@xlvane/compat 1.1.0 → 1.2.0

package/README.md

@@ -56,7 +56,7 @@ In CommonJS, `const ExcelJS = require('exceljs');` gives the same object; call `
 The full list, with the exceljs source of each behaviour, is in [docs/exceljs-compat.md](https://github.com/DevXord/xlvane/blob/main/docs/exceljs-compat.md) (also in `node_modules/xlvane/docs/exceljs-compat.md` after installing). The ones most likely to matter:
 
 - **Not offered:** row and column operations on a streamed worksheet (`insertRow(s)`, `spliceRows`, `duplicateRow`, `spliceColumns`; exceljs's streaming worksheet does not have them either) throw an `XlvError` with code `XLV_E_NOT_SUPPORTED` and the name of the method. Deep imports of exceljs internals (`exceljs/lib/...`) do not resolve; `exceljs/dist/es5` and the `exceljs/dist/exceljs*.js` files do. Nothing is dropped silently.
-- **CSV:** text that starts with `=`, `+`, `-`, `@`, a tab, CR or LF is written with a leading `'`, so spreadsheet applications do not run it as a formula. `formulaInjection: "off"` writes it unchanged, as exceljs does.
+- **CSV:** text that starts with `=`, `+`, `-`, `@`, a tab, CR, LF or another control character, or with a full-width or small form of these signs, is written with a leading `'`, so spreadsheet applications do not run it as a formula. `formulaInjection: "off"` writes it unchanged, as exceljs does.
 - **Sheet ids:** `worksheet.id` is written as `sheetId` and kept on loading, as in exceljs; an id outside 1 to 65534 is written as the lowest unused one, and the streaming `WorkbookReader` numbers worksheets 1, 2, 3… in file order.
 - **Views:** only the first view of a worksheet is written; a frozen view always gets the cell right of and below the panes as `topLeftCell`.
 - **Notes:** `protection.locked` and `lockText` read back as `'True'`/`'False'`, the values Excel writes.
@@ -66,6 +66,7 @@ The full list, with the exceljs source of each behaviour, is in [docs/exceljs-co
 
 ## Links
 
+- Website: [xlvane.github.io](https://xlvane.github.io)
 - Changes in each version: [CHANGELOG.md](https://github.com/DevXord/xlvane/blob/main/CHANGELOG.md)
 - Bugs and questions: [GitHub issues](https://github.com/DevXord/xlvane/issues)
 - Reporting a vulnerability: [SECURITY.md](https://github.com/DevXord/xlvane/blob/main/SECURITY.md)

package/dist/index.d.ts

@@ -2700,6 +2700,20 @@ export declare class Column {
   get protection(): Partial<Protection> | undefined;
   set protection(v: Partial<Protection> | undefined);
 }
+/** A merged range of a worksheet. */
+type MergeRange = {
+  top: number;
+  left: number;
+  bottom: number;
+  right: number;
+};
+/** The merged ranges of a worksheet by master address, with a counter of changes (D-H01). */
+declare class MergeMap extends Map<string, MergeRange> {
+  version: number;
+  override set(key: string, value: MergeRange): this;
+  override delete(key: string): boolean;
+  override clear(): void;
+}
 /**
  * A worksheet, as exceljs `Worksheet` (lib/doc/worksheet.js).
  *
@@ -2761,12 +2775,10 @@ export declare class Worksheet {
   /** @internal */
   _columns: Column[];
   /** @internal */
-  _merges: Map<string, {
-    top: number;
-    left: number;
-    bottom: number;
-    right: number;
-  }>;
+  _merges: MergeMap;
+  /** The cells covered by `_merges` (row × 16 385 + column), valid while `_mergedVersion` equals `_merges.version`. */
+  private _mergedCells;
+  private _mergedVersion;
   private readonly _keys;
   private _name;
   /** @internal Use `workbook.addWorksheet()`. */
@@ -2929,6 +2941,8 @@ export declare class Worksheet {
   mergeCellsWithoutStyle(...args: unknown[]): void;
   private _mergeKeepStyle;
   mergeCells(...args: unknown[]): void;
+  /** The index of merged cells, rebuilt from `_merges` after any other change to it. */
+  private _mergedIndex;
   unMergeCells(...args: unknown[]): void;
   get hasMerges(): boolean;
   /** Adds conditional formatting for a range (exceljs `addConditionalFormatting`). */

package/dist/index.js

@@ -1,4 +1,4 @@
-import { XlvError, adjustFormula, adjustRange, createWorkbook, hashPassword, imageFormat, openWorkbookStream, readWorkbook, shiftFormula, writeWorkbook, writeWorkbookStream } from "xlvane";
+import { DEFAULT_READ_LIMITS, XlvError, adjustFormula, adjustRange, createWorkbook, hashPassword, imageFormat, openWorkbookStream, readWorkbook, shiftFormula, writeWorkbook, writeWorkbookStream } from "xlvane";
 // src/media.ts
 const MAX_COLS = 16384;
 const MAX_ROWS = 1048576;
@@ -3628,6 +3628,22 @@ function parseRangeArgs(args) {
 		right: Math.max(s.col, e.col)
 	};
 }
+/** The merged ranges of a worksheet by master address, with a counter of changes (D-H01). */
+var MergeMap = class extends Map {
+	version = 0;
+	set(key, value) {
+		this.version++;
+		return super.set(key, value);
+	}
+	delete(key) {
+		this.version++;
+		return super.delete(key);
+	}
+	clear() {
+		this.version++;
+		super.clear();
+	}
+};
 /**
 * A worksheet, as exceljs `Worksheet` (lib/doc/worksheet.js).
 *
@@ -3673,7 +3689,10 @@ var Worksheet = class {
 	/** @internal */
 	_columns = [];
 	/** @internal */
-	_merges = /* @__PURE__ */ new Map();
+	_merges = new MergeMap();
+	/** The cells covered by `_merges` (row × 16 385 + column), valid while `_mergedVersion` equals `_merges.version`. */
+	_mergedCells = /* @__PURE__ */ new Set();
+	_mergedVersion = -1;
 	_keys = /* @__PURE__ */ new Map();
 	_name = "";
 	/** @internal Use `workbook.addWorksheet()`. */
@@ -4378,7 +4397,8 @@ var Worksheet = class {
 	_mergeKeepStyle = false;
 	mergeCells(...args) {
 		const range = parseRangeArgs(args);
-		for (const m of this._merges.values()) if (range.top <= m.bottom && m.top <= range.bottom && range.left <= m.right && m.left <= range.right) throw new Error("Cannot merge already merged cells");
+		const merged = this._mergedIndex();
+		for (let r = range.top; r <= range.bottom; r++) for (let c = range.left; c <= range.right; c++) if (merged.has(r * 16385 + c)) throw new Error("Cannot merge already merged cells");
 		const master = this.getCell(range.top, range.left);
 		for (let r = range.top; r <= range.bottom; r++) for (let c = range.left; c <= range.right; c++) {
 			if (r === range.top && c === range.left) continue;
@@ -4388,6 +4408,17 @@ var Worksheet = class {
 		}
 		master._mergeCount++;
 		this._merges.set(`${columnLetter(range.left)}${String(range.top)}`, range);
+		for (let r = range.top; r <= range.bottom; r++) for (let c = range.left; c <= range.right; c++) merged.add(r * 16385 + c);
+		this._mergedVersion = this._merges.version;
+	}
+	/** The index of merged cells, rebuilt from `_merges` after any other change to it. */
+	_mergedIndex() {
+		if (this._mergedVersion !== this._merges.version) {
+			this._mergedCells = /* @__PURE__ */ new Set();
+			for (const m of this._merges.values()) for (let r = m.top; r <= m.bottom; r++) for (let c = m.left; c <= m.right; c++) this._mergedCells.add(r * 16385 + c);
+			this._mergedVersion = this._merges.version;
+		}
+		return this._mergedCells;
 	}
 	unMergeCells(...args) {
 		const range = parseRangeArgs(args);
@@ -4575,7 +4606,11 @@ const INJECTION_START = /* @__PURE__ */ new Set([
 	"＝",
 	"＋",
 	"－",
-	"＠"
+	"＠",
+	"﹦",
+	"﹢",
+	"﹣",
+	"﹫"
 ]);
 function invalid(name, message, hint) {
 	return new XlvError("XLV_E_INVALID_OPTION", message, {
@@ -5032,7 +5067,7 @@ function worksheetCsv(sheet, options) {
 	const escape = (out) => {
 		if (injection !== "escape" || typeof out !== "string") return [out, false];
 		const first = out.replace(/\0/g, "")[0];
-		return first !== void 0 && INJECTION_START.has(first) ? [`'${out}`, f.quote !== ""] : [out, false];
+		return first !== void 0 && (INJECTION_START.has(first) || first.charCodeAt(0) < 32) ? [`'${out}`, f.quote !== ""] : [out, false];
 	};
 	if (f.headers) lines.push(f.headers.map((h, i) => {
 		const [out, force] = escape(h);
@@ -5985,6 +6020,24 @@ var Workbook = class {
 	_fill(read, options = {}) {
 		const ignore = new Set(options.ignoreNodes ?? []);
 		const use = (node) => !ignore.has(node);
+		let cellsRead = 0;
+		for (const s of read.sheets) cellsRead += s.cellCount;
+		const budget = Math.max(DEFAULT_READ_LIMITS.maxCells, 16 * cellsRead);
+		let spent = 0;
+		const spend = (positions, what, sheet) => {
+			spent += positions;
+			if (spent <= budget) return;
+			throw new XlvError("XLV_E_LIMIT_EXCEEDED", `${what} of worksheet "${sheet}" would create more than ${String(budget)} cells or columns for ${String(cellsRead)} cells in the file.`, {
+				location: { sheet },
+				hint: "The file declares ranges far larger than its data. Load it with ignoreNodes for that element (for example ignoreNodes: [\"mergeCells\"]), or read it with xlvane's readWorkbook, which does not create these objects.",
+				details: {
+					limit: "maxCells",
+					value: budget
+				}
+			});
+		};
+		const rowBudget = Math.max(67108864, 16 * cellsRead);
+		let rowsLooked = 0;
 		for (const s of read.sheets) {
 			if (s.kind !== "worksheet" || options.maxRows === void 0 && options.maxCols === void 0 || !use("sheetData")) continue;
 			const perRow = /* @__PURE__ */ new Map();
@@ -6055,6 +6108,7 @@ var Workbook = class {
 			ws.orderNo = position;
 			for (const c of use("cols") ? s.columns : []) {
 				const last = Math.min(c.max, 16384);
+				spend(Math.max(0, last - c.min + 1), "The column definitions", s.name);
 				for (let n = c.min; n <= last; n++) {
 					const column = ws.getColumn(n);
 					if (c.width !== null) column.width = c.width;
@@ -6108,6 +6162,15 @@ var Workbook = class {
 			}
 			const dim = /(\d+)$/.exec(s.dimension ?? "");
 			lastRow = use("sheetData") ? Math.min(Math.max(lastRow, dim ? Number(dim[1]) : 0), 1048576) : 0;
+			rowsLooked += lastRow;
+			if (rowsLooked > rowBudget) throw new XlvError("XLV_E_LIMIT_EXCEEDED", `The rows of worksheet "${s.name}" up to its dimension or last cell would bring the rows looked at for their settings past ${String(rowBudget)} for ${String(cellsRead)} cells in the file.`, {
+				location: { sheet: s.name },
+				hint: "The sheets declare far more rows than they hold. Load the file with ignoreNodes: [\"sheetData\"] to skip cells and rows, or read it with xlvane's readWorkbook.",
+				details: {
+					limit: "maxCells",
+					value: rowBudget
+				}
+			});
 			for (let r = 1; r <= lastRow; r++) {
 				const info = s.rowInfo(r);
 				if (!info) continue;
@@ -6117,7 +6180,11 @@ var Workbook = class {
 				if (info.outlineLevel) row.outlineLevel = info.outlineLevel;
 			}
 			for (const note of s.notes) ws.getCell(note.ref).note = noteOut(note);
-			for (const m of use("mergeCells") ? s.merges : []) if (m.includes(":")) ws.mergeCells(m);
+			for (const m of use("mergeCells") ? s.merges : []) {
+				if (!m.includes(":")) continue;
+				spend(areaOf(m), "A merged range", s.name);
+				ws.mergeCells(m);
+			}
 			if (use("sheetViews")) ws.views = [viewOut(s.view, s.freeze)];
 			const tab = colorOut(s.tabColor ?? void 0);
 			if (tab && use("sheetPr")) ws.properties["tabColor"] = tab;
@@ -6128,7 +6195,10 @@ var Workbook = class {
 			if (use("pageSetup")) ws.pageSetup = pageSetupOut(s.pageSetup, s.printArea, s.printTitles);
 			if (use("headerFooter")) ws.headerFooter = headerFooterOut(s.headerFooter);
 			if (use("rowBreaks")) ws.rowBreaks = rowBreaksOut(s.pageBreaks.rows);
-			for (const def of use("tableParts") ? s.tables : []) ws.tables[def.name] = tableOut(ws, def);
+			for (const def of use("tableParts") ? s.tables : []) {
+				spend(areaOf(def.ref), "A table", s.name);
+				ws.tables[def.name] = tableOut(ws, def);
+			}
 			for (const img of use("drawing") ? s.images : []) {
 				const id = img.image === null ? void 0 : mediaIds.get(img.image);
 				const media = id === void 0 ? null : imageOut(ws, img, id);
@@ -6166,6 +6236,18 @@ function freeIds(wanted) {
 		return next;
 	});
 }
+/** Cells in a range such as "A1:C3" (1 for a cell, 0 for anything else). */
+function areaOf(ref) {
+	const m = /^([A-Z]{1,3})(\d{1,7})(?::([A-Z]{1,3})(\d{1,7}))?$/.exec(ref.replace(/\$/g, ""));
+	if (!m) return 0;
+	const col = (letters) => {
+		let n = 0;
+		for (const ch of letters) n = n * 26 + ch.charCodeAt(0) - 64;
+		return n;
+	};
+	const [, c1 = "A", r1 = "1", c2 = c1, r2 = r1] = m;
+	return (Math.abs(Number(r2) - Number(r1)) + 1) * (Math.abs(col(c2) - col(c1)) + 1);
+}
 // src/stream.ts
 /**
 * A cell value for the streaming writer. Rows are written as they are committed, before later

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xlvane/compat",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "The commonly used exceljs 4.4.0 API on top of xlvane, for switching with one line in package.json.",
   "keywords": [
     "xlsx",
@@ -72,7 +72,7 @@
     "build": "tsdown"
   },
   "dependencies": {
-    "xlvane": "^1.1.0"
+    "xlvane": "^1.2.0"
   },
   "publishConfig": {
     "access": "public",