@cj-tech-master/excelts 9.5.7 → 9.5.8-canary.20260528224225.faabb36

package/dist/browser/modules/excel/utils/col-cache.js

@@ -51,7 +51,15 @@ const colCache = {
         let l3;
         let n = 1;
         if (level >= 4) {
-            throw new ColumnOutOfBoundsError(level, "Excel supports columns from 1 to 16384");
+            // Defensive invariant: Excel's column space (XFD = 16,384) caps at
+            // three letters, so neither `l2n` nor `n2l` should ever ask for a
+            // higher level. Both callers validate before reaching here; if
+            // this branch fires it indicates a programming error in a future
+            // caller, not a user input problem — surface that clearly rather
+            // than reusing `ColumnOutOfBoundsError` (which would lie about
+            // the offending column, since `level` is a letter-count, not a
+            // column number).
+            throw new Error(`colCache._fill: invariant violated — level ${level} exceeds the 3-letter cap; callers must validate before invoking _fill`);
         }
         if (this._l2nFill < 1 && level >= 1) {
             while (n <= 26) {
@@ -92,6 +100,16 @@ const colCache = {
     },
     l2n(l) {
         if (!this._l2n[l]) {
+            // Excel's column space stops at XFD (16,384) — three letters is
+            // the maximum width any valid column letter can have. Reject
+            // longer inputs explicitly here, BEFORE handing the length to
+            // `_fill`, so the thrown error carries the actual offending
+            // letter (`AAAA`) rather than the level integer (`4`) — matching
+            // what the equivalent `n2l(n > 16384)` and `decodeAddress` paths
+            // already report.
+            if (l.length > 3) {
+                throw new ColumnOutOfBoundsError(l, "Excel supports columns from 1 to 16384");
+            }
             this._fill(l.length);
         }
         if (!this._l2n[l]) {

package/dist/browser/modules/excel/workbook.browser.js

@@ -2289,6 +2289,16 @@ class Workbook {
         this._tableNames.clear();
         value.worksheets.forEach(worksheetModel => {
             const { id, name, state } = worksheetModel;
+            // API invariant: `_worksheets` is keyed by a positive integer
+            // sheet id. A worksheet model with a missing or non-integer id
+            // would be stored under a string pseudo key like `"undefined"`
+            // or `"NaN"`, making it unreachable via `getWorksheet(name)`
+            // (issue #166). The xlsx reconciler enforces the same invariant
+            // before reaching this point; programmatic callers assigning
+            // `model` directly with a malformed payload land here instead.
+            if (!Number.isInteger(id) || id <= 0) {
+                return;
+            }
             const orderNo = value.sheets && value.sheets.findIndex(ws => ws.id === id);
             const worksheet = (this._worksheets[id] = new Worksheet({
                 id,

package/dist/browser/modules/excel/xlsx/xform/book/sheet-xform.d.ts

@@ -1,14 +1,24 @@
 import type { WorksheetState } from "../../../types.js";
 import { BaseXform } from "../base-xform.js";
 interface SheetModel {
-    id: number;
+    id: number | undefined;
     name: string;
     state: WorksheetState;
-    rId: string;
+    rId: string | undefined;
 }
 declare class WorksheetXform extends BaseXform {
+    relationshipsPrefixes: readonly string[];
     render(xmlStream: any, model: SheetModel): void;
     parseOpen(node: any): boolean;
+    /**
+     * Locate the relationship id on a `<sheet>` element. Tries every
+     * prefix the workbook root bound to the relationships namespace,
+     * then any prefix the `<sheet>` element itself rebinds locally.
+     * Returns `undefined` if no relationship id is present — callers
+     * (the workbook reconciler) will treat such a `<sheet>` as a
+     * half-broken declaration that can't be bound to a worksheet part.
+     */
+    private _extractRelId;
     parseText(): void;
     parseClose(): boolean;
 }

package/dist/browser/modules/excel/xlsx/xform/book/sheet-xform.js

@@ -1,10 +1,34 @@
 import { BaseXform } from "../base-xform.js";
 const VALID_STATES = new Set(["visible", "hidden", "veryHidden"]);
+const RELATIONSHIPS_NS = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
 function parseWorksheetState(raw) {
     const state = raw || "visible";
     return VALID_STATES.has(state) ? state : "visible";
 }
+function parseSheetId(raw) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    const id = parseInt(raw, 10);
+    // OOXML constrains `sheetId` to a positive integer. Anything that
+    // doesn't parse to one — empty string, alphabetic, zero, negative,
+    // overflowing — must not propagate as `NaN`/`0`/`-1` because those
+    // would later seed pseudo keys like `_worksheets["NaN"]` (the same
+    // family of bug as issue #166's `_worksheets["undefined"]`).
+    return Number.isInteger(id) && id > 0 ? id : undefined;
+}
 class WorksheetXform extends BaseXform {
+    constructor() {
+        super(...arguments);
+        // All prefixes the workbook root binds to the OOXML relationships
+        // namespace. Conventionally a workbook declares `xmlns:r=…`, so the
+        // sheet uses `r:id="rId1"`. But the prefix is only a label and a
+        // workbook may legally bind any prefix (or several) to that
+        // namespace. `WorkbookXform` populates this list from the
+        // `<workbook>` root; `r` is the safe fallback when the workbook
+        // declares no relationships binding at all.
+        this.relationshipsPrefixes = ["r"];
+    }
     render(xmlStream, model) {
         xmlStream.leafNode("sheet", {
             name: model.name,
@@ -18,14 +42,44 @@ class WorksheetXform extends BaseXform {
         if (node.name === "sheet") {
             this.model = {
                 name: node.attributes.name,
-                id: parseInt(node.attributes.sheetId, 10),
+                id: parseSheetId(node.attributes.sheetId),
                 state: parseWorksheetState(node.attributes.state),
-                rId: node.attributes["r:id"]
+                rId: this._extractRelId(node)
             };
             return true;
         }
         return false;
     }
+    /**
+     * Locate the relationship id on a `<sheet>` element. Tries every
+     * prefix the workbook root bound to the relationships namespace,
+     * then any prefix the `<sheet>` element itself rebinds locally.
+     * Returns `undefined` if no relationship id is present — callers
+     * (the workbook reconciler) will treat such a `<sheet>` as a
+     * half-broken declaration that can't be bound to a worksheet part.
+     */
+    _extractRelId(node) {
+        const attrs = node.attributes ?? {};
+        for (const prefix of this.relationshipsPrefixes) {
+            const value = attrs[`${prefix}:id`];
+            if (value !== undefined) {
+                return value;
+            }
+        }
+        // Local-scope fallback: a `<sheet>` element occasionally redeclares
+        // the relationships namespace under a fresh prefix. Scan its own
+        // attributes for `xmlns:X="…/relationships"` and look up `X:id`.
+        for (const attrName of Object.keys(attrs)) {
+            if (attrName.startsWith("xmlns:") && attrs[attrName] === RELATIONSHIPS_NS) {
+                const localPrefix = attrName.slice("xmlns:".length);
+                const candidate = attrs[`${localPrefix}:id`];
+                if (candidate !== undefined) {
+                    return candidate;
+                }
+            }
+        }
+        return undefined;
+    }
     parseText() { }
     parseClose() {
         return false;

package/dist/browser/modules/excel/xlsx/xform/book/workbook-xform.d.ts

@@ -5,10 +5,17 @@ declare class WorkbookXform extends BaseXform {
     map: {
         [key: string]: any;
     };
+    /**
+     * The `<sheet>` xform shared with the `sheets` ListXform. Held as a
+     * field so `parseOpen` can pass workbook-level state (the prefixes
+     * bound to the OOXML relationships namespace) into it.
+     */
+    private readonly _sheetXform;
     constructor();
     prepare(model: any): void;
     render(xmlStream: any, model: any): void;
     parseOpen(node: any): boolean;
+    private static _findRelationshipsPrefixes;
     parseText(text: string): void;
     parseClose(name: string): boolean;
     reconcile(model: any): void;