@rowsncolumns/utils 9.5.1 → 9.5.4

package/dist/esm/condition-operand.js

@@ -0,0 +1,203 @@
+import { parseDate, parseTime } from "numfmt";
+import { checkIfStringIsReference } from "./selection";
+/**
+ * How a conditional-format / data-validation rule operand (`userEnteredValue`)
+ * becomes a formula fragment — the ONE place both rule builders and both xlsx
+ * exporters classify an operand, so the runtime and the exported file agree.
+ *
+ * Excel's rule dialog stores every operand as a formula. Typed text becomes a
+ * string literal, a typed number a number, a typed date its serial, `50%` the
+ * fraction `0.5`, and `=…` stays a formula. The `TEXT_*` rules ("Text that
+ * contains…", "begins with", cellIs equal `"5"`) take a string literal no
+ * matter what was typed: *begins with "1"* highlights `1abc` AND `123`, and
+ * `cellIs equal "5"` matches the text `5` but not the number 5.
+ */
+const NUMBER_LITERAL_PATTERN = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
+const BOOLEAN_LITERAL_PATTERN = /^(TRUE|FALSE)$/i;
+const PERCENT_LITERAL_PATTERN = /^([+-]?[\d.,\s ]+)%$/;
+/** A complete formula string literal — `"abc"`, `"say ""hi"""`. */
+const QUOTED_STRING_LITERAL_PATTERN = /^"(?:[^"]|"")*"$/;
+/**
+ * A function call — `TODAY()`, `DATE(2024,1,1)`, `LEN($B$1)`, `_xlfn.XLOOKUP(…)` — which is how
+ * OOXML stores a formula bound (`<formula1>TODAY()</formula1>`, never with a leading `=`).
+ */
+const FORMULA_CALL_PATTERN = /^[A-Z_\\][\w.]*\([\s\S]*\)$/i;
+/** Whole-column / whole-row spans (`A:A`, `$A:$C`, `1:1`), optionally sheet-qualified. */
+const AXIS_REFERENCE_PATTERN = /^(?:[^!]+!)?(?:\$?[A-Z]{1,3}:\$?[A-Z]{1,3}|\$?\d+:\$?\d+)$/i;
+const TEXT_CONDITION_TYPES = new Set([
+    "TEXT_EQ",
+    "TEXT_NOT_EQ",
+    "TEXT_CONTAINS",
+    "TEXT_NOT_CONTAINS",
+    "TEXT_STARTS_WITH",
+    "TEXT_ENDS_WITH",
+]);
+/**
+ * Whether a condition type compares TEXT — its operand is always a string
+ * literal in Excel, even when it looks like a number or a boolean.
+ */
+export const isTextConditionType = (type) => Boolean(type && TEXT_CONDITION_TYPES.has(type));
+export const escapeConditionFormulaText = (value) => value.replace(/"/g, '""');
+/**
+ * Parse a locale-formatted numeric string (e.g., "6,5" in fr-FR) into a JS
+ * number. Uses `Intl.NumberFormat` to detect decimal/group separators.
+ * Returns NaN on failure.
+ */
+const parseLocaleNumberLoose = (value, locale) => {
+    try {
+        const parts = new Intl.NumberFormat(locale).formatToParts(1234.5);
+        const decimal = parts.find((part) => part.type === "decimal")?.value ?? ".";
+        const group = parts.find((part) => part.type === "group")?.value ?? ",";
+        const cleaned = value.split(group).join("").replace(decimal, ".");
+        if (!cleaned.trim() || !NUMBER_LITERAL_PATTERN.test(cleaned.trim())) {
+            return NaN;
+        }
+        return Number(cleaned);
+    }
+    catch {
+        return NaN;
+    }
+};
+/** Shortest decimal text of a number rounded to Excel's 15 significant digits. */
+const formatNumberOperand = (value) => String(Number(value.toPrecision(15)));
+const parseNumberOperand = (text, locale) => {
+    if (NUMBER_LITERAL_PATTERN.test(text)) {
+        const value = Number(text);
+        return Number.isFinite(value) ? value : undefined;
+    }
+    if (locale) {
+        const value = parseLocaleNumberLoose(text, locale);
+        return Number.isFinite(value) ? value : undefined;
+    }
+    return undefined;
+};
+/**
+ * The formula fragment for an operand that is a typed LITERAL — a number
+ * (`5`, `1e3`, locale `6,5`), a percentage (`50%` → `0.5`), a boolean, or a
+ * date / time in the document locale (`2024-01-05`, `1/5/2024`, `10:30` → the
+ * serial). `undefined` for anything else (text, references, formulas).
+ */
+export const conditionOperandLiteral = (raw, locale) => {
+    if (!raw)
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    if (BOOLEAN_LITERAL_PATTERN.test(trimmed)) {
+        return trimmed.toUpperCase();
+    }
+    if (NUMBER_LITERAL_PATTERN.test(trimmed)) {
+        // Keep the typed digits — `6.50` and `6.5` are the same number and the
+        // formula parser reads either.
+        return Number.isFinite(Number(trimmed)) ? trimmed : undefined;
+    }
+    const percent = PERCENT_LITERAL_PATTERN.exec(trimmed);
+    if (percent) {
+        const value = parseNumberOperand(percent[1].trim(), locale ?? "en-US");
+        if (value !== undefined) {
+            return formatNumberOperand(value / 100);
+        }
+    }
+    // Dates (incl. date+time) and times, in the document locale's field order
+    // (`1/5/2024` is Jan 5 in en-US, May 1 in en-GB; `1.5.2024` is a de-DE
+    // date, not the grouped number 152024). numfmt's default locale is
+    // month-first, matching the app default.
+    try {
+        const dateOptions = locale ? { locale } : undefined;
+        const date = parseDate(trimmed, dateOptions);
+        if (date && typeof date.v === "number" && Number.isFinite(date.v)) {
+            return formatNumberOperand(date.v);
+        }
+        const time = parseTime(trimmed);
+        if (time && typeof time.v === "number" && Number.isFinite(time.v)) {
+            return formatNumberOperand(time.v);
+        }
+    }
+    catch {
+        // numfmt throws on malformed locale tags — the operand is then plain text.
+    }
+    if (locale) {
+        const value = parseLocaleNumberLoose(trimmed, locale);
+        if (Number.isFinite(value)) {
+            return formatNumberOperand(value);
+        }
+    }
+    return undefined;
+};
+/**
+ * Whether an operand (with any leading `=` already removed) is an A1
+ * reference — a cell, a range, a whole column/row, with `$` anchors and an
+ * optional (quoted) sheet qualifier: `B1`, `$B$1`, `B$1`, `Sheet1!$B$1`,
+ * `'My Sheet'!$B$1:$C$9`, `$A:$A`.
+ */
+export const isConditionOperandReference = (text) => checkIfStringIsReference(text) || AXIS_REFERENCE_PATTERN.test(text);
+/**
+ * Whether an operand (with any leading `=` already removed) is a function
+ * call — the form OOXML stores a formula bound in (`TODAY()`,
+ * `DATE(2024,1,1)`, `LEN($B$1)`): evaluated as a formula, never quoted.
+ */
+export const isConditionOperandFormulaCall = (text) => FORMULA_CALL_PATTERN.test(text);
+/**
+ * Normalize one rule operand into the formula fragment the rule builders
+ * splice into `=<cell><op><fragment>` (and the xlsx exporters write inside
+ * `<formula>` / `<formula1>` — never with a leading `=`).
+ *
+ * - `=…` → the formula text (leading `=` stripped).
+ * - `TEXT_*` types → ALWAYS a quoted string literal (`"1"`, `"TRUE"`).
+ * - A complete `"…"` string literal → as is.
+ * - An A1 reference (`$B$1`, `B$1`, `Sheet1!$B$1`, `'My Sheet'!$B$1`) → as is.
+ * - A function call (`TODAY()`, `DATE(2024,1,1)`, `LEN(A1)`) → as is.
+ * - A typed literal (number, `50%`, boolean, date/time in `locale`) → its
+ *   numeric form (`0.5`, `45296`, `TRUE`).
+ * - Anything else → a quoted string literal (`"abc"`).
+ *
+ * `""` for an empty operand.
+ */
+export const normalizeConditionOperand = (raw, type, locale) => {
+    if (!raw)
+        return "";
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return "";
+    if (trimmed.startsWith("=")) {
+        return trimmed.slice(1);
+    }
+    if (isTextConditionType(type)) {
+        return `"${escapeConditionFormulaText(trimmed)}"`;
+    }
+    if (QUOTED_STRING_LITERAL_PATTERN.test(trimmed)) {
+        return trimmed;
+    }
+    if (checkIfStringIsReference(trimmed) || isConditionOperandFormulaCall(trimmed)) {
+        return trimmed;
+    }
+    // Typed literals before whole-row spans: `10:30` is the time 10:30, not
+    // rows 10–30 (Excel's dialog reads it the way a cell entry would).
+    const literal = conditionOperandLiteral(trimmed, locale);
+    if (literal !== undefined) {
+        return literal;
+    }
+    if (isConditionOperandReference(trimmed)) {
+        return trimmed;
+    }
+    return `"${escapeConditionFormulaText(trimmed)}"`;
+};
+/**
+ * The OOXML `<formula>` / `<formula1>` text for a number/date rule operand:
+ * the leading `=` is stripped (Excel never writes one), typed literals are
+ * normalized to what Excel itself stores (`50%` → `0.5`, `2024-01-05` → its
+ * serial `45296` rather than the arithmetic `2024-01-05` = 2022), and every
+ * other operand — references, defined names, function calls — is written
+ * verbatim.
+ */
+export const conditionOperandToFormulaText = (raw, locale) => {
+    if (!raw)
+        return "";
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return "";
+    if (trimmed.startsWith("=")) {
+        return trimmed.slice(1);
+    }
+    return conditionOperandLiteral(trimmed, locale) ?? trimmed;
+};

package/dist/esm/conditional-format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-format.d.ts","sourceRoot":"","sources":["../../conditional-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,4BAA4B,CAAC;AAKpC;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D,CAAC;AA+DF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,GACzC,MAAM,yBAAyB,GAAG,SAAS,YAK5C,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,MAAM,yBAAyB,GAAG,SAAS,EAC3C,aAAa,MAAM,EACnB,SAAS,MAAM,uBA8HhB,CAAC"}
+{"version":3,"file":"conditional-format.d.ts","sourceRoot":"","sources":["../../conditional-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,4BAA4B,CAAC;AAQpC;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,GACzC,MAAM,yBAAyB,GAAG,SAAS,YAK5C,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,MAAM,yBAAyB,GAAG,SAAS,EAC3C,aAAa,MAAM,EACnB,SAAS,MAAM,uBA8HhB,CAAC"}

package/dist/esm/conditional-format.js

@@ -1,58 +1,6 @@
+import { escapeConditionFormulaText, normalizeConditionOperand, } from "./condition-operand";
 import { stripDataValidationTextPrefix } from "./data-validation";
-import { checkIfStringIsReference } from "./selection";
 const FORMULA_PREDICATE_BASE_CELL_REF = "A1";
-const NUMBER_LITERAL_PATTERN = /^-?\d+(?:\.\d+)?$/;
-const BOOLEAN_LITERAL_PATTERN = /^(TRUE|FALSE)$/i;
-const escapeFormulaText = (value) => value.replace(/"/g, '""');
-/**
- * Parse a locale-formatted numeric string (e.g., "6,5" in fr-FR) into a JS
- * number. Uses `Intl.NumberFormat` to detect decimal/group separators.
- * Returns NaN on failure.
- */
-const parseLocaleNumberLoose = (value, locale) => {
-    try {
-        const parts = new Intl.NumberFormat(locale).formatToParts(1234.5);
-        const decimal = parts.find((part) => part.type === "decimal")?.value ?? ".";
-        const group = parts.find((part) => part.type === "group")?.value ?? ",";
-        const cleaned = value.split(group).join("").replace(decimal, ".");
-        return Number(cleaned);
-    }
-    catch {
-        return NaN;
-    }
-};
-/**
- * Normalize a condition value for use in a formula expression.
- * Handles locale-specific number formats (e.g., "6,5" -> "6.5").
- */
-const normalizeConditionValue = (raw, allowStringLiteral = false, locale) => {
-    if (!raw)
-        return "";
-    const trimmed = raw.trim();
-    if (!trimmed)
-        return "";
-    if (trimmed.startsWith("=")) {
-        return trimmed.slice(1);
-    }
-    if (checkIfStringIsReference(trimmed)) {
-        return trimmed;
-    }
-    if (NUMBER_LITERAL_PATTERN.test(trimmed) ||
-        BOOLEAN_LITERAL_PATTERN.test(trimmed)) {
-        return trimmed;
-    }
-    // Try parsing as locale-aware number
-    if (locale) {
-        const parsed = parseLocaleNumberLoose(trimmed, locale);
-        if (!isNaN(parsed)) {
-            return String(parsed);
-        }
-    }
-    if (allowStringLiteral) {
-        return `"${escapeFormulaText(trimmed)}"`;
-    }
-    return trimmed;
-};
 /**
  * Whether a CF rule is evaluated via the calculator (formula path) instead of
  * the synchronous `checkBooleanRule` path used in
@@ -104,8 +52,8 @@ export const buildConditionalFormatExpression = (rule, baseCellRef, locale) => {
             return undefined;
         return trimmed.startsWith("=") ? trimmed : `=${trimmed}`;
     }
-    const fromExpr = normalizeConditionValue(fromRaw, true, locale);
-    const toExpr = normalizeConditionValue(toRaw, true, locale);
+    const fromExpr = normalizeConditionOperand(fromRaw, condition.type, locale);
+    const toExpr = normalizeConditionOperand(toRaw, condition.type, locale);
     if (!fromExpr && !toExpr)
         return undefined;
     const comparisonOperatorMap = {
@@ -185,13 +133,13 @@ export const buildConditionalFormatExpression = (rule, baseCellRef, locale) => {
             .flatMap((entry) => {
             if (entry.startsWith("'")) {
                 const stripped = stripDataValidationTextPrefix(entry);
-                const textCondition = `${baseCellRef}="${escapeFormulaText(stripped)}"`;
+                const textCondition = `${baseCellRef}="${escapeConditionFormulaText(stripped)}"`;
                 return stripped === ""
                     ? [textCondition, `${baseCellRef}="'"`]
                     : [textCondition];
             }
             return entry
-                ? [`${baseCellRef}=${normalizeConditionValue(entry, true, locale)}`]
+                ? [`${baseCellRef}=${normalizeConditionOperand(entry, condition.type, locale)}`]
                 : [];
         })
             .filter((entry) => Boolean(entry));

package/dist/esm/data-validation.d.ts

@@ -50,5 +50,14 @@ export declare const dataValidationOptionMatchesCellValue: (option: string | und
  * builder from drifting.
  */
 export declare const isDataValidationFormulaRule: (rule: DataValidationRule | undefined) => boolean;
+/**
+ * Excel's *Whole number* validation kind rejects any non-integer (`5.5` fails
+ * "whole between 1 and 10"). An imported `type="whole"` rule carries a plain
+ * `NUMBER_*` comparison as its `condition` (the bounds) — which alone accepts
+ * `5.5` — so when the rule's `xlsxSource.type` is `whole` the comparison is
+ * wrapped in the same integer guard `buildExcelValidationRule` composes for
+ * an authored Whole-number rule: `AND(ISNUMBER(x), x=INT(x), <comparison>)`.
+ * Rules of other kinds, and non-`NUMBER_*` conditions, are returned as built.
+ */
 export declare const buildDataValidationExpression: (rule: DataValidationRule | undefined, baseCellRef: string, locale?: string) => string | undefined;
 //# sourceMappingURL=data-validation.d.ts.map

package/dist/esm/data-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-validation.d.ts","sourceRoot":"","sources":["../../data-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAWpC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,OAAO,MAAM,KAAG,MACd,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAC/C,QAAQ,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,WAAW,MAAM,GAAG,SAAS,GAAG,IAAI,KACnC,OAKF,CAAC;AAwDF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,2BAA2B,GACtC,MAAM,kBAAkB,GAAG,SAAS,YAKrC,CAAC;AAEF,eAAO,MAAM,6BAA6B,GACxC,MAAM,kBAAkB,GAAG,SAAS,EACpC,aAAa,MAAM,EACnB,SAAS,MAAM,uBA4HhB,CAAC"}
+{"version":3,"file":"data-validation.d.ts","sourceRoot":"","sources":["../../data-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AASpC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,OAAO,MAAM,KAAG,MACd,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAC/C,QAAQ,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,WAAW,MAAM,GAAG,SAAS,GAAG,IAAI,KACnC,OAKF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,2BAA2B,GACtC,MAAM,kBAAkB,GAAG,SAAS,YAKrC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACxC,MAAM,kBAAkB,GAAG,SAAS,EACpC,aAAa,MAAM,EACnB,SAAS,MAAM,uBAgBhB,CAAC"}

package/dist/esm/data-validation.js

@@ -1,8 +1,5 @@
-import { checkIfStringIsReference } from "./selection";
+import { escapeConditionFormulaText, normalizeConditionOperand, } from "./condition-operand";
 const FORMULA_PREDICATE_BASE_CELL_REF = "A1";
-const NUMBER_LITERAL_PATTERN = /^-?\d+(?:\.\d+)?$/;
-const BOOLEAN_LITERAL_PATTERN = /^(TRUE|FALSE)$/i;
-const escapeFormulaText = (value) => value.replace(/"/g, '""');
 /**
  * A leading apostrophe in a data-validation / conditional-format list entry is
  * Excel's text prefix — `'000s` is the text "000s" and a bare `'` is empty
@@ -22,55 +19,6 @@ export const dataValidationOptionMatchesCellValue = (option, cellValue) => {
     const normalizedValue = rawValue === "'" ? "" : rawValue;
     return normalizedOption.toLowerCase() === normalizedValue.toLowerCase();
 };
-/**
- * Parse a locale-formatted numeric string (e.g., "6,5" in fr-FR) into a JS
- * number. Uses `Intl.NumberFormat` to detect decimal/group separators.
- * Returns NaN on failure.
- */
-const parseLocaleNumberLoose = (value, locale) => {
-    try {
-        const parts = new Intl.NumberFormat(locale).formatToParts(1234.5);
-        const decimal = parts.find((part) => part.type === "decimal")?.value ?? ".";
-        const group = parts.find((part) => part.type === "group")?.value ?? ",";
-        const cleaned = value.split(group).join("").replace(decimal, ".");
-        return Number(cleaned);
-    }
-    catch {
-        return NaN;
-    }
-};
-/**
- * Normalize a condition value for use in a formula expression.
- * Handles locale-specific number formats (e.g., "6,5" -> "6.5").
- */
-const normalizeConditionValue = (raw, allowStringLiteral = false, locale) => {
-    if (!raw)
-        return "";
-    const trimmed = raw.trim();
-    if (!trimmed)
-        return "";
-    if (trimmed.startsWith("=")) {
-        return trimmed.slice(1);
-    }
-    if (checkIfStringIsReference(trimmed)) {
-        return trimmed;
-    }
-    if (NUMBER_LITERAL_PATTERN.test(trimmed) ||
-        BOOLEAN_LITERAL_PATTERN.test(trimmed)) {
-        return trimmed;
-    }
-    // Try parsing as locale-aware number
-    if (locale) {
-        const parsed = parseLocaleNumberLoose(trimmed, locale);
-        if (!isNaN(parsed)) {
-            return String(parsed);
-        }
-    }
-    if (allowStringLiteral) {
-        return `"${escapeFormulaText(trimmed)}"`;
-    }
-    return trimmed;
-};
 /**
  * Whether a data validation rule is evaluated via the calculator (formula path)
  * instead of the synchronous `checkBooleanRule` path used in
@@ -110,7 +58,27 @@ const normalizeConditionValue = (raw, allowStringLiteral = false, locale) => {
 export const isDataValidationFormulaRule = (rule) => {
     return Boolean(buildDataValidationExpression(rule, FORMULA_PREDICATE_BASE_CELL_REF));
 };
+/**
+ * Excel's *Whole number* validation kind rejects any non-integer (`5.5` fails
+ * "whole between 1 and 10"). An imported `type="whole"` rule carries a plain
+ * `NUMBER_*` comparison as its `condition` (the bounds) — which alone accepts
+ * `5.5` — so when the rule's `xlsxSource.type` is `whole` the comparison is
+ * wrapped in the same integer guard `buildExcelValidationRule` composes for
+ * an authored Whole-number rule: `AND(ISNUMBER(x), x=INT(x), <comparison>)`.
+ * Rules of other kinds, and non-`NUMBER_*` conditions, are returned as built.
+ */
 export const buildDataValidationExpression = (rule, baseCellRef, locale) => {
+    const expression = buildDataValidationConditionExpression(rule, baseCellRef, locale);
+    if (!expression)
+        return undefined;
+    const isWholeSource = rule?.xlsxSource?.type?.trim().toLowerCase() === "whole";
+    const isNumberCondition = Boolean(rule?.condition?.type?.startsWith("NUMBER_"));
+    if (!isWholeSource || !isNumberCondition)
+        return expression;
+    const body = expression.startsWith("=") ? expression.slice(1) : expression;
+    return `=AND(ISNUMBER(${baseCellRef}),${baseCellRef}=INT(${baseCellRef}),${body})`;
+};
+const buildDataValidationConditionExpression = (rule, baseCellRef, locale) => {
     const condition = rule?.condition;
     if (!condition?.type)
         return undefined;
@@ -124,8 +92,8 @@ export const buildDataValidationExpression = (rule, baseCellRef, locale) => {
             return undefined;
         return trimmed.startsWith("=") ? trimmed : `=${trimmed}`;
     }
-    const fromExpr = normalizeConditionValue(fromRaw, true, locale);
-    const toExpr = normalizeConditionValue(toRaw, true, locale);
+    const fromExpr = normalizeConditionOperand(fromRaw, condition.type, locale);
+    const toExpr = normalizeConditionOperand(toRaw, condition.type, locale);
     if (!fromExpr && !toExpr)
         return undefined;
     const comparisonOperatorMap = {
@@ -206,7 +174,7 @@ export const buildDataValidationExpression = (rule, baseCellRef, locale) => {
             .flatMap((entry) => {
             if (entry.startsWith("'")) {
                 const stripped = stripDataValidationTextPrefix(entry);
-                const textCondition = `${baseCellRef}="${escapeFormulaText(stripped)}"`;
+                const textCondition = `${baseCellRef}="${escapeConditionFormulaText(stripped)}"`;
                 // The bare `'` entry means empty text, and a cell storing the lone
                 // text-prefix apostrophe is equivalent to a blank cell — accept it too.
                 return stripped === ""
@@ -214,7 +182,9 @@ export const buildDataValidationExpression = (rule, baseCellRef, locale) => {
                     : [textCondition];
             }
             return entry
-                ? [`${baseCellRef}=${normalizeConditionValue(entry, true, locale)}`]
+                ? [
+                    `${baseCellRef}=${normalizeConditionOperand(entry, condition.type, locale)}`,
+                ]
                 : [];
         })
             .filter((entry) => Boolean(entry));

package/dist/esm/date.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Excel's 1900 date system counts a day that never happened: serial 60 is
+ * 1900-02-29 (Lotus 1-2-3 compatibility). 1900-01-01 is 1, 1900-02-28 is 59,
+ * 1900-03-01 is 61. Google Sheets keeps the same numbering.
+ */
+export declare const EXCEL_LEAP_BUG_SERIAL = 60;
+/** The calendar day Excel's serial 60 stands for, which no `Date` can hold. */
+export declare const isExcelLeapDay: (year: number, month: number, day: number) => boolean;
 export type DateSerialMode = "local" | "excel-utc";
 /**
  * Convert date to serial with explicit time zone behavior.
@@ -6,6 +14,14 @@ export type DateSerialMode = "local" | "excel-utc";
  */
 export declare const toSerialWithMode: (date: Date, use1904?: boolean, mode?: DateSerialMode) => number;
 export declare const toSerial: (date: Date, use1904?: boolean) => number;
+/**
+ * Serial for calendar parts the way a user typed them. Unlike
+ * `toSerial(new Date(y, m, d))`, this never goes through a `Date`, so the
+ * phantom 1900-02-29 stays serial 60 instead of rolling over to March 1
+ * (rowsncolumns/spreadsheet#1026). Every other date takes the same path as
+ * `toSerial` in "local" mode. `month` is 0-based like `Date`.
+ */
+export declare const toSerialFromParts: (year: number, month: number, day: number, hour?: number, minute?: number, second?: number, use1904?: boolean) => number;
 /**
  * Convert serial to date
  * @param serial

package/dist/esm/date.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"date.d.ts","sourceRoot":"","sources":["../../date.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,IAAI,EACV,iBAAe,EACf,OAAM,cAAwB,WAwB/B,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,IAAI,EAAE,iBAAe,WAEnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,iBAAe,SA+BrD,CAAC"}
+{"version":3,"file":"date.d.ts","sourceRoot":"","sources":["../../date.ts"],"names":[],"mappings":"AACA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+EAA+E;AAC/E,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,EAAE,KAAK,MAAM,YAC3B,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,IAAI,EACV,iBAAe,EACf,OAAM,cAAwB,WAwB/B,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,IAAI,EAAE,iBAAe,WAEnD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,OAAO,MAAM,EACb,KAAK,MAAM,EACX,aAAQ,EACR,eAAU,EACV,eAAU,EACV,iBAAe,WAWhB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,iBAAe,SA+BrD,CAAC"}

package/dist/esm/date.js

@@ -1,5 +1,12 @@
 const DAY_TO_MS = 24 * 60 * 60 * 1000;
-const EXCEL_LEAP_BUG_SERIAL = 60;
+/**
+ * Excel's 1900 date system counts a day that never happened: serial 60 is
+ * 1900-02-29 (Lotus 1-2-3 compatibility). 1900-01-01 is 1, 1900-02-28 is 59,
+ * 1900-03-01 is 61. Google Sheets keeps the same numbering.
+ */
+export const EXCEL_LEAP_BUG_SERIAL = 60;
+/** The calendar day Excel's serial 60 stands for, which no `Date` can hold. */
+export const isExcelLeapDay = (year, month, day) => year === 1900 && month === 1 && day === 29;
 /**
  * Convert date to serial with explicit time zone behavior.
  * - local: interpret date components in local time (UI entry behavior).
@@ -23,6 +30,20 @@ export const toSerialWithMode = (date, use1904 = false, mode = "local") => {
 export const toSerial = (date, use1904 = false) => {
     return toSerialWithMode(date, use1904, "local");
 };
+/**
+ * Serial for calendar parts the way a user typed them. Unlike
+ * `toSerial(new Date(y, m, d))`, this never goes through a `Date`, so the
+ * phantom 1900-02-29 stays serial 60 instead of rolling over to March 1
+ * (rowsncolumns/spreadsheet#1026). Every other date takes the same path as
+ * `toSerial` in "local" mode. `month` is 0-based like `Date`.
+ */
+export const toSerialFromParts = (year, month, day, hour = 0, minute = 0, second = 0, use1904 = false) => {
+    const timeFraction = (hour * 3600 + minute * 60 + second) / (24 * 60 * 60);
+    if (!use1904 && isExcelLeapDay(year, month, day)) {
+        return EXCEL_LEAP_BUG_SERIAL + timeFraction;
+    }
+    return toSerialWithMode(new Date(year, month, day, hour, minute, second, 0), use1904, "local");
+};
 /**
  * Convert serial to date
  * @param serial

package/dist/esm/index.d.ts

@@ -18,6 +18,7 @@ export * from "./colors";
 export * from "./formula-refs";
 export * from "./sort";
 export * from "./table-styles";
+export * from "./condition-operand";
 export * from "./conditional-format";
 export * from "./data-validation";
 export * from "./content-hash";
@@ -26,8 +27,11 @@ export * from "./keyboard";
 export * from "./sheet-span";
 export * from "./formula-locale";
 export * from "./table-names";
+export * from "./sheet-names";
+export * from "./sheet-protection";
 export * from "./table-totals";
 export * from "./sparkline-groups";
 export * from "./rich-text-html";
+export * from "./clipboard-html-sanitize";
 export * from "./rich-text-links";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AACxB,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC;AACvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AACxB,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC;AACvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC"}

package/dist/esm/index.js

@@ -18,6 +18,7 @@ export * from "./colors";
 export * from "./formula-refs";
 export * from "./sort";
 export * from "./table-styles";
+export * from "./condition-operand";
 export * from "./conditional-format";
 export * from "./data-validation";
 export * from "./content-hash";
@@ -26,7 +27,10 @@ export * from "./keyboard";
 export * from "./sheet-span";
 export * from "./formula-locale";
 export * from "./table-names";
+export * from "./sheet-names";
+export * from "./sheet-protection";
 export * from "./table-totals";
 export * from "./sparkline-groups";
 export * from "./rich-text-html";
+export * from "./clipboard-html-sanitize";
 export * from "./rich-text-links";

package/dist/esm/rich-text-html.d.ts

@@ -52,6 +52,15 @@ export type ParsedRichText = {
  * Parse an HTML clipboard payload into a hidden, mounted sandbox so
  * `getComputedStyle` resolves the payload's own `<style>` rules (Excel's
  * `.fontN` / `.xlNN` classes). Callers must `cleanup()` when done.
+ *
+ * The payload is untrusted. It is parsed with `DOMParser` (an inert document:
+ * no scripts run, no handlers fire, nothing loads), stripped by
+ * {@link sanitizeClipboardDocument} — scripts, frames, embeds, SVG/MathML,
+ * every `on*` handler, `javascript:`/`data:` links and network-reaching CSS —
+ * and only then are the surviving nodes imported into the live sandbox. The
+ * import is node-by-node (`importNode`), never a serialize + `innerHTML`
+ * round trip, so the parser cannot re-interpret the sanitized tree (mXSS).
+ * This sanitization is not optional and runs for every clipboard consumer.
  */
 export declare const mountClipboardHtml: (clipboardValue: string) => {
     root: HTMLDivElement;

package/dist/esm/rich-text-html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rich-text-html.d.ts","sourceRoot":"","sources":["../../rich-text-html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAK5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;IAClC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAgGF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,MAAM;;;CAmBxD,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAkBX,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,eAAe,GAC1B,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAoBX,CAAC;AA+SF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,WAAW,KAAG,cA+DzD,CAAC;AAgBF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,WAAW,KAChB,WAAW,GAAG,SAShB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,MAAM,KACX,cAAc,GAAG,SAkBnB,CAAC"}
+{"version":3,"file":"rich-text-html.d.ts","sourceRoot":"","sources":["../../rich-text-html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAO5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;IAClC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAgGF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,MAAM;;;CA0BxD,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAkBX,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,eAAe,GAC1B,OAAO,MAAM,GAAG,IAAI,GAAG,SAAS,KAC/B,MAAM,GAAG,SAoBX,CAAC;AAiTF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,WAAW,KAAG,cA+DzD,CAAC;AAgBF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,WAAW,KAChB,WAAW,GAAG,SAShB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,MAAM,KACX,cAAc,GAAG,SAkBnB,CAAC"}

package/dist/esm/rich-text-html.js

@@ -1,5 +1,7 @@
+import { sanitizeClipboardDocument } from "./clipboard-html-sanitize";
 import { colorStringToHex } from "./color";
 import { canUseDOM } from "./dom";
+import { isSafeHyperlinkUri } from "./string";
 const BLOCK_TAGS = new Set([
     "p",
     "div",
@@ -86,16 +88,28 @@ const NON_COLORS = new Set([
  * Parse an HTML clipboard payload into a hidden, mounted sandbox so
  * `getComputedStyle` resolves the payload's own `<style>` rules (Excel's
  * `.fontN` / `.xlNN` classes). Callers must `cleanup()` when done.
+ *
+ * The payload is untrusted. It is parsed with `DOMParser` (an inert document:
+ * no scripts run, no handlers fire, nothing loads), stripped by
+ * {@link sanitizeClipboardDocument} — scripts, frames, embeds, SVG/MathML,
+ * every `on*` handler, `javascript:`/`data:` links and network-reaching CSS —
+ * and only then are the surviving nodes imported into the live sandbox. The
+ * import is node-by-node (`importNode`), never a serialize + `innerHTML`
+ * round trip, so the parser cannot re-interpret the sanitized tree (mXSS).
+ * This sanitization is not optional and runs for every clipboard consumer.
  */
 export const mountClipboardHtml = (clipboardValue) => {
     const parser = new DOMParser();
-    const doc = parser.parseFromString(clipboardValue, "text/html");
+    const doc = sanitizeClipboardDocument(parser.parseFromString(clipboardValue, "text/html"));
     const sandbox = document.createElement("div");
     sandbox.style.cssText =
         "position:fixed;left:-10000px;top:-10000px;width:0;height:0;overflow:hidden;opacity:0;pointer-events:none;font-size:10pt;";
-    sandbox.innerHTML = doc.body?.innerHTML ?? "";
+    const bodyChildren = doc.body ? Array.from(doc.body.childNodes) : [];
+    for (const child of bodyChildren) {
+        sandbox.appendChild(document.importNode(child, true));
+    }
     const styles = doc.head?.querySelectorAll("style") ?? [];
-    styles.forEach((style) => sandbox.appendChild(style.cloneNode(true)));
+    styles.forEach((style) => sandbox.appendChild(document.importNode(style, true)));
     document.body.appendChild(sandbox);
     return {
         root: sandbox,
@@ -232,8 +246,10 @@ const readElementFormat = (element, inherited) => {
             break;
         }
         case "a": {
+            // The sanitizer already drops unsafe hrefs from clipboard payloads;
+            // this converter also serves non-clipboard callers, so re-check here.
             const href = element.getAttribute("href");
-            if (href && href.trim()) {
+            if (href && href.trim() && isSafeHyperlinkUri(href)) {
                 format.link = { uri: href.trim() };
             }
             break;