@rowsncolumns/utils 9.5.1 → 9.5.4

package/dist/cjs/sheet-names.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * Excel compares worksheet names case-insensitively: `SHEET1` beside `Sheet1` is refused with
+ * "That name is already taken. Try a different one." The calc engine's sheet registry folds names
+ * the same way, so two sheets differing only by case would alias one engine sheet — every write to
+ * the second lands in the first and `=SHEET1!A1` resolves to whichever was registered first
+ * (Athena-Intel/demo-app-monorepo#37167 UI2-1). Both engines' rename / create / duplicate paths and
+ * the sheet tabs compare titles through these helpers (the rnc store mirrors them in Rust and
+ * surfaces the same message through its `rejections` channel).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateSheetName = exports.SHEET_NAME_INVALID_MESSAGE = exports.SHEET_NAME_RESERVED_WORD = exports.SHEET_NAME_ILLEGAL_CHARACTERS = exports.SHEET_NAME_MAX_LENGTH = exports.uniqueSheetTitle = exports.isSheetTitleTaken = exports.isSameSheetTitle = exports.sheetTitleKey = exports.SHEET_NAME_TAKEN_MESSAGE = void 0;
+var tslib_1 = require("tslib");
+exports.SHEET_NAME_TAKEN_MESSAGE = "That name is already taken. Try a different one.";
+/** The identity two worksheet titles are compared under: trimmed, Unicode-lowercased. */
+var sheetTitleKey = function (title) {
+    return title.trim().toLowerCase();
+};
+exports.sheetTitleKey = sheetTitleKey;
+/** Whether `a` and `b` name the same worksheet under Excel's comparison. */
+var isSameSheetTitle = function (a, b) {
+    return (0, exports.sheetTitleKey)(a) === (0, exports.sheetTitleKey)(b);
+};
+exports.isSameSheetTitle = isSameSheetTitle;
+/**
+ * Whether another sheet (any but `exceptSheetId`) already holds `title`, case-insensitively. A
+ * sheet may always re-case its own title (`Sheet1` → `SHEET1` in place is not a collision).
+ */
+var isSheetTitleTaken = function (title, sheets, exceptSheetId) {
+    var e_1, _a;
+    var key = (0, exports.sheetTitleKey)(title);
+    try {
+        for (var sheets_1 = tslib_1.__values(sheets), sheets_1_1 = sheets_1.next(); !sheets_1_1.done; sheets_1_1 = sheets_1.next()) {
+            var sheet = sheets_1_1.value;
+            if (sheet.sheetId !== exceptSheetId && (0, exports.sheetTitleKey)(sheet.title) === key) {
+                return true;
+            }
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (sheets_1_1 && !sheets_1_1.done && (_a = sheets_1.return)) _a.call(sheets_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    return false;
+};
+exports.isSheetTitleTaken = isSheetTitleTaken;
+/**
+ * `base` if no title in `existing` holds it (case-insensitively), else the first free
+ * `base 1`, `base 2`, … — the suffix scheme the JS engine uses for a new / duplicated sheet.
+ * Every candidate stays within `maxLength` (the suffix wins over the tail of a long base).
+ */
+var uniqueSheetTitle = function (base, existing, maxLength) {
+    var e_2, _a;
+    if (maxLength === void 0) { maxLength = Number.POSITIVE_INFINITY; }
+    var taken = new Set();
+    try {
+        for (var existing_1 = tslib_1.__values(existing), existing_1_1 = existing_1.next(); !existing_1_1.done; existing_1_1 = existing_1.next()) {
+            var title = existing_1_1.value;
+            taken.add((0, exports.sheetTitleKey)(title));
+        }
+    }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    finally {
+        try {
+            if (existing_1_1 && !existing_1_1.done && (_a = existing_1.return)) _a.call(existing_1);
+        }
+        finally { if (e_2) throw e_2.error; }
+    }
+    var root = base.slice(0, maxLength);
+    if (!taken.has((0, exports.sheetTitleKey)(root))) {
+        return root;
+    }
+    for (var counter = 1;; counter++) {
+        var suffix = " ".concat(counter);
+        var candidate = "".concat(root.slice(0, Math.max(0, maxLength - suffix.length))).concat(suffix);
+        if (!taken.has((0, exports.sheetTitleKey)(candidate))) {
+            return candidate;
+        }
+    }
+};
+exports.uniqueSheetTitle = uniqueSheetTitle;
+/** Excel's ceiling for a worksheet name, in UTF-16 code units (what `String#length` counts). */
+exports.SHEET_NAME_MAX_LENGTH = 31;
+/** The characters Excel never allows anywhere in a worksheet name: `\ / ? * [ ] :`. */
+exports.SHEET_NAME_ILLEGAL_CHARACTERS = ["\\", "/", "?", "*", "[", "]", ":"];
+var SHEET_NAME_ILLEGAL_CHARACTER = /[\\/?*[\]:]/;
+/** Excel reserves this title for its change-history sheet (compared case-insensitively). */
+exports.SHEET_NAME_RESERVED_WORD = "History";
+/**
+ * Excel 365's rename-refusal dialog, verbatim — one message for every rule except the duplicate
+ * title, which has its own ({@link SHEET_NAME_TAKEN_MESSAGE}).
+ */
+exports.SHEET_NAME_INVALID_MESSAGE = [
+    "Sheet names cannot:",
+    "• Be blank.",
+    "\u2022 Contain more than ".concat(exports.SHEET_NAME_MAX_LENGTH, " characters."),
+    "• Contain any of the following characters: / \\ ? * : [ ]",
+    "• Begin or end with an apostrophe ('), but they can be used in between text or numbers in a name.",
+    "\u2022 Be named \"".concat(exports.SHEET_NAME_RESERVED_WORD, "\". This is a reserved word Excel uses internally."),
+].join("\n");
+/**
+ * Excel's worksheet-name rules, in the order its dialog lists them: not blank, at most 31 characters,
+ * none of `\ / ? * [ ] :`, no leading or trailing apostrophe, not `History`, and unique among
+ * `existing` compared case-insensitively (a sheet may always re-case its own title — pass its id as
+ * `exceptSheetId`). Both engines' rename / create paths and the sheet tabs validate through this one
+ * function (the rnc store mirrors it in Rust and surfaces the same messages via its `rejections`).
+ */
+var validateSheetName = function (name, existing, exceptSheetId) {
+    var e_3, _a;
+    if (existing === void 0) { existing = []; }
+    var invalid = function (reason) { return ({
+        ok: false,
+        reason: reason,
+        message: exports.SHEET_NAME_INVALID_MESSAGE,
+    }); };
+    if (name.trim().length === 0) {
+        return invalid("blank");
+    }
+    if (name.length > exports.SHEET_NAME_MAX_LENGTH) {
+        return invalid("too-long");
+    }
+    if (SHEET_NAME_ILLEGAL_CHARACTER.test(name)) {
+        return invalid("illegal-character");
+    }
+    if (name.startsWith("'") || name.endsWith("'")) {
+        return invalid("apostrophe");
+    }
+    if ((0, exports.isSameSheetTitle)(name, exports.SHEET_NAME_RESERVED_WORD)) {
+        return invalid("reserved");
+    }
+    var key = (0, exports.sheetTitleKey)(name);
+    try {
+        for (var existing_2 = tslib_1.__values(existing), existing_2_1 = existing_2.next(); !existing_2_1.done; existing_2_1 = existing_2.next()) {
+            var sheet = existing_2_1.value;
+            if (typeof sheet === "string") {
+                if ((0, exports.sheetTitleKey)(sheet) === key) {
+                    return { ok: false, reason: "taken", message: exports.SHEET_NAME_TAKEN_MESSAGE };
+                }
+            }
+            else if (sheet.sheetId !== exceptSheetId && (0, exports.sheetTitleKey)(sheet.title) === key) {
+                return { ok: false, reason: "taken", message: exports.SHEET_NAME_TAKEN_MESSAGE };
+            }
+        }
+    }
+    catch (e_3_1) { e_3 = { error: e_3_1 }; }
+    finally {
+        try {
+            if (existing_2_1 && !existing_2_1.done && (_a = existing_2.return)) _a.call(existing_2);
+        }
+        finally { if (e_3) throw e_3.error; }
+    }
+    return { ok: true };
+};
+exports.validateSheetName = validateSheetName;

package/dist/cjs/sheet-protection.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Excel's refusal when an edit touches a locked cell of a protected sheet — the dialog every
+ * mutation path shows (typing, Delete / Backspace, fill, paste) on both engines
+ * (rowsncolumns/spreadsheet#939 U-35). The rnc store surfaces the same text through its
+ * `rejections` channel under the `protected-sheet` code.
+ */
+export declare const SHEET_PROTECTION_ERROR_TITLE = "This sheet is protected";
+export declare const PROTECTED_SHEET_EDIT_MESSAGE = "The cell or chart you're trying to change is on a protected sheet. To make a change, unprotect the sheet. You might be requested to enter a password.";
+//# sourceMappingURL=sheet-protection.d.ts.map

package/dist/cjs/sheet-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sheet-protection.d.ts","sourceRoot":"","sources":["../../sheet-protection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,4BAA4B,CAAC;AAEtE,eAAO,MAAM,4BAA4B,0JACgH,CAAC"}

package/dist/cjs/sheet-protection.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTECTED_SHEET_EDIT_MESSAGE = exports.SHEET_PROTECTION_ERROR_TITLE = void 0;
+/**
+ * Excel's refusal when an edit touches a locked cell of a protected sheet — the dialog every
+ * mutation path shows (typing, Delete / Backspace, fill, paste) on both engines
+ * (rowsncolumns/spreadsheet#939 U-35). The rnc store surfaces the same text through its
+ * `rejections` channel under the `protected-sheet` code.
+ */
+exports.SHEET_PROTECTION_ERROR_TITLE = "This sheet is protected";
+exports.PROTECTED_SHEET_EDIT_MESSAGE = "The cell or chart you're trying to change is on a protected sheet. To make a change, unprotect the sheet. You might be requested to enter a password.";

package/dist/cjs/string.d.ts

@@ -38,6 +38,20 @@ export declare const cellToAddress: (cell: CellInterface | null, isAbsoluteColum
  * @returns
  */
 export declare const cellRangeToAddress: (sheetName: string | undefined, range: GridRange) => string;
+/**
+ * Must `name` be single-quoted as a sheet qualifier (`'My Data'!A1`)? Excel writes it bare only when
+ * it is a plain identifier — ASCII letters and digits, starting with a letter — and cannot be read
+ * as something else: a cell reference (`A1`, `XFD1`, `R1C1`), or a boolean (`TRUE`). A leading digit
+ * (`2024`, `1Sheet`) always quotes. Deliberately a superset of Excel's minimum (a `_`, `.` or
+ * non-ASCII letter also quotes): over-quoting is always valid, under-quoting makes `=2024!A1` a
+ * formula Excel rejects (rowsncolumns/spreadsheet#939 K-10).
+ */
+export declare const sheetNameNeedsQuoting: (name: string) => boolean;
+/**
+ * Quote a sheet name for use as a formula qualifier when Excel requires it (see
+ * {@link sheetNameNeedsQuoting}); apostrophes inside are doubled (`'O''Neil'`). Rename, cross-sheet
+ * reference generation and formula-bar insertion all quote through here so they agree.
+ */
 export declare const sanitizeSheetName: (name: string | undefined) => string | undefined;
 /**
  * Remove single quotes from sheetname
@@ -76,6 +90,23 @@ export declare const matchesWildcardPattern: (pattern: string, text: string, anc
  */
 export declare const selectionBoundsFromCells: (start: CellInterface, end?: CellInterface | null) => GridRange;
 export declare const supplant: (s: string, o: Record<string, any>) => string;
+/**
+ * Whether a hyperlink target read from untrusted markup (clipboard HTML) may
+ * be kept. A URL with an explicit scheme must use one of the safe schemes;
+ * scheme-less, protocol-relative, path and fragment references are allowed
+ * (they are normalized by {@link normalizeExternalUrl} before being opened).
+ * Applies the same tab/newline and C0-control stripping as the browser's URL
+ * canonicalization so `java\tscript:` cannot slip through.
+ */
+export declare const isSafeHyperlinkUri: (uri: string | null | undefined) => boolean;
+/**
+ * Escape text for interpolation into an HTML text node (`text/html`
+ * clipboard fragments): a cell whose value is literally `<b>x</b>` must paste
+ * back as that text, not as bold "x".
+ */
+export declare const escapeHtmlText: (value: string) => string;
+/** Escape a value for interpolation into a quoted HTML attribute. */
+export declare const escapeHtmlAttribute: (value: string) => string;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to

package/dist/cjs/string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,MAAM,KAAG,MAe/D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,KACxD,OAWF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}
+{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAOF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,OAMrB,CAAC;AAEjC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,MAAM,KAAG,MAe/D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,KACxD,OAWF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAgBnE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAC2B,CAAC;AAE3E,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAM1B,CAAC;AAE3B;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}

package/dist/cjs/string.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeExternalUrl = exports.supplant = exports.selectionBoundsFromCells = exports.matchesWildcardPattern = exports.wildcardPatternToRegExpSource = exports.escapeCharacters = exports.desanitizeSheetName = exports.sanitizeSheetName = exports.cellRangeToAddress = exports.cellToAddress = exports.getRowIndexFromAddress = exports.getColumnNameFromAddress = exports.addressToCell = exports.convertCellToRange = void 0;
+exports.normalizeExternalUrl = exports.escapeHtmlAttribute = exports.escapeHtmlText = exports.isSafeHyperlinkUri = exports.supplant = exports.selectionBoundsFromCells = exports.matchesWildcardPattern = exports.wildcardPatternToRegExpSource = exports.escapeCharacters = exports.desanitizeSheetName = exports.sanitizeSheetName = exports.sheetNameNeedsQuoting = exports.cellRangeToAddress = exports.cellToAddress = exports.getRowIndexFromAddress = exports.getColumnNameFromAddress = exports.addressToCell = exports.convertCellToRange = void 0;
 var tslib_1 = require("tslib");
 var typeguards_1 = require("./typeguards");
 var numbers_1 = require("./numbers");
@@ -135,13 +135,38 @@ var cellRangeToAddress = function (sheetName, range) {
     }));
 };
 exports.cellRangeToAddress = cellRangeToAddress;
-/* Sanitize sheet names */
+/** `A1`-style lookalike: 1–3 ASCII letters followed only by digits (`AB12`, `XFD1`). */
+var SHEET_NAME_A1_LOOKALIKE = /^[A-Za-z]{1,3}\d+$/;
+/** `R1C1`-style lookalike: an optional-digit `R` part and/or `C` part, nothing else (`R`, `C22`, `R1C1`). */
+var SHEET_NAME_R1C1_LOOKALIKE = /^(?:[Rr]\d*)?(?:[Cc]\d*)?$/;
+/**
+ * Must `name` be single-quoted as a sheet qualifier (`'My Data'!A1`)? Excel writes it bare only when
+ * it is a plain identifier — ASCII letters and digits, starting with a letter — and cannot be read
+ * as something else: a cell reference (`A1`, `XFD1`, `R1C1`), or a boolean (`TRUE`). A leading digit
+ * (`2024`, `1Sheet`) always quotes. Deliberately a superset of Excel's minimum (a `_`, `.` or
+ * non-ASCII letter also quotes): over-quoting is always valid, under-quoting makes `=2024!A1` a
+ * formula Excel rejects (rowsncolumns/spreadsheet#939 K-10).
+ */
+var sheetNameNeedsQuoting = function (name) {
+    return name.length === 0 ||
+        /[^A-Za-z0-9]/.test(name) ||
+        /^\d/.test(name) ||
+        SHEET_NAME_A1_LOOKALIKE.test(name) ||
+        SHEET_NAME_R1C1_LOOKALIKE.test(name) ||
+        /^(?:true|false)$/i.test(name);
+};
+exports.sheetNameNeedsQuoting = sheetNameNeedsQuoting;
+/**
+ * Quote a sheet name for use as a formula qualifier when Excel requires it (see
+ * {@link sheetNameNeedsQuoting}); apostrophes inside are doubled (`'O''Neil'`). Rename, cross-sheet
+ * reference generation and formula-bar insertion all quote through here so they agree.
+ */
 var sanitizeSheetName = function (name) {
     if (name === void 0)
         return void 0;
     if (typeof name === "number")
         return name;
-    if (/\s+|[^a-z|A-Z|0-9]/.test(name)) {
+    if ((0, exports.sheetNameNeedsQuoting)(name)) {
         // Escape single quotes by doubling them for valid sheet references.
         var escaped = name.replace(/'/g, "''");
         return "'".concat(escaped, "'");
@@ -263,6 +288,51 @@ var URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
 // explicit scheme (javascript:, data:, vbscript:, …) is a script/content
 // injection vector and is rejected.
 var SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
+/**
+ * Whether a hyperlink target read from untrusted markup (clipboard HTML) may
+ * be kept. A URL with an explicit scheme must use one of the safe schemes;
+ * scheme-less, protocol-relative, path and fragment references are allowed
+ * (they are normalized by {@link normalizeExternalUrl} before being opened).
+ * Applies the same tab/newline and C0-control stripping as the browser's URL
+ * canonicalization so `java\tscript:` cannot slip through.
+ */
+var isSafeHyperlinkUri = function (uri) {
+    if (uri == null) {
+        return false;
+    }
+    var trimmed = uri
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return false;
+    }
+    var schemeMatch = URL_SCHEME.exec(trimmed);
+    if (!schemeMatch) {
+        return true;
+    }
+    return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase());
+};
+exports.isSafeHyperlinkUri = isSafeHyperlinkUri;
+/**
+ * Escape text for interpolation into an HTML text node (`text/html`
+ * clipboard fragments): a cell whose value is literally `<b>x</b>` must paste
+ * back as that text, not as bold "x".
+ */
+var escapeHtmlText = function (value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+};
+exports.escapeHtmlText = escapeHtmlText;
+/** Escape a value for interpolation into a quoted HTML attribute. */
+var escapeHtmlAttribute = function (value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+};
+exports.escapeHtmlAttribute = escapeHtmlAttribute;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to

package/dist/cjs/tsconfig.cjs.tsbuildinfo

@@ -1 +1 @@
-{"root":["../../array.ts","../../cell-data-helpers.ts","../../color.ts","../../colors.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}
+{"root":["../../array.ts","../../cell-data-helpers.ts","../../clipboard-html-sanitize.ts","../../color.ts","../../colors.ts","../../condition-operand.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-names.ts","../../sheet-protection.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}

package/dist/esm/clipboard-html-sanitize.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `<img src>` may point at http(s) or an inline `data:image/*` (browsers copy
+ * inline images that way). Anything else — `javascript:`, `data:text/html`,
+ * `blob:` from another origin — is dropped.
+ */
+export declare const isSafeImageSrc: (value: string | null | undefined) => boolean;
+export declare const sanitizeInlineStyle: (value: string) => string;
+export declare const sanitizeStylesheetText: (value: string) => string;
+/**
+ * Strip executable and network-reaching content from an inert (DOMParser)
+ * document in place. Safe to call on a document that was never attached; the
+ * caller imports the result into a live sandbox afterwards.
+ */
+export declare const sanitizeClipboardDocument: (doc: Document) => Document;
+//# sourceMappingURL=clipboard-html-sanitize.d.ts.map

package/dist/esm/clipboard-html-sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard-html-sanitize.d.ts","sourceRoot":"","sources":["../../clipboard-html-sanitize.ts"],"names":[],"mappings":"AA6FA;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAWjE,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAanD,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,OAAO,MAAM,KAAG,MACT,CAAC;AAmC/C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,QAAQ,KAAG,QAyCzD,CAAC"}

package/dist/esm/clipboard-html-sanitize.js

@@ -0,0 +1,192 @@
+import { isSafeHyperlinkUri } from "./string";
+/**
+ * Sanitizer for clipboard `text/html` before any of it touches the live DOM.
+ *
+ * Clipboard HTML is attacker-controlled: a page the user copied from (or a
+ * synthetic `paste` event) can carry `<img onerror>`, `<svg onload>`,
+ * `<script>`, `<iframe srcdoc>` or `javascript:` links. The paste converters
+ * only ever need the document's structure (tables, rows, cells, inline
+ * formatting tags, `data-*` value hints), its inline `style` attributes and
+ * the payload's own `<style>` rules (Excel's `.fontN` / `.xlNN` classes), so
+ * everything else is dropped from the INERT `DOMParser` document before the
+ * sanitized nodes are imported into the mounted sandbox.
+ *
+ * This runs unconditionally; a consumer's `sanitizeHtml` prop runs on the raw
+ * string before this and can only tighten the result.
+ */
+/** Elements removed with their subtree. */
+const FORBIDDEN_ELEMENTS = new Set([
+    "script",
+    "noscript",
+    "template",
+    "iframe",
+    "frame",
+    "frameset",
+    "object",
+    "embed",
+    "applet",
+    "link",
+    "base",
+    "svg",
+    "math",
+    "input",
+    "button",
+    "select",
+    "textarea",
+    "audio",
+    "video",
+    "source",
+    "track",
+    "canvas",
+    "portal",
+    "dialog",
+]);
+/** Elements removed but whose children are kept in place. */
+const UNWRAPPED_ELEMENTS = new Set(["form", "fieldset", "label", "output"]);
+/** URL-bearing attributes that never carry spreadsheet meaning. */
+const FORBIDDEN_ATTRIBUTES = new Set([
+    "srcdoc",
+    "srcset",
+    "formaction",
+    "action",
+    "background",
+    "poster",
+    "ping",
+    "dynsrc",
+    "lowsrc",
+    "cite",
+    "longdesc",
+    "manifest",
+    "codebase",
+    "classid",
+    "data",
+    "archive",
+    "profile",
+    "usemap",
+    "xlink:href",
+    "xml:base",
+]);
+/** Attributes whose value must be a safe URL; otherwise the attribute is dropped. */
+const URL_ATTRIBUTES = new Set(["href", "src"]);
+/**
+ * CSS constructs that can reach the network or (in legacy engines) run code.
+ * Any declaration containing one of them is dropped; the rest of the `style`
+ * survives so legitimate `font-weight` / `color` / `mso-number-format` hints
+ * are kept.
+ */
+const DANGEROUS_CSS = /(expression\s*\(|url\s*\(|@import|behavior\s*:|-moz-binding|javascript:|vbscript:|data:)/i;
+/**
+ * Stylesheet-level constructs that can reach the network. `<style>` text is
+ * needed for Excel's class rules but never for anything that fetches.
+ */
+const DANGEROUS_STYLESHEET_RULE = /@import[^;]*;?|url\s*\([^)]*\)|expression\s*\([^)]*\)|behavior\s*:[^;}]*|-moz-binding\s*:[^;}]*/gi;
+const isEventHandlerAttribute = (name) => name.length > 2 && name.charCodeAt(0) === 111 /* o */ && name.charCodeAt(1) === 110 /* n */;
+/**
+ * `<img src>` may point at http(s) or an inline `data:image/*` (browsers copy
+ * inline images that way). Anything else — `javascript:`, `data:text/html`,
+ * `blob:` from another origin — is dropped.
+ */
+export const isSafeImageSrc = (value) => {
+    if (!value) {
+        return false;
+    }
+    const trimmed = value.replace(/[\t\n\r]/g, "").trim();
+    if (/^data:image\/(png|gif|jpe?g|webp|bmp|svg\+xml|x-icon|tiff);/i.test(trimmed)) {
+        // Inline SVG can carry scripts when navigated to, but as an `<img>` source
+        // it is rendered in an isolated, script-less document; allow it.
+        return true;
+    }
+    return /^https?:\/\//i.test(trimmed) || /^\/\//.test(trimmed);
+};
+export const sanitizeInlineStyle = (value) => {
+    // Untouched styles are kept byte-for-byte: Excel's `mso-number-format`
+    // patterns carry escaped `\;` and significant spaces that a split/rejoin
+    // would mangle.
+    if (!DANGEROUS_CSS.test(value)) {
+        return value;
+    }
+    return value
+        .split(";")
+        .filter((declaration) => declaration.trim() && !DANGEROUS_CSS.test(declaration))
+        .join(";");
+};
+export const sanitizeStylesheetText = (value) => value.replace(DANGEROUS_STYLESHEET_RULE, "");
+const sanitizeAttributes = (element) => {
+    const tag = element.tagName.toLowerCase();
+    // Copy first: removing while iterating a live NamedNodeMap skips entries.
+    const attributes = Array.from(element.attributes);
+    for (const attribute of attributes) {
+        const name = attribute.name.toLowerCase();
+        if (isEventHandlerAttribute(name) || FORBIDDEN_ATTRIBUTES.has(name)) {
+            element.removeAttribute(attribute.name);
+            continue;
+        }
+        if (name === "style") {
+            const safe = sanitizeInlineStyle(attribute.value);
+            if (safe !== attribute.value) {
+                if (safe) {
+                    element.setAttribute(attribute.name, safe);
+                }
+                else {
+                    element.removeAttribute(attribute.name);
+                }
+            }
+            continue;
+        }
+        if (URL_ATTRIBUTES.has(name)) {
+            const safe = name === "src"
+                ? tag === "img" && isSafeImageSrc(attribute.value)
+                : isSafeHyperlinkUri(attribute.value);
+            if (!safe) {
+                element.removeAttribute(attribute.name);
+            }
+        }
+    }
+};
+/**
+ * Strip executable and network-reaching content from an inert (DOMParser)
+ * document in place. Safe to call on a document that was never attached; the
+ * caller imports the result into a live sandbox afterwards.
+ */
+export const sanitizeClipboardDocument = (doc) => {
+    // A static snapshot: removals below detach subtrees, and detached
+    // descendants are skipped via `doc.contains`.
+    const elements = Array.from(doc.querySelectorAll("*"));
+    for (const element of elements) {
+        if (!doc.contains(element)) {
+            continue;
+        }
+        const tag = element.tagName.toLowerCase();
+        if (FORBIDDEN_ELEMENTS.has(tag)) {
+            element.remove();
+            continue;
+        }
+        if (UNWRAPPED_ELEMENTS.has(tag)) {
+            const parent = element.parentNode;
+            if (parent) {
+                while (element.firstChild) {
+                    parent.insertBefore(element.firstChild, element);
+                }
+            }
+            element.remove();
+            continue;
+        }
+        if (tag === "style") {
+            const text = element.textContent ?? "";
+            const safe = sanitizeStylesheetText(text);
+            if (safe !== text) {
+                element.textContent = safe;
+            }
+            // A stylesheet never needs attributes beyond `type`/`media`.
+            for (const attribute of Array.from(element.attributes)) {
+                const name = attribute.name.toLowerCase();
+                if (name !== "type" && name !== "media") {
+                    element.removeAttribute(attribute.name);
+                }
+            }
+            continue;
+        }
+        sanitizeAttributes(element);
+    }
+    return doc;
+};

package/dist/esm/condition-operand.d.ts

@@ -0,0 +1,54 @@
+import type { ConditionType } from "@rowsncolumns/common-types";
+/**
+ * Whether a condition type compares TEXT — its operand is always a string
+ * literal in Excel, even when it looks like a number or a boolean.
+ */
+export declare const isTextConditionType: (type: ConditionType | string | undefined | null) => boolean;
+export declare const escapeConditionFormulaText: (value: string) => string;
+/**
+ * The formula fragment for an operand that is a typed LITERAL — a number
+ * (`5`, `1e3`, locale `6,5`), a percentage (`50%` → `0.5`), a boolean, or a
+ * date / time in the document locale (`2024-01-05`, `1/5/2024`, `10:30` → the
+ * serial). `undefined` for anything else (text, references, formulas).
+ */
+export declare const conditionOperandLiteral: (raw: string | undefined | null, locale?: string) => string | undefined;
+/**
+ * Whether an operand (with any leading `=` already removed) is an A1
+ * reference — a cell, a range, a whole column/row, with `$` anchors and an
+ * optional (quoted) sheet qualifier: `B1`, `$B$1`, `B$1`, `Sheet1!$B$1`,
+ * `'My Sheet'!$B$1:$C$9`, `$A:$A`.
+ */
+export declare const isConditionOperandReference: (text: string) => boolean;
+/**
+ * Whether an operand (with any leading `=` already removed) is a function
+ * call — the form OOXML stores a formula bound in (`TODAY()`,
+ * `DATE(2024,1,1)`, `LEN($B$1)`): evaluated as a formula, never quoted.
+ */
+export declare const isConditionOperandFormulaCall: (text: string) => boolean;
+/**
+ * Normalize one rule operand into the formula fragment the rule builders
+ * splice into `=<cell><op><fragment>` (and the xlsx exporters write inside
+ * `<formula>` / `<formula1>` — never with a leading `=`).
+ *
+ * - `=…` → the formula text (leading `=` stripped).
+ * - `TEXT_*` types → ALWAYS a quoted string literal (`"1"`, `"TRUE"`).
+ * - A complete `"…"` string literal → as is.
+ * - An A1 reference (`$B$1`, `B$1`, `Sheet1!$B$1`, `'My Sheet'!$B$1`) → as is.
+ * - A function call (`TODAY()`, `DATE(2024,1,1)`, `LEN(A1)`) → as is.
+ * - A typed literal (number, `50%`, boolean, date/time in `locale`) → its
+ *   numeric form (`0.5`, `45296`, `TRUE`).
+ * - Anything else → a quoted string literal (`"abc"`).
+ *
+ * `""` for an empty operand.
+ */
+export declare const normalizeConditionOperand: (raw: string | undefined | null, type: ConditionType | string | undefined | null, locale?: string) => string;
+/**
+ * The OOXML `<formula>` / `<formula1>` text for a number/date rule operand:
+ * the leading `=` is stripped (Excel never writes one), typed literals are
+ * normalized to what Excel itself stores (`50%` → `0.5`, `2024-01-05` → its
+ * serial `45296` rather than the arithmetic `2024-01-05` = 2022), and every
+ * other operand — references, defined names, function calls — is written
+ * verbatim.
+ */
+export declare const conditionOperandToFormulaText: (raw: string | undefined | null, locale?: string) => string;
+//# sourceMappingURL=condition-operand.d.ts.map

package/dist/esm/condition-operand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition-operand.d.ts","sourceRoot":"","sources":["../../condition-operand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAyChE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC9B,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,KAC9C,OAA0D,CAAC;AAE9D,eAAO,MAAM,0BAA0B,GAAI,OAAO,MAAM,WAC7B,CAAC;AAsC5B;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,SAAS,MAAM,KACd,MAAM,GAAG,SA2CX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,KAAG,OACU,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,MAAM,KAAG,OAC5B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,GACpC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,EAC/C,SAAS,MAAM,KACd,MA0BF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACxC,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,SAAS,MAAM,KACd,MAQF,CAAC"}