@cj-tech-master/excelts 7.0.1 → 7.1.0-canary.20260401153228.4a85b2c

package/README.md

@@ -9,10 +9,19 @@ Modern TypeScript Excel Workbook Manager - Read, manipulate and write spreadshee
 ExcelTS is a zero-dependency TypeScript toolkit for spreadsheets and documents:
 
 - 🚀 **Zero Runtime Dependencies** — Pure TypeScript, no external packages
-- 📦 **Five Modules** — Excel (XLSX/JSON), PDF (standalone engine + Excel bridge), CSV (RFC 4180), Archive (ZIP/TAR), Stream (cross-platform)
+- 📦 **Six Modules** — Excel (XLSX/JSON), PDF (standalone engine + Excel bridge), CSV (RFC 4180), XML (SAX/DOM/Writer), Archive (ZIP/TAR), Stream (cross-platform)
+- 🤖 **AI-Friendly** — Clean, consistent API designed to be easily generated and consumed by AI coding agents — one library handles Excel, PDF, CSV, XML, ZIP, and streaming with maximum efficiency
 - ✅ **Cross-Platform** — Node.js 22+, Bun, Chrome 89+, Firefox 102+, Safari 14.1+
 - ✅ **ESM First** — Native ES Modules with CommonJS compatibility and full tree-shaking
 
+## Module Documentation
+
+- [XML Module](src/modules/xml/README.md) — Zero-dependency SAX/DOM parser, query engine, and dual-mode writer
+- [PDF Module](src/modules/pdf/README.md) — Full-featured zero-dependency PDF engine with encryption and font embedding
+- [CSV Module](src/modules/csv/README.md) — RFC 4180 parser/formatter, streaming, data generation
+- [Archive Module](src/modules/archive/README.md) — ZIP/TAR create/read/edit, compression, encryption
+- [Stream Module](src/modules/stream/README.md) — Cross-platform Readable/Writable/Transform/Duplex
+
 ## Translations
 
 - [中文文档](README_zh.md)
@@ -126,6 +135,9 @@ ExcelTS provides focused subpath exports for standalone module usage:
 // Main entry - Excel core (Workbook, Worksheet, Cell, etc.)
 import { Workbook, WorkbookWriter } from "@cj-tech-master/excelts";
 
+// XML toolkit (SAX parser, DOM parser, query engine, writers)
+import { SaxParser, parseXml, XmlWriter, query } from "@cj-tech-master/excelts/xml";
+
 // ZIP/TAR archive utilities
 import { zip, unzip, ZipArchive, compress } from "@cj-tech-master/excelts/zip";
 
@@ -136,12 +148,7 @@ import { parseCsv, formatCsv, CsvParserStream } from "@cj-tech-master/excelts/cs
 import { Readable, pipeline, createTransform } from "@cj-tech-master/excelts/stream";
 ```
 
-Each subpath supports `browser`, `import` (ESM), and `require` (CJS) conditions. See the module READMEs for details:
-
-- [PDF Module](src/modules/pdf/README.md) - Full-featured zero-dependency PDF engine with encryption and font embedding
-- [CSV Module](src/modules/csv/README.md) - RFC 4180 parser/formatter, streaming, data generation
-- [Archive Module](src/modules/archive/README.md) - ZIP/TAR create/read/edit, compression, encryption
-- [Stream Module](src/modules/stream/README.md) - Cross-platform Readable/Writable/Transform/Duplex
+Each subpath supports `browser`, `import` (ESM), and `require` (CJS) conditions.
 
 ## PDF Export
 
@@ -251,6 +258,45 @@ archive APIs directly, ZIP string encoding can be customized via `ZipStringEncod
 When a non-UTF-8 encoding is used, Unicode extra fields can be emitted for better
 cross-tool compatibility.
 
+## XML Toolkit
+
+ExcelTS includes a standalone, zero-dependency XML module with streaming and buffered parsing/writing. It powers the XLSX pipeline internally and is available as a standalone subpath export.
+
+### Key Features
+
+- **SAX Parser** — Event-driven streaming parser with high throughput
+- **DOM Parser** — Build a queryable XML tree from a string
+- **Query Engine** — Simplified path expressions (`a/b[@id='1']`, `a//c`, `a/b[0]`)
+- **Dual-Mode Writer** — Buffered (`XmlWriter`) and streaming (`XmlStreamWriter`)
+- **Full Namespace Support** — Prefix resolution, reserved namespace enforcement, unbound prefix detection
+- **Security Hardened** — Entity expansion limits, nesting depth limits, duplicate attribute rejection, BOM handling
+
+### Quick Example
+
+```typescript
+import { SaxParser, parseXml, XmlWriter, query } from "@cj-tech-master/excelts/xml";
+
+// SAX streaming parse
+const parser = new SaxParser();
+parser.on("opentag", tag => console.log(tag.name, tag.attributes));
+parser.write('<root><item id="1">hello</item></root>');
+parser.close();
+
+// DOM parse + query
+const doc = parseXml("<root><a><b>1</b><b>2</b></a></root>");
+const items = queryAll(doc.root, "a/b"); // all <b> elements
+
+// Write XML
+const w = new XmlWriter();
+w.openXml();
+w.openNode("root");
+w.leafNode("item", { id: "1" }, "hello");
+w.closeNode();
+console.log(w.xml);
+```
+
+For the full API reference, see the [XML Module documentation](src/modules/xml/README.md).
+
 ### Editing an existing ZIP (ZipEditor)
 
 ExcelTS also includes a ZIP editor that can apply filesystem-like edits to an existing archive
@@ -532,6 +578,8 @@ import {
   // XML utilities
   xmlEncode,
   xmlDecode,
+  xmlEncodeAttr,
+  validateXmlName,
 
   // PDF export
   pdf, // Simplest: pdf([["A", 1], ["B", 2]]) → Uint8Array
@@ -571,28 +619,6 @@ For older browsers without native `CompressionStream` API (Firefox < 113, Safari
 
 ExcelTS does **not** require `crypto.randomUUID()` in browsers; it uses an internal UUID v4 generator with a `crypto.getRandomValues()` fallback.
 
-## Maintainer
-
-This project is actively maintained by [CJ (@cjnoname)](https://github.com/cjnoname).
-
-### Maintenance Status
-
-**Active Maintenance** - This project is actively maintained with a focus on:
-
-- 🔒 **Security Updates** - Timely security patches and dependency updates
-- 🐛 **Bug Fixes** - Critical bug fixes and stability improvements
-- 📦 **Dependency Management** - Keeping dependencies up-to-date and secure
-- 🔍 **Code Review** - Reviewing and merging community contributions
-
-### Contributing
-
-While I may not have the bandwidth to develop new features regularly, **community contributions are highly valued and encouraged!**
-
-- 💡 **Pull Requests Welcome** - I will review and merge quality PRs promptly
-- 🚀 **Feature Proposals** - Open an issue to discuss new features before implementing
-- 🐛 **Bug Reports** - Please report bugs with reproducible examples
-- 📖 **Documentation** - Improvements to documentation are always appreciated
-
 ## API Documentation
 
 For detailed API documentation, please refer to the comprehensive documentation sections:
@@ -605,33 +631,6 @@ For detailed API documentation, please refer to the comprehensive documentation
 - Data Validation
 - Conditional Formatting
 - File I/O
-- [PDF Export](src/modules/pdf/README.md)
-
-## Contributing Guidelines
-
-Contributions are welcome! Please feel free to submit a Pull Request.
-
-### Before Submitting a PR
-
-1. **Bug Fixes**: Add a unit-test or integration-test (in `src/**/__tests__`) that reproduces the issue
-2. **New Features**: Open an issue first to discuss the feature and implementation approach
-3. **Documentation**: Update relevant documentation and type definitions
-4. **Code Style**: Follow the existing code style and pass all linters (`npm run lint`)
-5. **Tests**: Ensure all tests pass (`npm test`) and add tests for new functionality
-
-### Important Notes
-
-- **Version Numbers**: Please do not modify package version in PRs. Versions are managed through releases.
-- **License**: All contributions will be included under the project's MIT license
-- **Commit Messages**: Write clear, descriptive commit messages
-
-### Getting Help
-
-If you need help or have questions:
-
-- 📖 Check existing [issues](https://github.com/cjnoname/excelts/issues) and [documentation](https://github.com/cjnoname/excelts)
-- 💬 Open a [new issue](https://github.com/cjnoname/excelts/issues/new) for discussion
-- 🐛 Use issue templates for bug reports
 
 ## License
 

package/README_zh.md

@@ -9,10 +9,19 @@
 ExcelTS 是零依赖的 TypeScript 电子表格与文档工具包：
 
 - 🚀 **零运行时依赖** — 纯 TypeScript 实现，无任何外部包依赖
-- 📦 **五大模块** — Excel（XLSX/JSON）、PDF（独立引擎 + Excel 桥接）、CSV（RFC 4180）、Archive（ZIP/TAR）、Stream（跨平台）
+- 📦 **六大模块** — Excel（XLSX/JSON）、PDF（独立引擎 + Excel 桥接）、CSV（RFC 4180）、XML（SAX/DOM/Writer）、Archive（ZIP/TAR）、Stream（跨平台）
+- 🤖 **AI 最佳伴侣** — 简洁一致的 API 设计，让 AI 编程助手更容易生成处理各种文件的代码——一个库搞定 Excel、PDF、CSV、XML、ZIP 和流式处理，保持最高效率
 - ✅ **跨平台** — Node.js 22+、Bun、Chrome 89+、Firefox 102+、Safari 14.1+
 - ✅ **ESM 优先** — 原生 ES Modules，兼容 CommonJS，完整 tree-shaking 支持
 
+## 模块文档
+
+- [XML 模块](src/modules/xml/README.md) — 零依赖 SAX/DOM 解析器、查询引擎和双模式写入器
+- [PDF 模块](src/modules/pdf/README.md) — 零依赖 PDF 引擎，支持加密和字体嵌入
+- [CSV 模块](src/modules/csv/README.md) — RFC 4180 解析/格式化、流式处理、数据生成
+- [归档模块](src/modules/archive/README.md) — ZIP/TAR 创建/读取/编辑、压缩、加密
+- [流模块](src/modules/stream/README.md) — 跨平台 Readable/Writable/Transform/Duplex
+
 ## 翻译
 
 - [English Documentation](README.md)
@@ -126,6 +135,9 @@ ExcelTS 提供独立模块的子路径导出：
 // 主入口 - Excel 核心（Workbook, Worksheet, Cell 等）
 import { Workbook, WorkbookWriter } from "@cj-tech-master/excelts";
 
+// XML 工具包（SAX 解析器、DOM 解析器、查询引擎、写入器）
+import { SaxParser, parseXml, XmlWriter, query } from "@cj-tech-master/excelts/xml";
+
 // ZIP/TAR 归档工具
 import { zip, unzip, ZipArchive, compress } from "@cj-tech-master/excelts/zip";
 
@@ -136,12 +148,7 @@ import { parseCsv, formatCsv, CsvParserStream } from "@cj-tech-master/excelts/cs
 import { Readable, pipeline, createTransform } from "@cj-tech-master/excelts/stream";
 ```
 
-每个子路径支持 `browser`、`import`（ESM）和 `require`（CJS）条件。详见各模块文档：
-
-- [PDF 模块](src/modules/pdf/README.md) - 零依赖 Excel 转 PDF，支持加密和字体嵌入
-- [CSV 模块](src/modules/csv/README.md) - RFC 4180 解析/格式化、流式处理、数据生成
-- [归档模块](src/modules/archive/README.md) - ZIP/TAR 创建/读取/编辑、压缩、加密
-- [流模块](src/modules/stream/README.md) - 跨平台 Readable/Writable/Transform/Duplex
+每个子路径支持 `browser`、`import`（ESM）和 `require`（CJS）条件。
 
 ## PDF 导出
 
@@ -250,6 +257,45 @@ ExcelTS 内置 ZIP/TAR 归档工具（用于 XLSX 管线）。若直接使用归
 
 当使用非 UTF-8 编码时，可写入 Unicode Extra Field 以提升跨工具兼容性。
 
+## XML 工具包
+
+ExcelTS 内置一个独立的、零依赖的 XML 模块，支持流式和缓冲两种解析/写入模式。它为 XLSX 管线提供底层支持，也可作为独立子路径导出使用。
+
+### 核心特性
+
+- **SAX 解析器** — 事件驱动的高性能流式解析器
+- **DOM 解析器** — 从字符串构建可查询的 XML 树
+- **查询引擎** — 简化路径表达式（`a/b[@id='1']`、`a//c`、`a/b[0]`）
+- **双模式写入** — 缓冲模式（`XmlWriter`）和流式模式（`XmlStreamWriter`）
+- **完整命名空间支持** — 前缀解析、保留命名空间强制、未绑定前缀检测
+- **安全加固** — 实体展开限制、嵌套深度限制、重复属性拒绝、BOM 处理
+
+### 快速示例
+
+```typescript
+import { SaxParser, parseXml, XmlWriter, queryAll } from "@cj-tech-master/excelts/xml";
+
+// SAX 流式解析
+const parser = new SaxParser();
+parser.on("opentag", tag => console.log(tag.name, tag.attributes));
+parser.write('<root><item id="1">hello</item></root>');
+parser.close();
+
+// DOM 解析 + 查询
+const doc = parseXml("<root><a><b>1</b><b>2</b></a></root>");
+const items = queryAll(doc.root, "a/b"); // 所有 <b> 元素
+
+// 写入 XML
+const w = new XmlWriter();
+w.openXml();
+w.openNode("root");
+w.leafNode("item", { id: "1" }, "hello");
+w.closeNode();
+console.log(w.xml);
+```
+
+完整 API 参考请见 [XML 模块文档](src/modules/xml/README.md)。
+
 ### 编辑现有 ZIP（ZipEditor）
 
 ExcelTS 也提供 ZIP 编辑器：对已有压缩包做类似文件系统的编辑，然后输出一个新的 ZIP。
@@ -530,6 +576,8 @@ import {
   // XML 工具
   xmlEncode,
   xmlDecode,
+  xmlEncodeAttr,
+  validateXmlName,
 
   // PDF 导出
   pdf, // 最简单：pdf([["A", 1], ["B", 2]]) → Uint8Array
@@ -569,28 +617,6 @@ import {
 
 浏览器端不要求必须支持 `crypto.randomUUID()`：ExcelTS 内置了 UUID v4 生成器，并会优先使用 `crypto.getRandomValues()` 作为 fallback。
 
-## 维护者
-
-本项目由 [CJ (@cjnoname)](https://github.com/cjnoname) 积极维护。
-
-### 维护状态
-
-**积极维护中** - 本项目处于积极维护状态，重点关注：
-
-- 🔒 **安全更新** - 及时的安全补丁和依赖项更新
-- 🐛 **Bug 修复** - 关键 Bug 修复和稳定性改进
-- 📦 **依赖管理** - 保持依赖项最新且安全
-- 🔍 **代码审查** - 审查和合并社区贡献
-
-### 贡献
-
-虽然我可能没有足够的时间定期开发新功能，但**非常重视和欢迎社区贡献！**
-
-- 💡 **欢迎 Pull Request** - 我会及时审查并合并高质量的 PR
-- 🚀 **功能提议** - 在实现前请先开 issue 讨论新功能
-- 🐛 **Bug 报告** - 请提供可重现的示例报告 Bug
-- 📖 **文档改进** - 始终欢迎文档改进
-
 ## API 文档
 
 详细的 API 文档，请参考以下综合文档部分：
@@ -603,33 +629,6 @@ import {
 - 数据验证
 - 条件格式
 - 文件输入输出
-- [PDF 导出](src/modules/pdf/README.md)
-
-## 贡献指南
-
-欢迎贡献！请随时提交 Pull Request。
-
-### 提交 PR 前
-
-1. **Bug 修复**：在 `src/**/__tests__` 中添加能重现问题的单元测试或集成测试
-2. **新功能**：先开 issue 讨论功能和实现方案
-3. **文档**：更新相关文档和类型定义
-4. **代码风格**：遵循现有代码风格并通过所有代码检查（`npm run lint`）
-5. **测试**：确保所有测试通过（`npm test`）并为新功能添加测试
-
-### 重要说明
-
-- **版本号**：请不要在 PR 中修改 package 版本。版本通过发布管理。
-- **许可证**：所有贡献都将包含在项目的 MIT 许可证下
-- **提交信息**：编写清晰、描述性的提交信息
-
-### 获取帮助
-
-如果需要帮助或有疑问：
-
-- 📖 查看现有的 [issues](https://github.com/cjnoname/excelts/issues) 和[文档](https://github.com/cjnoname/excelts)
-- 💬 开一个[新 issue](https://github.com/cjnoname/excelts/issues/new) 讨论
-- 🐛 使用 issue 模板报告 Bug
 
 ## 许可证
 

package/dist/browser/index.browser.d.ts

@@ -33,7 +33,7 @@ export type { CellAddress, SheetRange, Origin } from "./modules/excel/utils/addr
 export type { SheetToJSONOptions, AddJSONOptions, AddAOAOptions } from "./modules/excel/worksheet.js";
 export { dateToExcel, excelToDate } from "./utils/utils.base.js";
 export { base64ToUint8Array, uint8ArrayToBase64 } from "./utils/utils.base.js";
-export { xmlEncode, xmlDecode } from "./utils/utils.base.js";
+export { xmlEncode, xmlDecode } from "./modules/xml/encode.js";
 export { DateParser, DateFormatter, getSupportedFormats, type DateFormat } from "./utils/datetime.js";
 export { BaseError, type BaseErrorOptions, toError, errorToJSON, getErrorChain, getRootCause } from "./utils/errors.js";
 export { concatUint8Arrays, toUint8Array, stringToUint8Array, uint8ArrayToString } from "./utils/binary.js";

package/dist/browser/index.browser.js

@@ -48,7 +48,7 @@ export { dateToExcel, excelToDate } from "./utils/utils.base.js";
 // Base64 utilities (cross-platform)
 export { base64ToUint8Array, uint8ArrayToBase64 } from "./utils/utils.base.js";
 // XML utilities
-export { xmlEncode, xmlDecode } from "./utils/utils.base.js";
+export { xmlEncode, xmlDecode } from "./modules/xml/encode.js";
 // Date parsing/formatting (high-performance, zero-dep)
 export { DateParser, DateFormatter, getSupportedFormats } from "./utils/datetime.js";
 // Error infrastructure

package/dist/browser/index.d.ts

@@ -33,7 +33,7 @@ export type { CellAddress, SheetRange, Origin } from "./modules/excel/utils/addr
 export type { SheetToJSONOptions, AddJSONOptions, AddAOAOptions } from "./modules/excel/worksheet.js";
 export { dateToExcel, excelToDate } from "./utils/utils.base.js";
 export { base64ToUint8Array, uint8ArrayToBase64 } from "./utils/utils.base.js";
-export { xmlEncode, xmlDecode } from "./utils/utils.base.js";
+export { xmlEncode, xmlDecode } from "./modules/xml/encode.js";
 export { DateParser, DateFormatter, getSupportedFormats, type DateFormat } from "./utils/datetime.js";
 export { BaseError, type BaseErrorOptions, toError, errorToJSON, getErrorChain, getRootCause } from "./utils/errors.js";
 export { concatUint8Arrays, toUint8Array, stringToUint8Array, uint8ArrayToString } from "./utils/binary.js";

package/dist/browser/index.js

@@ -44,7 +44,7 @@ export { dateToExcel, excelToDate } from "./utils/utils.base.js";
 // Base64 utilities (cross-platform)
 export { base64ToUint8Array, uint8ArrayToBase64 } from "./utils/utils.base.js";
 // XML utilities
-export { xmlEncode, xmlDecode } from "./utils/utils.base.js";
+export { xmlEncode, xmlDecode } from "./modules/xml/encode.js";
 // Date parsing/formatting (high-performance, zero-dep)
 export { DateParser, DateFormatter, getSupportedFormats } from "./utils/datetime.js";
 // Error infrastructure

package/dist/browser/modules/excel/stream/hyperlink-reader.js

@@ -4,7 +4,7 @@
  * Cross-platform implementation.
  */
 import { EventEmitter } from "../../../utils/event-emitter.js";
-import { parseSax } from "../utils/parse-sax.js";
+import { SaxParser } from "../../xml/sax.js";
 import { Enums } from "../enums.js";
 import { RelType } from "../xlsx/rel-type.js";
 class HyperlinkReader extends EventEmitter {
@@ -43,37 +43,43 @@ class HyperlinkReader extends EventEmitter {
             return;
         }
         try {
-            for await (const events of parseSax(iterator)) {
-                for (const { eventType, value } of events) {
-                    if (eventType !== "opentag") {
-                        continue;
-                    }
-                    const node = value;
-                    if (node.name !== "Relationship") {
-                        continue;
-                    }
-                    const attributes = node.attributes;
-                    if (attributes.Type !== RelType.Hyperlink) {
-                        continue;
-                    }
-                    const relationship = {
-                        type: Enums.RelationshipType.Hyperlink,
-                        rId: attributes.Id,
-                        target: attributes.Target,
-                        targetMode: attributes.TargetMode
-                    };
-                    if (emitHyperlinks) {
-                        this.emit("hyperlink", relationship);
-                        continue;
-                    }
-                    // cache mode
-                    const rId = relationship.rId;
-                    if (cachedHyperlinks && cachedHyperlinks[rId] === undefined) {
-                        this._hyperlinkCount += 1;
-                    }
-                    cachedHyperlinks[rId] = relationship;
+            const parser = new SaxParser({ position: false });
+            const decoder = new TextDecoder("utf-8", { fatal: true });
+            parser.on("opentag", (node) => {
+                if (node.name !== "Relationship") {
+                    return;
                 }
+                const attributes = node.attributes;
+                if (attributes.Type !== RelType.Hyperlink) {
+                    return;
+                }
+                const relationship = {
+                    type: Enums.RelationshipType.Hyperlink,
+                    rId: attributes.Id,
+                    target: attributes.Target,
+                    targetMode: attributes.TargetMode
+                };
+                if (emitHyperlinks) {
+                    this.emit("hyperlink", relationship);
+                    return;
+                }
+                // cache mode
+                const rId = relationship.rId;
+                if (cachedHyperlinks && cachedHyperlinks[rId] === undefined) {
+                    this._hyperlinkCount += 1;
+                }
+                cachedHyperlinks[rId] = relationship;
+            });
+            for await (const chunk of iterator) {
+                const chunkStr = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+                parser.write(chunkStr);
+            }
+            // Flush trailing bytes (catches truncated UTF-8)
+            const trailing = decoder.decode();
+            if (trailing) {
+                parser.write(trailing);
             }
+            parser.close();
             this.emit("finished");
         }
         catch (error) {

package/dist/browser/modules/excel/stream/sheet-comments-writer.js

@@ -1,4 +1,4 @@
-import { XmlStream } from "../utils/xml-stream.js";
+import { XmlWriter } from "../../xml/writer.js";
 import { RelType } from "../xlsx/rel-type.js";
 import { colCache } from "../utils/col-cache.js";
 import { CommentXform } from "../xlsx/xform/comment/comment-xform.js";
@@ -60,13 +60,13 @@ class SheetCommentsWriter {
     }
     _writeComment(comment, index) {
         const commentXform = new CommentXform();
-        const commentsXmlStream = new XmlStream();
-        commentXform.render(commentsXmlStream, comment);
-        this.commentsStream.write(commentsXmlStream.xml);
+        const commentsXmlWriter = new XmlWriter();
+        commentXform.render(commentsXmlWriter, comment);
+        this.commentsStream.write(commentsXmlWriter.xml);
         const vmlShapeXform = new VmlShapeXform();
-        const vmlXmlStream = new XmlStream();
-        vmlShapeXform.render(vmlXmlStream, comment, index);
-        this.vmlStream.write(vmlXmlStream.xml);
+        const vmlXmlWriter = new XmlWriter();
+        vmlShapeXform.render(vmlXmlWriter, comment, index);
+        this.vmlStream.write(vmlXmlWriter.xml);
     }
     _writeClose() {
         this.commentsStream.write("</commentList></comments>");

package/dist/browser/modules/excel/stream/sheet-rels-writer.js

@@ -1,4 +1,4 @@
-import { xmlEncode } from "../../../utils/utils.browser.js";
+import { xmlEncode } from "../../xml/encode.js";
 import { RelType } from "../xlsx/rel-type.js";
 import { worksheetRelsPath } from "../utils/ooxml-paths.js";
 import { isInternalLink } from "../xlsx/xform/sheet/hyperlink-xform.js";
@@ -82,13 +82,13 @@ class SheetRelsWriter {
         const rId = `rId${++this.count}`;
         if (relationship.TargetMode) {
             this.stream.write(`<Relationship Id="${rId}"` +
-                ` Type="${relationship.Type}"` +
+                ` Type="${xmlEncode(relationship.Type)}"` +
                 ` Target="${xmlEncode(relationship.Target)}"` +
-                ` TargetMode="${relationship.TargetMode}"` +
+                ` TargetMode="${xmlEncode(relationship.TargetMode)}"` +
                 "/>");
         }
         else {
-            this.stream.write(`<Relationship Id="${rId}" Type="${relationship.Type}" Target="${relationship.Target}"/>`);
+            this.stream.write(`<Relationship Id="${rId}" Type="${xmlEncode(relationship.Type)}" Target="${xmlEncode(relationship.Target)}"/>`);
         }
         return rId;
     }