@svadmin/ui 0.70.0 → 0.73.0

package/dist/components/enterprise/json-schema-form.js

@@ -0,0 +1,195 @@
+const rootKeys = new Set(['$schema', '$id', '$comment', 'title', 'description', 'type', 'properties', 'required', 'additionalProperties']);
+const fieldKeys = new Set(['$id', '$comment', 'title', 'description', 'type', 'enum', 'const', 'default', 'minimum', 'maximum', 'exclusiveMinimum', 'exclusiveMaximum', 'multipleOf', 'minLength', 'maxLength', 'readOnly', 'writeOnly', 'deprecated', 'examples']);
+const unsafeKeys = new Set(['__proto__', 'constructor', 'prototype']);
+const pointer = (key) => `/${key.replaceAll('~', '~0').replaceAll('/', '~1')}`;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+const scalar = (value) => value === null || typeof value === 'string' || typeof value === 'boolean' || (typeof value === 'number' && Number.isFinite(value));
+const same = (a, b) => a === b;
+function matches(field, value) {
+    if (value === null)
+        return field.nullable;
+    if (field.type === 'enum')
+        return scalar(value);
+    if (field.type === 'integer')
+        return typeof value === 'number' && Number.isSafeInteger(value);
+    if (field.type === 'number')
+        return typeof value === 'number' && Number.isFinite(value);
+    return typeof value === field.type;
+}
+export function readSchemaForm(schema) {
+    const model = { fields: [], issues: [], additionalProperties: true };
+    const issue = (path, code) => { model.issues.push({ path, code }); };
+    if (!record(schema)) {
+        issue('', 'invalid-schema');
+        return model;
+    }
+    for (const key of Object.keys(schema))
+        if (!rootKeys.has(key))
+            issue(pointer(key), 'unsupported-schema');
+    if (schema['type'] !== undefined && schema['type'] !== 'object')
+        issue('/type', 'unsupported-schema');
+    if (schema['additionalProperties'] !== undefined && typeof schema['additionalProperties'] !== 'boolean')
+        issue('/additionalProperties', 'unsupported-schema');
+    model.additionalProperties = schema['additionalProperties'] !== false;
+    const properties = schema['properties'] === undefined ? {} : schema['properties'];
+    if (!record(properties) || Object.keys(properties).length > 256) {
+        issue('/properties', 'invalid-schema');
+        return model;
+    }
+    const required = schema['required'] === undefined ? [] : schema['required'];
+    if (!Array.isArray(required) || required.length > 256 || required.some((key) => typeof key !== 'string' || !Object.hasOwn(properties, key)))
+        issue('/required', 'invalid-schema');
+    const requiredKeys = new Set(Array.isArray(required) ? required : []);
+    for (const [key, raw] of Object.entries(properties)) {
+        const path = pointer(key);
+        if (unsafeKeys.has(key) || !record(raw)) {
+            issue(path, 'invalid-schema');
+            continue;
+        }
+        for (const keyword of Object.keys(raw))
+            if (!fieldKeys.has(keyword))
+                issue(`${path}${pointer(keyword)}`, 'unsupported-schema');
+        let type = raw['type'];
+        let nullable = false;
+        if (Array.isArray(type)) {
+            nullable = type.includes('null');
+            const nonNull = type.filter((item) => item !== 'null');
+            if (type.length !== 2 || nonNull.length !== 1)
+                issue(path, 'unsupported-schema');
+            type = nonNull[0];
+        }
+        const hasEnum = Object.hasOwn(raw, 'enum');
+        const hasConst = Object.hasOwn(raw, 'const');
+        const rawChoices = hasEnum ? raw['enum'] : hasConst ? [raw['const']] : undefined;
+        let choices;
+        if (rawChoices !== undefined) {
+            if (!Array.isArray(rawChoices) || rawChoices.length === 0 || rawChoices.length > 1000 || !rawChoices.every(scalar))
+                issue(path, 'invalid-schema');
+            else {
+                choices = [...rawChoices];
+                if (hasConst)
+                    choices = choices.filter((item) => same(item, raw['const']));
+                if (!choices.length)
+                    issue(path, 'invalid-schema');
+            }
+        }
+        else if (hasEnum)
+            issue(path, 'invalid-schema');
+        if (type === undefined)
+            type = choices ? 'enum' : 'string';
+        else if (type === 'enum') {
+            issue(path, 'invalid-schema');
+            continue;
+        }
+        if (!['string', 'number', 'integer', 'boolean', 'enum'].includes(String(type))) {
+            issue(path, 'unsupported-schema');
+            continue;
+        }
+        if (type === 'enum')
+            nullable = choices?.includes(null) ?? false;
+        const field = {
+            key, title: String(raw['title'] ?? key), description: String(raw['description'] ?? ''),
+            type: type, nullable, required: requiredKeys.has(key), readonly: raw['readOnly'] === true,
+            choices, hasDefault: Object.hasOwn(raw, 'default'), defaultValue: scalar(raw['default']) ? raw['default'] : undefined,
+            minimum: undefined, maximum: undefined, exclusiveMinimum: undefined, exclusiveMaximum: undefined,
+            multipleOf: undefined, minLength: undefined, maxLength: undefined,
+        };
+        for (const constraint of ['minimum', 'maximum', 'exclusiveMinimum', 'exclusiveMaximum', 'multipleOf', 'minLength', 'maxLength']) {
+            const value = raw[constraint];
+            if (value === undefined)
+                continue;
+            if (typeof value !== 'number' || !Number.isFinite(value)
+                || (constraint === 'multipleOf' && value <= 0)
+                || ((constraint === 'minLength' || constraint === 'maxLength') && (!Number.isSafeInteger(value) || value < 0)))
+                issue(`${path}/${constraint}`, 'invalid-schema');
+            else
+                field[constraint] = value;
+        }
+        if (choices?.some((choice) => !matches(field, choice)))
+            issue(path, 'invalid-schema');
+        if (field.hasDefault && (!scalar(raw['default']) || !matches(field, raw['default']) || (choices && !choices.some((choice) => same(choice, raw['default'])))))
+            issue(path, 'invalid-schema');
+        model.fields.push(field);
+    }
+    return model;
+}
+/** 只为不存在的键补默认值；显式 undefined 表示用户已清空，不重新灌回默认值。 */
+export function schemaFormValues(model, value) {
+    const result = { ...value };
+    for (const field of model.fields)
+        if (!Object.hasOwn(value, field.key) && field.hasDefault)
+            result[field.key] = field.defaultValue;
+    return result;
+}
+export function parseSchemaNumber(raw) {
+    if (raw.trim() === '')
+        return undefined;
+    if (!/^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i.test(raw.trim()))
+        throw new Error('invalid-value');
+    const value = Number(raw);
+    if (!Number.isFinite(value))
+        throw new Error('invalid-value');
+    return value;
+}
+export function enumIndex(choices, value) {
+    const index = choices.findIndex((choice) => same(choice, value));
+    return index < 0 ? '' : String(index);
+}
+export function enumValue(choices, index) {
+    if (index === '')
+        return undefined;
+    if (!/^(0|[1-9]\d*)$/.test(index))
+        throw new Error('invalid-value');
+    const value = choices[Number(index)];
+    if (value === undefined)
+        throw new Error('invalid-value');
+    return value;
+}
+export function validateSchemaForm(model, value) {
+    const issues = [...model.issues];
+    if (!record(value))
+        return [...issues, { path: '', code: 'invalid-value' }];
+    for (const field of model.fields) {
+        const path = pointer(field.key), current = Object.hasOwn(value, field.key) ? value[field.key] : undefined;
+        const issue = (code) => { issues.push({ path, code }); };
+        if (current === undefined) {
+            if (field.required)
+                issue('required');
+            continue;
+        }
+        if (!matches(field, current)) {
+            issue('type');
+            continue;
+        }
+        if (field.choices && !field.choices.some((choice) => same(choice, current)))
+            issue('enum');
+        if (typeof current === 'number') {
+            if ((field.minimum !== undefined && current < field.minimum) || (field.exclusiveMinimum !== undefined && current <= field.exclusiveMinimum))
+                issue('minimum');
+            if ((field.maximum !== undefined && current > field.maximum) || (field.exclusiveMaximum !== undefined && current >= field.exclusiveMaximum))
+                issue('maximum');
+            if (field.multipleOf !== undefined) {
+                const quotient = current / field.multipleOf;
+                if (!Number.isFinite(quotient) || Math.abs(quotient - Math.round(quotient)) > Math.min(1e-8, Number.EPSILON * Math.max(1, Math.abs(quotient)) * 4))
+                    issue('multipleOf');
+            }
+        }
+        if (typeof current === 'string') {
+            const length = Array.from(current).length;
+            if (field.minLength !== undefined && length < field.minLength)
+                issue('minLength');
+            if (field.maxLength !== undefined && length > field.maxLength)
+                issue('maxLength');
+        }
+    }
+    const keys = new Set(model.fields.map((field) => field.key));
+    for (const [key, current] of Object.entries(value)) {
+        if (unsafeKeys.has(key))
+            issues.push({ path: pointer(key), code: 'invalid-value' });
+        if (!model.additionalProperties && !keys.has(key) && current !== undefined)
+            issues.push({ path: pointer(key), code: 'additionalProperties' });
+    }
+    return issues;
+}
+// Reuse the hardened recursive form transport boundary, including accessor/symbol rejection.
+export { schemaFormSnapshot } from '../json-schema-form-state.js';

package/dist/components/enterprise/recursive-schema-form.d.ts

@@ -0,0 +1,30 @@
+import { type SchemaFormModel, type SchemaFormIssue } from './json-schema-form.js';
+type Node = {
+    kind: 'object';
+    properties: Record<string, Node>;
+    required: Set<string>;
+    additional: boolean;
+    nullable: boolean;
+} | {
+    kind: 'array';
+    item: Node;
+    min: number | undefined;
+    max: number | undefined;
+    nullable: boolean;
+} | {
+    kind: 'scalar';
+    model: SchemaFormModel;
+};
+export interface RecursiveSchemaFormModel {
+    node: Node | undefined;
+    issues: SchemaFormIssue[];
+}
+export declare const schemaFormPointer: (path: readonly string[]) => string;
+/** Compile bounded objects/arrays, delegating scalar assertions to the reviewed leaf validator.
+ * Unsupported assertions fail closed; this is deliberately not a complete JSON Schema engine.
+ * TypeBox's symbol annotations are not JSON assertion keywords and are not executed.
+ */
+export declare function readRecursiveSchemaForm(schema: unknown): RecursiveSchemaFormModel;
+/** Validate a detached JSON payload without defaults, coercion, cleaning or partial acceptance. */
+export declare function validateRecursiveSchemaForm(model: RecursiveSchemaFormModel, value: unknown): SchemaFormIssue[];
+export {};

package/dist/components/enterprise/recursive-schema-form.js

@@ -0,0 +1,196 @@
+import { readSchemaForm, validateSchemaForm } from './json-schema-form.js';
+import { SCHEMA_FORM_LIMITS, schemaFormSnapshot } from '../json-schema-form-state.js';
+const annotationKeys = ['$schema', '$id', '$comment', 'title', 'description', 'type', 'default', 'readOnly', 'writeOnly', 'deprecated', 'examples'];
+const objectKeys = new Set([...annotationKeys, 'properties', 'required', 'additionalProperties']);
+const arrayKeys = new Set([...annotationKeys, 'items', 'minItems', 'maxItems']);
+const unsafe = new Set(['__proto__', 'prototype', 'constructor']);
+export const schemaFormPointer = (path) => path.map(key => '/' + key.replaceAll('~', '~0').replaceAll('/', '~1')).join('');
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+function dataRecord(value) {
+    return record(value) && Object.keys(value).every(key => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        return descriptor !== undefined && 'value' in descriptor;
+    });
+}
+/** Compile bounded objects/arrays, delegating scalar assertions to the reviewed leaf validator.
+ * Unsupported assertions fail closed; this is deliberately not a complete JSON Schema engine.
+ * TypeBox's symbol annotations are not JSON assertion keywords and are not executed.
+ */
+export function readRecursiveSchemaForm(schema) {
+    const issues = [];
+    const active = new Set();
+    let visited = 0;
+    const issue = (path, code) => {
+        if (issues.length < 128)
+            issues.push({ path, code });
+    };
+    function read(raw, path, depth, root = false) {
+        if (++visited > SCHEMA_FORM_LIMITS.nodes || depth > SCHEMA_FORM_LIMITS.depth || !dataRecord(raw) || active.has(raw)) {
+            issue(path, 'invalid-schema');
+            return;
+        }
+        active.add(raw);
+        try {
+            let type = raw['type'];
+            let nullable = false;
+            if (Array.isArray(type)) {
+                const concrete = type.filter(value => value !== 'null');
+                if (type.length !== 2 || concrete.length !== 1 || !type.includes('null')) {
+                    issue(path, 'unsupported-schema');
+                    return;
+                }
+                nullable = true;
+                type = concrete[0];
+            }
+            if (type === undefined && (root || Object.hasOwn(raw, 'properties')))
+                type = 'object';
+            if (root && type !== 'object') {
+                issue(path, 'unsupported-schema');
+                return;
+            }
+            for (const key of ['readOnly', 'writeOnly', 'deprecated']) {
+                if (raw[key] !== undefined && typeof raw[key] !== 'boolean')
+                    issue(path + '/' + key, 'invalid-schema');
+            }
+            if (Object.hasOwn(raw, 'default')) {
+                try {
+                    schemaFormSnapshot({ value: raw['default'] });
+                }
+                catch {
+                    issue(path + '/default', 'invalid-schema');
+                }
+            }
+            if (type !== 'object' && type !== 'array') {
+                const model = readSchemaForm({ type: 'object', properties: { value: raw } });
+                for (const failure of model.issues)
+                    issue(path + failure.path.replace(/^\/value(?=\/|$)/u, ''), failure.code);
+                return { kind: 'scalar', model };
+            }
+            const allowed = type === 'object' ? objectKeys : arrayKeys;
+            for (const key of Object.keys(raw))
+                if (!allowed.has(key))
+                    issue(path + '/' + key, 'unsupported-schema');
+            if (type === 'object') {
+                const properties = raw['properties'] ?? {};
+                if (!dataRecord(properties) || Object.keys(properties).length > 256 || raw['properties'] === null) {
+                    issue(path + '/properties', 'invalid-schema');
+                    return;
+                }
+                const keys = raw['required'] ?? [];
+                if (!Array.isArray(keys) || keys.length > 256 || raw['required'] === null
+                    || new Set(keys).size !== keys.length || keys.some(key => typeof key !== 'string' || !Object.hasOwn(properties, key))) {
+                    issue(path + '/required', 'invalid-schema');
+                    return;
+                }
+                if (raw['additionalProperties'] !== undefined && typeof raw['additionalProperties'] !== 'boolean') {
+                    issue(path + '/additionalProperties', 'unsupported-schema');
+                }
+                const result = Object.create(null);
+                for (const [key, child] of Object.entries(properties)) {
+                    const childPath = path + schemaFormPointer([key]);
+                    if (unsafe.has(key)) {
+                        issue(childPath, 'invalid-schema');
+                        continue;
+                    }
+                    const node = read(child, childPath, depth + 1);
+                    if (node)
+                        result[key] = node;
+                }
+                return { kind: 'object', properties: result, required: new Set(keys), additional: raw['additionalProperties'] !== false, nullable };
+            }
+            const item = read(raw['items'], path + '/items', depth + 1);
+            const definition = raw;
+            function bound(key) {
+                const value = definition[key];
+                if (value === undefined)
+                    return;
+                if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+                    issue(path + '/' + key, 'invalid-schema');
+                    return;
+                }
+                return value;
+            }
+            const min = bound('minItems'), max = bound('maxItems');
+            if (min !== undefined && max !== undefined && min > max)
+                issue(path, 'invalid-schema');
+            return item ? { kind: 'array', item, min, max, nullable } : undefined;
+        }
+        finally {
+            active.delete(raw);
+        }
+    }
+    let node;
+    try {
+        node = read(schema, '', 0, true);
+    }
+    catch {
+        issue('', 'invalid-schema');
+    }
+    return { node, issues };
+}
+/** Validate a detached JSON payload without defaults, coercion, cleaning or partial acceptance. */
+export function validateRecursiveSchemaForm(model, value) {
+    if (model.issues.length || !model.node)
+        return model.issues.length ? [...model.issues] : [{ path: '', code: 'invalid-schema' }];
+    const issues = [];
+    const issue = (path, code) => {
+        if (issues.length < 128)
+            issues.push({ path, code });
+    };
+    let payload;
+    try {
+        payload = schemaFormSnapshot(value);
+    }
+    catch {
+        return [{ path: '', code: 'invalid-value' }];
+    }
+    let visited = 0;
+    function visit(node, current, path, required, depth) {
+        if (++visited > SCHEMA_FORM_LIMITS.nodes || depth > SCHEMA_FORM_LIMITS.depth) {
+            issue(path, 'invalid-value');
+            return;
+        }
+        if (current === undefined) {
+            if (required)
+                issue(path, 'required');
+            return;
+        }
+        if (node.kind === 'scalar') {
+            for (const failure of validateSchemaForm(node.model, { value: current }))
+                issue(path + failure.path.replace(/^\/value(?=\/|$)/u, ''), failure.code);
+            return;
+        }
+        if (current === null && node.nullable)
+            return;
+        if (node.kind === 'object') {
+            if (!record(current)) {
+                issue(path, 'type');
+                return;
+            }
+            for (const [key, child] of Object.entries(node.properties)) {
+                visit(child, Object.hasOwn(current, key) ? current[key] : undefined, path + schemaFormPointer([key]), node.required.has(key), depth + 1);
+            }
+            if (!node.additional)
+                for (const key of Object.keys(current)) {
+                    if (!Object.hasOwn(node.properties, key))
+                        issue(path + schemaFormPointer([key]), 'additionalProperties');
+                }
+            return;
+        }
+        if (!Array.isArray(current)) {
+            issue(path, 'type');
+            return;
+        }
+        if (node.min !== undefined && current.length < node.min)
+            issue(path, 'minItems');
+        if (node.max !== undefined && current.length > node.max)
+            issue(path, 'maxItems');
+        for (const [index, item] of current.entries())
+            visit(node.item, item, path + '/' + index, true, depth + 1);
+    }
+    visit(model.node, payload, '', true, 0);
+    return issues;
+}

package/dist/components/enterprise/spreadsheet-formula.d.ts

@@ -0,0 +1,12 @@
+/** 有界、无动态代码执行的轻量公式解析器；不是完整 Excel 公式引擎。 */
+export declare const FORMULA_LIMITS: Readonly<{
+    length: 2048;
+    tokens: 1024;
+    depth: 64;
+    work: 10000;
+    range: 10000;
+}>;
+export type FormulaErrorCode = '#VALUE!' | '#REF!' | '#NAME?' | '#DIV/0!' | '#NUM!' | '#CYCLE!' | '#LIMIT!';
+export declare function evaluateFormula(raw: string, cells: Readonly<Record<string, string>>): number | string;
+/** 文本导出不能把危险前缀当成外部电子表格公式；调用者仍需完成 CSV 引号转义。 */
+export declare function safeSpreadsheetCsvText(value: string): string;

package/dist/components/enterprise/spreadsheet-formula.js

@@ -0,0 +1,245 @@
+/** 有界、无动态代码执行的轻量公式解析器；不是完整 Excel 公式引擎。 */
+export const FORMULA_LIMITS = Object.freeze({ length: 2048, tokens: 1024, depth: 64, work: 10000, range: 10000 });
+class FormulaError extends Error {
+    code;
+    constructor(code) { super(code); this.code = code; }
+}
+function fail(code) { throw new FormulaError(code); }
+function finite(value) { return Number.isFinite(value) ? value : fail('#NUM!'); }
+function numeric(value) {
+    if (value === null)
+        return 0;
+    return typeof value === 'number' ? value : fail('#VALUE!');
+}
+const decimal = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i;
+function address(key) {
+    const match = /^\$?([A-Z]+)\$?(\d+)$/i.exec(key);
+    if (!match?.[1] || !match[2])
+        return fail('#REF!');
+    let column = 0;
+    for (const char of match[1].toUpperCase()) {
+        column = column * 26 + char.charCodeAt(0) - 64;
+        if (column > 16384)
+            return fail('#REF!');
+    }
+    const row = Number(match[2]);
+    if (row < 1 || row > 1048576 || !Number.isSafeInteger(row))
+        return fail('#REF!');
+    return { column, row };
+}
+function columnName(column) {
+    let name = '';
+    while (column > 0) {
+        column--;
+        name = String.fromCharCode(65 + column % 26) + name;
+        column = Math.floor(column / 26);
+    }
+    return name;
+}
+class Evaluation {
+    work = 0;
+    depth = 0;
+    active = new Set();
+    cache = new Map();
+    cells;
+    constructor(cells) { this.cells = cells; }
+    tick() { if (++this.work > FORMULA_LIMITS.work)
+        fail('#LIMIT!'); }
+    bounded(fn) {
+        if (++this.depth > FORMULA_LIMITS.depth) {
+            this.depth--;
+            return fail('#LIMIT!');
+        }
+        try {
+            return fn();
+        }
+        finally {
+            this.depth--;
+        }
+    }
+    cell(key) {
+        this.tick();
+        const parsed = address(key);
+        const normalized = `${columnName(parsed.column)}${parsed.row}`;
+        if (this.active.has(normalized))
+            return fail('#CYCLE!');
+        if (this.cache.has(normalized))
+            return this.cache.get(normalized) ?? null;
+        const raw = Object.hasOwn(this.cells, normalized) ? this.cells[normalized] : '';
+        if (typeof raw !== 'string')
+            return fail('#VALUE!');
+        this.active.add(normalized);
+        try {
+            const trimmed = raw.trim();
+            const value = raw.startsWith('=')
+                ? new Parser(raw.slice(1), this).parse()
+                : trimmed === '' ? null : decimal.test(trimmed) ? finite(Number(trimmed)) : raw;
+            this.cache.set(normalized, value);
+            return value;
+        }
+        finally {
+            this.active.delete(normalized);
+        }
+    }
+    range(start, end) {
+        const a = address(start);
+        const b = address(end);
+        const left = Math.min(a.column, b.column), right = Math.max(a.column, b.column);
+        const top = Math.min(a.row, b.row), bottom = Math.max(a.row, b.row);
+        if ((right - left + 1) * (bottom - top + 1) > FORMULA_LIMITS.range)
+            return fail('#LIMIT!');
+        const values = [];
+        for (let row = top; row <= bottom; row++) {
+            for (let column = left; column <= right; column++)
+                values.push(this.cell(`${columnName(column)}${row}`));
+        }
+        return values;
+    }
+}
+class Parser {
+    tokens = [];
+    position = 0;
+    context;
+    constructor(source, context) {
+        this.context = context;
+        if (source.length + 1 > FORMULA_LIMITS.length)
+            fail('#LIMIT!');
+        let rest = source;
+        while (rest.length) {
+            rest = rest.trimStart();
+            if (!rest)
+                break;
+            context.tick();
+            if (this.tokens.length >= FORMULA_LIMITS.tokens)
+                fail('#LIMIT!');
+            const number = /^(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?/i.exec(rest)?.[0];
+            const cell = /^\$?[A-Z]+\$?\d+/i.exec(rest)?.[0];
+            const name = /^[A-Z_][A-Z_0-9]*/i.exec(rest)?.[0];
+            let token;
+            if (number)
+                token = { kind: 'number', text: number };
+            else if (cell)
+                token = { kind: 'cell', text: cell.toUpperCase() };
+            else if (name)
+                token = { kind: 'name', text: name.toUpperCase() };
+            else if (/^[+\-*/(),:]/.test(rest))
+                token = { kind: 'symbol', text: rest[0] ?? '' };
+            else
+                return fail('#VALUE!');
+            this.tokens.push(token);
+            rest = rest.slice(token.text.length);
+        }
+        this.tokens.push({ kind: 'end', text: '' });
+    }
+    peek() { return this.tokens[this.position] ?? { kind: 'end', text: '' }; }
+    take() { this.context.tick(); const token = this.peek(); this.position++; return token; }
+    expect(text) { if (this.take().text !== text)
+        fail('#VALUE!'); }
+    parse() {
+        return this.context.bounded(() => {
+            const result = this.expression();
+            if (this.peek().kind !== 'end')
+                return fail('#VALUE!');
+            return result;
+        });
+    }
+    expression() {
+        let value = this.product();
+        while (this.peek().text === '+' || this.peek().text === '-') {
+            const op = this.take().text;
+            const right = numeric(this.product()), left = numeric(value);
+            value = finite(op === '+' ? left + right : left - right);
+        }
+        return value;
+    }
+    product() {
+        let value = this.unary();
+        while (this.peek().text === '*' || this.peek().text === '/') {
+            const op = this.take().text;
+            const right = numeric(this.unary()), left = numeric(value);
+            if (op === '/' && right === 0)
+                return fail('#DIV/0!');
+            value = finite(op === '*' ? left * right : left / right);
+        }
+        return value;
+    }
+    unary() {
+        if (this.peek().text === '+' || this.peek().text === '-') {
+            const negative = this.take().text === '-';
+            return this.context.bounded(() => finite(numeric(this.unary()) * (negative ? -1 : 1)));
+        }
+        return this.primary();
+    }
+    primary() {
+        const token = this.take();
+        if (token.kind === 'number')
+            return finite(Number(token.text));
+        if (token.kind === 'cell')
+            return this.context.cell(token.text);
+        if (token.text === '(')
+            return this.context.bounded(() => {
+                const value = this.expression();
+                this.expect(')');
+                return value;
+            });
+        if (token.kind === 'name')
+            return this.context.bounded(() => this.aggregate(token.text));
+        return fail('#VALUE!');
+    }
+    aggregate(name) {
+        if (!['SUM', 'AVG', 'AVERAGE', 'COUNT', 'MIN', 'MAX'].includes(name))
+            return fail('#NAME?');
+        this.expect('(');
+        const values = [];
+        if (this.peek().text !== ')') {
+            while (true) {
+                if (this.peek().kind === 'cell' && this.tokens[this.position + 1]?.text === ':') {
+                    const start = this.take().text;
+                    this.expect(':');
+                    const end = this.take();
+                    if (end.kind !== 'cell')
+                        return fail('#REF!');
+                    for (const value of this.context.range(start, end.text))
+                        if (typeof value === 'number')
+                            values.push(value);
+                }
+                else {
+                    const value = this.expression();
+                    if (typeof value === 'number')
+                        values.push(value);
+                }
+                if (this.peek().text !== ',')
+                    break;
+                this.take();
+            }
+        }
+        this.expect(')');
+        if (name === 'COUNT')
+            return values.length;
+        if (name === 'MIN' || name === 'MAX') {
+            if (!values.length)
+                return 0;
+            return values.reduce((a, b) => name === 'MIN' ? Math.min(a, b) : Math.max(a, b));
+        }
+        const sum = finite(values.reduce((a, b) => finite(a + b), 0));
+        if (name === 'SUM')
+            return sum;
+        return values.length ? finite(sum / values.length) : fail('#DIV/0!');
+    }
+}
+export function evaluateFormula(raw, cells) {
+    if (!raw.startsWith('='))
+        return raw;
+    try {
+        return new Parser(raw.slice(1), new Evaluation(cells)).parse() ?? 0;
+    }
+    catch (error) {
+        if (error instanceof FormulaError)
+            return error.code;
+        throw error;
+    }
+}
+/** 文本导出不能把危险前缀当成外部电子表格公式；调用者仍需完成 CSV 引号转义。 */
+export function safeSpreadsheetCsvText(value) {
+    return /^[\s\uFEFF]*[=+\-@]/u.test(value) || /^[\t\r\n]/.test(value) ? `'${value}` : value;
+}