@svadmin/core 0.53.0 → 0.55.0

package/src/schema-form.ts

@@ -0,0 +1,204 @@
+import { Type, type TSchema } from '@sinclair/typebox';
+import { Value } from '@sinclair/typebox/value';
+
+export type SchemaFormScalar = string | number | boolean | null;
+
+/** 条件路径从表单根开始，只能引用无条件的标量字段。 */
+export interface SchemaFormCondition {
+  path: readonly string[];
+  equals?: SchemaFormScalar;
+  notEquals?: SchemaFormScalar;
+  exists?: boolean;
+}
+
+export interface SchemaFormSchema {
+  type?: string;
+  title?: string;
+  description?: string;
+  properties?: Record<string, SchemaFormSchema>;
+  items?: SchemaFormSchema;
+  enum?: SchemaFormScalar[];
+  default?: unknown;
+  required?: string[];
+  visibleWhen?: SchemaFormCondition;
+  minLength?: number;
+  maxLength?: number;
+  pattern?: string;
+  minimum?: number;
+  maximum?: number;
+  minItems?: number;
+  maxItems?: number;
+}
+
+const keys = new Set([
+  'type', 'title', 'description', 'properties', 'items', 'enum', 'default', 'required',
+  'visibleWhen', 'minLength', 'maxLength', 'pattern', 'minimum', 'maximum', 'minItems', 'maxItems',
+]);
+const scalar = (value: unknown): value is SchemaFormScalar => value === null ||
+  typeof value === 'string' || typeof value === 'boolean' ||
+  (typeof value === 'number' && Number.isFinite(value));
+const fail = (): never => { throw new TypeError('Invalid schema form configuration.'); };
+
+/** Schema 来自可信宿主，但仍拒绝未知关键字、循环、错误约束和超限结构。 */
+export function assertSchemaFormSchema(schema: SchemaFormSchema): void {
+  let visited = 0;
+  const active = new Set<object>();
+  function visit(node: SchemaFormSchema, depth: number): void {
+    if (!node || typeof node !== 'object' || Array.isArray(node) ||
+        ++visited > 1000 || depth > 32 || active.has(node)) fail();
+    if (Object.keys(node).some(key => !keys.has(key))) fail();
+    active.add(node);
+    const kind = node.type ?? (node.properties ? 'object' : undefined);
+    if (kind !== undefined && !['object', 'array', 'string', 'number', 'integer', 'boolean', 'null'].includes(kind)) fail();
+    if (node.properties !== undefined) {
+      if (kind !== 'object' || !node.properties || typeof node.properties !== 'object' || Array.isArray(node.properties)) fail();
+      for (const child of Object.values(node.properties)) visit(child, depth + 1);
+    }
+    if (node.items !== undefined) {
+      if (kind !== 'array') fail();
+      visit(node.items, depth + 1);
+      if (node.items.visibleWhen !== undefined) fail();
+    }
+    if (node.required !== undefined && (kind !== 'object' || !Array.isArray(node.required) ||
+        node.required.some(key => typeof key !== 'string' || !Object.hasOwn(node.properties ?? {}, key)))) fail();
+    if (node.enum !== undefined && (!Array.isArray(node.enum) || node.enum.length === 0 ||
+        node.enum.length > 1000 || !node.enum.every(scalar) || kind === 'object' || kind === 'array')) fail();
+    for (const key of ['minLength', 'maxLength', 'minItems', 'maxItems'] as const) {
+      const limit = node[key];
+      if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 0 ||
+          (key.endsWith('Length') ? kind !== 'string' : kind !== 'array'))) fail();
+    }
+    for (const key of ['minimum', 'maximum'] as const) {
+      if (node[key] !== undefined && (!Number.isFinite(node[key]) || (kind !== 'number' && kind !== 'integer'))) fail();
+    }
+    if (node.pattern !== undefined) {
+      if (kind !== 'string' || typeof node.pattern !== 'string' || node.pattern.length > 1000) fail();
+      try { new RegExp(node.pattern); } catch { fail(); }
+    }
+    for (const [min, max] of [[node.minLength, node.maxLength], [node.minItems, node.maxItems], [node.minimum, node.maximum]]) {
+      if (min !== undefined && max !== undefined && min > max) fail();
+    }
+    const condition = node.visibleWhen;
+    if (condition !== undefined) {
+      if (!condition || typeof condition !== 'object' || Array.isArray(condition) ||
+          !Array.isArray(condition.path) || condition.path.length === 0 || condition.path.length > 32 ||
+          condition.path.some(part => typeof part !== 'string') ||
+          Object.keys(condition).some(key => !['path', 'equals', 'notEquals', 'exists'].includes(key)) ||
+          !['equals', 'notEquals', 'exists'].some(key => Object.hasOwn(condition, key))) fail();
+      if ((Object.hasOwn(condition, 'equals') && !scalar(condition.equals)) ||
+          (Object.hasOwn(condition, 'notEquals') && !scalar(condition.notEquals)) ||
+          (Object.hasOwn(condition, 'exists') && typeof condition.exists !== 'boolean')) fail();
+      let controller = schema;
+      for (const part of condition.path) {
+        if (controller.visibleWhen || !controller.properties || !Object.hasOwn(controller.properties, part)) fail();
+        const next = controller.properties?.[part];
+        if (!next) return fail();
+        controller = next;
+      }
+      if (controller.visibleWhen || controller.properties || controller.type === 'object' || controller.type === 'array') fail();
+    }
+    active.delete(node);
+  }
+  if (!schema || typeof schema !== 'object' || Array.isArray(schema) ||
+      (schema.type !== 'object' && !schema.properties) || schema.visibleWhen) fail();
+  visit(schema, 0);
+}
+
+export function readSchemaFormPath(value: unknown, path: readonly string[]): unknown {
+  return path.reduce<unknown>((current, key) => (
+    current !== null && typeof current === 'object' && Object.hasOwn(current, key)
+      ? (current as Record<string, unknown>)[key] : undefined
+  ), value);
+}
+
+export function matchesSchemaFormCondition(condition: SchemaFormCondition | undefined, value: unknown): boolean {
+  if (!condition) return true;
+  const current = readSchemaFormPath(value, condition.path);
+  if (condition.exists !== undefined && (current !== undefined) !== condition.exists) return false;
+  if (Object.hasOwn(condition, 'equals') && !Object.is(current, condition.equals)) return false;
+  if (Object.hasOwn(condition, 'notEquals') && Object.is(current, condition.notEquals)) return false;
+  return true;
+}
+
+export function isSchemaFormNodeVisible(schema: SchemaFormSchema, rootValue: unknown): boolean {
+  return matchesSchemaFormCondition(schema.visibleWhen, rootValue);
+}
+
+export interface SchemaFormValidationError {
+  /** JSON 数组路径，不混淆字段名中的点、斜杠和数组索引。 */
+  path: string;
+  code: 'invalid';
+  message: string;
+}
+
+/** 不编译代码、不转换类型；值约束复用 TypeBox 的解释型校验。 */
+export function prepareSchemaFormValue(schema: SchemaFormSchema, value: unknown): {
+  data: Record<string, unknown>;
+  errors: SchemaFormValidationError[];
+} {
+  assertSchemaFormSchema(schema);
+  const errors: SchemaFormValidationError[] = [];
+  let visited = 0;
+  const invalid = (path: string[]) => {
+    if (errors.length < 50) errors.push({ path: JSON.stringify(path), code: 'invalid', message: 'Invalid value.' });
+  };
+  function visit(node: SchemaFormSchema, current: unknown, path: string[], required: boolean): unknown {
+    if (++visited > 1000 || path.length > 32) throw new TypeError('Schema form data limit exceeded.');
+    if (current === undefined && !required) return undefined;
+    const kind = node.type ?? (node.properties ? 'object' : node.enum ? undefined : 'string');
+    let check: TSchema;
+    switch (kind) {
+      case 'object': check = Type.Object({}); break;
+      case 'array': check = Type.Array(Type.Unknown(), {
+        ...(node.minItems === undefined ? {} : { minItems: node.minItems }),
+        ...(node.maxItems === undefined ? {} : { maxItems: node.maxItems }),
+      }); break;
+      case 'number': check = Type.Number({
+        ...(node.minimum === undefined ? {} : { minimum: node.minimum }),
+        ...(node.maximum === undefined ? {} : { maximum: node.maximum }),
+      }); break;
+      case 'integer': check = Type.Integer({
+        minimum: Math.max(Number.MIN_SAFE_INTEGER, node.minimum ?? Number.MIN_SAFE_INTEGER),
+        maximum: Math.min(Number.MAX_SAFE_INTEGER, node.maximum ?? Number.MAX_SAFE_INTEGER),
+      }); break;
+      case 'boolean': check = Type.Boolean(); break;
+      case 'null': check = Type.Null(); break;
+      case 'string': check = Type.String({
+        ...(node.minLength === undefined ? {} : { minLength: node.minLength }),
+        ...(node.maxLength === undefined ? {} : { maxLength: node.maxLength }),
+        ...(node.pattern === undefined ? {} : { pattern: node.pattern }),
+      }); break;
+      default: check = Type.Unknown();
+    }
+    if (node.enum) check = Type.Intersect([check, Type.Union(node.enum.map(item => item === null ? Type.Null() : Type.Literal(item)))]);
+    if (!Value.Check(check, current)) invalid(path);
+    if (kind === 'array' && Array.isArray(current)) {
+      if (current.length > 1000 - visited) throw new TypeError('Schema form data limit exceeded.');
+      return current.map((item, index) => visit(node.items ?? { type: 'string' }, item, [...path, String(index)], true));
+    }
+    if (kind === 'object' && current !== null && typeof current === 'object' && !Array.isArray(current)) {
+      const source = current as Record<string, unknown>;
+      const result: Record<string, unknown> = {};
+      for (const key of Object.keys(source)) {
+        if (!Object.hasOwn(node.properties ?? {}, key)) invalid([...path, key]);
+      }
+      for (const [key, child] of Object.entries(node.properties ?? {})) {
+        if (!isSchemaFormNodeVisible(child, value)) continue;
+        const own = Object.hasOwn(source, key);
+        const next = visit(child, own ? source[key] : undefined, [...path, key], node.required?.includes(key) ?? false);
+        if (own || next !== undefined) Object.defineProperty(result, key, { value: next, enumerable: true, writable: true, configurable: true });
+      }
+      return result;
+    }
+    return current;
+  }
+  const projected = visit(schema, value, [], true);
+  return {
+    data: projected !== null && typeof projected === 'object' && !Array.isArray(projected) ? projected as Record<string, unknown> : {},
+    errors,
+  };
+}
+
+export function validateSchemaFormValue(schema: SchemaFormSchema, value: unknown): SchemaFormValidationError[] {
+  return prepareSchemaFormValue(schema, value).errors;
+}

package/src/schema.ts

@@ -1,4 +1,11 @@
 export { createExactSchemaValidator, checkExact } from './schema-validation';
+export {
+  readSchemaFormPath, matchesSchemaFormCondition, isSchemaFormNodeVisible, validateSchemaFormValue,
+  assertSchemaFormSchema, prepareSchemaFormValue,
+} from './schema-form';
+export type {
+  SchemaFormScalar, SchemaFormCondition, SchemaFormSchema, SchemaFormValidationError,
+} from './schema-form';
 export { snapshotPlainData } from './plain-data';
 export type { JsonValue } from './plain-data';
 export { decodeAuditEntry, decodeAuditCreate, decodeAuditQuery, decodeAuditEntries } from './audit-contract';

package/src/spreadsheet-clipboard.ts

@@ -0,0 +1,45 @@
+import Papa from 'papaparse';
+
+/** 复制计算值而非可执行公式；文本中和与字段转义分别处理。 */
+export function serializeSpreadsheetClipboard(rows: (string | number)[][], format: 'tsv' | 'csv'): string | undefined {
+  const width = rows[0]?.length ?? 0;
+  if (!rows.length || rows.length > 1000 || !width || width > 100 || rows.length * width > 10_000) return;
+  const safe: string[][] = [];
+  for (const row of rows) {
+    if (row.length !== width) return;
+    const values: string[] = [];
+    for (const value of row) {
+      if (typeof value !== 'string' && typeof value !== 'number') return;
+      if (typeof value === 'number' && !Number.isFinite(value)) return;
+      const text = typeof value === 'string' && (/^[\t\r\n]/.test(value) || /^\s*[=+@-]/.test(value))
+        ? `'${value}` : String(value);
+      if (text.length > 10_000) return;
+      values.push(text);
+    }
+    safe.push(values);
+  }
+  const result = Papa.unparse(safe, { delimiter: format === 'csv' ? ',' : '\t', newline: '\n', quotes: true });
+  return result.length <= 1_000_000 ? result : undefined;
+}
+
+/** 剪贴板采用显式分隔符，纯文本中的逗号不自动拆列。 */
+export function parseSpreadsheetClipboard(text: string, format: 'tsv' | 'csv' = 'tsv'): string[][] | undefined {
+  if (typeof text !== 'string' || text.length === 0 || text.length > 1_000_000
+    || (format !== 'tsv' && format !== 'csv')) return undefined;
+  const parsed = Papa.parse<string[]>(text, {
+    delimiter: format === 'csv' ? ',' : '\t',
+    dynamicTyping: false,
+    skipEmptyLines: false,
+    preview: 1002,
+  });
+  if (parsed.errors.length || parsed.meta.truncated) return undefined;
+  const rows = parsed.data;
+  // 只去掉行终止符生成的末尾空记录，保留中间空行和空单元格。
+  if (/[\r\n]$/.test(text) && rows.at(-1)?.length === 1 && rows.at(-1)?.[0] === '') rows.pop();
+  const columns = rows[0]?.length ?? 0;
+  if (!rows.length || rows.length > 1000 || columns < 1 || columns > 100 || rows.length * columns > 10_000
+    || rows.some(row => row.length !== columns || row.some(value => typeof value !== 'string' || value.length > 10_000))) {
+    return undefined;
+  }
+  return rows;
+}

package/src/spreadsheet-workbook.ts

@@ -0,0 +1,64 @@
+import { Type, type Static } from '@sinclair/typebox';
+import { snapshotPlainData } from './plain-data';
+import { checkExact } from './schema-validation';
+
+export const SPREADSHEET_WORKBOOK_LIMITS = Object.freeze({
+  maxSheets: 32, maxRows: 1000, maxCols: 100, maxCells: 10_000,
+  maxCellLength: 10_000, maxTotalText: 1_000_000, maxJsonLength: 10_000_000,
+});
+const formatSchema = Type.Object({
+  numberFormat: Type.Optional(Type.Union([Type.Literal('general'), Type.Literal('number'), Type.Literal('percent')])),
+  decimalPlaces: Type.Optional(Type.Integer({ minimum: 0, maximum: 20 })),
+  bold: Type.Optional(Type.Boolean()), italic: Type.Optional(Type.Boolean()),
+  align: Type.Optional(Type.Union([Type.Literal('left'), Type.Literal('center'), Type.Literal('right')])),
+}, { additionalProperties: false });
+export type SpreadsheetCellFormat = Static<typeof formatSchema>;
+const sheetSchema = Type.Object({
+  id: Type.String({ minLength: 1, maxLength: 200 }), name: Type.String({ minLength: 1, maxLength: 200 }),
+  rows: Type.Integer({ minimum: 1, maximum: 1000 }), cols: Type.Integer({ minimum: 1, maximum: 100 }),
+  cells: Type.Record(Type.String({ pattern: '^[A-Z]{1,2}[1-9][0-9]{0,3}$' }), Type.String({ maxLength: 10_000 })),
+  formats: Type.Optional(Type.Record(Type.String({ pattern: '^[A-Z]{1,2}[1-9][0-9]{0,3}$' }), formatSchema)),
+}, { additionalProperties: false });
+export type SpreadsheetSheet = Static<typeof sheetSchema>;
+const workbookSchema = Type.Object({
+  protocolVersion: Type.Literal(1), sheets: Type.Array(sheetSchema, { minItems: 1, maxItems: 32 }),
+  activeSheetId: Type.Optional(Type.String({ minLength: 1, maxLength: 200 })),
+}, { additionalProperties: false });
+export type SpreadsheetWorkbook = Static<typeof workbookSchema>;
+function inside(key: string, sheet: SpreadsheetSheet): boolean {
+  const match = /^([A-Z]{1,2})([1-9][0-9]{0,3})$/.exec(key);
+  if (!match) return false;
+  let column = 0;
+  for (const char of match[1] ?? '') column = column * 26 + char.charCodeAt(0) - 64;
+  return column <= sheet.cols && Number(match[2]) <= sheet.rows;
+}
+export function snapshotSpreadsheetWorkbook(value: unknown): SpreadsheetWorkbook | undefined {
+  try {
+    const plain = snapshotPlainData(value);
+    if (!checkExact(workbookSchema, plain)) return;
+    const ids = new Set<string>();
+    let totalText = 0;
+    for (const sheet of plain.sheets) {
+      if (!sheet.id.trim() || !sheet.name.trim() || ids.has(sheet.id)
+        || sheet.rows * sheet.cols > SPREADSHEET_WORKBOOK_LIMITS.maxCells) return;
+      ids.add(sheet.id);
+      for (const [key, text] of Object.entries(sheet.cells)) {
+        if (!inside(key, sheet)) return;
+        totalText += text.length;
+        if (totalText > SPREADSHEET_WORKBOOK_LIMITS.maxTotalText) return;
+      }
+      for (const key of Object.keys(sheet.formats ?? {})) if (!inside(key, sheet)) return;
+    }
+    if (plain.activeSheetId !== undefined && !ids.has(plain.activeSheetId)) return;
+    if (JSON.stringify(plain).length > SPREADSHEET_WORKBOOK_LIMITS.maxJsonLength) return;
+    return plain;
+  } catch { return; }
+}
+export function serializeSpreadsheetWorkbook(value: unknown): string | undefined {
+  const workbook = snapshotSpreadsheetWorkbook(value);
+  return workbook ? JSON.stringify(workbook) : undefined;
+}
+export function parseSpreadsheetWorkbook(value: string): SpreadsheetWorkbook | undefined {
+  if (typeof value !== 'string' || value.length > SPREADSHEET_WORKBOOK_LIMITS.maxJsonLength) return;
+  try { return snapshotSpreadsheetWorkbook(JSON.parse(value)); } catch { return; }
+}

package/src/spreadsheet-xlsx.ts

@@ -0,0 +1,181 @@
+import type { Cell, Workbook, Worksheet } from 'exceljs';
+import { snapshotSpreadsheetWorkbook, type SpreadsheetWorkbook, type SpreadsheetCellFormat } from './spreadsheet-workbook';
+
+export interface SpreadsheetXlsxOptions {
+  exceljs?: { Workbook: new () => Workbook };
+}
+
+export interface SpreadsheetXlsxImportLimits {
+  maxBytes?: number;
+  maxSheets?: number;
+  maxRows?: number;
+  maxCols?: number;
+  maxCells?: number;
+  maxCellLength?: number;
+}
+
+export interface SpreadsheetXlsxImportOptions extends SpreadsheetXlsxImportLimits {
+  exceljs?: { Workbook: new () => Workbook };
+  signal?: AbortSignal;
+}
+
+const DEFAULT_IMPORT_LIMITS: Required<SpreadsheetXlsxImportLimits> = {
+  maxBytes: 25 * 1024 * 1024,
+  maxSheets: 32,
+  maxRows: 1000,
+  maxCols: 100,
+  maxCells: 10_000,
+  maxCellLength: 10_000,
+};
+
+function checkImport(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) throw new Error('aborted');
+}
+
+function cellText(cell: { value: unknown; formula?: string; result?: unknown }): string {
+  if (typeof cell.formula === 'string') return `=${cell.formula}`;
+  if (cell.value === null || cell.value === undefined) return '';
+  if (typeof cell.value === 'string') return cell.value;
+  if (typeof cell.value === 'number' || typeof cell.value === 'boolean') return String(cell.value);
+  if (typeof cell.value === 'object' && cell.value !== null && 'text' in cell.value
+    && typeof cell.value.text === 'string') return cell.value.text;
+  return '';
+}
+
+function cellFormat(cell: Cell): SpreadsheetCellFormat | undefined {
+  const format: SpreadsheetCellFormat = {};
+  if (cell.font?.bold !== undefined) format.bold = cell.font.bold;
+  if (cell.font?.italic !== undefined) format.italic = cell.font.italic;
+  if (cell.alignment?.horizontal === 'left' || cell.alignment?.horizontal === 'center'
+    || cell.alignment?.horizontal === 'right') format.align = cell.alignment.horizontal;
+  if (cell.numFmt?.includes('%')) format.numberFormat = 'percent';
+  else if (cell.numFmt?.includes('0') || cell.numFmt?.includes('#')) format.numberFormat = 'number';
+  return Object.keys(format).length > 0 ? format : undefined;
+}
+
+function worksheetData(
+  worksheet: Worksheet,
+  limits: Required<SpreadsheetXlsxImportLimits>,
+  signal: AbortSignal | undefined,
+): SpreadsheetWorkbook['sheets'][number] {
+  const rows = worksheet.rowCount;
+  const cols = worksheet.columnCount;
+  if (!Number.isSafeInteger(rows) || rows <= 0 || rows > limits.maxRows
+    || !Number.isSafeInteger(cols) || cols <= 0 || cols > limits.maxCols
+    || rows * cols > limits.maxCells) throw new Error('limit');
+  const cells: Record<string, string> = {};
+  const formats: Record<string, SpreadsheetCellFormat> = {};
+  for (let row = 1; row <= rows; row += 1) {
+    checkImport(signal);
+    for (let col = 1; col <= cols; col += 1) {
+      const cell = worksheet.getCell(row, col);
+      const text = cellText(cell);
+      if (text.length > limits.maxCellLength) throw new Error('limit');
+      const format = cellFormat(cell);
+      if (text !== '') {
+        cells[cell.address] = text;
+      }
+      if (format) formats[cell.address] = format;
+    }
+  }
+  return {
+    // XLSX 不保存 SVAdmin 的内部 sheet id；名称是唯一可复现的导入身份。
+    id: worksheet.name,
+    name: worksheet.name,
+    rows,
+    cols,
+    cells,
+    ...(Object.keys(formats).length > 0 ? { formats } : {}),
+  };
+}
+
+/** 读取有界 XLSX；失败、超限或取消时原子返回 undefined。 */
+export async function parseSpreadsheetXlsx(
+  bytes: unknown,
+  options: SpreadsheetXlsxImportOptions = {},
+): Promise<SpreadsheetWorkbook | undefined> {
+  const limits = {
+    ...DEFAULT_IMPORT_LIMITS,
+    ...Object.fromEntries(Object.entries(options).filter(([key]) => key.startsWith('max'))),
+  } as Required<SpreadsheetXlsxImportLimits>;
+  if (!(bytes instanceof Uint8Array) || bytes.byteLength > limits.maxBytes) return;
+  try {
+    checkImport(options.signal);
+    const ExcelJS = options.exceljs ?? (await import('exceljs')).default;
+    checkImport(options.signal);
+    const workbook = new ExcelJS.Workbook();
+    type XlsxInput = Parameters<typeof workbook.xlsx.load>[0];
+    const xlsxBytes = new Uint8Array(bytes).slice().buffer as ArrayBuffer;
+    await workbook.xlsx.load(xlsxBytes as XlsxInput);
+    checkImport(options.signal);
+    if (workbook.worksheets.length === 0 || workbook.worksheets.length > limits.maxSheets) return;
+    const sheets = workbook.worksheets.map((worksheet) => worksheetData(worksheet, limits, options.signal));
+    const activeIndex = workbook.views[0]?.activeTab ?? 0;
+    const activeSheetId = sheets[activeIndex]?.id ?? sheets[0]?.id;
+    if (!activeSheetId) return;
+    return snapshotSpreadsheetWorkbook({ protocolVersion: 1, activeSheetId, sheets });
+  } catch {
+    return;
+  }
+}
+
+function numberFormat(format: string | undefined, decimalPlaces: number | undefined): string | undefined {
+  const places = decimalPlaces === undefined ? 2 : decimalPlaces;
+  const fraction = places ? `.${'0'.repeat(places)}` : '';
+  if (format === 'percent') return `0${fraction}%`;
+  if (format === 'number') return `#,##0${fraction}`;
+  return undefined;
+}
+
+/** 公式按文本保留，避免将不可信内容升级为 Excel 可执行公式。 */
+export async function serializeSpreadsheetXlsx(
+  value: unknown, options: SpreadsheetXlsxOptions = {},
+): Promise<Uint8Array | undefined> {
+  const workbook = snapshotSpreadsheetWorkbook(value);
+  if (!workbook) return;
+  const names = new Set<string>();
+  for (const sheet of workbook.sheets) {
+    const name = sheet.name.toLowerCase();
+    if (sheet.name.length > 31 || /[\\/*?:[\]]/.test(sheet.name)
+      || [...sheet.name].some(character => character.charCodeAt(0) < 32)
+      || sheet.name.startsWith("'") || sheet.name.endsWith("'")
+      || name === 'history' || names.has(name)) return;
+    names.add(name);
+  }
+  try {
+    const ExcelJS = options.exceljs ?? (await import('exceljs')).default;
+    const output = new ExcelJS.Workbook();
+    output.views = [{
+      x: 0, y: 0, width: 1200, height: 800, firstSheet: 0, visibility: 'visible',
+      activeTab: Math.max(0, workbook.sheets.findIndex(sheet => sheet.id === workbook.activeSheetId)),
+    }];
+    for (const sheet of workbook.sheets) {
+      const target = output.addWorksheet(sheet.name);
+      // 空白尾部也属于网格，避免导出后尺寸缩小到最后一个非空单元格。
+      target.getCell(sheet.rows, sheet.cols).value = '';
+      const addresses = new Set([...Object.keys(sheet.cells), ...Object.keys(sheet.formats ?? {})]);
+      for (const address of addresses) {
+        const raw = sheet.cells[address] ?? '';
+        const cell = target.getCell(address);
+        const format = sheet.formats?.[address];
+        const numeric = Number(raw);
+        const explicitNumber = format?.numberFormat === 'number' || format?.numberFormat === 'percent';
+        cell.value = explicitNumber && raw !== '' && Number.isFinite(numeric)
+          && String(numeric) === raw && Math.abs(numeric) <= Number.MAX_SAFE_INTEGER ? numeric : raw;
+        if (format) {
+          cell.font = {
+            ...(format.bold === undefined ? {} : { bold: format.bold }),
+            ...(format.italic === undefined ? {} : { italic: format.italic }),
+          };
+          if (format.align !== undefined) cell.alignment = { horizontal: format.align };
+          const numFmt = numberFormat(format.numberFormat, format.decimalPlaces);
+          if (numFmt !== undefined) cell.numFmt = numFmt;
+        }
+      }
+    }
+    const result = await output.xlsx.writeBuffer();
+    return new Uint8Array(result);
+  } catch {
+    return;
+  }
+}