@rowsncolumns/utils 9.2.35 → 9.2.37

package/dist/cjs/formatter.d.ts

@@ -17,6 +17,12 @@ export declare const isDatePattern: (pattern: string | undefined | null) => bool
 export declare const isDateTimePattern: (pattern: string | undefined | null) => boolean;
 export declare const isTimePattern: (pattern: string | undefined | null) => boolean;
 export declare const isTextPattern: (pattern: string | undefined | null) => boolean;
+/**
+ * Does the pattern spell a month name (`mmm`+) with no day-of-month field
+ * (`d`/`dd`) beside it? Quoted literals, bracket directives and escaped
+ * characters are skipped; `ddd`/`dddd` are weekday names, not a day.
+ */
+export declare const isStandaloneMonthPattern: (pattern: string) => boolean;
 export declare const ssfFormat: (pattern: string, value: any, locale?: string) => string;
 export declare const ssfFormatColor: (pattern: string, value: any) => string | undefined;
 //# sourceMappingURL=formatter.d.ts.map

package/dist/cjs/formatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../formatter.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OASlE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KACjC,OAWF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAWlE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAOlE,CAAC;AAMF,eAAO,MAAM,SAAS,GACpB,SAAS,MAAM,EACf,OAAO,GAAG,EACV,SAAS,MAAM,KACd,MAeF,CAAC;AAmLF,eAAO,MAAM,cAAc,GACzB,SAAS,MAAM,EACf,OAAO,GAAG,KACT,MAAM,GAAG,SAoBX,CAAC"}
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../formatter.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OASlE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KACjC,OAWF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAWlE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAOlE,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,KAAG,OA4B1D,CAAC;AA8EF,eAAO,MAAM,SAAS,GACpB,SAAS,MAAM,EACf,OAAO,GAAG,EACV,SAAS,MAAM,KACd,MAeF,CAAC;AAmLF,eAAO,MAAM,cAAc,GACzB,SAAS,MAAM,EACf,OAAO,GAAG,KACT,MAAM,GAAG,SAoBX,CAAC"}

package/dist/cjs/formatter.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ssfFormatColor = exports.ssfFormat = exports.isTextPattern = exports.isTimePattern = exports.isDateTimePattern = exports.isDatePattern = void 0;
+exports.ssfFormatColor = exports.ssfFormat = exports.isStandaloneMonthPattern = exports.isTextPattern = exports.isTimePattern = exports.isDateTimePattern = exports.isDatePattern = void 0;
+var tslib_1 = require("tslib");
 var numfmt_1 = require("numfmt");
 var colors_1 = require("./colors");
 /**
@@ -79,12 +80,120 @@ var isSingleSectionElapsedTimePattern = function (pattern) {
     return !pattern.includes(";") &&
         /\[(?:h+|m+|s+)\]/i.test(pattern.replace(/\[\$[^\]]+\]/g, ""));
 };
+/**
+ * Does the pattern spell a month name (`mmm`+) with no day-of-month field
+ * (`d`/`dd`) beside it? Quoted literals, bracket directives and escaped
+ * characters are skipped; `ddd`/`dddd` are weekday names, not a day.
+ */
+var isStandaloneMonthPattern = function (pattern) {
+    var _a;
+    var hasMonthName = false;
+    var hasDay = false;
+    var inQuotes = false;
+    var inBrackets = false;
+    for (var i = 0; i < pattern.length; i++) {
+        var char = pattern[i];
+        if (inQuotes) {
+            inQuotes = char !== '"';
+        }
+        else if (inBrackets) {
+            inBrackets = char !== "]";
+        }
+        else if (char === '"') {
+            inQuotes = true;
+        }
+        else if (char === "[") {
+            inBrackets = true;
+        }
+        else if (char === "\\" || char === "_" || char === "*") {
+            i++;
+        }
+        else {
+            var field = char.toLowerCase();
+            if (field !== "m" && field !== "d")
+                continue;
+            var run = 1;
+            while (((_a = pattern[i + run]) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === field)
+                run++;
+            if (field === "m")
+                hasMonthName || (hasMonthName = run >= 3);
+            else
+                hasDay || (hasDay = run <= 2);
+            i += run - 1;
+        }
+    }
+    return hasMonthName && !hasDay;
+};
+exports.isStandaloneMonthPattern = isStandaloneMonthPattern;
+var standaloneMonthPatternCache = new Map();
+/**
+ * Languages whose standalone month names Excel/Windows title-case ("Январь",
+ * "Січень") while the in-date forms stay lowercase ("1 января"). Intl keeps
+ * both lowercase, so the standalone table is capitalized for these; Latin-
+ * script inflecting locales (pl, cs, fi, …) stay lowercase, as Excel shows
+ * them.
+ */
+var TITLE_CASED_STANDALONE_MONTHS = new Set(["ru", "uk", "be"]);
+var intlMonthNames = function (locale, options) {
+    var formatter = new Intl.DateTimeFormat(locale, tslib_1.__assign(tslib_1.__assign({}, options), { timeZone: "UTC" }));
+    return Array.from({ length: 12 }, function (_, month) {
+        var _a, _b;
+        return (_b = (_a = formatter
+            .formatToParts(new Date(Date.UTC(2020, month, 1)))
+            .find(function (part) { return part.type === "month"; })) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : "";
+    });
+};
+var standaloneMonthLocales = new Map();
+/**
+ * numfmt ships one month-name table per locale: the form used beside a day
+ * number, which in inflecting languages is the genitive (ru "сентября" as in
+ * "1 сентября 2026"). A month shown without a day ("Сентябрь 2026") takes the
+ * standalone/nominative form, so those locales get a companion numfmt locale
+ * carrying the standalone names. Undefined where the names don't inflect.
+ */
+var getStandaloneMonthLocale = function (locale) {
+    if (standaloneMonthLocales.has(locale)) {
+        return standaloneMonthLocales.get(locale);
+    }
+    var overlay;
+    try {
+        var base = (0, numfmt_1.getLocale)(locale);
+        var standalone = intlMonthNames(locale, { month: "long" });
+        var withDay_1 = intlMonthNames(locale, { day: "numeric", month: "long" });
+        if (base && standalone.some(function (name, month) { return name !== withDay_1[month]; })) {
+            var language_1 = new Intl.Locale(locale).language;
+            var titleCase = function (name) {
+                return TITLE_CASED_STANDALONE_MONTHS.has(language_1)
+                    ? name.charAt(0).toLocaleUpperCase(locale) + name.slice(1)
+                    : name;
+            };
+            overlay = "standalone_".concat(locale.replace(/[^a-z\d]/gi, ""));
+            (0, numfmt_1.addLocale)(tslib_1.__assign(tslib_1.__assign({}, base), { mmmm: standalone.map(titleCase), mmm: intlMonthNames(locale, { month: "short" }).map(titleCase) }), overlay);
+        }
+    }
+    catch (_a) {
+        // Unknown locale: keep numfmt's own table.
+    }
+    standaloneMonthLocales.set(locale, overlay);
+    return overlay;
+};
+var localeForPattern = function (pattern, locale) {
+    var _a;
+    if (!locale)
+        return locale;
+    var standalone = standaloneMonthPatternCache.get(pattern);
+    if (standalone === undefined) {
+        standalone = (0, exports.isStandaloneMonthPattern)(pattern);
+        standaloneMonthPatternCache.set(pattern, standalone);
+    }
+    return standalone ? ((_a = getStandaloneMonthLocale(locale)) !== null && _a !== void 0 ? _a : locale) : locale;
+};
 var ssfFormat = function (pattern, value, locale) {
     try {
         var isNegativeElapsedTime = typeof value === "number" &&
             value < 0 &&
             isSingleSectionElapsedTimePattern(pattern);
-        var formatted = (0, numfmt_1.format)(pattern, isNegativeElapsedTime ? Math.abs(value) : value, { locale: locale });
+        var formatted = (0, numfmt_1.format)(pattern, isNegativeElapsedTime ? Math.abs(value) : value, { locale: localeForPattern(pattern, locale) });
         return isNegativeElapsedTime ? "-".concat(formatted) : formatted;
     }
     catch (err) {

package/dist/cjs/sort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sort.d.ts","sourceRoot":"","sources":["../../sort.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,SAAS,EACnD,QAAQ,CAAC,EAAE,EACX,gBAAgB,OAAO;;IA0CxB,CAAC"}
+{"version":3,"file":"sort.d.ts","sourceRoot":"","sources":["../../sort.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,SAAS,EACnD,QAAQ,CAAC,EAAE,EACX,gBAAgB,OAAO;;IAwCxB,CAAC"}

package/dist/cjs/sort.js

@@ -10,9 +10,7 @@ var tslib_1 = require("tslib");
 var sortSheetsByIndex = function (sheets, includeHidden) {
     var filtered = sheets
         .filter(Boolean)
-        .filter(function (sheet) {
-        return includeHidden ? sheet.title : !sheet.hidden && sheet.title;
-    });
+        .filter(function (sheet) { return includeHidden || !sheet.hidden; });
     // Remove duplicate sheets with the same sheetId, keeping only the first occurrence
     var seen = new Set();
     var deduplicated = filtered.filter(function (sheet) {

package/dist/cjs/string.d.ts

@@ -64,9 +64,16 @@ export declare const supplant: (s: string, o: Record<string, any>) => string;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */

package/dist/cjs/string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAKF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAY/C,CAAC"}
+{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}

package/dist/cjs/string.js

@@ -213,21 +213,40 @@ var supplant = function (s, o) {
 };
 exports.supplant = supplant;
 // RFC 3986 scheme: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) ":"
-var URL_SCHEME = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+var URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
+// Schemes an external hyperlink is allowed to carry. Anything else with an
+// explicit scheme (javascript:, data:, vbscript:, …) is a script/content
+// injection vector and is rejected.
+var SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */
 var normalizeExternalUrl = function (url) {
-    var trimmed = url.trim();
-    if (!trimmed ||
-        URL_SCHEME.test(trimmed) ||
-        trimmed.startsWith("//") ||
+    var trimmed = url
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return "";
+    }
+    var schemeMatch = URL_SCHEME.exec(trimmed);
+    if (schemeMatch) {
+        return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase()) ? trimmed : "";
+    }
+    if (trimmed.startsWith("//") ||
         trimmed.startsWith("#") ||
         trimmed.startsWith("/")) {
         return trimmed;

package/dist/esm/formatter.d.ts

@@ -17,6 +17,12 @@ export declare const isDatePattern: (pattern: string | undefined | null) => bool
 export declare const isDateTimePattern: (pattern: string | undefined | null) => boolean;
 export declare const isTimePattern: (pattern: string | undefined | null) => boolean;
 export declare const isTextPattern: (pattern: string | undefined | null) => boolean;
+/**
+ * Does the pattern spell a month name (`mmm`+) with no day-of-month field
+ * (`d`/`dd`) beside it? Quoted literals, bracket directives and escaped
+ * characters are skipped; `ddd`/`dddd` are weekday names, not a day.
+ */
+export declare const isStandaloneMonthPattern: (pattern: string) => boolean;
 export declare const ssfFormat: (pattern: string, value: any, locale?: string) => string;
 export declare const ssfFormatColor: (pattern: string, value: any) => string | undefined;
 //# sourceMappingURL=formatter.d.ts.map

package/dist/esm/formatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../formatter.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OASlE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KACjC,OAWF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAWlE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAOlE,CAAC;AAMF,eAAO,MAAM,SAAS,GACpB,SAAS,MAAM,EACf,OAAO,GAAG,EACV,SAAS,MAAM,KACd,MAeF,CAAC;AAmLF,eAAO,MAAM,cAAc,GACzB,SAAS,MAAM,EACf,OAAO,GAAG,KACT,MAAM,GAAG,SAoBX,CAAC"}
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../formatter.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OASlE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KACjC,OAWF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAWlE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAOlE,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,KAAG,OA4B1D,CAAC;AA8EF,eAAO,MAAM,SAAS,GACpB,SAAS,MAAM,EACf,OAAO,GAAG,EACV,SAAS,MAAM,KACd,MAeF,CAAC;AAmLF,eAAO,MAAM,cAAc,GACzB,SAAS,MAAM,EACf,OAAO,GAAG,KACT,MAAM,GAAG,SAoBX,CAAC"}

package/dist/esm/formatter.js

@@ -1,4 +1,4 @@
-import { format, formatColor, getFormatDateInfo, isDateFormat, isTextFormat, } from "numfmt";
+import { addLocale, format, formatColor, getFormatDateInfo, getLocale, isDateFormat, isTextFormat, } from "numfmt";
 import { IndexedColors } from "./colors";
 /**
  * Pattern-based type inference (Excel parity). xlsx files routinely carry
@@ -70,12 +70,119 @@ export const isTextPattern = (pattern) => {
 };
 const isSingleSectionElapsedTimePattern = (pattern) => !pattern.includes(";") &&
     /\[(?:h+|m+|s+)\]/i.test(pattern.replace(/\[\$[^\]]+\]/g, ""));
+/**
+ * Does the pattern spell a month name (`mmm`+) with no day-of-month field
+ * (`d`/`dd`) beside it? Quoted literals, bracket directives and escaped
+ * characters are skipped; `ddd`/`dddd` are weekday names, not a day.
+ */
+export const isStandaloneMonthPattern = (pattern) => {
+    let hasMonthName = false;
+    let hasDay = false;
+    let inQuotes = false;
+    let inBrackets = false;
+    for (let i = 0; i < pattern.length; i++) {
+        const char = pattern[i];
+        if (inQuotes) {
+            inQuotes = char !== '"';
+        }
+        else if (inBrackets) {
+            inBrackets = char !== "]";
+        }
+        else if (char === '"') {
+            inQuotes = true;
+        }
+        else if (char === "[") {
+            inBrackets = true;
+        }
+        else if (char === "\\" || char === "_" || char === "*") {
+            i++;
+        }
+        else {
+            const field = char.toLowerCase();
+            if (field !== "m" && field !== "d")
+                continue;
+            let run = 1;
+            while (pattern[i + run]?.toLowerCase() === field)
+                run++;
+            if (field === "m")
+                hasMonthName ||= run >= 3;
+            else
+                hasDay ||= run <= 2;
+            i += run - 1;
+        }
+    }
+    return hasMonthName && !hasDay;
+};
+const standaloneMonthPatternCache = new Map();
+/**
+ * Languages whose standalone month names Excel/Windows title-case ("Январь",
+ * "Січень") while the in-date forms stay lowercase ("1 января"). Intl keeps
+ * both lowercase, so the standalone table is capitalized for these; Latin-
+ * script inflecting locales (pl, cs, fi, …) stay lowercase, as Excel shows
+ * them.
+ */
+const TITLE_CASED_STANDALONE_MONTHS = new Set(["ru", "uk", "be"]);
+const intlMonthNames = (locale, options) => {
+    const formatter = new Intl.DateTimeFormat(locale, {
+        ...options,
+        timeZone: "UTC",
+    });
+    return Array.from({ length: 12 }, (_, month) => formatter
+        .formatToParts(new Date(Date.UTC(2020, month, 1)))
+        .find((part) => part.type === "month")?.value ?? "");
+};
+const standaloneMonthLocales = new Map();
+/**
+ * numfmt ships one month-name table per locale: the form used beside a day
+ * number, which in inflecting languages is the genitive (ru "сентября" as in
+ * "1 сентября 2026"). A month shown without a day ("Сентябрь 2026") takes the
+ * standalone/nominative form, so those locales get a companion numfmt locale
+ * carrying the standalone names. Undefined where the names don't inflect.
+ */
+const getStandaloneMonthLocale = (locale) => {
+    if (standaloneMonthLocales.has(locale)) {
+        return standaloneMonthLocales.get(locale);
+    }
+    let overlay;
+    try {
+        const base = getLocale(locale);
+        const standalone = intlMonthNames(locale, { month: "long" });
+        const withDay = intlMonthNames(locale, { day: "numeric", month: "long" });
+        if (base && standalone.some((name, month) => name !== withDay[month])) {
+            const language = new Intl.Locale(locale).language;
+            const titleCase = (name) => TITLE_CASED_STANDALONE_MONTHS.has(language)
+                ? name.charAt(0).toLocaleUpperCase(locale) + name.slice(1)
+                : name;
+            overlay = `standalone_${locale.replace(/[^a-z\d]/gi, "")}`;
+            addLocale({
+                ...base,
+                mmmm: standalone.map(titleCase),
+                mmm: intlMonthNames(locale, { month: "short" }).map(titleCase),
+            }, overlay);
+        }
+    }
+    catch {
+        // Unknown locale: keep numfmt's own table.
+    }
+    standaloneMonthLocales.set(locale, overlay);
+    return overlay;
+};
+const localeForPattern = (pattern, locale) => {
+    if (!locale)
+        return locale;
+    let standalone = standaloneMonthPatternCache.get(pattern);
+    if (standalone === undefined) {
+        standalone = isStandaloneMonthPattern(pattern);
+        standaloneMonthPatternCache.set(pattern, standalone);
+    }
+    return standalone ? (getStandaloneMonthLocale(locale) ?? locale) : locale;
+};
 export const ssfFormat = (pattern, value, locale) => {
     try {
         const isNegativeElapsedTime = typeof value === "number" &&
             value < 0 &&
             isSingleSectionElapsedTimePattern(pattern);
-        const formatted = format(pattern, isNegativeElapsedTime ? Math.abs(value) : value, { locale });
+        const formatted = format(pattern, isNegativeElapsedTime ? Math.abs(value) : value, { locale: localeForPattern(pattern, locale) });
         return isNegativeElapsedTime ? `-${formatted}` : formatted;
     }
     catch (err) {

package/dist/esm/sort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sort.d.ts","sourceRoot":"","sources":["../../sort.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,SAAS,EACnD,QAAQ,CAAC,EAAE,EACX,gBAAgB,OAAO;;IA0CxB,CAAC"}
+{"version":3,"file":"sort.d.ts","sourceRoot":"","sources":["../../sort.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,SAAS,EACnD,QAAQ,CAAC,EAAE,EACX,gBAAgB,OAAO;;IAwCxB,CAAC"}

package/dist/esm/sort.js

@@ -6,7 +6,7 @@
 export const sortSheetsByIndex = (sheets, includeHidden) => {
     const filtered = sheets
         .filter(Boolean)
-        .filter((sheet) => includeHidden ? sheet.title : !sheet.hidden && sheet.title);
+        .filter((sheet) => includeHidden || !sheet.hidden);
     // Remove duplicate sheets with the same sheetId, keeping only the first occurrence
     const seen = new Set();
     const deduplicated = filtered.filter((sheet) => {

package/dist/esm/string.d.ts

@@ -64,9 +64,16 @@ export declare const supplant: (s: string, o: Record<string, any>) => string;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */

package/dist/esm/string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAKF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAY/C,CAAC"}
+{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}

package/dist/esm/string.js

@@ -190,21 +190,40 @@ export const supplant = (s, o) => {
     });
 };
 // RFC 3986 scheme: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) ":"
-const URL_SCHEME = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+const URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
+// Schemes an external hyperlink is allowed to carry. Anything else with an
+// explicit scheme (javascript:, data:, vbscript:, …) is a script/content
+// injection vector and is rejected.
+const SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */
 export const normalizeExternalUrl = (url) => {
-    const trimmed = url.trim();
-    if (!trimmed ||
-        URL_SCHEME.test(trimmed) ||
-        trimmed.startsWith("//") ||
+    const trimmed = url
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return "";
+    }
+    const schemeMatch = URL_SCHEME.exec(trimmed);
+    if (schemeMatch) {
+        return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase()) ? trimmed : "";
+    }
+    if (trimmed.startsWith("//") ||
         trimmed.startsWith("#") ||
         trimmed.startsWith("/")) {
         return trimmed;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rowsncolumns/utils",
-  "version": "9.2.35",
+  "version": "9.2.37",
   "author": "Vinay M",
   "license": "SEE LICENSE IN LICENSE.md",
   "main": "./dist/cjs/index.js",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "numfmt": "^3.2.2",
-    "@rowsncolumns/common-types": ">=5.2.29"
+    "@rowsncolumns/common-types": ">=5.2.30"
   },
   "devDependencies": {},
   "peerDependencies": {}