@cj-tech-master/excelts 9.4.2 → 9.5.0

package/dist/browser/modules/excel/utils/ooxml-validator/check-chartsheet.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Chartsheet structure check.
+ *
+ * A chartsheet (`xl/chartsheets/sheetN.xml`) must contain a `<drawing>`
+ * reference — the chart itself is always in the linked drawing part.
+ * Without it, Excel shows an empty chart sheet.
+ */
+import type { ValidationContext } from "./context.js";
+export declare function checkChartsheet(ctx: ValidationContext): void;

package/dist/browser/modules/excel/utils/ooxml-validator/check-chartsheet.js

@@ -0,0 +1,26 @@
+/**
+ * Chartsheet structure check.
+ *
+ * A chartsheet (`xl/chartsheets/sheetN.xml`) must contain a `<drawing>`
+ * reference — the chart itself is always in the linked drawing part.
+ * Without it, Excel shows an empty chart sheet.
+ */
+import { hasDescendantLocal } from "./xml-utils.js";
+const CHARTSHEET_PATH_RE = /^xl\/chartsheets\/sheet\d+\.xml$/;
+export function checkChartsheet(ctx) {
+    for (const [path, entry] of ctx.files()) {
+        if (ctx.reporter.capped) {
+            return;
+        }
+        if (entry.type === "directory" || !CHARTSHEET_PATH_RE.test(path)) {
+            continue;
+        }
+        const dom = ctx.readDom(path);
+        if (!dom) {
+            continue;
+        }
+        if (!hasDescendantLocal(dom.root, "drawing")) {
+            ctx.reporter.error("chartsheet-missing-drawing", `${path}: missing drawing reference`, path);
+        }
+    }
+}

package/dist/browser/modules/excel/utils/ooxml-validator/check-content-types.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Content-types check.
+ *
+ * OPC requires every part in the package to be resolvable to a
+ * content-type via either a `<Default Extension=...>` entry or a
+ * `<Override PartName=...>` entry. Excel rejects packages where this
+ * mapping has gaps — the classic "repairable content" error.
+ *
+ * Beyond the OPC-mandatory rules, we also enforce Microsoft's
+ * well-known part→type expectations for the common OOXML part layouts
+ * (chart, pivot, chartsheet, drawing, etc.). A wrong content-type on
+ * these parts is one of the top causes of "Excel cannot open" errors
+ * because Excel uses the type string to route parsing.
+ */
+import type { ValidationContext } from "./context.js";
+export declare function checkContentTypes(ctx: ValidationContext): void;

package/dist/browser/modules/excel/utils/ooxml-validator/check-content-types.js

@@ -0,0 +1,181 @@
+/**
+ * Content-types check.
+ *
+ * OPC requires every part in the package to be resolvable to a
+ * content-type via either a `<Default Extension=...>` entry or a
+ * `<Override PartName=...>` entry. Excel rejects packages where this
+ * mapping has gaps — the classic "repairable content" error.
+ *
+ * Beyond the OPC-mandatory rules, we also enforce Microsoft's
+ * well-known part→type expectations for the common OOXML part layouts
+ * (chart, pivot, chartsheet, drawing, etc.). A wrong content-type on
+ * these parts is one of the top causes of "Excel cannot open" errors
+ * because Excel uses the type string to route parsing.
+ */
+import { getExtension, isLegalPartName, stripLeadingSlash } from "./path-utils.js";
+// -----------------------------------------------------------------------------
+// Well-known content types
+// -----------------------------------------------------------------------------
+const CT = {
+    workbook: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml",
+    styles: "application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml",
+    sharedStrings: "application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml",
+    theme: "application/vnd.openxmlformats-officedocument.theme+xml",
+    worksheet: "application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml",
+    chartsheet: "application/vnd.openxmlformats-officedocument.spreadsheetml.chartsheet+xml",
+    chart: "application/vnd.openxmlformats-officedocument.drawingml.chart+xml",
+    chartEx: "application/vnd.ms-office.chartex+xml",
+    chartStyle: "application/vnd.ms-office.chartstyle+xml",
+    chartColors: "application/vnd.ms-office.chartcolorstyle+xml",
+    drawing: "application/vnd.openxmlformats-officedocument.drawing+xml",
+    pivotTable: "application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml",
+    pivotCacheDefinition: "application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml",
+    pivotCacheRecords: "application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml",
+    comments: "application/vnd.openxmlformats-officedocument.spreadsheetml.comments+xml",
+    threadedComments: "application/vnd.ms-excel.threadedcomments+xml",
+    externalLink: "application/vnd.openxmlformats-officedocument.spreadsheetml.externalLink+xml",
+    tableDef: "application/vnd.openxmlformats-officedocument.spreadsheetml.table+xml",
+    calcChain: "application/vnd.openxmlformats-officedocument.spreadsheetml.calcChain+xml",
+    app: "application/vnd.openxmlformats-officedocument.extended-properties+xml",
+    core: "application/vnd.openxmlformats-package.core-properties+xml"
+};
+/**
+ * Path→expected content-type rules. The first matching rule wins. We
+ * keep these in a single table so it is easy to audit and extend. Exact
+ * string keys take precedence over regex rules for performance and
+ * readability.
+ */
+const EXACT_PART_CONTENT_TYPE = {
+    "xl/workbook.xml": CT.workbook,
+    "xl/styles.xml": CT.styles,
+    "xl/sharedStrings.xml": CT.sharedStrings,
+    "xl/calcChain.xml": CT.calcChain,
+    "docProps/app.xml": CT.app,
+    "docProps/core.xml": CT.core
+};
+const PATTERN_RULES = [
+    { pattern: /^xl\/theme\/[^/]+\.xml$/, contentType: CT.theme, label: "theme" },
+    { pattern: /^xl\/worksheets\/sheet\d+\.xml$/, contentType: CT.worksheet, label: "worksheet" },
+    { pattern: /^xl\/chartsheets\/sheet\d+\.xml$/, contentType: CT.chartsheet, label: "chartsheet" },
+    { pattern: /^xl\/charts\/chart\d+\.xml$/, contentType: CT.chart, label: "chart" },
+    { pattern: /^xl\/charts\/chartEx\d+\.xml$/, contentType: CT.chartEx, label: "chartEx" },
+    { pattern: /^xl\/charts\/style\d+\.xml$/, contentType: CT.chartStyle, label: "chart style" },
+    { pattern: /^xl\/charts\/colors\d+\.xml$/, contentType: CT.chartColors, label: "chart colors" },
+    { pattern: /^xl\/charts\/styleEx\d+\.xml$/, contentType: CT.chartStyle, label: "chart styleEx" },
+    {
+        pattern: /^xl\/charts\/colorsEx\d+\.xml$/,
+        contentType: CT.chartColors,
+        label: "chart colorsEx"
+    },
+    { pattern: /^xl\/drawings\/drawing\d+\.xml$/, contentType: CT.drawing, label: "drawing" },
+    {
+        pattern: /^xl\/pivotTables\/pivotTable\d+\.xml$/,
+        contentType: CT.pivotTable,
+        label: "pivot table"
+    },
+    {
+        pattern: /^xl\/pivotCache\/pivotCacheDefinition\d+\.xml$/,
+        contentType: CT.pivotCacheDefinition,
+        label: "pivot cache definition"
+    },
+    {
+        pattern: /^xl\/pivotCache\/pivotCacheRecords\d+\.xml$/,
+        contentType: CT.pivotCacheRecords,
+        label: "pivot cache records"
+    },
+    { pattern: /^xl\/tables\/table\d+\.xml$/, contentType: CT.tableDef, label: "table" },
+    {
+        pattern: /^xl\/externalLinks\/externalLink\d+\.xml$/,
+        contentType: CT.externalLink,
+        label: "external link"
+    },
+    { pattern: /^xl\/comments\d+\.xml$/, contentType: CT.comments, label: "comments" },
+    {
+        pattern: /^xl\/threadedComments\/threadedComment\d+\.xml$/,
+        contentType: CT.threadedComments,
+        label: "threaded comments"
+    }
+];
+function expectedContentType(path) {
+    const exact = EXACT_PART_CONTENT_TYPE[path];
+    if (exact) {
+        return { contentType: exact, label: path };
+    }
+    for (const rule of PATTERN_RULES) {
+        if (rule.pattern.test(path)) {
+            return { contentType: rule.contentType, label: rule.label };
+        }
+    }
+    return undefined;
+}
+// -----------------------------------------------------------------------------
+// Checker
+// -----------------------------------------------------------------------------
+export function checkContentTypes(ctx) {
+    if (!ctx.has("[Content_Types].xml")) {
+        // checkStructure will already have reported missing-part.
+        return;
+    }
+    const data = ctx.readContentTypes();
+    if (!data.parseOk) {
+        // context already reported `content-types-malformed`.
+        return;
+    }
+    // Duplicate overrides — we keep the first and report extras.
+    for (const pn of data.duplicateOverrides) {
+        ctx.reporter.error("content-types-duplicate-override", `Duplicate Override PartName: ${pn}`, "[Content_Types].xml");
+    }
+    // The two OPC-mandated defaults.
+    const relsDefault = data.defaults.get("rels");
+    if (relsDefault !== "application/vnd.openxmlformats-package.relationships+xml") {
+        ctx.reporter.error("content-types-missing-default", "Missing/incorrect Default for .rels (expected application/vnd.openxmlformats-package.relationships+xml)", "[Content_Types].xml");
+    }
+    const xmlDefault = data.defaults.get("xml");
+    if (xmlDefault !== "application/xml") {
+        ctx.reporter.error("content-types-missing-default", "Missing/incorrect Default for .xml (expected application/xml)", "[Content_Types].xml");
+    }
+    // Every override must point to an existing part.
+    for (const [partName, _ct] of data.overrides) {
+        if (ctx.reporter.capped) {
+            return;
+        }
+        if (!ctx.has(partName)) {
+            ctx.reporter.error("content-types-missing", `Override PartName points to missing file: /${partName}`, "[Content_Types].xml");
+        }
+    }
+    // Every part in the zip must resolve to a content type and — when we
+    // know the expected type — match it.
+    for (const [path, entry] of ctx.files()) {
+        if (ctx.reporter.capped) {
+            return;
+        }
+        if (entry.type === "directory" || path === "[Content_Types].xml") {
+            continue;
+        }
+        // Reject invalid OPC part names (e.g. containing `\`, ending `/`, or
+        // embedded `..`). Excel refuses such packages outright.
+        if (!isLegalPartName(path)) {
+            ctx.reporter.error("part-name-invalid", `Illegal OPC part name: ${path}`, path);
+        }
+        const overrideType = data.overrides.get(path);
+        const ext = getExtension(path);
+        const defaultType = ext ? data.defaults.get(ext) : undefined;
+        if (!overrideType && !defaultType) {
+            if (!ext) {
+                ctx.reporter.error("content-types-missing-for-part", `No content type for part without extension: ${path}`, "[Content_Types].xml");
+            }
+            else {
+                ctx.reporter.error("content-types-missing-for-part", `No Default/Override content type for part: ${path} (extension .${ext})`, "[Content_Types].xml");
+            }
+            continue;
+        }
+        const expected = expectedContentType(path);
+        if (!expected) {
+            continue;
+        }
+        const actual = overrideType ?? defaultType;
+        if (actual !== expected.contentType) {
+            ctx.reporter.error("content-types-wrong-for-part", `Unexpected content type for /${stripLeadingSlash(path)}: got "${actual}", expected "${expected.contentType}" (${expected.label})`, "[Content_Types].xml");
+        }
+    }
+}

package/dist/browser/modules/excel/utils/ooxml-validator/check-drawing.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Drawing part structure check.
+ *
+ * When a drawing file contains `<xdr:graphicFrame>` nodes but neither a
+ * classic `<c:chart>` nor a chartEx `<cx:chart>` reference inside them,
+ * the graphic frame is dangling — Excel shows a placeholder or drops the
+ * frame on load.
+ *
+ * We also scan anchor coordinates: every anchor must have `from` and
+ * `to` child elements, and EMU values (`x`, `y`, `cx`, `cy`,
+ * `colOff`, `rowOff`) when present must parse as finite non-negative
+ * numbers. Excel rejects anchors with NaN coordinates outright.
+ *
+ * Finally we enforce the ChartEx drawing-wrapper invariants that
+ * trigger "Removed Part: /xl/drawings/drawingN.xml (Drawing shape)"
+ * in production Excel logs:
+ *
+ *   - Any `<cx:chart>` reference MUST live inside an
+ *     `<mc:AlternateContent>` block. The Microsoft ChartEx schema was
+ *     never part of the base OOXML spec, so Excel's strict loader
+ *     requires MC substitution so legacy readers see a fallback shape.
+ *   - The `<mc:Fallback>` MUST be non-empty. An empty Fallback
+ *     collapses the anchor to nothing on clients that take that
+ *     branch, and Excel's strict loader has been observed to reject
+ *     the drawing even on the Choice branch when it sees the
+ *     degenerate Fallback.
+ *   - `<mc:AlternateContent>` lives INSIDE the `<xdr:twoCellAnchor>`
+ *     shape slot (between `<xdr:to>` and `<xdr:clientData>`), NOT
+ *     around the whole anchor. Wrapping the entire anchor duplicates
+ *     `<xdr:from>`/`<xdr:to>` across Choice and Fallback, which Excel
+ *     rejects even though MC substitution permits it in theory.
+ */
+import type { ValidationContext } from "./context.js";
+export declare function checkDrawing(ctx: ValidationContext): void;

package/dist/browser/modules/excel/utils/ooxml-validator/check-drawing.js

@@ -0,0 +1,267 @@
+/**
+ * Drawing part structure check.
+ *
+ * When a drawing file contains `<xdr:graphicFrame>` nodes but neither a
+ * classic `<c:chart>` nor a chartEx `<cx:chart>` reference inside them,
+ * the graphic frame is dangling — Excel shows a placeholder or drops the
+ * frame on load.
+ *
+ * We also scan anchor coordinates: every anchor must have `from` and
+ * `to` child elements, and EMU values (`x`, `y`, `cx`, `cy`,
+ * `colOff`, `rowOff`) when present must parse as finite non-negative
+ * numbers. Excel rejects anchors with NaN coordinates outright.
+ *
+ * Finally we enforce the ChartEx drawing-wrapper invariants that
+ * trigger "Removed Part: /xl/drawings/drawingN.xml (Drawing shape)"
+ * in production Excel logs:
+ *
+ *   - Any `<cx:chart>` reference MUST live inside an
+ *     `<mc:AlternateContent>` block. The Microsoft ChartEx schema was
+ *     never part of the base OOXML spec, so Excel's strict loader
+ *     requires MC substitution so legacy readers see a fallback shape.
+ *   - The `<mc:Fallback>` MUST be non-empty. An empty Fallback
+ *     collapses the anchor to nothing on clients that take that
+ *     branch, and Excel's strict loader has been observed to reject
+ *     the drawing even on the Choice branch when it sees the
+ *     degenerate Fallback.
+ *   - `<mc:AlternateContent>` lives INSIDE the `<xdr:twoCellAnchor>`
+ *     shape slot (between `<xdr:to>` and `<xdr:clientData>`), NOT
+ *     around the whole anchor. Wrapping the entire anchor duplicates
+ *     `<xdr:from>`/`<xdr:to>` across Choice and Fallback, which Excel
+ *     rejects even though MC substitution permits it in theory.
+ */
+import { attrByLocalName, collectDescendantsLocal, findChildLocal, findChildrenLocal, hasDescendantLocal, matchesLocal } from "./xml-utils.js";
+const DRAWING_PATH_RE = /^xl\/drawings\/drawing\d+\.xml$/;
+export function checkDrawing(ctx) {
+    for (const [path, entry] of ctx.files()) {
+        if (ctx.reporter.capped) {
+            return;
+        }
+        if (entry.type === "directory" || !DRAWING_PATH_RE.test(path)) {
+            continue;
+        }
+        checkSingleDrawing(ctx, path);
+    }
+}
+function checkSingleDrawing(ctx, path) {
+    const dom = ctx.readDom(path);
+    if (!dom) {
+        return;
+    }
+    const root = dom.root;
+    // Graphic frame without embedded chart reference.
+    for (const gf of collectDescendantsLocal(root, "graphicFrame")) {
+        const hasChartFrame = hasDescendantLocal(gf, "chart");
+        if (!hasChartFrame) {
+            ctx.reporter.error("drawing-graphicFrame-missing-chart", `${path}: xdr:graphicFrame has no c:chart or cx:chart reference`, path);
+        }
+    }
+    // AlternateContent wrap at drawing-root level is the "outer wrap"
+    // writer bug — but ONLY for chartEx (`Requires="cx1"` / `"cx"`).
+    // Form-control legacy wrappers (`Requires="a14"`) legitimately
+    // wrap the whole anchor and Excel handles them fine; those are
+    // not the chartEx bug this rule targets. When the whole anchor
+    // is wrapped for chartEx, `<xdr:from>` / `<xdr:to>` get
+    // duplicated inside Choice and Fallback and Excel rejects the
+    // drawing.
+    for (const child of root.children) {
+        if (child.type === "element" && matchesLocal(child.name, "AlternateContent")) {
+            // Only flag if the AlternateContent contains anchor elements —
+            // otherwise it might be a root-level extension that's fine.
+            if (hasDescendantLocal(child, "twoCellAnchor") ||
+                hasDescendantLocal(child, "oneCellAnchor") ||
+                hasDescendantLocal(child, "absoluteAnchor")) {
+                // Look for a Choice with Requires="cx1" / "cx" — those mean
+                // chartEx, which is the bug this rule flags. If the Choice
+                // uses any other prefix ("a14" for form controls, etc.) the
+                // outer wrap is the Microsoft-sanctioned shape and we skip.
+                const choiceRequires = findChoiceRequires(child);
+                if (choiceRequires === "cx" || choiceRequires === "cx1") {
+                    ctx.reporter.error("drawing-chartEx-alternateContent-outer-wrap", `${path}: <mc:AlternateContent> wraps the entire anchor. ` +
+                        `Move it INSIDE <xdr:twoCellAnchor>, after <xdr:to> and before ` +
+                        `<xdr:clientData>, so <xdr:from>/<xdr:to> are not duplicated.`, path);
+                }
+            }
+        }
+    }
+    // Anchors.
+    for (const anchorName of ["twoCellAnchor", "oneCellAnchor", "absoluteAnchor"]) {
+        for (const anchor of findChildrenLocal(root, anchorName)) {
+            checkAnchor(ctx, path, anchor);
+            checkChartExWrapping(ctx, path, anchor);
+        }
+    }
+}
+// -----------------------------------------------------------------------------
+// ChartEx AlternateContent wrapping
+// -----------------------------------------------------------------------------
+/**
+ * For every anchor: if it hosts a `<cx:chart>` reference, that
+ * reference MUST be wrapped in `<mc:AlternateContent>` (inside the
+ * anchor) with a non-empty `<mc:Fallback>`. This mirrors what Excel
+ * itself writes for every ChartEx drawing.
+ */
+function checkChartExWrapping(ctx, path, anchor) {
+    // Collect every `<cx:chart>` descendant of the anchor.
+    const chartExRefs = collectDescendantsLocal(anchor, "chart").filter(el => {
+        // Distinguish `<cx:chart>` (ChartEx) from `<c:chart>` (classic) by
+        // namespace prefix. Both have local name "chart".
+        const idx = el.name.indexOf(":");
+        return idx !== -1 && el.name.slice(0, idx) === "cx";
+    });
+    if (chartExRefs.length === 0) {
+        return;
+    }
+    // Is there an `<mc:AlternateContent>` direct child?
+    const alternateContent = anchor.children.find((c) => c.type === "element" && matchesLocal(c.name, "AlternateContent"));
+    if (!alternateContent) {
+        ctx.reporter.error("drawing-chartEx-missing-alternateContent-wrap", `${path}: anchor contains <cx:chart> but has no <mc:AlternateContent> wrapper. ` +
+            `ChartEx drawings must place the <xdr:graphicFrame> inside ` +
+            `<mc:AlternateContent><mc:Choice>…</mc:Choice><mc:Fallback>…</mc:Fallback></mc:AlternateContent>.`, path);
+        return;
+    }
+    // Fallback must be non-empty.
+    const fallback = findChildLocal(alternateContent, "Fallback");
+    if (!fallback) {
+        ctx.reporter.error("drawing-chartEx-alternateContent-empty-fallback", `${path}: <mc:AlternateContent> has no <mc:Fallback>. ` +
+            `Excel's strict loader rejects drawings whose Fallback is missing.`, path);
+        return;
+    }
+    const fallbackHasChildren = fallback.children.some(c => c.type === "element");
+    if (!fallbackHasChildren) {
+        ctx.reporter.error("drawing-chartEx-alternateContent-empty-fallback", `${path}: <mc:Fallback> is empty. ` +
+            `Provide a non-empty legacy shape (e.g. <xdr:sp>) so non-ChartEx ` +
+            `readers see a placeholder instead of collapsing the anchor.`, path);
+        return;
+    }
+    // Office creation-id extension. Warning-level: not strictly required
+    // by the base OOXML schema, but strict Excel builds have been seen
+    // dropping chartEx drawings that lack the extension.
+    // Structure: xdr:graphicFrame/xdr:nvGraphicFramePr/xdr:cNvPr/a:extLst/a:ext/a16:creationId
+    // We locate the graphicFrame inside Choice and walk down.
+    const choice = findChildLocal(alternateContent, "Choice");
+    if (!choice) {
+        return;
+    }
+    const graphicFrame = findChildLocal(choice, "graphicFrame");
+    if (!graphicFrame) {
+        return;
+    }
+    const nvGraphicFramePr = findChildLocal(graphicFrame, "nvGraphicFramePr");
+    if (!nvGraphicFramePr) {
+        return;
+    }
+    const cNvPr = findChildLocal(nvGraphicFramePr, "cNvPr");
+    if (!cNvPr) {
+        return;
+    }
+    const extLst = findChildLocal(cNvPr, "extLst");
+    const hasCreationId = !!extLst && collectDescendantsLocal(extLst, "creationId").length > 0;
+    if (!hasCreationId) {
+        ctx.reporter.warning("drawing-chartEx-missing-creationId", `${path}: chartEx drawing <xdr:cNvPr> missing Office creation-id extension ` +
+            `(<a:extLst>/<a:ext>/<a16:creationId>). Strict Excel builds may drop the drawing ` +
+            `on load without it.`, path);
+    }
+}
+function checkAnchor(ctx, path, anchor) {
+    const name = anchor.name.includes(":")
+        ? anchor.name.slice(anchor.name.lastIndexOf(":") + 1)
+        : anchor.name;
+    // twoCellAnchor requires from+to; oneCellAnchor requires from+ext;
+    // absoluteAnchor requires pos+ext.
+    if (name === "twoCellAnchor") {
+        if (!findChildLocal(anchor, "from") || !findChildLocal(anchor, "to")) {
+            ctx.reporter.error("drawing-anchor-missing", `${path}: ${name} missing from/to`, path);
+            return;
+        }
+        checkCellAnchor(ctx, path, findChildLocal(anchor, "from"));
+        checkCellAnchor(ctx, path, findChildLocal(anchor, "to"));
+    }
+    else if (name === "oneCellAnchor") {
+        if (!findChildLocal(anchor, "from") || !findChildLocal(anchor, "ext")) {
+            ctx.reporter.error("drawing-anchor-missing", `${path}: ${name} missing from/ext`, path);
+            return;
+        }
+        checkCellAnchor(ctx, path, findChildLocal(anchor, "from"));
+        checkExtOrPos(ctx, path, findChildLocal(anchor, "ext"), "ext");
+    }
+    else if (name === "absoluteAnchor") {
+        if (!findChildLocal(anchor, "pos") || !findChildLocal(anchor, "ext")) {
+            ctx.reporter.error("drawing-anchor-missing", `${path}: ${name} missing pos/ext`, path);
+            return;
+        }
+        checkExtOrPos(ctx, path, findChildLocal(anchor, "pos"), "pos");
+        checkExtOrPos(ctx, path, findChildLocal(anchor, "ext"), "ext");
+    }
+}
+function checkCellAnchor(ctx, path, cellAnchor) {
+    if (!cellAnchor) {
+        return;
+    }
+    // Children are col / colOff / row / rowOff (as xdr:col etc.). Each is a
+    // plain-text integer. A non-integer is typically the result of a writer
+    // that stringified `undefined` / `null` — Excel silently repairs the
+    // anchor (the "Removed Part: Drawing shape" message) but the file
+    // still opens. So we downgrade this to a warning.
+    for (const tag of ["col", "colOff", "row", "rowOff"]) {
+        const el = findChildLocal(cellAnchor, tag);
+        if (!el) {
+            continue; // some producers elide zero offsets — tolerate.
+        }
+        const text = collectText(el).trim();
+        const n = parseInt(text, 10);
+        if (!Number.isFinite(n)) {
+            ctx.reporter.warning("drawing-anchor-invalid-coords", `${path}: anchor ${tag}=${JSON.stringify(text)} is not an integer`, path);
+        }
+        // Negatives are permitted for colOff/rowOff in some corner cases
+        // (e.g. partial-cell anchors slight-past zero). Only warn on NaN.
+    }
+}
+function checkExtOrPos(ctx, path, el, kind) {
+    if (!el) {
+        return;
+    }
+    const attrs = kind === "ext" ? ["cx", "cy"] : ["x", "y"];
+    for (const a of attrs) {
+        const v = attrByLocalName(el, a);
+        if (v === undefined) {
+            continue;
+        }
+        const n = parseInt(v, 10);
+        if (!Number.isFinite(n)) {
+            ctx.reporter.warning("drawing-anchor-invalid-coords", `${path}: ${kind} ${a}=${JSON.stringify(v)} is not a valid EMU integer`, path);
+        }
+    }
+}
+function collectText(el) {
+    let out = "";
+    for (const child of el.children) {
+        if (child.type === "text" || child.type === "cdata") {
+            out += child.value;
+        }
+        else if (child.type === "element") {
+            out += collectText(child);
+        }
+    }
+    return out;
+}
+/**
+ * Extract the `Requires` value from the first `<mc:Choice>` inside an
+ * `<mc:AlternateContent>` block. Used by the outer-wrap rule to skip
+ * form-control (`Requires="a14"`) anchors — only chartEx
+ * (`Requires="cx1"` / `"cx"`) should trigger the diagnostic.
+ *
+ * Returns `undefined` when no Choice with a `Requires` attribute is
+ * found.
+ */
+function findChoiceRequires(ac) {
+    for (const child of ac.children) {
+        if (child.type === "element" && matchesLocal(child.name, "Choice")) {
+            const req = attrByLocalName(child, "Requires");
+            if (req !== undefined) {
+                return req;
+            }
+        }
+    }
+    return undefined;
+}

package/dist/browser/modules/excel/utils/ooxml-validator/check-pivot.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Pivot table & pivot cache check.
+ *
+ * Each `xl/pivotTables/pivotTableN.xml` declares a `cacheId` that must be
+ * registered in the workbook's `<pivotCaches>` list; the cache in turn
+ * must back a live pivotCacheDefinition/pivotCacheRecords pair.
+ *
+ * We do a lightweight cross-reference check: (a) every pivot table
+ * advertises a cacheId that resolves to a `<pivotCache>` entry in
+ * workbook.xml, and (b) each referenced pivotCacheDefinition's rels point
+ * at a pivotCacheRecords file that actually exists.
+ */
+import type { ValidationContext } from "./context.js";
+export declare function checkPivot(ctx: ValidationContext): void;

package/dist/browser/modules/excel/utils/ooxml-validator/check-pivot.js

@@ -0,0 +1,104 @@
+/**
+ * Pivot table & pivot cache check.
+ *
+ * Each `xl/pivotTables/pivotTableN.xml` declares a `cacheId` that must be
+ * registered in the workbook's `<pivotCaches>` list; the cache in turn
+ * must back a live pivotCacheDefinition/pivotCacheRecords pair.
+ *
+ * We do a lightweight cross-reference check: (a) every pivot table
+ * advertises a cacheId that resolves to a `<pivotCache>` entry in
+ * workbook.xml, and (b) each referenced pivotCacheDefinition's rels point
+ * at a pivotCacheRecords file that actually exists.
+ */
+import { attrByLocalName, findChildLocal, findChildrenLocal } from "./xml-utils.js";
+const PIVOT_TABLE_RE = /^xl\/pivotTables\/pivotTable\d+\.xml$/;
+const WORKBOOK_PATH = "xl/workbook.xml";
+export function checkPivot(ctx) {
+    const declared = collectWorkbookPivotCaches(ctx);
+    for (const [path, entry] of ctx.files()) {
+        if (ctx.reporter.capped) {
+            return;
+        }
+        if (entry.type === "directory" || !PIVOT_TABLE_RE.test(path)) {
+            continue;
+        }
+        const dom = ctx.readDom(path);
+        if (!dom) {
+            continue;
+        }
+        const cacheId = attrByLocalName(dom.root, "cacheId");
+        if (cacheId === undefined) {
+            ctx.reporter.error("pivot-missing-cacheId", `${path}: missing cacheId attribute`, path);
+            continue;
+        }
+        if (!declared.has(cacheId)) {
+            ctx.reporter.error("pivot-cacheId-not-in-workbook", `${path}: cacheId="${cacheId}" is not declared in workbook <pivotCaches>`, path);
+        }
+    }
+    // Each pivotCacheDefinition.rels should point at a pivotCacheRecords file
+    // that exists inside the package.
+    for (const [path, entry] of ctx.files()) {
+        if (ctx.reporter.capped) {
+            return;
+        }
+        if (entry.type === "directory" ||
+            !/^xl\/pivotCache\/pivotCacheDefinition\d+\.xml$/.test(path)) {
+            continue;
+        }
+        const defRels = ctx.readRels(defaultRelsPath(path));
+        const recordsRel = defRels.rels.find(r => r.type.includes("pivotCacheRecords"));
+        if (recordsRel) {
+            const resolved = recordsRel.target.startsWith("/")
+                ? recordsRel.target.slice(1)
+                : joinPath(parentDir(path), recordsRel.target);
+            if (!ctx.has(resolved)) {
+                ctx.reporter.error("pivot-cacheRecords-missing", `${path}: references missing pivotCacheRecords file ${resolved}`, path);
+            }
+        }
+    }
+}
+function collectWorkbookPivotCaches(ctx) {
+    const ids = new Set();
+    if (!ctx.has(WORKBOOK_PATH)) {
+        return ids;
+    }
+    const dom = ctx.readDom(WORKBOOK_PATH);
+    if (!dom) {
+        return ids;
+    }
+    const pivotCaches = findChildLocal(dom.root, "pivotCaches");
+    if (!pivotCaches) {
+        return ids;
+    }
+    for (const pc of findChildrenLocal(pivotCaches, "pivotCache")) {
+        const id = attrByLocalName(pc, "cacheId");
+        if (id !== undefined) {
+            ids.add(id);
+        }
+    }
+    return ids;
+}
+function defaultRelsPath(partPath) {
+    const dir = parentDir(partPath);
+    const base = partPath.slice(dir.length ? dir.length + 1 : 0);
+    return dir ? `${dir}/_rels/${base}.rels` : `_rels/${base}.rels`;
+}
+function parentDir(p) {
+    const idx = p.lastIndexOf("/");
+    return idx === -1 ? "" : p.slice(0, idx);
+}
+function joinPath(dir, target) {
+    // Resolve `./foo/bar` or `../baz` relative to `dir`.
+    const parts = dir ? dir.split("/") : [];
+    for (const seg of target.split("/")) {
+        if (seg === "" || seg === ".") {
+            continue;
+        }
+        if (seg === "..") {
+            parts.pop();
+            continue;
+        }
+        parts.push(seg);
+    }
+    return parts.join("/");
+}