@rowsncolumns/utils 9.5.1 → 9.5.4

package/dist/cjs/data-validation.js

@@ -1,11 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildDataValidationExpression = exports.isDataValidationFormulaRule = exports.dataValidationOptionMatchesCellValue = exports.stripDataValidationTextPrefix = void 0;
-var selection_1 = require("./selection");
+var condition_operand_1 = require("./condition-operand");
 var FORMULA_PREDICATE_BASE_CELL_REF = "A1";
-var NUMBER_LITERAL_PATTERN = /^-?\d+(?:\.\d+)?$/;
-var BOOLEAN_LITERAL_PATTERN = /^(TRUE|FALSE)$/i;
-var escapeFormulaText = function (value) { return value.replace(/"/g, '""'); };
 /**
  * A leading apostrophe in a data-validation / conditional-format list entry is
  * Excel's text prefix — `'000s` is the text "000s" and a bare `'` is empty
@@ -29,57 +26,6 @@ var dataValidationOptionMatchesCellValue = function (option, cellValue) {
     return normalizedOption.toLowerCase() === normalizedValue.toLowerCase();
 };
 exports.dataValidationOptionMatchesCellValue = dataValidationOptionMatchesCellValue;
-/**
- * Parse a locale-formatted numeric string (e.g., "6,5" in fr-FR) into a JS
- * number. Uses `Intl.NumberFormat` to detect decimal/group separators.
- * Returns NaN on failure.
- */
-var parseLocaleNumberLoose = function (value, locale) {
-    var _a, _b, _c, _d;
-    try {
-        var parts = new Intl.NumberFormat(locale).formatToParts(1234.5);
-        var decimal = (_b = (_a = parts.find(function (part) { return part.type === "decimal"; })) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : ".";
-        var group = (_d = (_c = parts.find(function (part) { return part.type === "group"; })) === null || _c === void 0 ? void 0 : _c.value) !== null && _d !== void 0 ? _d : ",";
-        var cleaned = value.split(group).join("").replace(decimal, ".");
-        return Number(cleaned);
-    }
-    catch (_e) {
-        return NaN;
-    }
-};
-/**
- * Normalize a condition value for use in a formula expression.
- * Handles locale-specific number formats (e.g., "6,5" -> "6.5").
- */
-var normalizeConditionValue = function (raw, allowStringLiteral, locale) {
-    if (allowStringLiteral === void 0) { allowStringLiteral = false; }
-    if (!raw)
-        return "";
-    var trimmed = raw.trim();
-    if (!trimmed)
-        return "";
-    if (trimmed.startsWith("=")) {
-        return trimmed.slice(1);
-    }
-    if ((0, selection_1.checkIfStringIsReference)(trimmed)) {
-        return trimmed;
-    }
-    if (NUMBER_LITERAL_PATTERN.test(trimmed) ||
-        BOOLEAN_LITERAL_PATTERN.test(trimmed)) {
-        return trimmed;
-    }
-    // Try parsing as locale-aware number
-    if (locale) {
-        var parsed = parseLocaleNumberLoose(trimmed, locale);
-        if (!isNaN(parsed)) {
-            return String(parsed);
-        }
-    }
-    if (allowStringLiteral) {
-        return "\"".concat(escapeFormulaText(trimmed), "\"");
-    }
-    return trimmed;
-};
 /**
  * Whether a data validation rule is evaluated via the calculator (formula path)
  * instead of the synchronous `checkBooleanRule` path used in
@@ -120,7 +66,29 @@ var isDataValidationFormulaRule = function (rule) {
     return Boolean((0, exports.buildDataValidationExpression)(rule, FORMULA_PREDICATE_BASE_CELL_REF));
 };
 exports.isDataValidationFormulaRule = isDataValidationFormulaRule;
+/**
+ * Excel's *Whole number* validation kind rejects any non-integer (`5.5` fails
+ * "whole between 1 and 10"). An imported `type="whole"` rule carries a plain
+ * `NUMBER_*` comparison as its `condition` (the bounds) — which alone accepts
+ * `5.5` — so when the rule's `xlsxSource.type` is `whole` the comparison is
+ * wrapped in the same integer guard `buildExcelValidationRule` composes for
+ * an authored Whole-number rule: `AND(ISNUMBER(x), x=INT(x), <comparison>)`.
+ * Rules of other kinds, and non-`NUMBER_*` conditions, are returned as built.
+ */
 var buildDataValidationExpression = function (rule, baseCellRef, locale) {
+    var _a, _b, _c, _d;
+    var expression = buildDataValidationConditionExpression(rule, baseCellRef, locale);
+    if (!expression)
+        return undefined;
+    var isWholeSource = ((_b = (_a = rule === null || rule === void 0 ? void 0 : rule.xlsxSource) === null || _a === void 0 ? void 0 : _a.type) === null || _b === void 0 ? void 0 : _b.trim().toLowerCase()) === "whole";
+    var isNumberCondition = Boolean((_d = (_c = rule === null || rule === void 0 ? void 0 : rule.condition) === null || _c === void 0 ? void 0 : _c.type) === null || _d === void 0 ? void 0 : _d.startsWith("NUMBER_"));
+    if (!isWholeSource || !isNumberCondition)
+        return expression;
+    var body = expression.startsWith("=") ? expression.slice(1) : expression;
+    return "=AND(ISNUMBER(".concat(baseCellRef, "),").concat(baseCellRef, "=INT(").concat(baseCellRef, "),").concat(body, ")");
+};
+exports.buildDataValidationExpression = buildDataValidationExpression;
+var buildDataValidationConditionExpression = function (rule, baseCellRef, locale) {
     var _a, _b, _c;
     var condition = rule === null || rule === void 0 ? void 0 : rule.condition;
     if (!(condition === null || condition === void 0 ? void 0 : condition.type))
@@ -135,8 +103,8 @@ var buildDataValidationExpression = function (rule, baseCellRef, locale) {
             return undefined;
         return trimmed.startsWith("=") ? trimmed : "=".concat(trimmed);
     }
-    var fromExpr = normalizeConditionValue(fromRaw, true, locale);
-    var toExpr = normalizeConditionValue(toRaw, true, locale);
+    var fromExpr = (0, condition_operand_1.normalizeConditionOperand)(fromRaw, condition.type, locale);
+    var toExpr = (0, condition_operand_1.normalizeConditionOperand)(toRaw, condition.type, locale);
     if (!fromExpr && !toExpr)
         return undefined;
     var comparisonOperatorMap = {
@@ -217,7 +185,7 @@ var buildDataValidationExpression = function (rule, baseCellRef, locale) {
             .flatMap(function (entry) {
             if (entry.startsWith("'")) {
                 var stripped = (0, exports.stripDataValidationTextPrefix)(entry);
-                var textCondition = "".concat(baseCellRef, "=\"").concat(escapeFormulaText(stripped), "\"");
+                var textCondition = "".concat(baseCellRef, "=\"").concat((0, condition_operand_1.escapeConditionFormulaText)(stripped), "\"");
                 // The bare `'` entry means empty text, and a cell storing the lone
                 // text-prefix apostrophe is equivalent to a blank cell — accept it too.
                 return stripped === ""
@@ -225,7 +193,9 @@ var buildDataValidationExpression = function (rule, baseCellRef, locale) {
                     : [textCondition];
             }
             return entry
-                ? ["".concat(baseCellRef, "=").concat(normalizeConditionValue(entry, true, locale))]
+                ? [
+                    "".concat(baseCellRef, "=").concat((0, condition_operand_1.normalizeConditionOperand)(entry, condition.type, locale)),
+                ]
                 : [];
         })
             .filter(function (entry) { return Boolean(entry); });
@@ -246,4 +216,3 @@ var buildDataValidationExpression = function (rule, baseCellRef, locale) {
     }
     return undefined;
 };
-exports.buildDataValidationExpression = buildDataValidationExpression;

package/dist/cjs/date.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Excel's 1900 date system counts a day that never happened: serial 60 is
+ * 1900-02-29 (Lotus 1-2-3 compatibility). 1900-01-01 is 1, 1900-02-28 is 59,
+ * 1900-03-01 is 61. Google Sheets keeps the same numbering.
+ */
+export declare const EXCEL_LEAP_BUG_SERIAL = 60;
+/** The calendar day Excel's serial 60 stands for, which no `Date` can hold. */
+export declare const isExcelLeapDay: (year: number, month: number, day: number) => boolean;
 export type DateSerialMode = "local" | "excel-utc";
 /**
  * Convert date to serial with explicit time zone behavior.
@@ -6,6 +14,14 @@ export type DateSerialMode = "local" | "excel-utc";
  */
 export declare const toSerialWithMode: (date: Date, use1904?: boolean, mode?: DateSerialMode) => number;
 export declare const toSerial: (date: Date, use1904?: boolean) => number;
+/**
+ * Serial for calendar parts the way a user typed them. Unlike
+ * `toSerial(new Date(y, m, d))`, this never goes through a `Date`, so the
+ * phantom 1900-02-29 stays serial 60 instead of rolling over to March 1
+ * (rowsncolumns/spreadsheet#1026). Every other date takes the same path as
+ * `toSerial` in "local" mode. `month` is 0-based like `Date`.
+ */
+export declare const toSerialFromParts: (year: number, month: number, day: number, hour?: number, minute?: number, second?: number, use1904?: boolean) => number;
 /**
  * Convert serial to date
  * @param serial

package/dist/cjs/date.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"date.d.ts","sourceRoot":"","sources":["../../date.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,IAAI,EACV,iBAAe,EACf,OAAM,cAAwB,WAwB/B,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,IAAI,EAAE,iBAAe,WAEnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,iBAAe,SA+BrD,CAAC"}
+{"version":3,"file":"date.d.ts","sourceRoot":"","sources":["../../date.ts"],"names":[],"mappings":"AACA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+EAA+E;AAC/E,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,EAAE,KAAK,MAAM,YAC3B,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,IAAI,EACV,iBAAe,EACf,OAAM,cAAwB,WAwB/B,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,IAAI,EAAE,iBAAe,WAEnD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,OAAO,MAAM,EACb,KAAK,MAAM,EACX,aAAQ,EACR,eAAU,EACV,eAAU,EACV,iBAAe,WAWhB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,iBAAe,SA+BrD,CAAC"}

package/dist/cjs/date.js

@@ -1,8 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toDate = exports.toSerial = exports.toSerialWithMode = void 0;
+exports.toDate = exports.toSerialFromParts = exports.toSerial = exports.toSerialWithMode = exports.isExcelLeapDay = exports.EXCEL_LEAP_BUG_SERIAL = void 0;
 var DAY_TO_MS = 24 * 60 * 60 * 1000;
-var EXCEL_LEAP_BUG_SERIAL = 60;
+/**
+ * Excel's 1900 date system counts a day that never happened: serial 60 is
+ * 1900-02-29 (Lotus 1-2-3 compatibility). 1900-01-01 is 1, 1900-02-28 is 59,
+ * 1900-03-01 is 61. Google Sheets keeps the same numbering.
+ */
+exports.EXCEL_LEAP_BUG_SERIAL = 60;
+/** The calendar day Excel's serial 60 stands for, which no `Date` can hold. */
+var isExcelLeapDay = function (year, month, day) {
+    return year === 1900 && month === 1 && day === 29;
+};
+exports.isExcelLeapDay = isExcelLeapDay;
 /**
  * Convert date to serial with explicit time zone behavior.
  * - local: interpret date components in local time (UI entry behavior).
@@ -31,6 +41,25 @@ var toSerial = function (date, use1904) {
     return (0, exports.toSerialWithMode)(date, use1904, "local");
 };
 exports.toSerial = toSerial;
+/**
+ * Serial for calendar parts the way a user typed them. Unlike
+ * `toSerial(new Date(y, m, d))`, this never goes through a `Date`, so the
+ * phantom 1900-02-29 stays serial 60 instead of rolling over to March 1
+ * (rowsncolumns/spreadsheet#1026). Every other date takes the same path as
+ * `toSerial` in "local" mode. `month` is 0-based like `Date`.
+ */
+var toSerialFromParts = function (year, month, day, hour, minute, second, use1904) {
+    if (hour === void 0) { hour = 0; }
+    if (minute === void 0) { minute = 0; }
+    if (second === void 0) { second = 0; }
+    if (use1904 === void 0) { use1904 = false; }
+    var timeFraction = (hour * 3600 + minute * 60 + second) / (24 * 60 * 60);
+    if (!use1904 && (0, exports.isExcelLeapDay)(year, month, day)) {
+        return exports.EXCEL_LEAP_BUG_SERIAL + timeFraction;
+    }
+    return (0, exports.toSerialWithMode)(new Date(year, month, day, hour, minute, second, 0), use1904, "local");
+};
+exports.toSerialFromParts = toSerialFromParts;
 /**
  * Convert serial to date
  * @param serial
@@ -44,11 +73,11 @@ var toDate = function (serial, use1904) {
         var utcDate_1 = new Date(utcMillis_1);
         return new Date(utcDate_1.getUTCFullYear(), utcDate_1.getUTCMonth(), utcDate_1.getUTCDate(), utcDate_1.getUTCHours(), utcDate_1.getUTCMinutes(), utcDate_1.getUTCSeconds(), utcDate_1.getUTCMilliseconds());
     }
-    if (serial === EXCEL_LEAP_BUG_SERIAL) {
+    if (serial === exports.EXCEL_LEAP_BUG_SERIAL) {
         return new Date(1900, 1, 28);
     }
     var baseUtc = Date.UTC(1899, 11, 31);
-    var dayCount = serial < EXCEL_LEAP_BUG_SERIAL ? serial : serial - 1;
+    var dayCount = serial < exports.EXCEL_LEAP_BUG_SERIAL ? serial : serial - 1;
     var utcMillis = baseUtc + dayCount * DAY_TO_MS;
     var utcDate = new Date(utcMillis);
     return new Date(utcDate.getUTCFullYear(), utcDate.getUTCMonth(), utcDate.getUTCDate(), utcDate.getUTCHours(), utcDate.getUTCMinutes(), utcDate.getUTCSeconds(), utcDate.getUTCMilliseconds());

package/dist/cjs/index.d.ts

@@ -18,6 +18,7 @@ export * from "./colors";
 export * from "./formula-refs";
 export * from "./sort";
 export * from "./table-styles";
+export * from "./condition-operand";
 export * from "./conditional-format";
 export * from "./data-validation";
 export * from "./content-hash";
@@ -26,8 +27,11 @@ export * from "./keyboard";
 export * from "./sheet-span";
 export * from "./formula-locale";
 export * from "./table-names";
+export * from "./sheet-names";
+export * from "./sheet-protection";
 export * from "./table-totals";
 export * from "./sparkline-groups";
 export * from "./rich-text-html";
+export * from "./clipboard-html-sanitize";
 export * from "./rich-text-links";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AACxB,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC;AACvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AACxB,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC;AACvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC"}

package/dist/cjs/index.js

@@ -21,6 +21,7 @@ tslib_1.__exportStar(require("./colors"), exports);
 tslib_1.__exportStar(require("./formula-refs"), exports);
 tslib_1.__exportStar(require("./sort"), exports);
 tslib_1.__exportStar(require("./table-styles"), exports);
+tslib_1.__exportStar(require("./condition-operand"), exports);
 tslib_1.__exportStar(require("./conditional-format"), exports);
 tslib_1.__exportStar(require("./data-validation"), exports);
 tslib_1.__exportStar(require("./content-hash"), exports);
@@ -29,7 +30,10 @@ tslib_1.__exportStar(require("./keyboard"), exports);
 tslib_1.__exportStar(require("./sheet-span"), exports);
 tslib_1.__exportStar(require("./formula-locale"), exports);
 tslib_1.__exportStar(require("./table-names"), exports);
+tslib_1.__exportStar(require("./sheet-names"), exports);
+tslib_1.__exportStar(require("./sheet-protection"), exports);
 tslib_1.__exportStar(require("./table-totals"), exports);
 tslib_1.__exportStar(require("./sparkline-groups"), exports);
 tslib_1.__exportStar(require("./rich-text-html"), exports);
+tslib_1.__exportStar(require("./clipboard-html-sanitize"), exports);
 tslib_1.__exportStar(require("./rich-text-links"), exports);

package/dist/cjs/rich-text-html.d.ts

@@ -52,6 +52,15 @@ export type ParsedRichText = {
  * Parse an HTML clipboard payload into a hidden, mounted sandbox so
  * `getComputedStyle` resolves the payload's own `<style>` rules (Excel's
  * `.fontN` / `.xlNN` classes). Callers must `cleanup()` when done.
+ *
+ * The payload is untrusted. It is parsed with `DOMParser` (an inert document:
+ * no scripts run, no handlers fire, nothing loads), stripped by
+ * {@link sanitizeClipboardDocument} — scripts, frames, embeds, SVG/MathML,
+ * every `on*` handler, `javascript:`/`data:` links and network-reaching CSS —
+ * and only then are the surviving nodes imported into the live sandbox. The
+ * import is node-by-node (`importNode`), never a serialize + `innerHTML`
+ * round trip, so the parser cannot re-interpret the sanitized tree (mXSS).
+ * This sanitization is not optional and runs for every clipboard consumer.
  */
 export declare const mountClipboardHtml: (clipboardValue: string) => {
     root: HTMLDivElement;

package/dist/cjs/rich-text-html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rich-text-html.d.ts","sourceRoot":"","sources":["../../rich-text-html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAK5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;IAClC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAgGF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,MAAM;;;CAmBxD,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAkBX,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,eAAe,GAC1B,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAoBX,CAAC;AA+SF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,WAAW,KAAG,cA+DzD,CAAC;AAgBF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,WAAW,KAChB,WAAW,GAAG,SAShB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,MAAM,KACX,cAAc,GAAG,SAkBnB,CAAC"}
+{"version":3,"file":"rich-text-html.d.ts","sourceRoot":"","sources":["../../rich-text-html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAO5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;IAClC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAgGF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,MAAM;;;CA0BxD,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAkBX,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,eAAe,GAC1B,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAoBX,CAAC;AAiTF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,WAAW,KAAG,cA+DzD,CAAC;AAgBF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,WAAW,KAChB,WAAW,GAAG,SAShB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,MAAM,KACX,cAAc,GAAG,SAkBnB,CAAC"}

package/dist/cjs/rich-text-html.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.clipboardHtmlToRichText = exports.findSingleClipboardCell = exports.htmlElementToRichText = exports.cssFontSizeToPt = exports.cssColorToHex = exports.mountClipboardHtml = void 0;
 var tslib_1 = require("tslib");
+var clipboard_html_sanitize_1 = require("./clipboard-html-sanitize");
 var color_1 = require("./color");
 var dom_1 = require("./dom");
+var string_1 = require("./string");
 var BLOCK_TAGS = new Set([
     "p",
     "div",
@@ -90,17 +92,42 @@ var NON_COLORS = new Set([
  * Parse an HTML clipboard payload into a hidden, mounted sandbox so
  * `getComputedStyle` resolves the payload's own `<style>` rules (Excel's
  * `.fontN` / `.xlNN` classes). Callers must `cleanup()` when done.
+ *
+ * The payload is untrusted. It is parsed with `DOMParser` (an inert document:
+ * no scripts run, no handlers fire, nothing loads), stripped by
+ * {@link sanitizeClipboardDocument} — scripts, frames, embeds, SVG/MathML,
+ * every `on*` handler, `javascript:`/`data:` links and network-reaching CSS —
+ * and only then are the surviving nodes imported into the live sandbox. The
+ * import is node-by-node (`importNode`), never a serialize + `innerHTML`
+ * round trip, so the parser cannot re-interpret the sanitized tree (mXSS).
+ * This sanitization is not optional and runs for every clipboard consumer.
  */
 var mountClipboardHtml = function (clipboardValue) {
-    var _a, _b, _c, _d;
+    var e_1, _a;
+    var _b, _c;
     var parser = new DOMParser();
-    var doc = parser.parseFromString(clipboardValue, "text/html");
+    var doc = (0, clipboard_html_sanitize_1.sanitizeClipboardDocument)(parser.parseFromString(clipboardValue, "text/html"));
     var sandbox = document.createElement("div");
     sandbox.style.cssText =
         "position:fixed;left:-10000px;top:-10000px;width:0;height:0;overflow:hidden;opacity:0;pointer-events:none;font-size:10pt;";
-    sandbox.innerHTML = (_b = (_a = doc.body) === null || _a === void 0 ? void 0 : _a.innerHTML) !== null && _b !== void 0 ? _b : "";
-    var styles = (_d = (_c = doc.head) === null || _c === void 0 ? void 0 : _c.querySelectorAll("style")) !== null && _d !== void 0 ? _d : [];
-    styles.forEach(function (style) { return sandbox.appendChild(style.cloneNode(true)); });
+    var bodyChildren = doc.body ? Array.from(doc.body.childNodes) : [];
+    try {
+        for (var bodyChildren_1 = tslib_1.__values(bodyChildren), bodyChildren_1_1 = bodyChildren_1.next(); !bodyChildren_1_1.done; bodyChildren_1_1 = bodyChildren_1.next()) {
+            var child = bodyChildren_1_1.value;
+            sandbox.appendChild(document.importNode(child, true));
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (bodyChildren_1_1 && !bodyChildren_1_1.done && (_a = bodyChildren_1.return)) _a.call(bodyChildren_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    var styles = (_c = (_b = doc.head) === null || _b === void 0 ? void 0 : _b.querySelectorAll("style")) !== null && _c !== void 0 ? _c : [];
+    styles.forEach(function (style) {
+        return sandbox.appendChild(document.importNode(style, true));
+    });
     document.body.appendChild(sandbox);
     return {
         root: sandbox,
@@ -244,8 +271,10 @@ var readElementFormat = function (element, inherited) {
             break;
         }
         case "a": {
+            // The sanitizer already drops unsafe hrefs from clipboard payloads;
+            // this converter also serves non-clipboard callers, so re-check here.
             var href = element.getAttribute("href");
-            if (href && href.trim()) {
+            if (href && href.trim() && (0, string_1.isSafeHyperlinkUri)(href)) {
                 format.link = { uri: href.trim() };
             }
             break;
@@ -318,7 +347,7 @@ var isBlockElement = function (element) {
     return display === "block" || display === "list-item";
 };
 var collectSegments = function (node, inherited, segments) {
-    var e_1, _a;
+    var e_2, _a;
     var _b;
     if (node.nodeType === Node.TEXT_NODE) {
         var text = normalizeWhitespace((_b = node.textContent) !== null && _b !== void 0 ? _b : "");
@@ -350,12 +379,12 @@ var collectSegments = function (node, inherited, segments) {
             collectSegments(child, format, segments);
         }
     }
-    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
     finally {
         try {
             if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
         }
-        finally { if (e_1) throw e_1.error; }
+        finally { if (e_2) throw e_2.error; }
     }
     if (block && segments.length && !endsWithNewline(segments)) {
         segments.push({ text: "\n", format: inherited });
@@ -377,7 +406,7 @@ var TEXT_KEYS = [
 ];
 /** The properties of `format` that differ from `base` (the run's own contribution). */
 var diffFormat = function (format, base) {
-    var e_2, _a;
+    var e_3, _a;
     var diff = {};
     try {
         for (var TEXT_KEYS_1 = tslib_1.__values(TEXT_KEYS), TEXT_KEYS_1_1 = TEXT_KEYS_1.next(); !TEXT_KEYS_1_1.done; TEXT_KEYS_1_1 = TEXT_KEYS_1.next()) {
@@ -407,17 +436,17 @@ var diffFormat = function (format, base) {
             diff[key] = normalizedValue;
         }
     }
-    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    catch (e_3_1) { e_3 = { error: e_3_1 }; }
     finally {
         try {
             if (TEXT_KEYS_1_1 && !TEXT_KEYS_1_1.done && (_a = TEXT_KEYS_1.return)) _a.call(TEXT_KEYS_1);
         }
-        finally { if (e_2) throw e_2.error; }
+        finally { if (e_3) throw e_3.error; }
     }
     return diff;
 };
 var sameFormat = function (a, b) {
-    var e_3, _a;
+    var e_4, _a;
     var keys = new Set(tslib_1.__spreadArray(tslib_1.__spreadArray([], tslib_1.__read(Object.keys(a)), false), tslib_1.__read(Object.keys(b)), false));
     try {
         for (var keys_1 = tslib_1.__values(keys), keys_1_1 = keys_1.next(); !keys_1_1.done; keys_1_1 = keys_1.next()) {
@@ -435,12 +464,12 @@ var sameFormat = function (a, b) {
             }
         }
     }
-    catch (e_3_1) { e_3 = { error: e_3_1 }; }
+    catch (e_4_1) { e_4 = { error: e_4_1 }; }
     finally {
         try {
             if (keys_1_1 && !keys_1_1.done && (_a = keys_1.return)) _a.call(keys_1);
         }
-        finally { if (e_3) throw e_3.error; }
+        finally { if (e_4) throw e_4.error; }
     }
     return true;
 };
@@ -452,7 +481,7 @@ var isEmptyFormat = function (format) {
  * table-less HTML) into the engine's rich-text shape. See the module doc.
  */
 var htmlElementToRichText = function (root) {
-    var e_4, _a, e_5, _b;
+    var e_5, _a, e_6, _b;
     var _c, _d, _e;
     var baseFormat = normalizeBase(readElementFormat(root, {}));
     var segments = [];
@@ -462,12 +491,12 @@ var htmlElementToRichText = function (root) {
             collectSegments(child, baseFormat, segments);
         }
     }
-    catch (e_4_1) { e_4 = { error: e_4_1 }; }
+    catch (e_5_1) { e_5 = { error: e_5_1 }; }
     finally {
         try {
             if (_g && !_g.done && (_a = _f.return)) _a.call(_f);
         }
-        finally { if (e_4) throw e_4.error; }
+        finally { if (e_5) throw e_5.error; }
     }
     // Trim outer whitespace (leading/trailing spaces and line breaks) so the
     // text matches `extractTextContent`, shifting the segments with it.
@@ -512,12 +541,12 @@ var htmlElementToRichText = function (root) {
             runs.push({ startIndex: start, endIndex: end, format: format, nodeType: "text" });
         }
     }
-    catch (e_5_1) { e_5 = { error: e_5_1 }; }
+    catch (e_6_1) { e_6 = { error: e_6_1 }; }
     finally {
         try {
             if (segments_1_1 && !segments_1_1.done && (_b = segments_1.return)) _b.call(segments_1);
         }
-        finally { if (e_5) throw e_5.error; }
+        finally { if (e_6) throw e_6.error; }
     }
     var wholeTextLink = links.find(function (link) { return link.startIndex === 0 && link.endIndex === text.length; });
     var hyperlink = (_d = wholeTextLink === null || wholeTextLink === void 0 ? void 0 : wholeTextLink.uri) !== null && _d !== void 0 ? _d : (_e = links[0]) === null || _e === void 0 ? void 0 : _e.uri;
@@ -534,7 +563,7 @@ exports.htmlElementToRichText = htmlElementToRichText;
 // The base drops the segment-only `link` key and `false`/`null` values — a
 // container can't be "not bold" more than the default already is.
 var normalizeBase = function (format) {
-    var e_6, _a;
+    var e_7, _a;
     var base = {};
     try {
         for (var TEXT_KEYS_2 = tslib_1.__values(TEXT_KEYS), TEXT_KEYS_2_1 = TEXT_KEYS_2.next(); !TEXT_KEYS_2_1.done; TEXT_KEYS_2_1 = TEXT_KEYS_2.next()) {
@@ -546,12 +575,12 @@ var normalizeBase = function (format) {
             base[key] = value;
         }
     }
-    catch (e_6_1) { e_6 = { error: e_6_1 }; }
+    catch (e_7_1) { e_7 = { error: e_7_1 }; }
     finally {
         try {
             if (TEXT_KEYS_2_1 && !TEXT_KEYS_2_1.done && (_a = TEXT_KEYS_2.return)) _a.call(TEXT_KEYS_2);
         }
-        finally { if (e_6) throw e_6.error; }
+        finally { if (e_7) throw e_7.error; }
     }
     return base;
 };

package/dist/cjs/sheet-names.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Excel compares worksheet names case-insensitively: `SHEET1` beside `Sheet1` is refused with
+ * "That name is already taken. Try a different one." The calc engine's sheet registry folds names
+ * the same way, so two sheets differing only by case would alias one engine sheet — every write to
+ * the second lands in the first and `=SHEET1!A1` resolves to whichever was registered first
+ * (Athena-Intel/demo-app-monorepo#37167 UI2-1). Both engines' rename / create / duplicate paths and
+ * the sheet tabs compare titles through these helpers (the rnc store mirrors them in Rust and
+ * surfaces the same message through its `rejections` channel).
+ */
+export declare const SHEET_NAME_TAKEN_MESSAGE = "That name is already taken. Try a different one.";
+/** The identity two worksheet titles are compared under: trimmed, Unicode-lowercased. */
+export declare const sheetTitleKey: (title: string) => string;
+/** Whether `a` and `b` name the same worksheet under Excel's comparison. */
+export declare const isSameSheetTitle: (a: string, b: string) => boolean;
+/**
+ * Whether another sheet (any but `exceptSheetId`) already holds `title`, case-insensitively. A
+ * sheet may always re-case its own title (`Sheet1` → `SHEET1` in place is not a collision).
+ */
+export declare const isSheetTitleTaken: (title: string, sheets: Iterable<{
+    sheetId: number;
+    title: string;
+}>, exceptSheetId?: number) => boolean;
+/**
+ * `base` if no title in `existing` holds it (case-insensitively), else the first free
+ * `base 1`, `base 2`, … — the suffix scheme the JS engine uses for a new / duplicated sheet.
+ * Every candidate stays within `maxLength` (the suffix wins over the tail of a long base).
+ */
+export declare const uniqueSheetTitle: (base: string, existing: Iterable<string>, maxLength?: number) => string;
+/** Excel's ceiling for a worksheet name, in UTF-16 code units (what `String#length` counts). */
+export declare const SHEET_NAME_MAX_LENGTH = 31;
+/** The characters Excel never allows anywhere in a worksheet name: `\ / ? * [ ] :`. */
+export declare const SHEET_NAME_ILLEGAL_CHARACTERS: readonly ["\\", "/", "?", "*", "[", "]", ":"];
+/** Excel reserves this title for its change-history sheet (compared case-insensitively). */
+export declare const SHEET_NAME_RESERVED_WORD = "History";
+/**
+ * Excel 365's rename-refusal dialog, verbatim — one message for every rule except the duplicate
+ * title, which has its own ({@link SHEET_NAME_TAKEN_MESSAGE}).
+ */
+export declare const SHEET_NAME_INVALID_MESSAGE: string;
+/** Why a worksheet name was refused — a stable key hosts may branch on; `message` is the dialog text. */
+export type SheetNameRejectionReason = "blank" | "too-long" | "illegal-character" | "apostrophe" | "reserved" | "taken";
+export type SheetNameValidation = {
+    ok: true;
+} | {
+    ok: false;
+    reason: SheetNameRejectionReason;
+    message: string;
+};
+/**
+ * Excel's worksheet-name rules, in the order its dialog lists them: not blank, at most 31 characters,
+ * none of `\ / ? * [ ] :`, no leading or trailing apostrophe, not `History`, and unique among
+ * `existing` compared case-insensitively (a sheet may always re-case its own title — pass its id as
+ * `exceptSheetId`). Both engines' rename / create paths and the sheet tabs validate through this one
+ * function (the rnc store mirrors it in Rust and surfaces the same messages via its `rejections`).
+ */
+export declare const validateSheetName: (name: string, existing?: Iterable<{
+    sheetId: number;
+    title: string;
+} | string>, exceptSheetId?: number) => SheetNameValidation;
+//# sourceMappingURL=sheet-names.d.ts.map

package/dist/cjs/sheet-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sheet-names.d.ts","sourceRoot":"","sources":["../../sheet-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,wBAAwB,qDACe,CAAC;AAErD,yFAAyF;AACzF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,MAClB,CAAC;AAE7B,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OACjB,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,QAAQ,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EACpD,gBAAgB,MAAM,KACrB,OAQF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,QAAQ,CAAC,MAAM,CAAC,EAC1B,kBAAoC,KACnC,MAgBF,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,uFAAuF;AACvF,eAAO,MAAM,6BAA6B,+CAAgD,CAAC;AAG3F,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAO3B,CAAC;AAEb,yGAAyG;AACzG,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,UAAU,GACV,mBAAmB,GACnB,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,WAAU,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAM,EACpE,gBAAgB,MAAM,KACrB,mBAgCF,CAAC"}