@rowsncolumns/utils 9.5.1 → 9.5.4

package/dist/esm/sheet-names.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Excel compares worksheet names case-insensitively: `SHEET1` beside `Sheet1` is refused with
+ * "That name is already taken. Try a different one." The calc engine's sheet registry folds names
+ * the same way, so two sheets differing only by case would alias one engine sheet — every write to
+ * the second lands in the first and `=SHEET1!A1` resolves to whichever was registered first
+ * (Athena-Intel/demo-app-monorepo#37167 UI2-1). Both engines' rename / create / duplicate paths and
+ * the sheet tabs compare titles through these helpers (the rnc store mirrors them in Rust and
+ * surfaces the same message through its `rejections` channel).
+ */
+export declare const SHEET_NAME_TAKEN_MESSAGE = "That name is already taken. Try a different one.";
+/** The identity two worksheet titles are compared under: trimmed, Unicode-lowercased. */
+export declare const sheetTitleKey: (title: string) => string;
+/** Whether `a` and `b` name the same worksheet under Excel's comparison. */
+export declare const isSameSheetTitle: (a: string, b: string) => boolean;
+/**
+ * Whether another sheet (any but `exceptSheetId`) already holds `title`, case-insensitively. A
+ * sheet may always re-case its own title (`Sheet1` → `SHEET1` in place is not a collision).
+ */
+export declare const isSheetTitleTaken: (title: string, sheets: Iterable<{
+    sheetId: number;
+    title: string;
+}>, exceptSheetId?: number) => boolean;
+/**
+ * `base` if no title in `existing` holds it (case-insensitively), else the first free
+ * `base 1`, `base 2`, … — the suffix scheme the JS engine uses for a new / duplicated sheet.
+ * Every candidate stays within `maxLength` (the suffix wins over the tail of a long base).
+ */
+export declare const uniqueSheetTitle: (base: string, existing: Iterable<string>, maxLength?: number) => string;
+/** Excel's ceiling for a worksheet name, in UTF-16 code units (what `String#length` counts). */
+export declare const SHEET_NAME_MAX_LENGTH = 31;
+/** The characters Excel never allows anywhere in a worksheet name: `\ / ? * [ ] :`. */
+export declare const SHEET_NAME_ILLEGAL_CHARACTERS: readonly ["\\", "/", "?", "*", "[", "]", ":"];
+/** Excel reserves this title for its change-history sheet (compared case-insensitively). */
+export declare const SHEET_NAME_RESERVED_WORD = "History";
+/**
+ * Excel 365's rename-refusal dialog, verbatim — one message for every rule except the duplicate
+ * title, which has its own ({@link SHEET_NAME_TAKEN_MESSAGE}).
+ */
+export declare const SHEET_NAME_INVALID_MESSAGE: string;
+/** Why a worksheet name was refused — a stable key hosts may branch on; `message` is the dialog text. */
+export type SheetNameRejectionReason = "blank" | "too-long" | "illegal-character" | "apostrophe" | "reserved" | "taken";
+export type SheetNameValidation = {
+    ok: true;
+} | {
+    ok: false;
+    reason: SheetNameRejectionReason;
+    message: string;
+};
+/**
+ * Excel's worksheet-name rules, in the order its dialog lists them: not blank, at most 31 characters,
+ * none of `\ / ? * [ ] :`, no leading or trailing apostrophe, not `History`, and unique among
+ * `existing` compared case-insensitively (a sheet may always re-case its own title — pass its id as
+ * `exceptSheetId`). Both engines' rename / create paths and the sheet tabs validate through this one
+ * function (the rnc store mirrors it in Rust and surfaces the same messages via its `rejections`).
+ */
+export declare const validateSheetName: (name: string, existing?: Iterable<{
+    sheetId: number;
+    title: string;
+} | string>, exceptSheetId?: number) => SheetNameValidation;
+//# sourceMappingURL=sheet-names.d.ts.map

package/dist/esm/sheet-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sheet-names.d.ts","sourceRoot":"","sources":["../../sheet-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,wBAAwB,qDACe,CAAC;AAErD,yFAAyF;AACzF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,MAClB,CAAC;AAE7B,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OACjB,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,QAAQ,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EACpD,gBAAgB,MAAM,KACrB,OAQF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,UAAU,QAAQ,CAAC,MAAM,CAAC,EAC1B,kBAAoC,KACnC,MAgBF,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,uFAAuF;AACvF,eAAO,MAAM,6BAA6B,+CAAgD,CAAC;AAG3F,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAO3B,CAAC;AAEb,yGAAyG;AACzG,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,UAAU,GACV,mBAAmB,GACnB,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,WAAU,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAM,EACpE,gBAAgB,MAAM,KACrB,mBAgCF,CAAC"}

package/dist/esm/sheet-names.js

@@ -0,0 +1,109 @@
+/**
+ * Excel compares worksheet names case-insensitively: `SHEET1` beside `Sheet1` is refused with
+ * "That name is already taken. Try a different one." The calc engine's sheet registry folds names
+ * the same way, so two sheets differing only by case would alias one engine sheet — every write to
+ * the second lands in the first and `=SHEET1!A1` resolves to whichever was registered first
+ * (Athena-Intel/demo-app-monorepo#37167 UI2-1). Both engines' rename / create / duplicate paths and
+ * the sheet tabs compare titles through these helpers (the rnc store mirrors them in Rust and
+ * surfaces the same message through its `rejections` channel).
+ */
+export const SHEET_NAME_TAKEN_MESSAGE = "That name is already taken. Try a different one.";
+/** The identity two worksheet titles are compared under: trimmed, Unicode-lowercased. */
+export const sheetTitleKey = (title) => title.trim().toLowerCase();
+/** Whether `a` and `b` name the same worksheet under Excel's comparison. */
+export const isSameSheetTitle = (a, b) => sheetTitleKey(a) === sheetTitleKey(b);
+/**
+ * Whether another sheet (any but `exceptSheetId`) already holds `title`, case-insensitively. A
+ * sheet may always re-case its own title (`Sheet1` → `SHEET1` in place is not a collision).
+ */
+export const isSheetTitleTaken = (title, sheets, exceptSheetId) => {
+    const key = sheetTitleKey(title);
+    for (const sheet of sheets) {
+        if (sheet.sheetId !== exceptSheetId && sheetTitleKey(sheet.title) === key) {
+            return true;
+        }
+    }
+    return false;
+};
+/**
+ * `base` if no title in `existing` holds it (case-insensitively), else the first free
+ * `base 1`, `base 2`, … — the suffix scheme the JS engine uses for a new / duplicated sheet.
+ * Every candidate stays within `maxLength` (the suffix wins over the tail of a long base).
+ */
+export const uniqueSheetTitle = (base, existing, maxLength = Number.POSITIVE_INFINITY) => {
+    const taken = new Set();
+    for (const title of existing) {
+        taken.add(sheetTitleKey(title));
+    }
+    const root = base.slice(0, maxLength);
+    if (!taken.has(sheetTitleKey(root))) {
+        return root;
+    }
+    for (let counter = 1;; counter++) {
+        const suffix = ` ${counter}`;
+        const candidate = `${root.slice(0, Math.max(0, maxLength - suffix.length))}${suffix}`;
+        if (!taken.has(sheetTitleKey(candidate))) {
+            return candidate;
+        }
+    }
+};
+/** Excel's ceiling for a worksheet name, in UTF-16 code units (what `String#length` counts). */
+export const SHEET_NAME_MAX_LENGTH = 31;
+/** The characters Excel never allows anywhere in a worksheet name: `\ / ? * [ ] :`. */
+export const SHEET_NAME_ILLEGAL_CHARACTERS = ["\\", "/", "?", "*", "[", "]", ":"];
+const SHEET_NAME_ILLEGAL_CHARACTER = /[\\/?*[\]:]/;
+/** Excel reserves this title for its change-history sheet (compared case-insensitively). */
+export const SHEET_NAME_RESERVED_WORD = "History";
+/**
+ * Excel 365's rename-refusal dialog, verbatim — one message for every rule except the duplicate
+ * title, which has its own ({@link SHEET_NAME_TAKEN_MESSAGE}).
+ */
+export const SHEET_NAME_INVALID_MESSAGE = [
+    "Sheet names cannot:",
+    "• Be blank.",
+    `• Contain more than ${SHEET_NAME_MAX_LENGTH} characters.`,
+    "• Contain any of the following characters: / \\ ? * : [ ]",
+    "• Begin or end with an apostrophe ('), but they can be used in between text or numbers in a name.",
+    `• Be named "${SHEET_NAME_RESERVED_WORD}". This is a reserved word Excel uses internally.`,
+].join("\n");
+/**
+ * Excel's worksheet-name rules, in the order its dialog lists them: not blank, at most 31 characters,
+ * none of `\ / ? * [ ] :`, no leading or trailing apostrophe, not `History`, and unique among
+ * `existing` compared case-insensitively (a sheet may always re-case its own title — pass its id as
+ * `exceptSheetId`). Both engines' rename / create paths and the sheet tabs validate through this one
+ * function (the rnc store mirrors it in Rust and surfaces the same messages via its `rejections`).
+ */
+export const validateSheetName = (name, existing = [], exceptSheetId) => {
+    const invalid = (reason) => ({
+        ok: false,
+        reason,
+        message: SHEET_NAME_INVALID_MESSAGE,
+    });
+    if (name.trim().length === 0) {
+        return invalid("blank");
+    }
+    if (name.length > SHEET_NAME_MAX_LENGTH) {
+        return invalid("too-long");
+    }
+    if (SHEET_NAME_ILLEGAL_CHARACTER.test(name)) {
+        return invalid("illegal-character");
+    }
+    if (name.startsWith("'") || name.endsWith("'")) {
+        return invalid("apostrophe");
+    }
+    if (isSameSheetTitle(name, SHEET_NAME_RESERVED_WORD)) {
+        return invalid("reserved");
+    }
+    const key = sheetTitleKey(name);
+    for (const sheet of existing) {
+        if (typeof sheet === "string") {
+            if (sheetTitleKey(sheet) === key) {
+                return { ok: false, reason: "taken", message: SHEET_NAME_TAKEN_MESSAGE };
+            }
+        }
+        else if (sheet.sheetId !== exceptSheetId && sheetTitleKey(sheet.title) === key) {
+            return { ok: false, reason: "taken", message: SHEET_NAME_TAKEN_MESSAGE };
+        }
+    }
+    return { ok: true };
+};

package/dist/esm/sheet-protection.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Excel's refusal when an edit touches a locked cell of a protected sheet — the dialog every
+ * mutation path shows (typing, Delete / Backspace, fill, paste) on both engines
+ * (rowsncolumns/spreadsheet#939 U-35). The rnc store surfaces the same text through its
+ * `rejections` channel under the `protected-sheet` code.
+ */
+export declare const SHEET_PROTECTION_ERROR_TITLE = "This sheet is protected";
+export declare const PROTECTED_SHEET_EDIT_MESSAGE = "The cell or chart you're trying to change is on a protected sheet. To make a change, unprotect the sheet. You might be requested to enter a password.";
+//# sourceMappingURL=sheet-protection.d.ts.map

package/dist/esm/sheet-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sheet-protection.d.ts","sourceRoot":"","sources":["../../sheet-protection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,4BAA4B,CAAC;AAEtE,eAAO,MAAM,4BAA4B,0JACgH,CAAC"}

package/dist/esm/sheet-protection.js

@@ -0,0 +1,8 @@
+/**
+ * Excel's refusal when an edit touches a locked cell of a protected sheet — the dialog every
+ * mutation path shows (typing, Delete / Backspace, fill, paste) on both engines
+ * (rowsncolumns/spreadsheet#939 U-35). The rnc store surfaces the same text through its
+ * `rejections` channel under the `protected-sheet` code.
+ */
+export const SHEET_PROTECTION_ERROR_TITLE = "This sheet is protected";
+export const PROTECTED_SHEET_EDIT_MESSAGE = "The cell or chart you're trying to change is on a protected sheet. To make a change, unprotect the sheet. You might be requested to enter a password.";

package/dist/esm/string.d.ts

@@ -38,6 +38,20 @@ export declare const cellToAddress: (cell: CellInterface | null, isAbsoluteColum
  * @returns
  */
 export declare const cellRangeToAddress: (sheetName: string | undefined, range: GridRange) => string;
+/**
+ * Must `name` be single-quoted as a sheet qualifier (`'My Data'!A1`)? Excel writes it bare only when
+ * it is a plain identifier — ASCII letters and digits, starting with a letter — and cannot be read
+ * as something else: a cell reference (`A1`, `XFD1`, `R1C1`), or a boolean (`TRUE`). A leading digit
+ * (`2024`, `1Sheet`) always quotes. Deliberately a superset of Excel's minimum (a `_`, `.` or
+ * non-ASCII letter also quotes): over-quoting is always valid, under-quoting makes `=2024!A1` a
+ * formula Excel rejects (rowsncolumns/spreadsheet#939 K-10).
+ */
+export declare const sheetNameNeedsQuoting: (name: string) => boolean;
+/**
+ * Quote a sheet name for use as a formula qualifier when Excel requires it (see
+ * {@link sheetNameNeedsQuoting}); apostrophes inside are doubled (`'O''Neil'`). Rename, cross-sheet
+ * reference generation and formula-bar insertion all quote through here so they agree.
+ */
 export declare const sanitizeSheetName: (name: string | undefined) => string | undefined;
 /**
  * Remove single quotes from sheetname
@@ -76,6 +90,23 @@ export declare const matchesWildcardPattern: (pattern: string, text: string, anc
  */
 export declare const selectionBoundsFromCells: (start: CellInterface, end?: CellInterface | null) => GridRange;
 export declare const supplant: (s: string, o: Record<string, any>) => string;
+/**
+ * Whether a hyperlink target read from untrusted markup (clipboard HTML) may
+ * be kept. A URL with an explicit scheme must use one of the safe schemes;
+ * scheme-less, protocol-relative, path and fragment references are allowed
+ * (they are normalized by {@link normalizeExternalUrl} before being opened).
+ * Applies the same tab/newline and C0-control stripping as the browser's URL
+ * canonicalization so `java\tscript:` cannot slip through.
+ */
+export declare const isSafeHyperlinkUri: (uri: string | null | undefined) => boolean;
+/**
+ * Escape text for interpolation into an HTML text node (`text/html`
+ * clipboard fragments): a cell whose value is literally `<b>x</b>` must paste
+ * back as that text, not as bold "x".
+ */
+export declare const escapeHtmlText: (value: string) => string;
+/** Escape a value for interpolation into a quoted HTML attribute. */
+export declare const escapeHtmlAttribute: (value: string) => string;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to

package/dist/esm/string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,MAAM,KAAG,MAe/D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,KACxD,OAWF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}
+{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAOF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,OAMrB,CAAC;AAEjC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,MAAM,KAAG,MAe/D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,KACxD,OAWF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAgBnE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAC2B,CAAC;AAE3E,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,MAM1B,CAAC;AAE3B;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}

package/dist/esm/string.js

@@ -118,13 +118,35 @@ export const cellRangeToAddress = (sheetName, range) => {
         columnIndex: range.endColumnIndex,
     })}`;
 };
-/* Sanitize sheet names */
+/** `A1`-style lookalike: 1–3 ASCII letters followed only by digits (`AB12`, `XFD1`). */
+const SHEET_NAME_A1_LOOKALIKE = /^[A-Za-z]{1,3}\d+$/;
+/** `R1C1`-style lookalike: an optional-digit `R` part and/or `C` part, nothing else (`R`, `C22`, `R1C1`). */
+const SHEET_NAME_R1C1_LOOKALIKE = /^(?:[Rr]\d*)?(?:[Cc]\d*)?$/;
+/**
+ * Must `name` be single-quoted as a sheet qualifier (`'My Data'!A1`)? Excel writes it bare only when
+ * it is a plain identifier — ASCII letters and digits, starting with a letter — and cannot be read
+ * as something else: a cell reference (`A1`, `XFD1`, `R1C1`), or a boolean (`TRUE`). A leading digit
+ * (`2024`, `1Sheet`) always quotes. Deliberately a superset of Excel's minimum (a `_`, `.` or
+ * non-ASCII letter also quotes): over-quoting is always valid, under-quoting makes `=2024!A1` a
+ * formula Excel rejects (rowsncolumns/spreadsheet#939 K-10).
+ */
+export const sheetNameNeedsQuoting = (name) => name.length === 0 ||
+    /[^A-Za-z0-9]/.test(name) ||
+    /^\d/.test(name) ||
+    SHEET_NAME_A1_LOOKALIKE.test(name) ||
+    SHEET_NAME_R1C1_LOOKALIKE.test(name) ||
+    /^(?:true|false)$/i.test(name);
+/**
+ * Quote a sheet name for use as a formula qualifier when Excel requires it (see
+ * {@link sheetNameNeedsQuoting}); apostrophes inside are doubled (`'O''Neil'`). Rename, cross-sheet
+ * reference generation and formula-bar insertion all quote through here so they agree.
+ */
 export const sanitizeSheetName = (name) => {
     if (name === void 0)
         return void 0;
     if (typeof name === "number")
         return name;
-    if (/\s+|[^a-z|A-Z|0-9]/.test(name)) {
+    if (sheetNameNeedsQuoting(name)) {
         // Escape single quotes by doubling them for valid sheet references.
         const escaped = name.replace(/'/g, "''");
         return `'${escaped}'`;
@@ -238,6 +260,44 @@ const URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
 // explicit scheme (javascript:, data:, vbscript:, …) is a script/content
 // injection vector and is rejected.
 const SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
+/**
+ * Whether a hyperlink target read from untrusted markup (clipboard HTML) may
+ * be kept. A URL with an explicit scheme must use one of the safe schemes;
+ * scheme-less, protocol-relative, path and fragment references are allowed
+ * (they are normalized by {@link normalizeExternalUrl} before being opened).
+ * Applies the same tab/newline and C0-control stripping as the browser's URL
+ * canonicalization so `java\tscript:` cannot slip through.
+ */
+export const isSafeHyperlinkUri = (uri) => {
+    if (uri == null) {
+        return false;
+    }
+    const trimmed = uri
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return false;
+    }
+    const schemeMatch = URL_SCHEME.exec(trimmed);
+    if (!schemeMatch) {
+        return true;
+    }
+    return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase());
+};
+/**
+ * Escape text for interpolation into an HTML text node (`text/html`
+ * clipboard fragments): a cell whose value is literally `<b>x</b>` must paste
+ * back as that text, not as bold "x".
+ */
+export const escapeHtmlText = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+/** Escape a value for interpolation into a quoted HTML attribute. */
+export const escapeHtmlAttribute = (value) => value
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to

package/dist/esm/tsconfig.esm.tsbuildinfo

@@ -1 +1 @@
-{"root":["../../array.ts","../../cell-data-helpers.ts","../../color.ts","../../colors.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}
+{"root":["../../array.ts","../../cell-data-helpers.ts","../../clipboard-html-sanitize.ts","../../color.ts","../../colors.ts","../../condition-operand.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-names.ts","../../sheet-protection.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rowsncolumns/utils",
-  "version": "9.5.1",
+  "version": "9.5.4",
   "author": "Vinay M",
   "license": "SEE LICENSE IN LICENSE.md",
   "main": "./dist/cjs/index.js",
@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "numfmt": "^3.2.2",
-    "@rowsncolumns/common-types": ">=5.3.1"
+    "@rowsncolumns/common-types": ">=5.3.2"
   },
   "devDependencies": {},
   "peerDependencies": {}