@xlsxflow/core 1.1.1 → 1.1.3

package/CHANGELOG.md

@@ -1,94 +1,122 @@
-# Changelog
-
-## 1.1.1
-
-- README: the XlsxFlow website address, and Pro at a flat $5.
-- More npm keywords: `xls` and `ods`.
-
-## 1.1.0
-
-### Added
-
-- `SheetWriter`: workbook properties (title, author, company and so on), defined names, hidden and very hidden sheets, and sheet views (zoom, gridlines, headings, right-to-left). `SheetReader.readWorkbook` reads them back.
-- `{ formatted: true }` reports each cell's text as Excel shows it, from its number format.
-- `SheetEditor.insertRows`, `deleteRows`, `insertColumns` and `deleteColumns`. Everything that points at the moved cells moves with them: formulas on all sheets, defined names, merges, conditional formats, validations, hyperlinks, filters, page breaks, column widths, tables, pictures, notes, sparklines, data tables, chart series and pivot sources.
-- `SheetEditor.setCells` edits and restyles cells of existing files; `addSheet` and `deleteSheet` add and remove sheets.
-- `parseCsv` streams CSV rows, which `SheetWriter.addSheet` turns into a sheet.
-- `SheetReader` reads Excel 97-2003 `.xls` files and OpenDocument `.ods` files: values, dates, formula results, merges, hidden rows, columns and sheets, frozen panes, defined names and document properties. `.ods` also gives formulas, hyperlinks and notes.
-- `OdsWriter` writes `.ods` files: values, dates, formulas, merges, column widths, frozen panes and hidden sheets.
-- Password-protected `.xlsx` files are rejected with an error that points to `decryptWorkbook` in `@xlsxflow/pro`, instead of a ZIP error.
-- Cell notes on write (plain or formatted text) and `getComments()` on read.
-- Conditional formats `cellIs`, `expression`, `top10`, `aboveAverage`, text rules, `duplicateValues`/`uniqueValues` and `iconSet`.
-- Excel tables, sheet protection, page setup (margins, header and footer, print area and titles), row heights, hidden rows and columns, outline grouping, tab colour, and validation operators and messages.
-- `Date` cell values, hyperlinks (URLs and locations in the workbook), `autoFilter`, and an optional shared string table on write.
-- Reading returns formulas (`formulas: true`, shared formulas expanded), styles (`styles: true`) and rich text (`richText: true`). Theme and indexed colours are resolved to ARGB.
-- PNG, JPEG and GIF images (`images` sheet option), anchored to a cell or stretched over a range. `getImages()` reads them back.
-- Low-level parts are exported for add-ons: the ZIP reader and writer, `resolveWorkbookParts`, `readSharedStrings`, and `mapFormulaRefs`/`shiftFormula`.
-- Tested: `.xlsm` files keep their macros through `SheetEditor`; the library runs in Cloudflare Workers without `nodejs_compat` (`scripts/workers` checks it).
-
-### Security
-
-Fixed crashes, hangs and memory blowups caused by crafted files:
-
-- A ZIP directory pointing outside the file crashed Node.
-- Unclosed tags and elements made the parser quadratic. The XML tokenizer is now linear on giant tags, text nodes and CDATA.
-- Repeated hidden columns, far-right cells, fraction formats with long denominators and large style tables were slow or used unbounded memory.
-- One deflated entry could be read many times under different names.
-
-Also:
-
-- `SheetEditor.edit` takes `maxUncompressedBytes`.
-- Option values typed as enums are escaped, and appended rows encode control characters.
-- `sheetToJson` keeps a `__proto__` header as an ordinary key.
-- In-memory parts are capped at 1 GiB uncompressed by default.
-
-### Fixed
-
-- Sheets with frozen panes were all marked as selected, so Excel opened them grouped.
-- The reader dropped or corrupted cells at stream chunk boundaries.
-- Styles pointed at the wrong font, fill or border, and styles used only by `AsyncIterable` rows were missing from `styles.xml`.
-- Number formats with quoted text, escapes or colours (`#,##0.00 "USD"`, `[Red]0.0`) were taken for date formats.
-- Reading a corrupt file without calling `getMetadata()` caused an unhandled promise rejection, which is fatal in Node.
-- `addSheet` accepted sheet names Excel refuses to open. It now throws.
-- Files Excel would repair:
-  - gradient stops were written as `<gradientStop>`;
-  - `vertical: 'middle'` was written as is instead of `center`;
-  - conditional formats came after validations.
-- Data bar `minValue`/`maxValue` were ignored, every conditional format had priority 1, and colours and ranges were not XML-escaped.
-- Strings with `_xHHHH_`, control characters, CR, or leading and trailing spaces now survive a round trip. `NaN` and `Infinity` are written as `#NUM!`.
-- Reader:
-  - Strict OOXML and non-standard part names work;
-  - empty `<v/>` reads as empty and `-0` as `0`;
-  - out-of-order cells land in the right column;
-  - time-only values are no longer a day off, and datetimes keep milliseconds.
-  - frozen panes saved by Excel as `frozenSplit` (frozen after a split) are reported.
-- `sheetToJson` ignored its `headerRowIndex` argument.
-
-### Changed
-
-- The package ships compiled ESM and CommonJS builds with type declarations.
-- Browser bundles no longer try to resolve Node's `fs`.
-- `[Content_Types].xml` is written last in the ZIP.
-- Real backpressure in the ZIP writer and worksheet stream. Producer errors now error the output stream instead of hanging it.
-- About 2.5× faster reads, and a table-driven CRC-32 for faster writes.
-- Styles, formulas and conditional formats are part of the MIT core. Paid add-ons are in the separate `@xlsxflow/pro` package.
-- Benchmarks corrected: the earlier ExcelJS write time came from a cold first run, and write-excel-file was run with an old API.
-
-## 1.0.0
-
-- `SheetWriter` and `SheetEditor` stream the ZIP with data descriptors instead of buffering the file in memory.
-- Dates are returned as ISO-8601 strings, detected from each cell's number format.
-
-## 0.3.0-beta
-
-- Workbooks with several sheets.
-- Fixed a buffer bug that made parsing quadratic.
-
-## 0.2.0-beta
-
-- Deflate compression with `CompressionStream`: a 1M-cell file went from 30 MB to 2.9 MB.
-- Inline and rich text strings are read.
-
-## 0.1.0-beta
-
-- First release: streaming reader, writer, and shared strings.
+# Changelog
+
+## 1.1.3
+
+### Fixed
+
+- `SheetEditor.setCells` refuses addresses past column XFD or row 1,048,576, instead of writing a file Excel reports as damaged.
+- `SheetWriter` and `SheetEditor` refuse text longer than Excel's 32,767 characters per cell.
+- Colours are checked: ARGB (`FFFF0000`) and RGB (`FF0000`, `#FF0000`) hex are accepted, anything else (`'red'`) throws instead of making Excel repair the file.
+- Picture anchors past the last column or row throw; a range given the wrong way round (`F20:A2`) is turned round.
+- `SheetReader`: a shared string index past the end of the table reads as an empty cell, not as the index.
+
+### Added
+
+- `checkCellText` is exported, for `@xlsxflow/pro`.
+
+## 1.1.2
+
+### Fixed
+
+- `SheetWriter` throws an error for a row longer than 16,384 cells or past row 1,048,576, instead of writing a file Excel reports as damaged.
+- `SheetEditor.setCells`: a date in a cell without a date format gets `yyyy-mm-dd` (or `yyyy-mm-dd hh:mm:ss` with a time), as in `SheetWriter`, instead of showing as a serial number.
+- `OdsWriter` stores formula results, so readers that don't recalculate show them.
+- `sheetToJson` keeps every column when headers repeat: the second `Name` becomes `Name_2`.
+- `parseCsv` returns `null` for empty unquoted fields with `{ convert: false }` too.
+
+### Added
+
+- `StylePatcher` is exported, for `@xlsxflow/pro`.
+
+## 1.1.1
+
+- README: the XlsxFlow website address, and Pro at a flat $5.
+- More npm keywords: `xls` and `ods`.
+
+## 1.1.0
+
+### Added
+
+- `SheetWriter`: workbook properties (title, author, company and so on), defined names, hidden and very hidden sheets, and sheet views (zoom, gridlines, headings, right-to-left). `SheetReader.readWorkbook` reads them back.
+- `{ formatted: true }` reports each cell's text as Excel shows it, from its number format.
+- `SheetEditor.insertRows`, `deleteRows`, `insertColumns` and `deleteColumns`. Everything that points at the moved cells moves with them: formulas on all sheets, defined names, merges, conditional formats, validations, hyperlinks, filters, page breaks, column widths, tables, pictures, notes, sparklines, data tables, chart series and pivot sources.
+- `SheetEditor.setCells` edits and restyles cells of existing files; `addSheet` and `deleteSheet` add and remove sheets.
+- `parseCsv` streams CSV rows, which `SheetWriter.addSheet` turns into a sheet.
+- `SheetReader` reads Excel 97-2003 `.xls` files and OpenDocument `.ods` files: values, dates, formula results, merges, hidden rows, columns and sheets, frozen panes, defined names and document properties. `.ods` also gives formulas, hyperlinks and notes.
+- `OdsWriter` writes `.ods` files: values, dates, formulas, merges, column widths, frozen panes and hidden sheets.
+- Password-protected `.xlsx` files are rejected with an error that points to `decryptWorkbook` in `@xlsxflow/pro`, instead of a ZIP error.
+- Cell notes on write (plain or formatted text) and `getComments()` on read.
+- Conditional formats `cellIs`, `expression`, `top10`, `aboveAverage`, text rules, `duplicateValues`/`uniqueValues` and `iconSet`.
+- Excel tables, sheet protection, page setup (margins, header and footer, print area and titles), row heights, hidden rows and columns, outline grouping, tab colour, and validation operators and messages.
+- `Date` cell values, hyperlinks (URLs and locations in the workbook), `autoFilter`, and an optional shared string table on write.
+- Reading returns formulas (`formulas: true`, shared formulas expanded), styles (`styles: true`) and rich text (`richText: true`). Theme and indexed colours are resolved to ARGB.
+- PNG, JPEG and GIF images (`images` sheet option), anchored to a cell or stretched over a range. `getImages()` reads them back.
+- Low-level parts are exported for add-ons: the ZIP reader and writer, `resolveWorkbookParts`, `readSharedStrings`, and `mapFormulaRefs`/`shiftFormula`.
+- Tested: `.xlsm` files keep their macros through `SheetEditor`; the library runs in Cloudflare Workers without `nodejs_compat` (`scripts/workers` checks it).
+
+### Security
+
+Fixed crashes, hangs and memory blowups caused by crafted files:
+
+- A ZIP directory pointing outside the file crashed Node.
+- Unclosed tags and elements made the parser quadratic. The XML tokenizer is now linear on giant tags, text nodes and CDATA.
+- Repeated hidden columns, far-right cells, fraction formats with long denominators and large style tables were slow or used unbounded memory.
+- One deflated entry could be read many times under different names.
+
+Also:
+
+- `SheetEditor.edit` takes `maxUncompressedBytes`.
+- Option values typed as enums are escaped, and appended rows encode control characters.
+- `sheetToJson` keeps a `__proto__` header as an ordinary key.
+- In-memory parts are capped at 1 GiB uncompressed by default.
+
+### Fixed
+
+- Sheets with frozen panes were all marked as selected, so Excel opened them grouped.
+- The reader dropped or corrupted cells at stream chunk boundaries.
+- Styles pointed at the wrong font, fill or border, and styles used only by `AsyncIterable` rows were missing from `styles.xml`.
+- Number formats with quoted text, escapes or colours (`#,##0.00 "USD"`, `[Red]0.0`) were taken for date formats.
+- Reading a corrupt file without calling `getMetadata()` caused an unhandled promise rejection, which is fatal in Node.
+- `addSheet` accepted sheet names Excel refuses to open. It now throws.
+- Files Excel would repair:
+  - gradient stops were written as `<gradientStop>`;
+  - `vertical: 'middle'` was written as is instead of `center`;
+  - conditional formats came after validations.
+- Data bar `minValue`/`maxValue` were ignored, every conditional format had priority 1, and colours and ranges were not XML-escaped.
+- Strings with `_xHHHH_`, control characters, CR, or leading and trailing spaces now survive a round trip. `NaN` and `Infinity` are written as `#NUM!`.
+- Reader:
+  - Strict OOXML and non-standard part names work;
+  - empty `<v/>` reads as empty and `-0` as `0`;
+  - out-of-order cells land in the right column;
+  - time-only values are no longer a day off, and datetimes keep milliseconds.
+  - frozen panes saved by Excel as `frozenSplit` (frozen after a split) are reported.
+- `sheetToJson` ignored its `headerRowIndex` argument.
+
+### Changed
+
+- The package ships compiled ESM and CommonJS builds with type declarations.
+- Browser bundles no longer try to resolve Node's `fs`.
+- `[Content_Types].xml` is written last in the ZIP.
+- Real backpressure in the ZIP writer and worksheet stream. Producer errors now error the output stream instead of hanging it.
+- About 2.5× faster reads, and a table-driven CRC-32 for faster writes.
+- Styles, formulas and conditional formats are part of the MIT core. Paid add-ons are in the separate `@xlsxflow/pro` package.
+- Benchmarks corrected: the earlier ExcelJS write time came from a cold first run, and write-excel-file was run with an old API.
+
+## 1.0.0
+
+- `SheetWriter` and `SheetEditor` stream the ZIP with data descriptors instead of buffering the file in memory.
+- Dates are returned as ISO-8601 strings, detected from each cell's number format.
+
+## 0.3.0-beta
+
+- Workbooks with several sheets.
+- Fixed a buffer bug that made parsing quadratic.
+
+## 0.2.0-beta
+
+- Deflate compression with `CompressionStream`: a 1M-cell file went from 30 MB to 2.9 MB.
+- Inline and rich text strings are read.
+
+## 0.1.0-beta
+
+- First release: streaming reader, writer, and shared strings.

package/README.md

@@ -83,7 +83,7 @@ Parts held in memory (workbook, shared strings, styles) are capped at 1 GiB unco
 
 **Reading files from untrusted users** (uploads on a server): set `maxUncompressedBytes` to what you expect, such as `50_000_000`. Corrupt or crafted ZIPs (overlapping entries, entries that inflate past their stated size, directories pointing outside the file) are rejected either way. The limit also bounds the empty cells added before far-right cells, since one tiny cell in column XFD pads its row to 16,384 values. Values are returned as written: hyperlinks may be `javascript:` URLs and text may start with `=`, so check them before putting them in a web page or a CSV that a spreadsheet will open.
 
-`sheetToJson(rows, headerRowIndex = 0)` turns the rows into objects keyed by the header row, and `streamToCsv(rows)` returns the sheet as CSV text. Both hold the whole result in memory.
+`sheetToJson(rows, headerRowIndex = 0)` turns the rows into objects keyed by the header row (a repeated header gets a suffix: `Name`, `Name_2`), and `streamToCsv(rows)` returns the sheet as CSV text. Both hold the whole result in memory.
 
 In Node.js, read straight from disk with `XlsxFlow.readFile`, or pass `await createFileReader(path)` to any function that takes a reader:
 
@@ -140,7 +140,7 @@ import { SheetWriter, parseCsv } from '@xlsxflow/core';
 const xlsx = new SheetWriter().addSheet('Data', parseCsv(csvStream)).write();
 ```
 
-Quoted fields can hold delimiters, line breaks and `""`. Unquoted numbers and `TRUE`/`FALSE` become numbers and booleans, and empty fields become empty cells; `{ convert: false }` keeps everything as text, and `{ delimiter: ';' }` sets the delimiter. Dates stay text, since CSV files do not say which date order they use.
+Quoted fields can hold delimiters, line breaks and `""`. Unquoted numbers and `TRUE`/`FALSE` become numbers and booleans, and empty fields become empty cells (`null`; a quoted `""` stays an empty string); `{ convert: false }` keeps everything else as text, and `{ delimiter: ';' }` sets the delimiter. Dates stay text, since CSV files do not say which date order they use.
 
 ### .xls and .ods Files
 
@@ -158,7 +158,7 @@ and document properties. `formatted: true` works on both; `formulas: true` works
   [`@xlsxflow/pro`](#free-and-pro).
 
 `OdsWriter` writes `.ods` with the same rows as `SheetWriter`: values, dates, formulas (converted to
-OpenFormula), merged cells, column widths, frozen panes, hidden sheets and document properties. Cell styles,
+OpenFormula, with their results), merged cells, column widths, frozen panes, hidden sheets and document properties. Cell styles,
 hyperlinks, notes and images are not written to `.ods`.
 
 ```typescript
@@ -224,6 +224,8 @@ writer.addSheet('Sales', [
 });
 ```
 
+Colours are ARGB hex (`FFC00000`); RGB hex (`C00000` or `#C00000`) is opaque. A cell holds at most 32,767 characters, as in Excel.
+
 Other sheet options:
 
 ```typescript

package/dist/index.cjs

@@ -350,7 +350,16 @@ async function sheetToJson(parseResult, headerRowIndex = 0) {
         if (skip-- > 0)
             continue;
         if (headers.length === 0) {
-            headers = row.cells.map((c, i) => (c !== null && c !== undefined ? String(c) : `Column${i + 1}`));
+            const seen = new Set();
+            headers = row.cells.map((c, i) => {
+                const base = c !== null && c !== undefined ? String(c) : `Column${i + 1}`;
+                // A repeated header gets a suffix ("Name_2") so its column isn't lost
+                let name = base;
+                for (let n = 2; seen.has(name); n++)
+                    name = `${base}_${n}`;
+                seen.add(name);
+                return name;
+            });
             continue;
         }
         const obj = {};
@@ -455,6 +464,21 @@ function decodeXString(s) {
 // Excel's sheet size (A..XFD, 1..1048576)
 const MAX_COLUMNS$1 = 16384;
 const MAX_ROWS$1 = 1048576;
+// Excel's limit on the characters in one cell
+const MAX_CELL_TEXT = 32767;
+function checkCellText(s, ref) {
+    if (s.length > MAX_CELL_TEXT)
+        throw new Error(`Cell ${ref} has ${s.length} characters, more than Excel's ${MAX_CELL_TEXT}.`);
+    return s;
+}
+// Colours are ARGB hex ("FFFF0000"); "FF0000" and "#FF0000" get an opaque alpha. Anything else
+// makes Excel repair the file.
+function argb(c) {
+    const m = /^#?([0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.exec(String(c));
+    if (!m)
+        throw new Error(`Invalid colour "${c}": use ARGB hex such as "FFFF0000".`);
+    return (m[1].length === 6 ? 'FF' + m[1] : m[1]).toUpperCase();
+}
 // 0-based column of letters like "BC" (or a reference like "BC12"); -1 when there are none
 function colIndex(ref) {
     const match = ref.match(/[A-Za-z]+/);
@@ -554,6 +578,8 @@ function encodeXString(s) {
         .replace(/_(?=x[0-9A-Fa-f]{4}_)/g, '_x005F_')
         .replace(/[\x00-\x08\x0B\x0C\r\x0E-\x1F]/g, c => `_x${c.charCodeAt(0).toString(16).toUpperCase().padStart(4, '0')}_`);
 }
+// The format SheetWriter gives a date without one: the time only when there is one
+const defaultDateFormat = (d) => d.getTime() % 86400000 === 0 ? 'yyyy-mm-dd' : 'yyyy-mm-dd hh:mm:ss';
 // True when a number format renders dates/times. Ignores quoted text, escapes, colours and
 // locale tags, so "0 \"days\"", "[Red]0.0" and "#,##0 \"USD\"" are not mistaken for dates.
 function isDateFormatCode(code) {
@@ -1450,7 +1476,8 @@ function parseWorksheet(xmlTokenStream, sharedStrings, styles, is1904 = false, o
                                 }
                                 else if (currentCellType === 's') {
                                     const index = parseInt(currentCellValue, 10);
-                                    resolvedValue = sharedStrings.get(index) ?? currentCellValue;
+                                    // An index past the table points nowhere: the cell is empty
+                                    resolvedValue = sharedStrings.get(index) ?? null;
                                 }
                                 else if (currentCellType === 'b') {
                                     resolvedValue = currentCellValue === '1' || currentCellValue === 'true';
@@ -1624,9 +1651,10 @@ async function readSheetImages(readText, readBytes, sheetPath) {
 const escapeXml$4 = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 const cellPos = (ref) => {
     const m = /^\$?([A-Za-z]{1,3})\$?(\d+)$/.exec(ref.trim());
-    if (!m)
+    const col = m ? colIndex(m[1]) : -1, row = m ? parseInt(m[2], 10) - 1 : -1;
+    if (col < 0 || col >= MAX_COLUMNS$1 || row < 0 || row >= MAX_ROWS$1)
         throw new Error(`Invalid anchor cell "${ref}".`);
-    return { col: colIndex(m[1]), row: parseInt(m[2], 10) - 1 };
+    return { col, row };
 };
 const marker = (tag, { col, row }) => `<xdr:${tag}><xdr:col>${col}</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>${row}</xdr:row><xdr:rowOff>0</xdr:rowOff></xdr:${tag}>`;
 const DRAWING_NS = 'xmlns:xdr="http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing" ' +
@@ -1638,9 +1666,11 @@ const DRAWING_NS = 'xmlns:xdr="http://schemas.openxmlformats.org/drawingml/2006/
 function anchorXml(place, natural, body, attrs = '') {
     if ('range' in place) {
         const [from, to = from] = place.range.split(':');
-        const end = cellPos(to);
-        // The object fills the range: it ends at the far edge of the last cell
-        return `<xdr:twoCellAnchor editAs="oneCell"${attrs}>${marker('from', cellPos(from))}${marker('to', { col: end.col + 1, row: end.row + 1 })}${body}<xdr:clientData/></xdr:twoCellAnchor>`;
+        const a = cellPos(from), b = cellPos(to);
+        // The object fills the range, given either way round: it ends at the far edge of the last cell
+        const start = { col: Math.min(a.col, b.col), row: Math.min(a.row, b.row) };
+        const end = { col: Math.max(a.col, b.col) + 1, row: Math.max(a.row, b.row) + 1 };
+        return `<xdr:twoCellAnchor editAs="oneCell"${attrs}>${marker('from', start)}${marker('to', end)}${body}<xdr:clientData/></xdr:twoCellAnchor>`;
     }
     const { width: w, height: h } = natural;
     const width = place.width ?? (place.height ? w * place.height / h : w);
@@ -2625,22 +2655,22 @@ function fontXml(font, nameTag = 'name') {
     if (font.size)
         xml += `<sz val="${escapeXml$3(font.size)}"/>`;
     if (font.color)
-        xml += `<color rgb="${escapeXml$3(font.color)}"/>`;
+        xml += `<color rgb="${argb(font.color)}"/>`;
     if (font.name)
         xml += `<${nameTag} val="${escapeXml$3(font.name)}"/>`;
     return xml;
 }
-const borderSideXml = (tag, s) => s ? `<${tag} style="${escapeXml$3(s.style)}">${s.color ? `<color rgb="${escapeXml$3(s.color)}"/>` : ''}</${tag}>` : `<${tag}/>`;
+const borderSideXml = (tag, s) => s ? `<${tag} style="${escapeXml$3(s.style)}">${s.color ? `<color rgb="${argb(s.color)}"/>` : ''}</${tag}>` : `<${tag}/>`;
 function borderXml(b) {
     const side = borderSideXml;
     return `<border>${side('left', b.left)}${side('right', b.right)}${side('top', b.top)}${side('bottom', b.bottom)}<diagonal/></border>`;
 }
 function fillXml(fill) {
     if (fill.type === 'gradient') {
-        const stops = fill.stops.map(s => `<stop position="${s.position}"><color rgb="${escapeXml$3(s.color)}"/></stop>`).join('');
+        const stops = fill.stops.map(s => `<stop position="${s.position}"><color rgb="${argb(s.color)}"/></stop>`).join('');
         return `<fill><gradientFill degree="${escapeXml$3(fill.degree ?? 0)}">${stops}</gradientFill></fill>`;
     }
-    return `<fill><patternFill patternType="solid"><fgColor rgb="${escapeXml$3(fill.fgColor)}"/></patternFill></fill>`;
+    return `<fill><patternFill patternType="solid"><fgColor rgb="${argb(fill.fgColor)}"/></patternFill></fill>`;
 }
 // Attributes of an <alignment> element
 function alignmentAttrs(alignment) {
@@ -2682,7 +2712,7 @@ class StyleEngine {
             xml += `<numFmt numFmtId="${this.registerNumFmt(style.numFmt)}" formatCode="${escapeXml$3(style.numFmt)}"/>`;
         if (style.fill?.type === 'solid') {
             // A differential solid fill takes its colour from bgColor
-            const c = escapeXml$3(style.fill.fgColor);
+            const c = argb(style.fill.fgColor);
             xml += `<fill><patternFill patternType="solid"><fgColor rgb="${c}"/><bgColor rgb="${c}"/></patternFill></fill>`;
         }
         if (style.border)
@@ -2810,7 +2840,7 @@ ${this.dxfs.size ? `<dxfs count="${this.dxfs.size}">${[...this.dxfs.keys()].map(
 function escapeXml$2(val) {
     return String(val).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }
-const color = (rgb) => `<color rgb="${escapeXml$2(rgb)}"/>`;
+const color = (rgb) => `<color rgb="${argb(rgb)}"/>`;
 const bound = (type, value) => value === undefined ? `<cfvo type="${type}"/>` : `<cfvo type="num" val="${escapeXml$2(value)}"/>`;
 const formula = (f) => `<formula>${escapeXml$2(String(f).replace(/^=/, ''))}</formula>`;
 // Excel string literal inside a formula
@@ -3362,7 +3392,6 @@ function escapeXml$1(val) {
 function isStyledCell$1(v) {
     return typeof v === 'object' && v !== null && 'value' in v;
 }
-const DAY_MS = 86400000;
 // "A1:C10" -> "$A$1:$C$10"
 const absoluteRef = (ref) => ref.replace(/([A-Za-z]+)(\d+)/g, '$$$1$$$2');
 function stringXml(s) {
@@ -3640,7 +3669,7 @@ class SheetWriter {
         const page = options.pageSetup;
         const fitToPage = page && (page.fitToWidth !== undefined || page.fitToHeight !== undefined);
         const sheetPr = options.tabColor || fitToPage
-            ? `<sheetPr>${options.tabColor ? `<tabColor rgb="${escapeXml$1(options.tabColor)}"/>` : ''}${fitToPage ? '<pageSetUpPr fitToPage="1"/>' : ''}</sheetPr>`
+            ? `<sheetPr>${options.tabColor ? `<tabColor rgb="${argb(options.tabColor)}"/>` : ''}${fitToPage ? '<pageSetUpPr fitToPage="1"/>' : ''}</sheetPr>`
             : '';
         const sheetFormatPr = outlineRow || outlineCol
             ? `<sheetFormatPr defaultRowHeight="15"${outlineRow ? ` outlineLevelRow="${outlineRow}"` : ''}${outlineCol ? ` outlineLevelCol="${outlineCol}"` : ''}/>`
@@ -3678,6 +3707,11 @@ class SheetWriter {
             if (done)
                 break;
             const rowNum = ri + 1;
+            // Past Excel's sheet size the file is damaged, so refuse it instead
+            if (rowNum > MAX_ROWS$1)
+                throw new Error(`Row ${rowNum} is past Excel's last row (${MAX_ROWS$1}).`);
+            if (row.length > MAX_COLUMNS$1)
+                throw new Error(`Row ${rowNum} has ${row.length} cells, more than Excel's ${MAX_COLUMNS$1} columns.`);
             chunkStr += optionRowsBefore(rowNum);
             if (rowOptions[nextRowOption]?.[0] === rowNum)
                 nextRowOption++;
@@ -3688,7 +3722,7 @@ class SheetWriter {
                 let cellStyle = styledCell.style;
                 if (val instanceof Date && !cellStyle?.numFmt) {
                     // A date needs a date format, or Excel shows the bare serial number
-                    cellStyle = { ...cellStyle, numFmt: val.getTime() % DAY_MS === 0 ? 'yyyy-mm-dd' : 'yyyy-mm-dd hh:mm:ss' };
+                    cellStyle = { ...cellStyle, numFmt: defaultDateFormat(val) };
                 }
                 const style = cellStyle ? this.styleEngine.registerStyle(cellStyle) : 0;
                 const sAttr = style > 0 ? ` s="${style}"` : '';
@@ -3739,6 +3773,7 @@ class SheetWriter {
                     return `<c r="${colRef}"${sAttr}><v>${dateToSerial(val)}</v></c>`;
                 }
                 if (typeof val === 'string') {
+                    checkCellText(val, colRef);
                     if (this.writerOptions.sharedStrings) {
                         let index = this.sharedStrings.get(val);
                         if (index === undefined)
@@ -4144,6 +4179,16 @@ class StylePatcher {
         this.memo.set(key, id);
         return id;
     }
+    // The format for date `d` in a cell of format `base`: `base` when it already shows dates, otherwise
+    // `base` with a date format, since a date in a General cell shows as its serial number
+    dateFormat(base, d) {
+        const xf = this.xfs[base] ?? this.added.cellXfs[base - this.xfs.length] ?? '';
+        const id = parseInt(attr(/^<[^>]*>/.exec(xf)?.[0] ?? '', 'numFmtId') ?? '0', 10);
+        const code = [...this.numFmts].find(([, v]) => v === id)?.[0];
+        if (isBuiltinDateFormat(id) || (code !== undefined && isDateFormatCode(code)))
+            return base;
+        return this.patch(base, { numFmt: defaultDateFormat(d) });
+    }
     toXml() {
         let xml = this.xml;
         for (const section of ['numFmts', 'fonts', 'fills', 'borders', 'cellXfs']) {
@@ -4699,7 +4744,7 @@ function editedCell(p, ref, attrs, edit) {
     }
     if (typeof edit === 'object')
         return `<${p}c r="${ref}"${attrs}><${p}f>${escapeXml$5(edit.formula.replace(/^=/, ''))}</${p}f></${p}c>`;
-    const text = escapeXml$5(encodeXString(edit));
+    const text = escapeXml$5(encodeXString(checkCellText(edit, ref)));
     const t = /^\s|\s$/.test(edit) ? `<${p}t xml:space="preserve">${text}</${p}t>` : `<${p}t>${text}</${p}t>`;
     return `<${p}c r="${ref}"${attrs} t="inlineStr"><${p}is>${t}</${p}is></${p}c>`;
 }
@@ -4750,9 +4795,9 @@ class SheetEditor {
             this.cellEdits.set(sheetName, rows = new Map());
         for (const [ref, edit] of Object.entries(cells)) {
             const m = /^\$?([A-Za-z]{1,3})\$?(\d+)$/.exec(ref);
-            if (!m || parseInt(m[2], 10) < 1)
+            const r = m ? parseInt(m[2], 10) : 0;
+            if (!m || r < 1 || r > MAX_ROWS$1 || colIndex(m[1]) >= MAX_COLUMNS$1)
                 throw new Error(`Invalid cell reference "${ref}".`);
-            const r = parseInt(m[2], 10);
             if (!rows.has(r))
                 rows.set(r, new Map());
             rows.get(r).set(colIndex(m[1]), edit);
@@ -4938,7 +4983,10 @@ class SheetEditor {
                 let patcher;
                 const styled = [...editsByPath.values(), ...added.values()]
                     .some(rows => [...rows.values()].some(cells => [...cells.values()].some(e => styleOf(e))));
-                if (styled) {
+                // Dates may need a date format added to their cells
+                const dated = [...editsByPath.values(), ...added.values()]
+                    .some(rows => [...rows.values()].some(cells => [...cells.values()].some(e => contentOf(e) instanceof Date)));
+                if (styled || (dated && parts.styles)) {
                     if (!parts.styles)
                         throw new Error('Workbook has no styles part.');
                     patcher = new StylePatcher(await read(parts.styles));
@@ -5015,6 +5063,10 @@ class SheetEditor {
                 attrs = `${attrs.replace(/\ss="[^"]*"/, '')} s="${patcher.patch(base, style)}"`;
             }
             const content = contentOf(edit);
+            if (content instanceof Date && patcher) {
+                const base = parseInt(/\ss="(\d+)"/.exec(attrs)?.[1] ?? '0', 10);
+                attrs = `${attrs.replace(/\ss="[^"]*"/, '')} s="${patcher.dateFormat(base, content)}"`;
+            }
             if (content === KEEP) {
                 return existing?.[2] !== undefined ? `<${p}c r="${ref}"${attrs}>${existing[2]}</${p}c>` : `<${p}c r="${ref}"${attrs}/>`;
             }
@@ -5164,7 +5216,7 @@ class SheetEditor {
                 if (typeof val === 'number')
                     return `<c r="${colRef}"><v>${val}</v></c>`;
                 if (typeof val === 'string') {
-                    return `<c r="${colRef}" t="inlineStr"><is><t xml:space="preserve">${escapeXml$5(encodeXString(val))}</t></is></c>`;
+                    return `<c r="${colRef}" t="inlineStr"><is><t xml:space="preserve">${escapeXml$5(encodeXString(checkCellText(val, colRef)))}</t></is></c>`;
                 }
                 return `<c r="${colRef}"/>`;
             }).join('');
@@ -5776,7 +5828,8 @@ async function* parseCsv(input, options = {}) {
     let first = true;
     const rows = [];
     const endField = () => {
-        row.push(quoted || !convert ? field : convertField(field));
+        // An empty unquoted field is null in both modes; a quoted "" stays an empty string
+        row.push(quoted ? field : !convert ? (field === '' ? null : field) : convertField(field));
         field = '';
         quoted = false;
     };
@@ -5908,11 +5961,14 @@ function textXml(s) {
 }
 const dateValue = (d) => d.toISOString().slice(0, 19); // UTC, like SheetWriter
 const hasTime = (d) => d.getTime() % 86400000 !== 0;
-function cellXml(cell, span, covered) {
+function cellXml(cell, span, covered, evaluate) {
     if (covered)
         return '<table:covered-table-cell/>';
-    const value = isStyledCell(cell) ? cell.value : cell;
+    let value = isStyledCell(cell) ? cell.value : cell;
     const formula = isStyledCell(cell) && cell.formula ? ` table:formula="${escapeXml(toOpenFormula(cell.formula))}"` : '';
+    // A formula without a value gets its result stored, as SheetWriter does, for readers that don't recalculate
+    if (formula && value == null)
+        value = evaluate(cell.formula);
     if (value === null || value === undefined || (typeof value === 'number' && !isFinite(value))) {
         return formula || span ? `<table:table-cell${formula}${span}/>` : '<table:table-cell/>';
     }
@@ -6005,6 +6061,15 @@ class OdsWriter {
                 const merges = (sheet.options.mergeCells ?? []).map(parseRange);
                 const lastMergeRow = Math.max(-1, ...merges.map(m => m.r2));
                 const mergeAt = (r, c) => merges.find(m => m.r1 === r && m.c1 === c);
+                // Formulas resolve against the sheet they live in; streamed rows can't be looked back at
+                const engine = new FormulaEngine();
+                if (Array.isArray(sheet.rows)) {
+                    engine.loadData(sheet.rows.map(row => row.map(cell => {
+                        const v = isStyledCell(cell) ? cell.value : cell;
+                        return v instanceof Date ? dateToSerial(v) : v ?? null;
+                    })));
+                }
+                const evaluate = (f) => engine.evaluate(f);
                 const covered = (r, c) => merges.some(m => r >= m.r1 && r <= m.r2 && c >= m.c1 && c <= m.c2 && (r !== m.r1 || c !== m.c1));
                 let r = 0, batch = '';
                 const writeRow = (row) => {
@@ -6013,7 +6078,7 @@ class OdsWriter {
                     for (let c = 0; c < width; c++) {
                         const m = mergeAt(r, c);
                         const span = m ? ` table:number-columns-spanned="${m.c2 - m.c1 + 1}" table:number-rows-spanned="${m.r2 - m.r1 + 1}"` : '';
-                        xml += cellXml(row[c], span, covered(r, c));
+                        xml += cellXml(row[c], span, covered(r, c), evaluate);
                     }
                     r++;
                     return xml + (width ? '' : '<table:table-cell/>') + '</table:table-row>';
@@ -6106,10 +6171,12 @@ exports.SheetEditor = SheetEditor;
 exports.SheetReader = SheetReader;
 exports.SheetWriter = SheetWriter;
 exports.StyleEngine = StyleEngine;
+exports.StylePatcher = StylePatcher;
 exports.XlsxFlow = XlsxFlow;
 exports.ZipRandomAccessParser = ZipRandomAccessParser;
 exports.ZipStreamWriter = ZipStreamWriter;
 exports.anchorXml = anchorXml;
+exports.checkCellText = checkCellText;
 exports.colIndex = colIndex;
 exports.colLetter = colLetter;
 exports.crc32 = crc32;