@shbernal/ts-xlsx 3.0.0 → 3.2.0

package/dist/vba/dir-records.d.ts

@@ -51,3 +51,9 @@ export interface DirRecord {
  * @throws {VbaParseError} when a record's payload runs past the end of the stream.
  */
 export declare function dirRecords(dir: Uint8Array, context: string): Generator<DirRecord>;
+/**
+ * One record's bytes, `Id(u16) Size(u32) data[Size]`: the grammar {@link dirRecords} walks, written.
+ * Built as bytes rather than spread into a `number[]`, which overflowed the call stack on a payload of a
+ * few hundred thousand bytes. Not for PROJECTVERSION, whose uncounted VersionMinor no edit here writes.
+ */
+export declare function dirRecord(id: number, data: Uint8Array): Uint8Array;

package/dist/vba/dir-records.js

@@ -1,4 +1,5 @@
-import { readU16, readU32 } from './bytes.js';
+import { hex } from '../hex.js';
+import { readU16, readU32, writeU16, writeU32 } from './bytes.js';
 import { VbaParseError } from './errors.js';
 export const REC_PROJECT_CODEPAGE = 0x0003;
 export const REC_PROJECT_VERSION = 0x0009;
@@ -19,10 +20,17 @@ export function* dirRecords(dir, context) {
         const size = readU32(dir, pos + 2);
         const dataStart = pos + 6;
         if (dataStart + size > dir.length) {
-            throw new VbaParseError(`dir record 0x${id.toString(16)} ${context}`);
+            throw new VbaParseError(`dir record 0x${hex(id, 4)} ${context}`);
         }
         const end = dataStart + size + (id === REC_PROJECT_VERSION ? 2 : 0);
         yield { id, recordStart: pos, dataStart, size, end };
         pos = end;
     }
 }
+export function dirRecord(id, data) {
+    const out = new Uint8Array(6 + data.length);
+    writeU16(out, 0, id);
+    writeU32(out, 2, data.length);
+    out.set(data, 6);
+    return out;
+}

package/dist/vba/errors.d.ts

@@ -12,11 +12,18 @@ export declare class VbaParseError extends XlsxError {
     readonly code = "malformed-input";
 }
 /**
- * Thrown when authoring a VBA project (synthesizing a `vbaProject.bin` from module source) is asked to
- * produce something that cannot be encoded to a well-formed container: a stream name longer than the
- * [MS-CFB] 31-character limit, a duplicate stream name, or a project so large it would exceed the
- * writer's single-header DIFAT bound. This is a caller-side contract violation, distinct from
+ * Thrown when a structural edit of a VBA project (removing a module, adding a library reference) is
+ * asked to produce something that cannot be encoded to a well-formed container: a stream name longer
+ * than the [MS-CFB] 31-character limit, a duplicate stream name, or a project so large it would exceed
+ * the writer's single-header DIFAT bound. This is a caller-side contract violation, distinct from
  * {@link VbaParseError} (which reports a malformed blob *read* from an untrusted file).
+ *
+ * It shares `code: 'authoring'` with `AuthoringError` rather than being one, and it is the only
+ * subsystem in the tree that got its own authoring class. The reason is symmetry with
+ * {@link VbaParseError} and not the VBA subsystem's importance: a caller who catches the parse error
+ * to skip a macro project it cannot read is the same caller who catches the author error to skip one
+ * it cannot write, and the two halves of that pair have to be nameable the same way. A CSV or table
+ * authoring failure has no read-side twin to pair with, which is why those stay `AuthoringError`.
  */
 export declare class VbaAuthorError extends XlsxError {
     readonly name = "VbaAuthorError";

package/dist/vba/index.d.ts

@@ -1,5 +1,3 @@
-export { type CfbNode, type CfbStorage, type CfbStream, writeCompoundFile } from './cfb-writer.ts';
 export { VbaAuthorError, VbaParseError } from './errors.ts';
-export { compressContainer, decompressContainer } from './ms-ovba.ts';
 export { parseVbaProject, VBA_PROJECT_CONTENT_TYPE, VBA_PROJECT_PART_PATH, VBA_PROJECT_REL_TYPE, type VbaModule, type VbaModuleKind, type VbaProject, type VbaProjectSignature, type VbaProjectSignatureKind, vbaProjectSignatureKind, } from './project.ts';
 export { addVbaReference, removeVbaModule, type VbaLibraryReference } from './project-editor.ts';

package/dist/vba/index.js

@@ -1,5 +1,3 @@
-export { writeCompoundFile } from './cfb-writer.js';
 export { VbaAuthorError, VbaParseError } from './errors.js';
-export { compressContainer, decompressContainer } from './ms-ovba.js';
 export { parseVbaProject, VBA_PROJECT_CONTENT_TYPE, VBA_PROJECT_PART_PATH, VBA_PROJECT_REL_TYPE, vbaProjectSignatureKind, } from './project.js';
 export { addVbaReference, removeVbaModule } from './project-editor.js';

package/dist/vba/ms-ovba.d.ts

@@ -6,7 +6,11 @@ export declare function decompressContainer(buf: Uint8Array, start?: number, max
 /**
  * Compress `data` into an MS-OVBA CompressedContainer: the inverse of {@link decompressContainer}.
  * Every 4096-decompressed-byte window is emitted as a compressed chunk of literal and copy tokens, or
- * stored verbatim when compression would not shrink it (so the encoded chunk never exceeds the 12-bit
- * size field). The result re-expands to `data` byte-for-byte.
+ * stored raw when those tokens would not fit the 4096 bytes a chunk's data may hold.
+ *
+ * The result re-expands to `data` byte-for-byte, with one exception the format itself prescribes: a
+ * final window that is shorter than 4096 bytes and does not compress (only possible past about 3640
+ * bytes, where a literal's flag-bit overhead first overflows the chunk) is stored raw and padded with
+ * `0x00` to 4096, so it re-expands with those zeros after it ([MS-OVBA] 2.4.1.3.10).
  */
 export declare function compressContainer(data: Uint8Array): Uint8Array;

package/dist/vba/ms-ovba.js

@@ -1,25 +1,30 @@
+import { hex } from '../hex.js';
 import { readU16 } from './bytes.js';
 import { VbaParseError } from './errors.js';
 const MAX_CHUNK_DECOMPRESSED = 4096;
 const CHUNK_SIGNATURE = 0b011 << 12;
+const CHUNK_SIGNATURE_MASK = 0b111 << 12;
 const CHUNK_COMPRESSED_FLAG = 0x8000;
+const MAX_MATCH_CANDIDATES = 64;
+const HASH_BITS = 12;
+const NO_CANDIDATE = -1;
 const DEFAULT_MAX_OUTPUT = 64 * 1024 * 1024;
 export function decompressContainer(buf, start = 0, maxOutput = DEFAULT_MAX_OUTPUT) {
     if (start >= buf.length) {
         throw new VbaParseError(`compressed container starts past end of stream (${start} >= ${buf.length})`);
     }
     if (buf[start] !== 0x01) {
-        throw new VbaParseError(`compressed container must begin with a 0x01 signature byte, found 0x${(buf[start] ?? 0).toString(16)}`);
+        throw new VbaParseError(`compressed container must begin with a 0x01 signature byte, found 0x${hex(buf[start] ?? 0, 2)}`);
     }
-    const out = new DecompressedBytes(maxOutput);
+    const out = new ByteSink(maxOutput);
     let pos = start + 1;
     while (pos + 2 <= buf.length) {
         const header = readU16(buf, pos);
         pos += 2;
         const chunkDataSize = (header & 0x0fff) + 1;
-        const compressed = (header & 0x8000) !== 0;
-        if (((header >> 12) & 0x7) !== 0b011) {
-            throw new VbaParseError(`chunk header has a bad 0b011 signature (0x${header.toString(16)})`);
+        const compressed = (header & CHUNK_COMPRESSED_FLAG) !== 0;
+        if ((header & CHUNK_SIGNATURE_MASK) !== CHUNK_SIGNATURE) {
+            throw new VbaParseError(`chunk header has a bad 0b011 signature (0x${hex(header, 4)})`);
         }
         const chunkEnd = pos + chunkDataSize;
         if (chunkEnd > buf.length) {
@@ -55,16 +60,19 @@ export function decompressContainer(buf, start = 0, maxOutput = DEFAULT_MAX_OUTP
                 for (let i = 0; i < length; i++)
                     out.push(out.at(src + i));
             }
+            if (out.length - chunkStart > MAX_CHUNK_DECOMPRESSED) {
+                throw new VbaParseError(`chunk decompressed to more than ${MAX_CHUNK_DECOMPRESSED} bytes, which [MS-OVBA] forbids`);
+            }
         }
         pos = chunkEnd;
     }
     return out.bytes();
 }
-class DecompressedBytes {
+class ByteSink {
     #buf;
     #length = 0;
     #limit;
-    constructor(limit) {
+    constructor(limit = Infinity) {
         this.#limit = limit;
         this.#buf = new Uint8Array(Math.min(MAX_CHUNK_DECOMPRESSED, limit));
     }
@@ -74,6 +82,9 @@ class DecompressedBytes {
     at(index) {
         return this.#buf[index];
     }
+    set(index, byte) {
+        this.#buf[index] = byte;
+    }
     push(byte) {
         if (this.#length >= this.#limit) {
             throw new VbaParseError(`decompressed output exceeds the ${this.#limit}-byte ceiling (possible bomb)`);
@@ -85,26 +96,47 @@ class DecompressedBytes {
         }
         this.#buf[this.#length++] = byte;
     }
+    pushAll(bytes) {
+        for (const byte of bytes)
+            this.push(byte);
+    }
     bytes() {
         return this.#buf.slice(0, this.#length);
     }
 }
 export function compressContainer(data) {
-    const out = [0x01];
+    const out = new ByteSink();
+    out.push(0x01);
     for (let start = 0; start < data.length; start += MAX_CHUNK_DECOMPRESSED) {
         const chunk = data.subarray(start, Math.min(start + MAX_CHUNK_DECOMPRESSED, data.length));
         const tokens = compressChunk(chunk);
-        const compressed = tokens.length < chunk.length;
-        const body = compressed ? tokens : chunk;
+        const compressed = tokens.length <= MAX_CHUNK_DECOMPRESSED;
+        const body = compressed ? tokens : padToChunk(chunk);
         const header = (compressed ? CHUNK_COMPRESSED_FLAG : 0) | CHUNK_SIGNATURE | ((body.length - 1) & 0x0fff);
-        out.push(header & 0xff, (header >> 8) & 0xff);
-        for (const b of body)
-            out.push(b);
+        out.push(header & 0xff);
+        out.push((header >> 8) & 0xff);
+        out.pushAll(body);
     }
-    return Uint8Array.from(out);
+    return out.bytes();
+}
+function padToChunk(chunk) {
+    if (chunk.length === MAX_CHUNK_DECOMPRESSED)
+        return chunk;
+    const padded = new Uint8Array(MAX_CHUNK_DECOMPRESSED);
+    padded.set(chunk);
+    return padded;
 }
 function compressChunk(chunk) {
-    const tokens = [];
+    const tokens = new ByteSink();
+    const heads = new Int32Array(1 << HASH_BITS).fill(NO_CANDIDATE);
+    const prev = new Int32Array(MAX_CHUNK_DECOMPRESSED).fill(NO_CANDIDATE);
+    const remember = (at) => {
+        if (at + 2 >= chunk.length)
+            return;
+        const bucket = hash3(chunk, at);
+        prev[at] = heads[bucket];
+        heads[bucket] = at;
+    };
     let pos = 0;
     while (pos < chunk.length) {
         const flagIndex = tokens.length;
@@ -116,37 +148,49 @@ function compressChunk(chunk) {
             const windowStart = Math.max(0, pos - (1 << bitCount));
             let bestLength = 0;
             let bestOffset = 0;
-            for (let cand = pos - 1; cand >= windowStart; cand--) {
+            let candidate = pos + 2 < chunk.length ? heads[hash3(chunk, pos)] : NO_CANDIDATE;
+            for (let tried = 0; candidate >= windowStart && tried < MAX_MATCH_CANDIDATES; tried++) {
                 let len = 0;
                 while (len < maxLength &&
                     pos + len < chunk.length &&
-                    chunk[cand + len] === chunk[pos + len]) {
+                    chunk[candidate + len] === chunk[pos + len]) {
                     len++;
                 }
                 if (len > bestLength) {
                     bestLength = len;
-                    bestOffset = pos - cand;
+                    bestOffset = pos - candidate;
                     if (bestLength === maxLength)
                         break;
                 }
+                candidate = prev[candidate];
             }
             if (bestLength >= 3) {
                 const token = ((bestOffset - 1) << (16 - bitCount)) | (bestLength - 3);
-                tokens.push(token & 0xff, (token >> 8) & 0xff);
+                tokens.push(token & 0xff);
+                tokens.push((token >> 8) & 0xff);
                 flags |= 1 << bit;
+                for (let i = 0; i < bestLength; i++)
+                    remember(pos + i);
                 pos += bestLength;
             }
             else {
                 tokens.push(chunk[pos]);
+                remember(pos);
                 pos++;
             }
         }
-        tokens[flagIndex] = flags;
+        tokens.set(flagIndex, flags);
     }
-    return tokens;
+    return tokens.bytes();
+}
+function hash3(chunk, pos) {
+    const first = chunk[pos];
+    const second = chunk[pos + 1];
+    const third = chunk[pos + 2];
+    return ((first << 8) ^ (second << 4) ^ third) & ((1 << HASH_BITS) - 1);
 }
 function copyTokenHelp(decompressedSoFar) {
-    const bitCount = Math.max(Math.ceil(Math.log2(Math.max(decompressedSoFar, 1))), 4);
+    const bitCount = Math.min(Math.max(Math.ceil(Math.log2(Math.max(decompressedSoFar, 1))), 4), Math.log2(MAX_CHUNK_DECOMPRESSED));
     const lengthMask = 0xffff >> bitCount;
     return { lengthMask, bitCount };
 }

package/dist/vba/project-editor.js

@@ -1,62 +1,63 @@
-import { readU16 } from './bytes.js';
-import { writeCompoundFile } from './cfb-writer.js';
+import { utf16leBytes } from '../bytes.js';
+import { InternalError, quoted } from '../errors.js';
+import { hex } from '../hex.js';
+import { concat, readU16, spliceBytes, writeU16, writeU32 } from './bytes.js';
+import { sameEntryName } from './cfb-format.js';
+import { isStream, writeCompoundFile } from './cfb-writer.js';
 import { CompoundFile } from './cfb.js';
 import { decoderForCodePage, encoderForCodePage } from './codepage.js';
-import { dirRecords, REC_MODULE_NAME, REC_MODULE_STREAMNAME, REC_MODULE_TERMINATOR, REC_MODULES_COUNT, REC_REFERENCE_NAME, REC_REFERENCE_NAME_UNICODE, REC_REFERENCE_REGISTERED, } from './dir-records.js';
+import { dirRecord, dirRecords, REC_MODULE_NAME, REC_MODULE_STREAMNAME, REC_MODULE_TERMINATOR, REC_MODULES_COUNT, REC_REFERENCE_NAME, REC_REFERENCE_NAME_UNICODE, REC_REFERENCE_REGISTERED, } from './dir-records.js';
 import { VbaAuthorError, VbaParseError } from './errors.js';
 import { compressContainer, decompressContainer } from './ms-ovba.js';
-import { parseVbaProject } from './project.js';
-import { push, u16, u32, utf16le, validateVbaName } from './vba-encoding.js';
-const DIR_STREAM = 'dir';
-const PROJECT_STREAM = 'PROJECT';
-const PROJECTWM_STREAM = 'PROJECTwm';
-const VBA_STORAGE = 'VBA';
+import { DIR_PATH, parseVbaProjectIn, PROJECT_PATH, PROJECTWM_PATH, VBA_STORAGE } from './project.js';
+import { validateReferenceName } from './vba-encoding.js';
 export function removeVbaModule(bin, name) {
-    const project = parseVbaProject(bin);
+    const cfb = new CompoundFile(bin);
+    const project = parseVbaProjectIn(cfb);
     const nameKey = name.toUpperCase();
     const module = project.modules.find((m) => m.name.toUpperCase() === nameKey);
     if (!module)
-        throw new VbaAuthorError(`module '${name}' is not in the VBA project`);
+        throw new VbaAuthorError(`module ${quoted(name)} is not in the VBA project`);
     if (module.kind !== 'procedural' && module.kind !== 'class') {
-        throw new VbaAuthorError(`cannot remove module '${name}': its kind '${module.kind}' is tied to host linkage this ` +
+        throw new VbaAuthorError(`cannot remove module ${quoted(name)}: its kind ${quoted(module.kind)} is tied to host linkage this ` +
             'primitive cannot verify');
     }
-    const cfb = new CompoundFile(bin);
-    const dirCompressed = cfb.readStream(DIR_STREAM);
+    const decoder = decoderForCodePage(project.codePage);
+    const dirCompressed = cfb.readStream(DIR_PATH);
     if (!dirCompressed)
         throw new VbaParseError("VBA project has no 'dir' stream");
-    const patchedDir = removeModuleDirRecord(decompressContainer(dirCompressed), module.streamName, project.codePage);
-    const replacements = new Map([[DIR_STREAM, compressContainer(patchedDir)]]);
-    const decoder = decoderForCodePage(project.codePage);
-    const encode = encoderForCodePage(project.codePage);
-    const projectText = cfb.readStream(PROJECT_STREAM);
+    const patchedDir = removeModuleDirRecord(decompressContainer(dirCompressed), module.streamName, decoder);
+    const replacements = [{ path: DIR_PATH, data: compressContainer(patchedDir) }];
+    const projectText = cfb.readStream(PROJECT_PATH);
     if (projectText) {
-        replacements.set(PROJECT_STREAM, encode(removeProjectStreamLines(decoder.decode(projectText), module.name, module.kind)));
+        replacements.push({
+            path: PROJECT_PATH,
+            data: removeProjectStreamLines(projectText, module.name, module.kind, decoder),
+        });
     }
-    const projectwm = cfb.readStream(PROJECTWM_STREAM);
+    const projectwm = cfb.readStream(PROJECTWM_PATH);
     if (projectwm) {
-        replacements.set(PROJECTWM_STREAM, removeProjectwmRecord(projectwm, project.modules.length, module.name, decoder));
-    }
-    const applied = new Set();
-    const withReplacements = replaceStreams(cfb.tree(), replacements, applied);
-    if (!applied.has(DIR_STREAM))
-        throw new VbaParseError("VBA project 'dir' stream is not in the container tree");
-    const removed = new Set();
-    const newTree = removeFromStorage(withReplacements, VBA_STORAGE, module.streamName, removed);
-    if (!removed.has(VBA_STORAGE)) {
-        throw new VbaParseError(`module stream '${module.streamName}' is not in the '${VBA_STORAGE}' storage`);
+        replacements.push({
+            path: PROJECTWM_PATH,
+            data: removeProjectwmRecord(projectwm, project.modules.length, module.name, decoder),
+        });
     }
+    const newTree = withoutStream(replaceStreams(cfb.tree(), replacements), [
+        VBA_STORAGE,
+        module.streamName,
+    ]);
     return writeCompoundFile(newTree);
 }
 const MAX_LIBID_VERSION = 0xffff;
 const MAX_LIBID_LCID = 0xffffffff;
 const MAX_DISPLAY_NAME_CHARS = 255;
+const MAX_LIBID_PATH_CHARS = 32_767;
 const GUID_PATTERN = /^\{?([0-9A-Fa-f]{8})-([0-9A-Fa-f]{4})-([0-9A-Fa-f]{4})-([0-9A-Fa-f]{4})-([0-9A-Fa-f]{12})\}?$/;
 function normalizeReference(ref) {
-    validateVbaName(ref.name, 'reference');
+    validateReferenceName(ref.name);
     const guidMatch = GUID_PATTERN.exec(ref.guid.trim());
     if (!guidMatch)
-        throw new VbaAuthorError(`invalid reference GUID '${ref.guid}'`);
+        throw new VbaAuthorError(`invalid reference GUID ${quoted(ref.guid)}`);
     const guid = `{${guidMatch.slice(1, 6).join('-').toUpperCase()}}`;
     for (const [field, value] of [
         ['majorVersion', ref.majorVersion],
@@ -70,50 +71,43 @@ function normalizeReference(ref) {
     if (!Number.isInteger(lcid) || lcid < 0 || lcid > MAX_LIBID_LCID) {
         throw new VbaAuthorError(`reference lcid must be an integer in [0, 0xFFFFFFFF], got ${lcid}`);
     }
+    if (ref.path.length > MAX_LIBID_PATH_CHARS) {
+        throw new VbaAuthorError(`reference path is ${ref.path.length} characters long, past the ${MAX_LIBID_PATH_CHARS} a Windows path can hold`);
+    }
     if (ref.path.length === 0 || ref.path.includes('\0') || ref.path.includes('#')) {
-        throw new VbaAuthorError(`invalid reference path '${ref.path}' (must be non-empty and contain no NUL or '#')`);
+        throw new VbaAuthorError(`invalid reference path ${quoted(ref.path)} (must be non-empty and contain no NUL or '#')`);
     }
     const displayName = ref.displayName ?? ref.name;
     if (displayName.length === 0 ||
         displayName.length > MAX_DISPLAY_NAME_CHARS ||
         displayName.includes('\0')) {
-        throw new VbaAuthorError(`invalid reference display name '${displayName}'`);
+        throw new VbaAuthorError(`invalid reference display name ${quoted(displayName)}`);
     }
-    const libid = `*\\G${guid}#${ref.majorVersion.toString(16).toUpperCase()}.` +
-        `${ref.minorVersion.toString(16).toUpperCase()}#${lcid.toString(16).toUpperCase()}` +
+    const libid = `*\\G${guid}#${hex(ref.majorVersion, 1)}.${hex(ref.minorVersion, 1)}#${hex(lcid, 1)}` +
         `#${ref.path}#${displayName}`;
     return { name: ref.name, libid };
 }
 export function addVbaReference(bin, ref) {
     const normalized = normalizeReference(ref);
-    const project = parseVbaProject(bin);
-    const encode = encoderForCodePage(project.codePage);
     const cfb = new CompoundFile(bin);
-    const dirCompressed = cfb.readStream(DIR_STREAM);
+    const encode = encoderForCodePage(parseVbaProjectIn(cfb).codePage);
+    const dirCompressed = cfb.readStream(DIR_PATH);
     if (!dirCompressed)
         throw new VbaParseError("VBA project has no 'dir' stream");
     const records = buildReferenceDirRecords(normalized, encode);
     const patchedDir = insertReferenceDirRecords(decompressContainer(dirCompressed), records);
-    const replacements = new Map([[DIR_STREAM, compressContainer(patchedDir)]]);
-    const applied = new Set();
-    const newTree = replaceStreams(cfb.tree(), replacements, applied);
-    if (!applied.has(DIR_STREAM))
-        throw new VbaParseError("VBA project 'dir' stream is not in the container tree");
-    return writeCompoundFile(newTree);
+    return writeCompoundFile(replaceStreams(cfb.tree(), [{ path: DIR_PATH, data: compressContainer(patchedDir) }]));
 }
 function buildReferenceDirRecords(ref, encode) {
-    const r = [];
-    const nameBytes = [...encode(ref.name)];
-    push(r, REC_REFERENCE_NAME, nameBytes);
-    push(r, REC_REFERENCE_NAME_UNICODE, utf16le(ref.name));
-    const libidBytes = [...encode(ref.libid)];
-    push(r, REC_REFERENCE_REGISTERED, [
-        ...u32(libidBytes.length),
-        ...libidBytes,
-        ...u32(0),
-        ...u16(0),
+    const libid = encode(ref.libid);
+    const sizeOfLibid = new Uint8Array(4);
+    writeU32(sizeOfLibid, 0, libid.length);
+    const reserved = new Uint8Array(6);
+    return concat([
+        dirRecord(REC_REFERENCE_NAME, encode(ref.name)),
+        dirRecord(REC_REFERENCE_NAME_UNICODE, utf16leBytes(ref.name)),
+        dirRecord(REC_REFERENCE_REGISTERED, concat([sizeOfLibid, libid, reserved])),
     ]);
-    return r;
 }
 function insertReferenceDirRecords(dir, records) {
     let insertAt = -1;
@@ -125,15 +119,9 @@ function insertReferenceDirRecords(dir, records) {
     }
     if (insertAt < 0)
         throw new VbaParseError('dir stream is missing MODULES_COUNT');
-    const rec = Uint8Array.from(records);
-    const out = new Uint8Array(dir.length + rec.length);
-    out.set(dir.subarray(0, insertAt), 0);
-    out.set(rec, insertAt);
-    out.set(dir.subarray(insertAt), insertAt + rec.length);
-    return out;
+    return spliceBytes(dir, insertAt, insertAt, records);
 }
-function removeModuleDirRecord(dir, streamName, codePage) {
-    const decoder = decoderForCodePage(codePage);
+function removeModuleDirRecord(dir, streamName, decoder) {
     let countAt = -1;
     let blockStart = -1;
     let removeStart = -1;
@@ -143,7 +131,8 @@ function removeModuleDirRecord(dir, streamName, codePage) {
         if (id === REC_MODULES_COUNT) {
             if (size < 2)
                 throw new VbaParseError('PROJECTMODULES MODULES_COUNT record is malformed');
-            countAt = dataStart;
+            if (countAt < 0)
+                countAt = dataStart;
         }
         else if (id === REC_MODULE_NAME) {
             blockStart = recordStart;
@@ -163,36 +152,49 @@ function removeModuleDirRecord(dir, streamName, codePage) {
     if (countAt < 0)
         throw new VbaParseError('dir stream is missing MODULES_COUNT');
     if (removeStart < 0 || removeEnd < 0) {
-        throw new VbaParseError(`module stream '${streamName}' not found in the dir stream`);
-    }
-    const out = new Uint8Array(dir.length - (removeEnd - removeStart));
-    out.set(dir.subarray(0, removeStart), 0);
-    out.set(dir.subarray(removeEnd), removeStart);
-    const newCount = readU16(out, countAt) - 1;
-    out[countAt] = newCount & 0xff;
-    out[countAt + 1] = (newCount >> 8) & 0xff;
+        throw new VbaParseError(`module stream ${quoted(streamName)} not found in the dir stream`);
+    }
+    if (countAt >= removeStart) {
+        throw new VbaParseError('dir stream declares MODULES_COUNT after a module block');
+    }
+    const count = readU16(dir, countAt);
+    if (count === 0) {
+        throw new VbaParseError('dir stream declares zero modules but carries a module block');
+    }
+    const out = spliceBytes(dir, removeStart, removeEnd);
+    writeU16(out, countAt, count - 1);
     return out;
 }
-function removeProjectStreamLines(text, name, kind) {
-    const eol = text.includes('\r\n') ? '\r\n' : '\n';
-    const lines = text.split(/\r\n|\r|\n/);
+function removeProjectStreamLines(stream, name, kind, decoder) {
+    const lines = projectLines(stream, decoder);
     const declLine = `${kind === 'procedural' ? 'Module' : 'Class'}=${name}`;
-    const declIndex = lines.indexOf(declLine);
-    if (declIndex >= 0)
-        lines.splice(declIndex, 1);
-    const wsIndex = lines.findIndex((l) => l.trim() === '[Workspace]');
-    if (wsIndex >= 0) {
-        for (let i = wsIndex + 1; i < lines.length; i++) {
-            const l = lines[i];
-            if (l.trim() === '' || l.startsWith('['))
-                break;
-            if (l.startsWith(`${name}=`)) {
-                lines.splice(i, 1);
-                break;
-            }
+    const removals = [];
+    const decl = lines.find((line) => line.text === declLine);
+    if (decl !== undefined)
+        removals.push(decl);
+    const wsIndex = lines.findIndex((line) => line.text.trim() === '[Workspace]');
+    for (const line of wsIndex < 0 ? [] : lines.slice(wsIndex + 1)) {
+        if (line.text.trim() === '' || line.text.startsWith('['))
+            break;
+        if (line.text.startsWith(`${name}=`)) {
+            removals.push(line);
+            break;
         }
     }
-    return lines.join(eol);
+    return removals
+        .sort((a, b) => b.start - a.start)
+        .reduce((bytes, line) => spliceBytes(bytes, line.start, line.end), stream);
+}
+function projectLines(stream, decoder) {
+    const lines = [];
+    for (let start = 0; start < stream.length;) {
+        const lf = stream.indexOf(0x0a, start);
+        const end = lf < 0 ? stream.length : lf + 1;
+        const contentEnd = lf > start && stream[lf - 1] === 0x0d ? lf - 1 : lf < 0 ? stream.length : lf;
+        lines.push({ text: decoder.decode(stream.subarray(start, contentEnd)), start, end });
+        start = end;
+    }
+    return lines;
 }
 function removeProjectwmRecord(wm, existingModuleCount, name, decoder) {
     let pos = 0;
@@ -218,37 +220,45 @@ function removeProjectwmRecord(wm, existingModuleCount, name, decoder) {
         }
     }
     if (removeStart < 0 || removeEnd < 0) {
-        throw new VbaParseError(`module '${name}' not found in the PROJECTwm stream`);
+        throw new VbaParseError(`module ${quoted(name)} not found in the PROJECTwm stream`);
     }
-    const out = new Uint8Array(wm.length - (removeEnd - removeStart));
-    out.set(wm.subarray(0, removeStart), 0);
-    out.set(wm.subarray(removeEnd), removeStart);
-    return out;
-}
-function removeFromStorage(nodes, storageName, streamName, removed) {
-    return nodes.map((n) => {
-        if ('data' in n)
-            return n;
-        const children = removeFromStorage(n.children, storageName, streamName, removed);
-        if (n.name === storageName && !removed.has(storageName)) {
-            const filtered = children.filter((c) => !('data' in c && c.name === streamName));
-            if (filtered.length !== children.length)
-                removed.add(storageName);
-            return { name: n.name, children: filtered };
-        }
-        return { name: n.name, children };
-    });
+    return spliceBytes(wm, removeStart, removeEnd);
 }
-function replaceStreams(nodes, replacements, applied) {
-    return nodes.map((node) => {
-        if ('data' in node) {
-            const data = replacements.get(node.name);
-            if (data !== undefined) {
-                applied.add(node.name);
-                return { name: node.name, data };
-            }
+function replaceStreams(nodes, replacements) {
+    let applied = 0;
+    const rebuild = (level, pending, depth) => level.map((node) => {
+        const here = pending.filter((replacement) => {
+            const segment = replacement.path[depth];
+            return segment !== undefined && sameEntryName(segment, node.name);
+        });
+        if (here.length === 0)
             return node;
+        if (isStream(node)) {
+            const replacement = here.find((candidate) => candidate.path.length === depth + 1);
+            if (replacement === undefined)
+                return node;
+            applied++;
+            return { name: node.name, data: replacement.data };
         }
-        return { name: node.name, children: replaceStreams(node.children, replacements, applied) };
+        return { name: node.name, children: rebuild(node.children, here, depth + 1) };
     });
+    const rebuilt = rebuild(nodes, replacements, 0);
+    if (applied !== replacements.length) {
+        throw new InternalError('a VBA stream read by its path is missing from the container tree');
+    }
+    return rebuilt;
+}
+function withoutStream(nodes, path) {
+    const [name, ...rest] = path;
+    const index = nodes.findIndex((node) => name !== undefined &&
+        sameEntryName(node.name, name) &&
+        isStream(node) === (rest.length === 0));
+    const target = nodes[index];
+    if (target === undefined) {
+        throw new InternalError('a VBA module stream read by its path is missing from the container tree');
+    }
+    const kept = isStream(target)
+        ? []
+        : [{ name: target.name, children: withoutStream(target.children, rest) }];
+    return [...nodes.slice(0, index), ...kept, ...nodes.slice(index + 1)];
 }

package/dist/vba/project.d.ts

@@ -1,3 +1,4 @@
+import { CompoundFile } from './cfb.ts';
 /** How a module participates in the project: the classification the VBA editor shows. */
 export type VbaModuleKind = 'procedural' | 'document' | 'class' | 'designer';
 export interface VbaModule {
@@ -42,4 +43,17 @@ export interface VbaProjectSignature {
  * carries (`.../office/2006/...` vs `.../2014/...` vs `.../2020/...`).
  */
 export declare function vbaProjectSignatureKind(relType: string): VbaProjectSignatureKind | undefined;
-export declare function parseVbaProject(bin: Uint8Array): VbaProject;
+export declare const VBA_STORAGE = "VBA";
+export declare const DIR_PATH: readonly string[];
+export declare const PROJECT_PATH: readonly string[];
+export declare const PROJECTWM_PATH: readonly string[];
+export declare function parseVbaProject(bin: Uint8Array, maxOutput?: number): VbaProject;
+/**
+ * As {@link parseVbaProject}, over a container the caller has already opened.
+ *
+ * Both project editors parse fail-closed first and then need the container itself, and each was
+ * building a second `CompoundFile` over the same bytes: a second walk of the DIFAT, FAT, mini-FAT,
+ * directory and mini-stream, which is roughly double the cost and double the peak allocation of every
+ * edit. Opening it once and handing it in is the whole of the fix.
+ */
+export declare function parseVbaProjectIn(cfb: CompoundFile, maxOutput?: number): VbaProject;