@poe-platform/safe-bash 0.1.809 → 0.1.810

package/dist/safe-bash-network-engine/transfer.js

@@ -18,7 +18,7 @@ import {
 import {
   createBody,
   queryData
-} from "../safe-bash/command-chunks/chunk-4557HE3J.js";
+} from "../safe-bash/command-chunks/chunk-PMWW7KSB.js";
 import "../safe-bash/command-chunks/chunk-CYIHFBEH.js";
 import "../safe-bash/command-chunks/chunk-ZGXSETAX.js";
 import {
@@ -293,6 +293,7 @@ function createTransferCommand(options, profile) {
   return def;
 }
 async function transfer(context, args, input, limits, transport, authorize, started, status, headerState) {
+  let retainedBody;
   const start = performance.now();
   const remaining = () => Math.min(args.maxTimeMs - (performance.now() - start), limits.maxTotalTimeMs - (performance.now() - started));
   const hasFileOutput = args.etagSave !== void 0 && args.etagSave !== "-" || args.remoteName || args.output !== void 0 && args.output !== "-" || args.dumpHeader !== void 0 && args.dumpHeader !== "-";
@@ -304,6 +305,13 @@ async function transfer(context, args, input, limits, transport, authorize, star
   } } : context.stdin;
   let response;
   let failure;
+  operation.registerCleanup(async () => {
+    try {
+      await retainedBody?.close();
+    } catch {
+      failure ??= new CurlError(65, "Failed cleaning upload replay storage");
+    }
+  });
   const values = { ...writeOutDefaults };
   let format = args.writeOut;
   let formatReady = false;
@@ -373,7 +381,7 @@ async function transfer(context, args, input, limits, transport, authorize, star
     if (args.query?.length) {
       const queryArgs = { ...args, data: args.query };
       delete queryArgs.upload;
-      const queryBody = createBody({ ...context, stdin: borrowed }, queryArgs, limits);
+      const queryBody = retainedBody = createBody({ ...context, stdin: borrowed }, queryArgs, limits);
       const encoded = await queryData(queryBody, signal, limits);
       let query = "";
       for (let index = 0; index < encoded.length; index++) {
@@ -386,7 +394,7 @@ async function transfer(context, args, input, limits, transport, authorize, star
       }
       initial.search += `${initial.search ? "&" : "?"}${query}`;
     }
-    let body = createBody({ ...context, stdin: borrowed }, args, limits);
+    let body = retainedBody = createBody({ ...context, stdin: borrowed }, args, limits);
     if (args.get && body) {
       const query = await queryData(body, signal, limits);
       if (/[^\x21-\x7e]/.test(query)) throw new CurlError(3, "GET data must be URL encoded");

package/dist/safe-bash-presentation-engine/command-placeholder.js

@@ -1,8 +1,9 @@
 import {
   insertPlaceholder
-} from "../safe-bash/command-chunks/chunk-5HGEXQVD.js";
-import "../safe-bash/command-chunks/chunk-NB7JO7FE.js";
-import "../safe-bash/command-chunks/chunk-6OKH4X67.js";
+} from "../safe-bash/command-chunks/chunk-WC2OCF4H.js";
+import "../safe-bash/command-chunks/chunk-YTFWPJ3F.js";
+import "../safe-bash/command-chunks/chunk-CAXJ4RLF.js";
+import "../safe-bash/command-chunks/chunk-U6QHTC5J.js";
 import "../safe-bash/command-chunks/chunk-YUVH6CE4.js";
 import "../safe-bash/command-chunks/chunk-DJVRDUCA.js";
 import "../safe-bash/command-chunks/chunk-XBZ4ZWGL.js";

package/dist/safe-bash-presentation-engine/index.d.ts

@@ -22,7 +22,7 @@ export { addChart, setCharts, chartTypes, type CreatableChartType, type ChartInp
 export { selectionQuerySchema } from "./selector-schema.js";
 export type { PresentationInventory, SlideInventory, PartInventory } from "./inventory.js";
 export { readSelectionIndex, decodeSelectionToken, createBatchHandles, SelectionError, type SelectionContext, type SelectionQuery, type SelectionRecord, type SelectionIndex } from "./selectors.js";
-export { getXmlPart, replaceXmlPart, type XmlPartContext, type XmlPartData } from "./xml-parts.js";
+export { getXmlPart, openRetainedXmlPart, stageRetainedXmlPart, replaceXmlPart, type RetainedXmlPart, type RetainedXmlPartContext, type XmlPartContext, type XmlPartData } from "./xml-parts.js";
 export type { PartView, PackageView, PartRelationship } from "./package-view.js";
 export type { XmlElementView } from "./xml-view.js";
 export { Presentation, type PresentationModel, type PresentationContext, type PresentationPublication } from "./presentation-model.js";

package/dist/safe-bash-presentation-engine/index.js

@@ -95,7 +95,7 @@ import {
 } from "../safe-bash/command-chunks/chunk-EWS4KYJE.js";
 import {
   insertPlaceholder
-} from "../safe-bash/command-chunks/chunk-5HGEXQVD.js";
+} from "../safe-bash/command-chunks/chunk-WC2OCF4H.js";
 import {
   sanitize
 } from "../safe-bash/command-chunks/chunk-K7AGAS3K.js";
@@ -149,11 +149,14 @@ import {
   Presentation,
   SlideLayout,
   SlideLayouts
-} from "../safe-bash/command-chunks/chunk-NB7JO7FE.js";
+} from "../safe-bash/command-chunks/chunk-YTFWPJ3F.js";
 import {
   getXmlPart,
-  replaceXmlPart
-} from "../safe-bash/command-chunks/chunk-6OKH4X67.js";
+  openRetainedXmlPart,
+  replaceXmlPart,
+  stageRetainedXmlPart
+} from "../safe-bash/command-chunks/chunk-CAXJ4RLF.js";
+import "../safe-bash/command-chunks/chunk-U6QHTC5J.js";
 import {
   Connector,
   DrawingOperation,
@@ -710,6 +713,7 @@ export {
   openLinkSession,
   openPackageArchive,
   openPropertySession,
+  openRetainedXmlPart,
   packPackage,
   paragraphAlignments,
   paragraphNumberingSchemes,
@@ -774,6 +778,7 @@ export {
   shapePathXml,
   shapePresets,
   splitSlides,
+  stageRetainedXmlPart,
   textCapitalizationStyles,
   textStrikeStyles,
   textUnderlineStyles,

package/dist/safe-bash-presentation-engine/presentation-model.js

@@ -1,7 +1,8 @@
 import {
   Presentation
-} from "../safe-bash/command-chunks/chunk-NB7JO7FE.js";
-import "../safe-bash/command-chunks/chunk-6OKH4X67.js";
+} from "../safe-bash/command-chunks/chunk-YTFWPJ3F.js";
+import "../safe-bash/command-chunks/chunk-CAXJ4RLF.js";
+import "../safe-bash/command-chunks/chunk-U6QHTC5J.js";
 import "../safe-bash/command-chunks/chunk-YUVH6CE4.js";
 import "../safe-bash/command-chunks/chunk-DJVRDUCA.js";
 import "../safe-bash/command-chunks/chunk-XBZ4ZWGL.js";

package/dist/safe-bash-presentation-engine/retained-text.js

@@ -1,11 +1,11 @@
+import {
+  fieldTypeKinds
+} from "../safe-bash/command-chunks/chunk-GTWVMFBK.js";
 import {
   openRetainedPresentationIndex,
   stageRetainedOutput,
   streamJson
 } from "../safe-bash/command-chunks/chunk-U6QHTC5J.js";
-import {
-  fieldTypeKinds
-} from "../safe-bash/command-chunks/chunk-GTWVMFBK.js";
 import {
   validateTextReadingOptions
 } from "../safe-bash/command-chunks/chunk-HONWGFDA.js";

package/dist/safe-bash-presentation-engine/retained-xml-parts.d.ts

@@ -0,0 +1,26 @@
+import type { ValidationLimits } from './validation.js';
+import type { ByteSource } from './contracts.js';
+import type { RetainedPackageArchive, RetainedPackageContext } from './retained-package.js';
+import { type StagedOutput } from './retained-output.js';
+import { type RetainedInspectionSelection } from './retained-inspection.js';
+export interface RetainedXmlPartContext extends RetainedPackageContext {
+    readonly validationLimits?: ValidationLimits;
+}
+type Archive = Pick<RetainedPackageArchive, 'parts' | 'has' | 'read' | 'byteLength'>;
+export interface RetainedXmlPart {
+    readonly part: string;
+    readonly format: 'original' | 'pretty';
+    bytes(): ByteSource;
+    xml(): ByteSource;
+    close(): Promise<void>;
+}
+/** Borrow an admitted archive; all decoded XML and pretty state use caller storage. */
+export declare function openRetainedXmlPart(archive: Archive, requested: string, settings: RetainedXmlPartContext, options?: {
+    readonly pretty?: boolean;
+}): Promise<RetainedXmlPart>;
+export declare function stageRetainedXmlPart(archive: Archive, fingerprint: string, selection: RetainedInspectionSelection, settings: RetainedXmlPartContext, output: {
+    readonly json: boolean;
+    readonly pretty?: boolean;
+    readonly maxOutputBytes: number;
+}): Promise<StagedOutput>;
+export {};

package/dist/safe-bash-presentation-engine/xml-parts.d.ts

@@ -15,3 +15,4 @@ export declare function getXmlPart(input: BinaryInput, part: string, context: Xm
 }): Promise<XmlPartData>;
 export declare function replaceXmlPart(input: BinaryInput, part: string, replacement: BinaryInput, context: XmlPartContext): Promise<Uint8Array>;
 export declare function validateXmlPartReplacement(reader: PackageReader, part: string, bytes: Uint8Array, context: XmlPartContext): PackageReader;
+export { openRetainedXmlPart, stageRetainedXmlPart, type RetainedXmlPart, type RetainedXmlPartContext } from './retained-xml-parts.js';

package/dist/safe-bash-presentation-engine/xml-parts.js

@@ -1,9 +1,13 @@
 import {
   getXmlPart,
+  openRetainedXmlPart,
   replaceXmlPart,
+  stageRetainedXmlPart,
   validateXmlPartReplacement
-} from "../safe-bash/command-chunks/chunk-6OKH4X67.js";
+} from "../safe-bash/command-chunks/chunk-CAXJ4RLF.js";
+import "../safe-bash/command-chunks/chunk-U6QHTC5J.js";
 import "../safe-bash/command-chunks/chunk-VPDSQPSN.js";
+import "../safe-bash/command-chunks/chunk-S4IIOSRA.js";
 import "../safe-bash/command-chunks/chunk-SFCERNHU.js";
 import "../safe-bash/command-chunks/chunk-KMMAJ6H6.js";
 import "../safe-bash/command-chunks/chunk-MMBRBANA.js";
@@ -22,6 +26,8 @@ import "../safe-bash/command-chunks/chunk-E6SK3OU2.js";
 import "../safe-bash/command-chunks/chunk-65DS4IOB.js";
 export {
   getXmlPart,
+  openRetainedXmlPart,
   replaceXmlPart,
+  stageRetainedXmlPart,
   validateXmlPartReplacement
 };

package/dist/safe-bash-xml-engine/document.js

@@ -1,6 +1,6 @@
 import {
   serializeDocument
-} from "../safe-bash/command-chunks/chunk-D7XBUF76.js";
+} from "../safe-bash/command-chunks/chunk-D2ASPM7R.js";
 import "../safe-bash/command-chunks/chunk-D2KZ66W4.js";
 import "../safe-bash/command-chunks/chunk-JYUJAF4L.js";
 import "../safe-bash/command-chunks/chunk-3I5WTVWZ.js";

package/dist/safe-bash-xml-engine/index.js

@@ -1,6 +1,6 @@
 import {
   serializeDocument
-} from "../safe-bash/command-chunks/chunk-D7XBUF76.js";
+} from "../safe-bash/command-chunks/chunk-D2ASPM7R.js";
 import "../safe-bash/command-chunks/chunk-D2KZ66W4.js";
 import {
   parseQuery

package/dist/spreadsheet-engine/rendering/print/tab-layout.d.ts

@@ -0,0 +1,11 @@
+/** Pango default tabs leave at least one space before the next eight-space stop. */
+export declare function nextPrintTabStop(width: number, tabWidth: number): number;
+/** Mirror tab-run boxes without reversing the already-shaped glyphs inside each run. */
+export declare function mirrorPrintTabRuns(glyphs: {
+    x: number;
+}[], runs: readonly {
+    start: number;
+    end: number;
+    first: number;
+    last: number;
+}[], width: number, tick: () => void): void;

package/dist/spreadsheet-engine/rendering/print/tab-layout.js

@@ -0,0 +1,15 @@
+/** Pango default tabs leave at least one space before the next eight-space stop. */
+export function nextPrintTabStop(width, tabWidth) {
+    return Math.ceil((width + tabWidth / 8) / tabWidth) * tabWidth;
+}
+/** Mirror tab-run boxes without reversing the already-shaped glyphs inside each run. */
+export function mirrorPrintTabRuns(glyphs, runs, width, tick) {
+    for (const run of runs) {
+        tick();
+        const offset = width - run.end - run.start;
+        for (let index = run.first; index < run.last; index++) {
+            tick();
+            glyphs[index].x += offset;
+        }
+    }
+}

package/dist/spreadsheet-engine/rendering/print/text-lines.d.ts

@@ -5,5 +5,5 @@ export declare function splitPrintLines(value: string, tick: (amount?: number) =
 }[];
 /** Gnumeric displays LF inside Fill strings as a direction-aware return arrow. */
 export declare function fillPrintNewlines(value: string, rtl: boolean, tick: (amount?: number) => void): string;
-/** Keep shaping boundaries while painting single-direction Fill paragraphs in visual order. */
-export declare function fillPrintParagraphs(value: string, rtl: boolean, tick: (amount?: number) => void): string[];
+/** Keep shaping boundaries and control markers in single-direction Fill visual order. */
+export declare function fillPrintItems(value: string, rtl: boolean, tick: (amount?: number) => void): string[];

package/dist/spreadsheet-engine/rendering/print/text-lines.js

@@ -30,9 +30,9 @@ export function fillPrintNewlines(value, rtl, tick) {
     tick(value.length);
     return value.split("\n").join(rtl ? "↪" : "↩");
 }
-/** Keep shaping boundaries while painting single-direction Fill paragraphs in visual order. */
-export function fillPrintParagraphs(value, rtl, tick) {
+/** Keep shaping boundaries and control markers in single-direction Fill visual order. */
+export function fillPrintItems(value, rtl, tick) {
     tick(value.length);
-    const parts = value.split("\u2029");
+    const parts = value.split("\u2029").flatMap(part => ["\u2028", "\r"].reduce((parts, separator) => parts.flatMap(part => part.split(separator).flatMap((piece, index) => index ? [separator, piece] : [piece])), [part]));
     return rtl ? parts.reverse() : parts;
 }

package/dist/spreadsheet-format-xls/biff-encrypted-properties.d.ts

@@ -1,4 +1,5 @@
 import { type CapabilityContext, type RangeSource } from "../spreadsheet-engine/contracts.js";
+import type { BiffPropertySource } from "./biff-encrypted-properties-write.js";
 import type { BiffRc4Cipher } from "./biff-encryption.js";
 /** Admit the outer container and reject hidden plaintext property collisions
  * before asking for a password. POI emits an empty document-summary placeholder. */
@@ -6,3 +7,6 @@ export declare function encryptedBiffPropertyStream(streams: ReadonlyMap<string,
 /** MS-OFFCRYPTO 2.3.5.4: header/table restart block 0; each payload restarts its
  * descriptor block. These are not Workbook's absolute-position 1024-byte chunks. */
 export declare function decryptBiffPropertyContainer(encrypted: Uint8Array, keyStream: (block: number, length: number) => Uint8Array, context: CapabilityContext, charge: (amount: number) => void, createCipher?: (block: number) => BiffRc4Cipher): ReadonlyMap<string, Uint8Array>;
+/** Decrypt payloads directly into caller storage. Container bytes and the validated
+ * descriptor table are still buffered; payload plaintext never accumulates in RAM. */
+export declare function decryptBiffPropertySources(encrypted: Uint8Array, createCipher: (block: number) => BiffRc4Cipher, context: CapabilityContext, charge: (amount: number) => void): Promise<ReadonlyMap<string, BiffPropertySource>>;

package/dist/spreadsheet-format-xls/biff-encrypted-properties.js

@@ -1,4 +1,5 @@
 import { SsconvertError } from "../spreadsheet-engine/contracts.js";
+import { stagePropertyBytes } from "./biff-property-bytes.js";
 import { Binary, invalidBiff } from "./biff-binary.js";
 import { biffPropertyFormats } from "./biff-properties.js";
 import { propertyRange, readPropertySectionRanges, readPropertyValueRanges } from "./biff-property-range.js";
@@ -98,62 +99,7 @@ export function decryptBiffPropertyContainer(encrypted, keyStream, context, char
     };
     try {
         check();
-        if (encrypted.length > context.limits.inputBytes)
-            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
-        const source = new Binary(encrypted), header = new Binary(decrypt(source.slice(0, 8), 0));
-        const offset = header.u32(0), size = header.u32(4);
-        header.bytes.fill(0);
-        if (offset < 8 || size < 4)
-            invalidBiff("invalid encrypted property descriptor range");
-        source.check(offset, size);
-        const table = new Binary(decrypt(source.slice(offset, size), 0)), count = table.u32(0);
-        if (count > Math.floor((size - 4) / 18))
-            invalidBiff("invalid encrypted property descriptor count");
-        if (count > (context.limits.workbookNodes ?? context.limits.inputBytes))
-            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property node limit exceeded");
-        charge(count);
-        let at = 4, textBytes = 0;
-        const descriptors = [], names = new Set();
-        for (let i = 0; i < count; i++) {
-            context.signal.throwIfAborted();
-            table.check(at, 18);
-            const start = table.u32(at), length = table.u32(at + 4), block = table.u16(at + 8), nameLength = table.u8(at + 10), flags = table.u8(at + 11);
-            if (flags !== 1 || table.u32(at + 12) !== 0)
-                invalidBiff("invalid encrypted property descriptor flags");
-            at += 16;
-            if (!nameLength || nameLength > 31)
-                invalidBiff("invalid encrypted property stream name");
-            table.check(at, (nameLength + 1) * 2);
-            charge(nameLength);
-            if (table.u16(at + nameLength * 2) !== 0)
-                invalidBiff("unterminated encrypted property stream name");
-            textBytes += nameLength * 3;
-            if (textBytes > (context.limits.workbookTextBytes ?? context.limits.inputBytes))
-                throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property text limit exceeded");
-            let name;
-            try {
-                name = new TextDecoder("utf-16le", { fatal: true, ignoreBOM: true }).decode(table.slice(at, nameLength * 2));
-            }
-            catch {
-                invalidBiff("invalid encrypted property stream name");
-            }
-            if (name.includes("\0") || names.has(name.toUpperCase()))
-                invalidBiff("duplicate or invalid encrypted property stream name");
-            names.add(name.toUpperCase());
-            at += (nameLength + 1) * 2;
-            source.check(start, length);
-            if (start < 8 || start < offset + size && start + length > offset)
-                invalidBiff("overlapping encrypted property ranges");
-            descriptors.push({ offset: start, size: length, block, name });
-        }
-        if (at !== size)
-            invalidBiff("invalid encrypted property descriptor size");
-        table.bytes.fill(0);
-        charge(count * Math.ceil(Math.log2(count + 1)));
-        const ordered = [...descriptors].sort((a, b) => a.offset - b.offset);
-        for (let i = 1; i < ordered.length; i++)
-            if (ordered[i].offset < ordered[i - 1].offset + ordered[i - 1].size)
-                invalidBiff("overlapping encrypted property payloads");
+        const descriptors = readEncryptedPropertyDescriptors(encrypted, decrypt, context, charge), source = new Binary(encrypted);
         for (const entry of descriptors)
             result.set(entry.name, decrypt(source.slice(entry.offset, entry.size), entry.block));
         return result;
@@ -163,3 +109,138 @@ export function decryptBiffPropertyContainer(encrypted, keyStream, context, char
         throw error;
     }
 }
+function readEncryptedPropertyDescriptors(encrypted, decrypt, context, charge) {
+    if (encrypted.length > context.limits.inputBytes)
+        throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
+    const source = new Binary(encrypted), header = new Binary(decrypt(source.slice(0, 8), 0));
+    const offset = header.u32(0), size = header.u32(4);
+    header.bytes.fill(0);
+    if (offset < 8 || size < 4)
+        invalidBiff("invalid encrypted property descriptor range");
+    source.check(offset, size);
+    const table = new Binary(decrypt(source.slice(offset, size), 0)), count = table.u32(0);
+    if (count > Math.floor((size - 4) / 18))
+        invalidBiff("invalid encrypted property descriptor count");
+    if (count > (context.limits.workbookNodes ?? context.limits.inputBytes))
+        throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property node limit exceeded");
+    charge(count);
+    let at = 4, textBytes = 0;
+    const descriptors = [], names = new Set();
+    for (let i = 0; i < count; i++) {
+        context.signal.throwIfAborted();
+        table.check(at, 18);
+        const start = table.u32(at), length = table.u32(at + 4), block = table.u16(at + 8), nameLength = table.u8(at + 10), flags = table.u8(at + 11);
+        if (flags !== 1 || table.u32(at + 12) !== 0)
+            invalidBiff("invalid encrypted property descriptor flags");
+        at += 16;
+        if (!nameLength || nameLength > 31)
+            invalidBiff("invalid encrypted property stream name");
+        table.check(at, (nameLength + 1) * 2);
+        charge(nameLength);
+        if (table.u16(at + nameLength * 2) !== 0)
+            invalidBiff("unterminated encrypted property stream name");
+        textBytes += nameLength * 3;
+        if (textBytes > (context.limits.workbookTextBytes ?? context.limits.inputBytes))
+            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property text limit exceeded");
+        let name;
+        try {
+            name = new TextDecoder("utf-16le", { fatal: true, ignoreBOM: true }).decode(table.slice(at, nameLength * 2));
+        }
+        catch {
+            invalidBiff("invalid encrypted property stream name");
+        }
+        if (name.includes("\0") || names.has(name.toUpperCase()))
+            invalidBiff("duplicate or invalid encrypted property stream name");
+        names.add(name.toUpperCase());
+        at += (nameLength + 1) * 2;
+        source.check(start, length);
+        if (start < 8 || start < offset + size && start + length > offset)
+            invalidBiff("overlapping encrypted property ranges");
+        descriptors.push({ offset: start, size: length, block, name });
+    }
+    if (at !== size)
+        invalidBiff("invalid encrypted property descriptor size");
+    table.bytes.fill(0);
+    charge(count * Math.ceil(Math.log2(count + 1)));
+    const ordered = [...descriptors].sort((a, b) => a.offset - b.offset);
+    for (let i = 1; i < ordered.length; i++)
+        if (ordered[i].offset < ordered[i - 1].offset + ordered[i - 1].size)
+            invalidBiff("overlapping encrypted property payloads");
+    return descriptors;
+}
+/** Decrypt payloads directly into caller storage. Container bytes and the validated
+ * descriptor table are still buffered; payload plaintext never accumulates in RAM. */
+export async function decryptBiffPropertySources(encrypted, createCipher, context, charge) {
+    const result = new Map(), owned = [];
+    let closed = false;
+    const check = () => { context.signal.throwIfAborted(); if (closed)
+        throw new SsconvertError("invalid-request", "Encrypted BIFF property reader disposed"); };
+    const close = async () => {
+        closed = true;
+        for (const bytes of owned)
+            bytes.fill(0);
+        const outcomes = await Promise.allSettled([...result.values()].map(source => source.close()));
+        result.clear();
+        const errors = outcomes.filter((value) => value.status === "rejected").map(value => value.reason);
+        if (errors.length)
+            throw new AggregateError(errors, "Encrypted BIFF property cleanup failed");
+    };
+    context.own(close);
+    function* chunks(bytes, block) {
+        check();
+        charge(bytes.length * 2 + 320);
+        const cipher = createCipher(block);
+        try {
+            check();
+            for (let at = 0; at < bytes.length; at += 16384) {
+                const output = bytes.slice(at, at + 16384);
+                try {
+                    cipher.xor(output);
+                    check();
+                    yield output;
+                    check();
+                }
+                finally {
+                    output.fill(0);
+                }
+            }
+        }
+        finally {
+            cipher.close();
+        }
+    }
+    try {
+        check();
+        const descriptors = readEncryptedPropertyDescriptors(encrypted, (bytes, block) => {
+            const output = new Uint8Array(bytes.length);
+            owned.push(output);
+            let at = 0;
+            for (const part of chunks(bytes, block)) {
+                output.set(part, at);
+                at += part.length;
+            }
+            return output;
+        }, context, charge);
+        for (const entry of descriptors) {
+            const bytes = encrypted.subarray(entry.offset, entry.offset + entry.size);
+            const source = await stagePropertyBytes({ length: entry.size, chunks: () => chunks(bytes, entry.block) }, context, context.limits.inputBytes);
+            result.set(entry.name, source);
+            check();
+        }
+        return result;
+    }
+    catch (error) {
+        try {
+            await close();
+        }
+        catch (cleanup) {
+            throw new AggregateError([error, cleanup], "Encrypted BIFF property read and cleanup failed");
+        }
+        throw error;
+    }
+    finally {
+        for (const bytes of owned)
+            bytes.fill(0);
+        owned.length = 0;
+    }
+}

package/dist/spreadsheet-format-xls/biff-encryption.d.ts

@@ -12,4 +12,4 @@ export declare function createRc4Cipher(key: Uint8Array, context: CapabilityCont
 /** Buffering convenience for the bounded record blocks and legacy readers. */
 export declare function rc4Stream(key: Uint8Array, length: number, context: CapabilityContext): Uint8Array;
 /** Decode admitted XOR/RC4 profiles; optional secret acquisition is explicit host authority. */
-export declare function decryptBiffRecords(records: BiffRecords, revision: number, context: CapabilityContext, streams?: ReadonlyMap<string, Uint8Array>, propertySources?: ReadonlyMap<string, RangeSource>): Promise<ReadonlyMap<string, Uint8Array> | undefined>;
+export declare function decryptBiffRecords(records: BiffRecords, revision: number, context: CapabilityContext, streams?: ReadonlyMap<string, Uint8Array>, propertySources?: ReadonlyMap<string, RangeSource>): Promise<ReadonlyMap<string, Uint8Array | RangeSource> | undefined>;

package/dist/spreadsheet-format-xls/biff-encryption.js

@@ -1,7 +1,7 @@
 import { biffRecord } from "./biff-record-storage.js";
 import { SsconvertError } from "../spreadsheet-engine/contracts.js";
 import { Binary, invalidBiff } from "./biff-binary.js";
-import { decryptBiffPropertyContainer, encryptedBiffPropertyStream } from "./biff-encrypted-properties.js";
+import { decryptBiffPropertyContainer, decryptBiffPropertySources, encryptedBiffPropertyStream } from "./biff-encrypted-properties.js";
 import { md5, sha1 } from "@noble/hashes/legacy.js";
 /** MS-OFFCRYPTO legacy interoperability only; RC4 provides no authentication.
  * The caller closes each stream before releasing its key lifetime. Only the
@@ -327,7 +327,9 @@ export async function decryptBiffRecords(records, revision, context, streams, pr
                     decoded.fill(0);
             }
         }
-        return properties ? decryptBiffPropertyContainer(properties, keyStream, context, admit, number => {
+        if (!properties)
+            return undefined;
+        const createCipher = (number) => {
             const key = blockKey(number);
             try {
                 return createRc4Cipher(key, context);
@@ -335,7 +337,10 @@ export async function decryptBiffRecords(records, revision, context, streams, pr
             finally {
                 key.fill(0);
             }
-        }) : undefined;
+        };
+        // Staging must finish while the block-key base still exists.
+        return context.createWorkingStorage ? await decryptBiffPropertySources(properties, createCipher, context, admit) :
+            decryptBiffPropertyContainer(properties, keyStream, context, admit, createCipher);
     }
     catch (error) {
         for (const bytes of decodedBuffers)

package/dist/spreadsheet-format-xls/biff-property-bytes.d.ts

@@ -6,4 +6,4 @@ export type BiffPropertyBytes = Uint8Array | {
 };
 export declare function propertyChunks(value: BiffPropertyBytes): Iterable<Uint8Array>;
 /** Consume lazy serialization once into caller storage; never retain emitted chunks. */
-export declare function stagePropertyBytes(value: BiffPropertyBytes, context: CapabilityContext): Promise<BiffPropertySource>;
+export declare function stagePropertyBytes(value: BiffPropertyBytes, context: CapabilityContext, maximumBytes?: number): Promise<BiffPropertySource>;

package/dist/spreadsheet-format-xls/biff-property-bytes.js

@@ -8,9 +8,9 @@ export function* propertyChunks(value) {
         yield* value.chunks();
 }
 /** Consume lazy serialization once into caller storage; never retain emitted chunks. */
-export async function stagePropertyBytes(value, context) {
+export async function stagePropertyBytes(value, context, maximumBytes = context.limits.outputBytes) {
     context.signal.throwIfAborted();
-    if (!Number.isSafeInteger(value.length) || value.length < 0 || value.length > context.limits.outputBytes)
+    if (!Number.isSafeInteger(value.length) || value.length < 0 || value.length > maximumBytes)
         throw new SsconvertError('resource-limit', 'Invalid BIFF property serialization size');
     const acquire = context.createWorkingStorage?.bind(context);
     if (!acquire)

package/dist/spreadsheet-format-xls/biff.js

@@ -1,3 +1,4 @@
+import { propertyRange } from "./biff-property-range.js";
 import { BiffStagedOutput } from "./biff-staged-output.js";
 import { createBiffCatalogs } from "./biff-catalogs.js";
 import { biffFillPatterns } from "./biff-fill-patterns.js";
@@ -1348,12 +1349,19 @@ async function readBiffContents(records, streamSize, streams, context, encoding,
     for (const [name, bytes] of decryptedProperties ?? []) {
         if (["\u0005SUMMARYINFORMATION", "\u0005DOCUMENTSUMMARYINFORMATION"].includes(name.toUpperCase()))
             continue;
-        accountFormulaWork(bytes.length * 2);
-        metadataBytes += bytes.length * 2;
+        const range = propertyRange(bytes, context);
+        accountFormulaWork(range.size * 2);
+        metadataBytes += range.size * 2;
         if (metadataBytes > (context.limits.workbookTextBytes ?? context.limits.inputBytes * 2))
             throw new SsconvertError("resource-limit", "ssconvert BIFF metadata byte limit exceeded");
+        let hex = "";
+        for (let at = 0; at < range.size;) {
+            const chunk = await range.read(at, 16384);
+            at += chunk.length;
+            hex += Array.from(chunk, byte => byte.toString(16).padStart(2, "0")).join("");
+        }
         unsupported.push({ source: "biff", kind: "encrypted-ancillary", disposition: "retained",
-            data: { stream: accountText(name), bytes: accountText(Array.from(bytes, byte => byte.toString(16).padStart(2, "0")).join("")) } });
+            data: { stream: accountText(name), bytes: accountText(hex) } });
         await context.diagnostic?.({ code: "biff-loss-warning", severity: "warning", message: `BIFF encrypted ancillary stream ${name} retained without interpretation` });
     }
     const properties = propertyStreams ? await readBiffProperties(propertyStreams, context, accountText, accountFormulaWork, unsupported) : {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-bash",
-  "version": "0.1.809",
+  "version": "0.1.810",
   "description": "Extensible virtual shell with pluggable filesystems and streaming commands",
   "type": "module",
   "license": "MIT",
@@ -1407,7 +1407,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@poe-platform/safe-fs": "0.1.809",
+    "@poe-platform/safe-fs": "0.1.810",
     "pdf-lib": "1.17.1",
     "@types/node": "^25.2.2",
     "@formatjs/intl-numberformat": "9.4.0",
@@ -2748,6 +2748,7 @@
     "./dist/spreadsheet-engine/rendering/print/rotated-text.js",
     "./dist/spreadsheet-engine/rendering/print/settings.js",
     "./dist/spreadsheet-engine/rendering/print/shared-borders.js",
+    "./dist/spreadsheet-engine/rendering/print/tab-layout.js",
     "./dist/spreadsheet-engine/rendering/print/text-lines.js",
     "./dist/spreadsheet-engine/rendering/print/text-span.js",
     "./dist/spreadsheet-engine/rendering/print/wrap-lines.js",

package/dist/safe-bash/chunks/chunk-I2A5ZCPD.js

@@ -1,17 +0,0 @@
-// packages/safe-bash/src/commands/audio/index.ts
-import { audioCommands, createAudioCommand, createAudioCommands, createFfprobeCommand, createFfprobeCommands, createSoxCommand, createSoxCommands, createSoxiCommand, createSoxiCommands, ffprobeCommands, soxCommands, soxiCommands } from "../../safe-bash-command-audio/index.js";
-
-export {
-  audioCommands,
-  createAudioCommand,
-  createAudioCommands,
-  createFfprobeCommand,
-  createFfprobeCommands,
-  createSoxCommand,
-  createSoxCommands,
-  createSoxiCommand,
-  createSoxiCommands,
-  ffprobeCommands,
-  soxCommands,
-  soxiCommands
-};

package/dist/safe-bash/chunks/chunk-PQTT2EZP.js

@@ -1,8 +0,0 @@
-// packages/safe-bash/src/commands/ffprobe/index.ts
-import { createFfprobeCommand, createFfprobeCommands, ffprobeCommands } from "../../safe-bash-command-ffprobe/index.js";
-
-export {
-  createFfprobeCommand,
-  createFfprobeCommands,
-  ffprobeCommands
-};