@xlvane/compat 1.2.2 → 1.2.3

package/dist/index.d.ts

@@ -289,14 +289,36 @@ export declare class Workbook {
   _meta(): WorkbookMeta;
   /** @internal */
   get _date1904(): boolean;
-  /** @internal Names of the other sheets, for the duplicate check of Worksheet.name. */
-  readonly _names: (exclude: Worksheet) => string[];
-  /** The id the next worksheet gets (lib/doc/workbook.js `nextId`). */
+  private _byName;
+  private _firstFree;
+  private _maxOrderNo;
+  private _maxOrderNoStale;
+  /** @internal Whether a sheet other than `exclude` has this name, ignoring case (the duplicate check of Worksheet.name). */
+  _nameTaken(name: string, exclude?: Worksheet): boolean;
+  /** @internal Keeps the name index in step with a renamed sheet. */
+  _renamed(sheet: Worksheet, oldName: string): void;
+  /** @internal Keeps the largest orderNo in step with a changed one. */
+  _orderNoChanged(sheet: Worksheet, oldOrderNo: number | undefined): void;
+  /** @internal Puts a worksheet into `_sheets` at its id and indexes it. */
+  _putSheet(sheet: Worksheet): void;
+  /** Takes a worksheet out of `_sheets` and its indexes. */
+  private _dropSheet;
+  /** Empties `_sheets` and its indexes. */
+  private _clearSheets;
+  /** The largest orderNo of the sheets, as exceljs computes it (lib/doc/workbook.js L81-85). */
+  private _lastOrderNo;
+  /** The id the next worksheet gets (lib/doc/workbook.js `nextId`): the lowest free id. */
   get nextId(): number;
   /** Adds a worksheet. Names follow exceljs rules (31 characters at most; longer names are cut). */
   addWorksheet(name?: string, options?: WorksheetOptions): Worksheet;
   /** @internal Adds a worksheet with a given id (a loaded file's sheetId, a model's id; D-F03). */
   _addWorksheetWithId(id: number, name?: string, options?: WorksheetOptions): Worksheet;
+  /**
+   * @internal Adds a worksheet read from a file (`xlsx.load`, `stream.xlsx.WorkbookReader`). A
+   * name exceljs refuses gives an XlvError with exceljs's message, the sheet and a hint, instead
+   * of the plain Error of `addWorksheet`; an empty name is refused too.
+   */
+  _addReadWorksheet(id: number, name: string, options?: WorksheetOptions): Worksheet;
   removeWorksheet(id: number | string): void;
   /** Removes a worksheet by id or name, as `removeWorksheet` (lib/doc/workbook.js L77). */
   removeWorksheetEx(worksheet: Worksheet): void;
@@ -2707,6 +2729,18 @@ type MergeRange = {
   bottom: number;
   right: number;
 };
+/**
+ * @internal What a worksheet needs from its workbook: the duplicate check of its name and, for a
+ * workbook that indexes its sheets, notices of a new name or orderNo.
+ */
+interface WorksheetHost {
+  /** Whether a sheet other than `exclude` has this name, ignoring case. */
+  _nameTaken(name: string, exclude: Worksheet): boolean;
+  _renamed?(sheet: Worksheet, oldName: string): void;
+  _orderNoChanged?(sheet: Worksheet, oldOrderNo: number | undefined): void;
+  readonly definedNames?: DefinedNames;
+  readonly worksheets?: readonly Worksheet[];
+}
 /** The merged ranges of a worksheet by master address, with a counter of changes (D-H01). */
 declare class MergeMap extends Map<string, MergeRange> {
   version: number;
@@ -2729,18 +2763,16 @@ declare class MergeMap extends Map<string, MergeRange> {
  * ```
  */
 export declare class Worksheet {
-  readonly workbook: {
-    readonly _names: (exclude: Worksheet) => string[];
-    readonly definedNames?: DefinedNames;
-    readonly worksheets?: readonly Worksheet[];
-  };
+  readonly workbook: WorksheetHost;
   readonly id: number;
   /**
    * The position of the sheet in `workbook.worksheets`, as exceljs `orderNo`: one more than the
    * largest of the other sheets for a new sheet (lib/doc/workbook.js L81-85), the 0-based position
    * in the file for a loaded one (L203). Worksheets are listed in this order.
    */
-  orderNo: number | undefined;
+  get orderNo(): number | undefined;
+  set orderNo(value: number | undefined);
+  private _orderNo;
   state: "visible" | "hidden" | "veryHidden";
   views: WorksheetView[];
   autoFilter: string | {
@@ -2782,11 +2814,7 @@ export declare class Worksheet {
   private readonly _keys;
   private _name;
   /** @internal Use `workbook.addWorksheet()`. */
-  constructor(workbook: {
-    readonly _names: (exclude: Worksheet) => string[];
-    readonly definedNames?: DefinedNames;
-    readonly worksheets?: readonly Worksheet[];
-  }, id: number, name: string | undefined, options: WorksheetOptions | undefined);
+  constructor(workbook: WorksheetHost, id: number, name: string | undefined, options: WorksheetOptions | undefined);
   get name(): string;
   /** Sheet name rules of exceljs (lib/doc/worksheet.js L134–173), including truncation to 31 characters. */
   set name(value: string);

package/dist/index.js

@@ -1040,24 +1040,60 @@ function sharedFormulaRanges(ws) {
 		const m = decodeAddress(master);
 		return m.row === b.top && m.col === b.left;
 	});
-	const overlaps = (a, b) => a.top <= b.bottom && b.top <= a.bottom && a.left <= b.right && b.left <= a.right;
-	const bad = /* @__PURE__ */ new Set();
-	const sorted = [...groups].sort((x, y) => x[1].top - y[1].top);
-	for (let i = 0; i < sorted.length; i++) {
-		const [mi, bi] = sorted[i];
-		for (let j = i + 1; j < sorted.length && sorted[j][1].top <= bi.bottom; j++) {
-			const [mj, bj] = sorted[j];
-			if (overlaps(bi, bj)) {
-				bad.add(mi);
-				bad.add(mj);
-			}
-		}
-		if (arrays.some((a) => overlaps(a, bi))) bad.add(mi);
-	}
+	const boxes = groups.map(([, b]) => b);
+	const withGroups = overlapCounts(boxes, boxes);
+	const withArrays = overlapCounts(boxes, arrays);
 	const out = /* @__PURE__ */ new Map();
-	for (const [master, b] of groups) if (!bad.has(master)) out.set(master, `${columnLetter(b.left)}${String(b.top)}:${columnLetter(b.right)}${String(b.bottom)}`);
+	groups.forEach(([master, b], i) => {
+		if (withGroups[i] === 1 && withArrays[i] === 0) out.set(master, `${columnLetter(b.left)}${String(b.top)}:${columnLetter(b.right)}${String(b.bottom)}`);
+	});
 	return out;
 }
+/**
+* For each box of `queries`, the number of boxes of `set` that share at least one cell with it.
+* Two boxes share cells when their rows and their columns overlap. Among the boxes with
+* `top <= q.bottom`, those with `bottom < q.top` are exactly the ones whose rows miss q's rows,
+* so the count is (boxes with top <= q.bottom whose columns meet q's) - (boxes with
+* bottom < q.top whose columns meet q's). Each term is found by a sweep over rows with two
+* Fenwick trees of columns: the columns of a box meet [a, b] unless it ends before a or starts
+* after b. Time O((queries + set) log(columns)).
+*/
+function overlapCounts(queries, set) {
+	const counts = new Array(queries.length).fill(0);
+	if (queries.length === 0 || set.length === 0) return counts;
+	let width = 1;
+	for (const b of set) width = Math.max(width, b.right + 1);
+	for (const q of queries) width = Math.max(width, q.right + 1);
+	const sweep = (key, at, sign) => {
+		const lefts = new Array(width + 1).fill(0);
+		const rights = new Array(width + 1).fill(0);
+		const add = (tree, i) => {
+			for (let k = Math.max(1, i); k <= width; k += k & -k) tree[k] += 1;
+		};
+		const below = (tree, i) => {
+			let n = 0;
+			for (let k = Math.min(i, width); k > 0; k -= k & -k) n += tree[k];
+			return n;
+		};
+		const boxes = [...set].sort((x, y) => key(x) - key(y));
+		const order = queries.map((_, i) => i).sort((x, y) => at(queries[x]) - at(queries[y]));
+		let added = 0;
+		for (const i of order) {
+			const q = queries[i];
+			const t = at(q);
+			while (added < boxes.length && key(boxes[added]) <= t) {
+				const b = boxes[added++];
+				add(lefts, b.left);
+				add(rights, b.right);
+			}
+			const meet = added - below(rights, q.left - 1) - (added - below(lefts, q.right));
+			counts[i] += sign * meet;
+		}
+	};
+	sweep((b) => b.top, (q) => q.bottom, 1);
+	sweep((b) => b.bottom, (q) => q.top - 1, -1);
+	return counts;
+}
 /** Converts a cell value for the writer; a `{ text, hyperlink }` value gives its text (the link is {@link linkIn}). */
 function valueIn(cell, sharedRanges) {
 	const v = cell.value;
@@ -1328,6 +1364,17 @@ function at(sheet, cell, run) {
 		});
 	}
 }
+/** The 32-bit FNV-1a hash of bytes. */
+function fnv1a(bytes) {
+	let h = 2166136261;
+	for (let i = 0; i < bytes.length; i++) h = Math.imul(h ^ bytes[i], 16777619);
+	return h >>> 0;
+}
+function sameBytes(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
 /** Builds an xlvane workbook from the exceljs model (D-503). */
 function toNewWorkbook(sheets, date1904, meta = {}) {
 	const book = createWorkbook({
@@ -1337,6 +1384,7 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 	if (sheets.length === 0) notSupported("Writing a workbook without worksheets");
 	const coreImages = /* @__PURE__ */ new Map();
 	const coreBytes = [];
+	const coreByHash = /* @__PURE__ */ new Map();
 	const imageId = (id) => {
 		let core = coreImages.get(id);
 		if (core === void 0) {
@@ -1349,10 +1397,14 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 				}
 			});
 			const bytes = imageBytes(image);
-			const same = coreBytes.findIndex((b) => b.length === bytes.length && b.every((x, i) => x === bytes[i]));
-			if (same === -1) {
+			const key = `${String(bytes.length)}:${String(fnv1a(bytes))}`;
+			const candidates = coreByHash.get(key) ?? [];
+			const same = candidates.find((c) => sameBytes(coreBytes[c], bytes));
+			if (same === void 0) {
 				core = book.addImage(bytes);
 				coreBytes[core] = bytes;
+				candidates.push(core);
+				coreByHash.set(key, candidates);
 			} else core = same;
 			coreImages.set(id, core);
 		}
@@ -1725,11 +1777,17 @@ function rangeText(r) {
 	return r.top === r.bottom && r.left === r.right ? a : `${a}:${address(r.bottom, r.right)}`;
 }
 /**
-* Cells per sheet up to which validations read from a file are given to every cell they cover,
-* as exceljs does (data-validations-xform.js L229–239). Larger ranges, such as whole columns,
-* keep their range as the key; `find()` and `cell.dataValidation` still answer for every cell.
+* Cells per workbook up to which validations read from a file are given to every cell they
+* cover, as exceljs does (data-validations-xform.js L229–239). Larger ranges, such as whole
+* columns, and ranges read after the budget is spent keep their range as the key; `find()` and
+* `cell.dataValidation` still answer for every cell. The budget is shared by all sheets of a
+* load, so many sheets cannot each expand 100 000 cells (security review J, C2).
 */
 const MAX_EXPANDED_CELLS = 1e5;
+/** @internal The budget of {@link dataValidationsOut} for one workbook load. */
+function validationBudget() {
+	return { left: MAX_EXPANDED_CELLS };
+}
 /**
 * The data validations of a worksheet (`worksheet.dataValidations`), keyed by cell address or
 * range as in exceljs (lib/doc/data-validations.js). `remove()` deletes the entry; exceljs
@@ -1906,21 +1964,23 @@ function validationOut(d, date1904) {
 	]) if (d[k] !== null) out[k] = d[k];
 	return out;
 }
-/** The `worksheet.dataValidations` model of validations read by xlvane. */
-function dataValidationsOut(list, date1904) {
+/**
+* The `worksheet.dataValidations` model of validations read by xlvane. `budget` is the number of
+* cells still to expand; pass the same object for every sheet of a workbook.
+*/
+function dataValidationsOut(list, date1904, budget = validationBudget()) {
 	const model = Object.create(null);
-	let budget = MAX_EXPANDED_CELLS;
 	for (const d of list) {
 		const v = validationOut(d, date1904);
 		for (const part of d.sqref.split(/\s+/)) {
 			const r = parseRange(part);
 			if (!r) continue;
 			const size = (r.bottom - r.top + 1) * (r.right - r.left + 1);
-			if (size > budget) {
+			if (size > budget.left) {
 				model[part] = v;
 				continue;
 			}
-			budget -= size;
+			budget.left -= size;
 			for (let row = r.top; row <= r.bottom; row++) for (let col = r.left; col <= r.right; col++) model[address(row, col)] = v;
 		}
 	}
@@ -3628,6 +3688,30 @@ function parseRangeArgs(args) {
 		right: Math.max(s.col, e.col)
 	};
 }
+/**
+* @internal exceljs's rules for a worksheet name (lib/doc/worksheet.js L134-173): the name to
+* use, cut to 31 characters, or exceljs's message for a name it refuses. `taken` tells whether
+* another sheet of the workbook has a name (already cut) that equals it ignoring case.
+*/
+function checkSheetName(value, taken) {
+	const fail = (message) => ({
+		name: typeof value === "string" ? value : "",
+		message,
+		duplicate: false
+	});
+	if (typeof value !== "string") return fail("The name has to be a string.");
+	if (value === "") return fail("The name can't be empty.");
+	if (value === "History") return fail("The name \"History\" is protected. Please use a different name.");
+	if (/[*?:/\\[\]]/.test(value)) return fail(`Worksheet name ${value} cannot include any of the following characters: * ? : \\ / [ ]`);
+	if (/(^')|('$)/.test(value)) return fail(`The first or last character of worksheet name cannot be a single quotation mark: ${value}`);
+	const name = value.length > 31 ? value.substring(0, 31) : value;
+	if (taken(name)) return {
+		name,
+		message: `Worksheet name already exists: ${name}`,
+		duplicate: true
+	};
+	return { name };
+}
 /** The merged ranges of a worksheet by master address, with a counter of changes (D-H01). */
 var MergeMap = class extends Map {
 	version = 0;
@@ -3666,7 +3750,15 @@ var Worksheet = class {
 	* largest of the other sheets for a new sheet (lib/doc/workbook.js L81-85), the 0-based position
 	* in the file for a loaded one (L203). Worksheets are listed in this order.
 	*/
-	orderNo;
+	get orderNo() {
+		return this._orderNo;
+	}
+	set orderNo(value) {
+		const old = this._orderNo;
+		this._orderNo = value;
+		this.workbook._orderNoChanged?.(this, old);
+	}
+	_orderNo;
 	state;
 	views;
 	autoFilter = null;
@@ -3717,16 +3809,12 @@ var Worksheet = class {
 	}
 	/** Sheet name rules of exceljs (lib/doc/worksheet.js L134–173), including truncation to 31 characters. */
 	set name(value) {
-		let name = value;
-		if (name === this._name) return;
-		if (typeof name !== "string") throw new Error("The name has to be a string.");
-		if (name === "") throw new Error("The name can't be empty.");
-		if (name === "History") throw new Error("The name \"History\" is protected. Please use a different name.");
-		if (/[*?:/\\[\]]/.test(name)) throw new Error(`Worksheet name ${name} cannot include any of the following characters: * ? : \\ / [ ]`);
-		if (/(^')|('$)/.test(name)) throw new Error(`The first or last character of worksheet name cannot be a single quotation mark: ${name}`);
-		if (name.length > 31) name = name.substring(0, 31);
-		if (this.workbook._names(this).some((n) => n.toLowerCase() === name.toLowerCase())) throw new Error(`Worksheet name already exists: ${name}`);
-		this._name = name;
+		if (value === this._name) return;
+		const checked = checkSheetName(value, (name) => this.workbook._nameTaken(name, this));
+		if (checked.message !== void 0) throw new Error(checked.message);
+		const old = this._name;
+		this._name = checked.name;
+		this.workbook._renamed?.(this, old);
 	}
 	/** Deprecated in exceljs in favour of `properties.tabColor`, which it reads and sets (lib/doc/worksheet.js L827). */
 	get tabColor() {
@@ -4707,7 +4795,7 @@ function formatDate(date, format, utc) {
 	});
 }
 const PARSE_TOKENS = /(\[[^[]*\])|([-_:/.,()\s]+)|(A|a|Q|YYYY|YY?|ww?|MM?M?M?|Do|DD?|hh?|HH?|mm?|ss?|S{1,3}|z|ZZ?)/g;
-const WORD = /\d*[^-_:/,()\s\d]+/;
+const WORD = /(?<!\d)\d*[^-_:/,()\s\d]+/;
 const ONE_OR_TWO = /\d\d?/;
 const PARSE_EXPRESSIONS = {
 	A: WORD,
@@ -5057,21 +5145,55 @@ function defaultWriteMap(dateFormat, dateUTC) {
 *
 * @internal
 */
-function worksheetCsv(sheet, options) {
+function worksheetCsv(sheet, options, latin1 = false) {
 	const f = formatterOptions(options.formatterOptions);
 	const injection = options.formulaInjection ?? "escape";
 	if (injection !== "escape" && injection !== "off") throw invalid("formulaInjection", "The option \"formulaInjection\" must be \"escape\" or \"off\".", "Use \"escape\" (default) or \"off\".");
+	if (latin1) {
+		for (const [name, value] of [
+			["delimiter", f.delimiter],
+			["rowDelimiter", f.rowDelimiter],
+			["quote", f.quote],
+			["escape", f.escapedQuote]
+		]) if (/[^\u0000-\u00ff]/.test(value)) throw invalid(name, `The option "${name}" has a character that latin1 cannot write.`, "Use characters up to U+00FF with encoding \"latin1\", or write UTF-8.");
+	}
+	if (injection === "escape") {
+		const off = "or pass formulaInjection: \"off\" for a trusted consumer.";
+		if (f.delimiter !== "	" && [...f.delimiter].some((c) => INJECTION_START.has(c) || c.charCodeAt(0) < 32)) throw invalid("delimiter", `The delimiter ${JSON.stringify(f.delimiter)} holds a formula sign or a control character, so a line could start with a formula.`, `Use "," (default), ";", "|" or "\\t", ${off}`);
+		if (![
+			"\n",
+			"\r\n",
+			"\r"
+		].includes(f.rowDelimiter)) throw invalid("rowDelimiter", `The row delimiter ${JSON.stringify(f.rowDelimiter)} is not a line break, so a standard CSV reader would not split rows where it is written.`, `Use "\\n" (default), "\\r\\n" or "\\r", ${off}`);
+		if (f.quote !== "" && f.quote !== "\"") throw invalid("quote", `The quote ${JSON.stringify(f.quote)} is not '"', so a standard CSV reader would split a value that holds a line break or the delimiter.`, `Leave formatterOptions.quote at its default ("), or use quote: false, ${off}`);
+		if (f.quote !== "" && f.escapedQuote !== `${f.quote}${f.quote}`) throw invalid("escape", "An escape character other than the quote lets a standard CSV reader end a quoted field early, so a value could start a new field with a formula.", "Leave formatterOptions.escape unset (the quote is doubled), or pass formulaInjection: \"off\" for a trusted consumer.");
+	}
+	/** The text latin1 will write: characters above U+00FF as "?". */
+	const narrow = (out) => latin1 && typeof out === "string" ? out.replace(/[^\u0000-\u00ff]/g, "?") : out;
+	/** A formatted field, refused if a standard reader would take its leading quote as quoting. */
+	const field = (out, index, force) => {
+		const text = formatField(out, index, f, force);
+		if (injection === "escape" && f.quote !== "\"" && text.startsWith("\"")) throw new XlvError("XLV_E_INVALID_OPTION", `Field ${String(index + 1)} starts with a double quote, which a standard CSV reader takes as quoting when formatterOptions.quote is not '"'.`, {
+			hint: "Leave formatterOptions.quote at its default (\"), or pass formulaInjection: \"off\" for a trusted consumer.",
+			details: {
+				option: "quote",
+				field: index + 1
+			}
+		});
+		return text;
+	};
 	const map = options.map ?? defaultWriteMap(options.dateFormat, options.dateUTC === true);
 	const includeEmptyRows = options.includeEmptyRows === void 0 || options.includeEmptyRows;
 	const lines = [];
-	const escape = (out) => {
+	const escape = (raw) => {
+		const out = narrow(raw);
 		if (injection !== "escape" || typeof out !== "string") return [out, false];
 		const first = out.replace(/\0/g, "")[0];
 		return first !== void 0 && (INJECTION_START.has(first) || first.charCodeAt(0) < 32) ? [`'${out}`, f.quote !== ""] : [out, false];
 	};
 	if (f.headers) lines.push(f.headers.map((h, i) => {
 		const [out, force] = escape(h);
-		return formatField(out, i, f, force);
+		return field(out, i, force);
 	}).join(f.delimiter));
 	if (sheet) {
 		let lastRow = 0;
@@ -5086,7 +5208,7 @@ function worksheetCsv(sheet, options) {
 					continue;
 				}
 				const [out, force] = escape(map(values[i], i));
-				fields.push(formatField(out, i, f, force));
+				fields.push(field(out, i, force));
 			}
 			lines.push(fields.join(f.delimiter));
 			lastRow = rowNumber;
@@ -5128,11 +5250,28 @@ function decoderFor(encoding) {
 async function readText(stream, encoding) {
 	const decoder = decoderFor(encoding);
 	let text = "";
+	let size = 0;
+	const count = (n) => {
+		size += n;
+		if (size > DEFAULT_READ_LIMITS.maxInputBytes) throw new XlvError("XLV_E_LIMIT_EXCEEDED", `The CSV input is larger than ${String(DEFAULT_READ_LIMITS.maxInputBytes)} bytes.`, {
+			hint: "Split the CSV file, or read it with the core fromCSV in parts.",
+			details: {
+				limit: "maxInputBytes",
+				value: DEFAULT_READ_LIMITS.maxInputBytes
+			}
+		});
+	};
 	const add = (chunk) => {
-		if (typeof chunk === "string") text += chunk;
-		else if (chunk instanceof Uint8Array) text += decoder.decode(chunk, { stream: true });
-		else if (chunk instanceof ArrayBuffer) text += decoder.decode(new Uint8Array(chunk), { stream: true });
-		else throw new XlvError("XLV_E_INVALID_INPUT", "workbook.csv.read() got a stream chunk that is neither text nor bytes.", { hint: "Pass a stream of strings, Buffers or Uint8Arrays." });
+		if (typeof chunk === "string") {
+			count(chunk.length);
+			text += chunk;
+		} else if (chunk instanceof Uint8Array) {
+			count(chunk.length);
+			text += decoder.decode(chunk, { stream: true });
+		} else if (chunk instanceof ArrayBuffer) {
+			count(chunk.byteLength);
+			text += decoder.decode(new Uint8Array(chunk), { stream: true });
+		} else throw new XlvError("XLV_E_INVALID_INPUT", "workbook.csv.read() got a stream chunk that is neither text nor bytes.", { hint: "Pass a stream of strings, Buffers or Uint8Arrays." });
 	};
 	const s = stream;
 	if (typeof stream === "string") add(stream);
@@ -5250,7 +5389,8 @@ var CsvIO = class {
 	}
 	/** Writes a worksheet to a CSV file (Node.js, Bun, Deno), replacing it. */
 	async writeFile(path, options = {}) {
-		const bytes = encode(this.text(options), options.encoding);
+		const e = (options.encoding ?? "").toLowerCase();
+		const bytes = encode(this.text(options, e === "latin1" || e === "binary"), options.encoding);
 		const fs = await nodeFs("writeFile");
 		try {
 			await fs.writeFile(path, bytes);
@@ -5274,7 +5414,7 @@ var CsvIO = class {
 	createInputStream() {
 		throw new Error("`CSV#createInputStream` is deprecated. You should use `CSV#read` instead. This method will be removed in version 5.0. Please follow upgrade instruction: https://github.com/exceljs/exceljs/blob/master/UPGRADE-4.0.md");
 	}
-	text(options) {
+	text(options, latin1 = false) {
 		const key = options.sheetName || options.sheetId;
 		const sheet = this.workbook.getWorksheet(key);
 		if (key !== void 0 && !sheet) throw new XlvError("XLV_E_SHEET_NOT_FOUND", `The workbook has no worksheet ${typeof key === "string" ? `named "${key}"` : `with id ${String(key)}`}.`, {
@@ -5282,7 +5422,7 @@ var CsvIO = class {
 			hint: `Available worksheets: ${this.workbook.worksheets.map((w) => `"${w.name}"`).join(", ") || "none"}.`,
 			details: { available: this.workbook.worksheets.map((w) => w.name) }
 		});
-		return worksheetCsv(sheet, options);
+		return worksheetCsv(sheet, options, latin1);
 	}
 };
 // src/defined-names.ts
@@ -5335,6 +5475,33 @@ function decodeEx(value) {
 		...address
 	} : address;
 }
+/**
+* Refuses a range that reaches past the sheet (row 1048576, column XFD) before its cells are
+* created one by one. exceljs bounds only column letters, so a range such as `$A$1:$A$99999999999`
+* makes it loop for hours; xlvane throws instead (security review J, C1).
+*/
+function checkGrid(location) {
+	const { bottom = 0, right = 0 } = location;
+	if (bottom <= 1048576 && right <= 16384) return;
+	const where = `${location.sheetName === void 0 ? "" : `${location.sheetName}!`}rows ${String(location.top)}-${String(bottom)}, columns ${String(location.left)}-${String(right)}`;
+	throw new XlvError("XLV_E_INVALID_CELL_REF", `The range ${where.slice(0, 80)} reaches past the sheet (row 1048576, column XFD).`, {
+		hint: "Use a range inside A1:XFD1048576, for example \"Data!$A$1:$B$10\".",
+		details: { ref: where.slice(0, 80) }
+	});
+}
+/**
+* @internal The number of cells the `model` setter of {@link DefinedNames} creates for one range
+* read from a file, or `null` for a range that reaches past the sheet (it is dropped, as invalid
+* ranges are; security review J, C1).
+*/
+function rangeCellCount(rangeStr) {
+	if (!RANGE.test(rangeStr.split("!").pop() ?? "")) return 0;
+	const location = decodeEx(rangeStr);
+	if (!location.top) return location.row !== void 0 && location.col !== void 0 ? 1 : 0;
+	const { top, left = 0, bottom = 0, right = 0 } = location;
+	if (bottom > 1048576 || right > 16384) return null;
+	return Math.max(0, bottom - top + 1) * Math.max(0, right - left + 1);
+}
 /** The sheet prefix exceljs writes (lib/doc/range.js L153): quoted unless letters and digits only. */
 function sheetPrefix(sheetName) {
 	if (!sheetName) return "";
@@ -5368,8 +5535,10 @@ var CellMatrix = class {
 		return this.sheets.get(sheetName)?.[rowNumber]?.[colNumber];
 	}
 	addCellEx(address) {
-		if (address.top) for (let row = address.top; row <= (address.bottom ?? 0); row++) for (let col = address.left ?? 0; col <= (address.right ?? 0); col++) this.getCellAt(address.sheetName, row, col);
-		else this.findCellEx(address, true);
+		if (address.top) {
+			checkGrid(address);
+			for (let row = address.top; row <= (address.bottom ?? 0); row++) for (let col = address.left ?? 0; col <= (address.right ?? 0); col++) this.getCellAt(address.sheetName, row, col);
+		} else this.findCellEx(address, true);
 	}
 	getCellEx(address) {
 		return this.findCellEx(address, true);
@@ -5466,6 +5635,7 @@ var DefinedNames = class {
 		this.addEx(decodeEx(locStr), name);
 	}
 	addEx(location, name) {
+		if (location.top) checkGrid(location);
 		const matrix = this.getMatrix(name);
 		if (location.top) for (let col = location.left ?? 0; col <= (location.right ?? 0); col++) for (let row = location.top; row <= (location.bottom ?? 0); row++) matrix.getCellAt(location.sheetName, row, col);
 		else matrix.addCellEx(location);
@@ -5736,12 +5906,7 @@ var XlsxIO = class {
 	}
 	/** Reads XLSX data from a readable stream (Node.js stream or any async iterable of bytes). */
 	async read(stream, options) {
-		const chunks = [];
-		let size = 0;
-		for await (const chunk of stream) {
-			chunks.push(chunk);
-			size += chunk.length;
-		}
+		const { chunks, size } = await collectInput(stream, "xlsx.read()");
 		const all = new Uint8Array(size);
 		let at = 0;
 		for (const c of chunks) {
@@ -5883,12 +6048,71 @@ var Workbook = class {
 	get _date1904() {
 		return this.properties.date1904 === true;
 	}
-	/** @internal Names of the other sheets, for the duplicate check of Worksheet.name. */
-	_names = (exclude) => this.worksheets.filter((w) => w !== exclude).map((w) => w.name);
-	/** The id the next worksheet gets (lib/doc/workbook.js `nextId`). */
+	_byName = /* @__PURE__ */ new Map();
+	_firstFree = 1;
+	_maxOrderNo = 0;
+	_maxOrderNoStale = false;
+	/** @internal Whether a sheet other than `exclude` has this name, ignoring case (the duplicate check of Worksheet.name). */
+	_nameTaken(name, exclude) {
+		const sheet = this._byName.get(name.toLowerCase());
+		return sheet !== void 0 && sheet !== exclude;
+	}
+	/** @internal Keeps the name index in step with a renamed sheet. */
+	_renamed(sheet, oldName) {
+		if (this._sheets[sheet.id] !== sheet) return;
+		const old = oldName.toLowerCase();
+		if (this._byName.get(old) === sheet) this._byName.delete(old);
+		this._byName.set(sheet.name.toLowerCase(), sheet);
+	}
+	/** @internal Keeps the largest orderNo in step with a changed one. */
+	_orderNoChanged(sheet, oldOrderNo) {
+		if (this._sheets[sheet.id] !== sheet || this._maxOrderNoStale) return;
+		const value = sheet.orderNo;
+		const plain = (v) => v === void 0 || typeof v === "number" && !Number.isNaN(v);
+		if (!plain(value) || !plain(oldOrderNo)) this._maxOrderNoStale = true;
+		else if (value !== void 0 && value > this._maxOrderNo) this._maxOrderNo = value;
+		else if (oldOrderNo !== void 0 && oldOrderNo >= this._maxOrderNo && (value === void 0 || value < oldOrderNo)) this._maxOrderNoStale = true;
+	}
+	/** @internal Puts a worksheet into `_sheets` at its id and indexes it. */
+	_putSheet(sheet) {
+		const previous = this._sheets[sheet.id];
+		if (previous && previous !== sheet) this._dropSheet(previous);
+		this._sheets[sheet.id] = sheet;
+		this._byName.set(sheet.name.toLowerCase(), sheet);
+		this._orderNoChanged(sheet, void 0);
+	}
+	/** Takes a worksheet out of `_sheets` and its indexes. */
+	_dropSheet(sheet) {
+		this._sheets[sheet.id] = void 0;
+		const key = sheet.name.toLowerCase();
+		if (this._byName.get(key) === sheet) this._byName.delete(key);
+		if (sheet.id < this._firstFree) this._firstFree = Math.max(1, sheet.id);
+		const order = sheet.orderNo;
+		if (order !== void 0 && !(typeof order === "number" && order < this._maxOrderNo)) this._maxOrderNoStale = true;
+	}
+	/** Empties `_sheets` and its indexes. */
+	_clearSheets() {
+		this._sheets = [];
+		this._byName = /* @__PURE__ */ new Map();
+		this._firstFree = 1;
+		this._maxOrderNo = 0;
+		this._maxOrderNoStale = false;
+	}
+	/** The largest orderNo of the sheets, as exceljs computes it (lib/doc/workbook.js L81-85). */
+	_lastOrderNo() {
+		if (this._maxOrderNoStale) {
+			this._maxOrderNo = this._sheets.reduce((acc, ws) => ws?.orderNo !== void 0 && ws.orderNo > acc ? ws.orderNo : acc, 0);
+			this._maxOrderNoStale = false;
+		}
+		return this._maxOrderNo;
+	}
+	/** The id the next worksheet gets (lib/doc/workbook.js `nextId`): the lowest free id. */
 	get nextId() {
-		for (let i = 1; i < this._sheets.length; i++) if (!this._sheets[i]) return i;
-		return this._sheets.length || 1;
+		const sheets = this._sheets;
+		let i = Math.max(1, this._firstFree);
+		while (i < sheets.length && sheets[i]) i++;
+		this._firstFree = i;
+		return i < sheets.length ? i : sheets.length || 1;
 	}
 	/** Adds a worksheet. Names follow exceljs rules (31 characters at most; longer names are cut). */
 	addWorksheet(name, options) {
@@ -5897,13 +6121,34 @@ var Workbook = class {
 	/** @internal Adds a worksheet with a given id (a loaded file's sheetId, a model's id; D-F03). */
 	_addWorksheetWithId(id, name, options) {
 		const sheet = new Worksheet(this, id, name, options);
-		sheet.orderNo = this._sheets.reduce((acc, ws) => ws?.orderNo !== void 0 && ws.orderNo > acc ? ws.orderNo : acc, 0) + 1;
-		this._sheets[id] = sheet;
+		const last = this._lastOrderNo();
+		this._putSheet(sheet);
+		sheet.orderNo = last + 1;
 		return sheet;
 	}
+	/**
+	* @internal Adds a worksheet read from a file (`xlsx.load`, `stream.xlsx.WorkbookReader`). A
+	* name exceljs refuses gives an XlvError with exceljs's message, the sheet and a hint, instead
+	* of the plain Error of `addWorksheet`; an empty name is refused too.
+	*/
+	_addReadWorksheet(id, name, options) {
+		const checked = checkSheetName(name, (n) => this._nameTaken(n));
+		if (checked.message !== void 0) {
+			const existing = checked.duplicate ? this._byName.get(checked.name.toLowerCase())?.name : void 0;
+			throw new XlvError(checked.duplicate ? "XLV_E_DUPLICATE_SHEET_NAME" : "XLV_E_INVALID_SHEET_NAME", checked.message, {
+				location: { sheet: name },
+				hint: checked.duplicate ? "Two worksheets of the file have the same name, ignoring case and after the first 31 characters, which exceljs does not accept. Rename one in a spreadsheet application, or read the file with xlvane's readWorkbook." : "The file names a worksheet in a way exceljs does not accept. Rename the sheet in a spreadsheet application, or read the file with xlvane's readWorkbook.",
+				details: existing === void 0 ? { name } : {
+					name,
+					existing
+				}
+			});
+		}
+		return this._addWorksheetWithId(id, name, options);
+	}
 	removeWorksheet(id) {
 		const sheet = this.getWorksheet(id);
-		if (sheet) this._sheets[sheet.id] = void 0;
+		if (sheet) this._dropSheet(sheet);
 	}
 	/** Removes a worksheet by id or name, as `removeWorksheet` (lib/doc/workbook.js L77). */
 	removeWorksheetEx(worksheet) {
@@ -5979,7 +6224,11 @@ var Workbook = class {
 	getWorksheet(id) {
 		if (id === void 0) return this.worksheets[0];
 		if (typeof id === "number") return this._sheets[id];
-		if (typeof id === "string") return this.worksheets.find((w) => w.name === id);
+		if (typeof id === "string") {
+			const sheet = this._byName.get(id.toLowerCase());
+			if (sheet?.name === id) return sheet;
+			return id === "" ? this.worksheets.find((w) => w.name === id) : void 0;
+		}
 	}
 	/** Worksheets in workbook order. */
 	get worksheets() {
@@ -6027,9 +6276,10 @@ var Workbook = class {
 		const spend = (positions, what, sheet) => {
 			spent += positions;
 			if (spent <= budget) return;
-			throw new XlvError("XLV_E_LIMIT_EXCEEDED", `${what} of worksheet "${sheet}" would create more than ${String(budget)} cells or columns for ${String(cellsRead)} cells in the file.`, {
-				location: { sheet },
-				hint: "The file declares ranges far larger than its data. Load it with ignoreNodes for that element (for example ignoreNodes: [\"mergeCells\"]), or read it with xlvane's readWorkbook, which does not create these objects.",
+			const of = sheet === void 0 ? "" : ` of worksheet "${sheet}"`;
+			throw new XlvError("XLV_E_LIMIT_EXCEEDED", `${what}${of} would create more than ${String(budget)} cells or columns for ${String(cellsRead)} cells in the file.`, {
+				...sheet === void 0 ? {} : { location: { sheet } },
+				hint: sheet === void 0 ? "The file declares names far larger than its data. Read it with xlvane's readWorkbook, which does not create these objects." : "The file declares ranges far larger than its data. Load it with ignoreNodes for that element (for example ignoreNodes: [\"mergeCells\"]), or read it with xlvane's readWorkbook, which does not create these objects.",
 				details: {
 					limit: "maxCells",
 					value: budget
@@ -6037,6 +6287,7 @@ var Workbook = class {
 			});
 		};
 		const rowBudget = Math.max(67108864, 16 * cellsRead);
+		const validations = validationBudget();
 		let rowsLooked = 0;
 		for (const s of read.sheets) {
 			if (s.kind !== "worksheet" || options.maxRows === void 0 && options.maxCols === void 0 || !use("sheetData")) continue;
@@ -6058,7 +6309,7 @@ var Workbook = class {
 				for (const count of perRow.values()) if (count > options.maxCols) limit("maxCols", options.maxCols, count);
 			}
 		}
-		this._sheets = [];
+		this._clearSheets();
 		if (read.dateSystem === "1904") this.properties.date1904 = true;
 		else delete this.properties.date1904;
 		const p = read.properties;
@@ -6078,11 +6329,9 @@ var Workbook = class {
 		this.company = p.company;
 		this.manager = p.manager;
 		this._media = mediaOut(read.images);
-		const sheetIndex = (i) => {
-			let n = -1;
-			for (let k = 0; k <= i && k < read.sheets.length; k++) if (read.sheets[k].kind === "worksheet") n++;
-			return Math.max(n, 0);
-		};
+		const worksheetsUpTo = [];
+		for (const s of read.sheets) worksheetsUpTo.push((worksheetsUpTo[worksheetsUpTo.length - 1] ?? 0) + (s.kind === "worksheet" ? 1 : 0));
+		const sheetIndex = (i) => i < 0 || worksheetsUpTo.length === 0 ? 0 : Math.max((worksheetsUpTo[Math.min(i, worksheetsUpTo.length - 1)] ?? 0) - 1, 0);
 		this.views = read.views.map((v) => {
 			const view = {
 				x: v.x ?? 0,
@@ -6097,14 +6346,22 @@ var Workbook = class {
 		});
 		this.calcProperties = read.calculation?.fullCalcOnLoad ? { fullCalcOnLoad: true } : {};
 		const mediaIds = new Map(read.images.map((img, i) => [img, i]));
-		this._definedNames.model = read.definedNames.filter((d) => !d.name.startsWith("_xlnm.")).map((d) => ({
-			name: d.name,
-			ranges: extractRanges(d.refersTo)
-		}));
+		this._definedNames.model = read.definedNames.filter((d) => !d.name.startsWith("_xlnm.")).map((d) => {
+			const ranges = extractRanges(d.refersTo).filter((range) => {
+				const cells = rangeCellCount(range);
+				if (cells === null) return false;
+				spend(cells, `The defined name "${d.name.slice(0, 255)}"`, void 0);
+				return true;
+			});
+			return {
+				name: d.name,
+				ranges
+			};
+		});
 		const ids = freeIds(read.sheets.map((s) => s.kind === "worksheet" ? s.sheetId : void 0));
 		for (const [position, s] of read.sheets.entries()) {
 			if (s.kind !== "worksheet") continue;
-			const ws = this._addWorksheetWithId(ids[position] ?? this.nextId, s.name, { state: s.state });
+			const ws = this._addReadWorksheet(ids[position] ?? this.nextId, s.name, { state: s.state });
 			ws.orderNo = position;
 			for (const c of use("cols") ? s.columns : []) {
 				const last = Math.min(c.max, 16384);
@@ -6183,13 +6440,27 @@ var Workbook = class {
 			for (const m of use("mergeCells") ? s.merges : []) {
 				if (!m.includes(":")) continue;
 				spend(areaOf(m), "A merged range", s.name);
-				ws.mergeCells(m);
+				try {
+					ws.mergeCells(m);
+				} catch (error) {
+					if (error instanceof XlvError || !(error instanceof Error) || error.message !== "Cannot merge already merged cells") throw error;
+					const other = mergeOverlapping(ws, m);
+					throw new XlvError("XLV_E_OVERLAPPING_MERGE", `Cannot merge already merged cells: the merged range ${m} of worksheet "${s.name}" shares cells with ${other ?? "an earlier merged range"}.`, {
+						location: {
+							sheet: s.name,
+							cell: m
+						},
+						hint: "The file has merged ranges that share cells, which exceljs does not accept. Load it with ignoreNodes: [\"mergeCells\"], or read it with xlvane's readWorkbook.",
+						details: other === void 0 ? {} : { other },
+						cause: error
+					});
+				}
 			}
 			if (use("sheetViews")) ws.views = [viewOut(s.view, s.freeze)];
 			const tab = colorOut(s.tabColor ?? void 0);
 			if (tab && use("sheetPr")) ws.properties["tabColor"] = tab;
 			if (s.autoFilter && use("autoFilter")) ws.autoFilter = s.autoFilter;
-			if (use("dataValidations")) ws.dataValidations.model = dataValidationsOut(s.dataValidations, read.dateSystem === "1904");
+			if (use("dataValidations")) ws.dataValidations.model = dataValidationsOut(s.dataValidations, read.dateSystem === "1904", validations);
 			if (use("conditionalFormatting")) ws.conditionalFormattings = conditionalFormatsOut(s.conditionalFormats);
 			if (use("sheetProtection")) ws.sheetProtection = s.protection ? protectionOut(s.protection) : null;
 			if (use("pageSetup")) ws.pageSetup = pageSetupOut(s.pageSetup, s.printArea, s.printTitles);
@@ -6213,6 +6484,31 @@ var Workbook = class {
 	}
 };
 /**
+* @internal The chunks of an input stream, read until it ends. Reading stops with
+* XLV_E_LIMIT_EXCEEDED as soon as the chunks pass maxInputBytes, the size the core reads at most,
+* so an endless stream is not collected first (security review J, C8).
+*/
+async function collectInput(stream, what) {
+	const limit = DEFAULT_READ_LIMITS.maxInputBytes;
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of stream) {
+		chunks.push(chunk);
+		size += chunk.length;
+		if (size > limit) throw new XlvError("XLV_E_LIMIT_EXCEEDED", `The stream given to ${what} holds more than ${String(limit)} bytes (maxInputBytes).`, {
+			hint: "Check that the stream is the XLSX file you expect. A larger file from a trusted source can be read with xlvane's readWorkbook and a higher limit, for example { limits: { maxInputBytes: 1073741824 } }.",
+			details: {
+				limit: "maxInputBytes",
+				value: limit
+			}
+		});
+	}
+	return {
+		chunks,
+		size
+	};
+}
+/**
 * Worksheet ids for a list of wanted ids: each whole number from 1 to 65534 (the sheet ids Office
 * uses, W2-20) that is not wanted by an earlier entry is kept; other entries (missing, invalid,
 * larger or repeated ids) get the lowest ids no entry wants, in order. The limit keeps the
@@ -6236,17 +6532,33 @@ function freeIds(wanted) {
 		return next;
 	});
 }
-/** Cells in a range such as "A1:C3" (1 for a cell, 0 for anything else). */
-function areaOf(ref) {
+/** The rows and columns of a range such as "A1:C3" or a cell, or `null` for anything else. */
+function rangeOf(ref) {
 	const m = /^([A-Z]{1,3})(\d{1,7})(?::([A-Z]{1,3})(\d{1,7}))?$/.exec(ref.replace(/\$/g, ""));
-	if (!m) return 0;
+	if (!m) return null;
 	const col = (letters) => {
 		let n = 0;
 		for (const ch of letters) n = n * 26 + ch.charCodeAt(0) - 64;
 		return n;
 	};
 	const [, c1 = "A", r1 = "1", c2 = c1, r2 = r1] = m;
-	return (Math.abs(Number(r2) - Number(r1)) + 1) * (Math.abs(col(c2) - col(c1)) + 1);
+	return {
+		top: Math.min(Number(r1), Number(r2)),
+		left: Math.min(col(c1), col(c2)),
+		bottom: Math.max(Number(r1), Number(r2)),
+		right: Math.max(col(c1), col(c2))
+	};
+}
+/** Cells in a range such as "A1:C3" (1 for a cell, 0 for anything else). */
+function areaOf(ref) {
+	const r = rangeOf(ref);
+	return r ? (r.bottom - r.top + 1) * (r.right - r.left + 1) : 0;
+}
+/** A merged range of the worksheet that shares cells with `ref`, as "A1:B2". */
+function mergeOverlapping(ws, ref) {
+	const r = rangeOf(ref);
+	if (!r) return void 0;
+	for (const o of ws._merges.values()) if (o.top <= r.bottom && r.top <= o.bottom && o.left <= r.right && r.left <= o.right) return `${columnLetter(o.left)}${String(o.top)}:${columnLetter(o.right)}${String(o.bottom)}`;
 }
 // src/stream.ts
 /**
@@ -6641,7 +6953,7 @@ var WorkbookWriter = class {
 	/** Adds a worksheet. Sheets are written in the order their first rows are committed. */
 	addWorksheet(name, options) {
 		const sheet = new WorksheetWriter(this, this.nextId++, name, options);
-		this._book._sheets[sheet.id] = sheet;
+		this._book._putSheet(sheet);
 		this.open.push(sheet);
 		return sheet;
 	}
@@ -6894,8 +7206,7 @@ var WorkbookReader = class extends Emitter {
 			return openWorkbookStreamFile(input);
 		}
 		if (input instanceof Uint8Array || input instanceof ArrayBuffer) return openWorkbookStream(input);
-		const chunks = [];
-		for await (const c of input) chunks.push(c);
+		const { chunks } = await collectInput(input, "stream.xlsx.WorkbookReader");
 		return openWorkbookStream(new Blob(chunks));
 	}
 	/** Worksheet events in workbook order, as exceljs `parse()` yields them (`{ eventType: 'worksheet', value }`). */
@@ -6914,7 +7225,7 @@ var WorkbookReader = class extends Emitter {
 				type: "worksheet",
 				id: String(id)
 			});
-			const sheet = host.addWorksheet(info.name, { state: info.state });
+			const sheet = host._addReadWorksheet(host.nextId, info.name, { state: info.state });
 			const name = info.name;
 			const rows = async function* () {
 				for await (const r of book.rows(name)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xlvane/compat",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "The commonly used exceljs 4.4.0 API on top of xlvane, for switching with one line in package.json.",
   "keywords": [
     "xlsx",
@@ -72,7 +72,7 @@
     "build": "tsdown"
   },
   "dependencies": {
-    "xlvane": "^1.2.2"
+    "xlvane": "^1.2.3"
   },
   "publishConfig": {
     "access": "public",