@shbernal/ts-xlsx 3.1.0 → 3.2.0

package/dist/vba/project-editor.js

@@ -1,17 +1,16 @@
-import { quoted } from '../errors.js';
-import { readU16, spliceBytes, writeU16 } from './bytes.js';
+import { utf16leBytes } from '../bytes.js';
+import { InternalError, quoted } from '../errors.js';
+import { hex } from '../hex.js';
+import { concat, readU16, spliceBytes, writeU16, writeU32 } from './bytes.js';
+import { sameEntryName } from './cfb-format.js';
 import { isStream, writeCompoundFile } from './cfb-writer.js';
 import { CompoundFile } from './cfb.js';
 import { decoderForCodePage, encoderForCodePage } from './codepage.js';
-import { dirRecords, REC_MODULE_NAME, REC_MODULE_STREAMNAME, REC_MODULE_TERMINATOR, REC_MODULES_COUNT, REC_REFERENCE_NAME, REC_REFERENCE_NAME_UNICODE, REC_REFERENCE_REGISTERED, } from './dir-records.js';
+import { dirRecord, dirRecords, REC_MODULE_NAME, REC_MODULE_STREAMNAME, REC_MODULE_TERMINATOR, REC_MODULES_COUNT, REC_REFERENCE_NAME, REC_REFERENCE_NAME_UNICODE, REC_REFERENCE_REGISTERED, } from './dir-records.js';
 import { VbaAuthorError, VbaParseError } from './errors.js';
 import { compressContainer, decompressContainer } from './ms-ovba.js';
-import { parseVbaProjectIn } from './project.js';
-import { push, u16, u32, utf16le, validateVbaName } from './vba-encoding.js';
-const DIR_STREAM = 'dir';
-const PROJECT_STREAM = 'PROJECT';
-const PROJECTWM_STREAM = 'PROJECTwm';
-const VBA_STORAGE = 'VBA';
+import { DIR_PATH, parseVbaProjectIn, PROJECT_PATH, PROJECTWM_PATH, VBA_STORAGE } from './project.js';
+import { validateReferenceName } from './vba-encoding.js';
 export function removeVbaModule(bin, name) {
     const cfb = new CompoundFile(bin);
     const project = parseVbaProjectIn(cfb);
@@ -24,37 +23,38 @@ export function removeVbaModule(bin, name) {
             'primitive cannot verify');
     }
     const decoder = decoderForCodePage(project.codePage);
-    const dirCompressed = cfb.readStream(DIR_STREAM);
+    const dirCompressed = cfb.readStream(DIR_PATH);
     if (!dirCompressed)
         throw new VbaParseError("VBA project has no 'dir' stream");
     const patchedDir = removeModuleDirRecord(decompressContainer(dirCompressed), module.streamName, decoder);
-    const replacements = new Map([[DIR_STREAM, compressContainer(patchedDir)]]);
-    const encode = encoderForCodePage(project.codePage);
-    const projectText = cfb.readStream(PROJECT_STREAM);
+    const replacements = [{ path: DIR_PATH, data: compressContainer(patchedDir) }];
+    const projectText = cfb.readStream(PROJECT_PATH);
     if (projectText) {
-        replacements.set(PROJECT_STREAM, encode(removeProjectStreamLines(decoder.decode(projectText), module.name, module.kind)));
+        replacements.push({
+            path: PROJECT_PATH,
+            data: removeProjectStreamLines(projectText, module.name, module.kind, decoder),
+        });
     }
-    const projectwm = cfb.readStream(PROJECTWM_STREAM);
+    const projectwm = cfb.readStream(PROJECTWM_PATH);
     if (projectwm) {
-        replacements.set(PROJECTWM_STREAM, removeProjectwmRecord(projectwm, project.modules.length, module.name, decoder));
-    }
-    const applied = new Set();
-    const withReplacements = replaceStreams(cfb.tree(), replacements, applied);
-    if (!applied.has(DIR_STREAM))
-        throw new VbaParseError("VBA project 'dir' stream is not in the container tree");
-    const removed = new Set();
-    const newTree = removeFromStorage(withReplacements, VBA_STORAGE, module.streamName, removed);
-    if (!removed.has(VBA_STORAGE)) {
-        throw new VbaParseError(`module stream ${quoted(module.streamName)} is not in the ${quoted(VBA_STORAGE)} storage`);
+        replacements.push({
+            path: PROJECTWM_PATH,
+            data: removeProjectwmRecord(projectwm, project.modules.length, module.name, decoder),
+        });
     }
+    const newTree = withoutStream(replaceStreams(cfb.tree(), replacements), [
+        VBA_STORAGE,
+        module.streamName,
+    ]);
     return writeCompoundFile(newTree);
 }
 const MAX_LIBID_VERSION = 0xffff;
 const MAX_LIBID_LCID = 0xffffffff;
 const MAX_DISPLAY_NAME_CHARS = 255;
+const MAX_LIBID_PATH_CHARS = 32_767;
 const GUID_PATTERN = /^\{?([0-9A-Fa-f]{8})-([0-9A-Fa-f]{4})-([0-9A-Fa-f]{4})-([0-9A-Fa-f]{4})-([0-9A-Fa-f]{12})\}?$/;
 function normalizeReference(ref) {
-    validateVbaName(ref.name, 'reference');
+    validateReferenceName(ref.name);
     const guidMatch = GUID_PATTERN.exec(ref.guid.trim());
     if (!guidMatch)
         throw new VbaAuthorError(`invalid reference GUID ${quoted(ref.guid)}`);
@@ -71,6 +71,9 @@ function normalizeReference(ref) {
     if (!Number.isInteger(lcid) || lcid < 0 || lcid > MAX_LIBID_LCID) {
         throw new VbaAuthorError(`reference lcid must be an integer in [0, 0xFFFFFFFF], got ${lcid}`);
     }
+    if (ref.path.length > MAX_LIBID_PATH_CHARS) {
+        throw new VbaAuthorError(`reference path is ${ref.path.length} characters long, past the ${MAX_LIBID_PATH_CHARS} a Windows path can hold`);
+    }
     if (ref.path.length === 0 || ref.path.includes('\0') || ref.path.includes('#')) {
         throw new VbaAuthorError(`invalid reference path ${quoted(ref.path)} (must be non-empty and contain no NUL or '#')`);
     }
@@ -80,8 +83,7 @@ function normalizeReference(ref) {
         displayName.includes('\0')) {
         throw new VbaAuthorError(`invalid reference display name ${quoted(displayName)}`);
     }
-    const libid = `*\\G${guid}#${ref.majorVersion.toString(16).toUpperCase()}.` +
-        `${ref.minorVersion.toString(16).toUpperCase()}#${lcid.toString(16).toUpperCase()}` +
+    const libid = `*\\G${guid}#${hex(ref.majorVersion, 1)}.${hex(ref.minorVersion, 1)}#${hex(lcid, 1)}` +
         `#${ref.path}#${displayName}`;
     return { name: ref.name, libid };
 }
@@ -89,31 +91,23 @@ export function addVbaReference(bin, ref) {
     const normalized = normalizeReference(ref);
     const cfb = new CompoundFile(bin);
     const encode = encoderForCodePage(parseVbaProjectIn(cfb).codePage);
-    const dirCompressed = cfb.readStream(DIR_STREAM);
+    const dirCompressed = cfb.readStream(DIR_PATH);
     if (!dirCompressed)
         throw new VbaParseError("VBA project has no 'dir' stream");
     const records = buildReferenceDirRecords(normalized, encode);
     const patchedDir = insertReferenceDirRecords(decompressContainer(dirCompressed), records);
-    const replacements = new Map([[DIR_STREAM, compressContainer(patchedDir)]]);
-    const applied = new Set();
-    const newTree = replaceStreams(cfb.tree(), replacements, applied);
-    if (!applied.has(DIR_STREAM))
-        throw new VbaParseError("VBA project 'dir' stream is not in the container tree");
-    return writeCompoundFile(newTree);
+    return writeCompoundFile(replaceStreams(cfb.tree(), [{ path: DIR_PATH, data: compressContainer(patchedDir) }]));
 }
 function buildReferenceDirRecords(ref, encode) {
-    const r = [];
-    const nameBytes = [...encode(ref.name)];
-    push(r, REC_REFERENCE_NAME, nameBytes);
-    push(r, REC_REFERENCE_NAME_UNICODE, utf16le(ref.name));
-    const libidBytes = [...encode(ref.libid)];
-    push(r, REC_REFERENCE_REGISTERED, [
-        ...u32(libidBytes.length),
-        ...libidBytes,
-        ...u32(0),
-        ...u16(0),
+    const libid = encode(ref.libid);
+    const sizeOfLibid = new Uint8Array(4);
+    writeU32(sizeOfLibid, 0, libid.length);
+    const reserved = new Uint8Array(6);
+    return concat([
+        dirRecord(REC_REFERENCE_NAME, encode(ref.name)),
+        dirRecord(REC_REFERENCE_NAME_UNICODE, utf16leBytes(ref.name)),
+        dirRecord(REC_REFERENCE_REGISTERED, concat([sizeOfLibid, libid, reserved])),
     ]);
-    return r;
 }
 function insertReferenceDirRecords(dir, records) {
     let insertAt = -1;
@@ -125,7 +119,7 @@ function insertReferenceDirRecords(dir, records) {
     }
     if (insertAt < 0)
         throw new VbaParseError('dir stream is missing MODULES_COUNT');
-    return spliceBytes(dir, insertAt, insertAt, Uint8Array.from(records));
+    return spliceBytes(dir, insertAt, insertAt, records);
 }
 function removeModuleDirRecord(dir, streamName, decoder) {
     let countAt = -1;
@@ -171,26 +165,36 @@ function removeModuleDirRecord(dir, streamName, decoder) {
     writeU16(out, countAt, count - 1);
     return out;
 }
-function removeProjectStreamLines(text, name, kind) {
-    const eol = text.includes('\r\n') ? '\r\n' : '\n';
-    const lines = text.split(/\r\n|\r|\n/);
+function removeProjectStreamLines(stream, name, kind, decoder) {
+    const lines = projectLines(stream, decoder);
     const declLine = `${kind === 'procedural' ? 'Module' : 'Class'}=${name}`;
-    const declIndex = lines.indexOf(declLine);
-    if (declIndex >= 0)
-        lines.splice(declIndex, 1);
-    const wsIndex = lines.findIndex((l) => l.trim() === '[Workspace]');
-    if (wsIndex >= 0) {
-        for (let i = wsIndex + 1; i < lines.length; i++) {
-            const l = lines[i];
-            if (l.trim() === '' || l.startsWith('['))
-                break;
-            if (l.startsWith(`${name}=`)) {
-                lines.splice(i, 1);
-                break;
-            }
+    const removals = [];
+    const decl = lines.find((line) => line.text === declLine);
+    if (decl !== undefined)
+        removals.push(decl);
+    const wsIndex = lines.findIndex((line) => line.text.trim() === '[Workspace]');
+    for (const line of wsIndex < 0 ? [] : lines.slice(wsIndex + 1)) {
+        if (line.text.trim() === '' || line.text.startsWith('['))
+            break;
+        if (line.text.startsWith(`${name}=`)) {
+            removals.push(line);
+            break;
         }
     }
-    return lines.join(eol);
+    return removals
+        .sort((a, b) => b.start - a.start)
+        .reduce((bytes, line) => spliceBytes(bytes, line.start, line.end), stream);
+}
+function projectLines(stream, decoder) {
+    const lines = [];
+    for (let start = 0; start < stream.length;) {
+        const lf = stream.indexOf(0x0a, start);
+        const end = lf < 0 ? stream.length : lf + 1;
+        const contentEnd = lf > start && stream[lf - 1] === 0x0d ? lf - 1 : lf < 0 ? stream.length : lf;
+        lines.push({ text: decoder.decode(stream.subarray(start, contentEnd)), start, end });
+        start = end;
+    }
+    return lines;
 }
 function removeProjectwmRecord(wm, existingModuleCount, name, decoder) {
     let pos = 0;
@@ -220,30 +224,41 @@ function removeProjectwmRecord(wm, existingModuleCount, name, decoder) {
     }
     return spliceBytes(wm, removeStart, removeEnd);
 }
-function removeFromStorage(nodes, storageName, streamName, removed) {
-    return nodes.map((n) => {
-        if (isStream(n))
-            return n;
-        const children = removeFromStorage(n.children, storageName, streamName, removed);
-        if (n.name === storageName && !removed.has(storageName)) {
-            const filtered = children.filter((c) => !(isStream(c) && c.name === streamName));
-            if (filtered.length !== children.length)
-                removed.add(storageName);
-            return { name: n.name, children: filtered };
-        }
-        return { name: n.name, children };
-    });
-}
-function replaceStreams(nodes, replacements, applied) {
-    return nodes.map((node) => {
-        if (isStream(node)) {
-            const data = replacements.get(node.name);
-            if (data !== undefined) {
-                applied.add(node.name);
-                return { name: node.name, data };
-            }
+function replaceStreams(nodes, replacements) {
+    let applied = 0;
+    const rebuild = (level, pending, depth) => level.map((node) => {
+        const here = pending.filter((replacement) => {
+            const segment = replacement.path[depth];
+            return segment !== undefined && sameEntryName(segment, node.name);
+        });
+        if (here.length === 0)
             return node;
+        if (isStream(node)) {
+            const replacement = here.find((candidate) => candidate.path.length === depth + 1);
+            if (replacement === undefined)
+                return node;
+            applied++;
+            return { name: node.name, data: replacement.data };
         }
-        return { name: node.name, children: replaceStreams(node.children, replacements, applied) };
+        return { name: node.name, children: rebuild(node.children, here, depth + 1) };
     });
+    const rebuilt = rebuild(nodes, replacements, 0);
+    if (applied !== replacements.length) {
+        throw new InternalError('a VBA stream read by its path is missing from the container tree');
+    }
+    return rebuilt;
+}
+function withoutStream(nodes, path) {
+    const [name, ...rest] = path;
+    const index = nodes.findIndex((node) => name !== undefined &&
+        sameEntryName(node.name, name) &&
+        isStream(node) === (rest.length === 0));
+    const target = nodes[index];
+    if (target === undefined) {
+        throw new InternalError('a VBA module stream read by its path is missing from the container tree');
+    }
+    const kept = isStream(target)
+        ? []
+        : [{ name: target.name, children: withoutStream(target.children, rest) }];
+    return [...nodes.slice(0, index), ...kept, ...nodes.slice(index + 1)];
 }

package/dist/vba/project.d.ts

@@ -43,6 +43,10 @@ export interface VbaProjectSignature {
  * carries (`.../office/2006/...` vs `.../2014/...` vs `.../2020/...`).
  */
 export declare function vbaProjectSignatureKind(relType: string): VbaProjectSignatureKind | undefined;
+export declare const VBA_STORAGE = "VBA";
+export declare const DIR_PATH: readonly string[];
+export declare const PROJECT_PATH: readonly string[];
+export declare const PROJECTWM_PATH: readonly string[];
 export declare function parseVbaProject(bin: Uint8Array, maxOutput?: number): VbaProject;
 /**
  * As {@link parseVbaProject}, over a container the caller has already opened.

package/dist/vba/project.js

@@ -1,4 +1,5 @@
 import { quoted } from '../errors.js';
+import { relTypeSegment } from '../rel-type.js';
 import { readU16, readU32 } from './bytes.js';
 import { CompoundFile } from './cfb.js';
 import { decoderForCodePage } from './codepage.js';
@@ -14,17 +15,21 @@ const SIGNATURE_KIND_BY_REL_SEGMENT = new Map([
     ['vbaProjectSignatureV3', 'v3'],
 ]);
 export function vbaProjectSignatureKind(relType) {
-    return SIGNATURE_KIND_BY_REL_SEGMENT.get(relType.slice(relType.lastIndexOf('/') + 1));
+    return SIGNATURE_KIND_BY_REL_SEGMENT.get(relTypeSegment(relType));
 }
 function isComplete(module) {
     return module.streamName !== undefined && module.offset !== undefined;
 }
+export const VBA_STORAGE = 'VBA';
+export const DIR_PATH = [VBA_STORAGE, 'dir'];
+export const PROJECT_PATH = ['PROJECT'];
+export const PROJECTWM_PATH = ['PROJECTwm'];
 export function parseVbaProject(bin, maxOutput = DEFAULT_MAX_PROJECT_OUTPUT) {
     return parseVbaProjectIn(new CompoundFile(bin), maxOutput);
 }
 export function parseVbaProjectIn(cfb, maxOutput = DEFAULT_MAX_PROJECT_OUTPUT) {
     const budget = new DecompressionBudget(maxOutput);
-    const dirCompressed = cfb.readStream('dir');
+    const dirCompressed = cfb.readStream(DIR_PATH);
     if (!dirCompressed)
         throw new VbaParseError("VBA project has no 'dir' stream");
     const dir = budget.spend(dirCompressed, 0);
@@ -78,9 +83,10 @@ export function parseVbaProjectIn(cfb, maxOutput = DEFAULT_MAX_PROJECT_OUTPUT) {
     return { codePage, modules };
 }
 function readModuleSource(cfb, streamName, textOffset, decoder, budget) {
-    const stream = cfb.readStream(streamName);
-    if (!stream)
-        throw new VbaParseError(`module stream ${quoted(streamName)} not found in container`);
+    const stream = cfb.readStream([VBA_STORAGE, streamName]);
+    if (!stream) {
+        throw new VbaParseError(`module stream ${quoted(streamName)} not found in the ${quoted(VBA_STORAGE)} storage`);
+    }
     return decoder.decode(budget.spend(stream, textOffset));
 }
 const DEFAULT_MAX_PROJECT_OUTPUT = 64 * 1024 * 1024;
@@ -103,7 +109,7 @@ const MODULE_KIND_BY_PROJECT_KEYWORD = new Map([
 ]);
 function readProjectStreamKinds(cfb, decoder) {
     const kinds = new Map();
-    const stream = cfb.readStream('PROJECT');
+    const stream = cfb.readStream(PROJECT_PATH);
     if (!stream)
         return kinds;
     const text = decoder.decode(stream);

package/dist/vba/vba-encoding.d.ts

@@ -1,14 +1,8 @@
 /**
- * Validate a module, project, or reference name against the shared VBA identifier contract: a valid
- * identifier, at most 31 characters (the CFB stream-name limit, which doubles as VBA's own module-name
- * limit). Used by {@link project-editor.ts | project-editor}'s structural edits.
+ * Validate a library reference's name against the VBA identifier contract: a valid identifier, at
+ * most 31 characters (the CFB stream-name limit, which VBA also applies to its names). The reference
+ * is the one new name {@link project-editor.ts | project-editor}'s structural edits write.
  *
  * @throws {VbaAuthorError} if `name` is not a valid VBA identifier or exceeds 31 characters.
  */
-export declare function validateVbaName(name: string, what: 'project' | 'module' | 'reference'): void;
-/** Append one `dir`-stream TLV record (Id, Size, data) to `out`. */
-export declare function push(out: number[], id: number, data: number[]): void;
-export declare function u16(n: number): number[];
-export declare function u32(n: number): number[];
-/** A name as NUL-free UTF-16LE code units: the encoding [MS-OVBA] uses for every "Unicode" name field. */
-export declare function utf16le(s: string): number[];
+export declare function validateReferenceName(name: string): void;

package/dist/vba/vba-encoding.js

@@ -1,22 +1,9 @@
-import { utf16leBytes } from '../bytes.js';
 import { quoted } from '../errors.js';
 import { MAX_NAME_CHARS } from './cfb-format.js';
 import { VbaAuthorError } from './errors.js';
 const IDENTIFIER = /^[A-Za-z][A-Za-z0-9_]*$/;
-export function validateVbaName(name, what) {
+export function validateReferenceName(name) {
     if (!IDENTIFIER.test(name) || name.length > MAX_NAME_CHARS) {
-        throw new VbaAuthorError(`invalid ${what} name ${quoted(name)} (must be a VBA identifier ≤ 31 chars)`);
+        throw new VbaAuthorError(`invalid reference name ${quoted(name)} (must be a VBA identifier ≤ 31 chars)`);
     }
 }
-export function push(out, id, data) {
-    out.push(...u16(id), ...u32(data.length), ...data);
-}
-export function u16(n) {
-    return [n & 0xff, (n >> 8) & 0xff];
-}
-export function u32(n) {
-    return [n & 0xff, (n >> 8) & 0xff, (n >> 16) & 0xff, (n >> 24) & 0xff];
-}
-export function utf16le(s) {
-    return [...utf16leBytes(s)];
-}

package/dist/xml/xml-read.d.ts

@@ -94,6 +94,34 @@ export interface ElementRange {
  * range is not a range.
  */
 export declare function elementRange(source: string, path: readonly string[]): ElementRange | undefined;
+/** A tag as {@link tagRanges} yields it. */
+export interface TagRange {
+    /** Offset of the tag's `<`. */
+    readonly start: number;
+    /** One past the tag's `>`. */
+    readonly end: number;
+    /** The name as written, namespace prefix included. */
+    readonly name: string;
+    /** The parsed attributes of an opening tag; empty for a closing one. */
+    readonly attrs: XmlAttributes;
+    readonly close: boolean;
+    readonly selfClosing: boolean;
+}
+/**
+ * Every tag in `source`, opening and closing, as offsets into the source: for an edit that rewrites a
+ * tag wherever it sits rather than one element a path names, such as translating the namespaces a
+ * part declares. A caller that resolves names keeps its own `NamespaceScope` in step, opening it on
+ * each opening tag and closing it on each closing one and after each self-closing one.
+ */
+export declare function tagRanges(source: string): Generator<TagRange>;
+/**
+ * Locate every element with the local name `local`, at any depth, as offsets into the source, in
+ * document order: {@link elementRange} for a part that repeats the element an edit is after, such as
+ * the `<c:f>` behind each of a chart's series. A same-named element nested in a match is part of that
+ * match's content rather than a range of its own. An element that never closes throws
+ * {@link XmlParseError}.
+ */
+export declare function elementRanges(source: string, local: string): Generator<ElementRange>;
 /** An element start surfaced by {@link openElements}: its qualified `name`, the namespace-stripped
  * `local` name the filter matched on, and its already-decoded `attrs`. */
 export interface OpenElement {
@@ -188,7 +216,7 @@ export declare function parseXml(source: string, handlers: SaxHandlers, options?
  * The other thing the open-coded versions disagreed on is what an unrelated element opening
  * mid-capture should do. Ending the capture is never what a caller wants: the text belongs to the
  * element that opened it, and a nested or sibling element is not that element. So an open that is
- * not for a captured name leaves an capture in progress alone, and {@link close} answers only for
+ * not for a captured name leaves a capture in progress alone, and {@link close} answers only for
  * the element that started it.
  *
  * Decoding stays outside. A `<t>` needs `decodeSpreadsheetText` over the whole element and never

package/dist/xml/xml-read.js

@@ -132,6 +132,62 @@ export function elementRange(source, path) {
     }
     return undefined;
 }
+const NO_ATTRIBUTES = Object.freeze(Object.create(null));
+export function* tagRanges(source) {
+    for (const { lt, tag } of rawTags(source)) {
+        yield {
+            start: lt,
+            end: tag.next,
+            name: tag.name,
+            attrs: tag.close ? NO_ATTRIBUTES : parseAttributes(tag.attrSource),
+            close: tag.close,
+            selfClosing: tag.selfClosing,
+        };
+    }
+}
+export function* elementRanges(source, local) {
+    let pending;
+    let depth = 0;
+    for (const { lt, tag, local: tagLocal } of rawTags(source)) {
+        if (tagLocal !== local)
+            continue;
+        if (pending !== undefined) {
+            if (tag.close) {
+                if (depth > 0)
+                    depth -= 1;
+                else {
+                    const open = pending;
+                    pending = undefined;
+                    yield { ...open, end: tag.next, contentEnd: lt };
+                }
+            }
+            else if (!tag.selfClosing) {
+                depth += 1;
+            }
+            continue;
+        }
+        if (tag.close)
+            continue;
+        const attrs = parseAttributes(tag.attrSource);
+        if (tag.selfClosing) {
+            yield {
+                start: lt,
+                end: tag.next,
+                contentStart: tag.next,
+                contentEnd: tag.next,
+                name: tag.name,
+                attrs,
+            };
+        }
+        else {
+            pending = { start: lt, contentStart: tag.next, name: tag.name, attrs };
+            depth = 0;
+        }
+    }
+    if (pending !== undefined) {
+        throw new XmlParseError(`unterminated <${pending.name}> element`);
+    }
+}
 export function* openElements(source, ...localNames) {
     const filter = localNames.length > 0 ? new Set(localNames) : undefined;
     const scope = new NamespaceScope();

package/dist/xml/xml-scan.d.ts

@@ -35,6 +35,19 @@ export type XmlEvent = {
  * codec keeps importing none of the serialisation vocabulary.
  */
 export declare function decodeEntities(value: string): string;
+/**
+ * A tag's attributes: each a name, then `=`, then a value in either quote style. Matching the quotes
+ * is what lets a delimiter-respecting scan find a tag's end even when a value holds a `>` (legal but
+ * rare). Names may carry a namespace prefix (`r:id`, `xml:space`). Anything that is not an attribute,
+ * such as a name nothing assigns or a quote never closed, is skipped rather than refused.
+ *
+ * Linear in the source, and that is the point of it being hand-written. The regex it replaced
+ * backtracked over a run of name characters no `=` followed from every position inside the run, so a
+ * single junk token in a tag cost the square of its length: a megabyte of one letter, a kilobyte
+ * zipped, cost minutes inside either reader. Here a dropped token resumes the scan where the token
+ * ended, and a value's closing quote is found with one `indexOf`, so no character is visited more
+ * than a constant number of times.
+ */
 export declare function parseAttributes(source: string): XmlAttributes;
 export type Markup = {
     readonly kind: 'comment' | 'pi' | 'declaration';

package/dist/xml/xml-scan.js

@@ -26,18 +26,69 @@ export function decodeEntities(value) {
 function admitText(value) {
     return stripUnrepresentable(decodeEntities(value));
 }
-const ATTRIBUTE = /([^\s=/>]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+const EQUALS = 0x3d;
+const SLASH = 0x2f;
+const GREATER_THAN = 0x3e;
+const DOUBLE_QUOTE = 0x22;
+const SINGLE_QUOTE = 0x27;
+const WIDE_WHITESPACE = /\s/;
+function isScanWhitespace(code) {
+    if (code < 0x80)
+        return code === 0x20 || (code >= 0x09 && code <= 0x0d);
+    return WIDE_WHITESPACE.test(String.fromCharCode(code));
+}
+function skipScanWhitespace(source, from) {
+    let i = from;
+    while (i < source.length && isScanWhitespace(source.charCodeAt(i)))
+        i++;
+    return i;
+}
+function endsName(code) {
+    if (code > GREATER_THAN && code < 0xa0)
+        return false;
+    return isScanWhitespace(code) || code === EQUALS || code === SLASH || code === GREATER_THAN;
+}
 export function parseAttributes(source) {
     const attrs = Object.create(null);
-    ATTRIBUTE.lastIndex = 0;
-    let match = ATTRIBUTE.exec(source);
-    while (match !== null) {
-        const value = match[2] ?? match[3] ?? '';
-        attrs[match[1]] = admitText(value);
-        match = ATTRIBUTE.exec(source);
+    const length = source.length;
+    let i = 0;
+    while (i < length) {
+        const nameStart = i;
+        while (i < length && !endsName(source.charCodeAt(i)))
+            i++;
+        if (i === nameStart) {
+            i++;
+            continue;
+        }
+        let cursor = skipScanWhitespace(source, i);
+        if (source.charCodeAt(cursor) !== EQUALS) {
+            i = cursor;
+            continue;
+        }
+        cursor = skipScanWhitespace(source, cursor + 1);
+        const quote = source.charCodeAt(cursor);
+        const close = quote === DOUBLE_QUOTE || quote === SINGLE_QUOTE
+            ? source.indexOf(quote === DOUBLE_QUOTE ? '"' : "'", cursor + 1)
+            : -1;
+        if (close === -1) {
+            i = cursor;
+            continue;
+        }
+        attrs[source.slice(nameStart, i)] = admitText(normalizeAttributeWhitespace(source.slice(cursor + 1, close)));
+        i = close + 1;
     }
     return attrs;
 }
+const ATTRIBUTE_WHITESPACE = /\r\n|[\t\n\r]/g;
+function normalizeAttributeWhitespace(raw) {
+    for (let i = 0; i < raw.length; i++) {
+        const code = raw.charCodeAt(i);
+        if (code === 0x09 || code === 0x0a || code === 0x0d) {
+            return raw.replace(ATTRIBUTE_WHITESPACE, ' ');
+        }
+    }
+    return raw;
+}
 function findTagEnd(source, start) {
     let quote = '';
     for (let i = start + 1; i < source.length; i++) {

package/dist/xml/xml.d.ts

@@ -31,7 +31,7 @@ export declare function escapeFormatCode(code: string): string;
  * `escapeText` runs last and sees no unrepresentable character left, so its guard is a
  * standing proof that the escape was complete rather than a second check of the same thing.
  *
- * Reversed by `decodeSpreadsheetText` in `./xml-scan.ts`, whose single left-to-right pass is what
+ * Reversed by `decodeSpreadsheetText` in `./xml-attrs.ts`, whose single left-to-right pass is what
  * makes the `_x005F_` step above reversible. Change either and read its comment first.
  */
 export declare function escapeSpreadsheetText(value: string): string;
@@ -42,6 +42,15 @@ export declare function escapeSpreadsheetText(value: string): string;
  * identically on the way back.
  */
 export declare function textElement(value: string): string;
+/**
+ * Re-render an opening tag, `<name …>` or the empty `<name …/>`, from its parsed name and attributes,
+ * for an edit that changes an attribute of an element a part already carries. Attribute order is the
+ * scanner's, which is the source's, so an element whose attributes an edit merges over keeps them
+ * where they were; only the quoting and the entity spelling become this writer's.
+ */
+export declare function startTag(name: string, attrs: {
+    readonly [attribute: string]: string | undefined;
+}, selfClosing: boolean): string;
 /**
  * A boolean attribute rendered with a leading space (` name="1"` / ` name="0"`), or '' when the value
  * is undefined. OOXML booleans serialise as 1/0; emitting the explicit `="0"` lets a writer force a
@@ -83,6 +92,29 @@ export declare function checkedToken(value: string, isValid: (candidate: string)
  * @throws {AuthoringError} when the value is not finite.
  */
 export declare function numAttr(name: string, value: number | undefined): string;
+/**
+ * An integer attribute rendered with a leading space (` name="3"`), or '' when the value is undefined.
+ *
+ * For an `xsd:int` or `xsd:unsignedInt` attribute, whose lexical space has no spelling for a fraction
+ * any more than for a NaN: `priority="1.5"` and `rank="-1"` make a package the schema rejects, so the
+ * value is refused here rather than written. `min` is the floor the attribute's type implies, `0` for
+ * an unsigned one.
+ *
+ * @throws {AuthoringError} when the value is not finite, not a safe integer, or below `min`.
+ */
+export declare function intAttr(name: string, value: number | undefined, min?: number): string;
+/**
+ * A numeric attribute written only when it differs from its schema default, with a leading space, or
+ * '' when the value is undefined or equals `defaultValue`.
+ *
+ * The number is checked before it is compared, because the two answer different questions: whether
+ * the value can be spelled, and whether it is worth spelling. Tested for truthiness instead, `NaN` is
+ * falsy and was omitted as if it were a default of zero, so a gradient fill with `degree: NaN` was
+ * written as an ordinary gradient rather than refused.
+ *
+ * @throws {AuthoringError} when the value is not finite.
+ */
+export declare function nonDefaultNumAttr(name: string, value: number | undefined, defaultValue: number): string;
 /**
  * Refuse a `Date` OOXML cannot spell, naming the property that carries it.
  *