@@ -3,6 +3,7 @@ import { createLogger } from '@sim/logger'
 import mammoth from 'mammoth'
 import type { FileParseResult, FileParser } from '@/lib/file-parsers/types'
 import { sanitizeTextForUTF8 } from '@/lib/file-parsers/utils'
+import { assertOoxmlArchiveWithinLimits } from '@/lib/file-parsers/zip-guard'
 
 const logger = createLogger('DocxParser')
 
@@ -37,6 +38,8 @@ export class DocxParser implements FileParser {
         throw new Error('Empty buffer provided')
       }
 
+      assertOoxmlArchiveWithinLimits(buffer)
+
       try {
         const result = await mammoth.extractRawText({ buffer })
 
 
@@ -3,6 +3,7 @@ import { readFile } from 'fs/promises'
 import { createLogger } from '@sim/logger'
 import type { FileParseResult, FileParser } from '@/lib/file-parsers/types'
 import { sanitizeTextForUTF8 } from '@/lib/file-parsers/utils'
+import { assertOoxmlArchiveWithinLimits } from '@/lib/file-parsers/zip-guard'
 
 const logger = createLogger('PptxParser')
 
@@ -35,6 +36,8 @@ export class PptxParser implements FileParser {
         throw new Error('Empty buffer provided')
       }
 
+      assertOoxmlArchiveWithinLimits(buffer)
+
       let parseOfficeAsync
       try {
         const officeParser = await import('officeparser')
 
@@ -1,8 +1,10 @@
 import { existsSync } from 'fs'
+import { readFile } from 'fs/promises'
 import { createLogger } from '@sim/logger'
 import * as XLSX from 'xlsx'
 import type { FileParseResult, FileParser } from '@/lib/file-parsers/types'
 import { sanitizeTextForUTF8 } from '@/lib/file-parsers/utils'
+import { assertOoxmlArchiveWithinLimits } from '@/lib/file-parsers/zip-guard'
 
 const logger = createLogger('XlsxParser')
 
@@ -16,6 +18,10 @@ const CONFIG = {
 }
 
 export class XlsxParser implements FileParser {
+  /**
+   * Read the file into a buffer and delegate to {@link parseBuffer} so the
+   * decompression-bomb guard runs before SheetJS inflates the workbook.
+   */
   async parseFile(filePath: string): Promise<FileParseResult> {
     try {
       if (!filePath) {
@@ -28,13 +34,8 @@ export class XlsxParser implements FileParser {
 
       logger.info(`Parsing XLSX file: ${filePath}`)
 
-      // Read with streaming option for large files
-      const workbook = XLSX.readFile(filePath, {
-        dense: true, // Use dense mode for better memory efficiency
-        sheetStubs: false, // Don't create stub cells
-      })
-
-      return this.processWorkbook(workbook)
+      const buffer = await readFile(filePath)
+      return this.parseBuffer(buffer)
     } catch (error) {
       logger.error('XLSX file parsing error:', error)
       throw new Error(`Failed to parse XLSX file: ${(error as Error).message}`)
@@ -52,6 +53,8 @@ export class XlsxParser implements FileParser {
         throw new Error('Empty buffer provided')
       }
 
+      assertOoxmlArchiveWithinLimits(buffer)
+
       const workbook = XLSX.read(buffer, {
         type: 'buffer',
         dense: true, // Use dense mode for better memory efficiency
 
@@ -0,0 +1,123 @@
+/**
+ * @vitest-environment node
+ */
+import JSZip from 'jszip'
+import { describe, expect, it } from 'vitest'
+import {
+  assertOoxmlArchiveWithinLimits,
+  type OoxmlSizeLimits,
+  ZipBombError,
+} from '@/lib/file-parsers/zip-guard'
+
+const HIGH_LIMITS: OoxmlSizeLimits = {
+  maxTotalUncompressedBytes: 1024 * 1024 * 1024,
+  maxCompressionRatio: 10_000,
+  ratioCheckFloorBytes: 1024 * 1024 * 1024,
+}
+
+async function buildZip(
+  entries: Record<string, string>,
+  options: { comment?: string } = {}
+): Promise<Buffer> {
+  const zip = new JSZip()
+  for (const [name, content] of Object.entries(entries)) {
+    zip.file(name, content)
+  }
+  return zip.generateAsync({
+    type: 'nodebuffer',
+    compression: 'DEFLATE',
+    comment: options.comment,
+  })
+}
+
+describe('assertOoxmlArchiveWithinLimits', () => {
+  it('accepts a well-formed archive within limits', async () => {
+    const buffer = await buildZip({ 'word/document.xml': '<xml>hello world</xml>' })
+    expect(() => assertOoxmlArchiveWithinLimits(buffer, HIGH_LIMITS)).not.toThrow()
+  })
+
+  it('rejects an archive whose declared expanded size exceeds the absolute cap', async () => {
+    const buffer = await buildZip({ 'xl/worksheets/sheet1.xml': 'A'.repeat(200_000) })
+    expect(() =>
+      assertOoxmlArchiveWithinLimits(buffer, {
+        maxTotalUncompressedBytes: 100_000,
+        maxCompressionRatio: 10_000,
+        ratioCheckFloorBytes: 1024 * 1024 * 1024,
+      })
+    ).toThrow(ZipBombError)
+  })
+
+  it('rejects an archive whose compression ratio exceeds the limit', async () => {
+    const buffer = await buildZip({ 'xl/worksheets/sheet1.xml': 'A'.repeat(200_000) })
+    expect(() =>
+      assertOoxmlArchiveWithinLimits(buffer, {
+        maxTotalUncompressedBytes: 1024 * 1024 * 1024,
+        maxCompressionRatio: 5,
+        ratioCheckFloorBytes: 1000,
+      })
+    ).toThrow(ZipBombError)
+  })
+
+  it('does not flag a small but highly compressible archive below the ratio floor', async () => {
+    const buffer = await buildZip({ 'xl/worksheets/sheet1.xml': 'A'.repeat(200_000) })
+    expect(() =>
+      assertOoxmlArchiveWithinLimits(buffer, {
+        maxTotalUncompressedBytes: 1024 * 1024 * 1024,
+        maxCompressionRatio: 5,
+        ratioCheckFloorBytes: 1024 * 1024 * 1024,
+      })
+    ).not.toThrow()
+  })
+
+  it('sums declared sizes across multiple entries', async () => {
+    const buffer = await buildZip({
+      'a.xml': 'A'.repeat(60_000),
+      'b.xml': 'B'.repeat(60_000),
+    })
+    expect(() =>
+      assertOoxmlArchiveWithinLimits(buffer, {
+        maxTotalUncompressedBytes: 100_000,
+        maxCompressionRatio: 10_000,
+        ratioCheckFloorBytes: 1024 * 1024 * 1024,
+      })
+    ).toThrow(ZipBombError)
+  })
+
+  it('accepts a well-formed archive that carries a trailing comment', async () => {
+    const buffer = await buildZip(
+      { 'word/document.xml': '<xml>hello</xml>' },
+      { comment: 'generated by test' }
+    )
+    expect(() => assertOoxmlArchiveWithinLimits(buffer, HIGH_LIMITS)).not.toThrow()
+  })
+
+  it('fails closed for a ZIP-shaped buffer whose central directory is unparseable', () => {
+    const buffer = Buffer.alloc(64)
+    buffer.writeUInt32LE(0x04034b50, 0) // local file header signature, no valid EOCD
+    expect(() => assertOoxmlArchiveWithinLimits(buffer)).toThrow(ZipBombError)
+  })
+
+  it('rejects a decoy EOCD signature that does not validate against the buffer tail', async () => {
+    const realZip = await buildZip({ 'xl/worksheets/sheet1.xml': 'A'.repeat(200_000) })
+    // A decoy EOCD (zeroed central directory) appended after the genuine archive
+    // would, without tail validation, redirect the guard to an empty directory
+    // and undercount the real entries.
+    const decoy = Buffer.alloc(64)
+    decoy.writeUInt32LE(0x06054b50, 0)
+    const tampered = Buffer.concat([realZip, decoy])
+    expect(() => assertOoxmlArchiveWithinLimits(tampered)).toThrow(ZipBombError)
+  })
+
+  it('no-ops for buffers that are not ZIP archives', () => {
+    const plaintext = Buffer.from('this is just plain text, not a zip archive at all')
+    expect(() => assertOoxmlArchiveWithinLimits(plaintext)).not.toThrow()
+  })
+
+  it('no-ops for buffers too small to contain an EOCD record', () => {
+    expect(() => assertOoxmlArchiveWithinLimits(Buffer.from('PK'))).not.toThrow()
+  })
+
+  it('no-ops for an empty buffer', () => {
+    expect(() => assertOoxmlArchiveWithinLimits(Buffer.alloc(0))).not.toThrow()
+  })
+})