@shbernal/ts-xlsx 1.3.1 → 2.1.0

package/dist/io/xlsx/write-stream.d.ts

@@ -12,12 +12,12 @@ import type { StyleRegistry } from './styles.ts';
 import { type FlushedSheet } from './write.ts';
 /** Calculation settings applied to the streamed workbook. Mirrors the {@link Workbook} flags. */
 export interface CalcProperties {
-    /** Ask the consumer to recalculate every formula on open — the OOXML `fullCalcOnLoad` flag. */
+    /** Ask the consumer to recalculate every formula on open: the OOXML `fullCalcOnLoad` flag. */
     fullCalcOnLoad?: boolean;
 }
 type SinkOptions = {
     /**
-     * Write the package to a caller-owned {@link Writable} sink — an outbound upload, a cloud-SDK
+     * Write the package to a caller-owned {@link Writable} sink: an outbound upload, a cloud-SDK
      * stream, any destination the caller controls. {@link WorkbookStreamWriter.commit} pushes every
      * chunk into it and settles only once the sink has finished (or rejects if it errors), so a
      * caller can deterministically sequence work after the upload completes. Mutually exclusive
@@ -41,7 +41,7 @@ type SinkOptions = {
 /** Options fixed at construction that shape the whole streamed package. */
 export type WorkbookStreamWriterOptions = SinkOptions & {
     /**
-     * Pool plain string cell values into a shared-strings table rather than storing each inline — the
+     * Pool plain string cell values into a shared-strings table rather than storing each inline: the
      * same {@link WriteOptions.useSharedStrings} the buffered writer exposes. Off by default.
      */
     readonly useSharedStrings?: boolean;
@@ -58,12 +58,12 @@ export declare class StreamedRow {
     /** The cells this row materialised, for styling before it is committed. */
     get cells(): readonly Cell[];
     /** Finalise the row: an eager writer serialises it now and releases its cells; otherwise a no-op.
-     * Committing twice is harmless — the second call does nothing rather than re-emitting the row. */
+     * Committing twice is harmless: the second call does nothing rather than re-emitting the row. */
     commit(): void;
 }
 /**
  * A worksheet being written incrementally. Append rows with {@link addRow}/{@link addRows}, style
- * cells through {@link getCell}, then {@link commit} to freeze it — after which any further mutation
+ * cells through {@link getCell}, then {@link commit} to freeze it, after which any further mutation
  * is rejected with a legible error rather than silently accepted or crashing.
  */
 export declare class WorksheetStreamWriter {
@@ -71,7 +71,7 @@ export declare class WorksheetStreamWriter {
     constructor(sheet: Worksheet, eager: boolean, styles: StyleRegistry);
     /** The sheet's name. */
     get name(): string;
-    /** The number of rows written so far — spans gaps and formatted-only rows, like the model, and
+    /** The number of rows written so far. Spans gaps and formatted-only rows, like the model, and
      * survives the eviction of eagerly-flushed rows. */
     get rowCount(): number;
     /** Append one row of values after the last used row; the cells are returned for styling. */
@@ -83,32 +83,39 @@ export declare class WorksheetStreamWriter {
      * {@link StreamedRow.commit}; the row's `<row>` XML is retained (interned into the workbook's live
      * style registry so its ids stay valid) and the cell graph is dropped, bounding peak memory.
      *
-     * @throws {AuthoringError} if the row carries a shared-formula cell — a finished row cannot join the
+     * @throws {AuthoringError} if the row carries a shared-formula cell: a finished row cannot join the
      *   whole-sheet formula planning, so shared formulas must be authored through {@link getCell}.
      */
     flushRow(number: number, cells: readonly Cell[]): void;
     flushedSheet(): FlushedSheet | undefined;
-    /** Address a cell by its A1 reference to read or style it before the sheet is committed. */
+    /**
+     * Address a cell by its A1 reference to read or style it before the sheet is committed. The row it
+     * names must still be live: a row whose {@link StreamedRow.commit} has run is finished.
+     *
+     * @throws {AuthoringError} if the reference names an already-committed row. That row's `<row>` is
+     *   rendered and its cells are released, so the cell this would materialise could only be written
+     *   as a second row carrying the same number.
+     */
     getCell(reference: string): Cell;
     /**
      * Attach a data validation to a range before the sheet is committed. Delegates to the model, so the
-     * streamed package emits the `<dataValidations>` block in its CT_Worksheet position — before
-     * `<hyperlinks>` — because both writers share one worksheet serializer.
+     * streamed package emits the `<dataValidations>` block in its CT_Worksheet position, before
+     * `<hyperlinks>`, because both writers share one worksheet serializer.
      */
     addDataValidation(sqref: string, rule: DataValidation, options?: {
         extended?: boolean;
     }): void;
     /**
      * Attach a conditional formatting to a range before the sheet is committed. Like every other block,
-     * it lands in its schema-mandated slot — after `<mergeCells>`, before `<dataValidations>` and
-     * `<hyperlinks>` — since the streamed sheet is serialized through the same path as a buffered write.
+     * it lands in its schema-mandated slot, after `<mergeCells>` and before `<dataValidations>` and
+     * `<hyperlinks>`, since the streamed sheet is serialized through the same path as a buffered write.
      */
     addConditionalFormatting(formatting: ConditionalFormatting): void;
     /**
      * Anchor a workbook image (the id from {@link WorkbookStreamWriter.addImage}) to this sheet,
      * spanning the rectangle from the top-left grid point `tl` to the bottom-right `br`. The streamed
      * package emits the drawing part, its media relationship, and the sheet's `<drawing>` reference
-     * exactly as a buffered write does — both writers share `buildPackageParts`.
+     * exactly as a buffered write does: both writers share `buildPackageParts`.
      */
     addImage(imageId: number, anchor: {
         readonly tl: AnchorPoint;
@@ -116,7 +123,7 @@ export declare class WorksheetStreamWriter {
     }): void;
     /**
      * Apply the sheet's autofilter before it is committed; mirrors {@link Worksheet.autoFilter}. The
-     * streamed package emits `<autoFilter>` in its CT_Worksheet slot — after `<sheetProtection>` — and
+     * streamed package emits `<autoFilter>` in its CT_Worksheet slot, after `<sheetProtection>`, and
      * contributes the hidden `_FilterDatabase` defined name, exactly as a buffered write does.
      */
     set autoFilter(filter: string | AutoFilter | undefined);
@@ -147,8 +154,8 @@ export declare class WorkbookStreamWriter {
     /** Document-level metadata written to the package's core properties. */
     get properties(): Workbook['properties'];
     /**
-     * The output stream carrying the package bytes. A caller drives it with Node's standard idiom —
-     * `writer.stream.pipe(out)` — which composes because `pipe` returns its destination. The stream is
+     * The output stream carrying the package bytes. A caller drives it with Node's standard idiom,
+     * `writer.stream.pipe(out)`, which composes because `pipe` returns its destination. The stream is
      * created lazily on first access so a caller handing the writer its own sink is still free to
      * ignore this one.
      */

package/dist/io/xlsx/write-stream.js

@@ -1,7 +1,8 @@
 import { createWriteStream } from 'node:fs';
 import { PassThrough } from 'node:stream';
 import { Zip, ZipDeflate } from 'fflate';
-import { encodeAddress } from '../../core/address.js';
+import { concat } from '../../bytes.js';
+import { encodeAddress, tryDecodeCellRef } from '../../core/address.js';
 import { INTERNAL } from '../../core/internal.js';
 import { isSharedFormulaValue } from '../../core/value.js';
 import { Workbook } from '../../core/workbook.js';
@@ -36,6 +37,7 @@ export class WorksheetStreamWriter {
     #lastRow = 0;
     #columnDefaults;
     #flushedRows = [];
+    #flushedNumbers = new Set();
     #extent = new Extent();
     #maxRowOutlineLevel = 0;
     constructor(sheet, eager, styles) {
@@ -97,6 +99,7 @@ export class WorksheetStreamWriter {
             this.#flushedRows.push({ number, xml });
             this.#extent.add(number, minCol, maxCol);
         }
+        this.#flushedNumbers.add(number);
         this.#sheet[INTERNAL].evictRow(number);
     }
     flushedSheet() {
@@ -110,6 +113,12 @@ export class WorksheetStreamWriter {
     }
     getCell(reference) {
         this.#assertOpen();
+        const target = tryDecodeCellRef(reference);
+        if (target !== undefined && this.#flushedNumbers.has(target.row)) {
+            throw new AuthoringError(`cell ${reference} of streamed sheet "${this.#sheet.name}" is in row ${target.row}, which is ` +
+                'already committed: its bytes are written and its cells released, so this value could only ' +
+                'be emitted as a second row with that number. Style a row before committing it.');
+        }
         return this.#sheet.getCell(reference);
     }
     addDataValidation(sqref, rule, options = {}) {
@@ -146,7 +155,7 @@ export class WorksheetStreamWriter {
     }
     #assertOpen() {
         if (this.#committed) {
-            throw new AuthoringError(`worksheet "${this.#sheet.name}" is already committed — its rows are finalised and no more can be added`);
+            throw new AuthoringError(`worksheet "${this.#sheet.name}" is already committed: its rows are finalised and no more can be added`);
         }
     }
 }
@@ -179,13 +188,13 @@ export class WorkbookStreamWriter {
     }
     addImage(options) {
         if (this.#committed) {
-            throw new AuthoringError('the workbook is already committed — no more images can be registered');
+            throw new AuthoringError('the workbook is already committed: no more images can be registered');
         }
         return this.#workbook.addImage(options);
     }
     addWorksheet(name, options = {}) {
         if (this.#committed) {
-            throw new AuthoringError('the workbook is already committed — no more worksheets can be added');
+            throw new AuthoringError('the workbook is already committed: no more worksheets can be added');
         }
         const sheet = new WorksheetStreamWriter(this.#workbook.addWorksheet(name, options), this.#eager, this.#styles);
         this.#sheets.push(sheet);
@@ -252,13 +261,3 @@ function streamZipPackage(parts, onChunk) {
         zip.end();
     });
 }
-function concat(chunks) {
-    const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
-    const out = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        out.set(chunk, offset);
-        offset += chunk.length;
-    }
-    return out;
-}

package/dist/io/xlsx/write.d.ts

@@ -16,13 +16,14 @@ export interface WriteOptions {
 /**
  * {@link WriteOptions} plus the streaming writer's internal wiring, so a buffered caller's options
  * object can never carry fields meant only for {@link WorkbookStreamWriter}'s own use. Not exported
- * from the public barrel — {@link buildPackageParts} is the only consumer outside this module.
+ * from the public barrel: {@link WorkbookStreamWriter} is the only caller that fills these fields,
+ * and it reaches them through {@link buildPackageParts}.
  */
 export interface InternalWriteOptions extends WriteOptions {
     /**
      * The style registry to intern into, in place of a freshly-seeded one. The streaming writer
      * serialises each committed row eagerly (freeing its cells), so those rows' style ids must be
-     * assigned by the very same registry that later emits `xl/styles.xml` — otherwise the ids in the
+     * assigned by the very same registry that later emits `xl/styles.xml`; otherwise the ids in the
      * pre-rendered rows would not match the styles part. When omitted the buffered path seeds its own,
      * so its output is unchanged.
      */
@@ -48,19 +49,19 @@ export declare function writeXlsx(workbook: Workbook, options?: WriteOptions): U
 /**
  * Serialise a workbook into an `.xlsx` package, deflating off the calling thread.
  *
- * Produces the same package {@link writeXlsx} does — byte for byte, entry timestamps included — and
+ * Produces the same package {@link writeXlsx} does, byte for byte and entry timestamps included, and
  * exists for one reason: DEFLATE dominates the cost of writing a large workbook, and {@link writeXlsx}
  * spends all of it on the caller's thread. Here `fflate` deflates each part in a worker, so the event
  * loop keeps turning (stalls drop from the whole write to tens of milliseconds) and parts compress in
  * parallel, which on a multi-sheet workbook also finishes sooner. On a single-sheet workbook there is
  * only one part to deflate, so expect responsiveness rather than speed.
  *
- * Building the parts still happens on the calling thread — only compression moves. That is why there
+ * Building the parts still happens on the calling thread; only compression moves. That is why there
  * is no `readXlsxAsync` mirroring this: reading is dominated by XML parsing and model building, which
  * no worker can take, and the reader's zip-bomb ceiling is enforced by counting output between
  * synchronous input slices. See ADR-0024.
  *
- * @throws {AuthoringError} — as a rejection — under the same conditions as {@link writeXlsx};
+ * @throws {AuthoringError}, as a rejection, under the same conditions as {@link writeXlsx};
  *   the part-building it shares happens before any worker is involved. A failure raised by the zip
  *   layer itself (including an environment that cannot spawn a worker) propagates unwrapped, exactly
  *   as it does from {@link writeXlsx}.
@@ -75,8 +76,8 @@ export declare function writeXlsxAsync(workbook: Workbook, options?: WriteOption
 export declare function createStyleRegistry(workbook: Workbook): StyleRegistry;
 /**
  * Assemble a workbook into the map of OPC package parts (part name → bytes) that make up an `.xlsx`,
- * short of zipping them. This is the whole serialisation — content types, relationships, workbook,
- * per-sheet XML, styles, theme, media, tables, and props — factored out of {@link writeXlsx} so the
+ * short of zipping them. This is the whole serialisation (content types, relationships, workbook,
+ * per-sheet XML, styles, theme, media, tables, and props) factored out of {@link writeXlsx} so the
  * streaming writer can drive the identical parts through a streamed zip container rather than
  * `zipSync`. Neither writer duplicates a byte of serialisation.
  *

package/dist/io/xlsx/write.js

@@ -1,5 +1,4 @@
 import { strToU8, zip, zipSync } from 'fflate';
-import { DEFAULT_THEME_XML } from '../../core/theme.js';
 import { AuthoringError } from '../../errors.js';
 import { THEME_PART_PATH } from '../opc/part-paths.js';
 import { relsPartXml } from '../opc/rels.js';
@@ -13,6 +12,7 @@ import { REL } from './relationships.js';
 import { SharedStringTable } from './shared-strings.js';
 import { StyleRegistry } from './styles.js';
 import { tableXml } from './tables.js';
+import { applyThemeOverrides, DEFAULT_THEME_XML } from './theme-xml.js';
 import { personsXml, threadedCommentsXml } from './threaded-comments.js';
 import { appPropsXml, contentTypesXml, corePropsXml, FIXED_WORKBOOK_REL_COUNT, rootRelsXml, workbookRelsXml, workbookXml, } from './workbook-xml.js';
 import { worksheetRelsXml, worksheetXml, } from './worksheet-xml.js';
@@ -66,7 +66,7 @@ function resolveSheetReferences(plan) {
 export function buildPackageParts(workbook, options = {}) {
     const sheets = workbook.worksheets;
     if (sheets.length === 0) {
-        throw new AuthoringError('cannot write a workbook with no worksheets — a zero-sheet package is corrupt to Excel');
+        throw new AuthoringError('cannot write a workbook with no worksheets: a zero-sheet package is corrupt to Excel');
     }
     const sharedStrings = options.useSharedStrings ? new SharedStringTable() : null;
     const media = planMedia(workbook, sheets);
@@ -184,7 +184,10 @@ export function buildPackageParts(workbook, options = {}) {
         'xl/styles.xml': strToU8(styles.toXml()),
     };
     if (!preserved.themeEmitted) {
-        files[THEME_PART_PATH] = strToU8(workbook.authoredThemeXml() ?? DEFAULT_THEME_XML);
+        const overrides = workbook.themeOverrides;
+        files[THEME_PART_PATH] = strToU8(overrides === undefined
+            ? DEFAULT_THEME_XML
+            : applyThemeOverrides(DEFAULT_THEME_XML, overrides));
     }
     if (hasSharedStrings) {
         files['xl/sharedStrings.xml'] = strToU8(sharedStrings.toXml());

package/dist/io/xlsx/x14-ext.d.ts

@@ -1,7 +1,7 @@
 /**
  * Wrap an x14 extension body in the `<ext>` envelope every worksheet- and workbook-level x14
  * extension shares: a `uri` scoping the extension to its feature (a fixed GUID from
- * {@link namespaces.ts}) plus the `xmlns:x14` binding the extension namespace on the element itself —
+ * {@link namespaces.ts}) plus the `xmlns:x14` binding the extension namespace on the element itself.
  * Excel declares it per `<ext>`, never at the part root. Callers needing an `<extLst>` wrapper add it
  * around the result; the producers the worksheet serialiser gathers return this bare so several exts
  * compose under a single shared `<extLst>`.

package/dist/sha512.d.ts

@@ -0,0 +1,2 @@
+/** The SHA-512 digest of `message`, as its 64 bytes. */
+export declare function sha512(message: Uint8Array): Uint8Array;

package/dist/sha512.js

@@ -0,0 +1,146 @@
+const BLOCK_BYTES = 128;
+const DIGEST_BYTES = 64;
+const K = new Uint32Array([
+    0x428a2f98, 0xd728ae22, 0x71374491, 0x23ef65cd, 0xb5c0fbcf, 0xec4d3b2f, 0xe9b5dba5, 0x8189dbbc,
+    0x3956c25b, 0xf348b538, 0x59f111f1, 0xb605d019, 0x923f82a4, 0xaf194f9b, 0xab1c5ed5, 0xda6d8118,
+    0xd807aa98, 0xa3030242, 0x12835b01, 0x45706fbe, 0x243185be, 0x4ee4b28c, 0x550c7dc3, 0xd5ffb4e2,
+    0x72be5d74, 0xf27b896f, 0x80deb1fe, 0x3b1696b1, 0x9bdc06a7, 0x25c71235, 0xc19bf174, 0xcf692694,
+    0xe49b69c1, 0x9ef14ad2, 0xefbe4786, 0x384f25e3, 0x0fc19dc6, 0x8b8cd5b5, 0x240ca1cc, 0x77ac9c65,
+    0x2de92c6f, 0x592b0275, 0x4a7484aa, 0x6ea6e483, 0x5cb0a9dc, 0xbd41fbd4, 0x76f988da, 0x831153b5,
+    0x983e5152, 0xee66dfab, 0xa831c66d, 0x2db43210, 0xb00327c8, 0x98fb213f, 0xbf597fc7, 0xbeef0ee4,
+    0xc6e00bf3, 0x3da88fc2, 0xd5a79147, 0x930aa725, 0x06ca6351, 0xe003826f, 0x14292967, 0x0a0e6e70,
+    0x27b70a85, 0x46d22ffc, 0x2e1b2138, 0x5c26c926, 0x4d2c6dfc, 0x5ac42aed, 0x53380d13, 0x9d95b3df,
+    0x650a7354, 0x8baf63de, 0x766a0abb, 0x3c77b2a8, 0x81c2c92e, 0x47edaee6, 0x92722c85, 0x1482353b,
+    0xa2bfe8a1, 0x4cf10364, 0xa81a664b, 0xbc423001, 0xc24b8b70, 0xd0f89791, 0xc76c51a3, 0x0654be30,
+    0xd192e819, 0xd6ef5218, 0xd6990624, 0x5565a910, 0xf40e3585, 0x5771202a, 0x106aa070, 0x32bbd1b8,
+    0x19a4c116, 0xb8d2d0c8, 0x1e376c08, 0x5141ab53, 0x2748774c, 0xdf8eeb99, 0x34b0bcb5, 0xe19b48a8,
+    0x391c0cb3, 0xc5c95a63, 0x4ed8aa4a, 0xe3418acb, 0x5b9cca4f, 0x7763e373, 0x682e6ff3, 0xd6b2b8a3,
+    0x748f82ee, 0x5defb2fc, 0x78a5636f, 0x43172f60, 0x84c87814, 0xa1f0ab72, 0x8cc70208, 0x1a6439ec,
+    0x90befffa, 0x23631e28, 0xa4506ceb, 0xde82bde9, 0xbef9a3f7, 0xb2c67915, 0xc67178f2, 0xe372532b,
+    0xca273ece, 0xea26619c, 0xd186b8c7, 0x21c0c207, 0xeada7dd6, 0xcde0eb1e, 0xf57d4f7f, 0xee6ed178,
+    0x06f067aa, 0x72176fba, 0x0a637dc5, 0xa2c898a6, 0x113f9804, 0xbef90dae, 0x1b710b35, 0x131c471b,
+    0x28db77f5, 0x23047d84, 0x32caab7b, 0x40c72493, 0x3c9ebe0a, 0x15c9bebc, 0x431d67c4, 0x9c100d4c,
+    0x4cc5d4be, 0xcb3e42b6, 0x597f299c, 0xfc657e2a, 0x5fcb6fab, 0x3ad6faec, 0x6c44198c, 0x4a475817,
+]);
+const INITIAL = new Uint32Array([
+    0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,
+    0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,
+]);
+function word(words, index) {
+    return words[index] ?? 0;
+}
+export function sha512(message) {
+    const blocks = Math.ceil((message.length + 17) / BLOCK_BYTES);
+    const padded = new Uint8Array(blocks * BLOCK_BYTES);
+    padded.set(message);
+    padded[message.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    const bits = message.length * 8;
+    view.setUint32(padded.length - 8, Math.floor(bits / 0x1_0000_0000), false);
+    view.setUint32(padded.length - 4, bits >>> 0, false);
+    const h = Uint32Array.from(INITIAL);
+    const schedule = new Uint32Array(160);
+    for (let block = 0; block < blocks; block++)
+        compress(h, view, block * BLOCK_BYTES, schedule);
+    const digest = new Uint8Array(DIGEST_BYTES);
+    const out = new DataView(digest.buffer);
+    for (let i = 0; i < 16; i++)
+        out.setUint32(i * 4, word(h, i), false);
+    return digest;
+}
+function compress(h, input, offset, schedule) {
+    for (let t = 0; t < 16; t++) {
+        schedule[t * 2] = input.getUint32(offset + t * 8, false);
+        schedule[t * 2 + 1] = input.getUint32(offset + t * 8 + 4, false);
+    }
+    for (let t = 16; t < 80; t++) {
+        const xHi = word(schedule, (t - 15) * 2);
+        const xLo = word(schedule, (t - 15) * 2 + 1);
+        const s0Hi = ((xHi >>> 1) | (xLo << 31)) ^ ((xHi >>> 8) | (xLo << 24)) ^ (xHi >>> 7);
+        const s0Lo = ((xLo >>> 1) | (xHi << 31)) ^ ((xLo >>> 8) | (xHi << 24)) ^ ((xLo >>> 7) | (xHi << 25));
+        const yHi = word(schedule, (t - 2) * 2);
+        const yLo = word(schedule, (t - 2) * 2 + 1);
+        const s1Hi = ((yHi >>> 19) | (yLo << 13)) ^ ((yLo >>> 29) | (yHi << 3)) ^ (yHi >>> 6);
+        const s1Lo = ((yLo >>> 19) | (yHi << 13)) ^ ((yHi >>> 29) | (yLo << 3)) ^ ((yLo >>> 6) | (yHi << 26));
+        const lo = (s1Lo >>> 0) +
+            word(schedule, (t - 7) * 2 + 1) +
+            (s0Lo >>> 0) +
+            word(schedule, (t - 16) * 2 + 1);
+        const hi = (s1Hi >>> 0) +
+            word(schedule, (t - 7) * 2) +
+            (s0Hi >>> 0) +
+            word(schedule, (t - 16) * 2) +
+            Math.floor(lo / 0x1_0000_0000);
+        schedule[t * 2] = hi >>> 0;
+        schedule[t * 2 + 1] = lo >>> 0;
+    }
+    let aHi = word(h, 0);
+    let aLo = word(h, 1);
+    let bHi = word(h, 2);
+    let bLo = word(h, 3);
+    let cHi = word(h, 4);
+    let cLo = word(h, 5);
+    let dHi = word(h, 6);
+    let dLo = word(h, 7);
+    let eHi = word(h, 8);
+    let eLo = word(h, 9);
+    let fHi = word(h, 10);
+    let fLo = word(h, 11);
+    let gHi = word(h, 12);
+    let gLo = word(h, 13);
+    let hHi = word(h, 14);
+    let hLo = word(h, 15);
+    for (let t = 0; t < 80; t++) {
+        const bigS1Hi = ((eHi >>> 14) | (eLo << 18)) ^ ((eHi >>> 18) | (eLo << 14)) ^ ((eLo >>> 9) | (eHi << 23));
+        const bigS1Lo = ((eLo >>> 14) | (eHi << 18)) ^ ((eLo >>> 18) | (eHi << 14)) ^ ((eHi >>> 9) | (eLo << 23));
+        const chHi = (eHi & fHi) ^ (~eHi & gHi);
+        const chLo = (eLo & fLo) ^ (~eLo & gLo);
+        const t1Lo = hLo + (bigS1Lo >>> 0) + (chLo >>> 0) + word(K, t * 2 + 1) + word(schedule, t * 2 + 1);
+        const t1Hi = (hHi +
+            (bigS1Hi >>> 0) +
+            (chHi >>> 0) +
+            word(K, t * 2) +
+            word(schedule, t * 2) +
+            Math.floor(t1Lo / 0x1_0000_0000)) >>>
+            0;
+        const t1LoWrapped = t1Lo >>> 0;
+        const bigS0Hi = ((aHi >>> 28) | (aLo << 4)) ^ ((aLo >>> 2) | (aHi << 30)) ^ ((aLo >>> 7) | (aHi << 25));
+        const bigS0Lo = ((aLo >>> 28) | (aHi << 4)) ^ ((aHi >>> 2) | (aLo << 30)) ^ ((aHi >>> 7) | (aLo << 25));
+        const majHi = (aHi & bHi) ^ (aHi & cHi) ^ (bHi & cHi);
+        const majLo = (aLo & bLo) ^ (aLo & cLo) ^ (bLo & cLo);
+        const t2Lo = (bigS0Lo >>> 0) + (majLo >>> 0);
+        const t2Hi = ((bigS0Hi >>> 0) + (majHi >>> 0) + Math.floor(t2Lo / 0x1_0000_0000)) >>> 0;
+        const t2LoWrapped = t2Lo >>> 0;
+        hHi = gHi;
+        hLo = gLo;
+        gHi = fHi;
+        gLo = fLo;
+        fHi = eHi;
+        fLo = eLo;
+        const nextELo = dLo + t1LoWrapped;
+        eHi = (dHi + t1Hi + Math.floor(nextELo / 0x1_0000_0000)) >>> 0;
+        eLo = nextELo >>> 0;
+        dHi = cHi;
+        dLo = cLo;
+        cHi = bHi;
+        cLo = bLo;
+        bHi = aHi;
+        bLo = aLo;
+        const nextALo = t1LoWrapped + t2LoWrapped;
+        aHi = (t1Hi + t2Hi + Math.floor(nextALo / 0x1_0000_0000)) >>> 0;
+        aLo = nextALo >>> 0;
+    }
+    addInto(h, 0, aHi, aLo);
+    addInto(h, 2, bHi, bLo);
+    addInto(h, 4, cHi, cLo);
+    addInto(h, 6, dHi, dLo);
+    addInto(h, 8, eHi, eLo);
+    addInto(h, 10, fHi, fLo);
+    addInto(h, 12, gHi, gLo);
+    addInto(h, 14, hHi, hLo);
+}
+function addInto(h, index, hi, lo) {
+    const sumLo = word(h, index + 1) + lo;
+    h[index] = (word(h, index) + hi + Math.floor(sumLo / 0x1_0000_0000)) >>> 0;
+    h[index + 1] = sumLo >>> 0;
+}

package/dist/vba/bytes.d.ts

@@ -0,0 +1,11 @@
+export { concat } from '../bytes.ts';
+/** Read a little-endian `uint16`. @throws {VbaParseError} if the two bytes are not both in `buf`. */
+export declare function readU16(buf: Uint8Array, at: number): number;
+/** Read a little-endian `uint32`. @throws {VbaParseError} if the four bytes are not all in `buf`. */
+export declare function readU32(buf: Uint8Array, at: number): number;
+/**
+ * Decode UTF-16LE code units: the encoding [MS-CFB] uses for directory-entry names and [MS-OVBA] for
+ * every "Unicode" name field. A trailing odd byte is dropped: these fields are length-prefixed by the
+ * producer and a half code unit carries nothing to decode.
+ */
+export declare function decodeUtf16le(bytes: Uint8Array): string;

package/dist/vba/bytes.js

@@ -0,0 +1,29 @@
+export { concat } from '../bytes.js';
+import { VbaParseError } from './errors.js';
+function truncated(at, need, length) {
+    return new VbaParseError(`read of ${need} bytes at offset ${at} runs past the end of a ${length}-byte buffer`);
+}
+export function readU16(buf, at) {
+    const b0 = buf[at];
+    const b1 = buf[at + 1];
+    if (b0 === undefined || b1 === undefined)
+        throw truncated(at, 2, buf.length);
+    return b0 | (b1 << 8);
+}
+export function readU32(buf, at) {
+    const b0 = buf[at];
+    const b1 = buf[at + 1];
+    const b2 = buf[at + 2];
+    const b3 = buf[at + 3];
+    if (b0 === undefined || b1 === undefined || b2 === undefined || b3 === undefined) {
+        throw truncated(at, 4, buf.length);
+    }
+    return (b0 | (b1 << 8) | (b2 << 16) | (b3 << 24)) >>> 0;
+}
+export function decodeUtf16le(bytes) {
+    let s = '';
+    for (let i = 0; i + 1 < bytes.length; i += 2) {
+        s += String.fromCharCode(readU16(bytes, i));
+    }
+    return s;
+}

package/dist/vba/cfb-writer.d.ts

@@ -14,6 +14,6 @@ export type CfbNode = CfbStream | CfbStorage;
  * by linear scan and by tree navigation.
  *
  * @throws {VbaAuthorError} if any name is empty or exceeds 31 characters, sibling names collide, or the
- *   project is so large it would need more than 109 FAT sectors (~7 MB — far beyond any real project).
+ *   project is so large it would need more than 109 FAT sectors (~7 MB, far beyond any real project).
  */
 export declare function writeCompoundFile(root: readonly CfbNode[]): Uint8Array;

package/dist/vba/cfb.d.ts

@@ -8,7 +8,7 @@ export declare class CompoundFile {
     readStream(name: string): Uint8Array | undefined;
     /**
      * Reconstruct the container's top-level children as the writer's node shape, recursing into every
-     * storage — so a caller can swap one stream and re-emit the whole hierarchy with {@link writeCompoundFile}.
+     * storage, so a caller can swap one stream and re-emit the whole hierarchy with {@link writeCompoundFile}.
      * Walks the red-black sibling tree each storage navigates (not the linear directory scan), so any part
      * a host reaches is carried through. Cycle- and bounds-guarded like every other chain walk here.
      */

package/dist/vba/cfb.js

@@ -1,3 +1,4 @@
+import { concat, decodeUtf16le, readU16, readU32 } from './bytes.js';
 import { VbaParseError } from './errors.js';
 const MAX_REGULAR_SECTOR = 0xfffffffa;
 const NOSTREAM = 0xffffffff;
@@ -10,7 +11,6 @@ const CFB_SIGNATURE_HI = 0xe11ab1a1;
 const DIR_ENTRY_SIZE = 128;
 export class CompoundFile {
     #buf;
-    #view;
     #sectorSize;
     #miniSectorSize;
     #miniCutoff;
@@ -21,14 +21,13 @@ export class CompoundFile {
     #miniStream;
     constructor(buf) {
         this.#buf = buf;
-        this.#view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
         if (buf.length < 512)
             throw new VbaParseError('compound file shorter than its 512-byte header');
-        if (this.#u32(0) !== CFB_SIGNATURE_LO || this.#u32(4) !== CFB_SIGNATURE_HI) {
+        if (readU32(this.#buf, 0) !== CFB_SIGNATURE_LO || readU32(this.#buf, 4) !== CFB_SIGNATURE_HI) {
             throw new VbaParseError('not a compound file (bad OLE2 signature)');
         }
-        const sectorShift = this.#u16(30);
-        const miniSectorShift = this.#u16(32);
+        const sectorShift = readU16(this.#buf, 30);
+        const miniSectorShift = readU16(this.#buf, 32);
         if (sectorShift !== 9 && sectorShift !== 12) {
             throw new VbaParseError(`unsupported sector shift ${sectorShift}`);
         }
@@ -37,12 +36,12 @@ export class CompoundFile {
         this.#sectorSize = 1 << sectorShift;
         this.#miniSectorSize = 1 << miniSectorShift;
         this.#maxSector = Math.floor(buf.length / this.#sectorSize);
-        const numFatSectors = this.#u32(44);
-        const firstDirSector = this.#u32(48);
-        this.#miniCutoff = this.#u32(56);
-        const firstMiniFatSector = this.#u32(60);
-        const firstDifatSector = this.#u32(68);
-        const numDifatSectors = this.#u32(72);
+        const numFatSectors = readU32(this.#buf, 44);
+        const firstDirSector = readU32(this.#buf, 48);
+        this.#miniCutoff = readU32(this.#buf, 56);
+        const firstMiniFatSector = readU32(this.#buf, 60);
+        const firstDifatSector = readU32(this.#buf, 68);
+        const numDifatSectors = readU32(this.#buf, 72);
         const fatSectorIds = this.#readDifat(numFatSectors, firstDifatSector, numDifatSectors);
         this.#fat = this.#readFat(fatSectorIds);
         this.#miniFat = this.#readChainValues(firstMiniFatSector);
@@ -103,7 +102,7 @@ export class CompoundFile {
     #readDifat(numFatSectors, firstDifat, numDifat) {
         const ids = [];
         for (let i = 0; i < 109 && ids.length < numFatSectors; i++) {
-            const v = this.#u32(76 + i * 4);
+            const v = readU32(this.#buf, 76 + i * 4);
             if (v >= MAX_REGULAR_SECTOR)
                 break;
             ids.push(v);
@@ -117,11 +116,11 @@ export class CompoundFile {
             seen.add(sector);
             const base = this.#dataSectorOffset(sector);
             for (let i = 0; i < perSector; i++) {
-                const v = this.#u32(base + i * 4);
+                const v = readU32(this.#buf, base + i * 4);
                 if (v < MAX_REGULAR_SECTOR)
                     ids.push(v);
             }
-            sector = this.#u32(base + perSector * 4);
+            sector = readU32(this.#buf, base + perSector * 4);
         }
         return ids;
     }
@@ -131,7 +130,7 @@ export class CompoundFile {
         for (const sid of fatSectorIds) {
             const base = this.#dataSectorOffset(sid);
             for (let i = 0; i < perSector; i++)
-                fat.push(this.#u32(base + i * 4));
+                fat.push(readU32(this.#buf, base + i * 4));
         }
         return fat;
     }
@@ -146,7 +145,7 @@ export class CompoundFile {
             seen.add(sector);
             const base = this.#dataSectorOffset(sector);
             for (let i = 0; i < perSector; i++)
-                values.push(this.#u32(base + i * 4));
+                values.push(readU32(this.#buf, base + i * 4));
             sector = this.#nextInFat(sector);
         }
         return values;
@@ -256,39 +255,4 @@ export class CompoundFile {
         }
         return base;
     }
-    #u16(at) {
-        return this.#view.getUint16(at, true);
-    }
-    #u32(at) {
-        return this.#view.getUint32(at, true);
-    }
-}
-function readU16(buf, at) {
-    return buf[at] | (buf[at + 1] << 8);
-}
-function readU32(buf, at) {
-    return ((buf[at] |
-        (buf[at + 1] << 8) |
-        (buf[at + 2] << 16) |
-        (buf[at + 3] << 24)) >>>
-        0);
-}
-function decodeUtf16le(bytes) {
-    let s = '';
-    for (let i = 0; i + 1 < bytes.length; i += 2) {
-        s += String.fromCharCode(bytes[i] | (bytes[i + 1] << 8));
-    }
-    return s;
-}
-function concat(chunks) {
-    let total = 0;
-    for (const c of chunks)
-        total += c.length;
-    const out = new Uint8Array(total);
-    let off = 0;
-    for (const c of chunks) {
-        out.set(c, off);
-        off += c.length;
-    }
-    return out;
 }

package/dist/vba/codepage.d.ts

@@ -3,7 +3,7 @@ export type Decoder = InstanceType<typeof TextDecoder>;
 export type Encoder = (text: string) => Uint8Array;
 /**
  * A `TextDecoder` for the given VBA project code page. Non-fatal (malformed bytes become U+FFFD rather
- * than throwing) because recovered source is for reading, not re-encoding — a stray byte must not sink
+ * than throwing) because recovered source is for reading, not re-encoding: a stray byte must not sink
  * the whole extraction. An unknown code page falls back to windows-1252.
  */
 export declare function decoderForCodePage(codePage: number): Decoder;
@@ -12,7 +12,7 @@ export declare function decoderForCodePage(codePage: number): Decoder;
  * decoding every byte 0x00..0xFF through the matching decoder and inverting the map. This is exact for
  * the single-byte code pages a VBA project realistically declares. Under a multi-byte code page (Shift
  * JIS, GBK, …) the high bytes are lead bytes, not standalone characters, so only ASCII inverts and any
- * non-ASCII character is rejected — fail-closed rather than emit a corrupt byte. A character the chosen
+ * non-ASCII character is rejected, failing closed rather than emitting a corrupt byte. A character the chosen
  * code page cannot represent throws {@link VbaAuthorError}.
  */
 export declare function encoderForCodePage(codePage: number): Encoder;