" typeface="Estrangelo Edessa"/><a:font script="Sora" typeface="Nirmala UI"/><a:font script="Tale" typeface="Microsoft Tai Le"/><a:font script="Talu" typeface="Microsoft New Tai Lue"/><a:font script="Tfng" typeface="Ebrima"/></a:majorFont><a:minorFont><a:latin typeface="Aptos Narrow" panose="02110004020202020204"/><a:ea typeface=""/><a:cs typeface=""/><a:font script="Jpan" typeface="&#28216;&#12468;&#12471;&#12483;&#12463;"/><a:font script="Hang" typeface="&#47569;&#51008; &#44256;&#46357;"/><a:font script="Hans" typeface="&#31561;&#32447;"/><a:font script="Hant" typeface="&#26032;&#32048;&#26126;&#39636;"/><a:font script="Arab" typeface="Arial"/><a:font script="Hebr" typeface="Arial"/><a:font script="Thai" typeface="Tahoma"/><a:font script="Ethi" typeface="Nyala"/><a:font script="Beng" typeface="Vrinda"/><a:font script="Gujr" typeface="Shruti"/><a:font script="Khmr" typeface="DaunPenh"/><a:font script="Knda" typeface="Tunga"/><a:font script="Guru" typeface="Raavi"/><a:font script="Cans" typeface="Euphemia"/><a:font script="Cher" typeface="Plantagenet Cherokee"/><a:font script="Yiii" typeface="Microsoft Yi Baiti"/><a:font script="Tibt" typeface="Microsoft Himalaya"/><a:font script="Thaa" typeface="MV Boli"/><a:font script="Deva" typeface="Mangal"/><a:font script="Telu" typeface="Gautami"/><a:font script="Taml" typeface="Latha"/><a:font script="Syrc" typeface="Estrangelo Edessa"/><a:font script="Orya" typeface="Kalinga"/><a:font script="Mlym" typeface="Kartika"/><a:font script="Laoo" typeface="DokChampa"/><a:font script="Sinh" typeface="Iskoola Pota"/><a:font script="Mong" typeface="Mongolian Baiti"/><a:font script="Viet" typeface="Arial"/><a:font script="Uigh" typeface="Microsoft Uighur"/><a:font script="Geor" typeface="Sylfaen"/><a:font script="Armn" typeface="Arial"/><a:font script="Bugi" typeface="Leelawadee UI"/><a:font script="Bopo" typeface="Microsoft JhengHei"/><a:font script="Java" typeface="Javanese Text"/><a:font script="Lisu" typeface="Segoe UI"/><a:font script="Mymr" typeface="Myanmar Text"/><a:font script="Nkoo" typeface="Ebrima"/><a:font script="Olck" typeface="Nirmala UI"/><a:font script="Osma" typeface="Ebrima"/><a:font script="Phag" typeface="Phagspa"/><a:font script="Syrn" typeface="Estrangelo Edessa"/><a:font script="Syrj" typeface="Estrangelo Edessa"/><a:font script="Syre" typeface="Estrangelo Edessa"/><a:font script="Sora" typeface="Nirmala UI"/><a:font script="Tale" typeface="Microsoft Tai Le"/><a:font script="Talu" typeface="Microsoft New Tai Lue"/><a:font script="Tfng" typeface="Ebrima"/></a:minorFont></a:fontScheme><a:fmtScheme name="Office"><a:fillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:gradFill rotWithShape="1"><a:gsLst><a:gs pos="0"><a:schemeClr val="phClr"><a:lumMod val="110000"/><a:satMod val="105000"/><a:tint val="67000"/></a:schemeClr></a:gs><a:gs pos="50000"><a:schemeClr val="phClr"><a:lumMod val="105000"/><a:satMod val="103000"/><a:tint val="73000"/></a:schemeClr></a:gs><a:gs pos="100000"><a:schemeClr val="phClr"><a:lumMod val="105000"/><a:satMod val="109000"/><a:tint val="81000"/></a:schemeClr></a:gs></a:gsLst><a:lin ang="5400000" scaled="0"/></a:gradFill><a:gradFill rotWithShape="1"><a:gsLst><a:gs pos="0"><a:schemeClr val="phClr"><a:satMod val="103000"/><a:lumMod val="102000"/><a:tint val="94000"/></a:schemeClr></a:gs><a:gs pos="50000"><a:schemeClr val="phClr"><a:satMod val="110000"/><a:lumMod val="100000"/><a:shade val="100000"/></a:schemeClr></a:gs><a:gs pos="100000"><a:schemeClr val="phClr"><a:lumMod val="99000"/><a:satMod val="120000"/><a:shade val="78000"/></a:schemeClr></a:gs></a:gsLst><a:lin ang="5400000" scaled="0"/></a:gradFill></a:fillStyleLst><a:lnStyleLst><a:ln w="12700" cap="flat" cmpd="sng" algn="ctr"><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:prstDash val="solid"/><a:miter lim="800000"/></a:ln><a:ln w="19050" cap="flat" cmpd="sng" algn="ctr"><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:prstDash val="solid"/><a:miter lim="800000"/></a:ln><a:ln w="25400" cap="flat" cmpd="sng" algn="ctr"><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:prstDash val="solid"/><a:miter lim="800000"/></a:ln></a:lnStyleLst><a:effectStyleLst><a:effectStyle><a:effectLst/></a:effectStyle><a:effectStyle><a:effectLst/></a:effectStyle><a:effectStyle><a:effectLst><a:outerShdw blurRad="57150" dist="19050" dir="5400000" algn="ctr" rotWithShape="0"><a:srgbClr val="000000"><a:alpha val="63000"/></a:srgbClr></a:outerShdw></a:effectLst></a:effectStyle></a:effectStyleLst><a:bgFillStyleLst><a:solidFill><a:schemeClr val="phClr"/></a:solidFill><a:solidFill><a:schemeClr val="phClr"><a:tint val="95000"/><a:satMod val="170000"/></a:schemeClr></a:solidFill><a:gradFill rotWithShape="1"><a:gsLst><a:gs pos="0"><a:schemeClr val="phClr"><a:tint val="93000"/><a:satMod val="150000"/><a:shade val="98000"/><a:lumMod val="102000"/></a:schemeClr></a:gs><a:gs pos="50000"><a:schemeClr val="phClr"><a:tint val="98000"/><a:satMod val="130000"/><a:shade val="90000"/><a:lumMod val="103000"/></a:schemeClr></a:gs><a:gs pos="100000"><a:schemeClr val="phClr"><a:shade val="63000"/><a:satMod val="120000"/></a:schemeClr></a:gs></a:gsLst><a:lin ang="5400000" scaled="0"/></a:gradFill></a:bgFillStyleLst></a:fmtScheme></a:themeElements><a:objectDefaults><a:lnDef><a:spPr/><a:bodyPr/><a:lstStyle/><a:style><a:lnRef idx="2"><a:schemeClr val="accent1"/></a:lnRef><a:fillRef idx="0"><a:schemeClr val="accent1"/></a:fillRef><a:effectRef idx="1"><a:schemeClr val="accent1"/></a:effectRef><a:fontRef idx="minor"><a:schemeClr val="tx1"/></a:fontRef></a:style></a:lnDef></a:objectDefaults><a:extraClrSchemeLst/><a:extLst><a:ext uri="{05A4C25C-085E-4340-85A3-A5531E510DB2}"><thm15:themeFamily xmlns:thm15="http://schemas.microsoft.com/office/thememl/2012/main" name="Office Theme" id="{2E142A2C-CD16-42D6-873A-C26D2A0506FA}" vid="{1BDDFF52-6CD6-40A5-AB3C-68EB2F1E4D0A}"/></a:ext></a:extLst></a:theme>`;
+
+function makeCoreProps() {
+  const now = new Date().toISOString().replace(/\.\d+Z$/, 'Z');
+  return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:creator>Microsoft Excel</dc:creator><cp:lastModifiedBy>Microsoft Excel</cp:lastModifiedBy><dcterms:created xsi:type="dcterms:W3CDTF">${now}</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">${now}</dcterms:modified></cp:coreProperties>`;
+}
+
+function makeAppProps(sheetName) {
+  return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"><Application>Microsoft Excel</Application><DocSecurity>0</DocSecurity><ScaleCrop>false</ScaleCrop><HeadingPairs><vt:vector size="2" baseType="variant"><vt:variant><vt:lpstr>Worksheets</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant></vt:vector></HeadingPairs><TitlesOfParts><vt:vector size="1" baseType="lpstr"><vt:lpstr>${escapeXml(sheetName)}</vt:lpstr></vt:vector></TitlesOfParts><Company></Company><LinksUpToDate>false</LinksUpToDate><SharedDoc>false</SharedDoc><HyperlinksChanged>false</HyperlinksChanged><AppVersion>16.0300</AppVersion></Properties>`;
+}
+
+// ─── CRC-32 ──────────────────────────────────────────────────────────────────
+
+const crcTable = (() => {
+  const t = new Uint32Array(256);
+  for (let i = 0; i < 256; i++) {
+    let c = i;
+    for (let j = 0; j < 8; j++) c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
+    t[i] = c;
+  }
+  return t;
+})();
+
+function crc32(buf) {
+  let crc = 0xFFFFFFFF;
+  for (let i = 0; i < buf.length; i++) crc = crcTable[(crc ^ buf[i]) & 0xFF] ^ (crc >>> 8);
+  return (crc ^ 0xFFFFFFFF) >>> 0;
+}
+
+// ─── Ordered ZIP Writer ──────────────────────────────────────────────────────
+
+function writeZipOrdered(entries, outputPath) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+
+  for (const entry of entries) {
+    const nameBuffer = Buffer.from(entry.name, 'utf8');
+    const uncompressed = entry.data;
+    const compressed = zlib.deflateRawSync(uncompressed);
+    const crc = crc32(uncompressed);
+
+    // Local file header
+    const local = Buffer.alloc(30 + nameBuffer.length);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0, 6);
+    local.writeUInt16LE(8, 8);   // deflate
+    local.writeUInt16LE(0, 10);
+    local.writeUInt16LE(0, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(uncompressed.length, 22);
+    local.writeUInt16LE(nameBuffer.length, 26);
+    local.writeUInt16LE(0, 28);
+    nameBuffer.copy(local, 30);
+
+    // Central directory
+    const central = Buffer.alloc(46 + nameBuffer.length);
+    central.writeUInt32LE(0x02014b50, 0);
+    central.writeUInt16LE(20, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(0, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt16LE(0, 12);
+    central.writeUInt16LE(0, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(uncompressed.length, 24);
+    central.writeUInt16LE(nameBuffer.length, 28);
+    central.writeUInt16LE(0, 30);
+    central.writeUInt16LE(0, 32);
+    central.writeUInt16LE(0, 34);
+    central.writeUInt16LE(0, 36);
+    central.writeUInt32LE(0, 38);
+    central.writeUInt32LE(offset, 42);
+    nameBuffer.copy(central, 46);
+
+    centralParts.push(central);
+    localParts.push(local, compressed);
+    offset += local.length + compressed.length;
+  }
+
+  const centralBuf = Buffer.concat(centralParts);
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(0x06054b50, 0);
+  eocd.writeUInt16LE(0, 4);
+  eocd.writeUInt16LE(0, 6);
+  eocd.writeUInt16LE(entries.length, 8);
+  eocd.writeUInt16LE(entries.length, 10);
+  eocd.writeUInt32LE(centralBuf.length, 12);
+  eocd.writeUInt32LE(offset, 16);
+  eocd.writeUInt16LE(0, 20);
+
+  const dir = path.dirname(outputPath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+
+  fs.writeFileSync(outputPath, Buffer.concat([...localParts, centralBuf, eocd]));
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Create an XLSX file with log data embedded as shared strings.
+ * Produces output matching genuine Microsoft Excel format.
+ *
+ * @param {object} options
+ * @param {string[]} options.headers - Column header strings
+ * @param {Array<Array>} options.rows - Row arrays (strings and numbers)
+ * @param {string} options.sheetName - Worksheet name
+ * @param {string} options.outputPath - Output file path
+ * @param {number[]} [options.colWidths] - Column widths
+ * @param {boolean} [options.autoFilter] - Add autoFilter
+ * @returns {string} Path to created file
+ */
+function createXlsxRaw(options) {
+  const { headers, rows, sheetName, outputPath, colWidths, autoFilter } = options;
+
+  // Collect all cell values for shared strings
+  const allValues = [...headers];
+  for (const row of rows) {
+    for (const val of row) allValues.push(val);
+  }
+
+  const { xml: ssXml, map: ssMap } = buildSharedStrings(allValues);
+  const sheetXml = buildSheetXml(headers, rows, ssMap, { colWidths, autoFilter });
+
+  // Assemble ZIP in the same entry order as real Excel
+  const entries = [
+    { name: '[Content_Types].xml', data: Buffer.from(CONTENT_TYPES, 'utf8') },
+    { name: '_rels/.rels', data: Buffer.from(RELS, 'utf8') },
+    { name: 'xl/workbook.xml', data: Buffer.from(makeWorkbook(sheetName), 'utf8') },
+    { name: 'xl/_rels/workbook.xml.rels', data: Buffer.from(WORKBOOK_RELS, 'utf8') },
+    { name: 'xl/worksheets/sheet1.xml', data: Buffer.from(sheetXml, 'utf8') },
+    { name: 'xl/theme/theme1.xml', data: Buffer.from(THEME, 'utf8') },
+    { name: 'xl/styles.xml', data: Buffer.from(STYLES, 'utf8') },
+    { name: 'xl/sharedStrings.xml', data: Buffer.from(ssXml, 'utf8') },
+    { name: 'docProps/core.xml', data: Buffer.from(makeCoreProps(), 'utf8') },
+    { name: 'docProps/app.xml', data: Buffer.from(makeAppProps(sheetName), 'utf8') },
+  ];
+
+  writeZipOrdered(entries, outputPath);
+  return outputPath;
+}
+
+module.exports = {
+  createXlsxRaw,
+  buildSharedStrings,
+  buildSheetXml,
+  escapeXml,
+  colLetter,
+};