@cj-tech-master/excelts 4.2.1-canary.20260111102127.f808a37 → 4.2.1-canary.20260112134913.a3cecdd

package/dist/browser/modules/archive/io/archive-sink.d.ts

@@ -4,6 +4,5 @@ export type ArchiveSink = WritableStream<Uint8Array> | {
     on?(event: string, listener: (...args: any[]) => void): any;
     once?(event: string, listener: (...args: any[]) => void): any;
 };
-export declare function isWritableStream(value: unknown): value is WritableStream<Uint8Array>;
 export declare function pipeIterableToSink(iterable: AsyncIterable<Uint8Array>, sink: ArchiveSink): Promise<void>;
 export declare function collect(iterable: AsyncIterable<Uint8Array>): Promise<Uint8Array>;

package/dist/browser/modules/archive/io/archive-sink.js

@@ -1,26 +1,6 @@
-export function isWritableStream(value) {
-    return !!value && typeof value === "object" && typeof value.getWriter === "function";
-}
-function once(emitter, event) {
-    return new Promise((resolve, reject) => {
-        const onError = (err) => {
-            cleanup();
-            reject(err instanceof Error ? err : new Error(String(err)));
-        };
-        const onDone = () => {
-            cleanup();
-            resolve();
-        };
-        const cleanup = () => {
-            emitter.off?.("error", onError);
-            emitter.off?.(event, onDone);
-            emitter.removeListener?.("error", onError);
-            emitter.removeListener?.(event, onDone);
-        };
-        emitter.on?.("error", onError);
-        emitter.on?.(event, onDone);
-    });
-}
+import { concatUint8Arrays } from "../../stream/shared.js";
+import { onceEvent } from "../../stream/internal/event-utils.js";
+import { isWritableStream } from "../../stream/internal/type-guards.js";
 export async function pipeIterableToSink(iterable, sink) {
     if (isWritableStream(sink)) {
         const writer = sink.getWriter();
@@ -44,14 +24,14 @@ export async function pipeIterableToSink(iterable, sink) {
     for await (const chunk of iterable) {
         const ok = sink.write(chunk);
         if (ok === false && typeof sink.once === "function") {
-            await once(sink, "drain");
+            await onceEvent(sink, "drain");
         }
     }
     if (typeof sink.end === "function") {
         sink.end();
     }
     if (typeof sink.once === "function") {
-        await Promise.race([once(sink, "finish"), once(sink, "close")]);
+        await Promise.race([onceEvent(sink, "finish"), onceEvent(sink, "close")]);
     }
 }
 export async function collect(iterable) {
@@ -61,17 +41,5 @@ export async function collect(iterable) {
         chunks.push(chunk);
         total += chunk.length;
     }
-    if (chunks.length === 0) {
-        return new Uint8Array(0);
-    }
-    if (chunks.length === 1) {
-        return chunks[0];
-    }
-    const out = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        out.set(chunk, offset);
-        offset += chunk.length;
-    }
-    return out;
+    return concatUint8Arrays(chunks, total);
 }

package/dist/browser/modules/archive/io/archive-source.d.ts

@@ -1,8 +1,6 @@
 export type ArchiveSource = Uint8Array | ArrayBuffer | string | Blob | AsyncIterable<unknown> | ReadableStream<unknown> | {
     [Symbol.asyncIterator](): AsyncIterator<unknown>;
 };
-export declare function isReadableStream(value: unknown): value is ReadableStream<unknown>;
-export declare function isAsyncIterable(value: unknown): value is AsyncIterable<unknown>;
 export declare function toUint8ArraySync(source: Uint8Array | ArrayBuffer | string): Uint8Array;
 export declare function toUint8Array(source: Uint8Array | ArrayBuffer | string | Blob): Promise<Uint8Array>;
 export declare function toAsyncIterable(source: ArchiveSource): AsyncIterable<Uint8Array>;

package/dist/browser/modules/archive/io/archive-source.js

@@ -1,12 +1,5 @@
 import { encodeUtf8 } from "../utils/text.js";
-export function isReadableStream(value) {
-    return !!value && typeof value === "object" && typeof value.getReader === "function";
-}
-export function isAsyncIterable(value) {
-    return (!!value &&
-        (typeof value === "object" || typeof value === "function") &&
-        typeof value[Symbol.asyncIterator] === "function");
-}
+import { isAsyncIterable, isReadableStream } from "../../stream/internal/type-guards.js";
 function normalizeChunk(value) {
     if (!value) {
         return null;

package/dist/browser/modules/excel/utils/ooxml-validator.d.ts

@@ -0,0 +1,48 @@
+export type OoxmlProblemKind = "missing-part" | "xml-malformed" | "content-types-missing" | "content-types-malformed" | "content-types-missing-default" | "content-types-missing-for-part" | "content-types-duplicate-override" | "root-rels-missing-officeDocument" | "rels-malformed" | "rels-missing-target" | "rels-duplicate-id" | "rels-empty-target" | "rels-invalid-target-path" | "rels-source-missing" | "workbook-sheet-missing-rel" | "workbook-sheet-wrong-rel-type" | "workbook-duplicate-sheetId" | "workbook-duplicate-sheet-rid" | "sheet-missing-rels" | "sheet-controls-missing-drawing" | "sheet-control-missing-rel" | "sheet-control-wrong-rel-type" | "sheet-legacyDrawing-missing-rel" | "sheet-legacyDrawing-wrong-rel-type" | "sheet-drawing-missing-rel" | "sheet-drawing-wrong-rel-type" | "sheet-comments-missing-rel" | "sheet-comments-wrong-rel-type" | "sheet-hyperlink-missing-rel" | "sheet-hyperlink-wrong-rel-type" | "sheet-tablePart-missing-rel" | "sheet-tablePart-wrong-rel-type";
+export type OoxmlOrderingProblemKind = "sheet-legacyDrawing-after-controls";
+export interface OoxmlValidationProblem {
+    kind: OoxmlProblemKind;
+    file?: string;
+    message: string;
+}
+export interface OoxmlOrderingValidationProblem {
+    kind: OoxmlOrderingProblemKind;
+    file?: string;
+    message: string;
+}
+export interface OoxmlValidationReport {
+    ok: boolean;
+    problems: Array<OoxmlValidationProblem | OoxmlOrderingValidationProblem>;
+    stats: {
+        entryCount: number;
+        xmlLikeCount: number;
+        relsCount: number;
+    };
+}
+export interface OoxmlValidateOptions {
+    /**
+     * Whether to check every XML-like entry (.xml, .rels, .vml) for well-formedness.
+     * Default: true.
+     */
+    checkXmlWellFormed?: boolean;
+    /**
+     * Whether to validate relationship targets exist (TargetMode=External ignored).
+     * Default: true.
+     */
+    checkRelationshipTargets?: boolean;
+    /**
+     * Whether to validate that every ContentTypes Override PartName exists.
+     * Default: true.
+     */
+    checkContentTypesOverrides?: boolean;
+    /**
+     * Whether to validate worksheet <controls>/<legacyDrawing> r:id wiring.
+     * Default: true.
+     */
+    checkWorksheetControlWiring?: boolean;
+    /**
+     * If provided, stops after this many problems.
+     */
+    maxProblems?: number;
+}
+export declare function validateXlsxBuffer(xlsxBuffer: Uint8Array, options?: OoxmlValidateOptions): Promise<OoxmlValidationReport>;

package/dist/browser/modules/excel/utils/ooxml-validator.js

@@ -0,0 +1,469 @@
+import path from "node:path";
+import { extractAll } from "../../archive/unzip/extract.js";
+import { parseSax } from "./parse-sax.js";
+function pushProblem(problems, problem, maxProblems) {
+    if (maxProblems !== undefined && problems.length >= maxProblems) {
+        return;
+    }
+    problems.push(problem);
+}
+function stripLeadingSlash(p) {
+    return p.startsWith("/") ? p.slice(1) : p;
+}
+function isXmlLike(pathName) {
+    return pathName.endsWith(".xml") || pathName.endsWith(".rels") || pathName.endsWith(".vml");
+}
+function getRelsSourceDir(relsPath) {
+    // In OPC, relationship targets are resolved relative to the SOURCE part directory,
+    // not the .rels part directory.
+    //
+    // Examples:
+    // - _rels/.rels                           -> base "" (package root)
+    // - xl/_rels/workbook.xml.rels            -> base "xl"
+    // - xl/worksheets/_rels/sheet1.xml.rels   -> base "xl/worksheets"
+    if (relsPath === "_rels/.rels") {
+        return "";
+    }
+    const relsMarker = "/_rels/";
+    const idx = relsPath.indexOf(relsMarker);
+    if (idx === -1) {
+        return relsPath.includes("/") ? relsPath.slice(0, relsPath.lastIndexOf("/")) : "";
+    }
+    return relsPath.slice(0, idx);
+}
+function resolveRelTarget(relsPath, target) {
+    const baseDir = getRelsSourceDir(relsPath);
+    const resolved = path.posix.normalize(path.posix.join(baseDir, target));
+    return resolved.replace(/^\//, "");
+}
+function isSafeResolvedPath(resolved) {
+    // Prevent path traversal out of package root.
+    // `normalize()` can produce paths starting with "../".
+    return !(resolved === ".." || resolved.startsWith("../") || resolved.includes("/../"));
+}
+async function assertXmlWellFormed(xmlText) {
+    // parseSax throws on malformed XML.
+    for await (const _events of parseSax([xmlText])) {
+        // no-op
+    }
+}
+function parseContentTypes(xml) {
+    const defaults = [];
+    const overrides = [];
+    const defaultRe = /<Default\s+[^>]*Extension="([^"]+)"[^>]*ContentType="([^"]+)"[^>]*\/>/g;
+    const overrideRe = /<Override\s+[^>]*PartName="([^"]+)"[^>]*ContentType="([^"]+)"[^>]*\/>/g;
+    for (let match = defaultRe.exec(xml); match; match = defaultRe.exec(xml)) {
+        defaults.push({ extension: match[1], contentType: match[2] });
+    }
+    for (let match = overrideRe.exec(xml); match; match = overrideRe.exec(xml)) {
+        overrides.push({ partName: match[1], contentType: match[2] });
+    }
+    const parseOk = xml.includes("<Types") && (defaults.length > 0 || overrides.length > 0);
+    return { defaults, overrides, parseOk };
+}
+function getExtension(p) {
+    const base = path.posix.basename(p);
+    const idx = base.lastIndexOf(".");
+    return idx === -1 ? "" : base.slice(idx + 1);
+}
+function isPackagePart(pathName) {
+    // Exclude directories and the [Content_Types].xml pseudo-root.
+    return pathName !== "" && pathName !== "[Content_Types].xml";
+}
+function parseRelationships(xml) {
+    // Ensure the rels XML itself is parseable.
+    // We still use regex to extract rels for speed/portability.
+    const relRe = /<Relationship\s+[^>]*Id="([^"]+)"[^>]*Type="([^"]+)"[^>]*Target="([^"]*)"(?:[^>]*TargetMode="([^"]+)")?[^>]*\/>/g;
+    const rels = [];
+    for (let match = relRe.exec(xml); match; match = relRe.exec(xml)) {
+        rels.push({ id: match[1], type: match[2], target: match[3], targetMode: match[4] });
+    }
+    // Basic sanity: should have <Relationships ...> root.
+    const parseOk = xml.includes("<Relationships") && xml.includes("Relationship");
+    return { rels, parseOk };
+}
+export async function validateXlsxBuffer(xlsxBuffer, options = {}) {
+    const { checkXmlWellFormed = true, checkRelationshipTargets = true, checkContentTypesOverrides = true, checkWorksheetControlWiring = true, maxProblems } = options;
+    const problems = [];
+    const entries = await extractAll(xlsxBuffer);
+    const has = (p) => entries.has(p);
+    const mustExist = [
+        "[Content_Types].xml",
+        "_rels/.rels",
+        "xl/workbook.xml",
+        "xl/_rels/workbook.xml.rels"
+    ];
+    for (const p of mustExist) {
+        if (!has(p)) {
+            pushProblem(problems, { kind: "missing-part", file: p, message: `Missing required part: ${p}` }, maxProblems);
+        }
+    }
+    // XML well-formedness for all XML-like parts.
+    if (checkXmlWellFormed) {
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !isXmlLike(p)) {
+                continue;
+            }
+            const xml = new TextDecoder().decode(entry.data);
+            try {
+                await assertXmlWellFormed(xml);
+            }
+            catch (err) {
+                pushProblem(problems, {
+                    kind: "xml-malformed",
+                    file: p,
+                    message: `Malformed XML: ${err?.message || String(err)}`
+                }, maxProblems);
+            }
+        }
+    }
+    // Content types overrides must point to existing parts.
+    if (checkContentTypesOverrides && has("[Content_Types].xml")) {
+        const ctXml = new TextDecoder().decode(entries.get("[Content_Types].xml").data);
+        const { defaults, overrides, parseOk } = parseContentTypes(ctXml);
+        if (!parseOk) {
+            pushProblem(problems, {
+                kind: "content-types-malformed",
+                file: "[Content_Types].xml",
+                message: "Content types XML missing expected root/entries"
+            }, maxProblems);
+        }
+        const defaultByExt = new Map(defaults.map(d => [d.extension.toLowerCase(), d.contentType]));
+        const overrideByPart = new Map();
+        for (const ov of overrides) {
+            const key = stripLeadingSlash(ov.partName);
+            if (overrideByPart.has(key)) {
+                pushProblem(problems, {
+                    kind: "content-types-duplicate-override",
+                    file: "[Content_Types].xml",
+                    message: `Duplicate Override PartName: ${ov.partName}`
+                }, maxProblems);
+            }
+            overrideByPart.set(key, ov.contentType);
+        }
+        // RFC: .rels and .xml defaults are expected in valid packages.
+        const relsDefault = defaultByExt.get("rels");
+        if (relsDefault !== "application/vnd.openxmlformats-package.relationships+xml") {
+            pushProblem(problems, {
+                kind: "content-types-missing-default",
+                file: "[Content_Types].xml",
+                message: "Missing/incorrect Default for .rels (expected application/vnd.openxmlformats-package.relationships+xml)"
+            }, maxProblems);
+        }
+        const xmlDefault = defaultByExt.get("xml");
+        if (xmlDefault !== "application/xml") {
+            pushProblem(problems, {
+                kind: "content-types-missing-default",
+                file: "[Content_Types].xml",
+                message: "Missing/incorrect Default for .xml (expected application/xml)"
+            }, maxProblems);
+        }
+        for (const ov of overrides) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            const zipPath = stripLeadingSlash(ov.partName);
+            if (!has(zipPath)) {
+                pushProblem(problems, {
+                    kind: "content-types-missing",
+                    file: "[Content_Types].xml",
+                    message: `Override PartName points to missing file: ${ov.partName}`
+                }, maxProblems);
+            }
+        }
+        // Strong check: every part in the zip should have a content type via Default or Override.
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !isPackagePart(p)) {
+                continue;
+            }
+            const overrideType = overrideByPart.get(p);
+            if (overrideType) {
+                continue;
+            }
+            const ext = getExtension(p).toLowerCase();
+            if (!ext) {
+                pushProblem(problems, {
+                    kind: "content-types-missing-for-part",
+                    file: "[Content_Types].xml",
+                    message: `No content type for part without extension: ${p}`
+                }, maxProblems);
+                continue;
+            }
+            if (!defaultByExt.has(ext)) {
+                pushProblem(problems, {
+                    kind: "content-types-missing-for-part",
+                    file: "[Content_Types].xml",
+                    message: `No Default/Override content type for part: ${p} (extension .${ext})`
+                }, maxProblems);
+            }
+        }
+    }
+    // Root relationships must point to the workbook (OPC officeDocument).
+    if (has("_rels/.rels")) {
+        const rootRelsXml = new TextDecoder().decode(entries.get("_rels/.rels").data);
+        const { rels } = parseRelationships(rootRelsXml);
+        const hasOfficeDocument = rels.some(r => r.type.includes("/relationships/officeDocument") && r.target === "xl/workbook.xml");
+        if (!hasOfficeDocument) {
+            pushProblem(problems, {
+                kind: "root-rels-missing-officeDocument",
+                file: "_rels/.rels",
+                message: "Missing officeDocument relationship to xl/workbook.xml"
+            }, maxProblems);
+        }
+    }
+    // Relationships: validate target existence and basic ID uniqueness.
+    if (checkRelationshipTargets) {
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !p.endsWith(".rels")) {
+                continue;
+            }
+            const relsXml = new TextDecoder().decode(entry.data);
+            const { rels, parseOk } = parseRelationships(relsXml);
+            if (!parseOk) {
+                pushProblem(problems, {
+                    kind: "rels-malformed",
+                    file: p,
+                    message: "Relationships XML missing expected root/entries"
+                }, maxProblems);
+            }
+            const ids = new Set();
+            for (const rel of rels) {
+                if (maxProblems !== undefined && problems.length >= maxProblems) {
+                    break;
+                }
+                if (ids.has(rel.id)) {
+                    pushProblem(problems, {
+                        kind: "rels-duplicate-id",
+                        file: p,
+                        message: `Duplicate relationship Id: ${rel.id}`
+                    }, maxProblems);
+                }
+                ids.add(rel.id);
+                if (rel.targetMode === "External") {
+                    continue;
+                }
+                if (!rel.target) {
+                    pushProblem(problems, {
+                        kind: "rels-empty-target",
+                        file: p,
+                        message: `Relationship ${rel.id} (${rel.type}) has empty Target`
+                    }, maxProblems);
+                    continue;
+                }
+                const resolvedTarget = resolveRelTarget(p, rel.target);
+                if (!isSafeResolvedPath(resolvedTarget)) {
+                    pushProblem(problems, {
+                        kind: "rels-invalid-target-path",
+                        file: p,
+                        message: `Rel ${rel.id} (${rel.type}) target escapes package root: ${rel.target} -> ${resolvedTarget}`
+                    }, maxProblems);
+                    continue;
+                }
+                if (!has(resolvedTarget)) {
+                    pushProblem(problems, {
+                        kind: "rels-missing-target",
+                        file: p,
+                        message: `Rel ${rel.id} (${rel.type}) target missing: ${rel.target} -> ${resolvedTarget}`
+                    }, maxProblems);
+                }
+            }
+            // Optional: ensure the source part exists for non-root rels.
+            if (p !== "_rels/.rels") {
+                // Convert: xl/_rels/workbook.xml.rels -> xl/workbook.xml
+                // Convert: xl/worksheets/_rels/sheet1.xml.rels -> xl/worksheets/sheet1.xml
+                const srcDir = getRelsSourceDir(p);
+                const relsBaseName = path.posix.basename(p);
+                const sourceName = relsBaseName.replace(/\.rels$/, "");
+                const sourcePath = srcDir ? `${srcDir}/${sourceName}` : sourceName;
+                if (!has(sourcePath)) {
+                    pushProblem(problems, {
+                        kind: "rels-source-missing",
+                        file: p,
+                        message: `Relationships part has no corresponding source part: ${sourcePath}`
+                    }, maxProblems);
+                }
+            }
+        }
+    }
+    // Workbook -> worksheets wiring.
+    if (has("xl/workbook.xml") && has("xl/_rels/workbook.xml.rels")) {
+        const workbookXml = new TextDecoder().decode(entries.get("xl/workbook.xml").data);
+        const workbookRelsXml = new TextDecoder().decode(entries.get("xl/_rels/workbook.xml.rels").data);
+        const { rels: wbRels } = parseRelationships(workbookRelsXml);
+        const wbById = new Map(wbRels.map(r => [r.id, r]));
+        // Uniqueness checks: sheetId and r:id should not be duplicated.
+        const sheetIdRe = /<sheet\b[^>]*\bsheetId="(\d+)"[^>]*\/>/g;
+        const seenSheetIds = new Set();
+        for (let match = sheetIdRe.exec(workbookXml); match; match = sheetIdRe.exec(workbookXml)) {
+            const id = match[1];
+            if (seenSheetIds.has(id)) {
+                pushProblem(problems, {
+                    kind: "workbook-duplicate-sheetId",
+                    file: "xl/workbook.xml",
+                    message: `Duplicate sheetId in workbook: ${id}`
+                }, maxProblems);
+            }
+            seenSheetIds.add(id);
+        }
+        const sheetRidSeen = new Set();
+        const sheetRidRe = /<sheet\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+        for (let match = sheetRidRe.exec(workbookXml); match; match = sheetRidRe.exec(workbookXml)) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            const rid = match[1];
+            if (sheetRidSeen.has(rid)) {
+                pushProblem(problems, {
+                    kind: "workbook-duplicate-sheet-rid",
+                    file: "xl/workbook.xml",
+                    message: `Duplicate sheet r:id in workbook: ${rid}`
+                }, maxProblems);
+            }
+            sheetRidSeen.add(rid);
+            const rel = wbById.get(rid);
+            if (!rel) {
+                pushProblem(problems, {
+                    kind: "workbook-sheet-missing-rel",
+                    file: "xl/workbook.xml",
+                    message: `Workbook <sheet> references missing relationship: ${rid} (in xl/_rels/workbook.xml.rels)`
+                }, maxProblems);
+                continue;
+            }
+            if (!rel.type.includes("/relationships/worksheet")) {
+                pushProblem(problems, {
+                    kind: "workbook-sheet-wrong-rel-type",
+                    file: "xl/workbook.xml",
+                    message: `Workbook <sheet> ${rid} relationship is not worksheet: ${rel.type}`
+                }, maxProblems);
+            }
+        }
+    }
+    // Worksheet <controls>/<legacyDrawing> wiring.
+    if (checkWorksheetControlWiring) {
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !p.startsWith("xl/worksheets/sheet") || !p.endsWith(".xml")) {
+                continue;
+            }
+            const sheetXml = new TextDecoder().decode(entry.data);
+            const relsPath = `xl/worksheets/_rels/${path.posix.basename(p)}.rels`;
+            // Excel is sensitive to worksheet child element ordering. In particular,
+            // legacyDrawing must come before controls when both are present.
+            const legacyDrawingIdx = sheetXml.indexOf("<legacyDrawing");
+            const controlsIdx = sheetXml.indexOf("<controls");
+            if (legacyDrawingIdx !== -1 && controlsIdx !== -1 && legacyDrawingIdx > controlsIdx) {
+                pushProblem(problems, {
+                    kind: "sheet-legacyDrawing-after-controls",
+                    file: p,
+                    message: "Worksheet has <legacyDrawing> after <controls>; Excel may repair or reject this sheet"
+                }, maxProblems);
+            }
+            // Match <control ...> elements (not necessarily self-closing).
+            const controlRidRe = /<control\b[^>]*\br:id="(rId\d+)"[^>]*>/g;
+            const controlRids = [];
+            for (let match = controlRidRe.exec(sheetXml); match; match = controlRidRe.exec(sheetXml)) {
+                controlRids.push(match[1]);
+            }
+            // Excel Online / strict Excel builds may reject or "repair" legacy form controls
+            // if the sheet doesn't also have a DrawingML <drawing> part.
+            if (controlRids.length > 0 && sheetXml.indexOf("<drawing") === -1) {
+                pushProblem(problems, {
+                    kind: "sheet-controls-missing-drawing",
+                    file: p,
+                    message: "Worksheet has legacy <controls> but no <drawing>; Excel may repair/reject legacy form controls"
+                }, maxProblems);
+            }
+            const legacyDrawingRidRe = /<legacyDrawing\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            const legacyDrawingRids = [];
+            for (let match = legacyDrawingRidRe.exec(sheetXml); match; match = legacyDrawingRidRe.exec(sheetXml)) {
+                legacyDrawingRids.push(match[1]);
+            }
+            if ((controlRids.length > 0 || legacyDrawingRids.length > 0) && !has(relsPath)) {
+                pushProblem(problems, {
+                    kind: "sheet-missing-rels",
+                    file: p,
+                    message: `Worksheet has controls/legacyDrawing but missing rels part: ${relsPath}`
+                }, maxProblems);
+                continue;
+            }
+            if (!has(relsPath)) {
+                continue;
+            }
+            const sheetRelsXml = new TextDecoder().decode(entries.get(relsPath).data);
+            const { rels: sheetRels } = parseRelationships(sheetRelsXml);
+            const byId = new Map(sheetRels.map(r => [r.id, r]));
+            const assertRidType = (rid, expectedTypeIncludes, kindMissing, kindWrong, nodeLabel) => {
+                const rel = byId.get(rid);
+                if (!rel) {
+                    pushProblem(problems, {
+                        kind: kindMissing,
+                        file: p,
+                        message: `Sheet ${nodeLabel} references missing relationship: ${rid} (in ${relsPath})`
+                    }, maxProblems);
+                    return;
+                }
+                if (!rel.type.includes(expectedTypeIncludes)) {
+                    pushProblem(problems, {
+                        kind: kindWrong,
+                        file: p,
+                        message: `Sheet ${nodeLabel} ${rid} relationship is not ${expectedTypeIncludes}: ${rel.type}`
+                    }, maxProblems);
+                }
+            };
+            for (const rid of controlRids) {
+                if (maxProblems !== undefined && problems.length >= maxProblems) {
+                    break;
+                }
+                assertRidType(rid, "/relationships/ctrlProp", "sheet-control-missing-rel", "sheet-control-wrong-rel-type", "<control>");
+            }
+            for (const rid of legacyDrawingRids) {
+                if (maxProblems !== undefined && problems.length >= maxProblems) {
+                    break;
+                }
+                assertRidType(rid, "/relationships/vmlDrawing", "sheet-legacyDrawing-missing-rel", "sheet-legacyDrawing-wrong-rel-type", "<legacyDrawing>");
+            }
+            // Common worksheet nodes that are wired via r:id
+            // - <drawing r:id="..."/> -> drawing
+            // - <comments r:id="..."/> -> comments
+            // - <tableParts><tablePart r:id="..."/></tableParts> -> table
+            // - <hyperlink r:id="..."/> -> hyperlink
+            const drawingRidRe = /<drawing\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = drawingRidRe.exec(sheetXml); match; match = drawingRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/drawing", "sheet-drawing-missing-rel", "sheet-drawing-wrong-rel-type", "<drawing>");
+            }
+            const commentsRidRe = /<comments\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = commentsRidRe.exec(sheetXml); match; match = commentsRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/comments", "sheet-comments-missing-rel", "sheet-comments-wrong-rel-type", "<comments>");
+            }
+            const tablePartRidRe = /<tablePart\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = tablePartRidRe.exec(sheetXml); match; match = tablePartRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/table", "sheet-tablePart-missing-rel", "sheet-tablePart-wrong-rel-type", "<tablePart>");
+            }
+            const hyperlinkRidRe = /<hyperlink\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = hyperlinkRidRe.exec(sheetXml); match; match = hyperlinkRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/hyperlink", "sheet-hyperlink-missing-rel", "sheet-hyperlink-wrong-rel-type", "<hyperlink>");
+            }
+        }
+    }
+    const stats = {
+        entryCount: entries.size,
+        xmlLikeCount: [...entries.values()].filter((f) => !f.isDirectory && isXmlLike(f.path)).length,
+        relsCount: [...entries.values()].filter((f) => !f.isDirectory && f.path.endsWith(".rels")).length
+    };
+    return {
+        ok: problems.length === 0,
+        problems,
+        stats
+    };
+}

package/dist/browser/modules/excel/worksheet.js

@@ -49,8 +49,11 @@ class Worksheet {
         this.pageSetup = Object.assign({}, {
             margins: { left: 0.7, right: 0.7, top: 0.75, bottom: 0.75, header: 0.3, footer: 0.3 },
             orientation: "portrait",
-            horizontalDpi: 4294967295,
-            verticalDpi: 4294967295,
+            // Excel does not normally write these unless explicitly set.
+            // Historically we used 4294967295 as a sentinel when parsing, but emitting it
+            // can cause strict Excel parsers to treat the workbook as corrupted.
+            horizontalDpi: undefined,
+            verticalDpi: undefined,
             fitToPage: !!(options.pageSetup &&
                 (options.pageSetup.fitToWidth || options.pageSetup.fitToHeight) &&
                 !options.pageSetup.scale),

package/dist/browser/modules/excel/xlsx/xform/drawing/ctrl-prop-xform.d.ts

@@ -8,6 +8,7 @@ import type { FormCheckboxModel } from "@excel/form-control";
  */
 declare class CtrlPropXform extends BaseXform {
     model: FormCheckboxModel;
+    private _checkedToXmlValue;
     get tag(): string;
     render(xmlStream: any, model?: FormCheckboxModel): void;
     /**

package/dist/browser/modules/excel/xlsx/xform/drawing/ctrl-prop-xform.js

@@ -7,6 +7,17 @@ import { BaseXform } from "../base-xform.js";
  * that stores its properties like objectType, checked state, and linked cell.
  */
 class CtrlPropXform extends BaseXform {
+    _checkedToXmlValue(checked) {
+        switch (checked) {
+            case "Checked":
+                return "1";
+            case "Mixed":
+                return "2";
+            case "Unchecked":
+            default:
+                return "0";
+        }
+    }
     get tag() {
         return "formControlPr";
     }
@@ -15,7 +26,8 @@ class CtrlPropXform extends BaseXform {
         const attrs = {
             xmlns: "http://schemas.microsoft.com/office/spreadsheetml/2009/9/main",
             objectType: "CheckBox",
-            checked: renderModel.checked,
+            // Excel tends to serialize this as numeric state (0/1/2), matching VML x:Checked.
+            checked: this._checkedToXmlValue(renderModel.checked),
             lockText: "1"
         };
         // Add linked cell reference