@cj-tech-master/excelts 6.1.3 → 6.2.0-canary.20260328172614.9d0f2b2

package/README.md

@@ -6,15 +6,12 @@ Modern TypeScript Excel Workbook Manager - Read, manipulate and write spreadshee
 
 ## About This Project
 
-ExcelTS is a modern TypeScript Excel workbook manager with:
+ExcelTS is a zero-dependency TypeScript toolkit for spreadsheets and documents:
 
-- 🚀 **Zero Runtime Dependencies** - Pure TypeScript implementation with no external packages
-- ✅ **Broad Runtime Support** - LTS Node.js, Bun, and modern browsers (Chrome, Firefox, Safari, Edge)
-- ✅ **Full TypeScript Support** - Complete type definitions and modern TypeScript patterns
-- ✅ **Modern Build System** - Using Rolldown for faster builds
-- ✅ **Enhanced Testing** - Migrated to Vitest with browser testing support
-- ✅ **ESM First** - Native ES Module support with CommonJS compatibility
-- ✅ **Named Exports** - All exports are named for better tree-shaking
+- 🚀 **Zero Runtime Dependencies** — Pure TypeScript, no external packages
+- 📦 **Five Modules** — Excel (XLSX/JSON), PDF (standalone engine + Excel bridge), CSV (RFC 4180), Archive (ZIP/TAR), Stream (cross-platform)
+- ✅ **Cross-Platform** — Node.js 22+, Bun, Chrome 89+, Firefox 102+, Safari 14.1+
+- ✅ **ESM First** — Native ES Modules with CommonJS compatibility and full tree-shaking
 
 ## Translations
 
@@ -103,6 +100,16 @@ cell.fill = {
   - Hyperlinks
   - Pivot tables
 
+- **PDF Export**
+  - Full-featured, zero-dependency PDF engine (standalone or with Excel)
+  - Full cell styling (fonts, colors, borders, fills, alignment)
+  - Automatic pagination with repeat header rows
+  - TrueType font embedding for Unicode/CJK text
+  - JPEG and PNG image embedding with transparency
+  - Password protection and encryption
+  - Per-worksheet page setup (size, orientation, margins)
+  - Tree-shakeable (not imported = not bundled)
+
 - **Advanced Features**
   - Streaming for large files
   - CSV import/export
@@ -131,10 +138,107 @@ import { Readable, pipeline, createTransform } from "@cj-tech-master/excelts/str
 
 Each subpath supports `browser`, `import` (ESM), and `require` (CJS) conditions. See the module READMEs for details:
 
+- [PDF Module](src/modules/pdf/README.md) - Full-featured zero-dependency PDF engine with encryption and font embedding
 - [CSV Module](src/modules/csv/README.md) - RFC 4180 parser/formatter, streaming, data generation
 - [Archive Module](src/modules/archive/README.md) - ZIP/TAR create/read/edit, compression, encryption
 - [Stream Module](src/modules/stream/README.md) - Cross-platform Readable/Writable/Transform/Duplex
 
+## PDF Export
+
+Export any workbook to PDF with zero external dependencies:
+
+```javascript
+import { Workbook, excelToPdf } from "@cj-tech-master/excelts";
+
+const workbook = new Workbook();
+const sheet = workbook.addWorksheet("Report");
+sheet.columns = [
+  { header: "Product", key: "product", width: 20 },
+  { header: "Revenue", key: "revenue", width: 15 }
+];
+sheet.addRow({ product: "Widget", revenue: 1000 });
+sheet.getColumn("revenue").numFmt = "$#,##0.00";
+
+// One-line export
+const pdf = excelToPdf(workbook, {
+  showGridLines: true,
+  showPageNumbers: true,
+  title: "Sales Report"
+});
+
+// Node.js: write to file
+import { writeFileSync } from "fs";
+writeFileSync("report.pdf", pdf);
+
+// Browser: download
+const blob = new Blob([pdf], { type: "application/pdf" });
+const url = URL.createObjectURL(blob);
+window.open(url);
+```
+
+### Convert Existing XLSX to PDF
+
+```javascript
+const workbook = new Workbook();
+await workbook.xlsx.readFile("input.xlsx");
+const pdf = excelToPdf(workbook);
+```
+
+### Encryption
+
+```javascript
+const pdf = excelToPdf(workbook, {
+  encryption: {
+    ownerPassword: "admin",
+    userPassword: "reader",
+    permissions: { print: true, copy: false }
+  }
+});
+```
+
+### Unicode / CJK
+
+```javascript
+import { readFileSync } from "fs";
+
+const pdf = excelToPdf(workbook, {
+  font: readFileSync("NotoSansSC-Regular.ttf") // TrueType font for CJK text
+});
+```
+
+### Standalone PDF (No Excel)
+
+Generate PDFs from plain data — no workbook, no Map objects, no boilerplate:
+
+```javascript
+import { pdf } from "@cj-tech-master/excelts/pdf";
+
+// Simplest — pass a 2D array
+const bytes = pdf([
+  ["Product", "Revenue"],
+  ["Widget", 1000],
+  ["Gadget", 2500]
+]);
+
+// With column widths and styled cells
+const bytes = pdf(
+  {
+    name: "Report",
+    columns: [
+      { width: 25, header: "Product" },
+      { width: 15, header: "Revenue" }
+    ],
+    data: [
+      ["Widget", 1000],
+      ["Gadget", 2500]
+    ]
+  },
+  { showGridLines: true }
+);
+```
+
+For the full API reference and all options, see the [PDF Module documentation](src/modules/pdf/README.md).
+
 ## Archive Utilities (ZIP/TAR)
 
 ExcelTS includes internal ZIP/TAR utilities used by the XLSX pipeline. If you use the
@@ -395,6 +499,7 @@ Then open `http://localhost:3000/src/modules/excel/examples/browser-smoke.html`.
 
 ### Browser-Specific Notes
 
+- **PDF export is fully supported** in browsers with zero configuration
 - **CSV operations are supported** using native RFC 4180 implementation
   - Use `await workbook.readCsv(input)` to read CSV
   - Use `workbook.writeCsv()` or `await workbook.writeCsvBuffer()` to write CSV
@@ -428,6 +533,16 @@ import {
   xmlEncode,
   xmlDecode,
 
+  // PDF export
+  pdf, // Simplest: pdf([["A", 1], ["B", 2]]) → Uint8Array
+  excelToPdf, // Workbook -> Uint8Array (Excel-to-PDF)
+  PageSizes, // Built-in page size definitions
+  PdfError, // Base PDF error
+  PdfRenderError, // Layout/rendering failures
+  PdfFontError, // Font parsing/embedding failures
+  PdfStructureError, // PDF structure assembly failures
+  isPdfError, // Type guard for PDF errors
+
   // Error infrastructure
   BaseError, // Base class for all library errors
   ExcelError, // Base Excel error (instanceof checks)
@@ -490,6 +605,7 @@ For detailed API documentation, please refer to the comprehensive documentation
 - Data Validation
 - Conditional Formatting
 - File I/O
+- [PDF Export](src/modules/pdf/README.md)
 
 ## Contributing Guidelines
 

package/README_zh.md

@@ -6,15 +6,12 @@
 
 ## 关于本项目
 
-ExcelTS 是现代化的 TypeScript Excel 工作簿管理器，具有以下特性:
+ExcelTS 是零依赖的 TypeScript 电子表格与文档工具包：
 
-- 🚀 **零运行时依赖** - 纯 TypeScript 实现，无任何外部包依赖
-- ✅ **广泛运行时支持** - 支持 LTS Node.js、Bun 及主流最新浏览器（Chrome、Firefox、Safari、Edge）
-- ✅ **完整的 TypeScript 支持** - 完整的类型定义和现代 TypeScript 模式
-- ✅ **现代构建系统** - 使用 Rolldown 进行更快的构建
-- ✅ **增强的测试** - 迁移到 Vitest 并支持浏览器测试
-- ✅ **ESM 优先** - 原生 ES Module 支持，兼容 CommonJS
-- ✅ **命名导出** - 所有导出都是命名导出，更好的 tree-shaking
+- 🚀 **零运行时依赖** — 纯 TypeScript 实现，无任何外部包依赖
+- 📦 **五大模块** — Excel（XLSX/JSON）、PDF（独立引擎 + Excel 桥接）、CSV（RFC 4180）、Archive（ZIP/TAR）、Stream（跨平台）
+- ✅ **跨平台** — Node.js 22+、Bun、Chrome 89+、Firefox 102+、Safari 14.1+
+- ✅ **ESM 优先** — 原生 ES Modules，兼容 CommonJS，完整 tree-shaking 支持
 
 ## 翻译
 
@@ -103,6 +100,16 @@ cell.fill = {
   - 超链接
   - 数据透视表
 
+- **PDF 导出**
+  - 零依赖 Excel 转 PDF
+  - 完整的单元格样式支持（字体、颜色、边框、填充、对齐）
+  - 自动分页与重复表头行
+  - TrueType 字体嵌入，支持 Unicode/CJK 中文文本
+  - JPEG 和 PNG 图片嵌入，支持透明度
+  - 密码保护和加密
+  - 每个工作表独立的页面设置（纸张大小、方向、页边距）
+  - 支持 Tree-shaking（不导入 = 不打包）
+
 - **高级功能**
   - 大文件流式处理
   - CSV 导入/导出
@@ -131,10 +138,107 @@ import { Readable, pipeline, createTransform } from "@cj-tech-master/excelts/str
 
 每个子路径支持 `browser`、`import`（ESM）和 `require`（CJS）条件。详见各模块文档：
 
+- [PDF 模块](src/modules/pdf/README.md) - 零依赖 Excel 转 PDF，支持加密和字体嵌入
 - [CSV 模块](src/modules/csv/README.md) - RFC 4180 解析/格式化、流式处理、数据生成
 - [归档模块](src/modules/archive/README.md) - ZIP/TAR 创建/读取/编辑、压缩、加密
 - [流模块](src/modules/stream/README.md) - 跨平台 Readable/Writable/Transform/Duplex
 
+## PDF 导出
+
+零依赖将任意工作簿导出为 PDF：
+
+```javascript
+import { Workbook, excelToPdf } from "@cj-tech-master/excelts";
+
+const workbook = new Workbook();
+const sheet = workbook.addWorksheet("报告");
+sheet.columns = [
+  { header: "产品", key: "product", width: 20 },
+  { header: "收入", key: "revenue", width: 15 }
+];
+sheet.addRow({ product: "组件A", revenue: 1000 });
+sheet.getColumn("revenue").numFmt = "¥#,##0.00";
+
+// 一行导出
+const pdf = excelToPdf(workbook, {
+  showGridLines: true,
+  showPageNumbers: true,
+  title: "销售报告"
+});
+
+// Node.js：写入文件
+import { writeFileSync } from "fs";
+writeFileSync("report.pdf", pdf);
+
+// 浏览器：下载
+const blob = new Blob([pdf], { type: "application/pdf" });
+const url = URL.createObjectURL(blob);
+window.open(url);
+```
+
+### 将现有 XLSX 转换为 PDF
+
+```javascript
+const workbook = new Workbook();
+await workbook.xlsx.readFile("input.xlsx");
+const pdf = excelToPdf(workbook);
+```
+
+### 加密
+
+```javascript
+const pdf = excelToPdf(workbook, {
+  encryption: {
+    ownerPassword: "admin",
+    userPassword: "reader",
+    permissions: { print: true, copy: false }
+  }
+});
+```
+
+### Unicode / CJK 中文支持
+
+```javascript
+import { readFileSync } from "fs";
+
+const pdf = excelToPdf(workbook, {
+  font: readFileSync("NotoSansSC-Regular.ttf") // 嵌入 TrueType 字体以支持中文
+});
+```
+
+### 独立 PDF 生成（无需 Excel）
+
+无需工作簿，直接从数组数据生成 PDF：
+
+```javascript
+import { pdf } from "@cj-tech-master/excelts/pdf";
+
+// 最简方式 — 传入二维数组
+const bytes = pdf([
+  ["产品", "收入"],
+  ["组件A", 1000],
+  ["组件B", 2500]
+]);
+
+// 带列宽和样式
+const bytes = pdf(
+  {
+    name: "报告",
+    columns: [
+      { width: 25, header: "产品" },
+      { width: 15, header: "收入" }
+    ],
+    data: [
+      ["组件A", 1000],
+      ["组件B", 2500]
+    ]
+  },
+  { showGridLines: true }
+);
+```
+
+完整 API 参考和所有选项请查看 [PDF 模块文档](src/modules/pdf/README.md)。
+
 ## 归档工具（ZIP/TAR）
 
 ExcelTS 内置 ZIP/TAR 归档工具（用于 XLSX 管线）。若直接使用归档相关 API，
@@ -393,6 +497,7 @@ npx serve .
 
 ### 浏览器版本注意事项
 
+- **完全支持 PDF 导出**（浏览器端零配置即可使用）
 - **支持 CSV 操作**（使用原生 RFC 4180 标准实现）
   - 使用 `await workbook.readCsv(input)` 读取 CSV
   - 使用 `workbook.writeCsv()` 或 `await workbook.writeCsvBuffer()` 写入 CSV
@@ -426,6 +531,16 @@ import {
   xmlEncode,
   xmlDecode,
 
+  // PDF 导出
+  pdf, // 最简单：pdf([["A", 1], ["B", 2]]) → Uint8Array
+  excelToPdf, // Workbook -> Uint8Array（Excel 转 PDF）
+  PageSizes, // 内置页面尺寸定义
+  PdfError, // PDF 基础错误
+  PdfRenderError, // 布局/渲染错误
+  PdfFontError, // 字体解析/嵌入错误
+  PdfStructureError, // PDF 结构组装错误
+  isPdfError, // PDF 错误类型守卫
+
   // 错误基础设施
   BaseError, // 所有库错误的基类
   ExcelError, // Excel 基础错误（支持 instanceof 检查）
@@ -488,6 +603,7 @@ import {
 - 数据验证
 - 条件格式
 - 文件输入输出
+- [PDF 导出](src/modules/pdf/README.md)
 
 ## 贡献指南
 

package/dist/browser/index.browser.d.ts

@@ -17,11 +17,10 @@ export * from "./modules/excel/enums.js";
 export * from "./modules/excel/types.js";
 export type { PivotTable, PivotTableModel, PivotTableValue, PivotTableSource, CacheField, SharedItemValue, DataField, PivotTableSubtotal, RecordValue, ParsedCacheDefinition, ParsedCacheRecords } from "./modules/excel/pivot-table.js";
 export type { FormCheckboxModel, FormCheckboxOptions, FormControlRange, FormControlAnchor } from "./modules/excel/form-control.js";
-import { WorkbookWriter } from "./modules/excel/stream/workbook-writer.browser.js";
-import { WorkbookReader } from "./modules/excel/stream/workbook-reader.browser.js";
-import { WorksheetWriter } from "./modules/excel/stream/worksheet-writer.js";
-import { WorksheetReader } from "./modules/excel/stream/worksheet-reader.js";
-export { WorkbookWriter, WorkbookReader, WorksheetWriter, WorksheetReader };
+export { WorkbookWriter } from "./modules/excel/stream/workbook-writer.browser.js";
+export { WorkbookReader } from "./modules/excel/stream/workbook-reader.browser.js";
+export { WorksheetWriter } from "./modules/excel/stream/worksheet-writer.js";
+export { WorksheetReader } from "./modules/excel/stream/worksheet-reader.js";
 export type { CsvOptions, CsvInput } from "./modules/excel/workbook.js";
 export { CsvParserStream, CsvFormatterStream, createCsvParserStream, createCsvFormatterStream } from "./modules/csv/stream/index.js";
 export { DefinedNames, type DefinedNameModel } from "./modules/excel/defined-names.js";
@@ -38,4 +37,6 @@ export { xmlEncode, xmlDecode } from "./utils/utils.base.js";
 export { DateParser, DateFormatter, getSupportedFormats, type DateFormat } from "./utils/datetime.js";
 export { BaseError, type BaseErrorOptions, toError, errorToJSON, getErrorChain, getRootCause } from "./utils/errors.js";
 export { concatUint8Arrays, toUint8Array, stringToUint8Array, uint8ArrayToString } from "./utils/binary.js";
+export { pdf, excelToPdf, PageSizes, PdfError, PdfRenderError, PdfFontError, PdfStructureError, isPdfError } from "./modules/pdf/index.js";
+export type { PdfExportOptions, PdfPageSize, PdfOrientation, PdfMargins, PageSizeName, PdfColor } from "./modules/pdf/index.js";
 export { ExcelError, isExcelError, ExcelFileError, ExcelDownloadError, ExcelNotSupportedError, ExcelStreamStateError, InvalidAddressError, ColumnOutOfBoundsError, RowOutOfBoundsError, MergeConflictError, InvalidValueTypeError, XmlParseError, WorksheetNameError, PivotTableError, TableError, ImageError, MaxItemsExceededError } from "./modules/excel/errors.js";

package/dist/browser/index.browser.js

@@ -29,11 +29,10 @@ export * from "./modules/excel/types.js";
 // Streaming Writer (Browser-compatible)
 // Uses cross-platform base implementation without Node.js fs
 // =============================================================================
-import { WorkbookWriter } from "./modules/excel/stream/workbook-writer.browser.js";
-import { WorkbookReader } from "./modules/excel/stream/workbook-reader.browser.js";
-import { WorksheetWriter } from "./modules/excel/stream/worksheet-writer.js";
-import { WorksheetReader } from "./modules/excel/stream/worksheet-reader.js";
-export { WorkbookWriter, WorkbookReader, WorksheetWriter, WorksheetReader };
+export { WorkbookWriter } from "./modules/excel/stream/workbook-writer.browser.js";
+export { WorkbookReader } from "./modules/excel/stream/workbook-reader.browser.js";
+export { WorksheetWriter } from "./modules/excel/stream/worksheet-writer.js";
+export { WorksheetReader } from "./modules/excel/stream/worksheet-reader.js";
 export { CsvParserStream, CsvFormatterStream, createCsvParserStream, createCsvFormatterStream } from "./modules/csv/stream/index.js";
 // =============================================================================
 // Additional Classes & Types
@@ -57,6 +56,10 @@ export { BaseError, toError, errorToJSON, getErrorChain, getRootCause } from "./
 // Binary utilities (cross-platform)
 export { concatUint8Arrays, toUint8Array, stringToUint8Array, uint8ArrayToString } from "./utils/binary.js";
 // =============================================================================
+// PDF Export (Browser-compatible, zero external dependencies)
+// =============================================================================
+export { pdf, excelToPdf, PageSizes, PdfError, PdfRenderError, PdfFontError, PdfStructureError, isPdfError } from "./modules/pdf/index.js";
+// =============================================================================
 // Errors
 // =============================================================================
 export { ExcelError, isExcelError, ExcelFileError, ExcelDownloadError, ExcelNotSupportedError, ExcelStreamStateError, InvalidAddressError, ColumnOutOfBoundsError, RowOutOfBoundsError, MergeConflictError, InvalidValueTypeError, XmlParseError, WorksheetNameError, PivotTableError, TableError, ImageError, MaxItemsExceededError } from "./modules/excel/errors.js";

package/dist/browser/index.d.ts

@@ -37,4 +37,6 @@ export { xmlEncode, xmlDecode } from "./utils/utils.base.js";
 export { DateParser, DateFormatter, getSupportedFormats, type DateFormat } from "./utils/datetime.js";
 export { BaseError, type BaseErrorOptions, toError, errorToJSON, getErrorChain, getRootCause } from "./utils/errors.js";
 export { concatUint8Arrays, toUint8Array, stringToUint8Array, uint8ArrayToString } from "./utils/binary.js";
+export { pdf, excelToPdf, PageSizes, PdfError, PdfRenderError, PdfFontError, PdfStructureError, isPdfError } from "./modules/pdf/index.js";
+export type { PdfExportOptions, PdfPageSize, PdfOrientation, PdfMargins, PageSizeName, PdfColor } from "./modules/pdf/index.js";
 export { ExcelError, isExcelError, ExcelFileError, ExcelDownloadError, ExcelNotSupportedError, ExcelStreamStateError, InvalidAddressError, ColumnOutOfBoundsError, RowOutOfBoundsError, MergeConflictError, InvalidValueTypeError, XmlParseError, WorksheetNameError, PivotTableError, TableError, ImageError, MaxItemsExceededError } from "./modules/excel/errors.js";

package/dist/browser/index.js

@@ -52,6 +52,10 @@ export { BaseError, toError, errorToJSON, getErrorChain, getRootCause } from "./
 // Binary utilities (cross-platform)
 export { concatUint8Arrays, toUint8Array, stringToUint8Array, uint8ArrayToString } from "./utils/binary.js";
 // =============================================================================
+// PDF Export
+// =============================================================================
+export { pdf, excelToPdf, PageSizes, PdfError, PdfRenderError, PdfFontError, PdfStructureError, isPdfError } from "./modules/pdf/index.js";
+// =============================================================================
 // Errors
 // =============================================================================
 export { ExcelError, isExcelError, ExcelFileError, ExcelDownloadError, ExcelNotSupportedError, ExcelStreamStateError, InvalidAddressError, ColumnOutOfBoundsError, RowOutOfBoundsError, MergeConflictError, InvalidValueTypeError, XmlParseError, WorksheetNameError, PivotTableError, TableError, ImageError, MaxItemsExceededError } from "./modules/excel/errors.js";

package/dist/browser/modules/archive/unzip/zip-extract-core.js

@@ -22,6 +22,13 @@ import { collect } from "../io/archive-sink.js";
  * Local file header fixed size (30 bytes)
  */
 export const LOCAL_HEADER_FIXED_SIZE = 30;
+/**
+ * Maximum allowed uncompressed entry size for non-streaming extraction (512 MB).
+ * This is a pre-decompression check based on the declared size in the ZIP metadata.
+ * It prevents memory exhaustion from archives that declare very large output sizes.
+ * The streaming extraction path (processEntryDataStream) has its own byte-level checks.
+ */
+const DEFAULT_MAX_ENTRY_SIZE = 512 * 1024 * 1024;
 /**
  * Process compressed (and possibly encrypted) entry data to get the final content.
  *
@@ -36,6 +43,15 @@ export const LOCAL_HEADER_FIXED_SIZE = 30;
  */
 export async function processEntryData(entry, compressedData, password, checkCrc32 = false, validateEntrySizes = true) {
     let result;
+    // Pre-decompression size check: reject entries whose *declared* uncompressed size
+    // exceeds the limit. This catches archives that honestly declare very large entries
+    // but does NOT protect against ZIP bombs that lie about their size (for that, use
+    // the streaming path processEntryDataStream which validates actual output bytes).
+    if (validateEntrySizes && entry.uncompressedSize > DEFAULT_MAX_ENTRY_SIZE) {
+        throw new Error(`Entry "${entry.path}" declares uncompressed size of ${entry.uncompressedSize} bytes, ` +
+            `which exceeds the maximum allowed size of ${DEFAULT_MAX_ENTRY_SIZE} bytes. ` +
+            "Use the streaming API for large entries.");
+    }
     // Handle encrypted entries
     if (entry.isEncrypted) {
         if (!password) {
@@ -99,6 +115,12 @@ export async function processEntryData(entry, compressedData, password, checkCrc
  */
 export function processEntryDataSync(entry, compressedData, password, validateEntrySizes = true) {
     let result;
+    // Pre-decompression size check (same as async version)
+    if (validateEntrySizes && entry.uncompressedSize > DEFAULT_MAX_ENTRY_SIZE) {
+        throw new Error(`Entry "${entry.path}" declares uncompressed size of ${entry.uncompressedSize} bytes, ` +
+            `which exceeds the maximum allowed size of ${DEFAULT_MAX_ENTRY_SIZE} bytes. ` +
+            "Use the streaming API for large entries.");
+    }
     // Handle encrypted entries
     if (entry.isEncrypted) {
         if (!password) {

package/dist/browser/modules/archive/zip/zip-entry-options.d.ts

@@ -31,17 +31,17 @@ export type ZipDeflateFileDefaults = {
 export declare function buildZipDeflateFileOptions(entryOptions: ZipDeflateFileEntryOptions | undefined, defaults: ZipDeflateFileDefaults): {
     level: number;
     modTime: Date;
-    atime: Date;
-    ctime: Date;
-    birthTime: Date;
+    atime: Date | undefined;
+    ctime: Date | undefined;
+    birthTime: Date | undefined;
     timestamps: ZipTimestampMode;
-    comment: string;
+    comment: string | undefined;
     smartStore: boolean;
     zip64: Zip64Mode;
     path: false | ZipPathOptions;
-    encoding: ZipStringEncoding;
-    mode: number;
-    msDosAttributes: number;
-    externalAttributes: number;
-    versionMadeBy: number;
+    encoding: ZipStringEncoding | undefined;
+    mode: number | undefined;
+    msDosAttributes: number | undefined;
+    externalAttributes: number | undefined;
+    versionMadeBy: number | undefined;
 };

package/dist/browser/modules/archive/zip-spec/zip-parser-core.js

@@ -13,6 +13,18 @@ import { CENTRAL_DIR_HEADER_SIG, COMPRESSION_AES, UINT16_MAX, UINT32_MAX, ZIP64_
 // -----------------------------------------------------------------------------
 // Constants
 // -----------------------------------------------------------------------------
+const MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
+/**
+ * Convert a BigInt to Number, throwing if the value exceeds Number.MAX_SAFE_INTEGER.
+ * This prevents silent precision loss when parsing ZIP64 fields.
+ */
+function safeBigIntToNumber(value, fieldName) {
+    if (value > MAX_SAFE) {
+        throw new Error(`ZIP64 ${fieldName} value ${value} exceeds Number.MAX_SAFE_INTEGER. ` +
+            "The archive may be corrupted or malicious.");
+    }
+    return Number(value);
+}
 /** Minimum EOCD size (22 bytes fixed + 0-byte comment) */
 export const EOCD_MIN_SIZE = 22;
 /** Maximum comment size (2^16 - 1) */
@@ -129,7 +141,7 @@ export function parseZIP64EOCDLocator(data, offset) {
         return -1;
     }
     reader.skip(4); // disk number with ZIP64 EOCD
-    return Number(reader.readBigUint64());
+    return safeBigIntToNumber(reader.readBigUint64(), "EOCD locator offset");
 }
 /**
  * Parse ZIP64 EOCD.
@@ -167,16 +179,16 @@ export function parseZIP64EOCD(data, offset) {
  */
 export function applyZIP64ToEOCD(eocd, zip64) {
     if (eocd.totalEntries === UINT16_MAX) {
-        eocd.totalEntries = Number(zip64.totalEntries);
+        eocd.totalEntries = safeBigIntToNumber(zip64.totalEntries, "totalEntries");
     }
     if (eocd.entriesOnDisk === UINT16_MAX) {
-        eocd.entriesOnDisk = Number(zip64.entriesOnDisk);
+        eocd.entriesOnDisk = safeBigIntToNumber(zip64.entriesOnDisk, "entriesOnDisk");
     }
     if (eocd.centralDirSize === UINT32_MAX) {
-        eocd.centralDirSize = Number(zip64.centralDirSize);
+        eocd.centralDirSize = safeBigIntToNumber(zip64.centralDirSize, "centralDirSize");
     }
     if (eocd.centralDirOffset === UINT32_MAX) {
-        eocd.centralDirOffset = Number(zip64.centralDirOffset);
+        eocd.centralDirOffset = safeBigIntToNumber(zip64.centralDirOffset, "centralDirOffset");
     }
 }
 // -----------------------------------------------------------------------------

package/dist/browser/modules/csv/format/formatter.js

@@ -134,7 +134,12 @@ export function formatField(value, regex, ctx) {
     // Escape formulae to prevent CSV injection (OWASP recommendation)
     // Prefix dangerous characters with single quote to neutralize them in spreadsheet apps
     // Using single quote (') as recommended by OWASP, which Excel interprets as a text prefix
-    if (escapeFormulae && transformQuoteHint !== false && startsWithFormulaChar(str)) {
+    // Skip numeric types: negative numbers like -5.55 are not formula injection vectors
+    if (escapeFormulae &&
+        transformQuoteHint !== false &&
+        typeof value !== "number" &&
+        typeof value !== "bigint" &&
+        startsWithFormulaChar(str)) {
         str = "'" + str;
     }
     // If quoting is disabled, return raw string

package/dist/browser/modules/csv/index.d.ts

@@ -11,8 +11,8 @@
  */
 export type { HeaderArray, RowHashArray, RowArray, RowMap, Row, HeaderTransformFunction, RowTransformCallback, RowTransformFunction, RowValidateCallback, RowValidateFunction, TransformContext, FormattedValue, TransformResult, TypeTransformMap, DynamicTypingConfig, CastDateConfig, ColumnConfig, CsvErrorCode, CsvRecordError, OnSkipCallback, CsvParseOptions, CsvFormatOptions, CsvParseArrayOptions, CsvParseObjectOptions, ChunkMeta, CsvParseMeta, RecordInfo, RecordWithInfo, CsvParseResult, CsvParseResultWithObjname, ColumnMismatchConfig, ColumnMismatchLess, ColumnMismatchMore } from "./types.js";
 export { isFormattedValue, quoted, unquoted } from "./types.js";
-export { parseCsv } from "./parse/index.js";
-export { parseCsvAsync, parseCsvRows, parseCsvWithProgress } from "./parse/index.js";
+export { parseCsv } from "./parse/sync.js";
+export { parseCsvAsync, parseCsvRows, parseCsvWithProgress } from "./parse/async.js";
 export { formatCsv } from "./format/index.js";
 export { CsvParserStream, CsvFormatterStream, createCsvParserStream, createCsvFormatterStream } from "./stream/index.js";
 export { detectDelimiter, detectLinebreak, stripBom } from "./utils/detect.js";

package/dist/browser/modules/csv/index.js

@@ -14,10 +14,10 @@ export { isFormattedValue, quoted, unquoted } from "./types.js";
 // =============================================================================
 // Core Functions
 // =============================================================================
-// Synchronous parser
-export { parseCsv } from "./parse/index.js";
+// Synchronous parser (direct import to avoid barrel pulling in async -> stream)
+export { parseCsv } from "./parse/sync.js";
 // Async parser
-export { parseCsvAsync, parseCsvRows, parseCsvWithProgress } from "./parse/index.js";
+export { parseCsvAsync, parseCsvRows, parseCsvWithProgress } from "./parse/async.js";
 // Formatter
 export { formatCsv } from "./format/index.js";
 // =============================================================================

package/dist/browser/modules/csv/parse/sync.js

@@ -401,7 +401,7 @@ export function parseCsv(input, options = {}) {
     // Handle objname option
     const { objname } = options;
     if (objname && state.headerRow) {
-        const objResult = {};
+        const objResult = Object.create(null);
         for (const item of objectRows) {
             const rec = config.infoOption
                 ? item.record
@@ -409,6 +409,11 @@ export function parseCsv(input, options = {}) {
             const key = rec[objname];
             // Convert undefined/null to empty string, otherwise convert to string
             const keyStr = key === undefined || key === null ? "" : String(key);
+            // Skip __proto__ to prevent prototype pollution via JSON.
+            // Note: constructor/prototype are safe on Object.create(null) objects.
+            if (keyStr === "__proto__") {
+                continue;
+            }
             objResult[keyStr] = item;
         }
         return {