@particle-academy/holy-sheet 2.10.1 → 2.10.2

package/dist/index.js

@@ -240,12 +240,12 @@ function parseRows(csv, delimiter, quote2) {
 // src/workbook/cell-address.ts
 var CellAddress = {
   /** 0-based column index → Excel-style letters. */
-  letter(index) {
-    if (index < 0) {
-      throw new Error(`[holy-sheet] column index must be \u2265 0, got ${index}`);
+  letter(index2) {
+    if (index2 < 0) {
+      throw new Error(`[holy-sheet] column index must be \u2265 0, got ${index2}`);
     }
     let letters = "";
-    let n = index;
+    let n = index2;
     do {
       letters = String.fromCharCode(65 + n % 26) + letters;
       n = Math.floor(n / 26) - 1;
@@ -298,8 +298,8 @@ var ColumnWidths = {
       return Number.isInteger(key) && key >= 0 && key <= ColumnWidths.MAX_INDEX ? key : null;
     }
     if (typeof key === "string" && /^[0-9]{1,5}$/.test(key)) {
-      const index = parseInt(key, 10);
-      return index <= ColumnWidths.MAX_INDEX ? index : null;
+      const index2 = parseInt(key, 10);
+      return index2 <= ColumnWidths.MAX_INDEX ? index2 : null;
     }
     return null;
   },
@@ -558,6 +558,14 @@ var DateConverter = {
 };
 
 // src/exceptions.ts
+var ArchiveRefused = class _ArchiveRefused extends Error {
+  constructor(reason) {
+    super(`Source archive refused: ${reason}`);
+    this.reason = reason;
+    this.name = "ArchiveRefused";
+    Object.setPrototypeOf(this, _ArchiveRefused.prototype);
+  }
+};
 var SchemaException = class _SchemaException extends Error {
   constructor(errors, message) {
     super(message ?? summarize(errors));
@@ -798,23 +806,23 @@ var Normalizer = class {
     for (const [colIdx, columnDef] of (sheet.columns ?? []).entries()) {
       if (columnDef === null || typeof columnDef !== "object") continue;
       if (columnDef.width === void 0) continue;
-      const index = ColumnWidths.index(colIdx);
+      const index2 = ColumnWidths.index(colIdx);
       const width = ColumnWidths.width(columnDef.width);
-      if (index === null || width === null) continue;
-      out.set(index, width);
+      if (index2 === null || width === null) continue;
+      out.set(index2, width);
     }
-    for (const [index, width] of this.normalizeColumnWidths(sheet.columnWidths ?? {})) {
-      out.set(index, width);
+    for (const [index2, width] of this.normalizeColumnWidths(sheet.columnWidths ?? {})) {
+      out.set(index2, width);
     }
     return new Map([...out.entries()].sort((a, b) => a[0] - b[0]));
   }
   normalizeColumnWidths(widths) {
     const out = /* @__PURE__ */ new Map();
     for (const [key, px] of Object.entries(widths)) {
-      const index = ColumnWidths.index(key);
+      const index2 = ColumnWidths.index(key);
       const width = ColumnWidths.width(px);
-      if (index === null || width === null) continue;
-      out.set(index, width);
+      if (index2 === null || width === null) continue;
+      out.set(index2, width);
     }
     return out;
   }
@@ -926,14 +934,14 @@ function normalizePoints(points2, count) {
   const byIndex = /* @__PURE__ */ new Map();
   for (const p of Object.values(points2)) {
     const rec = isPlainObject(p) || Array.isArray(p) ? p : null;
-    const index = rec ? rec.index : void 0;
+    const index2 = rec ? rec.index : void 0;
     const color2 = rec ? rec.color : void 0;
     const m = typeof color2 === "string" ? /^#([0-9A-Fa-f]{6})$/.exec(color2) : null;
-    if (typeof index === "number" && Number.isInteger(index) && index >= 0 && index < count && m) {
-      byIndex.set(index, m[1].toUpperCase());
+    if (typeof index2 === "number" && Number.isInteger(index2) && index2 >= 0 && index2 < count && m) {
+      byIndex.set(index2, m[1].toUpperCase());
     }
   }
-  return [...byIndex.entries()].sort((a, b) => a[0] - b[0]).map(([index, color2]) => ({ index, color: color2 }));
+  return [...byIndex.entries()].sort((a, b) => a[0] - b[0]).map(([index2, color2]) => ({ index: index2, color: color2 }));
 }
 var CHART_TYPES = ["column", "bar", "line", "pie"];
 function normalizeCharts(charts, sheetName2, cells) {
@@ -1067,13 +1075,13 @@ var FormulaLinter = class {
     return issues;
   }
   buildIndex(wb) {
-    const index = /* @__PURE__ */ new Map();
+    const index2 = /* @__PURE__ */ new Map();
     for (const sheet of wb.sheets) {
       for (const [address, cell] of sheet.cells) {
-        index.set(sheet.name + "!" + address, cell);
+        index2.set(sheet.name + "!" + address, cell);
       }
     }
-    return index;
+    return index2;
   }
   isError(v) {
     return typeof v === "string" && v.length > 0 && v[0] === "#";
@@ -1587,21 +1595,21 @@ var Repairer = class {
       const widths = {};
       let changed = false;
       for (const [key, px] of Object.entries(sheet.columnWidths)) {
-        let index = ColumnWidths.index(key);
-        if (index === null) {
+        let index2 = ColumnWidths.index(key);
+        if (index2 === null) {
           const letters = ColumnWidths.fromLetters(key);
           if (letters !== null) {
-            index = letters;
-            this.repairs.push(`converted '${path}.columnWidths.${key}' to column index ${index}`);
+            index2 = letters;
+            this.repairs.push(`converted '${path}.columnWidths.${key}' to column index ${index2}`);
             changed = true;
           }
         }
-        if (index === null || ColumnWidths.width(px) === null) {
+        if (index2 === null || ColumnWidths.width(px) === null) {
           this.repairs.push(`dropped '${path}.columnWidths.${key}' (not a column index and a width)`);
           changed = true;
           continue;
         }
-        widths[String(index)] = px;
+        widths[String(index2)] = px;
       }
       if (changed) {
         sheet.columnWidths = widths;
@@ -2025,14 +2033,14 @@ function validatePoints(points2, at2, values2) {
   const errors = [];
   points2.forEach((p, k) => {
     const rec = isPlainObject(p) || Array.isArray(p) ? p : null;
-    const index = rec ? rec.index ?? null : null;
+    const index2 = rec ? rec.index ?? null : null;
     const color2 = rec ? rec.color ?? null : null;
-    if (typeof index !== "number" || !Number.isInteger(index) || index < 0 || index >= count) {
+    if (typeof index2 !== "number" || !Number.isInteger(index2) || index2 < 0 || index2 >= count) {
       errors.push(error(
         `${at2}[${k}].index`,
         "an index within values (0 to " + Math.max(0, count - 1) + ")",
-        typeOf(index),
-        index,
+        typeOf(index2),
+        index2,
         'The 0-based position of the point in its values range: "B5:B7" has points 0, 1 and 2.'
       ));
     }
@@ -2427,8 +2435,17 @@ function buildTree(t, lengths, off, num) {
   let i;
   let sum = 0;
   for (i = 0; i < 16; i++) t.table[i] = 0;
-  for (i = 0; i < num; i++) t.table[lengths[off + i]]++;
+  for (i = 0; i < num; i++) {
+    const length = lengths[off + i];
+    if (length === void 0 || length > 15) throw new Error("holy-sheet: invalid DEFLATE tree");
+    t.table[length]++;
+  }
   t.table[0] = 0;
+  let slots = 1;
+  for (i = 1; i <= 15; i++) {
+    slots = slots * 2 - t.table[i];
+    if (slots < 0) throw new Error("holy-sheet: oversubscribed DEFLATE tree");
+  }
   for (i = 0; i < 16; i++) {
     OFFS[i] = sum;
     sum += t.table[i];
@@ -2448,6 +2465,7 @@ var Reader = class {
 };
 function getBit(d) {
   if (d.bitcount-- === 0) {
+    if (d.index >= d.source.length) throw new Error("holy-sheet: truncated DEFLATE input");
     d.tag = d.source[d.index++];
     d.bitcount = 7;
   }
@@ -2468,6 +2486,7 @@ function decodeSymbol(d, t) {
   do {
     cur = 2 * cur + getBit(d);
     len++;
+    if (len > 15) throw new Error("holy-sheet: invalid DEFLATE code");
     sum += t.table[len];
     cur -= t.table[len];
   } while (cur >= 0);
@@ -2478,6 +2497,7 @@ function decodeTrees(d, lt, dt) {
   const hlit = readBits(d, 5, 257);
   const hdist = readBits(d, 5, 1);
   const hclen = readBits(d, 4, 4);
+  if (hlit > 286) throw new Error("holy-sheet: invalid DEFLATE literal count");
   let i;
   for (i = 0; i < 19; i++) lengths[i] = 0;
   for (i = 0; i < hclen; i++) {
@@ -2490,32 +2510,44 @@ function decodeTrees(d, lt, dt) {
     const sym = decodeSymbol(d, codeTree);
     switch (sym) {
       case 16: {
+        if (num === 0) throw new Error("holy-sheet: invalid DEFLATE repeat");
         const prev = lengths[num - 1];
-        for (let length = readBits(d, 2, 3); length; length--) lengths[num++] = prev;
+        const repeat = readBits(d, 2, 3);
+        if (num + repeat > hlit + hdist) throw new Error("holy-sheet: invalid DEFLATE repeat");
+        for (let length = repeat; length; length--) lengths[num++] = prev;
         break;
       }
-      case 17:
-        for (let length = readBits(d, 3, 3); length; length--) lengths[num++] = 0;
+      case 17: {
+        const repeat = readBits(d, 3, 3);
+        if (num + repeat > hlit + hdist) throw new Error("holy-sheet: invalid DEFLATE repeat");
+        for (let length = repeat; length; length--) lengths[num++] = 0;
         break;
-      case 18:
-        for (let length = readBits(d, 7, 11); length; length--) lengths[num++] = 0;
+      }
+      case 18: {
+        const repeat = readBits(d, 7, 11);
+        if (num + repeat > hlit + hdist) throw new Error("holy-sheet: invalid DEFLATE repeat");
+        for (let length = repeat; length; length--) lengths[num++] = 0;
         break;
+      }
       default:
         lengths[num++] = sym;
         break;
     }
   }
+  if (lengths[256] === 0) throw new Error("holy-sheet: missing DEFLATE end code");
   buildTree(lt, lengths, 0, hlit);
   buildTree(dt, lengths, hlit, hdist);
 }
 var Out = class {
-  constructor() {
-    this.buf = new Uint8Array(1024);
+  constructor(limit) {
+    this.limit = limit;
     this.len = 0;
+    this.buf = new Uint8Array(Math.min(1024, limit));
   }
   push(b) {
+    if (this.len >= this.limit) throw new Error("holy-sheet: DEFLATE output limit exceeded");
     if (this.len >= this.buf.length) {
-      const next = new Uint8Array(this.buf.length * 2);
+      const next = new Uint8Array(Math.min(this.limit, Math.max(1, this.buf.length * 2)));
       next.set(this.buf);
       this.buf = next;
     }
@@ -2530,9 +2562,12 @@ function inflateBlockData(d, out, lt, dt) {
       out.push(sym);
     } else {
       const lengthSym = sym - 257;
+      if (lengthSym < 0 || lengthSym >= LENGTH_BITS.length) throw new Error("holy-sheet: invalid DEFLATE length");
       const length = readBits(d, LENGTH_BITS[lengthSym], LENGTH_BASE[lengthSym]);
       const distSym = decodeSymbol(d, dt);
+      if (distSym < 0 || distSym >= DIST_BITS.length) throw new Error("holy-sheet: invalid DEFLATE distance");
       const dist = readBits(d, DIST_BITS[distSym], DIST_BASE[distSym]);
+      if (dist > out.len) throw new Error("holy-sheet: DEFLATE distance before output");
       const offs = out.len - dist;
       for (let i = 0; i < length; i++) out.push(out.buf[offs + i]);
     }
@@ -2540,13 +2575,20 @@ function inflateBlockData(d, out, lt, dt) {
 }
 function inflateUncompressedBlock(d, out) {
   d.bitcount = 0;
+  if (d.index + 4 > d.source.length) throw new Error("holy-sheet: truncated DEFLATE input");
   let length = d.source[d.index + 1] * 256 + d.source[d.index];
+  const complement = d.source[d.index + 3] * 256 + d.source[d.index + 2];
+  if ((length ^ complement) !== 65535) throw new Error("holy-sheet: invalid DEFLATE stored length");
   d.index += 4;
+  if (d.index + length > d.source.length) throw new Error("holy-sheet: truncated DEFLATE input");
   for (; length; length--) out.push(d.source[d.index++]);
 }
-function inflateRaw(source) {
+function inflateRaw(source, maxOutputBytes = Number.POSITIVE_INFINITY) {
+  if (maxOutputBytes !== Number.POSITIVE_INFINITY && (!Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 0)) {
+    throw new Error("holy-sheet: invalid DEFLATE output limit");
+  }
   const d = new Reader(source);
-  const out = new Out();
+  const out = new Out(maxOutputBytes);
   const lt = new Tree();
   const dt = new Tree();
   let bfinal;
@@ -2568,41 +2610,166 @@ function inflateRaw(source) {
   return out.buf.subarray(0, out.len);
 }
 
-// src/zip/zip-reader.ts
-var decoder = new TextDecoder();
-function unzipSync(data) {
-  const dv = new DataView(data.buffer, data.byteOffset, data.byteLength);
-  let eocd = -1;
-  for (let i = data.length - 22; i >= 0; i--) {
-    if (dv.getUint32(i, true) === 101010256) {
-      eocd = i;
+// src/zip/source-archive.ts
+var DEFAULT_ARCHIVE_LIMITS = Object.freeze({
+  maxArchiveBytes: 67108864,
+  maxEntries: 16384,
+  maxPartBytes: 67108864,
+  maxExpandedBytes: 268435456,
+  maxCompressionRatio: 1e3
+});
+var corrupt = () => {
+  throw new ArchiveRefused("archive_corrupt");
+};
+var SourceArchive = class _SourceArchive {
+  constructor(original, parts) {
+    this.original = original;
+    this.parts = parts;
+  }
+  static open(input, options = {}) {
+    for (const [key, value] of Object.entries(options)) {
+      if (!Object.prototype.hasOwnProperty.call(DEFAULT_ARCHIVE_LIMITS, key) || !Number.isSafeInteger(value) || value < 1) throw new ArchiveRefused("archive_limits");
+    }
+    const limits = { ...DEFAULT_ARCHIVE_LIMITS, ...options };
+    if (input.length > limits.maxArchiveBytes) throw new ArchiveRefused("archive_limit");
+    const bytes = input.slice();
+    const records = index(bytes, limits);
+    const parts = /* @__PURE__ */ new Map();
+    for (const record of records) {
+      const compressed = bytes.subarray(record.start, record.start + record.compressed);
+      let payload;
+      try {
+        payload = record.method === 0 ? compressed.slice() : inflateRaw(compressed, record.size + 1);
+      } catch {
+        throw new ArchiveRefused("archive_corrupt");
+      }
+      if (payload.length !== record.size || crc32(payload) !== record.crc) corrupt();
+      parts.set(record.name, payload);
+    }
+    return new _SourceArchive(bytes, parts);
+  }
+  names() {
+    return [...this.parts.keys()];
+  }
+  read(name) {
+    return this.parts.get(name)?.slice() ?? null;
+  }
+  toBytes() {
+    return this.original.slice();
+  }
+};
+function index(bytes, limits) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const bounds = (at3, size, end2 = bytes.length) => {
+    if (at3 < 0 || size < 0 || at3 + size > end2 || at3 + size > bytes.length) corrupt();
+  };
+  const u16 = (at3) => {
+    bounds(at3, 2);
+    return view.getUint16(at3, true);
+  };
+  const u32 = (at3) => {
+    bounds(at3, 4);
+    return view.getUint32(at3, true);
+  };
+  let end = -1;
+  for (let at3 = bytes.length - 22; at3 >= Math.max(0, bytes.length - 65557); at3--) {
+    if (u32(at3) === 101010256 && at3 + 22 + u16(at3 + 20) === bytes.length && u32(at3 + 16) + u32(at3 + 12) === at3) {
+      end = at3;
       break;
     }
   }
-  if (eocd < 0) throw new Error("holy-sheet: not a zip archive (no EOCD record)");
-  const count = dv.getUint16(eocd + 10, true);
-  let cd = dv.getUint32(eocd + 16, true);
-  const result = {};
-  for (let n = 0; n < count; n++) {
-    if (dv.getUint32(cd, true) !== 33639248) break;
-    const method = dv.getUint16(cd + 10, true);
-    const compSize = dv.getUint32(cd + 20, true);
-    const nameLen = dv.getUint16(cd + 28, true);
-    const extraLen = dv.getUint16(cd + 30, true);
-    const commentLen = dv.getUint16(cd + 32, true);
-    const localOffset = dv.getUint32(cd + 42, true);
-    const name = decoder.decode(data.subarray(cd + 46, cd + 46 + nameLen));
-    const lhNameLen = dv.getUint16(localOffset + 26, true);
-    const lhExtraLen = dv.getUint16(localOffset + 28, true);
-    const dataStart = localOffset + 30 + lhNameLen + lhExtraLen;
-    const raw = data.subarray(dataStart, dataStart + compSize);
-    let content;
-    if (method === 0) content = raw.slice();
-    else if (method === 8) content = inflateRaw(raw);
-    else throw new Error(`holy-sheet: unsupported zip method ${method} for "${name}"`);
-    result[name] = content;
-    cd += 46 + nameLen + extraLen + commentLen;
+  if (end === -1) corrupt();
+  const count = u16(end + 10), directory = u32(end + 16);
+  if (u16(end + 4) !== 0 || u16(end + 6) !== 0 || u16(end + 8) !== count || count === 65535) throw new ArchiveRefused("archive_unsupported");
+  if (count > limits.maxEntries) throw new ArchiveRefused("archive_limit");
+  if (end - directory < count * 46) corrupt();
+  const records = [], seen = /* @__PURE__ */ new Set(), regions = [];
+  let at2 = directory, expanded = 0;
+  const extra = (start, length) => {
+    const finish = start + length;
+    while (start < finish) {
+      bounds(start, 4, finish);
+      const id = u16(start), size = u16(start + 2);
+      bounds(start + 4, size, finish);
+      if (id === 1 || id === 39169) throw new ArchiveRefused("archive_unsupported");
+      start += 4 + size;
+    }
+  };
+  for (let i = 0; i < count; i++) {
+    bounds(at2, 46, end);
+    if (u32(at2) !== 33639248) corrupt();
+    const flags = u16(at2 + 8), method = u16(at2 + 10), crc = u32(at2 + 16);
+    const compressed = u32(at2 + 20), size = u32(at2 + 24), local = u32(at2 + 42);
+    const nameLength = u16(at2 + 28), extraLength = u16(at2 + 30), commentLength = u16(at2 + 32);
+    if ((flags & -2063) !== 0 || ![0, 8].includes(method) || method === 0 && (flags & 6) !== 0 || u16(at2 + 34) !== 0 || [compressed, size, local].includes(4294967295) || u16(at2 + 6) > 20) throw new ArchiveRefused("archive_unsupported");
+    bounds(at2 + 46, nameLength + extraLength + commentLength, end);
+    const name = partName(bytes.subarray(at2 + 46, at2 + 46 + nameLength), flags);
+    if (seen.has(name)) throw new ArchiveRefused("archive_duplicate");
+    seen.add(name);
+    expanded += size;
+    if (size > limits.maxPartBytes || expanded > limits.maxExpandedBytes || size > Math.max(1, compressed) * limits.maxCompressionRatio) throw new ArchiveRefused("archive_limit");
+    if (method === 0 && compressed !== size) corrupt();
+    extra(at2 + 46 + nameLength, extraLength);
+    bounds(local, 30, directory);
+    if (u32(local) !== 67324752 || u16(local + 4) !== u16(at2 + 6) || u16(local + 6) !== flags || u16(local + 8) !== method) corrupt();
+    const localName2 = u16(local + 26), localExtra = u16(local + 28);
+    const start = local + 30 + localName2 + localExtra;
+    bounds(local + 30, localName2 + localExtra + compressed, directory);
+    const rawName = bytes.subarray(local + 30, local + 30 + localName2);
+    const centralName = bytes.subarray(at2 + 46, at2 + 46 + nameLength);
+    if (rawName.length !== centralName.length || !rawName.every((byte, pos) => byte === centralName[pos])) corrupt();
+    extra(local + 30 + localName2, localExtra);
+    for (const [offset, expected] of [[14, crc], [18, compressed], [22, size]]) {
+      const value = u32(local + offset);
+      if (value !== expected && !((flags & 8) !== 0 && value === 0)) corrupt();
+    }
+    let finish = start + compressed;
+    if ((flags & 8) !== 0) {
+      let found = false;
+      for (const prefix of [0, 4]) {
+        if (finish + prefix + 12 <= directory && (prefix === 0 || u32(finish) === 134695760) && u32(finish + prefix) === crc && u32(finish + prefix + 4) === compressed && u32(finish + prefix + 8) === size) {
+          finish += prefix + 12;
+          found = true;
+          break;
+        }
+      }
+      if (!found) corrupt();
+    }
+    records.push({ name, method, crc, size, compressed, start });
+    regions.push([local, finish]);
+    at2 += 46 + nameLength + extraLength + commentLength;
+  }
+  if (at2 !== end) corrupt();
+  regions.sort((a, b) => a[0] - b[0]);
+  let previous = 0;
+  for (const [start, finish] of regions) {
+    if (start < previous) corrupt();
+    previous = finish;
+  }
+  return records;
+}
+function partName(bytes, flags) {
+  let name;
+  try {
+    name = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+  } catch {
+    throw new ArchiveRefused("archive_path");
+  }
+  if (name === "" || name.startsWith("/") || name.includes(String.fromCharCode(92)) || name.includes(":")) throw new ArchiveRefused("archive_path");
+  for (const byte of bytes) {
+    if (byte < 32 || byte === 127) throw new ArchiveRefused("archive_path");
+    if (byte > 127 && (flags & 2048) === 0) throw new ArchiveRefused("archive_unsupported");
   }
+  const parts = (name.endsWith("/") ? name.slice(0, -1) : name).split("/");
+  if (parts.some((part2) => part2 === "" || part2 === "." || part2 === "..")) throw new ArchiveRefused("archive_path");
+  return name;
+}
+
+// src/zip/zip-reader.ts
+function unzipSync(data, limits = {}) {
+  const source = SourceArchive.open(data, limits);
+  const result = /* @__PURE__ */ Object.create(null);
+  for (const name of source.names()) result[name] = source.read(name);
   return result;
 }
 
@@ -2650,23 +2817,56 @@ var ODS_MIMETYPES = /* @__PURE__ */ new Set([
   "application/vnd.oasis.opendocument.spreadsheet",
   "application/vnd.oasis.opendocument.spreadsheet-template"
 ]);
-var decoder2 = new TextDecoder();
+var decoder = new TextDecoder();
 var FormatSniffer = {
   sniff(bytes, path = null) {
     let files;
     try {
       files = unzipSync(bytes);
     } catch (e) {
+      if (e instanceof ArchiveRefused && (e.reason !== "archive_corrupt" || bytes[0] === 80 && bytes[1] === 75)) throw e;
       if (e instanceof Error && e.message.includes("unsupported zip method")) throw e;
       throw UnsupportedFormatException.notAZip(path);
     }
-    const mimetype = files["mimetype"] ? phpTrim(decoder2.decode(files["mimetype"])) : null;
+    const mimetype = files["mimetype"] ? phpTrim(decoder.decode(files["mimetype"])) : null;
     if (mimetype !== null && ODS_MIMETYPES.has(mimetype)) return { format: "ods", files };
     if (files["xl/workbook.xml"]) return { format: "xlsx", files };
     throw UnsupportedFormatException.unknownPackage(path, mimetype);
   }
 };
 
+// src/reader/file-input.ts
+async function readFileBounded(path) {
+  const fs = await import('fs');
+  if (!fs.statSync(path).isFile()) throw new ArchiveRefused("archive_path");
+  const fd = fs.openSync(path, "r");
+  const limit = DEFAULT_ARCHIVE_LIMITS.maxArchiveBytes;
+  try {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile()) throw new ArchiveRefused("archive_path");
+    if (stat.size > limit) throw new ArchiveRefused("archive_limit");
+    const chunks = [];
+    let total = 0;
+    for (; ; ) {
+      const chunk = new Uint8Array(Math.min(65536, limit + 1 - total));
+      const count = fs.readSync(fd, chunk, 0, chunk.length, null);
+      if (count === 0) break;
+      if (total + count > limit) throw new ArchiveRefused("archive_limit");
+      chunks.push(chunk.subarray(0, count));
+      total += count;
+    }
+    const bytes = new Uint8Array(total);
+    let at2 = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, at2);
+      at2 += chunk.length;
+    }
+    return bytes;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 // src/reader/ods/ods-formula.ts
 function odsFormulaToA1(formula2) {
   let grammar = "of";
@@ -3446,7 +3646,7 @@ function at(node, name) {
 var MAX_ROWS = 1048576;
 var MAX_COLUMNS = 16384;
 var UNIX_EPOCH_SERIAL = 25569;
-var decoder3 = new TextDecoder();
+var decoder2 = new TextDecoder();
 var OdsReader = class {
   describe(bytes) {
     return WorkbookSchema.fromWorkbook(this.readWorkbook(bytes));
@@ -3456,7 +3656,7 @@ var OdsReader = class {
   }
   /** Read an already-unzipped package (name -> bytes). */
   readFiles(files) {
-    const getText = (name) => files[name] ? decoder3.decode(files[name]) : null;
+    const getText = (name) => files[name] ? decoder2.decode(files[name]) : null;
     const content = getText("content.xml");
     if (content === null) throw new Error("[holy-sheet] missing content.xml");
     const contentDoc = parseXml(content, { namespaces: true });
@@ -3818,7 +4018,7 @@ function points(ser) {
       byIndex.set(parseInt(idx, 10), color2);
     }
   }
-  return [...byIndex.entries()].sort((a, b) => a[0] - b[0]).map(([index, color2]) => ({ index, color: color2 }));
+  return [...byIndex.entries()].sort((a, b) => a[0] - b[0]).map(([index2, color2]) => ({ index: index2, color: color2 }));
 }
 function seriesColor(ser) {
   const spPr = el(ser, "spPr");
@@ -4126,7 +4326,7 @@ function parseFrozen(xml) {
 }
 
 // src/reader/xlsx-reader.ts
-var decoder4 = new TextDecoder();
+var decoder3 = new TextDecoder();
 var XlsxReader = class {
   describe(bytes) {
     return WorkbookSchema.fromWorkbook(this.readWorkbook(bytes));
@@ -4136,7 +4336,7 @@ var XlsxReader = class {
   }
   /** Read an already-unzipped package (name -> bytes), so a caller that sniffed it does not unzip twice. */
   readFiles(files) {
-    const getText = (name) => files[name] ? decoder4.decode(files[name]) : null;
+    const getText = (name) => files[name] ? decoder3.decode(files[name]) : null;
     const stylesXml = getText("xl/styles.xml");
     const stylesIndex = stylesXml ? StylesParser.parse(stylesXml) : [];
     const sharedStringsXml = getText("xl/sharedStrings.xml");
@@ -5006,11 +5206,11 @@ var SheetReducer = {
       if (!isArr(get(op, "sheet"))) {
         return schema;
       }
-      const index = has(op, "index") ? phpInteger(op.index) : sheets.length;
-      if (index === null) {
+      const index2 = has(op, "index") ? phpInteger(op.index) : sheets.length;
+      if (index2 === null) {
         return schema;
       }
-      sheets.splice(Math.max(0, Math.min(sheets.length, index)), 0, op.sheet);
+      sheets.splice(Math.max(0, Math.min(sheets.length, index2)), 0, op.sheet);
       return { ...schema, sheets };
     }
     const at2 = find(sheets, phpString(get(op, "sheet") ?? ""));
@@ -5186,11 +5386,11 @@ function shiftColumns(sheet, at2, delta) {
   });
   if (isArr(get(sheet, "columnWidths"))) {
     const widths = /* @__PURE__ */ new Map();
-    for (const [index, width] of entriesOf(sheet.columnWidths)) {
-      if (!isIndexKey(index)) {
+    for (const [index2, width] of entriesOf(sheet.columnWidths)) {
+      if (!isIndexKey(index2)) {
         continue;
       }
-      const i = phpInt2(index);
+      const i = phpInt2(index2);
       const number = i + 1;
       if (number < at2) {
         widths.set(i, width);
@@ -5199,8 +5399,8 @@ function shiftColumns(sheet, at2, delta) {
       }
     }
     const sorted = {};
-    for (const [index, width] of [...widths.entries()].sort((x, y) => x[0] - y[0])) {
-      sorted[index] = width;
+    for (const [index2, width] of [...widths.entries()].sort((x, y) => x[0] - y[0])) {
+      sorted[index2] = width;
     }
     sheet = setOrUnset(sheet, "columnWidths", sorted, EMPTY);
   }
@@ -5463,22 +5663,22 @@ function granular(a, b) {
       ops.push({ type: "rename_sheet", sheet: name, name: renames.get(name) });
     }
   }
-  namesB.forEach((name, index) => {
+  namesB.forEach((name, index2) => {
     if (unmatchedAdded.includes(name)) {
-      ops.push({ type: "add_sheet", index, sheet: sheetsB[index] });
+      ops.push({ type: "add_sheet", index: index2, sheet: sheetsB[index2] });
     }
   });
   let state = SheetReducer.applyAll(a, ops);
-  namesB.forEach((name, index) => {
+  namesB.forEach((name, index2) => {
     const current = new Map(entriesOf(get(state, "sheets") ?? []).map(([key, sheet]) => [key, sheetName(sheet)]));
-    if ((current.get(String(index)) ?? null) !== name) {
-      const op = { type: "move_sheet", sheet: name, toIndex: index };
+    if ((current.get(String(index2)) ?? null) !== name) {
+      const op = { type: "move_sheet", sheet: name, toIndex: index2 };
       ops.push(op);
       state = SheetReducer.apply(state, op);
     }
   });
-  sheetsB.forEach((target, index) => {
-    const current = state.sheets[index];
+  sheetsB.forEach((target, index2) => {
+    const current = state.sheets[index2];
     if (SheetDiff.same(current, target)) {
       return;
     }
@@ -6129,7 +6329,7 @@ var holy_sheet_schema_default = {
 };
 
 // src/agent.ts
-var VERSION = "2.10.1";
+var VERSION = "2.10.2";
 function toU8(input) {
   return input instanceof Uint8Array ? input : new Uint8Array(input);
 }
@@ -6174,8 +6374,8 @@ var Agent = {
   async describe(path) {
     const fs = await import('fs');
     if (!fs.existsSync(path)) return { error: "not_found", path };
-    const bytes = fs.readFileSync(path);
-    return readSpreadsheet(new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength), path);
+    const bytes = await readFileBounded(path);
+    return readSpreadsheet(bytes, path);
   },
   /** Validate + conservative repairs in one call. */
   validateAndRepair(schema) {
@@ -6292,6 +6492,6 @@ var HolySheet = class {
 };
 HolySheet.VERSION = VERSION;
 
-export { Agent, ArrayBuilder, CellAddress, CsvBuilder, FormatSniffer, FormulaLinter, HolySheet, Inference, Normalizer, OdsReader, Repairer, SchemaException, SheetDiff, SheetOpSchema, SheetReducer, Theme, UnsupportedFormatException, VERSION, Validator, XlsxReader, XlsxWriter, unzipSync, zipSync };
+export { Agent, ArchiveRefused, ArrayBuilder, CellAddress, CsvBuilder, FormatSniffer, FormulaLinter, HolySheet, Inference, Normalizer, OdsReader, Repairer, SchemaException, SheetDiff, SheetOpSchema, SheetReducer, Theme, UnsupportedFormatException, VERSION, Validator, XlsxReader, XlsxWriter, unzipSync, zipSync };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map