xls-codec 4.8.0 → 4.10.0

package/dist/workbook/conditional-format.d.ts

@@ -1,2 +1,2 @@
-import { a as parseDxfStyle, i as RawConditionalFormatStyle, n as RawConditionalFormat, o as readCondFmtGroup, r as RawConditionalFormatFill, t as CondFmtGroupResult } from "../conditional-format-Cqcjnm7O.js";
-export { CondFmtGroupResult, RawConditionalFormat, RawConditionalFormatFill, RawConditionalFormatStyle, parseDxfStyle, readCondFmtGroup };
+import { a as RawConditionalFormatStyle, i as RawConditionalFormatFill, n as RawCfOperand, o as parseDxfStyle, r as RawConditionalFormat, s as readCondFmtGroup, t as CondFmtGroupResult } from "../conditional-format-BRMUTRP1.js";
+export { CondFmtGroupResult, RawCfOperand, RawConditionalFormat, RawConditionalFormatFill, RawConditionalFormatStyle, parseDxfStyle, readCondFmtGroup };

package/dist/workbook/conditional-format.js

@@ -60,27 +60,42 @@ function parseDxfStyle(dxfBytes) {
 		return;
 	}
 }
-function readCf(record, ranges, formulaSheets) {
+/** The shared byte-layout parse both readCf and conditional-format.ts's own readCondFmtGroup need: ct/cp/cce1/cce2, the dxf trailer's own bytes (its length inferred from the record's total size the same way this file always has, since [MS-XLS] never states it directly), and the two formula operands. Returns undefined for a truncated/malformed record rather than throwing, so a caller can fold this into its own try/catch or call it standalone. */
+function parseCfBytes(record) {
 	try {
 		const cursor = new BlockCursor(record.blocks);
 		const ct = cursor.u8();
 		const cp = cursor.u8();
 		const cce1 = cursor.u16();
 		const cce2 = cursor.u16();
-		if (ct === 2) return;
-		const operator = CP_TO_OPERATOR.get(cp);
-		if (operator === void 0) return;
 		const dxfLength = recordByteLength(record) - 6 - cce1 - cce2;
-		const dxfBytes = cursor.take(dxfLength);
-		const rgce1 = cursor.take(cce1);
-		const rgce2 = cursor.take(cce2);
-		if (cce1 === 0) return;
+		return {
+			ct,
+			cp,
+			dxfBytes: cursor.take(dxfLength),
+			rgce1: cursor.take(cce1),
+			rgce2: cursor.take(cce2)
+		};
+	} catch (err) {
+		if (!(err instanceof BiffFormatError)) throw err;
+		return;
+	}
+}
+function readCf(record, ranges, formulaSheets) {
+	const parsed = parseCfBytes(record);
+	if (parsed === void 0) return;
+	const { ct, cp, dxfBytes, rgce1, rgce2 } = parsed;
+	if (ct === 2) return;
+	const operator = CP_TO_OPERATOR.get(cp);
+	if (operator === void 0) return;
+	if (rgce1.length === 0) return;
+	try {
 		const formula1 = parseFormulaText(rgce1, formulaSheets);
 		if (formula1 === void 0) return;
 		return {
 			operator,
 			formula1,
-			formula2: cce2 > 0 ? parseFormulaText(rgce2, formulaSheets) : void 0,
+			formula2: rgce2.length > 0 ? parseFormulaText(rgce2, formulaSheets) : void 0,
 			style: parseDxfStyle(dxfBytes),
 			ranges
 		};
@@ -89,16 +104,20 @@ function readCf(record, ranges, formulaSheets) {
 		return;
 	}
 }
+const DEGRADED_CONDFMT_GROUP = {
+	formats: [],
+	recordsConsumed: 1,
+	nID: 0,
+	ranges: [],
+	rawCfs: []
+};
 function readCondFmtGroup(records, startIndex, formulaSheets) {
 	const condFmt = records[startIndex];
-	if (condFmt === void 0) return {
-		formats: [],
-		recordsConsumed: 1
-	};
+	if (condFmt === void 0) return DEGRADED_CONDFMT_GROUP;
 	try {
 		const cursor = new BlockCursor(condFmt.blocks);
 		const ccf = cursor.u16();
-		cursor.skip(2);
+		const nID = cursor.u16() >>> 1 & 32767;
 		cursor.skip(8);
 		const crefCount = cursor.u16();
 		const ranges = [];
@@ -115,25 +134,29 @@ function readCondFmtGroup(records, startIndex, formulaSheets) {
 			});
 		}
 		const formats = [];
+		const rawCfs = [];
 		for (let offset = 1; offset <= ccf; offset += 1) {
 			const cfRecord = records[startIndex + offset];
-			if (cfRecord?.type !== 433) return {
-				formats: [],
-				recordsConsumed: 1
-			};
+			if (cfRecord?.type !== 433) return DEGRADED_CONDFMT_GROUP;
 			const format = readCf(cfRecord, ranges, formulaSheets);
 			if (format !== void 0) formats.push(format);
+			const parsed = parseCfBytes(cfRecord);
+			rawCfs.push(parsed === void 0 ? void 0 : {
+				ct: parsed.ct,
+				cp: parsed.cp,
+				rgce1: parsed.rgce1
+			});
 		}
 		return {
 			formats,
-			recordsConsumed: 1 + ccf
+			recordsConsumed: 1 + ccf,
+			nID,
+			ranges,
+			rawCfs
 		};
 	} catch (err) {
 		if (!(err instanceof BiffFormatError)) throw err;
-		return {
-			formats: [],
-			recordsConsumed: 1
-		};
+		return DEGRADED_CONDFMT_GROUP;
 	}
 }
 //#endregion

package/dist/workbook/data-validation.d.cts

@@ -1,2 +1,2 @@
-import { n as readDv, t as RawDataValidation } from "../data-validation-lJWM9-AP.cjs";
+import { n as readDv, t as RawDataValidation } from "../data-validation-BgUt8CbE.cjs";
 export { RawDataValidation, readDv };

package/dist/workbook/data-validation.d.ts

@@ -1,2 +1,2 @@
-import { n as readDv, t as RawDataValidation } from "../data-validation-BeYpL3Nb.js";
+import { n as readDv, t as RawDataValidation } from "../data-validation-Cq6iD8lB.js";
 export { RawDataValidation, readDv };

package/dist/workbook/drawing.d.cts

@@ -1,4 +1,4 @@
-import { r as FormulaSheetContext } from "../ptg-CCBbJLZJ.cjs";
+import { r as FormulaSheetContext } from "../ptg-75v7MhaA.cjs";
 import { n as Substream, t as RecordGroup } from "../substreams-XDNgDvRJ.cjs";
 import { BlipImage } from "../drawing/blips.cjs";
 import { RawColumn, RawRow } from "./sheet.cjs";

package/dist/workbook/drawing.d.ts

@@ -1,4 +1,4 @@
-import { r as FormulaSheetContext } from "../ptg-CCBbJLZJ.js";
+import { r as FormulaSheetContext } from "../ptg-75v7MhaA.js";
 import { n as Substream, t as RecordGroup } from "../substreams-CgTHx5kX.js";
 import { BlipImage } from "../drawing/blips.js";
 import { RawColumn, RawRow } from "./sheet.js";

package/dist/workbook/encryption.cjs

@@ -4,7 +4,8 @@ const require_biff_records = require("../biff/records.cjs");
 const require_biff_cursor = require("../biff/cursor.cjs");
 let archive_codec = require("archive-codec");
 //#region src/workbook/encryption.ts
-/** [MS-XLS] 2.4.117's own wEncryptionType: RC4 encryption, as opposed to 0x0000 (XOR obfuscation, out of scope). */
+/** [MS-XLS] 2.4.117's own wEncryptionType. */
+const ENCRYPTION_TYPE_XOR = 0;
 const ENCRYPTION_TYPE_RC4 = 1;
 /** [MS-OFFCRYPTO] 2.3.6.1's own EncryptionVersionInfo: vMajor/vMinor MUST both be 1 for the "RC4 encryption header" this module reads. vMajor 2/3/4 with vMinor 2 names the RC4 CryptoAPI encryption header instead (2.3.5.1), a different, unimplemented header shape. */
 const RC4_HEADER_VERSION_MAJOR = 1;
@@ -21,29 +22,28 @@ const NEVER_ENCRYPTED_RECORD_TYPES = /* @__PURE__ */ new Set([
 	406,
 	312
 ]);
-/** Reads FilePass's own fields, rejecting the two encryption schemes this module does not implement with a specific message rather than a generic parse failure. */
-function readFilePassRc4Header(filePassRecord) {
+/** Reads FilePass's own fields, dispatching on wEncryptionType, and rejecting RC4 CryptoAPI (the one scheme this module does not implement) with a specific message rather than a generic parse failure. */
+function readFilePassHeader(filePassRecord) {
 	const cursor = new require_biff_cursor.BlockCursor([filePassRecord.data]);
 	const encryptionType = cursor.u16();
-	if (encryptionType !== ENCRYPTION_TYPE_RC4) throw new require_biff_records.BiffFormatError(`workbook uses FilePass wEncryptionType 0x${encryptionType.toString(16).padStart(4, "0")} (XOR obfuscation), which this reader does not decrypt`);
+	if (encryptionType === ENCRYPTION_TYPE_XOR) return {
+		kind: "xor",
+		key: cursor.u16(),
+		verificationBytes: cursor.u16()
+	};
+	if (encryptionType !== ENCRYPTION_TYPE_RC4) throw new require_biff_records.BiffFormatError(`workbook uses FilePass wEncryptionType 0x${encryptionType.toString(16).padStart(4, "0")}, which this reader does not decrypt`);
 	const versionMajor = cursor.u16();
 	const versionMinor = cursor.u16();
 	if (versionMajor !== RC4_HEADER_VERSION_MAJOR || versionMinor !== RC4_HEADER_VERSION_MINOR) throw new require_biff_records.BiffFormatError(`workbook uses RC4 CryptoAPI encryption (EncryptionVersionInfo ${versionMajor}.${versionMinor}), which this reader does not decrypt`);
 	return {
+		kind: "rc4",
 		salt: cursor.take(archive_codec.OFFICE_RC4_VERIFIER_LENGTH),
 		encryptedVerifier: cursor.take(archive_codec.OFFICE_RC4_VERIFIER_LENGTH),
 		encryptedVerifierHash: cursor.take(archive_codec.OFFICE_RC4_VERIFIER_LENGTH)
 	};
 }
-/** [MS-OFFCRYPTO] 2.3.6.4's own password verification: block 0's key decrypts EncryptedVerifier, and MD5 of the result must equal the same block's decryption of EncryptedVerifierHash. Both verifier fields sit in one continuous keystream starting at position 0, not two independently-reset ones -- though decryptOfficeRc4 regenerates its keystream fresh from block start on every call regardless, so decrypting them as two separate 16-byte calls at offsets 0 and 16 is equivalent to one 32-byte call, not merely close to it. */
-function verifyOfficeRc4Password(baseHash, header) {
-	const decryptedVerifier = (0, archive_codec.decryptOfficeRc4)(baseHash, 0, header.encryptedVerifier);
-	const decryptedVerifierHash = (0, archive_codec.decryptOfficeRc4)(baseHash, archive_codec.OFFICE_RC4_VERIFIER_LENGTH, header.encryptedVerifierHash);
-	const computedHash = (0, archive_codec.md5)(decryptedVerifier);
-	if (!(computedHash.length === decryptedVerifierHash.length && computedHash.every((byte, index) => byte === decryptedVerifierHash[index]))) throw new require_biff_records.BiffFormatError("incorrect password for RC4-encrypted workbook");
-}
-/** Decrypts one record's own data in place against the derived base hash, honouring every [MS-XLS] 2.2.10 exclusion: a never-encrypted record's data is returned unchanged, BoundSheet8's own lbPlyPos prefix is preserved while the rest of its data is decrypted, and everything else is decrypted whole. `record.offset` is the record's own header start, so its data begins `HEADER_SIZE` bytes further into the stream -- the position [MS-OFFCRYPTO]'s block-keyed keystream is defined against. */
-function decryptRecord(record, baseHash) {
+/** Decrypts one record's own data against the derived RC4 base hash, honouring every [MS-XLS] 2.2.10 exclusion: a never-encrypted record's data is returned unchanged, BoundSheet8's own lbPlyPos prefix is preserved while the rest of its data is decrypted, and everything else is decrypted whole. `record.offset` is the record's own header start, so its data begins `HEADER_SIZE` bytes further into the stream -- the position [MS-OFFCRYPTO]'s block-keyed keystream is defined against. */
+function decryptRecordRc4(record, baseHash) {
 	if (NEVER_ENCRYPTED_RECORD_TYPES.has(record.type)) return record;
 	const dataOffset = record.offset + 4;
 	if (record.type === 133) {
@@ -62,17 +62,64 @@ function decryptRecord(record, baseHash) {
 		data: (0, archive_codec.decryptOfficeRc4)(baseHash, dataOffset, record.data)
 	};
 }
+/** [MS-XLS] 2.2.10's own XorArrayIndex rule for a record's decrypted span starting `spanOffset` bytes into the Workbook stream: `(streamOffset + recordDataLength) % 16`, where `recordDataLength` is the record's own FULL declared data length -- not the length of `spanOffset`'s own remaining span, which for BoundSheet8 is 4 bytes shorter than the record's own declared size. Confirmed against Apache POI's own `XORDecryptor.invokeCipher` comment ("XorArrayIndex = (FileOffset + Data.Length) % 16") and LibreOffice's `XclImpBiff5Decrypter::OnUpdate`, and directly against a real Excel-generated XOR-obfuscated fixture -- see archive-codec's own crypto/xor-obfuscation.test.ts. */
+function xorArrayIndexFor(spanOffset, recordDataLength) {
+	return (spanOffset + recordDataLength) % archive_codec.XOR_OBFUSCATION_ARRAY_LENGTH;
+}
+/** Decrypts one record's own data against the derived XOR obfuscation array, honouring the same [MS-XLS] 2.2.10 exclusions decryptRecordRc4 does. */
+function decryptRecordXor(record, array) {
+	if (NEVER_ENCRYPTED_RECORD_TYPES.has(record.type)) return record;
+	const dataOffset = record.offset + 4;
+	if (record.type === 133) {
+		const lbPlyPos = record.data.subarray(0, BOUNDSHEET8_LBPLYPOS_SIZE);
+		const spanOffset = dataOffset + BOUNDSHEET8_LBPLYPOS_SIZE;
+		const decryptedRest = (0, archive_codec.decryptXorObfuscationMethod1)(array, record.data.subarray(BOUNDSHEET8_LBPLYPOS_SIZE), xorArrayIndexFor(spanOffset, record.data.length));
+		const data = new Uint8Array(record.data.length);
+		data.set(lbPlyPos, 0);
+		data.set(decryptedRest, BOUNDSHEET8_LBPLYPOS_SIZE);
+		return {
+			...record,
+			data
+		};
+	}
+	return {
+		...record,
+		data: (0, archive_codec.decryptXorObfuscationMethod1)(array, record.data, xorArrayIndexFor(dataOffset, record.data.length))
+	};
+}
+/** [MS-OFFCRYPTO] 2.3.6.4's own password verification: block 0's key decrypts EncryptedVerifier, and MD5 of the result must equal the same block's decryption of EncryptedVerifierHash. Both verifier fields sit in one continuous keystream starting at position 0, not two independently-reset ones -- though decryptOfficeRc4 regenerates its keystream fresh from block start on every call regardless, so decrypting them as two separate 16-byte calls at offsets 0 and 16 is equivalent to one 32-byte call, not merely close to it. */
+function decryptWorkbookRecordsRc4(records, header, password) {
+	const baseHash = (0, archive_codec.deriveOfficeRc4BaseHash)(password, header.salt);
+	const decryptedVerifier = (0, archive_codec.decryptOfficeRc4)(baseHash, 0, header.encryptedVerifier);
+	const decryptedVerifierHash = (0, archive_codec.decryptOfficeRc4)(baseHash, archive_codec.OFFICE_RC4_VERIFIER_LENGTH, header.encryptedVerifierHash);
+	const computedHash = (0, archive_codec.md5)(decryptedVerifier);
+	if (!(computedHash.length === decryptedVerifierHash.length && computedHash.every((byte, index) => byte === decryptedVerifierHash[index]))) throw new require_biff_records.BiffFormatError("incorrect password for RC4-encrypted workbook");
+	return records.map((record) => decryptRecordRc4(record, baseHash));
+}
+/** Verifies the password against both of XORObfuscation's own fields (its `key` and `verificationBytes`, matching Apache POI's own `XORDecryptor.verifyPassword`, which checks both rather than either alone) before decrypting every record. */
+function decryptWorkbookRecordsXor(records, header, password) {
+	let computedKey;
+	let computedVerifier;
+	try {
+		computedKey = (0, archive_codec.createXorObfuscationKey)(password);
+		computedVerifier = (0, archive_codec.createXorObfuscationPasswordVerifier)(password);
+	} catch (error) {
+		if (error instanceof RangeError) throw new require_biff_records.BiffFormatError("incorrect password for XOR-obfuscated workbook");
+		throw error;
+	}
+	if (computedKey !== header.key || computedVerifier !== header.verificationBytes) throw new require_biff_records.BiffFormatError("incorrect password for XOR-obfuscated workbook");
+	const array = (0, archive_codec.createXorObfuscationArray)(password, archive_codec.XOR_OBFUSCATION_ROTATE_DISTANCE_METHOD1);
+	return records.map((record) => decryptRecordXor(record, array));
+}
 /**
-* Decrypts every record of a workbook stream protected by [MS-OFFCRYPTO] 2.3.6.1's RC4 encryption header, given the `FilePass` record already located within `records` and the password to decrypt it with.
+* Decrypts every record of a workbook stream protected by [MS-XLS] 2.4.117's FilePass record, under whichever of the two schemes it names (the [MS-OFFCRYPTO] 2.3.6.1 RC4 encryption header, or 2.3.7's XOR obfuscation), given the `FilePass` record already located within `records` and the password to decrypt it with.
 *
-* Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI, XOR obfuscation) -- there is no partial or best-effort result to return in any of those cases.
+* Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI) -- there is no partial or best-effort result to return in any of those cases.
 */
 function decryptWorkbookRecords(records, filePassRecord, password) {
-	const header = readFilePassRc4Header(filePassRecord);
-	if (password === void 0) throw new require_biff_records.BiffFormatError("workbook is RC4-encrypted (FilePass record); call readXlsContent with a password to decrypt it");
-	const baseHash = (0, archive_codec.deriveOfficeRc4BaseHash)(password, header.salt);
-	verifyOfficeRc4Password(baseHash, header);
-	return records.map((record) => decryptRecord(record, baseHash));
+	const header = readFilePassHeader(filePassRecord);
+	if (password === void 0) throw new require_biff_records.BiffFormatError(`workbook is ${header.kind === "xor" ? "XOR-obfuscated" : "RC4-encrypted"} (FilePass record); call readXlsContent with a password to decrypt it`);
+	return header.kind === "xor" ? decryptWorkbookRecordsXor(records, header, password) : decryptWorkbookRecordsRc4(records, header, password);
 }
 //#endregion
 exports.decryptWorkbookRecords = decryptWorkbookRecords;

package/dist/workbook/encryption.d.cts

@@ -1,9 +1,9 @@
 import { n as BiffRecord } from "../records-G82UEVq8.cjs";
 //#region src/workbook/encryption.d.ts
 /**
- * Decrypts every record of a workbook stream protected by [MS-OFFCRYPTO] 2.3.6.1's RC4 encryption header, given the `FilePass` record already located within `records` and the password to decrypt it with.
+ * Decrypts every record of a workbook stream protected by [MS-XLS] 2.4.117's FilePass record, under whichever of the two schemes it names (the [MS-OFFCRYPTO] 2.3.6.1 RC4 encryption header, or 2.3.7's XOR obfuscation), given the `FilePass` record already located within `records` and the password to decrypt it with.
  *
- * Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI, XOR obfuscation) -- there is no partial or best-effort result to return in any of those cases.
+ * Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI) -- there is no partial or best-effort result to return in any of those cases.
  */
 declare function decryptWorkbookRecords(records: readonly BiffRecord[], filePassRecord: BiffRecord, password: string | undefined): readonly BiffRecord[];
 //#endregion

package/dist/workbook/encryption.d.ts

@@ -1,9 +1,9 @@
 import { n as BiffRecord } from "../records-G82UEVq8.js";
 //#region src/workbook/encryption.d.ts
 /**
- * Decrypts every record of a workbook stream protected by [MS-OFFCRYPTO] 2.3.6.1's RC4 encryption header, given the `FilePass` record already located within `records` and the password to decrypt it with.
+ * Decrypts every record of a workbook stream protected by [MS-XLS] 2.4.117's FilePass record, under whichever of the two schemes it names (the [MS-OFFCRYPTO] 2.3.6.1 RC4 encryption header, or 2.3.7's XOR obfuscation), given the `FilePass` record already located within `records` and the password to decrypt it with.
  *
- * Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI, XOR obfuscation) -- there is no partial or best-effort result to return in any of those cases.
+ * Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI) -- there is no partial or best-effort result to return in any of those cases.
  */
 declare function decryptWorkbookRecords(records: readonly BiffRecord[], filePassRecord: BiffRecord, password: string | undefined): readonly BiffRecord[];
 //#endregion

package/dist/workbook/encryption.js

@@ -1,9 +1,10 @@
 import { RECORD_BOF } from "../biff/record-types.js";
 import { BiffFormatError } from "../biff/records.js";
 import { BlockCursor } from "../biff/cursor.js";
-import { OFFICE_RC4_VERIFIER_LENGTH, decryptOfficeRc4, deriveOfficeRc4BaseHash, md5 } from "archive-codec";
+import { OFFICE_RC4_VERIFIER_LENGTH, XOR_OBFUSCATION_ARRAY_LENGTH, XOR_OBFUSCATION_ROTATE_DISTANCE_METHOD1, createXorObfuscationArray, createXorObfuscationKey, createXorObfuscationPasswordVerifier, decryptOfficeRc4, decryptXorObfuscationMethod1, deriveOfficeRc4BaseHash, md5 } from "archive-codec";
 //#region src/workbook/encryption.ts
-/** [MS-XLS] 2.4.117's own wEncryptionType: RC4 encryption, as opposed to 0x0000 (XOR obfuscation, out of scope). */
+/** [MS-XLS] 2.4.117's own wEncryptionType. */
+const ENCRYPTION_TYPE_XOR = 0;
 const ENCRYPTION_TYPE_RC4 = 1;
 /** [MS-OFFCRYPTO] 2.3.6.1's own EncryptionVersionInfo: vMajor/vMinor MUST both be 1 for the "RC4 encryption header" this module reads. vMajor 2/3/4 with vMinor 2 names the RC4 CryptoAPI encryption header instead (2.3.5.1), a different, unimplemented header shape. */
 const RC4_HEADER_VERSION_MAJOR = 1;
@@ -20,29 +21,28 @@ const NEVER_ENCRYPTED_RECORD_TYPES = /* @__PURE__ */ new Set([
 	406,
 	312
 ]);
-/** Reads FilePass's own fields, rejecting the two encryption schemes this module does not implement with a specific message rather than a generic parse failure. */
-function readFilePassRc4Header(filePassRecord) {
+/** Reads FilePass's own fields, dispatching on wEncryptionType, and rejecting RC4 CryptoAPI (the one scheme this module does not implement) with a specific message rather than a generic parse failure. */
+function readFilePassHeader(filePassRecord) {
 	const cursor = new BlockCursor([filePassRecord.data]);
 	const encryptionType = cursor.u16();
-	if (encryptionType !== ENCRYPTION_TYPE_RC4) throw new BiffFormatError(`workbook uses FilePass wEncryptionType 0x${encryptionType.toString(16).padStart(4, "0")} (XOR obfuscation), which this reader does not decrypt`);
+	if (encryptionType === ENCRYPTION_TYPE_XOR) return {
+		kind: "xor",
+		key: cursor.u16(),
+		verificationBytes: cursor.u16()
+	};
+	if (encryptionType !== ENCRYPTION_TYPE_RC4) throw new BiffFormatError(`workbook uses FilePass wEncryptionType 0x${encryptionType.toString(16).padStart(4, "0")}, which this reader does not decrypt`);
 	const versionMajor = cursor.u16();
 	const versionMinor = cursor.u16();
 	if (versionMajor !== RC4_HEADER_VERSION_MAJOR || versionMinor !== RC4_HEADER_VERSION_MINOR) throw new BiffFormatError(`workbook uses RC4 CryptoAPI encryption (EncryptionVersionInfo ${versionMajor}.${versionMinor}), which this reader does not decrypt`);
 	return {
+		kind: "rc4",
 		salt: cursor.take(OFFICE_RC4_VERIFIER_LENGTH),
 		encryptedVerifier: cursor.take(OFFICE_RC4_VERIFIER_LENGTH),
 		encryptedVerifierHash: cursor.take(OFFICE_RC4_VERIFIER_LENGTH)
 	};
 }
-/** [MS-OFFCRYPTO] 2.3.6.4's own password verification: block 0's key decrypts EncryptedVerifier, and MD5 of the result must equal the same block's decryption of EncryptedVerifierHash. Both verifier fields sit in one continuous keystream starting at position 0, not two independently-reset ones -- though decryptOfficeRc4 regenerates its keystream fresh from block start on every call regardless, so decrypting them as two separate 16-byte calls at offsets 0 and 16 is equivalent to one 32-byte call, not merely close to it. */
-function verifyOfficeRc4Password(baseHash, header) {
-	const decryptedVerifier = decryptOfficeRc4(baseHash, 0, header.encryptedVerifier);
-	const decryptedVerifierHash = decryptOfficeRc4(baseHash, OFFICE_RC4_VERIFIER_LENGTH, header.encryptedVerifierHash);
-	const computedHash = md5(decryptedVerifier);
-	if (!(computedHash.length === decryptedVerifierHash.length && computedHash.every((byte, index) => byte === decryptedVerifierHash[index]))) throw new BiffFormatError("incorrect password for RC4-encrypted workbook");
-}
-/** Decrypts one record's own data in place against the derived base hash, honouring every [MS-XLS] 2.2.10 exclusion: a never-encrypted record's data is returned unchanged, BoundSheet8's own lbPlyPos prefix is preserved while the rest of its data is decrypted, and everything else is decrypted whole. `record.offset` is the record's own header start, so its data begins `HEADER_SIZE` bytes further into the stream -- the position [MS-OFFCRYPTO]'s block-keyed keystream is defined against. */
-function decryptRecord(record, baseHash) {
+/** Decrypts one record's own data against the derived RC4 base hash, honouring every [MS-XLS] 2.2.10 exclusion: a never-encrypted record's data is returned unchanged, BoundSheet8's own lbPlyPos prefix is preserved while the rest of its data is decrypted, and everything else is decrypted whole. `record.offset` is the record's own header start, so its data begins `HEADER_SIZE` bytes further into the stream -- the position [MS-OFFCRYPTO]'s block-keyed keystream is defined against. */
+function decryptRecordRc4(record, baseHash) {
 	if (NEVER_ENCRYPTED_RECORD_TYPES.has(record.type)) return record;
 	const dataOffset = record.offset + 4;
 	if (record.type === 133) {
@@ -61,17 +61,64 @@ function decryptRecord(record, baseHash) {
 		data: decryptOfficeRc4(baseHash, dataOffset, record.data)
 	};
 }
+/** [MS-XLS] 2.2.10's own XorArrayIndex rule for a record's decrypted span starting `spanOffset` bytes into the Workbook stream: `(streamOffset + recordDataLength) % 16`, where `recordDataLength` is the record's own FULL declared data length -- not the length of `spanOffset`'s own remaining span, which for BoundSheet8 is 4 bytes shorter than the record's own declared size. Confirmed against Apache POI's own `XORDecryptor.invokeCipher` comment ("XorArrayIndex = (FileOffset + Data.Length) % 16") and LibreOffice's `XclImpBiff5Decrypter::OnUpdate`, and directly against a real Excel-generated XOR-obfuscated fixture -- see archive-codec's own crypto/xor-obfuscation.test.ts. */
+function xorArrayIndexFor(spanOffset, recordDataLength) {
+	return (spanOffset + recordDataLength) % XOR_OBFUSCATION_ARRAY_LENGTH;
+}
+/** Decrypts one record's own data against the derived XOR obfuscation array, honouring the same [MS-XLS] 2.2.10 exclusions decryptRecordRc4 does. */
+function decryptRecordXor(record, array) {
+	if (NEVER_ENCRYPTED_RECORD_TYPES.has(record.type)) return record;
+	const dataOffset = record.offset + 4;
+	if (record.type === 133) {
+		const lbPlyPos = record.data.subarray(0, BOUNDSHEET8_LBPLYPOS_SIZE);
+		const spanOffset = dataOffset + BOUNDSHEET8_LBPLYPOS_SIZE;
+		const decryptedRest = decryptXorObfuscationMethod1(array, record.data.subarray(BOUNDSHEET8_LBPLYPOS_SIZE), xorArrayIndexFor(spanOffset, record.data.length));
+		const data = new Uint8Array(record.data.length);
+		data.set(lbPlyPos, 0);
+		data.set(decryptedRest, BOUNDSHEET8_LBPLYPOS_SIZE);
+		return {
+			...record,
+			data
+		};
+	}
+	return {
+		...record,
+		data: decryptXorObfuscationMethod1(array, record.data, xorArrayIndexFor(dataOffset, record.data.length))
+	};
+}
+/** [MS-OFFCRYPTO] 2.3.6.4's own password verification: block 0's key decrypts EncryptedVerifier, and MD5 of the result must equal the same block's decryption of EncryptedVerifierHash. Both verifier fields sit in one continuous keystream starting at position 0, not two independently-reset ones -- though decryptOfficeRc4 regenerates its keystream fresh from block start on every call regardless, so decrypting them as two separate 16-byte calls at offsets 0 and 16 is equivalent to one 32-byte call, not merely close to it. */
+function decryptWorkbookRecordsRc4(records, header, password) {
+	const baseHash = deriveOfficeRc4BaseHash(password, header.salt);
+	const decryptedVerifier = decryptOfficeRc4(baseHash, 0, header.encryptedVerifier);
+	const decryptedVerifierHash = decryptOfficeRc4(baseHash, OFFICE_RC4_VERIFIER_LENGTH, header.encryptedVerifierHash);
+	const computedHash = md5(decryptedVerifier);
+	if (!(computedHash.length === decryptedVerifierHash.length && computedHash.every((byte, index) => byte === decryptedVerifierHash[index]))) throw new BiffFormatError("incorrect password for RC4-encrypted workbook");
+	return records.map((record) => decryptRecordRc4(record, baseHash));
+}
+/** Verifies the password against both of XORObfuscation's own fields (its `key` and `verificationBytes`, matching Apache POI's own `XORDecryptor.verifyPassword`, which checks both rather than either alone) before decrypting every record. */
+function decryptWorkbookRecordsXor(records, header, password) {
+	let computedKey;
+	let computedVerifier;
+	try {
+		computedKey = createXorObfuscationKey(password);
+		computedVerifier = createXorObfuscationPasswordVerifier(password);
+	} catch (error) {
+		if (error instanceof RangeError) throw new BiffFormatError("incorrect password for XOR-obfuscated workbook");
+		throw error;
+	}
+	if (computedKey !== header.key || computedVerifier !== header.verificationBytes) throw new BiffFormatError("incorrect password for XOR-obfuscated workbook");
+	const array = createXorObfuscationArray(password, XOR_OBFUSCATION_ROTATE_DISTANCE_METHOD1);
+	return records.map((record) => decryptRecordXor(record, array));
+}
 /**
-* Decrypts every record of a workbook stream protected by [MS-OFFCRYPTO] 2.3.6.1's RC4 encryption header, given the `FilePass` record already located within `records` and the password to decrypt it with.
+* Decrypts every record of a workbook stream protected by [MS-XLS] 2.4.117's FilePass record, under whichever of the two schemes it names (the [MS-OFFCRYPTO] 2.3.6.1 RC4 encryption header, or 2.3.7's XOR obfuscation), given the `FilePass` record already located within `records` and the password to decrypt it with.
 *
-* Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI, XOR obfuscation) -- there is no partial or best-effort result to return in any of those cases.
+* Throws `BiffFormatError` for a missing password, an incorrect one, or an encryption scheme this module does not implement (RC4 CryptoAPI) -- there is no partial or best-effort result to return in any of those cases.
 */
 function decryptWorkbookRecords(records, filePassRecord, password) {
-	const header = readFilePassRc4Header(filePassRecord);
-	if (password === void 0) throw new BiffFormatError("workbook is RC4-encrypted (FilePass record); call readXlsContent with a password to decrypt it");
-	const baseHash = deriveOfficeRc4BaseHash(password, header.salt);
-	verifyOfficeRc4Password(baseHash, header);
-	return records.map((record) => decryptRecord(record, baseHash));
+	const header = readFilePassHeader(filePassRecord);
+	if (password === void 0) throw new BiffFormatError(`workbook is ${header.kind === "xor" ? "XOR-obfuscated" : "RC4-encrypted"} (FilePass record); call readXlsContent with a password to decrypt it`);
+	return header.kind === "xor" ? decryptWorkbookRecordsXor(records, header, password) : decryptWorkbookRecordsRc4(records, header, password);
 }
 //#endregion
 export { decryptWorkbookRecords };

package/dist/workbook/globals-writer.d.cts

@@ -1,4 +1,4 @@
-import { E as XfDecorationFields } from "../xf-colors-mqerVt2O.cjs";
+import { E as XfDecorationFields } from "../xf-colors-aeH9Ax3Q.cjs";
 import { t as PrintNamePlanEntry } from "../print-names-B2OR0fvs.cjs";
 import { Alignment, Color } from "document-schema.js";
 //#region src/workbook/globals-writer.d.ts

package/dist/workbook/globals-writer.d.ts

@@ -1,4 +1,4 @@
-import { E as XfDecorationFields } from "../xf-colors-d3OvRw76.js";
+import { E as XfDecorationFields } from "../xf-colors-kdNsiNYt.js";
 import { t as PrintNamePlanEntry } from "../print-names-BXcmmwVi.js";
 import { Alignment, Color } from "document-schema.js";
 //#region src/workbook/globals-writer.d.ts

package/dist/workbook/globals.d.cts

@@ -1,6 +1,6 @@
-import { a as SheetRange, t as ExternalSheetLabel } from "../ptg-CCBbJLZJ.cjs";
+import { a as SheetRange, t as ExternalSheetLabel } from "../ptg-75v7MhaA.cjs";
 import { t as RecordGroup } from "../substreams-XDNgDvRJ.cjs";
-import { E as XfDecorationFields, w as XfAlignmentFields } from "../xf-colors-mqerVt2O.cjs";
+import { E as XfDecorationFields, w as XfAlignmentFields } from "../xf-colors-aeH9Ax3Q.cjs";
 import { n as SheetPrintNames } from "../print-names-B2OR0fvs.cjs";
 import { Color } from "document-schema.js";
 //#region src/workbook/globals.d.ts

package/dist/workbook/globals.d.ts

@@ -1,6 +1,6 @@
-import { a as SheetRange, t as ExternalSheetLabel } from "../ptg-CCBbJLZJ.js";
+import { a as SheetRange, t as ExternalSheetLabel } from "../ptg-75v7MhaA.js";
 import { t as RecordGroup } from "../substreams-CgTHx5kX.js";
-import { E as XfDecorationFields, w as XfAlignmentFields } from "../xf-colors-d3OvRw76.js";
+import { E as XfDecorationFields, w as XfAlignmentFields } from "../xf-colors-kdNsiNYt.js";
 import { n as SheetPrintNames } from "../print-names-BXcmmwVi.js";
 import { Color } from "document-schema.js";
 //#region src/workbook/globals.d.ts

package/dist/workbook/sheet.cjs

@@ -11,6 +11,7 @@ const require_biff_ptg = require("../biff/ptg.cjs");
 const require_biff_rk = require("../biff/rk.cjs");
 const require_workbook_conditional_format = require("./conditional-format.cjs");
 const require_workbook_conditional_format_12 = require("./conditional-format-12.cjs");
+const require_workbook_conditional_format_ex = require("./conditional-format-ex.cjs");
 const require_workbook_data_validation = require("./data-validation.cjs");
 //#region src/workbook/sheet.ts
 /** Row record flag bits, in the 32-bit field following unused1 ([MS-XLS] 2.4.221). */
@@ -116,6 +117,7 @@ function readSheetRecords(records, sharedStrings, formulaSheets = EMPTY_FORMULA_
 	const dataValidations = [];
 	const conditionalFormats = [];
 	const conditionalFormats12 = [];
+	const legacyCondFmtsByNID = /* @__PURE__ */ new Map();
 	let usedRange;
 	const marginsPt = {};
 	const rowBreaks = [];
@@ -148,6 +150,10 @@ function readSheetRecords(records, sharedStrings, formulaSheets = EMPTY_FORMULA_
 			case 432: {
 				const group = require_workbook_conditional_format.readCondFmtGroup(records, index, formulaSheets);
 				conditionalFormats.push(...group.formats);
+				legacyCondFmtsByNID.set(group.nID, {
+					ranges: group.ranges,
+					cfs: group.rawCfs
+				});
 				index += group.recordsConsumed - 1;
 				break;
 			}
@@ -157,6 +163,11 @@ function readSheetRecords(records, sharedStrings, formulaSheets = EMPTY_FORMULA_
 				index += group.recordsConsumed - 1;
 				break;
 			}
+			case require_biff_record_types.RECORD_CFEX: {
+				const format = require_workbook_conditional_format_ex.readCfEx(record, legacyCondFmtsByNID, formulaSheets);
+				if (format !== void 0) conditionalFormats12.push(format);
+				break;
+			}
 			case 513:
 				cells.push(readBlank(record));
 				break;

package/dist/workbook/sheet.d.cts

@@ -1,9 +1,9 @@
 import { n as SetupFields } from "../print-setup-B_ihDvm5.cjs";
-import { r as FormulaSheetContext } from "../ptg-CCBbJLZJ.cjs";
+import { r as FormulaSheetContext } from "../ptg-75v7MhaA.cjs";
 import { t as RecordGroup } from "../substreams-XDNgDvRJ.cjs";
-import { n as RawConditionalFormat } from "../conditional-format-Bt1vRWgc.cjs";
-import { a as RawConditionalFormat12 } from "../conditional-format-12-CZ43-CR4.cjs";
-import { t as RawDataValidation } from "../data-validation-lJWM9-AP.cjs";
+import { r as RawConditionalFormat } from "../conditional-format-Cth_afMy.cjs";
+import { a as RawConditionalFormat12 } from "../conditional-format-12-D65-ruTq.cjs";
+import { t as RawDataValidation } from "../data-validation-BgUt8CbE.cjs";
 //#region src/workbook/sheet.d.ts
 /** A cell's value as its own record carries it, before number-format classification decides whether a number is really a date, a percentage, or an amount of money. */
 type RawCellValue = {

package/dist/workbook/sheet.d.ts

@@ -1,9 +1,9 @@
 import { n as SetupFields } from "../print-setup-B_ihDvm5.js";
-import { r as FormulaSheetContext } from "../ptg-CCBbJLZJ.js";
+import { r as FormulaSheetContext } from "../ptg-75v7MhaA.js";
 import { t as RecordGroup } from "../substreams-CgTHx5kX.js";
-import { n as RawConditionalFormat } from "../conditional-format-Cqcjnm7O.js";
-import { a as RawConditionalFormat12 } from "../conditional-format-12-Xl52VBCj.js";
-import { t as RawDataValidation } from "../data-validation-BeYpL3Nb.js";
+import { r as RawConditionalFormat } from "../conditional-format-BRMUTRP1.js";
+import { a as RawConditionalFormat12 } from "../conditional-format-12-C3nwy1f8.js";
+import { t as RawDataValidation } from "../data-validation-Cq6iD8lB.js";
 //#region src/workbook/sheet.d.ts
 /** A cell's value as its own record carries it, before number-format classification decides whether a number is really a date, a percentage, or an amount of money. */
 type RawCellValue = {

package/dist/workbook/sheet.js

@@ -1,4 +1,4 @@
-import { RECORD_CONDFMT12 } from "../biff/record-types.js";
+import { RECORD_CFEX, RECORD_CONDFMT12 } from "../biff/record-types.js";
 import { BiffFormatError } from "../biff/records.js";
 import { columnWidthToPoints, inchesToPoints, twipsToPoints } from "../units.js";
 import { unpackSetupFlags } from "../biff/print-setup.js";
@@ -10,6 +10,7 @@ import { parseFormulaText, readPtgExpBase } from "../biff/ptg.js";
 import { decodeRkNumber } from "../biff/rk.js";
 import { readCondFmtGroup } from "./conditional-format.js";
 import { readCondFmt12Group } from "./conditional-format-12.js";
+import { readCfEx } from "./conditional-format-ex.js";
 import { readDv } from "./data-validation.js";
 //#region src/workbook/sheet.ts
 /** Row record flag bits, in the 32-bit field following unused1 ([MS-XLS] 2.4.221). */
@@ -115,6 +116,7 @@ function readSheetRecords(records, sharedStrings, formulaSheets = EMPTY_FORMULA_
 	const dataValidations = [];
 	const conditionalFormats = [];
 	const conditionalFormats12 = [];
+	const legacyCondFmtsByNID = /* @__PURE__ */ new Map();
 	let usedRange;
 	const marginsPt = {};
 	const rowBreaks = [];
@@ -147,6 +149,10 @@ function readSheetRecords(records, sharedStrings, formulaSheets = EMPTY_FORMULA_
 			case 432: {
 				const group = readCondFmtGroup(records, index, formulaSheets);
 				conditionalFormats.push(...group.formats);
+				legacyCondFmtsByNID.set(group.nID, {
+					ranges: group.ranges,
+					cfs: group.rawCfs
+				});
 				index += group.recordsConsumed - 1;
 				break;
 			}
@@ -156,6 +162,11 @@ function readSheetRecords(records, sharedStrings, formulaSheets = EMPTY_FORMULA_
 				index += group.recordsConsumed - 1;
 				break;
 			}
+			case RECORD_CFEX: {
+				const format = readCfEx(record, legacyCondFmtsByNID, formulaSheets);
+				if (format !== void 0) conditionalFormats12.push(format);
+				break;
+			}
 			case 513:
 				cells.push(readBlank(record));
 				break;

package/dist/{xf-colors-mqerVt2O.d.cts → xf-colors-aeH9Ax3Q.d.cts}

@@ -1,4 +1,4 @@
-import { t as BlockCursor } from "./cursor-VMtw9uVP.cjs";
+import { t as BlockCursor } from "./cursor-CnEuX5qE.cjs";
 import { Alignment, Color, ContentBorder, ContentCellFill, ContentCellPatternType } from "document-schema.js";
 //#region src/biff/xf-colors.d.ts
 /** FLSNULL: no fill pattern -- the cell's fill colour fields carry no meaning. */

package/dist/{xf-colors-d3OvRw76.d.ts → xf-colors-kdNsiNYt.d.ts}

@@ -1,4 +1,4 @@
-import { t as BlockCursor } from "./cursor-VMtw9uVP.js";
+import { t as BlockCursor } from "./cursor-CnEuX5qE.js";
 import { Alignment, Color, ContentBorder, ContentCellFill, ContentCellPatternType } from "document-schema.js";
 //#region src/biff/xf-colors.d.ts
 /** FLSNULL: no fill pattern -- the cell's fill colour fields carry no meaning. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xls-codec",
-  "version": "4.8.0",
+  "version": "4.10.0",
   "description": "Hand-written reader for the legacy Excel Binary File Format (.xls, BIFF8) as specified by [MS-XLS], mapping a workbook's record stream onto the shared document-schema.js spreadsheet model - the .xls codec for the documents.js family.",
   "type": "module",
   "repository": {
@@ -70,7 +70,7 @@
   },
   "packageManager": "pnpm@11.6.0",
   "dependencies": {
-    "archive-codec": "1.9.2",
+    "archive-codec": "1.10.0",
     "document-schema.js": "7.5.0",
     "excel-number-format": "1.1.1"
   },