@xlvane/compat 1.2.2 → 1.3.0

package/dist/index.js

@@ -1040,24 +1040,60 @@ function sharedFormulaRanges(ws) {
 		const m = decodeAddress(master);
 		return m.row === b.top && m.col === b.left;
 	});
-	const overlaps = (a, b) => a.top <= b.bottom && b.top <= a.bottom && a.left <= b.right && b.left <= a.right;
-	const bad = /* @__PURE__ */ new Set();
-	const sorted = [...groups].sort((x, y) => x[1].top - y[1].top);
-	for (let i = 0; i < sorted.length; i++) {
-		const [mi, bi] = sorted[i];
-		for (let j = i + 1; j < sorted.length && sorted[j][1].top <= bi.bottom; j++) {
-			const [mj, bj] = sorted[j];
-			if (overlaps(bi, bj)) {
-				bad.add(mi);
-				bad.add(mj);
-			}
-		}
-		if (arrays.some((a) => overlaps(a, bi))) bad.add(mi);
-	}
+	const boxes = groups.map(([, b]) => b);
+	const withGroups = overlapCounts(boxes, boxes);
+	const withArrays = overlapCounts(boxes, arrays);
 	const out = /* @__PURE__ */ new Map();
-	for (const [master, b] of groups) if (!bad.has(master)) out.set(master, `${columnLetter(b.left)}${String(b.top)}:${columnLetter(b.right)}${String(b.bottom)}`);
+	groups.forEach(([master, b], i) => {
+		if (withGroups[i] === 1 && withArrays[i] === 0) out.set(master, `${columnLetter(b.left)}${String(b.top)}:${columnLetter(b.right)}${String(b.bottom)}`);
+	});
 	return out;
 }
+/**
+* For each box of `queries`, the number of boxes of `set` that share at least one cell with it.
+* Two boxes share cells when their rows and their columns overlap. Among the boxes with
+* `top <= q.bottom`, those with `bottom < q.top` are exactly the ones whose rows miss q's rows,
+* so the count is (boxes with top <= q.bottom whose columns meet q's) - (boxes with
+* bottom < q.top whose columns meet q's). Each term is found by a sweep over rows with two
+* Fenwick trees of columns: the columns of a box meet [a, b] unless it ends before a or starts
+* after b. Time O((queries + set) log(columns)).
+*/
+function overlapCounts(queries, set) {
+	const counts = new Array(queries.length).fill(0);
+	if (queries.length === 0 || set.length === 0) return counts;
+	let width = 1;
+	for (const b of set) width = Math.max(width, b.right + 1);
+	for (const q of queries) width = Math.max(width, q.right + 1);
+	const sweep = (key, at, sign) => {
+		const lefts = new Array(width + 1).fill(0);
+		const rights = new Array(width + 1).fill(0);
+		const add = (tree, i) => {
+			for (let k = Math.max(1, i); k <= width; k += k & -k) tree[k] += 1;
+		};
+		const below = (tree, i) => {
+			let n = 0;
+			for (let k = Math.min(i, width); k > 0; k -= k & -k) n += tree[k];
+			return n;
+		};
+		const boxes = [...set].sort((x, y) => key(x) - key(y));
+		const order = queries.map((_, i) => i).sort((x, y) => at(queries[x]) - at(queries[y]));
+		let added = 0;
+		for (const i of order) {
+			const q = queries[i];
+			const t = at(q);
+			while (added < boxes.length && key(boxes[added]) <= t) {
+				const b = boxes[added++];
+				add(lefts, b.left);
+				add(rights, b.right);
+			}
+			const meet = added - below(rights, q.left - 1) - (added - below(lefts, q.right));
+			counts[i] += sign * meet;
+		}
+	};
+	sweep((b) => b.top, (q) => q.bottom, 1);
+	sweep((b) => b.bottom, (q) => q.top - 1, -1);
+	return counts;
+}
 /** Converts a cell value for the writer; a `{ text, hyperlink }` value gives its text (the link is {@link linkIn}). */
 function valueIn(cell, sharedRanges) {
 	const v = cell.value;
@@ -1328,6 +1364,17 @@ function at(sheet, cell, run) {
 		});
 	}
 }
+/** The 32-bit FNV-1a hash of bytes. */
+function fnv1a(bytes) {
+	let h = 2166136261;
+	for (let i = 0; i < bytes.length; i++) h = Math.imul(h ^ bytes[i], 16777619);
+	return h >>> 0;
+}
+function sameBytes(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
 /** Builds an xlvane workbook from the exceljs model (D-503). */
 function toNewWorkbook(sheets, date1904, meta = {}) {
 	const book = createWorkbook({
@@ -1337,6 +1384,7 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 	if (sheets.length === 0) notSupported("Writing a workbook without worksheets");
 	const coreImages = /* @__PURE__ */ new Map();
 	const coreBytes = [];
+	const coreByHash = /* @__PURE__ */ new Map();
 	const imageId = (id) => {
 		let core = coreImages.get(id);
 		if (core === void 0) {
@@ -1349,10 +1397,14 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 				}
 			});
 			const bytes = imageBytes(image);
-			const same = coreBytes.findIndex((b) => b.length === bytes.length && b.every((x, i) => x === bytes[i]));
-			if (same === -1) {
+			const key = `${String(bytes.length)}:${String(fnv1a(bytes))}`;
+			const candidates = coreByHash.get(key) ?? [];
+			const same = candidates.find((c) => sameBytes(coreBytes[c], bytes));
+			if (same === void 0) {
 				core = book.addImage(bytes);
 				coreBytes[core] = bytes;
+				candidates.push(core);
+				coreByHash.set(key, candidates);
 			} else core = same;
 			coreImages.set(id, core);
 		}
@@ -1382,6 +1434,8 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 			}
 			return c;
 		};
+		const styleFor = (cell) => useStyles ? cellStyleIn(cell, styleOf(cell.style)) : isDateCell(cell) ? { numFmt: 14 } : {};
+		const uniform = uniformMerges(ws);
 		ws._rows.forEach((row) => {
 			if (!row) return;
 			if (row.height !== void 0 || row.hidden || row.outlineLevel) sheet.row(row.number, {
@@ -1391,13 +1445,31 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 				...row.collapsed ? { collapsed: true } : {}
 			});
 			row._cells.forEach((cell) => {
-				if (cell) at(ws.name, cell.address, () => writeCell(cell));
+				if (!cell) return;
+				if (cell._master !== null && uniform.masters.has(cell._master)) {
+					if (cell.note !== void 0) at(ws.name, cell.address, () => {
+						const note = noteIn(cell);
+						if (note) sheet.note(cell.address, note);
+					});
+				} else at(ws.name, cell.address, () => writeCell(cell));
 			});
 		});
+		for (const m of uniform.ranges) {
+			const master = ws.findCell(m.top, m.left);
+			if (!master) continue;
+			const style = styleFor(master);
+			if (Object.keys(style).length === 0) continue;
+			const width = m.right - m.left + 1;
+			const step = Math.max(1, Math.floor(MERGE_STYLE_BLOCK / width));
+			for (let top = m.top; top <= m.bottom; top += step) {
+				const bottom = Math.min(m.bottom, top + step - 1);
+				sheet.style(`${columnLetter(m.left)}${String(top)}:${columnLetter(m.right)}${String(bottom)}`, style);
+			}
+		}
 		function writeCell(cell) {
 			const note = noteIn(cell);
 			if (note) sheet.note(cell.address, note);
-			const style = useStyles ? cellStyleIn(cell, styleOf(cell.style)) : isDateCell(cell) ? { numFmt: 14 } : {};
+			const style = styleFor(cell);
 			const value = cell.type === ValueType.Merge ? null : valueIn(cell, sharedRanges);
 			if (value === null && Object.keys(style).length === 0) return;
 			sheet.set(cell.address, value, style);
@@ -1433,6 +1505,55 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 	for (const d of meta.definedNames ?? []) book.defineName(d.name, d.ranges.join(","));
 	return book;
 }
+/** Cells styled by one `sheet.style` call for a merged range: at most what the core styles at once. */
+const MERGE_STYLE_BLOCK = 1048576;
+/** Whether two exceljs styles have the same parts (the same objects, as a merge's copies have). */
+function sameStyleParts(a, b) {
+	if (a === b) return true;
+	let n = 0;
+	for (const k in a) {
+		if (a[k] !== b[k]) return false;
+		n++;
+	}
+	for (const _ in b) n--;
+	return n === 0;
+}
+/**
+* The merged ranges of a worksheet whose other cells all exist, belong to the range's master and
+* carry the master's style (the copy `mergeCells` gives them, as in exceljs), and the masters all
+* of whose ranges are such. Their cells are written as the master's style over the range (K2),
+* and their notes one by one (K3).
+*/
+function uniformMerges(ws) {
+	const ranges = [];
+	const masters = /* @__PURE__ */ new Set();
+	const mixed = /* @__PURE__ */ new Set();
+	for (const m of ws._merges.values()) {
+		const master = ws.findCell(m.top, m.left);
+		if (!master) continue;
+		let ok = true;
+		for (let r = m.top; ok && r <= m.bottom; r++) {
+			const row = ws.findRow(r);
+			for (let c = m.left; c <= m.right; c++) {
+				if (r === m.top && c === m.left) continue;
+				const cell = row?.findCell(c);
+				if (!cell || cell._master !== master || !sameStyleParts(cell.style, master.style)) {
+					ok = false;
+					break;
+				}
+			}
+		}
+		if (ok) {
+			ranges.push(m);
+			masters.add(master);
+		} else mixed.add(master);
+	}
+	for (const master of mixed) masters.delete(master);
+	return {
+		ranges: ranges.filter((m) => masters.has(ws.findCell(m.top, m.left))),
+		masters
+	};
+}
 /**
 * The validations, conditional formats, protection and printing settings of a worksheet in the
 * form of the core API (D-C06). exceljs always writes page margins and page setup
@@ -1546,6 +1667,18 @@ function viewOut(view, freeze) {
 	};
 }
 /**
+* Whether a formula read by xlvane has text, without making the core build it: the core moves a
+* shared master's text to a dependent only when the dependent's `text` is read (a getter), and
+* gives `null` (a plain value) when it cannot move it. Reading the text of every dependent made a
+* small file with a huge master and many dependents exhaust memory (K2), and exceljs reads a
+* dependent as `{ sharedFormula }` without its text anyway.
+*/
+function hasFormulaText(f) {
+	const d = Object.getOwnPropertyDescriptor(f, "text");
+	if (d !== void 0 && d.get !== void 0) return true;
+	return f.text !== null;
+}
+/**
 * A formula read by xlvane in exceljs's shape (cell-xform.js L460–470; X4-29): a shared-formula
 * master `{ formula, result, ref, shareType: 'shared' }`, a dependent `{ sharedFormula: master,
 * result }` (its `cell.formula` is translated), an array formula `{ formula, result, ref,
@@ -1725,11 +1858,17 @@ function rangeText(r) {
 	return r.top === r.bottom && r.left === r.right ? a : `${a}:${address(r.bottom, r.right)}`;
 }
 /**
-* Cells per sheet up to which validations read from a file are given to every cell they cover,
-* as exceljs does (data-validations-xform.js L229–239). Larger ranges, such as whole columns,
-* keep their range as the key; `find()` and `cell.dataValidation` still answer for every cell.
+* Cells per workbook up to which validations read from a file are given to every cell they
+* cover, as exceljs does (data-validations-xform.js L229–239). Larger ranges, such as whole
+* columns, and ranges read after the budget is spent keep their range as the key; `find()` and
+* `cell.dataValidation` still answer for every cell. The budget is shared by all sheets of a
+* load, so many sheets cannot each expand 100 000 cells (security review J, C2).
 */
 const MAX_EXPANDED_CELLS = 1e5;
+/** @internal The budget of {@link dataValidationsOut} for one workbook load. */
+function validationBudget() {
+	return { left: MAX_EXPANDED_CELLS };
+}
 /**
 * The data validations of a worksheet (`worksheet.dataValidations`), keyed by cell address or
 * range as in exceljs (lib/doc/data-validations.js). `remove()` deletes the entry; exceljs
@@ -1906,21 +2045,23 @@ function validationOut(d, date1904) {
 	]) if (d[k] !== null) out[k] = d[k];
 	return out;
 }
-/** The `worksheet.dataValidations` model of validations read by xlvane. */
-function dataValidationsOut(list, date1904) {
+/**
+* The `worksheet.dataValidations` model of validations read by xlvane. `budget` is the number of
+* cells still to expand; pass the same object for every sheet of a workbook.
+*/
+function dataValidationsOut(list, date1904, budget = validationBudget()) {
 	const model = Object.create(null);
-	let budget = MAX_EXPANDED_CELLS;
 	for (const d of list) {
 		const v = validationOut(d, date1904);
 		for (const part of d.sqref.split(/\s+/)) {
 			const r = parseRange(part);
 			if (!r) continue;
 			const size = (r.bottom - r.top + 1) * (r.right - r.left + 1);
-			if (size > budget) {
+			if (size > budget.left) {
 				model[part] = v;
 				continue;
 			}
-			budget -= size;
+			budget.left -= size;
 			for (let row = r.top; row <= r.bottom; row++) for (let col = r.left; col <= r.right; col++) model[address(row, col)] = v;
 		}
 	}
@@ -2798,6 +2939,56 @@ function notSupported(feature) {
 		details: { feature }
 	});
 }
+/**
+* The shared-formula text moved per workbook (K4 S1, D-K04). A move costs time in proportion to the
+* master's length, and the load-time budget is spent once, so a 4 KB file whose 1 000 000-character
+* master is shared with 250 cells took about 47 s to read every dependent's formula once. Two
+* budgets, counting the master's text read plus the moved text built for each `cell.formula` that
+* is not kept yet:
+* - every move: 512 Mi characters, the default `maxSharedStringChars` with which xlvane's
+*   `readWorkbook` expands shared formulas, so a workbook the core reads is read here too;
+* - moves of masters longer than 8192 characters, the longest formula Office writes ([MS-OI29500]
+*   §2.1.1085 a): 32 Mi characters, so such a master stops after a few moves.
+*/
+const SHARED_FORMULA_TEXT = 536870912;
+const LONG_SHARED_FORMULA_TEXT = 33554432;
+const LONG_FORMULA = 8192;
+/** Characters moved in all and for long masters, per workbook (a `Worksheet.workbook`). */
+const sharedFormulaSpent = /* @__PURE__ */ new WeakMap();
+/**
+* @internal Moves the text of a shared-formula master at `master` to `row`/`col` of `sheet` with
+* `shiftFormula`, counted against the workbook's shared-formula budgets; `undefined` when the
+* formula cannot be moved. Throws `XLV_E_LIMIT_EXCEEDED` before a move that would pass one.
+*/
+function moveSharedFormula(workbook, sheet, text, master, row, col) {
+	let spent = sharedFormulaSpent.get(workbook);
+	if (spent === void 0) sharedFormulaSpent.set(workbook, spent = {
+		chars: 0,
+		long: 0
+	});
+	const cost = 2 * text.length;
+	const long = text.length > LONG_FORMULA;
+	const limit = long && spent.long + cost > LONG_SHARED_FORMULA_TEXT ? LONG_SHARED_FORMULA_TEXT : spent.chars + cost > SHARED_FORMULA_TEXT ? SHARED_FORMULA_TEXT : null;
+	if (limit !== null) {
+		const cell = `${columnLetter(col)}${String(row)}`;
+		throw new XlvError("XLV_E_LIMIT_EXCEEDED", `Moving the shared formula of ${columnLetter(master.col)}${String(master.row)} (${String(text.length)} characters) to ${cell} of worksheet "${sheet}" would bring the shared-formula text moved in this workbook past ${String(limit)} characters.`, {
+			location: {
+				sheet,
+				cell
+			},
+			hint: "The workbook shares very long formulas with many cells. Read the dependents' cached result (cell.result) instead of cell.formula, or read the file with xlvane's readWorkbook, whose shared-formula text is limited by limits.maxSharedStringChars.",
+			details: {
+				limit: "sharedFormulaText",
+				value: limit
+			}
+		});
+	}
+	const moved = shiftFormula(text, row - master.row, col - master.col);
+	const used = text.length + (moved?.length ?? 0);
+	spent.chars += used;
+	if (long) spent.long += used;
+	return moved ?? void 0;
+}
 /** Column letters for a 1-based number (A … XFD). */
 function columnLetter(n) {
 	let s = "";
@@ -2842,7 +3033,7 @@ function typeOf(value) {
 	if (value instanceof Date) return ValueType.Date;
 	if (isRecord(value)) {
 		if (value["text"] && value["hyperlink"]) return ValueType.Hyperlink;
-		if (value["formula"] || value["sharedFormula"]) return ValueType.Formula;
+		if (value["sharedFormula"] || value["formula"]) return ValueType.Formula;
 		if (value["richText"]) return ValueType.RichText;
 		if (value["sharedString"]) return ValueType.SharedString;
 		if (value["error"]) return ValueType.Error;
@@ -2891,6 +3082,8 @@ var Cell = class {
 	_master = null;
 	/** @internal Number of merged ranges this cell is the master of. */
 	_mergeCount = 0;
+	/** The moved formula of a `{ sharedFormula }` value, and what it was moved from (see `formula`). */
+	_moved = void 0;
 	/** @internal Use `worksheet.getCell()`. */
 	constructor(_row, _col) {
 		this._row = _row;
@@ -2976,12 +3169,39 @@ var Cell = class {
 		const v = this.value;
 		if (!isRecord(v)) return void 0;
 		if (typeof v["formula"] === "string") return v["formula"];
-		if (typeof v["sharedFormula"] === "string") {
-			const masterRef = v["sharedFormula"].replace(/\$/g, "");
+		const shared = v["sharedFormula"];
+		if (typeof shared === "string") {
+			const masterRef = shared.replace(/\$/g, "");
 			const master = this.worksheet.findCell(masterRef);
-			const text = master?.formula;
-			if (!master || text === void 0 || master === this) return void 0;
-			return shiftFormula(text, this.row - master.row, this.col - master.col) ?? void 0;
+			let text;
+			let at;
+			if (!master) {
+				text = this.worksheet._sharedMasters?.get(masterRef.toUpperCase());
+				if (text === void 0) return void 0;
+				at = decodeAddress(masterRef);
+			} else {
+				if (master === this) return void 0;
+				text = master.formula;
+				if (text === void 0) return void 0;
+				at = {
+					row: master.row,
+					col: master.col
+				};
+			}
+			const kept = this._moved;
+			if (kept !== void 0 && kept.value === v && kept.shared === shared && kept.master === text && kept.masterRow === at.row && kept.masterCol === at.col && kept.row === this.row && kept.col === this.col) return kept.text;
+			const moved = moveSharedFormula(this.worksheet.workbook, this.worksheet.name, text, at, this.row, this.col);
+			this._moved = {
+				value: v,
+				shared,
+				master: text,
+				masterRow: at.row,
+				masterCol: at.col,
+				row: this.row,
+				col: this.col,
+				text: moved
+			};
+			return moved;
 		}
 	}
 	/** `FormulaType.Shared` for a `{ sharedFormula }` value, `Master` for other formulas, otherwise `None` (lib/doc/cell.js L807). */
@@ -3628,6 +3848,30 @@ function parseRangeArgs(args) {
 		right: Math.max(s.col, e.col)
 	};
 }
+/**
+* @internal exceljs's rules for a worksheet name (lib/doc/worksheet.js L134-173): the name to
+* use, cut to 31 characters, or exceljs's message for a name it refuses. `taken` tells whether
+* another sheet of the workbook has a name (already cut) that equals it ignoring case.
+*/
+function checkSheetName(value, taken) {
+	const fail = (message) => ({
+		name: typeof value === "string" ? value : "",
+		message,
+		duplicate: false
+	});
+	if (typeof value !== "string") return fail("The name has to be a string.");
+	if (value === "") return fail("The name can't be empty.");
+	if (value === "History") return fail("The name \"History\" is protected. Please use a different name.");
+	if (/[*?:/\\[\]]/.test(value)) return fail(`Worksheet name ${value} cannot include any of the following characters: * ? : \\ / [ ]`);
+	if (/(^')|('$)/.test(value)) return fail(`The first or last character of worksheet name cannot be a single quotation mark: ${value}`);
+	const name = value.length > 31 ? value.substring(0, 31) : value;
+	if (taken(name)) return {
+		name,
+		message: `Worksheet name already exists: ${name}`,
+		duplicate: true
+	};
+	return { name };
+}
 /** The merged ranges of a worksheet by master address, with a counter of changes (D-H01). */
 var MergeMap = class extends Map {
 	version = 0;
@@ -3666,7 +3910,15 @@ var Worksheet = class {
 	* largest of the other sheets for a new sheet (lib/doc/workbook.js L81-85), the 0-based position
 	* in the file for a loaded one (L203). Worksheets are listed in this order.
 	*/
-	orderNo;
+	get orderNo() {
+		return this._orderNo;
+	}
+	set orderNo(value) {
+		const old = this._orderNo;
+		this._orderNo = value;
+		this.workbook._orderNoChanged?.(this, old);
+	}
+	_orderNo;
 	state;
 	views;
 	autoFilter = null;
@@ -3690,6 +3942,11 @@ var Worksheet = class {
 	_columns = [];
 	/** @internal */
 	_merges = new MergeMap();
+	/**
+	* @internal Formulas of shared-formula masters by address, for the dependents of a worksheet
+	* whose rows are not kept (stream.xlsx.WorkbookReader), so `cell.formula` can move them (K2).
+	*/
+	_sharedMasters = void 0;
 	/** The cells covered by `_merges` (row × 16 385 + column), valid while `_mergedVersion` equals `_merges.version`. */
 	_mergedCells = /* @__PURE__ */ new Set();
 	_mergedVersion = -1;
@@ -3717,16 +3974,12 @@ var Worksheet = class {
 	}
 	/** Sheet name rules of exceljs (lib/doc/worksheet.js L134–173), including truncation to 31 characters. */
 	set name(value) {
-		let name = value;
-		if (name === this._name) return;
-		if (typeof name !== "string") throw new Error("The name has to be a string.");
-		if (name === "") throw new Error("The name can't be empty.");
-		if (name === "History") throw new Error("The name \"History\" is protected. Please use a different name.");
-		if (/[*?:/\\[\]]/.test(name)) throw new Error(`Worksheet name ${name} cannot include any of the following characters: * ? : \\ / [ ]`);
-		if (/(^')|('$)/.test(name)) throw new Error(`The first or last character of worksheet name cannot be a single quotation mark: ${name}`);
-		if (name.length > 31) name = name.substring(0, 31);
-		if (this.workbook._names(this).some((n) => n.toLowerCase() === name.toLowerCase())) throw new Error(`Worksheet name already exists: ${name}`);
-		this._name = name;
+		if (value === this._name) return;
+		const checked = checkSheetName(value, (name) => this.workbook._nameTaken(name, this));
+		if (checked.message !== void 0) throw new Error(checked.message);
+		const old = this._name;
+		this._name = checked.name;
+		this.workbook._renamed?.(this, old);
 	}
 	/** Deprecated in exceljs in favour of `properties.tabColor`, which it reads and sets (lib/doc/worksheet.js L827). */
 	get tabColor() {
@@ -4610,8 +4863,12 @@ const INJECTION_START = /* @__PURE__ */ new Set([
 	"﹦",
 	"﹢",
 	"﹣",
-	"﹫"
+	"﹫",
+	"",
+	"￾"
 ]);
+/** Characters a field is quoted for while formulas are escaped, whatever the delimiter: other applications may split on them (K2). */
+const COMMON_DELIMITERS = ",;	|";
 function invalid(name, message, hint) {
 	return new XlvError("XLV_E_INVALID_OPTION", message, {
 		hint,
@@ -4707,7 +4964,7 @@ function formatDate(date, format, utc) {
 	});
 }
 const PARSE_TOKENS = /(\[[^[]*\])|([-_:/.,()\s]+)|(A|a|Q|YYYY|YY?|ww?|MM?M?M?|Do|DD?|hh?|HH?|mm?|ss?|S{1,3}|z|ZZ?)/g;
-const WORD = /\d*[^-_:/,()\s\d]+/;
+const WORD = /(?<!\d)\d*[^-_:/,()\s\d]+/;
 const ONE_OR_TWO = /\d\d?/;
 const PARSE_EXPRESSIONS = {
 	A: WORD,
@@ -4897,9 +5154,41 @@ function malformed(line, message) {
 		details: { line }
 	});
 }
-/** Splits CSV text into rows of fields as fast-csv 4.3 does with the given parser options. */
-function parseCsv(text, o) {
-	const rows = [];
+/** Rows and columns of a worksheet (Part 1 §18.3.1.73, ST_CellRef up to XFD1048576). */
+const MAX_SHEET_ROWS = 1048576;
+const MAX_SHEET_COLUMNS = 16384;
+/** Fields added to the worksheet in total, as the core's `maxCells` read limit (K3). */
+const MAX_CSV_CELLS = DEFAULT_READ_LIMITS.maxCells;
+function tooMany(what, line) {
+	if (what === "cells") return new XlvError("XLV_E_LIMIT_EXCEEDED", `CSV line ${String(line)}: the CSV has more than ${String(MAX_CSV_CELLS)} fields in the rows read, the most csv.read adds to a worksheet.`, {
+		location: { line },
+		hint: "Split the CSV file into smaller parts, read only part of it with parserOptions.maxRows or skipRows, or read it with the core fromCSV, whose maxCells option can be raised for a trusted file.",
+		details: {
+			limit: "maxCells",
+			value: MAX_CSV_CELLS,
+			line
+		}
+	});
+	const rows = what === "rows";
+	const max = rows ? MAX_SHEET_ROWS : MAX_SHEET_COLUMNS;
+	return new XlvError("XLV_E_LIMIT_EXCEEDED", `CSV line ${String(line)}: ${rows ? `the CSV has more than ${String(max)} rows` : `the row has more than ${String(max)} fields`}, more than a worksheet can hold.`, {
+		location: { line },
+		hint: rows ? "Split the CSV file into parts of at most 1048576 rows, or read only part of it with parserOptions.maxRows." : "Split the CSV file into parts of at most 16384 columns, or check the delimiter (parserOptions.delimiter).",
+		details: {
+			limit: rows ? "maxRows" : "maxColumns",
+			value: max,
+			line
+		}
+	});
+}
+/**
+* The rows of CSV text, split as fast-csv 4.3 does with the given parser options, one at a time:
+* the rows that `ignoreEmpty`, the header, `skipRows` and `maxRows` drop are left out. More than
+* 1 048 576 rows, or a row of more than 16 384 fields, throw `XLV_E_LIMIT_EXCEEDED` as soon as
+* they are reached, because a worksheet cannot hold them (K2); so do more than 5 000 000 fields
+* in the rows given (`DEFAULT_READ_LIMITS.maxCells`, K3).
+*/
+function* csvRows(text, o) {
 	let at = 0;
 	let line = 1;
 	const n = text.length;
@@ -4908,6 +5197,10 @@ function parseCsv(text, o) {
 		if (text[i] === "\r" && text[i + 1] === "\n") return i + 2;
 		return i < n ? i + 1 : i;
 	};
+	const trim = (f) => o.trim ? f.trim() : o.ltrim ? f.trimStart() : o.rtrim ? f.trimEnd() : f;
+	let kept = 0;
+	let emitted = 0;
+	let cells = 0;
 	for (let k = 0; k < o.skipLines && at < n; k++) {
 		while (!atLineEnd(at)) at++;
 		at = skipLineEnd(at);
@@ -4920,38 +5213,50 @@ function parseCsv(text, o) {
 			line++;
 			continue;
 		}
+		const rowLine = line;
 		const fields = [];
+		let extra = 0;
+		let extraText = false;
+		const push = (field) => {
+			if (fields.length < MAX_SHEET_COLUMNS) fields.push(field);
+			else {
+				extra++;
+				if (field.trim() !== "") extraText = true;
+			}
+		};
 		for (;;) {
 			let start = at;
 			while (start < n && (text[start] === " " || text[start] === "	") && text[start] !== o.delimiter) start++;
 			if (o.quote !== "" && text[start] === o.quote) {
 				let value = "";
 				let i = start + 1;
+				let from = i;
 				const opened = line;
 				for (;;) {
 					if (i >= n) throw malformed(opened, `missing closing ${o.quote} for the field that starts here.`);
 					const ch = text[i];
 					if (ch === o.escape && text[i + 1] === o.quote) {
-						value += o.quote;
+						value += text.slice(from, i) + o.quote;
 						i += 2;
+						from = i;
 						continue;
 					}
 					if (ch === o.quote) {
+						value += text.slice(from, i);
 						i++;
 						break;
 					}
 					if (ch === "\n") line++;
-					value += ch;
 					i++;
 				}
 				while (i < n && (text[i] === " " || text[i] === "	") && text[i] !== o.delimiter) i++;
 				if (i < n && text[i] !== o.delimiter && text[i] !== "\n" && text[i] !== "\r") throw malformed(line, `unexpected text after the closing ${o.quote}.`);
-				fields.push(value);
+				push(value);
 				at = i;
 			} else {
 				let i = at;
 				while (i < n && text[i] !== o.delimiter && text[i] !== "\n" && text[i] !== "\r") i++;
-				fields.push(text.slice(at, i));
+				push(text.slice(at, i));
 				at = i;
 			}
 			if (at < n && text[at] === o.delimiter) {
@@ -4963,14 +5268,30 @@ function parseCsv(text, o) {
 		at = skipLineEnd(at);
 		line++;
 		const row = fields.length === 1 && fields[0].trim() === "" ? [""] : fields;
-		rows.push(row.map((f) => o.trim ? f.trim() : o.ltrim ? f.trimStart() : o.rtrim ? f.trimEnd() : f));
+		if (o.ignoreEmpty && !extraText && row.every((f) => f.trim() === "")) continue;
+		kept++;
+		if (o.skipHeader && kept === 1) continue;
+		if (kept - (o.skipHeader ? 1 : 0) <= o.skipRows) continue;
+		if (o.maxRows > 0 && emitted >= o.maxRows) continue;
+		if (extra > 0) throw tooMany("columns", rowLine);
+		if (++emitted > MAX_SHEET_ROWS) throw tooMany("rows", rowLine);
+		cells += row.length;
+		if (cells > MAX_CSV_CELLS) throw tooMany("cells", rowLine);
+		yield {
+			fields: row.map(trim),
+			line: rowLine
+		};
 	}
-	let out = rows;
-	if (o.ignoreEmpty) out = out.filter((r) => r.some((f) => f.trim() !== ""));
-	if (o.skipHeader) out = out.slice(1);
-	if (o.skipRows > 0) out = out.slice(o.skipRows);
-	if (o.maxRows > 0) out = out.slice(0, o.maxRows);
-	return out;
+}
+/** The delimiters and line-break characters in `text`: at least the number of fields less one. */
+function fieldEnds(text, delimiter) {
+	const d = delimiter.charCodeAt(0);
+	let n = 0;
+	for (let i = 0; i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		if (c === d || c === 10 || c === 13) n++;
+	}
+	return n;
 }
 /**
 * exceljs's default conversion of a CSV field (lib/csv/csv.js L57–83), with two fixes: text of
@@ -4990,7 +5311,7 @@ function csvValue(datum, dateFormats) {
 	if (special !== void 0) return typeof special === "object" ? { ...special } : special;
 	return datum;
 }
-function formatterOptions(raw) {
+function formatterOptions(raw, escapeFormulas) {
 	const o = raw ?? {};
 	const delimiter = typeof o["delimiter"] === "string" ? o["delimiter"] : ",";
 	const rowDelimiter = typeof o["rowDelimiter"] === "string" ? o["rowDelimiter"] : "\n";
@@ -5007,9 +5328,27 @@ function formatterOptions(raw) {
 		headers: Array.isArray(o["headers"]) && o["writeHeaders"] !== false ? o["headers"].map(String) : null,
 		includeEndRowDelimiter: o["includeEndRowDelimiter"] === true,
 		writeBOM: o["writeBOM"] === true,
-		escapeChars: new RegExp(`[${escapeRe(delimiter)}${escapeRe(rowDelimiter)}|\\r|\\n]`)
+		escapeChars: new RegExp(`[${escapeRe(delimiter)}${escapeRe(rowDelimiter)}|\\r|\\n${escapeFormulas ? escapeRe(COMMON_DELIMITERS) : ""}]`),
+		strictQuoting: escapeFormulas
 	};
 }
+/**
+* Whether an application that splits `text` at a comma, ";", tab or "|" would get a field that
+* starts like a formula: one of those characters followed by a formula sign, a control character
+* or a byte order mark, after any spaces or tabs and an opening double quote (K2).
+*/
+function splitStartsFormula(text) {
+	for (let i = 0; i < text.length; i++) {
+		if (!COMMON_DELIMITERS.includes(text[i])) continue;
+		let j = i + 1;
+		while (text[j] === " " || text[j] === "	") j++;
+		if (text[j] === "\"") j++;
+		while (text[j] === " ") j++;
+		const c = text[j];
+		if (c !== void 0 && (INJECTION_START.has(c) || c.charCodeAt(0) < 32)) return true;
+	}
+	return false;
+}
 /** One field as fast-csv FieldFormatter.format writes it. */
 function formatField(value, index, f, forceQuote) {
 	const text = `${value === null || value === void 0 ? "" : String(value)}`.replace(/\0/g, "");
@@ -5020,6 +5359,13 @@ function formatField(value, index, f, forceQuote) {
 			field: index + 1
 		}
 	});
+	if (f.quote === "" && f.strictQuoting && splitStartsFormula(text)) throw new XlvError("XLV_E_INVALID_OPTION", `Field ${String(index + 1)} has a comma, ";", tab or "|" followed by a formula sign, which an application splitting on that character reads as a formula; it cannot be written with quote: false.`, {
+		hint: "Leave formatterOptions.quote at its default (\") so such fields are quoted, or pass formulaInjection: \"off\" for a trusted consumer.",
+		details: {
+			option: "quote",
+			field: index + 1
+		}
+	});
 	if (f.quote !== "" && text.includes(f.quote)) return `${f.quote}${text.split(f.quote).join(f.escapedQuote)}${f.quote}`;
 	const q = f.quoteColumns;
 	const quoteThis = forceQuote || q === true || Array.isArray(q) && q[index] === true;
@@ -5039,7 +5385,7 @@ function defaultWriteMap(dateFormat, dateUTC) {
 		if (typeof value === "object") {
 			const v = value;
 			if (v["text"] || v["hyperlink"]) return v["hyperlink"] || v["text"] || "";
-			if (v["formula"] || v["sharedFormula"] || "result" in v) {
+			if (v["sharedFormula"] || v["formula"] || "result" in v) {
 				const result = v["result"];
 				if (result === void 0 || result === null) return "";
 				if (result instanceof Date) return date(result);
@@ -5052,26 +5398,252 @@ function defaultWriteMap(dateFormat, dateUTC) {
 		return value;
 	};
 }
+/** The output encoding for the `encoding` option (an unsupported one is refused when encoding). */
+function outputEncoding(encoding) {
+	const e = (encoding ?? "").toLowerCase();
+	if (e === "latin1" || e === "binary") return "latin1";
+	if (e === "utf16le" || e === "utf-16le" || e === "ucs2" || e === "ucs-2") return "utf16le";
+	return "utf8";
+}
+/** Leading UTF-8 sequences of U+FF1D, U+FF0B, U+FF0D, U+FF20, U+FE66, U+FE62, U+FE63, U+FE6B. */
+const UTF8_FORMULA_SIGNS = [
+	[
+		239,
+		188,
+		157
+	],
+	[
+		239,
+		188,
+		139
+	],
+	[
+		239,
+		188,
+		141
+	],
+	[
+		239,
+		188,
+		160
+	],
+	[
+		239,
+		185,
+		166
+	],
+	[
+		239,
+		185,
+		162
+	],
+	[
+		239,
+		185,
+		163
+	],
+	[
+		239,
+		185,
+		171
+	]
+];
 /**
-* The CSV text of a worksheet, as exceljs `csv.write` gives it.
+* Whether the first bytes of a field, as latin1 or UTF-16LE writes it, are a byte order mark
+* (EF BB BF, FF FE, FE FF), which makes a reader decode the rest of the file in that encoding
+* and drop the mark, or the UTF-8 form of a full-width or small formula sign, which a reader that
+* guesses UTF-8 shows as one (K2). `prefix` holds bytes written before the field (latin1 writes
+* the `writeBOM` mark U+FEFF as the single byte FF). UTF-16LE bytes are taken without their NUL
+* bytes, as an 8-bit reader that drops them reads them (K3); a sequence that holds no NUL byte is
+* the same either way.
+*/
+function encodedStartIsUnsafe(text, encoding, prefix) {
+	if (encoding === "utf8") return false;
+	const bytes = [...prefix];
+	for (let i = 0; bytes.length < 3 && i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		if (encoding === "latin1") bytes.push(c & 255);
+		else for (const b of [c & 255, c >> 8]) if (b !== 0) bytes.push(b);
+	}
+	const starts = (lead) => lead.every((b, i) => bytes[i] === b);
+	return starts([
+		239,
+		187,
+		191
+	]) || starts([255, 254]) || starts([254, 255]) || UTF8_FORMULA_SIGNS.some(starts);
+}
+/** Bytes that end a field or a row for a reader of the 8-bit text, whatever its delimiter. */
+const BYTE_BREAKS = /* @__PURE__ */ new Set([
+	44,
+	59,
+	9,
+	124,
+	13,
+	10
+]);
+/** Whether the 8-bit text `view` has a formula start at `i`: "=", or spaces or tabs, a quote and "=". */
+function viewFormulaAt(view, i) {
+	if (view[i] === "=") return true;
+	let j = i;
+	while (view[j] === " " || view[j] === "	") j++;
+	return view[j] === "\"" && view[j + 1] === "=";
+}
+/**
+* Whether the UTF-16LE bytes of `text` without NULs start a formula (see {@link viewFormulaAt})
+* because of a character above U+00FF, such as U+3D00 (00 3D) or U+4E3D (3D 4E). Starts made only
+* of characters up to U+00FF are the same text in both readings and are checked as text.
+*/
+function utf16StartsFormula(text) {
+	let view = "";
+	let foreign = false;
+	let lead = 0;
+	let blank = true;
+	for (let i = 0; i < text.length && view.length - lead < 2; i++) {
+		const c = text.charCodeAt(i);
+		if (c > 255) foreign = true;
+		for (const b of c > 255 ? [c & 255, c >> 8] : [c]) {
+			if (b === 0) continue;
+			view += String.fromCharCode(b);
+			if (blank && (b === 32 || b === 9)) lead++;
+			else blank = false;
+		}
+	}
+	return foreign && viewFormulaAt(view, 0);
+}
+/** The UTF-16LE bytes of a written field without NULs, and whether characters above U+00FF give a break or a quote among them. */
+function utf16View(written, delimiter) {
+	let view = "";
+	let foreignBreak = false;
+	let foreignQuote = false;
+	for (let i = 0; i < written.length; i++) {
+		const c = written.charCodeAt(i);
+		for (const b of c > 255 ? [c & 255, c >> 8] : [c]) {
+			if (b === 0) continue;
+			if (c > 255) {
+				if (b === 34) foreignQuote = true;
+				else if (BYTE_BREAKS.has(b) || delimiter.includes(String.fromCharCode(b))) foreignBreak = true;
+			}
+			view += String.fromCharCode(b);
+		}
+	}
+	return {
+		view,
+		foreignBreak,
+		foreignQuote
+	};
+}
+/** Whether the 8-bit text `view` has a delimiter (`delimiter` or a common one) or a line break followed by a formula start. */
+function viewSplitStartsFormula(view, delimiter) {
+	for (let i = 0; i < view.length; i++) {
+		if (BYTE_BREAKS.has(view.charCodeAt(i)) && viewFormulaAt(view, i + 1)) return true;
+		if (view.startsWith(delimiter, i) && viewFormulaAt(view, i + delimiter.length)) return true;
+	}
+	return false;
+}
+/** Column letters of a 1-based column number. */
+function columnName(n) {
+	let s = "";
+	for (let c = n; c > 0; c = Math.floor((c - 1) / 26)) s = String.fromCharCode(65 + (c - 1) % 26) + s;
+	return s;
+}
+/**
+* The CSV text of a worksheet, as exceljs `csv.write` gives it, for output in `encoding`.
 *
 * @internal
 */
-function worksheetCsv(sheet, options) {
-	const f = formatterOptions(options.formatterOptions);
+function worksheetCsv(sheet, options, encoding = "utf8") {
 	const injection = options.formulaInjection ?? "escape";
 	if (injection !== "escape" && injection !== "off") throw invalid("formulaInjection", "The option \"formulaInjection\" must be \"escape\" or \"off\".", "Use \"escape\" (default) or \"off\".");
+	const f = formatterOptions(options.formatterOptions, injection === "escape");
+	const latin1 = encoding === "latin1";
+	const sheetName = sheet?.name ?? "";
+	if (latin1) {
+		for (const [name, value] of [
+			["delimiter", f.delimiter],
+			["rowDelimiter", f.rowDelimiter],
+			["quote", f.quote],
+			["escape", f.escapedQuote]
+		]) if (/[^\u0000-\u00ff]/.test(value)) throw invalid(name, `The option "${name}" has a character that latin1 cannot write.`, "Use characters up to U+00FF with encoding \"latin1\", or write UTF-8.");
+	}
+	if (injection === "escape") {
+		const off = "or pass formulaInjection: \"off\" for a trusted consumer.";
+		if (f.delimiter === "") throw invalid("delimiter", "The delimiter is empty, so the fields of a row run together and the text of one field could complete a formula or a byte order mark begun by the one before.", `Use "," (default), ";", "|" or "\\t", ${off}`);
+		if (encoding !== "utf8") {
+			for (const [name, value] of [["delimiter", f.delimiter], ["rowDelimiter", f.rowDelimiter]]) if (/[^\u0000-\u007f]/.test(value)) throw invalid(name, `The option "${name}" (${JSON.stringify(value)}) has characters other than ASCII, whose ${encoding} bytes could join the bytes of the fields around them into a byte order mark or a formula sign.`, `Use ASCII characters with encoding "${encoding}" (for example "," or ";"), write UTF-8 (the default encoding), ${off}`);
+		}
+		if (f.delimiter !== "	" && [...f.delimiter].some((c) => INJECTION_START.has(c) || c.charCodeAt(0) < 32)) throw invalid("delimiter", `The delimiter ${JSON.stringify(f.delimiter)} holds a formula sign or a control character, so a line could start with a formula.`, `Use "," (default), ";", "|" or "\\t", ${off}`);
+		if (![
+			"\n",
+			"\r\n",
+			"\r"
+		].includes(f.rowDelimiter)) throw invalid("rowDelimiter", `The row delimiter ${JSON.stringify(f.rowDelimiter)} is not a line break, so a standard CSV reader would not split rows where it is written.`, `Use "\\n" (default), "\\r\\n" or "\\r", ${off}`);
+		if (f.quote !== "" && f.quote !== "\"") throw invalid("quote", `The quote ${JSON.stringify(f.quote)} is not '"', so a standard CSV reader would split a value that holds a line break or the delimiter.`, `Leave formatterOptions.quote at its default ("), or use quote: false, ${off}`);
+		if (f.quote !== "" && f.escapedQuote !== `${f.quote}${f.quote}`) throw invalid("escape", "An escape character other than the quote lets a standard CSV reader end a quoted field early, so a value could start a new field with a formula.", "Leave formatterOptions.escape unset (the quote is doubled), or pass formulaInjection: \"off\" for a trusted consumer.");
+	}
+	/** The text latin1 will write: characters above U+00FF as "?". */
+	const narrow = (out) => latin1 && typeof out === "string" ? out.replace(/[^\u0000-\u00ff]/g, "?") : out;
+	const utf16 = encoding === "utf16le" && injection === "escape";
+	const marked = injection === "escape" && (utf16 || latin1 && f.writeBOM);
+	/** A quote may be taken differently by a reader of the 8-bit text from here on (K3). */
+	let quoteShifted = false;
+	const unsafeField = (index, row, reason, hint) => {
+		const cell = `${columnName(index + 1)}${String(row)}`;
+		return new XlvError("XLV_E_INVALID_OPTION", `The text of ${row === 0 ? `header ${String(index + 1)}` : `cell ${cell}`} cannot be written safely as ${encoding}: ${reason}`, {
+			location: row === 0 ? { sheet: sheetName } : {
+				sheet: sheetName,
+				cell
+			},
+			hint,
+			details: {
+				option: "encoding",
+				field: index + 1,
+				row
+			}
+		});
+	};
+	/**
+	* A formatted field, refused if a standard reader would take its leading quote as quoting, or
+	* if a reader of the output as 8-bit text that drops NUL bytes (LibreOffice) would split it
+	* before a formula start: in utf16le output, when characters above U+00FF give a delimiter,
+	* line break or quote there, when an earlier quote of that kind may shift the quoting, or for
+	* the first field after a mark that reader keeps (K3). `row` is the row number, 0 for the header
+	* line; `atStart`: the field is the first one of the file.
+	*/
+	const field = (out, index, force, row, atStart) => {
+		const text = formatField(out, index, f, force);
+		if (injection === "escape" && f.quote !== "\"" && text.startsWith("\"")) throw new XlvError("XLV_E_INVALID_OPTION", `Field ${String(index + 1)} starts with a double quote, which a standard CSV reader takes as quoting when formatterOptions.quote is not '"'.`, {
+			hint: "Leave formatterOptions.quote at its default (\"), or pass formulaInjection: \"off\" for a trusted consumer.",
+			details: {
+				option: "quote",
+				field: index + 1
+			}
+		});
+		const first = marked && atStart;
+		if (first || quoteShifted || utf16 && /[^\u0000-\u00ff]/.test(text)) {
+			const { view, foreignBreak, foreignQuote } = utf16 ? utf16View(text, f.delimiter) : {
+				view: text,
+				foreignBreak: false,
+				foreignQuote: false
+			};
+			if ((first || foreignBreak || foreignQuote || quoteShifted) && viewSplitStartsFormula(view, f.delimiter)) throw first ? unsafeField(index, row, `the file starts with ${utf16 ? "the UTF-16LE byte order mark (FF FE)" : "the byte FF (writeBOM)"}, which LibreOffice keeps when it reads the file as 8-bit text, so the opening quote of this first field is not taken as quoting and its delimiter or line break followed by "=" starts a formula.`, utf16 ? "Write UTF-8 (the default encoding), move this text out of the first cell, or pass formulaInjection: \"off\" for a trusted consumer." : "Leave formatterOptions.writeBOM off with latin1, write UTF-8, or pass formulaInjection: \"off\" for a trusted consumer.") : utf16 ? unsafeField(index, row, "read as 8-bit text without its NUL bytes, as LibreOffice reads UTF-16LE CSV files, its bytes hold a delimiter or a line break followed by \"=\", which starts a formula there.", "Write UTF-8 (the default encoding), or pass formulaInjection: \"off\" for a trusted consumer.") : unsafeField(index, row, "the first field, after the byte FF of writeBOM, is split by LibreOffice, which may then take the quotes after it differently, and this field holds a delimiter or a line break followed by \"=\".", "Leave formatterOptions.writeBOM off with latin1, write UTF-8, or pass formulaInjection: \"off\" for a trusted consumer.");
+			if (foreignQuote || first && ([...view].some((c) => BYTE_BREAKS.has(c.charCodeAt(0))) || view.includes(f.delimiter))) quoteShifted = true;
+		}
+		return text;
+	};
 	const map = options.map ?? defaultWriteMap(options.dateFormat, options.dateUTC === true);
 	const includeEmptyRows = options.includeEmptyRows === void 0 || options.includeEmptyRows;
 	const lines = [];
-	const escape = (out) => {
+	const escape = (raw, atStart) => {
+		const out = narrow(raw === null || raw === void 0 || typeof raw === "number" || typeof raw === "boolean" || typeof raw === "bigint" || typeof raw === "string" ? raw : String(raw));
 		if (injection !== "escape" || typeof out !== "string") return [out, false];
-		const first = out.replace(/\0/g, "")[0];
-		return first !== void 0 && (INJECTION_START.has(first) || first.charCodeAt(0) < 32) ? [`'${out}`, f.quote !== ""] : [out, false];
+		const text = out.replace(/\0/g, "");
+		const first = text[0];
+		if (first === void 0) return [out, false];
+		return INJECTION_START.has(first) || first.charCodeAt(0) < 32 || encodedStartIsUnsafe(text, encoding, atStart && f.writeBOM && latin1 ? [255] : []) || utf16 && utf16StartsFormula(text) ? [`'${out}`, f.quote !== ""] : [out, false];
 	};
 	if (f.headers) lines.push(f.headers.map((h, i) => {
-		const [out, force] = escape(h);
-		return formatField(out, i, f, force);
+		const [out, force] = escape(h, i === 0);
+		return field(out, i, force, 0, i === 0);
 	}).join(f.delimiter));
 	if (sheet) {
 		let lastRow = 0;
@@ -5085,8 +5657,9 @@ function worksheetCsv(sheet, options) {
 					fields.push("");
 					continue;
 				}
-				const [out, force] = escape(map(values[i], i));
-				fields.push(formatField(out, i, f, force));
+				const atStart = lines.length === 0 && i === 0;
+				const [out, force] = escape(map(values[i], i), atStart);
+				fields.push(field(out, i, force, rowNumber, atStart));
 			}
 			lines.push(fields.join(f.delimiter));
 			lastRow = rowNumber;
@@ -5094,7 +5667,7 @@ function worksheetCsv(sheet, options) {
 	}
 	let text = lines.join(f.rowDelimiter);
 	if (f.includeEndRowDelimiter) text += f.rowDelimiter;
-	return (f.writeBOM ? "" : "") + text;
+	return (f.writeBOM || utf16 ? "" : "") + text;
 }
 function encode(text, encoding) {
 	const e = (encoding ?? "utf8").toLowerCase();
@@ -5128,11 +5701,28 @@ function decoderFor(encoding) {
 async function readText(stream, encoding) {
 	const decoder = decoderFor(encoding);
 	let text = "";
+	let size = 0;
+	const count = (n) => {
+		size += n;
+		if (size > DEFAULT_READ_LIMITS.maxInputBytes) throw new XlvError("XLV_E_LIMIT_EXCEEDED", `The CSV input is larger than ${String(DEFAULT_READ_LIMITS.maxInputBytes)} bytes.`, {
+			hint: "Split the CSV file, or read it with the core fromCSV in parts.",
+			details: {
+				limit: "maxInputBytes",
+				value: DEFAULT_READ_LIMITS.maxInputBytes
+			}
+		});
+	};
 	const add = (chunk) => {
-		if (typeof chunk === "string") text += chunk;
-		else if (chunk instanceof Uint8Array) text += decoder.decode(chunk, { stream: true });
-		else if (chunk instanceof ArrayBuffer) text += decoder.decode(new Uint8Array(chunk), { stream: true });
-		else throw new XlvError("XLV_E_INVALID_INPUT", "workbook.csv.read() got a stream chunk that is neither text nor bytes.", { hint: "Pass a stream of strings, Buffers or Uint8Arrays." });
+		if (typeof chunk === "string") {
+			count(chunk.length);
+			text += chunk;
+		} else if (chunk instanceof Uint8Array) {
+			count(chunk.length);
+			text += decoder.decode(chunk, { stream: true });
+		} else if (chunk instanceof ArrayBuffer) {
+			count(chunk.byteLength);
+			text += decoder.decode(new Uint8Array(chunk), { stream: true });
+		} else throw new XlvError("XLV_E_INVALID_INPUT", "workbook.csv.read() got a stream chunk that is neither text nor bytes.", { hint: "Pass a stream of strings, Buffers or Uint8Arrays." });
 	};
 	const s = stream;
 	if (typeof stream === "string") add(stream);
@@ -5219,10 +5809,16 @@ var CsvIO = class {
 	async read(stream, options = {}) {
 		const worksheet = this.workbook.addWorksheet(options.sheetName);
 		const parser = parserOptions(options.parserOptions);
-		const rows = parseCsv(await readText(stream, parser.encoding), parser);
+		const text = await readText(stream, parser.encoding);
 		const formats = options.dateFormats ?? DEFAULT_DATE_FORMATS;
 		const map = options.map ?? ((datum) => csvValue(datum, formats));
-		for (const row of rows) worksheet.addRow(row.map((datum, i) => map(datum, i)));
+		if (text.length >= MAX_CSV_CELLS && fieldEnds(text, parser.delimiter) >= MAX_CSV_CELLS) try {
+			const rows = csvRows(text, parser);
+			while (rows.next().done !== true);
+		} catch (error) {
+			if (error instanceof XlvError && error.code === "XLV_E_LIMIT_EXCEEDED" && error.details?.limit === "maxCells") throw error;
+		}
+		for (const row of csvRows(text, parser)) worksheet.addRow(row.fields.map((datum, i) => map(datum, i)));
 		return worksheet;
 	}
 	/** Reads a CSV file (Node.js, Bun, Deno) into a new worksheet. */
@@ -5250,7 +5846,7 @@ var CsvIO = class {
 	}
 	/** Writes a worksheet to a CSV file (Node.js, Bun, Deno), replacing it. */
 	async writeFile(path, options = {}) {
-		const bytes = encode(this.text(options), options.encoding);
+		const bytes = encode(this.text(options, outputEncoding(options.encoding)), options.encoding);
 		const fs = await nodeFs("writeFile");
 		try {
 			await fs.writeFile(path, bytes);
@@ -5274,7 +5870,7 @@ var CsvIO = class {
 	createInputStream() {
 		throw new Error("`CSV#createInputStream` is deprecated. You should use `CSV#read` instead. This method will be removed in version 5.0. Please follow upgrade instruction: https://github.com/exceljs/exceljs/blob/master/UPGRADE-4.0.md");
 	}
-	text(options) {
+	text(options, encoding = "utf8") {
 		const key = options.sheetName || options.sheetId;
 		const sheet = this.workbook.getWorksheet(key);
 		if (key !== void 0 && !sheet) throw new XlvError("XLV_E_SHEET_NOT_FOUND", `The workbook has no worksheet ${typeof key === "string" ? `named "${key}"` : `with id ${String(key)}`}.`, {
@@ -5282,7 +5878,7 @@ var CsvIO = class {
 			hint: `Available worksheets: ${this.workbook.worksheets.map((w) => `"${w.name}"`).join(", ") || "none"}.`,
 			details: { available: this.workbook.worksheets.map((w) => w.name) }
 		});
-		return worksheetCsv(sheet, options);
+		return worksheetCsv(sheet, options, encoding);
 	}
 };
 // src/defined-names.ts
@@ -5335,6 +5931,33 @@ function decodeEx(value) {
 		...address
 	} : address;
 }
+/**
+* Refuses a range that reaches past the sheet (row 1048576, column XFD) before its cells are
+* created one by one. exceljs bounds only column letters, so a range such as `$A$1:$A$99999999999`
+* makes it loop for hours; xlvane throws instead (security review J, C1).
+*/
+function checkGrid(location) {
+	const { bottom = 0, right = 0 } = location;
+	if (bottom <= 1048576 && right <= 16384) return;
+	const where = `${location.sheetName === void 0 ? "" : `${location.sheetName}!`}rows ${String(location.top)}-${String(bottom)}, columns ${String(location.left)}-${String(right)}`;
+	throw new XlvError("XLV_E_INVALID_CELL_REF", `The range ${where.slice(0, 80)} reaches past the sheet (row 1048576, column XFD).`, {
+		hint: "Use a range inside A1:XFD1048576, for example \"Data!$A$1:$B$10\".",
+		details: { ref: where.slice(0, 80) }
+	});
+}
+/**
+* @internal The number of cells the `model` setter of {@link DefinedNames} creates for one range
+* read from a file, or `null` for a range that reaches past the sheet (it is dropped, as invalid
+* ranges are; security review J, C1).
+*/
+function rangeCellCount(rangeStr) {
+	if (!RANGE.test(rangeStr.split("!").pop() ?? "")) return 0;
+	const location = decodeEx(rangeStr);
+	if (!location.top) return location.row !== void 0 && location.col !== void 0 ? 1 : 0;
+	const { top, left = 0, bottom = 0, right = 0 } = location;
+	if (bottom > 1048576 || right > 16384) return null;
+	return Math.max(0, bottom - top + 1) * Math.max(0, right - left + 1);
+}
 /** The sheet prefix exceljs writes (lib/doc/range.js L153): quoted unless letters and digits only. */
 function sheetPrefix(sheetName) {
 	if (!sheetName) return "";
@@ -5368,8 +5991,10 @@ var CellMatrix = class {
 		return this.sheets.get(sheetName)?.[rowNumber]?.[colNumber];
 	}
 	addCellEx(address) {
-		if (address.top) for (let row = address.top; row <= (address.bottom ?? 0); row++) for (let col = address.left ?? 0; col <= (address.right ?? 0); col++) this.getCellAt(address.sheetName, row, col);
-		else this.findCellEx(address, true);
+		if (address.top) {
+			checkGrid(address);
+			for (let row = address.top; row <= (address.bottom ?? 0); row++) for (let col = address.left ?? 0; col <= (address.right ?? 0); col++) this.getCellAt(address.sheetName, row, col);
+		} else this.findCellEx(address, true);
 	}
 	getCellEx(address) {
 		return this.findCellEx(address, true);
@@ -5466,6 +6091,7 @@ var DefinedNames = class {
 		this.addEx(decodeEx(locStr), name);
 	}
 	addEx(location, name) {
+		if (location.top) checkGrid(location);
 		const matrix = this.getMatrix(name);
 		if (location.top) for (let col = location.left ?? 0; col <= (location.right ?? 0); col++) for (let row = location.top; row <= (location.bottom ?? 0); row++) matrix.getCellAt(location.sheetName, row, col);
 		else matrix.addCellEx(location);
@@ -5736,12 +6362,7 @@ var XlsxIO = class {
 	}
 	/** Reads XLSX data from a readable stream (Node.js stream or any async iterable of bytes). */
 	async read(stream, options) {
-		const chunks = [];
-		let size = 0;
-		for await (const chunk of stream) {
-			chunks.push(chunk);
-			size += chunk.length;
-		}
+		const { chunks, size } = await collectInput(stream, "xlsx.read()");
 		const all = new Uint8Array(size);
 		let at = 0;
 		for (const c of chunks) {
@@ -5883,12 +6504,71 @@ var Workbook = class {
 	get _date1904() {
 		return this.properties.date1904 === true;
 	}
-	/** @internal Names of the other sheets, for the duplicate check of Worksheet.name. */
-	_names = (exclude) => this.worksheets.filter((w) => w !== exclude).map((w) => w.name);
-	/** The id the next worksheet gets (lib/doc/workbook.js `nextId`). */
+	_byName = /* @__PURE__ */ new Map();
+	_firstFree = 1;
+	_maxOrderNo = 0;
+	_maxOrderNoStale = false;
+	/** @internal Whether a sheet other than `exclude` has this name, ignoring case (the duplicate check of Worksheet.name). */
+	_nameTaken(name, exclude) {
+		const sheet = this._byName.get(name.toLowerCase());
+		return sheet !== void 0 && sheet !== exclude;
+	}
+	/** @internal Keeps the name index in step with a renamed sheet. */
+	_renamed(sheet, oldName) {
+		if (this._sheets[sheet.id] !== sheet) return;
+		const old = oldName.toLowerCase();
+		if (this._byName.get(old) === sheet) this._byName.delete(old);
+		this._byName.set(sheet.name.toLowerCase(), sheet);
+	}
+	/** @internal Keeps the largest orderNo in step with a changed one. */
+	_orderNoChanged(sheet, oldOrderNo) {
+		if (this._sheets[sheet.id] !== sheet || this._maxOrderNoStale) return;
+		const value = sheet.orderNo;
+		const plain = (v) => v === void 0 || typeof v === "number" && !Number.isNaN(v);
+		if (!plain(value) || !plain(oldOrderNo)) this._maxOrderNoStale = true;
+		else if (value !== void 0 && value > this._maxOrderNo) this._maxOrderNo = value;
+		else if (oldOrderNo !== void 0 && oldOrderNo >= this._maxOrderNo && (value === void 0 || value < oldOrderNo)) this._maxOrderNoStale = true;
+	}
+	/** @internal Puts a worksheet into `_sheets` at its id and indexes it. */
+	_putSheet(sheet) {
+		const previous = this._sheets[sheet.id];
+		if (previous && previous !== sheet) this._dropSheet(previous);
+		this._sheets[sheet.id] = sheet;
+		this._byName.set(sheet.name.toLowerCase(), sheet);
+		this._orderNoChanged(sheet, void 0);
+	}
+	/** Takes a worksheet out of `_sheets` and its indexes. */
+	_dropSheet(sheet) {
+		this._sheets[sheet.id] = void 0;
+		const key = sheet.name.toLowerCase();
+		if (this._byName.get(key) === sheet) this._byName.delete(key);
+		if (sheet.id < this._firstFree) this._firstFree = Math.max(1, sheet.id);
+		const order = sheet.orderNo;
+		if (order !== void 0 && !(typeof order === "number" && order < this._maxOrderNo)) this._maxOrderNoStale = true;
+	}
+	/** Empties `_sheets` and its indexes. */
+	_clearSheets() {
+		this._sheets = [];
+		this._byName = /* @__PURE__ */ new Map();
+		this._firstFree = 1;
+		this._maxOrderNo = 0;
+		this._maxOrderNoStale = false;
+	}
+	/** The largest orderNo of the sheets, as exceljs computes it (lib/doc/workbook.js L81-85). */
+	_lastOrderNo() {
+		if (this._maxOrderNoStale) {
+			this._maxOrderNo = this._sheets.reduce((acc, ws) => ws?.orderNo !== void 0 && ws.orderNo > acc ? ws.orderNo : acc, 0);
+			this._maxOrderNoStale = false;
+		}
+		return this._maxOrderNo;
+	}
+	/** The id the next worksheet gets (lib/doc/workbook.js `nextId`): the lowest free id. */
 	get nextId() {
-		for (let i = 1; i < this._sheets.length; i++) if (!this._sheets[i]) return i;
-		return this._sheets.length || 1;
+		const sheets = this._sheets;
+		let i = Math.max(1, this._firstFree);
+		while (i < sheets.length && sheets[i]) i++;
+		this._firstFree = i;
+		return i < sheets.length ? i : sheets.length || 1;
 	}
 	/** Adds a worksheet. Names follow exceljs rules (31 characters at most; longer names are cut). */
 	addWorksheet(name, options) {
@@ -5897,13 +6577,34 @@ var Workbook = class {
 	/** @internal Adds a worksheet with a given id (a loaded file's sheetId, a model's id; D-F03). */
 	_addWorksheetWithId(id, name, options) {
 		const sheet = new Worksheet(this, id, name, options);
-		sheet.orderNo = this._sheets.reduce((acc, ws) => ws?.orderNo !== void 0 && ws.orderNo > acc ? ws.orderNo : acc, 0) + 1;
-		this._sheets[id] = sheet;
+		const last = this._lastOrderNo();
+		this._putSheet(sheet);
+		sheet.orderNo = last + 1;
 		return sheet;
 	}
+	/**
+	* @internal Adds a worksheet read from a file (`xlsx.load`, `stream.xlsx.WorkbookReader`). A
+	* name exceljs refuses gives an XlvError with exceljs's message, the sheet and a hint, instead
+	* of the plain Error of `addWorksheet`; an empty name is refused too.
+	*/
+	_addReadWorksheet(id, name, options) {
+		const checked = checkSheetName(name, (n) => this._nameTaken(n));
+		if (checked.message !== void 0) {
+			const existing = checked.duplicate ? this._byName.get(checked.name.toLowerCase())?.name : void 0;
+			throw new XlvError(checked.duplicate ? "XLV_E_DUPLICATE_SHEET_NAME" : "XLV_E_INVALID_SHEET_NAME", checked.message, {
+				location: { sheet: name },
+				hint: checked.duplicate ? "Two worksheets of the file have the same name, ignoring case and after the first 31 characters, which exceljs does not accept. Rename one in a spreadsheet application, or read the file with xlvane's readWorkbook." : "The file names a worksheet in a way exceljs does not accept. Rename the sheet in a spreadsheet application, or read the file with xlvane's readWorkbook.",
+				details: existing === void 0 ? { name } : {
+					name,
+					existing
+				}
+			});
+		}
+		return this._addWorksheetWithId(id, name, options);
+	}
 	removeWorksheet(id) {
 		const sheet = this.getWorksheet(id);
-		if (sheet) this._sheets[sheet.id] = void 0;
+		if (sheet) this._dropSheet(sheet);
 	}
 	/** Removes a worksheet by id or name, as `removeWorksheet` (lib/doc/workbook.js L77). */
 	removeWorksheetEx(worksheet) {
@@ -5979,7 +6680,11 @@ var Workbook = class {
 	getWorksheet(id) {
 		if (id === void 0) return this.worksheets[0];
 		if (typeof id === "number") return this._sheets[id];
-		if (typeof id === "string") return this.worksheets.find((w) => w.name === id);
+		if (typeof id === "string") {
+			const sheet = this._byName.get(id.toLowerCase());
+			if (sheet?.name === id) return sheet;
+			return id === "" ? this.worksheets.find((w) => w.name === id) : void 0;
+		}
 	}
 	/** Worksheets in workbook order. */
 	get worksheets() {
@@ -6027,16 +6732,35 @@ var Workbook = class {
 		const spend = (positions, what, sheet) => {
 			spent += positions;
 			if (spent <= budget) return;
-			throw new XlvError("XLV_E_LIMIT_EXCEEDED", `${what} of worksheet "${sheet}" would create more than ${String(budget)} cells or columns for ${String(cellsRead)} cells in the file.`, {
-				location: { sheet },
-				hint: "The file declares ranges far larger than its data. Load it with ignoreNodes for that element (for example ignoreNodes: [\"mergeCells\"]), or read it with xlvane's readWorkbook, which does not create these objects.",
+			const of = sheet === void 0 ? "" : ` of worksheet "${sheet}"`;
+			throw new XlvError("XLV_E_LIMIT_EXCEEDED", `${what}${of} would create more than ${String(budget)} cells or columns for ${String(cellsRead)} cells in the file.`, {
+				...sheet === void 0 ? {} : { location: { sheet } },
+				hint: sheet === void 0 ? "The file declares names far larger than its data. Read it with xlvane's readWorkbook, which does not create these objects." : "The file declares ranges far larger than its data. Load it with ignoreNodes for that element (for example ignoreNodes: [\"mergeCells\"]), or read it with xlvane's readWorkbook, which does not create these objects.",
 				details: {
 					limit: "maxCells",
 					value: budget
 				}
 			});
 		};
+		const mergeBudget = Math.max(MERGED_CELLS_BUDGET, cellsRead);
+		let merged = 0;
+		const spendMerge = (positions, ref, sheet) => {
+			merged += positions;
+			if (merged <= mergeBudget) return;
+			throw new XlvError("XLV_E_LIMIT_EXCEEDED", `The merged range ${ref} of worksheet "${sheet}" would bring the merged cells past ${String(mergeBudget)} for ${String(cellsRead)} cells in the file.`, {
+				location: {
+					sheet,
+					cell: ref
+				},
+				hint: "The file merges far more cells than it holds. Load it with ignoreNodes: [\"mergeCells\"] to skip merged ranges, or read it with xlvane's readWorkbook, which does not create these cells.",
+				details: {
+					limit: "mergedCells",
+					value: mergeBudget
+				}
+			});
+		};
 		const rowBudget = Math.max(67108864, 16 * cellsRead);
+		const validations = validationBudget();
 		let rowsLooked = 0;
 		for (const s of read.sheets) {
 			if (s.kind !== "worksheet" || options.maxRows === void 0 && options.maxCols === void 0 || !use("sheetData")) continue;
@@ -6058,7 +6782,7 @@ var Workbook = class {
 				for (const count of perRow.values()) if (count > options.maxCols) limit("maxCols", options.maxCols, count);
 			}
 		}
-		this._sheets = [];
+		this._clearSheets();
 		if (read.dateSystem === "1904") this.properties.date1904 = true;
 		else delete this.properties.date1904;
 		const p = read.properties;
@@ -6078,11 +6802,9 @@ var Workbook = class {
 		this.company = p.company;
 		this.manager = p.manager;
 		this._media = mediaOut(read.images);
-		const sheetIndex = (i) => {
-			let n = -1;
-			for (let k = 0; k <= i && k < read.sheets.length; k++) if (read.sheets[k].kind === "worksheet") n++;
-			return Math.max(n, 0);
-		};
+		const worksheetsUpTo = [];
+		for (const s of read.sheets) worksheetsUpTo.push((worksheetsUpTo[worksheetsUpTo.length - 1] ?? 0) + (s.kind === "worksheet" ? 1 : 0));
+		const sheetIndex = (i) => i < 0 || worksheetsUpTo.length === 0 ? 0 : Math.max((worksheetsUpTo[Math.min(i, worksheetsUpTo.length - 1)] ?? 0) - 1, 0);
 		this.views = read.views.map((v) => {
 			const view = {
 				x: v.x ?? 0,
@@ -6097,14 +6819,22 @@ var Workbook = class {
 		});
 		this.calcProperties = read.calculation?.fullCalcOnLoad ? { fullCalcOnLoad: true } : {};
 		const mediaIds = new Map(read.images.map((img, i) => [img, i]));
-		this._definedNames.model = read.definedNames.filter((d) => !d.name.startsWith("_xlnm.")).map((d) => ({
-			name: d.name,
-			ranges: extractRanges(d.refersTo)
-		}));
+		this._definedNames.model = read.definedNames.filter((d) => !d.name.startsWith("_xlnm.")).map((d) => {
+			const ranges = extractRanges(d.refersTo).filter((range) => {
+				const cells = rangeCellCount(range);
+				if (cells === null) return false;
+				spend(cells, `The defined name "${d.name.slice(0, 255)}"`, void 0);
+				return true;
+			});
+			return {
+				name: d.name,
+				ranges
+			};
+		});
 		const ids = freeIds(read.sheets.map((s) => s.kind === "worksheet" ? s.sheetId : void 0));
 		for (const [position, s] of read.sheets.entries()) {
 			if (s.kind !== "worksheet") continue;
-			const ws = this._addWorksheetWithId(ids[position] ?? this.nextId, s.name, { state: s.state });
+			const ws = this._addReadWorksheet(ids[position] ?? this.nextId, s.name, { state: s.state });
 			ws.orderNo = position;
 			for (const c of use("cols") ? s.columns : []) {
 				const last = Math.min(c.max, 16384);
@@ -6141,7 +6871,7 @@ var Workbook = class {
 				const target = ws.getCell(cell.row, cell.col);
 				let value;
 				const plain = cell.type === "error" ? { error: cell.value } : cell.value;
-				if (cell.formula && cell.formula.text !== null) value = formulaOut(cell.formula, plain, cell.ref, masters);
+				if (cell.formula && hasFormulaText(cell.formula)) value = formulaOut(cell.formula, plain, cell.ref, masters);
 				else value = cell.richText ? richTextOut(cell.richText) : plain;
 				const h = cell.hyperlink;
 				if (h && use("hyperlinks") && (h.target !== null || h.location !== null && h.location !== "")) {
@@ -6183,13 +6913,28 @@ var Workbook = class {
 			for (const m of use("mergeCells") ? s.merges : []) {
 				if (!m.includes(":")) continue;
 				spend(areaOf(m), "A merged range", s.name);
-				ws.mergeCells(m);
+				spendMerge(areaOf(m), m, s.name);
+				try {
+					ws.mergeCells(m);
+				} catch (error) {
+					if (error instanceof XlvError || !(error instanceof Error) || error.message !== "Cannot merge already merged cells") throw error;
+					const other = mergeOverlapping(ws, m);
+					throw new XlvError("XLV_E_OVERLAPPING_MERGE", `Cannot merge already merged cells: the merged range ${m} of worksheet "${s.name}" shares cells with ${other ?? "an earlier merged range"}.`, {
+						location: {
+							sheet: s.name,
+							cell: m
+						},
+						hint: "The file has merged ranges that share cells, which exceljs does not accept. Load it with ignoreNodes: [\"mergeCells\"], or read it with xlvane's readWorkbook.",
+						details: other === void 0 ? {} : { other },
+						cause: error
+					});
+				}
 			}
 			if (use("sheetViews")) ws.views = [viewOut(s.view, s.freeze)];
 			const tab = colorOut(s.tabColor ?? void 0);
 			if (tab && use("sheetPr")) ws.properties["tabColor"] = tab;
 			if (s.autoFilter && use("autoFilter")) ws.autoFilter = s.autoFilter;
-			if (use("dataValidations")) ws.dataValidations.model = dataValidationsOut(s.dataValidations, read.dateSystem === "1904");
+			if (use("dataValidations")) ws.dataValidations.model = dataValidationsOut(s.dataValidations, read.dateSystem === "1904", validations);
 			if (use("conditionalFormatting")) ws.conditionalFormattings = conditionalFormatsOut(s.conditionalFormats);
 			if (use("sheetProtection")) ws.sheetProtection = s.protection ? protectionOut(s.protection) : null;
 			if (use("pageSetup")) ws.pageSetup = pageSetupOut(s.pageSetup, s.printArea, s.printTitles);
@@ -6212,6 +6957,33 @@ var Workbook = class {
 		}
 	}
 };
+/** Merged cells `xlsx.load` creates at most for a file with fewer cells (one whole column; K2). */
+const MERGED_CELLS_BUDGET = 1048576;
+/**
+* @internal The chunks of an input stream, read until it ends. Reading stops with
+* XLV_E_LIMIT_EXCEEDED as soon as the chunks pass maxInputBytes, the size the core reads at most,
+* so an endless stream is not collected first (security review J, C8).
+*/
+async function collectInput(stream, what) {
+	const limit = DEFAULT_READ_LIMITS.maxInputBytes;
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of stream) {
+		chunks.push(chunk);
+		size += chunk.length;
+		if (size > limit) throw new XlvError("XLV_E_LIMIT_EXCEEDED", `The stream given to ${what} holds more than ${String(limit)} bytes (maxInputBytes).`, {
+			hint: "Check that the stream is the XLSX file you expect. A larger file from a trusted source can be read with xlvane's readWorkbook and a higher limit, for example { limits: { maxInputBytes: 1073741824 } }.",
+			details: {
+				limit: "maxInputBytes",
+				value: limit
+			}
+		});
+	}
+	return {
+		chunks,
+		size
+	};
+}
 /**
 * Worksheet ids for a list of wanted ids: each whole number from 1 to 65534 (the sheet ids Office
 * uses, W2-20) that is not wanted by an earlier entry is kept; other entries (missing, invalid,
@@ -6236,17 +7008,33 @@ function freeIds(wanted) {
 		return next;
 	});
 }
-/** Cells in a range such as "A1:C3" (1 for a cell, 0 for anything else). */
-function areaOf(ref) {
+/** The rows and columns of a range such as "A1:C3" or a cell, or `null` for anything else. */
+function rangeOf(ref) {
 	const m = /^([A-Z]{1,3})(\d{1,7})(?::([A-Z]{1,3})(\d{1,7}))?$/.exec(ref.replace(/\$/g, ""));
-	if (!m) return 0;
+	if (!m) return null;
 	const col = (letters) => {
 		let n = 0;
 		for (const ch of letters) n = n * 26 + ch.charCodeAt(0) - 64;
 		return n;
 	};
 	const [, c1 = "A", r1 = "1", c2 = c1, r2 = r1] = m;
-	return (Math.abs(Number(r2) - Number(r1)) + 1) * (Math.abs(col(c2) - col(c1)) + 1);
+	return {
+		top: Math.min(Number(r1), Number(r2)),
+		left: Math.min(col(c1), col(c2)),
+		bottom: Math.max(Number(r1), Number(r2)),
+		right: Math.max(col(c1), col(c2))
+	};
+}
+/** Cells in a range such as "A1:C3" (1 for a cell, 0 for anything else). */
+function areaOf(ref) {
+	const r = rangeOf(ref);
+	return r ? (r.bottom - r.top + 1) * (r.right - r.left + 1) : 0;
+}
+/** A merged range of the worksheet that shares cells with `ref`, as "A1:B2". */
+function mergeOverlapping(ws, ref) {
+	const r = rangeOf(ref);
+	if (!r) return void 0;
+	for (const o of ws._merges.values()) if (o.top <= r.bottom && r.top <= o.bottom && o.left <= r.right && r.left <= o.right) return `${columnLetter(o.left)}${String(o.top)}:${columnLetter(o.right)}${String(o.bottom)}`;
 }
 // src/stream.ts
 /**
@@ -6259,7 +7047,7 @@ function streamValueIn(cell, masters) {
 	const v = cell.value;
 	if (v !== null && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date)) {
 		const r = v;
-		if (typeof r["formula"] === "string" && r["shareType"] !== "array" && typeof r["ref"] === "string") {
+		if (typeof r["ref"] === "string" && r["shareType"] !== "array" && typeof r["formula"] === "string") {
 			masters.set(cell.address, {
 				formula: r["formula"],
 				row: cell.row,
@@ -6641,7 +7429,7 @@ var WorkbookWriter = class {
 	/** Adds a worksheet. Sheets are written in the order their first rows are committed. */
 	addWorksheet(name, options) {
 		const sheet = new WorksheetWriter(this, this.nextId++, name, options);
-		this._book._sheets[sheet.id] = sheet;
+		this._book._putSheet(sheet);
 		this.open.push(sheet);
 		return sheet;
 	}
@@ -6866,6 +7654,44 @@ var WorksheetReader = class extends Emitter {
 	}
 };
 /**
+* The value of a shared-formula dependent read by the streaming reader: `{ sharedFormula: master,
+* result }`, as exceljs's xlsx.load gives it, with a non-enumerable `formula` that moves the
+* master's text (`masters`, by address) to `row`/`col` when it is first read. The master's row is
+* not kept, so a sheet the value is copied into (stream.xlsx.WorkbookWriter, whose committed rows
+* are dropped) can write this formula instead of looking the master up (K3); reading the rows
+* alone builds no moved texts (K2). Setting `formula` replaces it with an ordinary property. A move
+* counts against the shared-formula budget of `workbook`, as `cell.formula` does (K4 S1).
+*/
+function sharedDependent(master, result, masters, row, col, workbook, sheet) {
+	const value = {
+		sharedFormula: master,
+		...result
+	};
+	let moved;
+	let built = false;
+	Object.defineProperty(value, "formula", {
+		configurable: true,
+		enumerable: false,
+		get() {
+			if (!built) {
+				const text = masters.get(master);
+				moved = text === void 0 ? void 0 : moveSharedFormula(workbook, sheet, text, decodeAddress(master), row, col);
+				built = true;
+			}
+			return moved;
+		},
+		set(formula) {
+			Object.defineProperty(this, "formula", {
+				value: formula,
+				writable: true,
+				enumerable: true,
+				configurable: true
+			});
+		}
+	});
+	return value;
+}
+/**
 * The streaming reader of exceljs (`ExcelJS.stream.xlsx.WorkbookReader`): iterate worksheets
 * and their rows with `for await`, or call `read()` and listen to `worksheet`, `end`,
 * `finished` and `error` events (and `entry` with `entries: 'emit'`). Rows are not kept.
@@ -6894,8 +7720,7 @@ var WorkbookReader = class extends Emitter {
 			return openWorkbookStreamFile(input);
 		}
 		if (input instanceof Uint8Array || input instanceof ArrayBuffer) return openWorkbookStream(input);
-		const chunks = [];
-		for await (const c of input) chunks.push(c);
+		const { chunks } = await collectInput(input, "stream.xlsx.WorkbookReader");
 		return openWorkbookStream(new Blob(chunks));
 	}
 	/** Worksheet events in workbook order, as exceljs `parse()` yields them (`{ eventType: 'worksheet', value }`). */
@@ -6914,18 +7739,33 @@ var WorkbookReader = class extends Emitter {
 				type: "worksheet",
 				id: String(id)
 			});
-			const sheet = host.addWorksheet(info.name, { state: info.state });
+			const sheet = host._addReadWorksheet(host.nextId, info.name, { state: info.state });
 			const name = info.name;
+			const masters = /* @__PURE__ */ new Map();
+			const kept = /* @__PURE__ */ new Map();
+			sheet._sharedMasters = kept;
 			const rows = async function* () {
 				for await (const r of book.rows(name)) {
 					const row = sheet.getRow(r.number);
 					for (const cell of r.cells) {
 						const plain = cell.type === "error" ? { error: cell.value } : cell.value;
 						const target = row.getCell(cell.col);
-						target.value = cell.formula && cell.formula.text !== null ? plain === null ? { formula: cell.formula.text } : {
-							formula: cell.formula.text,
-							result: plain
-						} : cell.richText ? richTextOut(cell.richText) : plain;
+						const f = cell.formula;
+						const result = plain === null ? {} : { result: plain };
+						let value;
+						if (f && f.kind === "shared" && f.sharedIndex !== null && f.ref === null && masters.has(f.sharedIndex) && hasFormulaText(f)) value = sharedDependent(masters.get(f.sharedIndex), result, kept, r.number, cell.col, host, name);
+						else if (f && hasFormulaText(f)) {
+							const text = f.text ?? "";
+							if (f.kind === "shared" && f.sharedIndex !== null && f.ref !== null) {
+								masters.set(f.sharedIndex, cell.ref);
+								kept.set(cell.ref, text);
+							}
+							value = {
+								formula: text,
+								...result
+							};
+						} else value = cell.richText ? richTextOut(cell.richText) : plain;
+						target.value = value;
 						if (styles) target.style = styleOut(cell.style, cell.numFmt);
 					}
 					for (const cell of r.styledCells) {