@rowsncolumns/utils 9.5.0 → 9.5.3

package/dist/cjs/clipboard-html-sanitize.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `<img src>` may point at http(s) or an inline `data:image/*` (browsers copy
+ * inline images that way). Anything else — `javascript:`, `data:text/html`,
+ * `blob:` from another origin — is dropped.
+ */
+export declare const isSafeImageSrc: (value: string | null | undefined) => boolean;
+export declare const sanitizeInlineStyle: (value: string) => string;
+export declare const sanitizeStylesheetText: (value: string) => string;
+/**
+ * Strip executable and network-reaching content from an inert (DOMParser)
+ * document in place. Safe to call on a document that was never attached; the
+ * caller imports the result into a live sandbox afterwards.
+ */
+export declare const sanitizeClipboardDocument: (doc: Document) => Document;
+//# sourceMappingURL=clipboard-html-sanitize.d.ts.map

package/dist/cjs/clipboard-html-sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard-html-sanitize.d.ts","sourceRoot":"","sources":["../../clipboard-html-sanitize.ts"],"names":[],"mappings":"AA6FA;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAWjE,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAanD,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,OAAO,MAAM,KAAG,MACT,CAAC;AAmC/C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,QAAQ,KAAG,QAyCzD,CAAC"}

package/dist/cjs/clipboard-html-sanitize.js

@@ -0,0 +1,237 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeClipboardDocument = exports.sanitizeStylesheetText = exports.sanitizeInlineStyle = exports.isSafeImageSrc = void 0;
+var tslib_1 = require("tslib");
+var string_1 = require("./string");
+/**
+ * Sanitizer for clipboard `text/html` before any of it touches the live DOM.
+ *
+ * Clipboard HTML is attacker-controlled: a page the user copied from (or a
+ * synthetic `paste` event) can carry `<img onerror>`, `<svg onload>`,
+ * `<script>`, `<iframe srcdoc>` or `javascript:` links. The paste converters
+ * only ever need the document's structure (tables, rows, cells, inline
+ * formatting tags, `data-*` value hints), its inline `style` attributes and
+ * the payload's own `<style>` rules (Excel's `.fontN` / `.xlNN` classes), so
+ * everything else is dropped from the INERT `DOMParser` document before the
+ * sanitized nodes are imported into the mounted sandbox.
+ *
+ * This runs unconditionally; a consumer's `sanitizeHtml` prop runs on the raw
+ * string before this and can only tighten the result.
+ */
+/** Elements removed with their subtree. */
+var FORBIDDEN_ELEMENTS = new Set([
+    "script",
+    "noscript",
+    "template",
+    "iframe",
+    "frame",
+    "frameset",
+    "object",
+    "embed",
+    "applet",
+    "link",
+    "base",
+    "svg",
+    "math",
+    "input",
+    "button",
+    "select",
+    "textarea",
+    "audio",
+    "video",
+    "source",
+    "track",
+    "canvas",
+    "portal",
+    "dialog",
+]);
+/** Elements removed but whose children are kept in place. */
+var UNWRAPPED_ELEMENTS = new Set(["form", "fieldset", "label", "output"]);
+/** URL-bearing attributes that never carry spreadsheet meaning. */
+var FORBIDDEN_ATTRIBUTES = new Set([
+    "srcdoc",
+    "srcset",
+    "formaction",
+    "action",
+    "background",
+    "poster",
+    "ping",
+    "dynsrc",
+    "lowsrc",
+    "cite",
+    "longdesc",
+    "manifest",
+    "codebase",
+    "classid",
+    "data",
+    "archive",
+    "profile",
+    "usemap",
+    "xlink:href",
+    "xml:base",
+]);
+/** Attributes whose value must be a safe URL; otherwise the attribute is dropped. */
+var URL_ATTRIBUTES = new Set(["href", "src"]);
+/**
+ * CSS constructs that can reach the network or (in legacy engines) run code.
+ * Any declaration containing one of them is dropped; the rest of the `style`
+ * survives so legitimate `font-weight` / `color` / `mso-number-format` hints
+ * are kept.
+ */
+var DANGEROUS_CSS = /(expression\s*\(|url\s*\(|@import|behavior\s*:|-moz-binding|javascript:|vbscript:|data:)/i;
+/**
+ * Stylesheet-level constructs that can reach the network. `<style>` text is
+ * needed for Excel's class rules but never for anything that fetches.
+ */
+var DANGEROUS_STYLESHEET_RULE = /@import[^;]*;?|url\s*\([^)]*\)|expression\s*\([^)]*\)|behavior\s*:[^;}]*|-moz-binding\s*:[^;}]*/gi;
+var isEventHandlerAttribute = function (name) {
+    return name.length > 2 && name.charCodeAt(0) === 111 /* o */ && name.charCodeAt(1) === 110;
+} /* n */;
+/**
+ * `<img src>` may point at http(s) or an inline `data:image/*` (browsers copy
+ * inline images that way). Anything else — `javascript:`, `data:text/html`,
+ * `blob:` from another origin — is dropped.
+ */
+var isSafeImageSrc = function (value) {
+    if (!value) {
+        return false;
+    }
+    var trimmed = value.replace(/[\t\n\r]/g, "").trim();
+    if (/^data:image\/(png|gif|jpe?g|webp|bmp|svg\+xml|x-icon|tiff);/i.test(trimmed)) {
+        // Inline SVG can carry scripts when navigated to, but as an `<img>` source
+        // it is rendered in an isolated, script-less document; allow it.
+        return true;
+    }
+    return /^https?:\/\//i.test(trimmed) || /^\/\//.test(trimmed);
+};
+exports.isSafeImageSrc = isSafeImageSrc;
+var sanitizeInlineStyle = function (value) {
+    // Untouched styles are kept byte-for-byte: Excel's `mso-number-format`
+    // patterns carry escaped `\;` and significant spaces that a split/rejoin
+    // would mangle.
+    if (!DANGEROUS_CSS.test(value)) {
+        return value;
+    }
+    return value
+        .split(";")
+        .filter(function (declaration) { return declaration.trim() && !DANGEROUS_CSS.test(declaration); })
+        .join(";");
+};
+exports.sanitizeInlineStyle = sanitizeInlineStyle;
+var sanitizeStylesheetText = function (value) {
+    return value.replace(DANGEROUS_STYLESHEET_RULE, "");
+};
+exports.sanitizeStylesheetText = sanitizeStylesheetText;
+var sanitizeAttributes = function (element) {
+    var e_1, _a;
+    var tag = element.tagName.toLowerCase();
+    // Copy first: removing while iterating a live NamedNodeMap skips entries.
+    var attributes = Array.from(element.attributes);
+    try {
+        for (var attributes_1 = tslib_1.__values(attributes), attributes_1_1 = attributes_1.next(); !attributes_1_1.done; attributes_1_1 = attributes_1.next()) {
+            var attribute = attributes_1_1.value;
+            var name_1 = attribute.name.toLowerCase();
+            if (isEventHandlerAttribute(name_1) || FORBIDDEN_ATTRIBUTES.has(name_1)) {
+                element.removeAttribute(attribute.name);
+                continue;
+            }
+            if (name_1 === "style") {
+                var safe = (0, exports.sanitizeInlineStyle)(attribute.value);
+                if (safe !== attribute.value) {
+                    if (safe) {
+                        element.setAttribute(attribute.name, safe);
+                    }
+                    else {
+                        element.removeAttribute(attribute.name);
+                    }
+                }
+                continue;
+            }
+            if (URL_ATTRIBUTES.has(name_1)) {
+                var safe = name_1 === "src"
+                    ? tag === "img" && (0, exports.isSafeImageSrc)(attribute.value)
+                    : (0, string_1.isSafeHyperlinkUri)(attribute.value);
+                if (!safe) {
+                    element.removeAttribute(attribute.name);
+                }
+            }
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (attributes_1_1 && !attributes_1_1.done && (_a = attributes_1.return)) _a.call(attributes_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+};
+/**
+ * Strip executable and network-reaching content from an inert (DOMParser)
+ * document in place. Safe to call on a document that was never attached; the
+ * caller imports the result into a live sandbox afterwards.
+ */
+var sanitizeClipboardDocument = function (doc) {
+    var e_2, _a, e_3, _b;
+    var _c;
+    // A static snapshot: removals below detach subtrees, and detached
+    // descendants are skipped via `doc.contains`.
+    var elements = Array.from(doc.querySelectorAll("*"));
+    try {
+        for (var elements_1 = tslib_1.__values(elements), elements_1_1 = elements_1.next(); !elements_1_1.done; elements_1_1 = elements_1.next()) {
+            var element = elements_1_1.value;
+            if (!doc.contains(element)) {
+                continue;
+            }
+            var tag = element.tagName.toLowerCase();
+            if (FORBIDDEN_ELEMENTS.has(tag)) {
+                element.remove();
+                continue;
+            }
+            if (UNWRAPPED_ELEMENTS.has(tag)) {
+                var parent_1 = element.parentNode;
+                if (parent_1) {
+                    while (element.firstChild) {
+                        parent_1.insertBefore(element.firstChild, element);
+                    }
+                }
+                element.remove();
+                continue;
+            }
+            if (tag === "style") {
+                var text = (_c = element.textContent) !== null && _c !== void 0 ? _c : "";
+                var safe = (0, exports.sanitizeStylesheetText)(text);
+                if (safe !== text) {
+                    element.textContent = safe;
+                }
+                try {
+                    // A stylesheet never needs attributes beyond `type`/`media`.
+                    for (var _d = (e_3 = void 0, tslib_1.__values(Array.from(element.attributes))), _e = _d.next(); !_e.done; _e = _d.next()) {
+                        var attribute = _e.value;
+                        var name_2 = attribute.name.toLowerCase();
+                        if (name_2 !== "type" && name_2 !== "media") {
+                            element.removeAttribute(attribute.name);
+                        }
+                    }
+                }
+                catch (e_3_1) { e_3 = { error: e_3_1 }; }
+                finally {
+                    try {
+                        if (_e && !_e.done && (_b = _d.return)) _b.call(_d);
+                    }
+                    finally { if (e_3) throw e_3.error; }
+                }
+                continue;
+            }
+            sanitizeAttributes(element);
+        }
+    }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    finally {
+        try {
+            if (elements_1_1 && !elements_1_1.done && (_a = elements_1.return)) _a.call(elements_1);
+        }
+        finally { if (e_2) throw e_2.error; }
+    }
+    return doc;
+};
+exports.sanitizeClipboardDocument = sanitizeClipboardDocument;

package/dist/cjs/condition-operand.d.ts

@@ -0,0 +1,54 @@
+import type { ConditionType } from "@rowsncolumns/common-types";
+/**
+ * Whether a condition type compares TEXT — its operand is always a string
+ * literal in Excel, even when it looks like a number or a boolean.
+ */
+export declare const isTextConditionType: (type: ConditionType | string | undefined | null) => boolean;
+export declare const escapeConditionFormulaText: (value: string) => string;
+/**
+ * The formula fragment for an operand that is a typed LITERAL — a number
+ * (`5`, `1e3`, locale `6,5`), a percentage (`50%` → `0.5`), a boolean, or a
+ * date / time in the document locale (`2024-01-05`, `1/5/2024`, `10:30` → the
+ * serial). `undefined` for anything else (text, references, formulas).
+ */
+export declare const conditionOperandLiteral: (raw: string | undefined | null, locale?: string) => string | undefined;
+/**
+ * Whether an operand (with any leading `=` already removed) is an A1
+ * reference — a cell, a range, a whole column/row, with `$` anchors and an
+ * optional (quoted) sheet qualifier: `B1`, `$B$1`, `B$1`, `Sheet1!$B$1`,
+ * `'My Sheet'!$B$1:$C$9`, `$A:$A`.
+ */
+export declare const isConditionOperandReference: (text: string) => boolean;
+/**
+ * Whether an operand (with any leading `=` already removed) is a function
+ * call — the form OOXML stores a formula bound in (`TODAY()`,
+ * `DATE(2024,1,1)`, `LEN($B$1)`): evaluated as a formula, never quoted.
+ */
+export declare const isConditionOperandFormulaCall: (text: string) => boolean;
+/**
+ * Normalize one rule operand into the formula fragment the rule builders
+ * splice into `=<cell><op><fragment>` (and the xlsx exporters write inside
+ * `<formula>` / `<formula1>` — never with a leading `=`).
+ *
+ * - `=…` → the formula text (leading `=` stripped).
+ * - `TEXT_*` types → ALWAYS a quoted string literal (`"1"`, `"TRUE"`).
+ * - A complete `"…"` string literal → as is.
+ * - An A1 reference (`$B$1`, `B$1`, `Sheet1!$B$1`, `'My Sheet'!$B$1`) → as is.
+ * - A function call (`TODAY()`, `DATE(2024,1,1)`, `LEN(A1)`) → as is.
+ * - A typed literal (number, `50%`, boolean, date/time in `locale`) → its
+ *   numeric form (`0.5`, `45296`, `TRUE`).
+ * - Anything else → a quoted string literal (`"abc"`).
+ *
+ * `""` for an empty operand.
+ */
+export declare const normalizeConditionOperand: (raw: string | undefined | null, type: ConditionType | string | undefined | null, locale?: string) => string;
+/**
+ * The OOXML `<formula>` / `<formula1>` text for a number/date rule operand:
+ * the leading `=` is stripped (Excel never writes one), typed literals are
+ * normalized to what Excel itself stores (`50%` → `0.5`, `2024-01-05` → its
+ * serial `45296` rather than the arithmetic `2024-01-05` = 2022), and every
+ * other operand — references, defined names, function calls — is written
+ * verbatim.
+ */
+export declare const conditionOperandToFormulaText: (raw: string | undefined | null, locale?: string) => string;
+//# sourceMappingURL=condition-operand.d.ts.map

package/dist/cjs/condition-operand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition-operand.d.ts","sourceRoot":"","sources":["../../condition-operand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAyChE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC9B,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,KAC9C,OAA0D,CAAC;AAE9D,eAAO,MAAM,0BAA0B,GAAI,OAAO,MAAM,WAC7B,CAAC;AAsC5B;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,SAAS,MAAM,KACd,MAAM,GAAG,SA2CX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,KAAG,OACU,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,OAC5B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,GACpC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,EAC/C,SAAS,MAAM,KACd,MA0BF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACxC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,SAAS,MAAM,KACd,MAQF,CAAC"}

package/dist/cjs/condition-operand.js

@@ -0,0 +1,223 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.conditionOperandToFormulaText = exports.normalizeConditionOperand = exports.isConditionOperandFormulaCall = exports.isConditionOperandReference = exports.conditionOperandLiteral = exports.escapeConditionFormulaText = exports.isTextConditionType = void 0;
+var numfmt_1 = require("numfmt");
+var selection_1 = require("./selection");
+/**
+ * How a conditional-format / data-validation rule operand (`userEnteredValue`)
+ * becomes a formula fragment — the ONE place both rule builders and both xlsx
+ * exporters classify an operand, so the runtime and the exported file agree.
+ *
+ * Excel's rule dialog stores every operand as a formula. Typed text becomes a
+ * string literal, a typed number a number, a typed date its serial, `50%` the
+ * fraction `0.5`, and `=…` stays a formula. The `TEXT_*` rules ("Text that
+ * contains…", "begins with", cellIs equal `"5"`) take a string literal no
+ * matter what was typed: *begins with "1"* highlights `1abc` AND `123`, and
+ * `cellIs equal "5"` matches the text `5` but not the number 5.
+ */
+var NUMBER_LITERAL_PATTERN = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
+var BOOLEAN_LITERAL_PATTERN = /^(TRUE|FALSE)$/i;
+var PERCENT_LITERAL_PATTERN = /^([+-]?[\d.,\s ]+)%$/;
+/** A complete formula string literal — `"abc"`, `"say ""hi"""`. */
+var QUOTED_STRING_LITERAL_PATTERN = /^"(?:[^"]|"")*"$/;
+/**
+ * A function call — `TODAY()`, `DATE(2024,1,1)`, `LEN($B$1)`, `_xlfn.XLOOKUP(…)` — which is how
+ * OOXML stores a formula bound (`<formula1>TODAY()</formula1>`, never with a leading `=`).
+ */
+var FORMULA_CALL_PATTERN = /^[A-Z_\\][\w.]*\([\s\S]*\)$/i;
+/** Whole-column / whole-row spans (`A:A`, `$A:$C`, `1:1`), optionally sheet-qualified. */
+var AXIS_REFERENCE_PATTERN = /^(?:[^!]+!)?(?:\$?[A-Z]{1,3}:\$?[A-Z]{1,3}|\$?\d+:\$?\d+)$/i;
+var TEXT_CONDITION_TYPES = new Set([
+    "TEXT_EQ",
+    "TEXT_NOT_EQ",
+    "TEXT_CONTAINS",
+    "TEXT_NOT_CONTAINS",
+    "TEXT_STARTS_WITH",
+    "TEXT_ENDS_WITH",
+]);
+/**
+ * Whether a condition type compares TEXT — its operand is always a string
+ * literal in Excel, even when it looks like a number or a boolean.
+ */
+var isTextConditionType = function (type) { return Boolean(type && TEXT_CONDITION_TYPES.has(type)); };
+exports.isTextConditionType = isTextConditionType;
+var escapeConditionFormulaText = function (value) {
+    return value.replace(/"/g, '""');
+};
+exports.escapeConditionFormulaText = escapeConditionFormulaText;
+/**
+ * Parse a locale-formatted numeric string (e.g., "6,5" in fr-FR) into a JS
+ * number. Uses `Intl.NumberFormat` to detect decimal/group separators.
+ * Returns NaN on failure.
+ */
+var parseLocaleNumberLoose = function (value, locale) {
+    var _a, _b, _c, _d;
+    try {
+        var parts = new Intl.NumberFormat(locale).formatToParts(1234.5);
+        var decimal = (_b = (_a = parts.find(function (part) { return part.type === "decimal"; })) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : ".";
+        var group = (_d = (_c = parts.find(function (part) { return part.type === "group"; })) === null || _c === void 0 ? void 0 : _c.value) !== null && _d !== void 0 ? _d : ",";
+        var cleaned = value.split(group).join("").replace(decimal, ".");
+        if (!cleaned.trim() || !NUMBER_LITERAL_PATTERN.test(cleaned.trim())) {
+            return NaN;
+        }
+        return Number(cleaned);
+    }
+    catch (_e) {
+        return NaN;
+    }
+};
+/** Shortest decimal text of a number rounded to Excel's 15 significant digits. */
+var formatNumberOperand = function (value) {
+    return String(Number(value.toPrecision(15)));
+};
+var parseNumberOperand = function (text, locale) {
+    if (NUMBER_LITERAL_PATTERN.test(text)) {
+        var value = Number(text);
+        return Number.isFinite(value) ? value : undefined;
+    }
+    if (locale) {
+        var value = parseLocaleNumberLoose(text, locale);
+        return Number.isFinite(value) ? value : undefined;
+    }
+    return undefined;
+};
+/**
+ * The formula fragment for an operand that is a typed LITERAL — a number
+ * (`5`, `1e3`, locale `6,5`), a percentage (`50%` → `0.5`), a boolean, or a
+ * date / time in the document locale (`2024-01-05`, `1/5/2024`, `10:30` → the
+ * serial). `undefined` for anything else (text, references, formulas).
+ */
+var conditionOperandLiteral = function (raw, locale) {
+    if (!raw)
+        return undefined;
+    var trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    if (BOOLEAN_LITERAL_PATTERN.test(trimmed)) {
+        return trimmed.toUpperCase();
+    }
+    if (NUMBER_LITERAL_PATTERN.test(trimmed)) {
+        // Keep the typed digits — `6.50` and `6.5` are the same number and the
+        // formula parser reads either.
+        return Number.isFinite(Number(trimmed)) ? trimmed : undefined;
+    }
+    var percent = PERCENT_LITERAL_PATTERN.exec(trimmed);
+    if (percent) {
+        var value = parseNumberOperand(percent[1].trim(), locale !== null && locale !== void 0 ? locale : "en-US");
+        if (value !== undefined) {
+            return formatNumberOperand(value / 100);
+        }
+    }
+    // Dates (incl. date+time) and times, in the document locale's field order
+    // (`1/5/2024` is Jan 5 in en-US, May 1 in en-GB; `1.5.2024` is a de-DE
+    // date, not the grouped number 152024). numfmt's default locale is
+    // month-first, matching the app default.
+    try {
+        var dateOptions = locale ? { locale: locale } : undefined;
+        var date = (0, numfmt_1.parseDate)(trimmed, dateOptions);
+        if (date && typeof date.v === "number" && Number.isFinite(date.v)) {
+            return formatNumberOperand(date.v);
+        }
+        var time = (0, numfmt_1.parseTime)(trimmed);
+        if (time && typeof time.v === "number" && Number.isFinite(time.v)) {
+            return formatNumberOperand(time.v);
+        }
+    }
+    catch (_a) {
+        // numfmt throws on malformed locale tags — the operand is then plain text.
+    }
+    if (locale) {
+        var value = parseLocaleNumberLoose(trimmed, locale);
+        if (Number.isFinite(value)) {
+            return formatNumberOperand(value);
+        }
+    }
+    return undefined;
+};
+exports.conditionOperandLiteral = conditionOperandLiteral;
+/**
+ * Whether an operand (with any leading `=` already removed) is an A1
+ * reference — a cell, a range, a whole column/row, with `$` anchors and an
+ * optional (quoted) sheet qualifier: `B1`, `$B$1`, `B$1`, `Sheet1!$B$1`,
+ * `'My Sheet'!$B$1:$C$9`, `$A:$A`.
+ */
+var isConditionOperandReference = function (text) {
+    return (0, selection_1.checkIfStringIsReference)(text) || AXIS_REFERENCE_PATTERN.test(text);
+};
+exports.isConditionOperandReference = isConditionOperandReference;
+/**
+ * Whether an operand (with any leading `=` already removed) is a function
+ * call — the form OOXML stores a formula bound in (`TODAY()`,
+ * `DATE(2024,1,1)`, `LEN($B$1)`): evaluated as a formula, never quoted.
+ */
+var isConditionOperandFormulaCall = function (text) {
+    return FORMULA_CALL_PATTERN.test(text);
+};
+exports.isConditionOperandFormulaCall = isConditionOperandFormulaCall;
+/**
+ * Normalize one rule operand into the formula fragment the rule builders
+ * splice into `=<cell><op><fragment>` (and the xlsx exporters write inside
+ * `<formula>` / `<formula1>` — never with a leading `=`).
+ *
+ * - `=…` → the formula text (leading `=` stripped).
+ * - `TEXT_*` types → ALWAYS a quoted string literal (`"1"`, `"TRUE"`).
+ * - A complete `"…"` string literal → as is.
+ * - An A1 reference (`$B$1`, `B$1`, `Sheet1!$B$1`, `'My Sheet'!$B$1`) → as is.
+ * - A function call (`TODAY()`, `DATE(2024,1,1)`, `LEN(A1)`) → as is.
+ * - A typed literal (number, `50%`, boolean, date/time in `locale`) → its
+ *   numeric form (`0.5`, `45296`, `TRUE`).
+ * - Anything else → a quoted string literal (`"abc"`).
+ *
+ * `""` for an empty operand.
+ */
+var normalizeConditionOperand = function (raw, type, locale) {
+    if (!raw)
+        return "";
+    var trimmed = raw.trim();
+    if (!trimmed)
+        return "";
+    if (trimmed.startsWith("=")) {
+        return trimmed.slice(1);
+    }
+    if ((0, exports.isTextConditionType)(type)) {
+        return "\"".concat((0, exports.escapeConditionFormulaText)(trimmed), "\"");
+    }
+    if (QUOTED_STRING_LITERAL_PATTERN.test(trimmed)) {
+        return trimmed;
+    }
+    if ((0, selection_1.checkIfStringIsReference)(trimmed) || (0, exports.isConditionOperandFormulaCall)(trimmed)) {
+        return trimmed;
+    }
+    // Typed literals before whole-row spans: `10:30` is the time 10:30, not
+    // rows 10–30 (Excel's dialog reads it the way a cell entry would).
+    var literal = (0, exports.conditionOperandLiteral)(trimmed, locale);
+    if (literal !== undefined) {
+        return literal;
+    }
+    if ((0, exports.isConditionOperandReference)(trimmed)) {
+        return trimmed;
+    }
+    return "\"".concat((0, exports.escapeConditionFormulaText)(trimmed), "\"");
+};
+exports.normalizeConditionOperand = normalizeConditionOperand;
+/**
+ * The OOXML `<formula>` / `<formula1>` text for a number/date rule operand:
+ * the leading `=` is stripped (Excel never writes one), typed literals are
+ * normalized to what Excel itself stores (`50%` → `0.5`, `2024-01-05` → its
+ * serial `45296` rather than the arithmetic `2024-01-05` = 2022), and every
+ * other operand — references, defined names, function calls — is written
+ * verbatim.
+ */
+var conditionOperandToFormulaText = function (raw, locale) {
+    var _a;
+    if (!raw)
+        return "";
+    var trimmed = raw.trim();
+    if (!trimmed)
+        return "";
+    if (trimmed.startsWith("=")) {
+        return trimmed.slice(1);
+    }
+    return (_a = (0, exports.conditionOperandLiteral)(trimmed, locale)) !== null && _a !== void 0 ? _a : trimmed;
+};
+exports.conditionOperandToFormulaText = conditionOperandToFormulaText;

package/dist/cjs/conditional-format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-format.d.ts","sourceRoot":"","sources":["../../conditional-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,4BAA4B,CAAC;AAKpC;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D,CAAC;AA+DF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,GACzC,MAAM,yBAAyB,GAAG,SAAS,YAK5C,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,MAAM,yBAAyB,GAAG,SAAS,EAC3C,aAAa,MAAM,EACnB,SAAS,MAAM,uBA8HhB,CAAC"}
+{"version":3,"file":"conditional-format.d.ts","sourceRoot":"","sources":["../../conditional-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,4BAA4B,CAAC;AAQpC;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,GACzC,MAAM,yBAAyB,GAAG,SAAS,YAK5C,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,MAAM,yBAAyB,GAAG,SAAS,EAC3C,aAAa,MAAM,EACnB,SAAS,MAAM,uBA8HhB,CAAC"}

package/dist/cjs/conditional-format.js

@@ -1,63 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildConditionalFormatExpression = exports.isConditionalFormatFormulaRule = void 0;
+var condition_operand_1 = require("./condition-operand");
 var data_validation_1 = require("./data-validation");
-var selection_1 = require("./selection");
 var FORMULA_PREDICATE_BASE_CELL_REF = "A1";
-var NUMBER_LITERAL_PATTERN = /^-?\d+(?:\.\d+)?$/;
-var BOOLEAN_LITERAL_PATTERN = /^(TRUE|FALSE)$/i;
-var escapeFormulaText = function (value) { return value.replace(/"/g, '""'); };
-/**
- * Parse a locale-formatted numeric string (e.g., "6,5" in fr-FR) into a JS
- * number. Uses `Intl.NumberFormat` to detect decimal/group separators.
- * Returns NaN on failure.
- */
-var parseLocaleNumberLoose = function (value, locale) {
-    var _a, _b, _c, _d;
-    try {
-        var parts = new Intl.NumberFormat(locale).formatToParts(1234.5);
-        var decimal = (_b = (_a = parts.find(function (part) { return part.type === "decimal"; })) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : ".";
-        var group = (_d = (_c = parts.find(function (part) { return part.type === "group"; })) === null || _c === void 0 ? void 0 : _c.value) !== null && _d !== void 0 ? _d : ",";
-        var cleaned = value.split(group).join("").replace(decimal, ".");
-        return Number(cleaned);
-    }
-    catch (_e) {
-        return NaN;
-    }
-};
-/**
- * Normalize a condition value for use in a formula expression.
- * Handles locale-specific number formats (e.g., "6,5" -> "6.5").
- */
-var normalizeConditionValue = function (raw, allowStringLiteral, locale) {
-    if (allowStringLiteral === void 0) { allowStringLiteral = false; }
-    if (!raw)
-        return "";
-    var trimmed = raw.trim();
-    if (!trimmed)
-        return "";
-    if (trimmed.startsWith("=")) {
-        return trimmed.slice(1);
-    }
-    if ((0, selection_1.checkIfStringIsReference)(trimmed)) {
-        return trimmed;
-    }
-    if (NUMBER_LITERAL_PATTERN.test(trimmed) ||
-        BOOLEAN_LITERAL_PATTERN.test(trimmed)) {
-        return trimmed;
-    }
-    // Try parsing as locale-aware number
-    if (locale) {
-        var parsed = parseLocaleNumberLoose(trimmed, locale);
-        if (!isNaN(parsed)) {
-            return String(parsed);
-        }
-    }
-    if (allowStringLiteral) {
-        return "\"".concat(escapeFormulaText(trimmed), "\"");
-    }
-    return trimmed;
-};
 /**
  * Whether a CF rule is evaluated via the calculator (formula path) instead of
  * the synchronous `checkBooleanRule` path used in
@@ -111,8 +57,8 @@ var buildConditionalFormatExpression = function (rule, baseCellRef, locale) {
             return undefined;
         return trimmed.startsWith("=") ? trimmed : "=".concat(trimmed);
     }
-    var fromExpr = normalizeConditionValue(fromRaw, true, locale);
-    var toExpr = normalizeConditionValue(toRaw, true, locale);
+    var fromExpr = (0, condition_operand_1.normalizeConditionOperand)(fromRaw, condition.type, locale);
+    var toExpr = (0, condition_operand_1.normalizeConditionOperand)(toRaw, condition.type, locale);
     if (!fromExpr && !toExpr)
         return undefined;
     var comparisonOperatorMap = {
@@ -192,13 +138,13 @@ var buildConditionalFormatExpression = function (rule, baseCellRef, locale) {
             .flatMap(function (entry) {
             if (entry.startsWith("'")) {
                 var stripped = (0, data_validation_1.stripDataValidationTextPrefix)(entry);
-                var textCondition = "".concat(baseCellRef, "=\"").concat(escapeFormulaText(stripped), "\"");
+                var textCondition = "".concat(baseCellRef, "=\"").concat((0, condition_operand_1.escapeConditionFormulaText)(stripped), "\"");
                 return stripped === ""
                     ? [textCondition, "".concat(baseCellRef, "=\"'\"")]
                     : [textCondition];
             }
             return entry
-                ? ["".concat(baseCellRef, "=").concat(normalizeConditionValue(entry, true, locale))]
+                ? ["".concat(baseCellRef, "=").concat((0, condition_operand_1.normalizeConditionOperand)(entry, condition.type, locale))]
                 : [];
         })
             .filter(function (entry) { return Boolean(entry); });

package/dist/cjs/data-validation.d.ts

@@ -50,5 +50,14 @@ export declare const dataValidationOptionMatchesCellValue: (option: string | und
  * builder from drifting.
  */
 export declare const isDataValidationFormulaRule: (rule: DataValidationRule | undefined) => boolean;
+/**
+ * Excel's *Whole number* validation kind rejects any non-integer (`5.5` fails
+ * "whole between 1 and 10"). An imported `type="whole"` rule carries a plain
+ * `NUMBER_*` comparison as its `condition` (the bounds) — which alone accepts
+ * `5.5` — so when the rule's `xlsxSource.type` is `whole` the comparison is
+ * wrapped in the same integer guard `buildExcelValidationRule` composes for
+ * an authored Whole-number rule: `AND(ISNUMBER(x), x=INT(x), <comparison>)`.
+ * Rules of other kinds, and non-`NUMBER_*` conditions, are returned as built.
+ */
 export declare const buildDataValidationExpression: (rule: DataValidationRule | undefined, baseCellRef: string, locale?: string) => string | undefined;
 //# sourceMappingURL=data-validation.d.ts.map

package/dist/cjs/data-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-validation.d.ts","sourceRoot":"","sources":["../../data-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAWpC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,OAAO,MAAM,KAAG,MACd,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAC/C,QAAQ,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,WAAW,MAAM,GAAG,SAAS,GAAG,IAAI,KACnC,OAKF,CAAC;AAwDF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,2BAA2B,GACtC,MAAM,kBAAkB,GAAG,SAAS,YAKrC,CAAC;AAEF,eAAO,MAAM,6BAA6B,GACxC,MAAM,kBAAkB,GAAG,SAAS,EACpC,aAAa,MAAM,EACnB,SAAS,MAAM,uBA4HhB,CAAC"}
+{"version":3,"file":"data-validation.d.ts","sourceRoot":"","sources":["../../data-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AASpC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,OAAO,MAAM,KAAG,MACd,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAC/C,QAAQ,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,WAAW,MAAM,GAAG,SAAS,GAAG,IAAI,KACnC,OAKF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,2BAA2B,GACtC,MAAM,kBAAkB,GAAG,SAAS,YAKrC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACxC,MAAM,kBAAkB,GAAG,SAAS,EACpC,aAAa,MAAM,EACnB,SAAS,MAAM,uBAgBhB,CAAC"}