@rowsncolumns/utils 9.5.1 → 9.5.3

package/dist/cjs/sheet-protection.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTECTED_SHEET_EDIT_MESSAGE = exports.SHEET_PROTECTION_ERROR_TITLE = void 0;
+/**
+ * Excel's refusal when an edit touches a locked cell of a protected sheet — the dialog every
+ * mutation path shows (typing, Delete / Backspace, fill, paste) on both engines
+ * (rowsncolumns/spreadsheet#939 U-35). The rnc store surfaces the same text through its
+ * `rejections` channel under the `protected-sheet` code.
+ */
+exports.SHEET_PROTECTION_ERROR_TITLE = "This sheet is protected";
+exports.PROTECTED_SHEET_EDIT_MESSAGE = "The cell or chart you're trying to change is on a protected sheet. To make a change, unprotect the sheet. You might be requested to enter a password.";

package/dist/cjs/string.d.ts

@@ -38,6 +38,20 @@ export declare const cellToAddress: (cell: CellInterface | null, isAbsoluteColum
  * @returns
  */
 export declare const cellRangeToAddress: (sheetName: string | undefined, range: GridRange) => string;
+/**
+ * Must `name` be single-quoted as a sheet qualifier (`'My Data'!A1`)? Excel writes it bare only when
+ * it is a plain identifier — ASCII letters and digits, starting with a letter — and cannot be read
+ * as something else: a cell reference (`A1`, `XFD1`, `R1C1`), or a boolean (`TRUE`). A leading digit
+ * (`2024`, `1Sheet`) always quotes. Deliberately a superset of Excel's minimum (a `_`, `.` or
+ * non-ASCII letter also quotes): over-quoting is always valid, under-quoting makes `=2024!A1` a
+ * formula Excel rejects (rowsncolumns/spreadsheet#939 K-10).
+ */
+export declare const sheetNameNeedsQuoting: (name: string) => boolean;
+/**
+ * Quote a sheet name for use as a formula qualifier when Excel requires it (see
+ * {@link sheetNameNeedsQuoting}); apostrophes inside are doubled (`'O''Neil'`). Rename, cross-sheet
+ * reference generation and formula-bar insertion all quote through here so they agree.
+ */
 export declare const sanitizeSheetName: (name: string | undefined) => string | undefined;
 /**
  * Remove single quotes from sheetname
@@ -76,6 +90,23 @@ export declare const matchesWildcardPattern: (pattern: string, text: string, anc
  */
 export declare const selectionBoundsFromCells: (start: CellInterface, end?: CellInterface | null) => GridRange;
 export declare const supplant: (s: string, o: Record<string, any>) => string;
+/**
+ * Whether a hyperlink target read from untrusted markup (clipboard HTML) may
+ * be kept. A URL with an explicit scheme must use one of the safe schemes;
+ * scheme-less, protocol-relative, path and fragment references are allowed
+ * (they are normalized by {@link normalizeExternalUrl} before being opened).
+ * Applies the same tab/newline and C0-control stripping as the browser's URL
+ * canonicalization so `java\tscript:` cannot slip through.
+ */
+export declare const isSafeHyperlinkUri: (uri: string | null | undefined) => boolean;
+/**
+ * Escape text for interpolation into an HTML text node (`text/html`
+ * clipboard fragments): a cell whose value is literally `<b>x</b>` must paste
+ * back as that text, not as bold "x".
+ */
+export declare const escapeHtmlText: (value: string) => string;
+/** Escape a value for interpolation into a quoted HTML attribute. */
+export declare const escapeHtmlAttribute: (value: string) => string;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to

package/dist/cjs/string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,MAAM,KAAG,MAe/D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,KACxD,OAWF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}
+{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAOF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,OAMrB,CAAC;AAEjC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,MAAM,KAAG,MAe/D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,KACxD,OAWF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAgBnE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAC2B,CAAC;AAE3E,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAM1B,CAAC;AAE3B;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}

package/dist/cjs/string.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeExternalUrl = exports.supplant = exports.selectionBoundsFromCells = exports.matchesWildcardPattern = exports.wildcardPatternToRegExpSource = exports.escapeCharacters = exports.desanitizeSheetName = exports.sanitizeSheetName = exports.cellRangeToAddress = exports.cellToAddress = exports.getRowIndexFromAddress = exports.getColumnNameFromAddress = exports.addressToCell = exports.convertCellToRange = void 0;
+exports.normalizeExternalUrl = exports.escapeHtmlAttribute = exports.escapeHtmlText = exports.isSafeHyperlinkUri = exports.supplant = exports.selectionBoundsFromCells = exports.matchesWildcardPattern = exports.wildcardPatternToRegExpSource = exports.escapeCharacters = exports.desanitizeSheetName = exports.sanitizeSheetName = exports.sheetNameNeedsQuoting = exports.cellRangeToAddress = exports.cellToAddress = exports.getRowIndexFromAddress = exports.getColumnNameFromAddress = exports.addressToCell = exports.convertCellToRange = void 0;
 var tslib_1 = require("tslib");
 var typeguards_1 = require("./typeguards");
 var numbers_1 = require("./numbers");
@@ -135,13 +135,38 @@ var cellRangeToAddress = function (sheetName, range) {
     }));
 };
 exports.cellRangeToAddress = cellRangeToAddress;
-/* Sanitize sheet names */
+/** `A1`-style lookalike: 1–3 ASCII letters followed only by digits (`AB12`, `XFD1`). */
+var SHEET_NAME_A1_LOOKALIKE = /^[A-Za-z]{1,3}\d+$/;
+/** `R1C1`-style lookalike: an optional-digit `R` part and/or `C` part, nothing else (`R`, `C22`, `R1C1`). */
+var SHEET_NAME_R1C1_LOOKALIKE = /^(?:[Rr]\d*)?(?:[Cc]\d*)?$/;
+/**
+ * Must `name` be single-quoted as a sheet qualifier (`'My Data'!A1`)? Excel writes it bare only when
+ * it is a plain identifier — ASCII letters and digits, starting with a letter — and cannot be read
+ * as something else: a cell reference (`A1`, `XFD1`, `R1C1`), or a boolean (`TRUE`). A leading digit
+ * (`2024`, `1Sheet`) always quotes. Deliberately a superset of Excel's minimum (a `_`, `.` or
+ * non-ASCII letter also quotes): over-quoting is always valid, under-quoting makes `=2024!A1` a
+ * formula Excel rejects (rowsncolumns/spreadsheet#939 K-10).
+ */
+var sheetNameNeedsQuoting = function (name) {
+    return name.length === 0 ||
+        /[^A-Za-z0-9]/.test(name) ||
+        /^\d/.test(name) ||
+        SHEET_NAME_A1_LOOKALIKE.test(name) ||
+        SHEET_NAME_R1C1_LOOKALIKE.test(name) ||
+        /^(?:true|false)$/i.test(name);
+};
+exports.sheetNameNeedsQuoting = sheetNameNeedsQuoting;
+/**
+ * Quote a sheet name for use as a formula qualifier when Excel requires it (see
+ * {@link sheetNameNeedsQuoting}); apostrophes inside are doubled (`'O''Neil'`). Rename, cross-sheet
+ * reference generation and formula-bar insertion all quote through here so they agree.
+ */
 var sanitizeSheetName = function (name) {
     if (name === void 0)
         return void 0;
     if (typeof name === "number")
         return name;
-    if (/\s+|[^a-z|A-Z|0-9]/.test(name)) {
+    if ((0, exports.sheetNameNeedsQuoting)(name)) {
         // Escape single quotes by doubling them for valid sheet references.
         var escaped = name.replace(/'/g, "''");
         return "'".concat(escaped, "'");
@@ -263,6 +288,51 @@ var URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
 // explicit scheme (javascript:, data:, vbscript:, …) is a script/content
 // injection vector and is rejected.
 var SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
+/**
+ * Whether a hyperlink target read from untrusted markup (clipboard HTML) may
+ * be kept. A URL with an explicit scheme must use one of the safe schemes;
+ * scheme-less, protocol-relative, path and fragment references are allowed
+ * (they are normalized by {@link normalizeExternalUrl} before being opened).
+ * Applies the same tab/newline and C0-control stripping as the browser's URL
+ * canonicalization so `java\tscript:` cannot slip through.
+ */
+var isSafeHyperlinkUri = function (uri) {
+    if (uri == null) {
+        return false;
+    }
+    var trimmed = uri
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return false;
+    }
+    var schemeMatch = URL_SCHEME.exec(trimmed);
+    if (!schemeMatch) {
+        return true;
+    }
+    return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase());
+};
+exports.isSafeHyperlinkUri = isSafeHyperlinkUri;
+/**
+ * Escape text for interpolation into an HTML text node (`text/html`
+ * clipboard fragments): a cell whose value is literally `<b>x</b>` must paste
+ * back as that text, not as bold "x".
+ */
+var escapeHtmlText = function (value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+};
+exports.escapeHtmlText = escapeHtmlText;
+/** Escape a value for interpolation into a quoted HTML attribute. */
+var escapeHtmlAttribute = function (value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+};
+exports.escapeHtmlAttribute = escapeHtmlAttribute;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to

package/dist/cjs/tsconfig.cjs.tsbuildinfo

@@ -1 +1 @@
-{"root":["../../array.ts","../../cell-data-helpers.ts","../../color.ts","../../colors.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}
+{"root":["../../array.ts","../../cell-data-helpers.ts","../../clipboard-html-sanitize.ts","../../color.ts","../../colors.ts","../../condition-operand.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-names.ts","../../sheet-protection.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}

package/dist/esm/clipboard-html-sanitize.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `<img src>` may point at http(s) or an inline `data:image/*` (browsers copy
+ * inline images that way). Anything else — `javascript:`, `data:text/html`,
+ * `blob:` from another origin — is dropped.
+ */
+export declare const isSafeImageSrc: (value: string | null | undefined) => boolean;
+export declare const sanitizeInlineStyle: (value: string) => string;
+export declare const sanitizeStylesheetText: (value: string) => string;
+/**
+ * Strip executable and network-reaching content from an inert (DOMParser)
+ * document in place. Safe to call on a document that was never attached; the
+ * caller imports the result into a live sandbox afterwards.
+ */
+export declare const sanitizeClipboardDocument: (doc: Document) => Document;
+//# sourceMappingURL=clipboard-html-sanitize.d.ts.map

package/dist/esm/clipboard-html-sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard-html-sanitize.d.ts","sourceRoot":"","sources":["../../clipboard-html-sanitize.ts"],"names":[],"mappings":"AA6FA;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAWjE,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAanD,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,OAAO,MAAM,KAAG,MACT,CAAC;AAmC/C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,QAAQ,KAAG,QAyCzD,CAAC"}

package/dist/esm/clipboard-html-sanitize.js

@@ -0,0 +1,192 @@
+import { isSafeHyperlinkUri } from "./string";
+/**
+ * Sanitizer for clipboard `text/html` before any of it touches the live DOM.
+ *
+ * Clipboard HTML is attacker-controlled: a page the user copied from (or a
+ * synthetic `paste` event) can carry `<img onerror>`, `<svg onload>`,
+ * `<script>`, `<iframe srcdoc>` or `javascript:` links. The paste converters
+ * only ever need the document's structure (tables, rows, cells, inline
+ * formatting tags, `data-*` value hints), its inline `style` attributes and
+ * the payload's own `<style>` rules (Excel's `.fontN` / `.xlNN` classes), so
+ * everything else is dropped from the INERT `DOMParser` document before the
+ * sanitized nodes are imported into the mounted sandbox.
+ *
+ * This runs unconditionally; a consumer's `sanitizeHtml` prop runs on the raw
+ * string before this and can only tighten the result.
+ */
+/** Elements removed with their subtree. */
+const FORBIDDEN_ELEMENTS = new Set([
+    "script",
+    "noscript",
+    "template",
+    "iframe",
+    "frame",
+    "frameset",
+    "object",
+    "embed",
+    "applet",
+    "link",
+    "base",
+    "svg",
+    "math",
+    "input",
+    "button",
+    "select",
+    "textarea",
+    "audio",
+    "video",
+    "source",
+    "track",
+    "canvas",
+    "portal",
+    "dialog",
+]);
+/** Elements removed but whose children are kept in place. */
+const UNWRAPPED_ELEMENTS = new Set(["form", "fieldset", "label", "output"]);
+/** URL-bearing attributes that never carry spreadsheet meaning. */
+const FORBIDDEN_ATTRIBUTES = new Set([
+    "srcdoc",
+    "srcset",
+    "formaction",
+    "action",
+    "background",
+    "poster",
+    "ping",
+    "dynsrc",
+    "lowsrc",
+    "cite",
+    "longdesc",
+    "manifest",
+    "codebase",
+    "classid",
+    "data",
+    "archive",
+    "profile",
+    "usemap",
+    "xlink:href",
+    "xml:base",
+]);
+/** Attributes whose value must be a safe URL; otherwise the attribute is dropped. */
+const URL_ATTRIBUTES = new Set(["href", "src"]);
+/**
+ * CSS constructs that can reach the network or (in legacy engines) run code.
+ * Any declaration containing one of them is dropped; the rest of the `style`
+ * survives so legitimate `font-weight` / `color` / `mso-number-format` hints
+ * are kept.
+ */
+const DANGEROUS_CSS = /(expression\s*\(|url\s*\(|@import|behavior\s*:|-moz-binding|javascript:|vbscript:|data:)/i;
+/**
+ * Stylesheet-level constructs that can reach the network. `<style>` text is
+ * needed for Excel's class rules but never for anything that fetches.
+ */
+const DANGEROUS_STYLESHEET_RULE = /@import[^;]*;?|url\s*\([^)]*\)|expression\s*\([^)]*\)|behavior\s*:[^;}]*|-moz-binding\s*:[^;}]*/gi;
+const isEventHandlerAttribute = (name) => name.length > 2 && name.charCodeAt(0) === 111 /* o */ && name.charCodeAt(1) === 110 /* n */;
+/**
+ * `<img src>` may point at http(s) or an inline `data:image/*` (browsers copy
+ * inline images that way). Anything else — `javascript:`, `data:text/html`,
+ * `blob:` from another origin — is dropped.
+ */
+export const isSafeImageSrc = (value) => {
+    if (!value) {
+        return false;
+    }
+    const trimmed = value.replace(/[\t\n\r]/g, "").trim();
+    if (/^data:image\/(png|gif|jpe?g|webp|bmp|svg\+xml|x-icon|tiff);/i.test(trimmed)) {
+        // Inline SVG can carry scripts when navigated to, but as an `<img>` source
+        // it is rendered in an isolated, script-less document; allow it.
+        return true;
+    }
+    return /^https?:\/\//i.test(trimmed) || /^\/\//.test(trimmed);
+};
+export const sanitizeInlineStyle = (value) => {
+    // Untouched styles are kept byte-for-byte: Excel's `mso-number-format`
+    // patterns carry escaped `\;` and significant spaces that a split/rejoin
+    // would mangle.
+    if (!DANGEROUS_CSS.test(value)) {
+        return value;
+    }
+    return value
+        .split(";")
+        .filter((declaration) => declaration.trim() && !DANGEROUS_CSS.test(declaration))
+        .join(";");
+};
+export const sanitizeStylesheetText = (value) => value.replace(DANGEROUS_STYLESHEET_RULE, "");
+const sanitizeAttributes = (element) => {
+    const tag = element.tagName.toLowerCase();
+    // Copy first: removing while iterating a live NamedNodeMap skips entries.
+    const attributes = Array.from(element.attributes);
+    for (const attribute of attributes) {
+        const name = attribute.name.toLowerCase();
+        if (isEventHandlerAttribute(name) || FORBIDDEN_ATTRIBUTES.has(name)) {
+            element.removeAttribute(attribute.name);
+            continue;
+        }
+        if (name === "style") {
+            const safe = sanitizeInlineStyle(attribute.value);
+            if (safe !== attribute.value) {
+                if (safe) {
+                    element.setAttribute(attribute.name, safe);
+                }
+                else {
+                    element.removeAttribute(attribute.name);
+                }
+            }
+            continue;
+        }
+        if (URL_ATTRIBUTES.has(name)) {
+            const safe = name === "src"
+                ? tag === "img" && isSafeImageSrc(attribute.value)
+                : isSafeHyperlinkUri(attribute.value);
+            if (!safe) {
+                element.removeAttribute(attribute.name);
+            }
+        }
+    }
+};
+/**
+ * Strip executable and network-reaching content from an inert (DOMParser)
+ * document in place. Safe to call on a document that was never attached; the
+ * caller imports the result into a live sandbox afterwards.
+ */
+export const sanitizeClipboardDocument = (doc) => {
+    // A static snapshot: removals below detach subtrees, and detached
+    // descendants are skipped via `doc.contains`.
+    const elements = Array.from(doc.querySelectorAll("*"));
+    for (const element of elements) {
+        if (!doc.contains(element)) {
+            continue;
+        }
+        const tag = element.tagName.toLowerCase();
+        if (FORBIDDEN_ELEMENTS.has(tag)) {
+            element.remove();
+            continue;
+        }
+        if (UNWRAPPED_ELEMENTS.has(tag)) {
+            const parent = element.parentNode;
+            if (parent) {
+                while (element.firstChild) {
+                    parent.insertBefore(element.firstChild, element);
+                }
+            }
+            element.remove();
+            continue;
+        }
+        if (tag === "style") {
+            const text = element.textContent ?? "";
+            const safe = sanitizeStylesheetText(text);
+            if (safe !== text) {
+                element.textContent = safe;
+            }
+            // A stylesheet never needs attributes beyond `type`/`media`.
+            for (const attribute of Array.from(element.attributes)) {
+                const name = attribute.name.toLowerCase();
+                if (name !== "type" && name !== "media") {
+                    element.removeAttribute(attribute.name);
+                }
+            }
+            continue;
+        }
+        sanitizeAttributes(element);
+    }
+    return doc;
+};

package/dist/esm/condition-operand.d.ts

@@ -0,0 +1,54 @@
+import type { ConditionType } from "@rowsncolumns/common-types";
+/**
+ * Whether a condition type compares TEXT — its operand is always a string
+ * literal in Excel, even when it looks like a number or a boolean.
+ */
+export declare const isTextConditionType: (type: ConditionType | string | undefined | null) => boolean;
+export declare const escapeConditionFormulaText: (value: string) => string;
+/**
+ * The formula fragment for an operand that is a typed LITERAL — a number
+ * (`5`, `1e3`, locale `6,5`), a percentage (`50%` → `0.5`), a boolean, or a
+ * date / time in the document locale (`2024-01-05`, `1/5/2024`, `10:30` → the
+ * serial). `undefined` for anything else (text, references, formulas).
+ */
+export declare const conditionOperandLiteral: (raw: string | undefined | null, locale?: string) => string | undefined;
+/**
+ * Whether an operand (with any leading `=` already removed) is an A1
+ * reference — a cell, a range, a whole column/row, with `$` anchors and an
+ * optional (quoted) sheet qualifier: `B1`, `$B$1`, `B$1`, `Sheet1!$B$1`,
+ * `'My Sheet'!$B$1:$C$9`, `$A:$A`.
+ */
+export declare const isConditionOperandReference: (text: string) => boolean;
+/**
+ * Whether an operand (with any leading `=` already removed) is a function
+ * call — the form OOXML stores a formula bound in (`TODAY()`,
+ * `DATE(2024,1,1)`, `LEN($B$1)`): evaluated as a formula, never quoted.
+ */
+export declare const isConditionOperandFormulaCall: (text: string) => boolean;
+/**
+ * Normalize one rule operand into the formula fragment the rule builders
+ * splice into `=<cell><op><fragment>` (and the xlsx exporters write inside
+ * `<formula>` / `<formula1>` — never with a leading `=`).
+ *
+ * - `=…` → the formula text (leading `=` stripped).
+ * - `TEXT_*` types → ALWAYS a quoted string literal (`"1"`, `"TRUE"`).
+ * - A complete `"…"` string literal → as is.
+ * - An A1 reference (`$B$1`, `B$1`, `Sheet1!$B$1`, `'My Sheet'!$B$1`) → as is.
+ * - A function call (`TODAY()`, `DATE(2024,1,1)`, `LEN(A1)`) → as is.
+ * - A typed literal (number, `50%`, boolean, date/time in `locale`) → its
+ *   numeric form (`0.5`, `45296`, `TRUE`).
+ * - Anything else → a quoted string literal (`"abc"`).
+ *
+ * `""` for an empty operand.
+ */
+export declare const normalizeConditionOperand: (raw: string | undefined | null, type: ConditionType | string | undefined | null, locale?: string) => string;
+/**
+ * The OOXML `<formula>` / `<formula1>` text for a number/date rule operand:
+ * the leading `=` is stripped (Excel never writes one), typed literals are
+ * normalized to what Excel itself stores (`50%` → `0.5`, `2024-01-05` → its
+ * serial `45296` rather than the arithmetic `2024-01-05` = 2022), and every
+ * other operand — references, defined names, function calls — is written
+ * verbatim.
+ */
+export declare const conditionOperandToFormulaText: (raw: string | undefined | null, locale?: string) => string;
+//# sourceMappingURL=condition-operand.d.ts.map

package/dist/esm/condition-operand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition-operand.d.ts","sourceRoot":"","sources":["../../condition-operand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAyChE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC9B,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,KAC9C,OAA0D,CAAC;AAE9D,eAAO,MAAM,0BAA0B,GAAI,OAAO,MAAM,WAC7B,CAAC;AAsC5B;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,SAAS,MAAM,KACd,MAAM,GAAG,SA2CX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,KAAG,OACU,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,OAC5B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,GACpC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,EAC/C,SAAS,MAAM,KACd,MA0BF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACxC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,SAAS,MAAM,KACd,MAQF,CAAC"}

package/dist/esm/condition-operand.js

@@ -0,0 +1,203 @@
+import { parseDate, parseTime } from "numfmt";
+import { checkIfStringIsReference } from "./selection";
+/**
+ * How a conditional-format / data-validation rule operand (`userEnteredValue`)
+ * becomes a formula fragment — the ONE place both rule builders and both xlsx
+ * exporters classify an operand, so the runtime and the exported file agree.
+ *
+ * Excel's rule dialog stores every operand as a formula. Typed text becomes a
+ * string literal, a typed number a number, a typed date its serial, `50%` the
+ * fraction `0.5`, and `=…` stays a formula. The `TEXT_*` rules ("Text that
+ * contains…", "begins with", cellIs equal `"5"`) take a string literal no
+ * matter what was typed: *begins with "1"* highlights `1abc` AND `123`, and
+ * `cellIs equal "5"` matches the text `5` but not the number 5.
+ */
+const NUMBER_LITERAL_PATTERN = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
+const BOOLEAN_LITERAL_PATTERN = /^(TRUE|FALSE)$/i;
+const PERCENT_LITERAL_PATTERN = /^([+-]?[\d.,\s ]+)%$/;
+/** A complete formula string literal — `"abc"`, `"say ""hi"""`. */
+const QUOTED_STRING_LITERAL_PATTERN = /^"(?:[^"]|"")*"$/;
+/**
+ * A function call — `TODAY()`, `DATE(2024,1,1)`, `LEN($B$1)`, `_xlfn.XLOOKUP(…)` — which is how
+ * OOXML stores a formula bound (`<formula1>TODAY()</formula1>`, never with a leading `=`).
+ */
+const FORMULA_CALL_PATTERN = /^[A-Z_\\][\w.]*\([\s\S]*\)$/i;
+/** Whole-column / whole-row spans (`A:A`, `$A:$C`, `1:1`), optionally sheet-qualified. */
+const AXIS_REFERENCE_PATTERN = /^(?:[^!]+!)?(?:\$?[A-Z]{1,3}:\$?[A-Z]{1,3}|\$?\d+:\$?\d+)$/i;
+const TEXT_CONDITION_TYPES = new Set([
+    "TEXT_EQ",
+    "TEXT_NOT_EQ",
+    "TEXT_CONTAINS",
+    "TEXT_NOT_CONTAINS",
+    "TEXT_STARTS_WITH",
+    "TEXT_ENDS_WITH",
+]);
+/**
+ * Whether a condition type compares TEXT — its operand is always a string
+ * literal in Excel, even when it looks like a number or a boolean.
+ */
+export const isTextConditionType = (type) => Boolean(type && TEXT_CONDITION_TYPES.has(type));
+export const escapeConditionFormulaText = (value) => value.replace(/"/g, '""');
+/**
+ * Parse a locale-formatted numeric string (e.g., "6,5" in fr-FR) into a JS
+ * number. Uses `Intl.NumberFormat` to detect decimal/group separators.
+ * Returns NaN on failure.
+ */
+const parseLocaleNumberLoose = (value, locale) => {
+    try {
+        const parts = new Intl.NumberFormat(locale).formatToParts(1234.5);
+        const decimal = parts.find((part) => part.type === "decimal")?.value ?? ".";
+        const group = parts.find((part) => part.type === "group")?.value ?? ",";
+        const cleaned = value.split(group).join("").replace(decimal, ".");
+        if (!cleaned.trim() || !NUMBER_LITERAL_PATTERN.test(cleaned.trim())) {
+            return NaN;
+        }
+        return Number(cleaned);
+    }
+    catch {
+        return NaN;
+    }
+};
+/** Shortest decimal text of a number rounded to Excel's 15 significant digits. */
+const formatNumberOperand = (value) => String(Number(value.toPrecision(15)));
+const parseNumberOperand = (text, locale) => {
+    if (NUMBER_LITERAL_PATTERN.test(text)) {
+        const value = Number(text);
+        return Number.isFinite(value) ? value : undefined;
+    }
+    if (locale) {
+        const value = parseLocaleNumberLoose(text, locale);
+        return Number.isFinite(value) ? value : undefined;
+    }
+    return undefined;
+};
+/**
+ * The formula fragment for an operand that is a typed LITERAL — a number
+ * (`5`, `1e3`, locale `6,5`), a percentage (`50%` → `0.5`), a boolean, or a
+ * date / time in the document locale (`2024-01-05`, `1/5/2024`, `10:30` → the
+ * serial). `undefined` for anything else (text, references, formulas).
+ */
+export const conditionOperandLiteral = (raw, locale) => {
+    if (!raw)
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    if (BOOLEAN_LITERAL_PATTERN.test(trimmed)) {
+        return trimmed.toUpperCase();
+    }
+    if (NUMBER_LITERAL_PATTERN.test(trimmed)) {
+        // Keep the typed digits — `6.50` and `6.5` are the same number and the
+        // formula parser reads either.
+        return Number.isFinite(Number(trimmed)) ? trimmed : undefined;
+    }
+    const percent = PERCENT_LITERAL_PATTERN.exec(trimmed);
+    if (percent) {
+        const value = parseNumberOperand(percent[1].trim(), locale ?? "en-US");
+        if (value !== undefined) {
+            return formatNumberOperand(value / 100);
+        }
+    }
+    // Dates (incl. date+time) and times, in the document locale's field order
+    // (`1/5/2024` is Jan 5 in en-US, May 1 in en-GB; `1.5.2024` is a de-DE
+    // date, not the grouped number 152024). numfmt's default locale is
+    // month-first, matching the app default.
+    try {
+        const dateOptions = locale ? { locale } : undefined;
+        const date = parseDate(trimmed, dateOptions);
+        if (date && typeof date.v === "number" && Number.isFinite(date.v)) {
+            return formatNumberOperand(date.v);
+        }
+        const time = parseTime(trimmed);
+        if (time && typeof time.v === "number" && Number.isFinite(time.v)) {
+            return formatNumberOperand(time.v);
+        }
+    }
+    catch {
+        // numfmt throws on malformed locale tags — the operand is then plain text.
+    }
+    if (locale) {
+        const value = parseLocaleNumberLoose(trimmed, locale);
+        if (Number.isFinite(value)) {
+            return formatNumberOperand(value);
+        }
+    }
+    return undefined;
+};
+/**
+ * Whether an operand (with any leading `=` already removed) is an A1
+ * reference — a cell, a range, a whole column/row, with `$` anchors and an
+ * optional (quoted) sheet qualifier: `B1`, `$B$1`, `B$1`, `Sheet1!$B$1`,
+ * `'My Sheet'!$B$1:$C$9`, `$A:$A`.
+ */
+export const isConditionOperandReference = (text) => checkIfStringIsReference(text) || AXIS_REFERENCE_PATTERN.test(text);
+/**
+ * Whether an operand (with any leading `=` already removed) is a function
+ * call — the form OOXML stores a formula bound in (`TODAY()`,
+ * `DATE(2024,1,1)`, `LEN($B$1)`): evaluated as a formula, never quoted.
+ */
+export const isConditionOperandFormulaCall = (text) => FORMULA_CALL_PATTERN.test(text);
+/**
+ * Normalize one rule operand into the formula fragment the rule builders
+ * splice into `=<cell><op><fragment>` (and the xlsx exporters write inside
+ * `<formula>` / `<formula1>` — never with a leading `=`).
+ *
+ * - `=…` → the formula text (leading `=` stripped).
+ * - `TEXT_*` types → ALWAYS a quoted string literal (`"1"`, `"TRUE"`).
+ * - A complete `"…"` string literal → as is.
+ * - An A1 reference (`$B$1`, `B$1`, `Sheet1!$B$1`, `'My Sheet'!$B$1`) → as is.
+ * - A function call (`TODAY()`, `DATE(2024,1,1)`, `LEN(A1)`) → as is.
+ * - A typed literal (number, `50%`, boolean, date/time in `locale`) → its
+ *   numeric form (`0.5`, `45296`, `TRUE`).
+ * - Anything else → a quoted string literal (`"abc"`).
+ *
+ * `""` for an empty operand.
+ */
+export const normalizeConditionOperand = (raw, type, locale) => {
+    if (!raw)
+        return "";
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return "";
+    if (trimmed.startsWith("=")) {
+        return trimmed.slice(1);
+    }
+    if (isTextConditionType(type)) {
+        return `"${escapeConditionFormulaText(trimmed)}"`;
+    }
+    if (QUOTED_STRING_LITERAL_PATTERN.test(trimmed)) {
+        return trimmed;
+    }
+    if (checkIfStringIsReference(trimmed) || isConditionOperandFormulaCall(trimmed)) {
+        return trimmed;
+    }
+    // Typed literals before whole-row spans: `10:30` is the time 10:30, not
+    // rows 10–30 (Excel's dialog reads it the way a cell entry would).
+    const literal = conditionOperandLiteral(trimmed, locale);
+    if (literal !== undefined) {
+        return literal;
+    }
+    if (isConditionOperandReference(trimmed)) {
+        return trimmed;
+    }
+    return `"${escapeConditionFormulaText(trimmed)}"`;
+};
+/**
+ * The OOXML `<formula>` / `<formula1>` text for a number/date rule operand:
+ * the leading `=` is stripped (Excel never writes one), typed literals are
+ * normalized to what Excel itself stores (`50%` → `0.5`, `2024-01-05` → its
+ * serial `45296` rather than the arithmetic `2024-01-05` = 2022), and every
+ * other operand — references, defined names, function calls — is written
+ * verbatim.
+ */
+export const conditionOperandToFormulaText = (raw, locale) => {
+    if (!raw)
+        return "";
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return "";
+    if (trimmed.startsWith("=")) {
+        return trimmed.slice(1);
+    }
+    return conditionOperandLiteral(trimmed, locale) ?? trimmed;
+};

package/dist/esm/conditional-format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-format.d.ts","sourceRoot":"","sources":["../../conditional-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,4BAA4B,CAAC;AAKpC;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D,CAAC;AA+DF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,GACzC,MAAM,yBAAyB,GAAG,SAAS,YAK5C,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,MAAM,yBAAyB,GAAG,SAAS,EAC3C,aAAa,MAAM,EACnB,SAAS,MAAM,uBA8HhB,CAAC"}
+{"version":3,"file":"conditional-format.d.ts","sourceRoot":"","sources":["../../conditional-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,4BAA4B,CAAC;AAQpC;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,GACzC,MAAM,yBAAyB,GAAG,SAAS,YAK5C,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,MAAM,yBAAyB,GAAG,SAAS,EAC3C,aAAa,MAAM,EACnB,SAAS,MAAM,uBA8HhB,CAAC"}