@cj-tech-master/excelts 4.2.1-canary.20260111102127.f808a37 → 4.2.1-canary.20260112134913.a3cecdd

package/dist/cjs/modules/archive/io/archive-source.js

@@ -1,19 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isReadableStream = isReadableStream;
-exports.isAsyncIterable = isAsyncIterable;
 exports.toUint8ArraySync = toUint8ArraySync;
 exports.toUint8Array = toUint8Array;
 exports.toAsyncIterable = toAsyncIterable;
 const text_1 = require("../utils/text.js");
-function isReadableStream(value) {
-    return !!value && typeof value === "object" && typeof value.getReader === "function";
-}
-function isAsyncIterable(value) {
-    return (!!value &&
-        (typeof value === "object" || typeof value === "function") &&
-        typeof value[Symbol.asyncIterator] === "function");
-}
+const type_guards_1 = require("../../stream/internal/type-guards.js");
 function normalizeChunk(value) {
     if (!value) {
         return null;
@@ -78,7 +69,7 @@ async function* toAsyncIterable(source) {
         yield await toUint8Array(source);
         return;
     }
-    if (isReadableStream(source)) {
+    if ((0, type_guards_1.isReadableStream)(source)) {
         const reader = source.getReader();
         try {
             while (true) {
@@ -101,7 +92,7 @@ async function* toAsyncIterable(source) {
             }
         }
     }
-    if (isAsyncIterable(source)) {
+    if ((0, type_guards_1.isAsyncIterable)(source)) {
         for await (const value of source) {
             const chunk = normalizeChunk(value);
             if (chunk) {

package/dist/cjs/modules/excel/utils/ooxml-validator.js

@@ -0,0 +1,475 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateXlsxBuffer = validateXlsxBuffer;
+const node_path_1 = __importDefault(require("node:path"));
+const extract_1 = require("../../archive/unzip/extract.js");
+const parse_sax_1 = require("./parse-sax.js");
+function pushProblem(problems, problem, maxProblems) {
+    if (maxProblems !== undefined && problems.length >= maxProblems) {
+        return;
+    }
+    problems.push(problem);
+}
+function stripLeadingSlash(p) {
+    return p.startsWith("/") ? p.slice(1) : p;
+}
+function isXmlLike(pathName) {
+    return pathName.endsWith(".xml") || pathName.endsWith(".rels") || pathName.endsWith(".vml");
+}
+function getRelsSourceDir(relsPath) {
+    // In OPC, relationship targets are resolved relative to the SOURCE part directory,
+    // not the .rels part directory.
+    //
+    // Examples:
+    // - _rels/.rels                           -> base "" (package root)
+    // - xl/_rels/workbook.xml.rels            -> base "xl"
+    // - xl/worksheets/_rels/sheet1.xml.rels   -> base "xl/worksheets"
+    if (relsPath === "_rels/.rels") {
+        return "";
+    }
+    const relsMarker = "/_rels/";
+    const idx = relsPath.indexOf(relsMarker);
+    if (idx === -1) {
+        return relsPath.includes("/") ? relsPath.slice(0, relsPath.lastIndexOf("/")) : "";
+    }
+    return relsPath.slice(0, idx);
+}
+function resolveRelTarget(relsPath, target) {
+    const baseDir = getRelsSourceDir(relsPath);
+    const resolved = node_path_1.default.posix.normalize(node_path_1.default.posix.join(baseDir, target));
+    return resolved.replace(/^\//, "");
+}
+function isSafeResolvedPath(resolved) {
+    // Prevent path traversal out of package root.
+    // `normalize()` can produce paths starting with "../".
+    return !(resolved === ".." || resolved.startsWith("../") || resolved.includes("/../"));
+}
+async function assertXmlWellFormed(xmlText) {
+    // parseSax throws on malformed XML.
+    for await (const _events of (0, parse_sax_1.parseSax)([xmlText])) {
+        // no-op
+    }
+}
+function parseContentTypes(xml) {
+    const defaults = [];
+    const overrides = [];
+    const defaultRe = /<Default\s+[^>]*Extension="([^"]+)"[^>]*ContentType="([^"]+)"[^>]*\/>/g;
+    const overrideRe = /<Override\s+[^>]*PartName="([^"]+)"[^>]*ContentType="([^"]+)"[^>]*\/>/g;
+    for (let match = defaultRe.exec(xml); match; match = defaultRe.exec(xml)) {
+        defaults.push({ extension: match[1], contentType: match[2] });
+    }
+    for (let match = overrideRe.exec(xml); match; match = overrideRe.exec(xml)) {
+        overrides.push({ partName: match[1], contentType: match[2] });
+    }
+    const parseOk = xml.includes("<Types") && (defaults.length > 0 || overrides.length > 0);
+    return { defaults, overrides, parseOk };
+}
+function getExtension(p) {
+    const base = node_path_1.default.posix.basename(p);
+    const idx = base.lastIndexOf(".");
+    return idx === -1 ? "" : base.slice(idx + 1);
+}
+function isPackagePart(pathName) {
+    // Exclude directories and the [Content_Types].xml pseudo-root.
+    return pathName !== "" && pathName !== "[Content_Types].xml";
+}
+function parseRelationships(xml) {
+    // Ensure the rels XML itself is parseable.
+    // We still use regex to extract rels for speed/portability.
+    const relRe = /<Relationship\s+[^>]*Id="([^"]+)"[^>]*Type="([^"]+)"[^>]*Target="([^"]*)"(?:[^>]*TargetMode="([^"]+)")?[^>]*\/>/g;
+    const rels = [];
+    for (let match = relRe.exec(xml); match; match = relRe.exec(xml)) {
+        rels.push({ id: match[1], type: match[2], target: match[3], targetMode: match[4] });
+    }
+    // Basic sanity: should have <Relationships ...> root.
+    const parseOk = xml.includes("<Relationships") && xml.includes("Relationship");
+    return { rels, parseOk };
+}
+async function validateXlsxBuffer(xlsxBuffer, options = {}) {
+    const { checkXmlWellFormed = true, checkRelationshipTargets = true, checkContentTypesOverrides = true, checkWorksheetControlWiring = true, maxProblems } = options;
+    const problems = [];
+    const entries = await (0, extract_1.extractAll)(xlsxBuffer);
+    const has = (p) => entries.has(p);
+    const mustExist = [
+        "[Content_Types].xml",
+        "_rels/.rels",
+        "xl/workbook.xml",
+        "xl/_rels/workbook.xml.rels"
+    ];
+    for (const p of mustExist) {
+        if (!has(p)) {
+            pushProblem(problems, { kind: "missing-part", file: p, message: `Missing required part: ${p}` }, maxProblems);
+        }
+    }
+    // XML well-formedness for all XML-like parts.
+    if (checkXmlWellFormed) {
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !isXmlLike(p)) {
+                continue;
+            }
+            const xml = new TextDecoder().decode(entry.data);
+            try {
+                await assertXmlWellFormed(xml);
+            }
+            catch (err) {
+                pushProblem(problems, {
+                    kind: "xml-malformed",
+                    file: p,
+                    message: `Malformed XML: ${err?.message || String(err)}`
+                }, maxProblems);
+            }
+        }
+    }
+    // Content types overrides must point to existing parts.
+    if (checkContentTypesOverrides && has("[Content_Types].xml")) {
+        const ctXml = new TextDecoder().decode(entries.get("[Content_Types].xml").data);
+        const { defaults, overrides, parseOk } = parseContentTypes(ctXml);
+        if (!parseOk) {
+            pushProblem(problems, {
+                kind: "content-types-malformed",
+                file: "[Content_Types].xml",
+                message: "Content types XML missing expected root/entries"
+            }, maxProblems);
+        }
+        const defaultByExt = new Map(defaults.map(d => [d.extension.toLowerCase(), d.contentType]));
+        const overrideByPart = new Map();
+        for (const ov of overrides) {
+            const key = stripLeadingSlash(ov.partName);
+            if (overrideByPart.has(key)) {
+                pushProblem(problems, {
+                    kind: "content-types-duplicate-override",
+                    file: "[Content_Types].xml",
+                    message: `Duplicate Override PartName: ${ov.partName}`
+                }, maxProblems);
+            }
+            overrideByPart.set(key, ov.contentType);
+        }
+        // RFC: .rels and .xml defaults are expected in valid packages.
+        const relsDefault = defaultByExt.get("rels");
+        if (relsDefault !== "application/vnd.openxmlformats-package.relationships+xml") {
+            pushProblem(problems, {
+                kind: "content-types-missing-default",
+                file: "[Content_Types].xml",
+                message: "Missing/incorrect Default for .rels (expected application/vnd.openxmlformats-package.relationships+xml)"
+            }, maxProblems);
+        }
+        const xmlDefault = defaultByExt.get("xml");
+        if (xmlDefault !== "application/xml") {
+            pushProblem(problems, {
+                kind: "content-types-missing-default",
+                file: "[Content_Types].xml",
+                message: "Missing/incorrect Default for .xml (expected application/xml)"
+            }, maxProblems);
+        }
+        for (const ov of overrides) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            const zipPath = stripLeadingSlash(ov.partName);
+            if (!has(zipPath)) {
+                pushProblem(problems, {
+                    kind: "content-types-missing",
+                    file: "[Content_Types].xml",
+                    message: `Override PartName points to missing file: ${ov.partName}`
+                }, maxProblems);
+            }
+        }
+        // Strong check: every part in the zip should have a content type via Default or Override.
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !isPackagePart(p)) {
+                continue;
+            }
+            const overrideType = overrideByPart.get(p);
+            if (overrideType) {
+                continue;
+            }
+            const ext = getExtension(p).toLowerCase();
+            if (!ext) {
+                pushProblem(problems, {
+                    kind: "content-types-missing-for-part",
+                    file: "[Content_Types].xml",
+                    message: `No content type for part without extension: ${p}`
+                }, maxProblems);
+                continue;
+            }
+            if (!defaultByExt.has(ext)) {
+                pushProblem(problems, {
+                    kind: "content-types-missing-for-part",
+                    file: "[Content_Types].xml",
+                    message: `No Default/Override content type for part: ${p} (extension .${ext})`
+                }, maxProblems);
+            }
+        }
+    }
+    // Root relationships must point to the workbook (OPC officeDocument).
+    if (has("_rels/.rels")) {
+        const rootRelsXml = new TextDecoder().decode(entries.get("_rels/.rels").data);
+        const { rels } = parseRelationships(rootRelsXml);
+        const hasOfficeDocument = rels.some(r => r.type.includes("/relationships/officeDocument") && r.target === "xl/workbook.xml");
+        if (!hasOfficeDocument) {
+            pushProblem(problems, {
+                kind: "root-rels-missing-officeDocument",
+                file: "_rels/.rels",
+                message: "Missing officeDocument relationship to xl/workbook.xml"
+            }, maxProblems);
+        }
+    }
+    // Relationships: validate target existence and basic ID uniqueness.
+    if (checkRelationshipTargets) {
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !p.endsWith(".rels")) {
+                continue;
+            }
+            const relsXml = new TextDecoder().decode(entry.data);
+            const { rels, parseOk } = parseRelationships(relsXml);
+            if (!parseOk) {
+                pushProblem(problems, {
+                    kind: "rels-malformed",
+                    file: p,
+                    message: "Relationships XML missing expected root/entries"
+                }, maxProblems);
+            }
+            const ids = new Set();
+            for (const rel of rels) {
+                if (maxProblems !== undefined && problems.length >= maxProblems) {
+                    break;
+                }
+                if (ids.has(rel.id)) {
+                    pushProblem(problems, {
+                        kind: "rels-duplicate-id",
+                        file: p,
+                        message: `Duplicate relationship Id: ${rel.id}`
+                    }, maxProblems);
+                }
+                ids.add(rel.id);
+                if (rel.targetMode === "External") {
+                    continue;
+                }
+                if (!rel.target) {
+                    pushProblem(problems, {
+                        kind: "rels-empty-target",
+                        file: p,
+                        message: `Relationship ${rel.id} (${rel.type}) has empty Target`
+                    }, maxProblems);
+                    continue;
+                }
+                const resolvedTarget = resolveRelTarget(p, rel.target);
+                if (!isSafeResolvedPath(resolvedTarget)) {
+                    pushProblem(problems, {
+                        kind: "rels-invalid-target-path",
+                        file: p,
+                        message: `Rel ${rel.id} (${rel.type}) target escapes package root: ${rel.target} -> ${resolvedTarget}`
+                    }, maxProblems);
+                    continue;
+                }
+                if (!has(resolvedTarget)) {
+                    pushProblem(problems, {
+                        kind: "rels-missing-target",
+                        file: p,
+                        message: `Rel ${rel.id} (${rel.type}) target missing: ${rel.target} -> ${resolvedTarget}`
+                    }, maxProblems);
+                }
+            }
+            // Optional: ensure the source part exists for non-root rels.
+            if (p !== "_rels/.rels") {
+                // Convert: xl/_rels/workbook.xml.rels -> xl/workbook.xml
+                // Convert: xl/worksheets/_rels/sheet1.xml.rels -> xl/worksheets/sheet1.xml
+                const srcDir = getRelsSourceDir(p);
+                const relsBaseName = node_path_1.default.posix.basename(p);
+                const sourceName = relsBaseName.replace(/\.rels$/, "");
+                const sourcePath = srcDir ? `${srcDir}/${sourceName}` : sourceName;
+                if (!has(sourcePath)) {
+                    pushProblem(problems, {
+                        kind: "rels-source-missing",
+                        file: p,
+                        message: `Relationships part has no corresponding source part: ${sourcePath}`
+                    }, maxProblems);
+                }
+            }
+        }
+    }
+    // Workbook -> worksheets wiring.
+    if (has("xl/workbook.xml") && has("xl/_rels/workbook.xml.rels")) {
+        const workbookXml = new TextDecoder().decode(entries.get("xl/workbook.xml").data);
+        const workbookRelsXml = new TextDecoder().decode(entries.get("xl/_rels/workbook.xml.rels").data);
+        const { rels: wbRels } = parseRelationships(workbookRelsXml);
+        const wbById = new Map(wbRels.map(r => [r.id, r]));
+        // Uniqueness checks: sheetId and r:id should not be duplicated.
+        const sheetIdRe = /<sheet\b[^>]*\bsheetId="(\d+)"[^>]*\/>/g;
+        const seenSheetIds = new Set();
+        for (let match = sheetIdRe.exec(workbookXml); match; match = sheetIdRe.exec(workbookXml)) {
+            const id = match[1];
+            if (seenSheetIds.has(id)) {
+                pushProblem(problems, {
+                    kind: "workbook-duplicate-sheetId",
+                    file: "xl/workbook.xml",
+                    message: `Duplicate sheetId in workbook: ${id}`
+                }, maxProblems);
+            }
+            seenSheetIds.add(id);
+        }
+        const sheetRidSeen = new Set();
+        const sheetRidRe = /<sheet\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+        for (let match = sheetRidRe.exec(workbookXml); match; match = sheetRidRe.exec(workbookXml)) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            const rid = match[1];
+            if (sheetRidSeen.has(rid)) {
+                pushProblem(problems, {
+                    kind: "workbook-duplicate-sheet-rid",
+                    file: "xl/workbook.xml",
+                    message: `Duplicate sheet r:id in workbook: ${rid}`
+                }, maxProblems);
+            }
+            sheetRidSeen.add(rid);
+            const rel = wbById.get(rid);
+            if (!rel) {
+                pushProblem(problems, {
+                    kind: "workbook-sheet-missing-rel",
+                    file: "xl/workbook.xml",
+                    message: `Workbook <sheet> references missing relationship: ${rid} (in xl/_rels/workbook.xml.rels)`
+                }, maxProblems);
+                continue;
+            }
+            if (!rel.type.includes("/relationships/worksheet")) {
+                pushProblem(problems, {
+                    kind: "workbook-sheet-wrong-rel-type",
+                    file: "xl/workbook.xml",
+                    message: `Workbook <sheet> ${rid} relationship is not worksheet: ${rel.type}`
+                }, maxProblems);
+            }
+        }
+    }
+    // Worksheet <controls>/<legacyDrawing> wiring.
+    if (checkWorksheetControlWiring) {
+        for (const [p, entry] of entries) {
+            if (maxProblems !== undefined && problems.length >= maxProblems) {
+                break;
+            }
+            if (entry.isDirectory || !p.startsWith("xl/worksheets/sheet") || !p.endsWith(".xml")) {
+                continue;
+            }
+            const sheetXml = new TextDecoder().decode(entry.data);
+            const relsPath = `xl/worksheets/_rels/${node_path_1.default.posix.basename(p)}.rels`;
+            // Excel is sensitive to worksheet child element ordering. In particular,
+            // legacyDrawing must come before controls when both are present.
+            const legacyDrawingIdx = sheetXml.indexOf("<legacyDrawing");
+            const controlsIdx = sheetXml.indexOf("<controls");
+            if (legacyDrawingIdx !== -1 && controlsIdx !== -1 && legacyDrawingIdx > controlsIdx) {
+                pushProblem(problems, {
+                    kind: "sheet-legacyDrawing-after-controls",
+                    file: p,
+                    message: "Worksheet has <legacyDrawing> after <controls>; Excel may repair or reject this sheet"
+                }, maxProblems);
+            }
+            // Match <control ...> elements (not necessarily self-closing).
+            const controlRidRe = /<control\b[^>]*\br:id="(rId\d+)"[^>]*>/g;
+            const controlRids = [];
+            for (let match = controlRidRe.exec(sheetXml); match; match = controlRidRe.exec(sheetXml)) {
+                controlRids.push(match[1]);
+            }
+            // Excel Online / strict Excel builds may reject or "repair" legacy form controls
+            // if the sheet doesn't also have a DrawingML <drawing> part.
+            if (controlRids.length > 0 && sheetXml.indexOf("<drawing") === -1) {
+                pushProblem(problems, {
+                    kind: "sheet-controls-missing-drawing",
+                    file: p,
+                    message: "Worksheet has legacy <controls> but no <drawing>; Excel may repair/reject legacy form controls"
+                }, maxProblems);
+            }
+            const legacyDrawingRidRe = /<legacyDrawing\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            const legacyDrawingRids = [];
+            for (let match = legacyDrawingRidRe.exec(sheetXml); match; match = legacyDrawingRidRe.exec(sheetXml)) {
+                legacyDrawingRids.push(match[1]);
+            }
+            if ((controlRids.length > 0 || legacyDrawingRids.length > 0) && !has(relsPath)) {
+                pushProblem(problems, {
+                    kind: "sheet-missing-rels",
+                    file: p,
+                    message: `Worksheet has controls/legacyDrawing but missing rels part: ${relsPath}`
+                }, maxProblems);
+                continue;
+            }
+            if (!has(relsPath)) {
+                continue;
+            }
+            const sheetRelsXml = new TextDecoder().decode(entries.get(relsPath).data);
+            const { rels: sheetRels } = parseRelationships(sheetRelsXml);
+            const byId = new Map(sheetRels.map(r => [r.id, r]));
+            const assertRidType = (rid, expectedTypeIncludes, kindMissing, kindWrong, nodeLabel) => {
+                const rel = byId.get(rid);
+                if (!rel) {
+                    pushProblem(problems, {
+                        kind: kindMissing,
+                        file: p,
+                        message: `Sheet ${nodeLabel} references missing relationship: ${rid} (in ${relsPath})`
+                    }, maxProblems);
+                    return;
+                }
+                if (!rel.type.includes(expectedTypeIncludes)) {
+                    pushProblem(problems, {
+                        kind: kindWrong,
+                        file: p,
+                        message: `Sheet ${nodeLabel} ${rid} relationship is not ${expectedTypeIncludes}: ${rel.type}`
+                    }, maxProblems);
+                }
+            };
+            for (const rid of controlRids) {
+                if (maxProblems !== undefined && problems.length >= maxProblems) {
+                    break;
+                }
+                assertRidType(rid, "/relationships/ctrlProp", "sheet-control-missing-rel", "sheet-control-wrong-rel-type", "<control>");
+            }
+            for (const rid of legacyDrawingRids) {
+                if (maxProblems !== undefined && problems.length >= maxProblems) {
+                    break;
+                }
+                assertRidType(rid, "/relationships/vmlDrawing", "sheet-legacyDrawing-missing-rel", "sheet-legacyDrawing-wrong-rel-type", "<legacyDrawing>");
+            }
+            // Common worksheet nodes that are wired via r:id
+            // - <drawing r:id="..."/> -> drawing
+            // - <comments r:id="..."/> -> comments
+            // - <tableParts><tablePart r:id="..."/></tableParts> -> table
+            // - <hyperlink r:id="..."/> -> hyperlink
+            const drawingRidRe = /<drawing\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = drawingRidRe.exec(sheetXml); match; match = drawingRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/drawing", "sheet-drawing-missing-rel", "sheet-drawing-wrong-rel-type", "<drawing>");
+            }
+            const commentsRidRe = /<comments\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = commentsRidRe.exec(sheetXml); match; match = commentsRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/comments", "sheet-comments-missing-rel", "sheet-comments-wrong-rel-type", "<comments>");
+            }
+            const tablePartRidRe = /<tablePart\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = tablePartRidRe.exec(sheetXml); match; match = tablePartRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/table", "sheet-tablePart-missing-rel", "sheet-tablePart-wrong-rel-type", "<tablePart>");
+            }
+            const hyperlinkRidRe = /<hyperlink\b[^>]*\br:id="(rId\d+)"[^>]*\/>/g;
+            for (let match = hyperlinkRidRe.exec(sheetXml); match; match = hyperlinkRidRe.exec(sheetXml)) {
+                assertRidType(match[1], "/relationships/hyperlink", "sheet-hyperlink-missing-rel", "sheet-hyperlink-wrong-rel-type", "<hyperlink>");
+            }
+        }
+    }
+    const stats = {
+        entryCount: entries.size,
+        xmlLikeCount: [...entries.values()].filter((f) => !f.isDirectory && isXmlLike(f.path)).length,
+        relsCount: [...entries.values()].filter((f) => !f.isDirectory && f.path.endsWith(".rels")).length
+    };
+    return {
+        ok: problems.length === 0,
+        problems,
+        stats
+    };
+}

package/dist/cjs/modules/excel/worksheet.js

@@ -52,8 +52,11 @@ class Worksheet {
         this.pageSetup = Object.assign({}, {
             margins: { left: 0.7, right: 0.7, top: 0.75, bottom: 0.75, header: 0.3, footer: 0.3 },
             orientation: "portrait",
-            horizontalDpi: 4294967295,
-            verticalDpi: 4294967295,
+            // Excel does not normally write these unless explicitly set.
+            // Historically we used 4294967295 as a sentinel when parsing, but emitting it
+            // can cause strict Excel parsers to treat the workbook as corrupted.
+            horizontalDpi: undefined,
+            verticalDpi: undefined,
             fitToPage: !!(options.pageSetup &&
                 (options.pageSetup.fitToWidth || options.pageSetup.fitToHeight) &&
                 !options.pageSetup.scale),

package/dist/cjs/modules/excel/xlsx/xform/drawing/ctrl-prop-xform.js

@@ -10,6 +10,17 @@ const base_xform_1 = require("../base-xform.js");
  * that stores its properties like objectType, checked state, and linked cell.
  */
 class CtrlPropXform extends base_xform_1.BaseXform {
+    _checkedToXmlValue(checked) {
+        switch (checked) {
+            case "Checked":
+                return "1";
+            case "Mixed":
+                return "2";
+            case "Unchecked":
+            default:
+                return "0";
+        }
+    }
     get tag() {
         return "formControlPr";
     }
@@ -18,7 +29,8 @@ class CtrlPropXform extends base_xform_1.BaseXform {
         const attrs = {
             xmlns: "http://schemas.microsoft.com/office/spreadsheetml/2009/9/main",
             objectType: "CheckBox",
-            checked: renderModel.checked,
+            // Excel tends to serialize this as numeric state (0/1/2), matching VML x:Checked.
+            checked: this._checkedToXmlValue(renderModel.checked),
             lockText: "1"
         };
         // Add linked cell reference

package/dist/cjs/modules/excel/xlsx/xform/drawing/sp-xform.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpXform = void 0;
+const base_xform_1 = require("../base-xform.js");
+class SpXform extends base_xform_1.BaseXform {
+    get tag() {
+        return "xdr:sp";
+    }
+    render(xmlStream, model) {
+        if (!model) {
+            return;
+        }
+        xmlStream.openNode(this.tag, { macro: "", textlink: "" });
+        // Non-visual properties
+        xmlStream.openNode("xdr:nvSpPr");
+        xmlStream.openNode("xdr:cNvPr", {
+            id: model.cNvPrId,
+            name: model.name,
+            hidden: model.hidden ? "1" : undefined
+        });
+        xmlStream.openNode("a:extLst");
+        xmlStream.openNode("a:ext", {
+            uri: "{63B3BB69-23CF-44E3-9099-C40C66FF867C}"
+        });
+        xmlStream.leafNode("a14:compatExt", {
+            spid: model.spid,
+            "xmlns:a14": "http://schemas.microsoft.com/office/drawing/2010/main"
+        }, undefined);
+        xmlStream.closeNode(); // a:ext
+        xmlStream.closeNode(); // a:extLst
+        xmlStream.closeNode(); // xdr:cNvPr
+        xmlStream.leafNode("xdr:cNvSpPr");
+        xmlStream.closeNode(); // xdr:nvSpPr
+        // Shape properties
+        xmlStream.openNode("xdr:spPr", { bwMode: "auto" });
+        xmlStream.openNode("a:xfrm");
+        xmlStream.leafNode("a:off", { x: 0, y: 0 });
+        xmlStream.leafNode("a:ext", { cx: 0, cy: 0 });
+        xmlStream.closeNode(); // a:xfrm
+        xmlStream.openNode("a:prstGeom", { prst: "rect" });
+        xmlStream.leafNode("a:avLst");
+        xmlStream.closeNode(); // a:prstGeom
+        xmlStream.leafNode("a:noFill");
+        xmlStream.openNode("a:ln");
+        xmlStream.leafNode("a:noFill");
+        xmlStream.closeNode(); // a:ln
+        xmlStream.openNode("a:extLst");
+        xmlStream.openNode("a:ext", { uri: "{909E8E84-426E-40DD-AFC4-6F175D3DCCD1}" });
+        xmlStream.openNode("a14:hiddenFill", {
+            "xmlns:a14": "http://schemas.microsoft.com/office/drawing/2010/main"
+        });
+        xmlStream.openNode("a:solidFill");
+        xmlStream.leafNode("a:srgbClr", { val: "F0F0F0" });
+        xmlStream.closeNode(); // a:solidFill
+        xmlStream.closeNode(); // a14:hiddenFill
+        xmlStream.closeNode(); // a:ext
+        xmlStream.openNode("a:ext", { uri: "{91240B29-F687-4F45-9708-019B960494DF}" });
+        xmlStream.openNode("a14:hiddenLine", {
+            w: 9525,
+            "xmlns:a14": "http://schemas.microsoft.com/office/drawing/2010/main"
+        });
+        xmlStream.openNode("a:solidFill");
+        xmlStream.leafNode("a:srgbClr", { val: "000000" });
+        xmlStream.closeNode(); // a:solidFill
+        xmlStream.leafNode("a:miter", { lim: 800000 });
+        xmlStream.leafNode("a:headEnd");
+        xmlStream.leafNode("a:tailEnd");
+        xmlStream.closeNode(); // a14:hiddenLine
+        xmlStream.closeNode(); // a:ext
+        xmlStream.closeNode(); // a:extLst
+        xmlStream.closeNode(); // xdr:spPr
+        // Text body (label)
+        xmlStream.openNode("xdr:txBody");
+        xmlStream.leafNode("a:bodyPr", {
+            vertOverflow: "clip",
+            wrap: "square",
+            lIns: 18288,
+            tIns: 18288,
+            rIns: 0,
+            bIns: 18288,
+            anchor: "ctr",
+            upright: 1
+        });
+        xmlStream.leafNode("a:lstStyle");
+        xmlStream.openNode("a:p");
+        xmlStream.openNode("a:pPr", { algn: "l", rtl: 0 });
+        xmlStream.leafNode("a:defRPr", { sz: 1000 });
+        xmlStream.closeNode(); // a:pPr
+        xmlStream.openNode("a:r");
+        xmlStream.openNode("a:rPr", {
+            lang: "en-US",
+            sz: 800,
+            b: 0,
+            i: 0,
+            u: "none",
+            strike: "noStrike",
+            baseline: 0
+        });
+        xmlStream.openNode("a:solidFill");
+        xmlStream.leafNode("a:srgbClr", { val: "000000" });
+        xmlStream.closeNode(); // a:solidFill
+        xmlStream.leafNode("a:latin", { typeface: "Tahoma", pitchFamily: 2, charset: 0 });
+        xmlStream.leafNode("a:ea", { typeface: "Tahoma", pitchFamily: 2, charset: 0 });
+        xmlStream.leafNode("a:cs", { typeface: "Tahoma", pitchFamily: 2, charset: 0 });
+        xmlStream.closeNode(); // a:rPr
+        xmlStream.openNode("a:t");
+        xmlStream.writeText(model.text ?? "");
+        xmlStream.closeNode(); // a:t
+        xmlStream.closeNode(); // a:r
+        xmlStream.closeNode(); // a:p
+        xmlStream.closeNode(); // xdr:txBody
+        xmlStream.closeNode(); // xdr:sp
+    }
+}
+exports.SpXform = SpXform;