@poe-platform/safe-bash 0.1.809 → 0.1.811

package/dist/spreadsheet-engine/rendering/print/bidi-runs.js

@@ -0,0 +1,35 @@
+import createBidi from "bidi-js";
+// The CommonJS factory is published with an ESM-shaped declaration.
+const bidi = createBidi();
+/** Visual run order with logical text retained for the font shaper. */
+export function printBidiRuns(text, direction, tick) {
+    // UAX #9 caps embedding depth at 125; reserve synchronous resolver work.
+    tick(text.length * 128);
+    if (!text)
+        return [];
+    const embedding = bidi.getEmbeddingLevels(text, direction);
+    const groups = [];
+    const membership = [];
+    let previous = -1;
+    for (let index = 0; index < text.length; index++) {
+        tick();
+        const level = embedding.levels[index];
+        if (level !== previous) {
+            groups.push({ text: "", direction: level % 2 ? "rtl" : "ltr" });
+            previous = level;
+        }
+        groups[groups.length - 1].text += text[index];
+        membership.push(groups.length - 1);
+    }
+    const seen = new Set();
+    const result = [];
+    for (const index of bidi.getReorderedIndices(text, embedding)) {
+        tick();
+        const group = membership[index];
+        if (!seen.has(group)) {
+            seen.add(group);
+            result.push(groups[group]);
+        }
+    }
+    return result;
+}

package/dist/spreadsheet-engine/rendering/print/control-bidi.d.ts

@@ -0,0 +1,8 @@
+/** Pango's single-paragraph FriBidi profile for mixed letter/tab/control runs. */
+export declare function controlBidiItems(text: string, direction: "ltr" | "rtl", tick: (amount?: number) => void): {
+    items: {
+        text: string;
+        direction: "ltr" | "rtl";
+    }[];
+    order: number[];
+} | undefined;

package/dist/spreadsheet-engine/rendering/print/control-bidi.js

@@ -0,0 +1,80 @@
+import createBidi from "bidi-js";
+const bidi = createBidi();
+/** Pango's single-paragraph FriBidi profile for mixed letter/tab/control runs. */
+export function controlBidiItems(text, direction, tick) {
+    tick(text.length * 128);
+    const types = Array.from(text, char => bidi.getBidiCharTypeName(char));
+    // Wider weak/neutral/explicit profiles need independent native qualification.
+    if (!types.includes("L") || !types.includes("R") || types.some(type => !["L", "R", "BN", "B", "S"].includes(type)))
+        return;
+    const levels = new Uint8Array(text.length);
+    let start = 0;
+    for (let index = 0; index <= text.length; index++) {
+        tick();
+        if (index < text.length && text[index] !== "\r" && text[index] !== "\u2029")
+            continue;
+        // FriBidi X8 stops explicit-level assignment at the first B. Later
+        // letters retain the initialized zero base before implicit resolution.
+        levels.set(bidi.getEmbeddingLevels(text.slice(start, index), start === 0 ? direction : "ltr").levels, start);
+        if (index < text.length)
+            levels[index] = direction === "rtl" ? 1 : 0;
+        start = index + 1;
+    }
+    // FriBidi L1 restores segment/paragraph separators to the original base.
+    let afterParagraph = false;
+    for (let index = 0; index < text.length; index++) {
+        tick();
+        if (text[index] === "\r" || text[index] === "\u2029")
+            afterParagraph = true;
+        if (afterParagraph && bidi.getBidiCharTypeName(text[index]) === "BN")
+            levels[index] = 0;
+        if (text[index] === "\t")
+            levels[index] = direction === "rtl" ? 1 : 0;
+    }
+    let reset = true;
+    for (let index = text.length - 1; index >= 0; index--) {
+        tick();
+        const char = text[index];
+        if (char === "\t" || char === "\r" || char === "\u2029")
+            reset = true;
+        else if (bidi.getBidiCharTypeName(char) !== "BN")
+            reset = false;
+        if (reset)
+            levels[index] = direction === "rtl" ? 1 : 0;
+    }
+    const items = [];
+    const itemLevels = [];
+    let previousControl = true;
+    for (let index = 0; index < text.length; index++) {
+        tick();
+        const char = text[index], level = levels[index];
+        const control = char === "\t" || char === "\r" || char === "\u2029";
+        if (control || previousControl || level !== itemLevels.at(-1)) {
+            items.push({ text: "", direction: level % 2 ? "rtl" : "ltr" });
+            itemLevels.push(level);
+        }
+        items.at(-1).text += char;
+        previousControl = control;
+    }
+    const order = items.map((_, index) => index);
+    const max = itemLevels.reduce((max, level) => Math.max(max, level), 0);
+    // Reorder the single rendered line, including controls, as Pango does.
+    for (let level = max; level >= 1; level--) {
+        for (let first = 0; first < order.length;) {
+            tick();
+            if (itemLevels[order[first]] < level) {
+                first++;
+                continue;
+            }
+            let last = first;
+            while (last < order.length && itemLevels[order[last]] >= level) {
+                tick();
+                last++;
+            }
+            for (let a = first, b = last - 1; a < b; a++, b--)
+                [order[a], order[b]] = [order[b], order[a]];
+            first = last;
+        }
+    }
+    return { items, order };
+}

package/dist/spreadsheet-engine/rendering/print/tab-layout.d.ts

@@ -0,0 +1,11 @@
+/** Pango default tabs leave at least one space before the next eight-space stop. */
+export declare function nextPrintTabStop(width: number, tabWidth: number): number;
+/** Mirror tab-run boxes without reversing the already-shaped glyphs inside each run. */
+export declare function mirrorPrintTabRuns(glyphs: {
+    x: number;
+}[], runs: readonly {
+    start: number;
+    end: number;
+    first: number;
+    last: number;
+}[], width: number, tick: () => void): void;

package/dist/spreadsheet-engine/rendering/print/tab-layout.js

@@ -0,0 +1,15 @@
+/** Pango default tabs leave at least one space before the next eight-space stop. */
+export function nextPrintTabStop(width, tabWidth) {
+    return Math.ceil((width + tabWidth / 8) / tabWidth) * tabWidth;
+}
+/** Mirror tab-run boxes without reversing the already-shaped glyphs inside each run. */
+export function mirrorPrintTabRuns(glyphs, runs, width, tick) {
+    for (const run of runs) {
+        tick();
+        const offset = width - run.end - run.start;
+        for (let index = run.first; index < run.last; index++) {
+            tick();
+            glyphs[index].x += offset;
+        }
+    }
+}

package/dist/spreadsheet-engine/rendering/print/text-lines.d.ts

@@ -5,5 +5,5 @@ export declare function splitPrintLines(value: string, tick: (amount?: number) =
 }[];
 /** Gnumeric displays LF inside Fill strings as a direction-aware return arrow. */
 export declare function fillPrintNewlines(value: string, rtl: boolean, tick: (amount?: number) => void): string;
-/** Keep shaping boundaries while painting single-direction Fill paragraphs in visual order. */
-export declare function fillPrintParagraphs(value: string, rtl: boolean, tick: (amount?: number) => void): string[];
+/** Keep shaping boundaries and control markers in single-direction Fill visual order. */
+export declare function fillPrintItems(value: string, rtl: boolean, tick: (amount?: number) => void): string[];

package/dist/spreadsheet-engine/rendering/print/text-lines.js

@@ -30,9 +30,9 @@ export function fillPrintNewlines(value, rtl, tick) {
     tick(value.length);
     return value.split("\n").join(rtl ? "↪" : "↩");
 }
-/** Keep shaping boundaries while painting single-direction Fill paragraphs in visual order. */
-export function fillPrintParagraphs(value, rtl, tick) {
+/** Keep shaping boundaries and control markers in single-direction Fill visual order. */
+export function fillPrintItems(value, rtl, tick) {
     tick(value.length);
-    const parts = value.split("\u2029");
+    const parts = value.split("\u2029").flatMap(part => ["\u2028", "\r"].reduce((parts, separator) => parts.flatMap(part => part.split(separator).flatMap((piece, index) => index ? [separator, piece] : [piece])), [part]));
     return rtl ? parts.reverse() : parts;
 }

package/dist/spreadsheet-format-xls/biff-encrypted-properties.d.ts

@@ -1,8 +1,12 @@
 import { type CapabilityContext, type RangeSource } from "../spreadsheet-engine/contracts.js";
+import type { BiffPropertySource } from "./biff-encrypted-properties-write.js";
 import type { BiffRc4Cipher } from "./biff-encryption.js";
 /** Admit the outer container and reject hidden plaintext property collisions
  * before asking for a password. POI emits an empty document-summary placeholder. */
-export declare function encryptedBiffPropertyStream(streams: ReadonlyMap<string, Uint8Array> | undefined, context: CapabilityContext, charge: (amount: number) => void, propertySources?: ReadonlyMap<string, RangeSource>): Promise<Uint8Array>;
+export declare function encryptedBiffPropertyStream(streams: ReadonlyMap<string, Uint8Array> | undefined, context: CapabilityContext, charge: (amount: number) => void, propertySources?: ReadonlyMap<string, RangeSource>): Promise<Uint8Array | RangeSource>;
 /** MS-OFFCRYPTO 2.3.5.4: header/table restart block 0; each payload restarts its
  * descriptor block. These are not Workbook's absolute-position 1024-byte chunks. */
 export declare function decryptBiffPropertyContainer(encrypted: Uint8Array, keyStream: (block: number, length: number) => Uint8Array, context: CapabilityContext, charge: (amount: number) => void, createCipher?: (block: number) => BiffRc4Cipher): ReadonlyMap<string, Uint8Array>;
+/** Decrypt retained ciphertext directly into caller storage. Only the descriptor
+ * table is buffered; payload plaintext never accumulates in RAM. */
+export declare function decryptBiffPropertySources(encrypted: Uint8Array | RangeSource, createCipher: (block: number) => BiffRc4Cipher, context: CapabilityContext, charge: (amount: number) => void): Promise<ReadonlyMap<string, BiffPropertySource>>;

package/dist/spreadsheet-format-xls/biff-encrypted-properties.js

@@ -1,4 +1,5 @@
 import { SsconvertError } from "../spreadsheet-engine/contracts.js";
+import { stagePropertyBytes } from "./biff-property-bytes.js";
 import { Binary, invalidBiff } from "./biff-binary.js";
 import { biffPropertyFormats } from "./biff-properties.js";
 import { propertyRange, readPropertySectionRanges, readPropertyValueRanges } from "./biff-property-range.js";
@@ -22,7 +23,8 @@ export async function encryptedBiffPropertyStream(streams, context, charge, prop
             invalidBiff("duplicate encrypted property stream");
         names.add(key);
         if (key === "ENCRYPTION") {
-            encrypted = bytes;
+            const input = propertySources?.get(name);
+            encrypted = input ? propertyRange(input, context) : bytes;
             continue;
         }
         const file = propertyRange(propertySources?.get(name) ?? bytes, context);
@@ -44,9 +46,11 @@ export async function encryptedBiffPropertyStream(streams, context, charge, prop
     }
     if (!encrypted)
         throw new SsconvertError("unsupported-feature", "Unsupported ssconvert feature: encrypted Excel workbook ancillary properties require the encryption stream");
-    if (encrypted.length > context.limits.inputBytes)
+    const length = encrypted instanceof Uint8Array ? encrypted.length : encrypted.size;
+    if (length > context.limits.inputBytes)
         throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
-    new Binary(encrypted).check(0, 8);
+    if (length < 8)
+        invalidBiff("truncated binary data");
     return encrypted;
 }
 /** MS-OFFCRYPTO 2.3.5.4: header/table restart block 0; each payload restarts its
@@ -100,60 +104,8 @@ export function decryptBiffPropertyContainer(encrypted, keyStream, context, char
         check();
         if (encrypted.length > context.limits.inputBytes)
             throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
-        const source = new Binary(encrypted), header = new Binary(decrypt(source.slice(0, 8), 0));
-        const offset = header.u32(0), size = header.u32(4);
-        header.bytes.fill(0);
-        if (offset < 8 || size < 4)
-            invalidBiff("invalid encrypted property descriptor range");
-        source.check(offset, size);
-        const table = new Binary(decrypt(source.slice(offset, size), 0)), count = table.u32(0);
-        if (count > Math.floor((size - 4) / 18))
-            invalidBiff("invalid encrypted property descriptor count");
-        if (count > (context.limits.workbookNodes ?? context.limits.inputBytes))
-            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property node limit exceeded");
-        charge(count);
-        let at = 4, textBytes = 0;
-        const descriptors = [], names = new Set();
-        for (let i = 0; i < count; i++) {
-            context.signal.throwIfAborted();
-            table.check(at, 18);
-            const start = table.u32(at), length = table.u32(at + 4), block = table.u16(at + 8), nameLength = table.u8(at + 10), flags = table.u8(at + 11);
-            if (flags !== 1 || table.u32(at + 12) !== 0)
-                invalidBiff("invalid encrypted property descriptor flags");
-            at += 16;
-            if (!nameLength || nameLength > 31)
-                invalidBiff("invalid encrypted property stream name");
-            table.check(at, (nameLength + 1) * 2);
-            charge(nameLength);
-            if (table.u16(at + nameLength * 2) !== 0)
-                invalidBiff("unterminated encrypted property stream name");
-            textBytes += nameLength * 3;
-            if (textBytes > (context.limits.workbookTextBytes ?? context.limits.inputBytes))
-                throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property text limit exceeded");
-            let name;
-            try {
-                name = new TextDecoder("utf-16le", { fatal: true, ignoreBOM: true }).decode(table.slice(at, nameLength * 2));
-            }
-            catch {
-                invalidBiff("invalid encrypted property stream name");
-            }
-            if (name.includes("\0") || names.has(name.toUpperCase()))
-                invalidBiff("duplicate or invalid encrypted property stream name");
-            names.add(name.toUpperCase());
-            at += (nameLength + 1) * 2;
-            source.check(start, length);
-            if (start < 8 || start < offset + size && start + length > offset)
-                invalidBiff("overlapping encrypted property ranges");
-            descriptors.push({ offset: start, size: length, block, name });
-        }
-        if (at !== size)
-            invalidBiff("invalid encrypted property descriptor size");
-        table.bytes.fill(0);
-        charge(count * Math.ceil(Math.log2(count + 1)));
-        const ordered = [...descriptors].sort((a, b) => a.offset - b.offset);
-        for (let i = 1; i < ordered.length; i++)
-            if (ordered[i].offset < ordered[i - 1].offset + ordered[i - 1].size)
-                invalidBiff("overlapping encrypted property payloads");
+        const source = new Binary(encrypted), { offset, size } = propertyTableRange(decrypt(source.slice(0, 8), 0), source);
+        const descriptors = readEncryptedPropertyDescriptors(source, offset, size, decrypt(source.slice(offset, size), 0), context, charge);
         for (const entry of descriptors)
             result.set(entry.name, decrypt(source.slice(entry.offset, entry.size), entry.block));
         return result;
@@ -163,3 +115,145 @@ export function decryptBiffPropertyContainer(encrypted, keyStream, context, char
         throw error;
     }
 }
+function propertyTableRange(bytes, source) {
+    const header = new Binary(bytes), offset = header.u32(0), size = header.u32(4);
+    bytes.fill(0);
+    if (offset < 8 || size < 4)
+        invalidBiff("invalid encrypted property descriptor range");
+    source.check(offset, size);
+    return { offset, size };
+}
+function readEncryptedPropertyDescriptors(source, offset, size, bytes, context, charge) {
+    const table = new Binary(bytes), count = table.u32(0);
+    if (count > Math.floor((size - 4) / 18))
+        invalidBiff("invalid encrypted property descriptor count");
+    if (count > (context.limits.workbookNodes ?? context.limits.inputBytes))
+        throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property node limit exceeded");
+    charge(count);
+    let at = 4, textBytes = 0;
+    const descriptors = [], names = new Set();
+    for (let i = 0; i < count; i++) {
+        context.signal.throwIfAborted();
+        table.check(at, 18);
+        const start = table.u32(at), length = table.u32(at + 4), block = table.u16(at + 8), nameLength = table.u8(at + 10), flags = table.u8(at + 11);
+        if (flags !== 1 || table.u32(at + 12) !== 0)
+            invalidBiff("invalid encrypted property descriptor flags");
+        at += 16;
+        if (!nameLength || nameLength > 31)
+            invalidBiff("invalid encrypted property stream name");
+        table.check(at, (nameLength + 1) * 2);
+        charge(nameLength);
+        if (table.u16(at + nameLength * 2) !== 0)
+            invalidBiff("unterminated encrypted property stream name");
+        textBytes += nameLength * 3;
+        if (textBytes > (context.limits.workbookTextBytes ?? context.limits.inputBytes))
+            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property text limit exceeded");
+        let name;
+        try {
+            name = new TextDecoder("utf-16le", { fatal: true, ignoreBOM: true }).decode(table.slice(at, nameLength * 2));
+        }
+        catch {
+            invalidBiff("invalid encrypted property stream name");
+        }
+        if (name.includes("\0") || names.has(name.toUpperCase()))
+            invalidBiff("duplicate or invalid encrypted property stream name");
+        names.add(name.toUpperCase());
+        at += (nameLength + 1) * 2;
+        source.check(start, length);
+        if (start < 8 || start < offset + size && start + length > offset)
+            invalidBiff("overlapping encrypted property ranges");
+        descriptors.push({ offset: start, size: length, block, name });
+    }
+    if (at !== size)
+        invalidBiff("invalid encrypted property descriptor size");
+    table.bytes.fill(0);
+    charge(count * Math.ceil(Math.log2(count + 1)));
+    const ordered = [...descriptors].sort((a, b) => a.offset - b.offset);
+    for (let i = 1; i < ordered.length; i++)
+        if (ordered[i].offset < ordered[i - 1].offset + ordered[i - 1].size)
+            invalidBiff("overlapping encrypted property payloads");
+    return descriptors;
+}
+/** Decrypt retained ciphertext directly into caller storage. Only the descriptor
+ * table is buffered; payload plaintext never accumulates in RAM. */
+export async function decryptBiffPropertySources(encrypted, createCipher, context, charge) {
+    const result = new Map(), owned = [];
+    const input = propertyRange(encrypted, context);
+    let closed = false;
+    const check = () => { context.signal.throwIfAborted(); if (closed)
+        throw new SsconvertError("invalid-request", "Encrypted BIFF property reader disposed"); };
+    const close = async () => {
+        closed = true;
+        for (const bytes of owned)
+            bytes.fill(0);
+        const outcomes = await Promise.allSettled([...result.values()].map(source => source.close()));
+        result.clear();
+        const errors = outcomes.filter((value) => value.status === "rejected").map(value => value.reason);
+        if (errors.length)
+            throw new AggregateError(errors, "Encrypted BIFF property cleanup failed");
+    };
+    context.own(close);
+    async function* chunks(offset, size, block) {
+        check();
+        input.check(offset, size);
+        charge(size * 2 + 320);
+        const cipher = createCipher(block);
+        try {
+            check();
+            for (let at = 0; at < size;) {
+                const output = await input.read(offset + at, Math.min(16384, size - at), { signal: context.signal });
+                at += output.length;
+                try {
+                    cipher.xor(output);
+                    check();
+                    yield output;
+                    check();
+                }
+                finally {
+                    output.fill(0);
+                }
+            }
+        }
+        finally {
+            cipher.close();
+        }
+    }
+    try {
+        check();
+        if (input.size > context.limits.inputBytes)
+            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
+        const decrypt = async (offset, size) => {
+            input.check(offset, size);
+            const output = new Uint8Array(size);
+            owned.push(output);
+            let at = 0;
+            for await (const part of chunks(offset, size, 0)) {
+                output.set(part, at);
+                at += part.length;
+            }
+            return output;
+        };
+        const { offset, size } = propertyTableRange(await decrypt(0, 8), input);
+        const descriptors = readEncryptedPropertyDescriptors(input, offset, size, await decrypt(offset, size), context, charge);
+        for (const entry of descriptors) {
+            const source = await stagePropertyBytes({ length: entry.size, chunks: () => chunks(entry.offset, entry.size, entry.block) }, context, context.limits.inputBytes);
+            result.set(entry.name, source);
+            check();
+        }
+        return result;
+    }
+    catch (error) {
+        try {
+            await close();
+        }
+        catch (cleanup) {
+            throw new AggregateError([error, cleanup], "Encrypted BIFF property read and cleanup failed");
+        }
+        throw error;
+    }
+    finally {
+        for (const bytes of owned)
+            bytes.fill(0);
+        owned.length = 0;
+    }
+}

package/dist/spreadsheet-format-xls/biff-encryption.d.ts

@@ -12,4 +12,4 @@ export declare function createRc4Cipher(key: Uint8Array, context: CapabilityCont
 /** Buffering convenience for the bounded record blocks and legacy readers. */
 export declare function rc4Stream(key: Uint8Array, length: number, context: CapabilityContext): Uint8Array;
 /** Decode admitted XOR/RC4 profiles; optional secret acquisition is explicit host authority. */
-export declare function decryptBiffRecords(records: BiffRecords, revision: number, context: CapabilityContext, streams?: ReadonlyMap<string, Uint8Array>, propertySources?: ReadonlyMap<string, RangeSource>): Promise<ReadonlyMap<string, Uint8Array> | undefined>;
+export declare function decryptBiffRecords(records: BiffRecords, revision: number, context: CapabilityContext, streams?: ReadonlyMap<string, Uint8Array>, propertySources?: ReadonlyMap<string, RangeSource>): Promise<ReadonlyMap<string, Uint8Array | RangeSource> | undefined>;

package/dist/spreadsheet-format-xls/biff-encryption.js

@@ -1,7 +1,7 @@
 import { biffRecord } from "./biff-record-storage.js";
 import { SsconvertError } from "../spreadsheet-engine/contracts.js";
 import { Binary, invalidBiff } from "./biff-binary.js";
-import { decryptBiffPropertyContainer, encryptedBiffPropertyStream } from "./biff-encrypted-properties.js";
+import { decryptBiffPropertyContainer, decryptBiffPropertySources, encryptedBiffPropertyStream } from "./biff-encrypted-properties.js";
 import { md5, sha1 } from "@noble/hashes/legacy.js";
 /** MS-OFFCRYPTO legacy interoperability only; RC4 provides no authentication.
  * The caller closes each stream before releasing its key lifetime. Only the
@@ -327,7 +327,9 @@ export async function decryptBiffRecords(records, revision, context, streams, pr
                     decoded.fill(0);
             }
         }
-        return properties ? decryptBiffPropertyContainer(properties, keyStream, context, admit, number => {
+        if (!properties)
+            return undefined;
+        const createCipher = (number) => {
             const key = blockKey(number);
             try {
                 return createRc4Cipher(key, context);
@@ -335,7 +337,10 @@ export async function decryptBiffRecords(records, revision, context, streams, pr
             finally {
                 key.fill(0);
             }
-        }) : undefined;
+        };
+        // Staging must finish while the block-key base still exists.
+        return context.createWorkingStorage || !(properties instanceof Uint8Array) ? await decryptBiffPropertySources(properties, createCipher, context, admit) :
+            decryptBiffPropertyContainer(properties, keyStream, context, admit, createCipher);
     }
     catch (error) {
         for (const bytes of decodedBuffers)

package/dist/spreadsheet-format-xls/biff-property-bytes.d.ts

@@ -6,4 +6,7 @@ export type BiffPropertyBytes = Uint8Array | {
 };
 export declare function propertyChunks(value: BiffPropertyBytes): Iterable<Uint8Array>;
 /** Consume lazy serialization once into caller storage; never retain emitted chunks. */
-export declare function stagePropertyBytes(value: BiffPropertyBytes, context: CapabilityContext): Promise<BiffPropertySource>;
+export declare function stagePropertyBytes(value: BiffPropertyBytes | {
+    readonly length: number;
+    chunks(): AsyncIterable<Uint8Array>;
+}, context: CapabilityContext, maximumBytes?: number): Promise<BiffPropertySource>;

package/dist/spreadsheet-format-xls/biff-property-bytes.js

@@ -8,9 +8,9 @@ export function* propertyChunks(value) {
         yield* value.chunks();
 }
 /** Consume lazy serialization once into caller storage; never retain emitted chunks. */
-export async function stagePropertyBytes(value, context) {
+export async function stagePropertyBytes(value, context, maximumBytes = context.limits.outputBytes) {
     context.signal.throwIfAborted();
-    if (!Number.isSafeInteger(value.length) || value.length < 0 || value.length > context.limits.outputBytes)
+    if (!Number.isSafeInteger(value.length) || value.length < 0 || value.length > maximumBytes)
         throw new SsconvertError('resource-limit', 'Invalid BIFF property serialization size');
     const acquire = context.createWorkingStorage?.bind(context);
     if (!acquire)
@@ -61,7 +61,7 @@ export async function stagePropertyBytes(value, context) {
                 count = 0;
             };
             try {
-                for (const part of propertyChunks(value)) {
+                for await (const part of value instanceof Uint8Array ? propertyChunks(value) : value.chunks()) {
                     check();
                     if (part.length > source.size - written - count)
                         throw new SsconvertError('io', 'Invalid BIFF property serialization size');

package/dist/spreadsheet-format-xls/biff-range.js

@@ -100,7 +100,7 @@ export async function readBiffRange(input, context, probe = false) {
                 // Only these ancillary payloads are interpreted by the existing reader.
                 // Keep other names for its name/work admission, without copying ignored streams.
                 const needed = ["ENCRYPTION", "\u0005SUMMARYINFORMATION", "\u0005DOCUMENTSUMMARYINFORMATION"].includes(name.toUpperCase());
-                if (needed && name.toUpperCase() !== "ENCRYPTION" && recordStore) {
+                if (needed && recordStore) {
                     propertySources.set(name, { size: stream.size, async read(at, count, options) {
                             try {
                                 return await stream.read(at, count, options);

package/dist/spreadsheet-format-xls/biff.js

@@ -1,3 +1,4 @@
+import { propertyRange } from "./biff-property-range.js";
 import { BiffStagedOutput } from "./biff-staged-output.js";
 import { createBiffCatalogs } from "./biff-catalogs.js";
 import { biffFillPatterns } from "./biff-fill-patterns.js";
@@ -1348,12 +1349,19 @@ async function readBiffContents(records, streamSize, streams, context, encoding,
     for (const [name, bytes] of decryptedProperties ?? []) {
         if (["\u0005SUMMARYINFORMATION", "\u0005DOCUMENTSUMMARYINFORMATION"].includes(name.toUpperCase()))
             continue;
-        accountFormulaWork(bytes.length * 2);
-        metadataBytes += bytes.length * 2;
+        const range = propertyRange(bytes, context);
+        accountFormulaWork(range.size * 2);
+        metadataBytes += range.size * 2;
         if (metadataBytes > (context.limits.workbookTextBytes ?? context.limits.inputBytes * 2))
             throw new SsconvertError("resource-limit", "ssconvert BIFF metadata byte limit exceeded");
+        let hex = "";
+        for (let at = 0; at < range.size;) {
+            const chunk = await range.read(at, 16384);
+            at += chunk.length;
+            hex += Array.from(chunk, byte => byte.toString(16).padStart(2, "0")).join("");
+        }
         unsupported.push({ source: "biff", kind: "encrypted-ancillary", disposition: "retained",
-            data: { stream: accountText(name), bytes: accountText(Array.from(bytes, byte => byte.toString(16).padStart(2, "0")).join("")) } });
+            data: { stream: accountText(name), bytes: accountText(hex) } });
         await context.diagnostic?.({ code: "biff-loss-warning", severity: "warning", message: `BIFF encrypted ancillary stream ${name} retained without interpretation` });
     }
     const properties = propertyStreams ? await readBiffProperties(propertyStreams, context, accountText, accountFormulaWork, unsupported) : {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-bash",
-  "version": "0.1.809",
+  "version": "0.1.811",
   "description": "Extensible virtual shell with pluggable filesystems and streaming commands",
   "type": "module",
   "license": "MIT",
@@ -1407,7 +1407,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@poe-platform/safe-fs": "0.1.809",
+    "@poe-platform/safe-fs": "0.1.811",
     "pdf-lib": "1.17.1",
     "@types/node": "^25.2.2",
     "@formatjs/intl-numberformat": "9.4.0",
@@ -1420,6 +1420,7 @@
     "parse5": "7.3.0",
     "@pdf-lib/fontkit": "1.1.1",
     "linebreak": "^1.1.0",
+    "bidi-js": "1.1.0",
     "saxes": "^6.0.0",
     "temporal-polyfill": "1.0.4",
     "@formatjs/intl-localematcher": "0.8.13",
@@ -2729,9 +2730,11 @@
     "./dist/spreadsheet-engine/rendering/images/index.js",
     "./dist/spreadsheet-engine/rendering/images/profile-raster.js",
     "./dist/spreadsheet-engine/rendering/images/scene.js",
+    "./dist/spreadsheet-engine/rendering/print/bidi-runs.js",
     "./dist/spreadsheet-engine/rendering/print/blank-styles.js",
     "./dist/spreadsheet-engine/rendering/print/border-junctions.js",
     "./dist/spreadsheet-engine/rendering/print/cell-style.js",
+    "./dist/spreadsheet-engine/rendering/print/control-bidi.js",
     "./dist/spreadsheet-engine/rendering/print/diagonal-borders.js",
     "./dist/spreadsheet-engine/rendering/print/font-normalization-data.js",
     "./dist/spreadsheet-engine/rendering/print/font-normalization.js",
@@ -2748,6 +2751,7 @@
     "./dist/spreadsheet-engine/rendering/print/rotated-text.js",
     "./dist/spreadsheet-engine/rendering/print/settings.js",
     "./dist/spreadsheet-engine/rendering/print/shared-borders.js",
+    "./dist/spreadsheet-engine/rendering/print/tab-layout.js",
     "./dist/spreadsheet-engine/rendering/print/text-lines.js",
     "./dist/spreadsheet-engine/rendering/print/text-span.js",
     "./dist/spreadsheet-engine/rendering/print/wrap-lines.js",

package/dist/safe-bash/chunks/chunk-I2A5ZCPD.js

@@ -1,17 +0,0 @@
-// packages/safe-bash/src/commands/audio/index.ts
-import { audioCommands, createAudioCommand, createAudioCommands, createFfprobeCommand, createFfprobeCommands, createSoxCommand, createSoxCommands, createSoxiCommand, createSoxiCommands, ffprobeCommands, soxCommands, soxiCommands } from "../../safe-bash-command-audio/index.js";
-
-export {
-  audioCommands,
-  createAudioCommand,
-  createAudioCommands,
-  createFfprobeCommand,
-  createFfprobeCommands,
-  createSoxCommand,
-  createSoxCommands,
-  createSoxiCommand,
-  createSoxiCommands,
-  ffprobeCommands,
-  soxCommands,
-  soxiCommands
-};

package/dist/safe-bash/chunks/chunk-PQTT2EZP.js

@@ -1,8 +0,0 @@
-// packages/safe-bash/src/commands/ffprobe/index.ts
-import { createFfprobeCommand, createFfprobeCommands, ffprobeCommands } from "../../safe-bash-command-ffprobe/index.js";
-
-export {
-  createFfprobeCommand,
-  createFfprobeCommands,
-  ffprobeCommands
-};