@shbernal/ts-xlsx 1.0.2 → 1.0.3

package/dist/io/xlsx/write.js

@@ -14,27 +14,27 @@
 // `worksheet-xml.ts` and are re-exported here so the streaming writer's import surface is
 // unchanged.
 import { strToU8, zip, zipSync } from 'fflate';
-import { DEFAULT_THEME_XML } from "../../core/theme.js";
-import { AuthoringError } from "../../errors.js";
-import { THEME_PART_PATH } from "../opc/part-paths.js";
-import { relsPartXml } from "../opc/rels.js";
-import { collectComments, commentsXml, vmlDrawingXml } from "./comments.js";
-import { collectHyperlinks, planHyperlinks } from "./hyperlinks.js";
-import { drawingRelsXml, drawingXml } from "./images.js";
-import { planMedia, planPreservedParts, SheetRelIds, } from "./package-plan.js";
-import { pivotCacheDefinitionXml, pivotCacheRecordsXml, pivotTableXml } from "./pivot.js";
-import { REL } from "./relationships.js";
-import { SharedStringTable } from "./shared-strings.js";
-import { StyleRegistry } from "./styles.js";
-import { tableXml } from "./tables.js";
-import { personsXml, threadedCommentsXml } from "./threaded-comments.js";
-import { appPropsXml, contentTypesXml, corePropsXml, FIXED_WORKBOOK_REL_COUNT, rootRelsXml, workbookRelsXml, workbookXml, } from "./workbook-xml.js";
-import { worksheetRelsXml, worksheetXml, } from "./worksheet-xml.js";
-export { buildColumnDefaults, Extent, renderRow, } from "./worksheet-xml.js";
+import { DEFAULT_THEME_XML } from '../../core/theme.js';
+import { AuthoringError } from '../../errors.js';
+import { THEME_PART_PATH } from '../opc/part-paths.js';
+import { relsPartXml } from '../opc/rels.js';
+import { collectComments, commentsXml, vmlDrawingXml } from './comments.js';
+import { collectHyperlinks, planHyperlinks } from './hyperlinks.js';
+import { drawingRelsXml, drawingXml } from './images.js';
+import { planMedia, planPreservedParts, SheetRelIds, } from './package-plan.js';
+import { pivotCacheDefinitionXml, pivotCacheRecordsXml, pivotTableXml } from './pivot.js';
+import { REL } from './relationships.js';
+import { SharedStringTable } from './shared-strings.js';
+import { StyleRegistry } from './styles.js';
+import { tableXml } from './tables.js';
+import { personsXml, threadedCommentsXml } from './threaded-comments.js';
+import { appPropsXml, contentTypesXml, corePropsXml, FIXED_WORKBOOK_REL_COUNT, rootRelsXml, workbookRelsXml, workbookXml, } from './workbook-xml.js';
+import { worksheetRelsXml, worksheetXml, } from './worksheet-xml.js';
+export { buildColumnDefaults, Extent, renderRow, } from './worksheet-xml.js';
 /**
  * Serialise a workbook into an `.xlsx` package.
  *
- * @throws {@link AuthoringError} if the workbook has no worksheets (a zero-sheet package is corrupt),
+ * @throws {AuthoringError} if the workbook has no worksheets (a zero-sheet package is corrupt),
  *   or holds a value the writer cannot yet represent.
  */
 export function writeXlsx(workbook, options = {}) {
@@ -55,7 +55,7 @@ export function writeXlsx(workbook, options = {}) {
  * no worker can take, and the reader's zip-bomb ceiling is enforced by counting output between
  * synchronous input slices. See ADR-0024.
  *
- * @throws {@link AuthoringError} — as a rejection — under the same conditions as {@link writeXlsx};
+ * @throws {AuthoringError} — as a rejection — under the same conditions as {@link writeXlsx};
  *   the part-building it shares happens before any worker is involved. A failure raised by the zip
  *   layer itself (including an environment that cannot spawn a worker) propagates unwrapped, exactly
  *   as it does from {@link writeXlsx}.
@@ -135,7 +135,7 @@ function resolveSheetReferences(plan) {
  * streaming writer can drive the identical parts through a streamed zip container rather than
  * `zipSync`. Neither writer duplicates a byte of serialisation.
  *
- * @throws {@link AuthoringError} if the workbook has no worksheets, or holds a value the writer cannot represent.
+ * @throws {AuthoringError} if the workbook has no worksheets, or holds a value the writer cannot represent.
  */
 export function buildPackageParts(workbook, options = {}) {
     const sheets = workbook.worksheets;

package/dist/io/xlsx/x14-ext.js

@@ -1,4 +1,4 @@
-import { X14_NS } from "./namespaces.js";
+import { X14_NS } from './namespaces.js';
 /**
  * Wrap an x14 extension body in the `<ext>` envelope every worksheet- and workbook-level x14
  * extension shares: a `uri` scoping the extension to its feature (a fixed GUID from

package/dist/vba/cfb-writer.js

@@ -10,7 +10,7 @@
 // Unlike the reader, this is not a hostile-input path: we are the producer. It still validates its
 // contract (name length, sibling-name uniqueness, size bound) and fails closed with VbaAuthorError,
 // because a silently malformed container would surface far downstream as an unopenable workbook.
-import { VbaAuthorError } from "./errors.js";
+import { VbaAuthorError } from './errors.js';
 const SECTOR = 512;
 const MINI_SECTOR = 64;
 const MINI_CUTOFF = 4096;

package/dist/vba/cfb.js

@@ -9,7 +9,7 @@
 // It parses an untrusted blob, so every sector index, chain, and stream size is bounds-checked against
 // the file and every chain walk is cycle-guarded. A malformed container fails closed with a
 // VbaParseError instead of reading out of bounds, looping forever, or over-allocating.
-import { VbaParseError } from "./errors.js";
+import { VbaParseError } from './errors.js';
 // Sector values 0xFFFFFFFA..0xFFFFFFFF are reserved markers (DIFSECT/FATSECT/ENDOFCHAIN/FREESECT), not
 // data-sector indices; any value at or above this is chain-terminal. Directory-tree links reuse the same
 // convention: NOSTREAM (0xFFFFFFFF) and any value at or above the ceiling mean "no such sibling/child".

package/dist/vba/codepage.js

@@ -1,7 +1,7 @@
 // The VBA project stores module names and source as MBCS bytes in the project code page
 // (`PROJECTCODEPAGE`, [MS-OVBA] 2.3.4.2). To recover text we decode those bytes with the matching
 // encoding rather than assuming latin1 — a CJK or Cyrillic project would otherwise mojibake.
-import { VbaAuthorError, VbaParseError } from "./errors.js";
+import { VbaAuthorError, VbaParseError } from './errors.js';
 // Windows code-page numbers → the WHATWG encoding label `TextDecoder` understands. Node's built-in
 // ICU covers all of these. Only the code pages a VBA project realistically declares are listed; an
 // unlisted one falls back to windows-1252 (the overwhelmingly common Western-European default) so a

package/dist/vba/errors.js

@@ -1,4 +1,4 @@
-import { XlsxError } from "../errors.js";
+import { XlsxError } from '../errors.js';
 /**
  * Thrown when a VBA project (`vbaProject.bin`) is present but cannot be parsed — a malformed
  * compound file, a corrupt compressed stream, or a `dir` record that does not conform to [MS-OVBA].

package/dist/vba/index.js

@@ -8,8 +8,8 @@
 // is a projection over bytes the model preserves opaquely on round-trip. For the design invariants and
 // the wider VBA feature map see the ADRs: read view (docs/decisions/0016), authoring (0017/0019), and
 // structural edits (0018/0019), plus docs/knowledge/specs/xlsm-macro-preservation.md.
-export { writeCompoundFile, } from "./cfb-writer.js";
-export { VbaAuthorError, VbaParseError } from "./errors.js";
-export { compressContainer, decompressContainer } from "./ms-ovba.js";
-export { parseVbaProject, VBA_PROJECT_CONTENT_TYPE, VBA_PROJECT_PART_PATH, VBA_PROJECT_REL_TYPE, vbaProjectSignatureKind, } from "./project.js";
-export { addVbaReference, removeVbaModule, } from "./project-editor.js";
+export { writeCompoundFile, } from './cfb-writer.js';
+export { VbaAuthorError, VbaParseError } from './errors.js';
+export { compressContainer, decompressContainer } from './ms-ovba.js';
+export { parseVbaProject, VBA_PROJECT_CONTENT_TYPE, VBA_PROJECT_PART_PATH, VBA_PROJECT_REL_TYPE, vbaProjectSignatureKind, } from './project.js';
+export { addVbaReference, removeVbaModule, } from './project-editor.js';

package/dist/vba/ms-ovba.js

@@ -11,7 +11,7 @@
 // fails closed with a VbaParseError rather than over-allocating, looping, or reading out of bounds. The
 // compressor is the authoring inverse — it is fed our own bytes, and its output re-expands to the input
 // byte-for-byte (the round-trip is the correctness contract).
-import { VbaParseError } from "./errors.js";
+import { VbaParseError } from './errors.js';
 // A decompressed chunk covers at most 4096 bytes; both directions honour this window ([MS-OVBA]
 // 2.4.1.3.6). The chunk header's bits 12-14 carry a fixed 0b011 signature, bit 15 the compressed flag.
 const MAX_CHUNK_DECOMPRESSED = 4096;

package/dist/vba/project-editor.js

@@ -9,13 +9,13 @@
 // p-code — so source authoring/editing lives in the offline `tools/vba-compiler` (VBIDE), not in this
 // pure-TS path (ADR 0019). These splices are safe precisely because they leave every module's p-code
 // exactly as its own compiler wrote it.
-import { CompoundFile } from "./cfb.js";
-import { writeCompoundFile } from "./cfb-writer.js";
-import { decoderForCodePage, encoderForCodePage } from "./codepage.js";
-import { VbaAuthorError, VbaParseError } from "./errors.js";
-import { compressContainer, decompressContainer } from "./ms-ovba.js";
-import { parseVbaProject } from "./project.js";
-import { push, u16, u32, utf16le, validateVbaName } from "./vba-encoding.js";
+import { CompoundFile } from './cfb.js';
+import { writeCompoundFile } from './cfb-writer.js';
+import { decoderForCodePage, encoderForCodePage } from './codepage.js';
+import { VbaAuthorError, VbaParseError } from './errors.js';
+import { compressContainer, decompressContainer } from './ms-ovba.js';
+import { parseVbaProject } from './project.js';
+import { push, u16, u32, utf16le, validateVbaName } from './vba-encoding.js';
 const DIR_STREAM = 'dir';
 const PROJECT_STREAM = 'PROJECT';
 const PROJECTWM_STREAM = 'PROJECTwm';

package/dist/vba/project.js

@@ -5,10 +5,10 @@
 // where the compressed source text begins — past the p-code / PerformanceCache. We decompress `dir`,
 // read those facts, then decompress each module stream from its text offset and decode with the
 // project code page. The p-code is version-specific and deliberately not exposed; a reader wants source.
-import { CompoundFile } from "./cfb.js";
-import { decoderForCodePage } from "./codepage.js";
-import { VbaParseError } from "./errors.js";
-import { decompressContainer } from "./ms-ovba.js";
+import { CompoundFile } from './cfb.js';
+import { decoderForCodePage } from './codepage.js';
+import { VbaParseError } from './errors.js';
+import { decompressContainer } from './ms-ovba.js';
 // The OPC packaging identity of a workbook's VBA project — the relationship Type URI Excel wires it
 // under, the content type its `.bin` part declares, and the canonical package path. These are the
 // facts an authoring path needs to attach a macro blob so the writer emits a valid macro-enabled

package/dist/vba/vba-encoding.js

@@ -5,7 +5,7 @@
 // on open — a module runs the compiled p-code it ships — so authoring/editing module SOURCE is done by
 // the offline `tools/vba-compiler` (VBIDE), which produces genuinely compiled p-code. This module holds
 // only what the pure-TS structural edits (remove module, add reference) still need (ADR 0019).
-import { VbaAuthorError } from "./errors.js";
+import { VbaAuthorError } from './errors.js';
 const IDENTIFIER = /^[A-Za-z][A-Za-z0-9_]*$/;
 const MAX_NAME_CHARS = 31; // the CFB stream-name limit, and VBA's own module-name limit
 /**

package/dist/xml/errors.js

@@ -1,4 +1,4 @@
-import { XlsxError } from "../errors.js";
+import { XlsxError } from '../errors.js';
 /**
  * Thrown when XML text cannot be scanned into parse events — an unterminated tag, comment, CDATA
  * section, markup declaration or processing instruction.

package/dist/xml/xml-read.js

@@ -10,7 +10,7 @@
 // entities and numeric character references are recognised; DTDs and `<!ENTITY>`
 // definitions are skipped, so entity-expansion (billion-laughs) and external-entity
 // (XXE) attacks are structurally impossible here, not merely mitigated.
-import { XmlParseError } from "./errors.js";
+import { XmlParseError } from './errors.js';
 const PREDEFINED_ENTITIES = {
     amp: '&',
     lt: '<',

package/dist/xml/xml.js

@@ -5,7 +5,7 @@
 // path. Escaping is the one hard, security-relevant requirement — an unescaped `<`,
 // `&`, or `"` produces a malformed package a consumer rejects — so it lives here,
 // audited once, rather than sprinkled through the part emitters.
-import { AuthoringError } from "../errors.js";
+import { AuthoringError } from '../errors.js';
 const TEXT_ESCAPES = {
     '&': '&amp;',
     '<': '&lt;',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shbernal/ts-xlsx",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "A TypeScript-first library for reading and writing xlsx (OOXML) spreadsheets.",
   "license": "MIT",
   "author": "shbernal",
@@ -74,6 +74,7 @@
     "constitution:check": "node scripts/check-constitution.ts",
     "layering:check": "node scripts/check-layering.ts",
     "entries:check": "node scripts/check-entries.ts",
+    "source-text:check": "node scripts/check-source-text.ts",
     "lint": "biome check --error-on-warnings src scripts test tools",
     "lint:fix": "biome check --write --error-on-warnings src scripts test tools",
     "format": "biome format --write src scripts test tools",
@@ -112,6 +113,6 @@
     "@types/node": "^24.13.3",
     "jszip": "^3.10.1",
     "lefthook": "^2.1.10",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   }
 }