@yolk-sdk/extractors 0.1.0-canary.98

package/dist/node/xlsx-routing.mjs

@@ -0,0 +1,115 @@
+import { sheetJsTags, sheetJsTextViews } from "./sheetjs-xml.mjs";
+//#region src/node/xlsx-routing.ts
+/**
+* Early, exact rejection of XLSX input that SheetJS 0.20.3 would hand to its ODS, Numbers, or
+* binary (XLSB) parsers, so users get a clear error instead of "Could not read XLSX". These checks
+* are not the security guarantee: SheetJS only ever receives the allowlisted archive built by
+* `buildSheetJsInput` (`xlsx-sheetjs-input.ts`), which contains no marker entries and no `.bin`
+* parts whatever these checks decide.
+*/
+/**
+* An entry name as SheetJS looks it up: its ZIP reader (`cfb_add`) keeps a name that already
+* starts with `Root Entry/` and otherwise stores `"Root Entry/" + name` with the first `//`
+* collapsed; `safegetzipfile` strips `Root Entry/`, treats `\` and `/` alike, and compares
+* lower-cased names.
+*/
+const sheetJsEntryPath = (name) => (name.startsWith("Root Entry/") ? name : `Root Entry/${name}`.replace("//", "/")).replace(/^Root Entry\//, "").replaceAll("\\", "/").toLowerCase();
+/** Entries `parse_zip` checks before content types (SheetJS-normalized paths). */
+const alternateFormatEntries = new Set([
+	"meta-inf/manifest.xml",
+	"objectdata.xml",
+	"index/document.iwa"
+]);
+/**
+* Whether SheetJS would treat this entry as an ODS, UOC, or Numbers marker. `CFB.find` matches
+* `Index.zip` by base name, and any `Root Entry/` name (any case) is rejected outright.
+*/
+const isAlternateFormatEntry = (name) => {
+	const path = sheetJsEntryPath(name);
+	return name.toLowerCase().startsWith("root entry/") || alternateFormatEntries.has(path) || path.slice(path.lastIndexOf("/") + 1) === "index.zip";
+};
+/** Whether any tag SheetJS would parse from any view of `content` satisfies `test`. */
+const someSheetJsTag = (content, test) => sheetJsTextViews(content).some((text) => {
+	for (const tag of sheetJsTags(text)) if (test(tag)) return true;
+	return false;
+});
+const namedEntities = new Map([
+	["quot", "\""],
+	["apos", "'"],
+	["gt", ">"],
+	["lt", "<"],
+	["amp", "&"]
+]);
+/** SheetJS `unescapexml`: XML entities, numeric references, `_xHHHH_` codes, CDATA. */
+const unescapeLikeSheetJs = (text) => text.replace(/<!\[CDATA\[|\]\]>/g, "").replace(/&(quot|apos|gt|lt|amp|#x?[\da-f]+);/gi, (raw, entity) => {
+	const named = namedEntities.get(entity.toLowerCase());
+	if (named !== void 0) return named;
+	const hex = entity[1] === "x" || entity[1] === "X";
+	const code = Number.parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10);
+	return Number.isInteger(code) && code <= 65535 ? String.fromCharCode(code) : raw;
+}).replace(/_x([\da-f]{4})_/gi, (_, code) => String.fromCharCode(Number.parseInt(code, 16)));
+/** SheetJS `resolve_path` from the directory of `xl/…` (only the final segment matters here). */
+const resolveLikeSheetJs = (target) => {
+	if (target.startsWith("/")) return target.slice(1);
+	const segments = ["xl"];
+	for (const step of target.split("/")) if (step === "..") segments.pop();
+	else if (step !== ".") segments.push(step);
+	return segments.join("/");
+};
+/**
+* Whether a `Target` or `PartName` names a path ending in `.bin`, the only suffix SheetJS hands
+* to a binary parser. Checked raw and SheetJS-unescaped, as written and resolved.
+*/
+const namesBinaryPart = (value) => [value, unescapeLikeSheetJs(value)].some((path) => path.toLowerCase().endsWith(".bin") || resolveLikeSheetJs(path).toLowerCase().endsWith(".bin"));
+/**
+* Relationship types whose `.bin` targets SheetJS never parses: it follows workbook
+* relationships only as sheets (worksheet, chartsheet, dialogsheet, macrosheet, or no type) and
+* worksheet relationships only as comments, drawings, and legacy drawings.
+*/
+const binaryRelationshipTypes = new Set([
+	"printerSettings",
+	"oleObject",
+	"activeXControlBinary",
+	"customProperty",
+	"attachedToolbars",
+	"image",
+	"hyperlink"
+]);
+/**
+* Whether a relationships part has a `<Relationship>` whose `Target` ends in `.bin` and whose
+* `Type` (read exactly as SheetJS reads it: case-sensitive, missing counts as a sheet) is not on
+* the allowlist.
+*/
+const relationshipsRouteToBinary = (content) => someSheetJsTag(content, ({ head, attributes }) => {
+	const target = attributes.get("Target");
+	if (head !== "<Relationship" || target === void 0 || !namesBinaryPart(target)) return false;
+	const type = attributes.get("Type");
+	return type === void 0 || !binaryRelationshipTypes.has(type.slice(type.lastIndexOf("/") + 1));
+});
+/** Content types of `.bin` parts SheetJS never parses, lower-cased. */
+const binaryPartContentTypes = new Set([
+	"application/vnd.openxmlformats-officedocument.spreadsheetml.printersettings",
+	"application/vnd.ms-office.activex",
+	"application/vnd.openxmlformats-officedocument.oleobject",
+	"application/vnd.openxmlformats-officedocument.spreadsheetml.customproperty",
+	"application/vnd.ms-excel.attachedtoolbars"
+]);
+/** XLSB part types: `application/vnd.ms-excel.*` without an `+xml` suffix (toolbars excepted). */
+const isBinarySpreadsheetType = (contentType) => contentType.startsWith("application/vnd.ms-excel.") && !contentType.endsWith("+xml") && !binaryPartContentTypes.has(contentType);
+/**
+* Whether `[Content_Types].xml` has an `<Override>` (any prefix, as SheetJS reads it) with an
+* XLSB content type, or a `PartName` ending in `.bin` whose content type is not on the allowlist.
+* `<Default>` entries are ignored: SheetJS does not route by them, and its own XLSX writer emits
+* `<Default Extension="bin">` with the XLSB workbook type.
+*/
+const contentTypesRouteToBinary = (content) => someSheetJsTag(content, ({ head, attributes }) => {
+	if (head.replace(/<\w*:/, "<") !== "<Override") return false;
+	const contentType = attributes.get("ContentType")?.toLowerCase();
+	const partName = attributes.get("PartName");
+	if (contentType !== void 0 && isBinarySpreadsheetType(contentType)) return true;
+	return partName !== void 0 && namesBinaryPart(partName) && (contentType === void 0 || !binaryPartContentTypes.has(contentType));
+});
+//#endregion
+export { contentTypesRouteToBinary, isAlternateFormatEntry, relationshipsRouteToBinary, sheetJsEntryPath };
+
+//# sourceMappingURL=xlsx-routing.mjs.map

package/dist/node/xlsx-routing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"xlsx-routing.mjs","names":[],"sources":["../../src/node/xlsx-routing.ts"],"sourcesContent":["import { sheetJsTags, sheetJsTextViews } from './sheetjs-xml.ts'\nimport type { SheetJsTag } from './sheetjs-xml.ts'\n\n/**\n * Early, exact rejection of XLSX input that SheetJS 0.20.3 would hand to its ODS, Numbers, or\n * binary (XLSB) parsers, so users get a clear error instead of \"Could not read XLSX\". These checks\n * are not the security guarantee: SheetJS only ever receives the allowlisted archive built by\n * `buildSheetJsInput` (`xlsx-sheetjs-input.ts`), which contains no marker entries and no `.bin`\n * parts whatever these checks decide.\n */\n\n/**\n * An entry name as SheetJS looks it up: its ZIP reader (`cfb_add`) keeps a name that already\n * starts with `Root Entry/` and otherwise stores `\"Root Entry/\" + name` with the first `//`\n * collapsed; `safegetzipfile` strips `Root Entry/`, treats `\\` and `/` alike, and compares\n * lower-cased names.\n */\nexport const sheetJsEntryPath = (name: string) =>\n  (name.startsWith('Root Entry/') ? name : `Root Entry/${name}`.replace('//', '/'))\n    .replace(/^Root Entry\\//, '')\n    .replaceAll('\\\\', '/')\n    .toLowerCase()\n\n/** Entries `parse_zip` checks before content types (SheetJS-normalized paths). */\nconst alternateFormatEntries = new Set([\n  'meta-inf/manifest.xml',\n  'objectdata.xml',\n  'index/document.iwa'\n])\n\n/**\n * Whether SheetJS would treat this entry as an ODS, UOC, or Numbers marker. `CFB.find` matches\n * `Index.zip` by base name, and any `Root Entry/` name (any case) is rejected outright.\n */\nexport const isAlternateFormatEntry = (name: string) => {\n  const path = sheetJsEntryPath(name)\n\n  return (\n    name.toLowerCase().startsWith('root entry/') ||\n    alternateFormatEntries.has(path) ||\n    path.slice(path.lastIndexOf('/') + 1) === 'index.zip'\n  )\n}\n\n/** Whether any tag SheetJS would parse from any view of `content` satisfies `test`. */\nconst someSheetJsTag = (content: Uint8Array, test: (tag: SheetJsTag) => boolean) =>\n  sheetJsTextViews(content).some(text => {\n    for (const tag of sheetJsTags(text)) {\n      if (test(tag)) return true\n    }\n\n    return false\n  })\n\nconst namedEntities: ReadonlyMap<string, string> = new Map([\n  ['quot', '\"'],\n  ['apos', \"'\"],\n  ['gt', '>'],\n  ['lt', '<'],\n  ['amp', '&']\n])\n\n/** SheetJS `unescapexml`: XML entities, numeric references, `_xHHHH_` codes, CDATA. */\nconst unescapeLikeSheetJs = (text: string): string =>\n  text\n    .replace(/<!\\[CDATA\\[|\\]\\]>/g, '')\n    .replace(/&(quot|apos|gt|lt|amp|#x?[\\da-f]+);/gi, (raw, entity: string) => {\n      const named = namedEntities.get(entity.toLowerCase())\n\n      if (named !== undefined) return named\n\n      const hex = entity[1] === 'x' || entity[1] === 'X'\n      const code = Number.parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10)\n\n      return Number.isInteger(code) && code <= 0xffff ? String.fromCharCode(code) : raw\n    })\n    .replace(/_x([\\da-f]{4})_/gi, (_, code: string) =>\n      String.fromCharCode(Number.parseInt(code, 16))\n    )\n\n/** SheetJS `resolve_path` from the directory of `xl/…` (only the final segment matters here). */\nconst resolveLikeSheetJs = (target: string) => {\n  if (target.startsWith('/')) return target.slice(1)\n\n  const segments = ['xl']\n\n  for (const step of target.split('/')) {\n    if (step === '..') segments.pop()\n    else if (step !== '.') segments.push(step)\n  }\n\n  return segments.join('/')\n}\n\n/**\n * Whether a `Target` or `PartName` names a path ending in `.bin`, the only suffix SheetJS hands\n * to a binary parser. Checked raw and SheetJS-unescaped, as written and resolved.\n */\nconst namesBinaryPart = (value: string) =>\n  [value, unescapeLikeSheetJs(value)].some(\n    path =>\n      path.toLowerCase().endsWith('.bin') || resolveLikeSheetJs(path).toLowerCase().endsWith('.bin')\n  )\n\n/**\n * Relationship types whose `.bin` targets SheetJS never parses: it follows workbook\n * relationships only as sheets (worksheet, chartsheet, dialogsheet, macrosheet, or no type) and\n * worksheet relationships only as comments, drawings, and legacy drawings.\n */\nconst binaryRelationshipTypes = new Set([\n  'printerSettings',\n  'oleObject',\n  'activeXControlBinary',\n  'customProperty',\n  'attachedToolbars',\n  'image',\n  'hyperlink'\n])\n\n/**\n * Whether a relationships part has a `<Relationship>` whose `Target` ends in `.bin` and whose\n * `Type` (read exactly as SheetJS reads it: case-sensitive, missing counts as a sheet) is not on\n * the allowlist.\n */\nexport const relationshipsRouteToBinary = (content: Uint8Array) =>\n  someSheetJsTag(content, ({ head, attributes }) => {\n    const target = attributes.get('Target')\n\n    if (head !== '<Relationship' || target === undefined || !namesBinaryPart(target)) return false\n\n    const type = attributes.get('Type')\n\n    return type === undefined || !binaryRelationshipTypes.has(type.slice(type.lastIndexOf('/') + 1))\n  })\n\n/** Content types of `.bin` parts SheetJS never parses, lower-cased. */\nconst binaryPartContentTypes = new Set([\n  'application/vnd.openxmlformats-officedocument.spreadsheetml.printersettings',\n  'application/vnd.ms-office.activex',\n  'application/vnd.openxmlformats-officedocument.oleobject',\n  'application/vnd.openxmlformats-officedocument.spreadsheetml.customproperty',\n  'application/vnd.ms-excel.attachedtoolbars'\n])\n\n/** XLSB part types: `application/vnd.ms-excel.*` without an `+xml` suffix (toolbars excepted). */\nconst isBinarySpreadsheetType = (contentType: string) =>\n  contentType.startsWith('application/vnd.ms-excel.') &&\n  !contentType.endsWith('+xml') &&\n  !binaryPartContentTypes.has(contentType)\n\n/**\n * Whether `[Content_Types].xml` has an `<Override>` (any prefix, as SheetJS reads it) with an\n * XLSB content type, or a `PartName` ending in `.bin` whose content type is not on the allowlist.\n * `<Default>` entries are ignored: SheetJS does not route by them, and its own XLSX writer emits\n * `<Default Extension=\"bin\">` with the XLSB workbook type.\n */\nexport const contentTypesRouteToBinary = (content: Uint8Array) =>\n  someSheetJsTag(content, ({ head, attributes }) => {\n    if (head.replace(/<\\w*:/, '<') !== '<Override') return false\n\n    const contentType = attributes.get('ContentType')?.toLowerCase()\n    const partName = attributes.get('PartName')\n\n    if (contentType !== undefined && isBinarySpreadsheetType(contentType)) return true\n\n    return (\n      partName !== undefined &&\n      namesBinaryPart(partName) &&\n      (contentType === undefined || !binaryPartContentTypes.has(contentType))\n    )\n  })\n"],"mappings":";;;;;;;;;;;;;;;AAiBA,MAAa,oBAAoB,UAC9B,KAAK,WAAW,aAAa,IAAI,OAAO,cAAc,OAAO,QAAQ,MAAM,GAAG,GAC5E,QAAQ,iBAAiB,EAAE,EAC3B,WAAW,MAAM,GAAG,EACpB,YAAY;;AAGjB,MAAM,yBAAyB,IAAI,IAAI;CACrC;CACA;CACA;AACF,CAAC;;;;;AAMD,MAAa,0BAA0B,SAAiB;CACtD,MAAM,OAAO,iBAAiB,IAAI;CAElC,OACE,KAAK,YAAY,EAAE,WAAW,aAAa,KAC3C,uBAAuB,IAAI,IAAI,KAC/B,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,MAAM;AAE9C;;AAGA,MAAM,kBAAkB,SAAqB,SAC3C,iBAAiB,OAAO,EAAE,MAAK,SAAQ;CACrC,KAAK,MAAM,OAAO,YAAY,IAAI,GAChC,IAAI,KAAK,GAAG,GAAG,OAAO;CAGxB,OAAO;AACT,CAAC;AAEH,MAAM,gBAA6C,IAAI,IAAI;CACzD,CAAC,QAAQ,IAAG;CACZ,CAAC,QAAQ,GAAG;CACZ,CAAC,MAAM,GAAG;CACV,CAAC,MAAM,GAAG;CACV,CAAC,OAAO,GAAG;AACb,CAAC;;AAGD,MAAM,uBAAuB,SAC3B,KACG,QAAQ,sBAAsB,EAAE,EAChC,QAAQ,0CAA0C,KAAK,WAAmB;CACzE,MAAM,QAAQ,cAAc,IAAI,OAAO,YAAY,CAAC;CAEpD,IAAI,UAAU,KAAA,GAAW,OAAO;CAEhC,MAAM,MAAM,OAAO,OAAO,OAAO,OAAO,OAAO;CAC/C,MAAM,OAAO,OAAO,SAAS,OAAO,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE;CAErE,OAAO,OAAO,UAAU,IAAI,KAAK,QAAQ,QAAS,OAAO,aAAa,IAAI,IAAI;AAChF,CAAC,EACA,QAAQ,sBAAsB,GAAG,SAChC,OAAO,aAAa,OAAO,SAAS,MAAM,EAAE,CAAC,CAC/C;;AAGJ,MAAM,sBAAsB,WAAmB;CAC7C,IAAI,OAAO,WAAW,GAAG,GAAG,OAAO,OAAO,MAAM,CAAC;CAEjD,MAAM,WAAW,CAAC,IAAI;CAEtB,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GACjC,IAAI,SAAS,MAAM,SAAS,IAAI;MAC3B,IAAI,SAAS,KAAK,SAAS,KAAK,IAAI;CAG3C,OAAO,SAAS,KAAK,GAAG;AAC1B;;;;;AAMA,MAAM,mBAAmB,UACvB,CAAC,OAAO,oBAAoB,KAAK,CAAC,EAAE,MAClC,SACE,KAAK,YAAY,EAAE,SAAS,MAAM,KAAK,mBAAmB,IAAI,EAAE,YAAY,EAAE,SAAS,MAAM,CACjG;;;;;;AAOF,MAAM,0BAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,MAAa,8BAA8B,YACzC,eAAe,UAAU,EAAE,MAAM,iBAAiB;CAChD,MAAM,SAAS,WAAW,IAAI,QAAQ;CAEtC,IAAI,SAAS,mBAAmB,WAAW,KAAA,KAAa,CAAC,gBAAgB,MAAM,GAAG,OAAO;CAEzF,MAAM,OAAO,WAAW,IAAI,MAAM;CAElC,OAAO,SAAS,KAAA,KAAa,CAAC,wBAAwB,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AACjG,CAAC;;AAGH,MAAM,yBAAyB,IAAI,IAAI;CACrC;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,2BAA2B,gBAC/B,YAAY,WAAW,2BAA2B,KAClD,CAAC,YAAY,SAAS,MAAM,KAC5B,CAAC,uBAAuB,IAAI,WAAW;;;;;;;AAQzC,MAAa,6BAA6B,YACxC,eAAe,UAAU,EAAE,MAAM,iBAAiB;CAChD,IAAI,KAAK,QAAQ,SAAS,GAAG,MAAM,aAAa,OAAO;CAEvD,MAAM,cAAc,WAAW,IAAI,aAAa,GAAG,YAAY;CAC/D,MAAM,WAAW,WAAW,IAAI,UAAU;CAE1C,IAAI,gBAAgB,KAAA,KAAa,wBAAwB,WAAW,GAAG,OAAO;CAE9E,OACE,aAAa,KAAA,KACb,gBAAgB,QAAQ,MACvB,gBAAgB,KAAA,KAAa,CAAC,uBAAuB,IAAI,WAAW;AAEzE,CAAC"}

package/dist/node/xlsx-sheetjs-input.d.mts

@@ -0,0 +1,29 @@
+//#region src/node/xlsx-sheetjs-input.d.ts
+/** Canonical names SheetJS can receive besides `xl/worksheets/sheet<n>.xml`. */
+declare const sheetJsFixedParts: readonly ["[Content_Types].xml", "_rels/.rels", "xl/workbook.xml", "xl/_rels/workbook.xml.rels", "xl/sharedStrings.xml", "xl/styles.xml"];
+/** Whether `name` is one of the canonical names `buildSheetJsInput` emits. */
+declare const isSheetJsInputName: (name: string) => boolean;
+type SheetJsInputSheet = {
+  /** The sheet name exactly as SheetJS reads it from the generated workbook. */readonly name: string; /** The validated source part handed over as this sheet's worksheet, if any. */
+  readonly part: string | undefined;
+};
+type SheetJsInput = {
+  /** The stored-entry ZIP handed to SheetJS. */readonly archive: Uint8Array; /** Entry names in `archive`, all canonical (see `isSheetJsInputName`). */
+  readonly names: ReadonlyArray<string>; /** Every sheet of the generated workbook, in order. */
+  readonly sheets: ReadonlyArray<SheetJsInputSheet>; /** The workbook title from its core properties, read without SheetJS. */
+  readonly title: string | undefined;
+};
+/**
+ * Build SheetJS's input from validated parts. Sheet `n` of the workbook gets relationship
+ * `rId<n>` to `xl/worksheets/sheet<n>.xml`. That entry holds the sheet's worksheet when its
+ * workbook relationship is an internal worksheet resolving to an `.xml` part; other sheets (chart
+ * sheets, missing parts) keep their name and order but have no entry, so SheetJS skips them.
+ *
+ * Throws `FileExtractionError` when the workbook declares more than `maxSheets` sheets, when it
+ * is malformed (see `readWorkbookModel`; two sheets on one worksheet part count too), or when a
+ * copied part holds CDATA, all before SheetJS runs.
+ */
+declare const buildSheetJsInput: (parts: Readonly<Record<string, Uint8Array>>, maxSheets: number) => SheetJsInput;
+//#endregion
+export { SheetJsInput, SheetJsInputSheet, buildSheetJsInput, isSheetJsInputName, sheetJsFixedParts };
+//# sourceMappingURL=xlsx-sheetjs-input.d.mts.map

package/dist/node/xlsx-sheetjs-input.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xlsx-sheetjs-input.d.mts","names":[],"sources":["../../src/node/xlsx-sheetjs-input.ts"],"mappings":";;cA8Da,iBAAA;;cAcA,kBAAA,GAAsB,IAAY;AAAA,KA4DnC,iBAAA;EAnEF,uFAqEC,IAAA,UA7DgD;EAAA,SA+DhD,IAAI;AAAA;AAAA,KAGH,YAAA;EAPA,uDASD,OAAA,EAAS,UAAA;WAET,KAAA,EAAO,aAAA,UAPH;EAAA,SASJ,MAAA,EAAQ,aAAA,CAAc,iBAAA,GANT;EAAA,SAQb,KAAA;AAAA;;;;;;;;;;;cAaE,iBAAA,GACX,KAAA,EAAO,QAAA,CAAS,MAAA,SAAe,UAAA,IAC/B,SAAA,aACC,YAAA"}

package/dist/node/xlsx-sheetjs-input.mjs

@@ -0,0 +1,165 @@
+import { FileExtractionError } from "../errors.mjs";
+import { coreTitle, officeDocumentRelationshipsNamespace, sheetJsCouldReadCdata, sheetJsXmlHeader } from "./sheetjs-xml.mjs";
+import { directoryOf, indexParts, relationships, relationshipsPathFor, resolvePartPath, utf8Text, workbookPartPath } from "./xlsx-parts.mjs";
+import { readStyles, stylesXml } from "./xlsx-styles.mjs";
+import { readWorkbookModel, workbookXml } from "./xlsx-workbook.mjs";
+import { strToU8, zipSync } from "fflate";
+//#region src/node/xlsx-sheetjs-input.ts
+/**
+* The archive SheetJS reads is built here from scratch, never passed through. Every part SheetJS
+* reads is generated or checked:
+*
+* - generated: `[Content_Types].xml`, `_rels/.rels`, `xl/_rels/workbook.xml.rels`,
+*   `xl/workbook.xml` (`xlsx-workbook.ts`), and `xl/styles.xml` (`xlsx-styles.ts`);
+* - copied after checks: worksheets (stored as `xl/worksheets/sheet<n>.xml`) and
+*   `xl/sharedStrings.xml`, validated, hyperlink-stripped, and free of anything SheetJS could
+*   turn into a CDATA marker (`sheetJsCouldReadCdata`).
+*
+* With these entries SheetJS 0.20.3 `parse_zip` can only take its XLSX path:
+*
+* - no `META-INF/manifest.xml`, `objectdata.xml`, or `Index/Document.iwa`, so it never reaches
+*   `parse_ods` or `parse_numbers_iwa`; `[Content_Types].xml` exists, so `Index.zip` is never read;
+* - every entry ends in `.xml` or `.rels`, so no binary (XLSB) parser can receive data: SheetJS
+*   dispatches on the requested path ending in `.bin`, and `safegetzipfile` only returns an entry
+*   whose name equals that path ignoring case;
+* - the generated content types name the XML workbook, so `xlsb` stays false, and no attacker
+*   `Override`, `PartName`, relationship `Type`, or `Target` reaches SheetJS;
+* - the generated workbook lists exactly the sheets the extractor counted, each with its own
+*   relationship to its own `xl/worksheets/sheet<n>.xml`, so every part is parsed at most once.
+*
+* Comments, threaded comments, VML, drawings, worksheet relationships, external links, pivot
+* caches, calculation chains, metadata, themes, `customXml`, and `docProps/*` (the title is read
+* by the extractor) are left out; SheetJS reads none of them to produce cell values or display
+* text.
+*/
+const strictOfficeDocumentRelationships = "http://purl.oclc.org/ooxml/officeDocument/relationships";
+const corePropertiesTypes = new Set(["http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties", "http://schemas.openxmlformats.org/officedocument/2006/relationships/metadata/core-properties"]);
+/** A relationship of `kind` in the transitional or strict namespace. */
+const hasKind = (relationship, kind) => relationship.type === `http://schemas.openxmlformats.org/officeDocument/2006/relationships/${kind}` || relationship.type === `${strictOfficeDocumentRelationships}/${kind}`;
+/** Canonical names SheetJS can receive besides `xl/worksheets/sheet<n>.xml`. */
+const sheetJsFixedParts = [
+	"[Content_Types].xml",
+	"_rels/.rels",
+	"xl/workbook.xml",
+	"xl/_rels/workbook.xml.rels",
+	"xl/sharedStrings.xml",
+	"xl/styles.xml"
+];
+const canonicalWorksheet = /^xl\/worksheets\/sheet[1-9]\d*\.xml$/;
+const fixedPartNames = new Set(sheetJsFixedParts);
+/** Whether `name` is one of the canonical names `buildSheetJsInput` emits. */
+const isSheetJsInputName = (name) => fixedPartNames.has(name) || canonicalWorksheet.test(name);
+const contentType = {
+	workbook: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml",
+	worksheet: "application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml",
+	sharedStrings: "application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml",
+	styles: "application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml"
+};
+const contentTypesXml = (overrides) => `${sheetJsXmlHeader}<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/>${overrides.map(([path, type]) => `<Override PartName="/${path}" ContentType="${type}"/>`).join("")}</Types>`;
+const relationshipsXml = (entries) => `${sheetJsXmlHeader}<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">${entries.map(([id, type, target]) => `<Relationship Id="${id}" Type="${type}" Target="${target}"/>`).join("")}</Relationships>`;
+/** An XML part found by name ignoring case; `.xml` only, so no binary bytes are renamed. */
+const xmlPart = (index, path) => {
+	const part = path === void 0 ? void 0 : index.find(path);
+	return part !== void 0 && part.name.toLowerCase().endsWith(".xml") ? part : void 0;
+};
+/** The part a relationship of `kind` points at, else the conventional path. */
+const relatedXmlPart = (index, related, baseDirectory, matches, conventionalPath) => {
+	for (const relationship of related.values()) if (!relationship.external && matches(relationship)) return xmlPart(index, resolvePartPath(baseDirectory, relationship.target));
+	return xmlPart(index, conventionalPath);
+};
+const malformed = () => new FileExtractionError({
+	format: "xlsx",
+	message: "XLSX workbook is malformed."
+});
+const cdataRejected = () => new FileExtractionError({
+	format: "xlsx",
+	message: "XLSX contains unsupported markup (CDATA, comments or declarations) in worksheet or shared-strings parts."
+});
+/** A copied part, unless SheetJS could meet a CDATA marker in it (decoded or tag-removed). */
+const withoutCdata = (bytes) => {
+	if (sheetJsCouldReadCdata(bytes)) throw cdataRejected();
+	return bytes;
+};
+/**
+* Build SheetJS's input from validated parts. Sheet `n` of the workbook gets relationship
+* `rId<n>` to `xl/worksheets/sheet<n>.xml`. That entry holds the sheet's worksheet when its
+* workbook relationship is an internal worksheet resolving to an `.xml` part; other sheets (chart
+* sheets, missing parts) keep their name and order but have no entry, so SheetJS skips them.
+*
+* Throws `FileExtractionError` when the workbook declares more than `maxSheets` sheets, when it
+* is malformed (see `readWorkbookModel`; two sheets on one worksheet part count too), or when a
+* copied part holds CDATA, all before SheetJS runs.
+*/
+const buildSheetJsInput = (parts, maxSheets) => {
+	const index = indexParts(parts);
+	const workbook = index.find(workbookPartPath);
+	if (workbook === void 0) throw new FileExtractionError({
+		format: "xlsx",
+		message: "Invalid Office archive."
+	});
+	const workbookDirectory = directoryOf(workbookPartPath);
+	const workbookRelationships = relationships(utf8Text(index.find(relationshipsPathFor(workbookPartPath))?.bytes));
+	const model = readWorkbookModel(workbook.bytes, maxSheets);
+	const files = Object.create(null);
+	const overrides = [];
+	const sheetRelationships = [];
+	const sheets = [];
+	const included = /* @__PURE__ */ new Set();
+	for (const [position, sheet] of model.sheets.entries()) {
+		const name = `worksheets/sheet${position + 1}.xml`;
+		sheetRelationships.push([
+			`rId${position + 1}`,
+			`${officeDocumentRelationshipsNamespace}/worksheet`,
+			name
+		]);
+		const relationship = sheet.relationshipId === void 0 ? void 0 : workbookRelationships.get(sheet.relationshipId);
+		const part = relationship === void 0 || relationship.external || !hasKind(relationship, "worksheet") ? void 0 : xmlPart(index, resolvePartPath(workbookDirectory, relationship.target));
+		if (part === void 0) {
+			sheets.push({
+				name: sheet.name,
+				part: void 0
+			});
+			continue;
+		}
+		if (included.has(part.name)) throw malformed();
+		included.add(part.name);
+		files[`xl/${name}`] = withoutCdata(part.bytes);
+		overrides.push([`xl/${name}`, contentType.worksheet]);
+		sheets.push({
+			name: sheet.name,
+			part: part.name
+		});
+	}
+	const sharedStrings = relatedXmlPart(index, workbookRelationships, workbookDirectory, (relationship) => hasKind(relationship, "sharedStrings"), "xl/sharedStrings.xml");
+	if (sharedStrings !== void 0) {
+		files["xl/sharedStrings.xml"] = withoutCdata(sharedStrings.bytes);
+		overrides.push(["xl/sharedStrings.xml", contentType.sharedStrings]);
+	}
+	const styles = relatedXmlPart(index, workbookRelationships, workbookDirectory, (relationship) => hasKind(relationship, "styles"), "xl/styles.xml");
+	if (styles !== void 0) {
+		files["xl/styles.xml"] = strToU8(stylesXml(readStyles(styles.bytes)));
+		overrides.push(["xl/styles.xml", contentType.styles]);
+	}
+	const core = relatedXmlPart(index, relationships(utf8Text(index.find("_rels/.rels")?.bytes)), "", (relationship) => relationship.type !== void 0 && corePropertiesTypes.has(relationship.type), "docProps/core.xml");
+	const archive = {
+		"[Content_Types].xml": strToU8(contentTypesXml([[workbookPartPath, contentType.workbook], ...overrides])),
+		"_rels/.rels": strToU8(relationshipsXml([[
+			"rId1",
+			`${officeDocumentRelationshipsNamespace}/officeDocument`,
+			workbookPartPath
+		]])),
+		[workbookPartPath]: strToU8(workbookXml(model)),
+		"xl/_rels/workbook.xml.rels": strToU8(relationshipsXml(sheetRelationships)),
+		...files
+	};
+	return {
+		archive: zipSync(archive, { level: 0 }),
+		names: Object.keys(archive),
+		sheets,
+		title: coreTitle(core?.bytes)
+	};
+};
+//#endregion
+export { buildSheetJsInput, isSheetJsInputName, sheetJsFixedParts };
+
+//# sourceMappingURL=xlsx-sheetjs-input.mjs.map

package/dist/node/xlsx-sheetjs-input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"xlsx-sheetjs-input.mjs","names":[],"sources":["../../src/node/xlsx-sheetjs-input.ts"],"sourcesContent":["import { strToU8, zipSync } from 'fflate'\nimport { FileExtractionError } from '../errors.ts'\nimport {\n  coreTitle,\n  officeDocumentRelationshipsNamespace,\n  sheetJsCouldReadCdata,\n  sheetJsXmlHeader\n} from './sheetjs-xml.ts'\nimport { readStyles, stylesXml } from './xlsx-styles.ts'\nimport { readWorkbookModel, workbookXml } from './xlsx-workbook.ts'\nimport {\n  directoryOf,\n  indexParts,\n  relationships,\n  relationshipsPathFor,\n  resolvePartPath,\n  utf8Text,\n  workbookPartPath\n} from './xlsx-parts.ts'\nimport type { PartIndex, Relationship } from './xlsx-parts.ts'\n\n/**\n * The archive SheetJS reads is built here from scratch, never passed through. Every part SheetJS\n * reads is generated or checked:\n *\n * - generated: `[Content_Types].xml`, `_rels/.rels`, `xl/_rels/workbook.xml.rels`,\n *   `xl/workbook.xml` (`xlsx-workbook.ts`), and `xl/styles.xml` (`xlsx-styles.ts`);\n * - copied after checks: worksheets (stored as `xl/worksheets/sheet<n>.xml`) and\n *   `xl/sharedStrings.xml`, validated, hyperlink-stripped, and free of anything SheetJS could\n *   turn into a CDATA marker (`sheetJsCouldReadCdata`).\n *\n * With these entries SheetJS 0.20.3 `parse_zip` can only take its XLSX path:\n *\n * - no `META-INF/manifest.xml`, `objectdata.xml`, or `Index/Document.iwa`, so it never reaches\n *   `parse_ods` or `parse_numbers_iwa`; `[Content_Types].xml` exists, so `Index.zip` is never read;\n * - every entry ends in `.xml` or `.rels`, so no binary (XLSB) parser can receive data: SheetJS\n *   dispatches on the requested path ending in `.bin`, and `safegetzipfile` only returns an entry\n *   whose name equals that path ignoring case;\n * - the generated content types name the XML workbook, so `xlsb` stays false, and no attacker\n *   `Override`, `PartName`, relationship `Type`, or `Target` reaches SheetJS;\n * - the generated workbook lists exactly the sheets the extractor counted, each with its own\n *   relationship to its own `xl/worksheets/sheet<n>.xml`, so every part is parsed at most once.\n *\n * Comments, threaded comments, VML, drawings, worksheet relationships, external links, pivot\n * caches, calculation chains, metadata, themes, `customXml`, and `docProps/*` (the title is read\n * by the extractor) are left out; SheetJS reads none of them to produce cell values or display\n * text.\n */\n\nconst strictOfficeDocumentRelationships = 'http://purl.oclc.org/ooxml/officeDocument/relationships'\n\nconst corePropertiesTypes = new Set([\n  'http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties',\n  'http://schemas.openxmlformats.org/officedocument/2006/relationships/metadata/core-properties'\n])\n\n/** A relationship of `kind` in the transitional or strict namespace. */\nconst hasKind = (relationship: Relationship, kind: string) =>\n  relationship.type === `${officeDocumentRelationshipsNamespace}/${kind}` ||\n  relationship.type === `${strictOfficeDocumentRelationships}/${kind}`\n\n/** Canonical names SheetJS can receive besides `xl/worksheets/sheet<n>.xml`. */\nexport const sheetJsFixedParts = [\n  '[Content_Types].xml',\n  '_rels/.rels',\n  'xl/workbook.xml',\n  'xl/_rels/workbook.xml.rels',\n  'xl/sharedStrings.xml',\n  'xl/styles.xml'\n] as const\n\nconst canonicalWorksheet = /^xl\\/worksheets\\/sheet[1-9]\\d*\\.xml$/\n\nconst fixedPartNames: ReadonlySet<string> = new Set(sheetJsFixedParts)\n\n/** Whether `name` is one of the canonical names `buildSheetJsInput` emits. */\nexport const isSheetJsInputName = (name: string) =>\n  fixedPartNames.has(name) || canonicalWorksheet.test(name)\n\nconst contentType = {\n  workbook: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml',\n  worksheet: 'application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml',\n  sharedStrings: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml',\n  styles: 'application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml'\n} as const\n\nconst contentTypesXml = (overrides: ReadonlyArray<readonly [string, string]>) =>\n  `${sheetJsXmlHeader}<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\"><Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/><Default Extension=\"xml\" ContentType=\"application/xml\"/>${overrides\n    .map(([path, type]) => `<Override PartName=\"/${path}\" ContentType=\"${type}\"/>`)\n    .join('')}</Types>`\n\nconst relationshipsXml = (entries: ReadonlyArray<readonly [string, string, string]>) =>\n  `${sheetJsXmlHeader}<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">${entries\n    .map(([id, type, target]) => `<Relationship Id=\"${id}\" Type=\"${type}\" Target=\"${target}\"/>`)\n    .join('')}</Relationships>`\n\n/** An XML part found by name ignoring case; `.xml` only, so no binary bytes are renamed. */\nconst xmlPart = (index: PartIndex, path: string | undefined) => {\n  const part = path === undefined ? undefined : index.find(path)\n\n  return part !== undefined && part.name.toLowerCase().endsWith('.xml') ? part : undefined\n}\n\n/** The part a relationship of `kind` points at, else the conventional path. */\nconst relatedXmlPart = (\n  index: PartIndex,\n  related: ReadonlyMap<string, Relationship>,\n  baseDirectory: string,\n  matches: (relationship: Relationship) => boolean,\n  conventionalPath: string\n) => {\n  for (const relationship of related.values()) {\n    if (!relationship.external && matches(relationship))\n      return xmlPart(index, resolvePartPath(baseDirectory, relationship.target))\n  }\n\n  return xmlPart(index, conventionalPath)\n}\n\nconst malformed = () =>\n  new FileExtractionError({ format: 'xlsx', message: 'XLSX workbook is malformed.' })\n\nconst cdataRejected = () =>\n  new FileExtractionError({\n    format: 'xlsx',\n    message:\n      'XLSX contains unsupported markup (CDATA, comments or declarations) in worksheet or shared-strings parts.'\n  })\n\n/** A copied part, unless SheetJS could meet a CDATA marker in it (decoded or tag-removed). */\nconst withoutCdata = (bytes: Uint8Array) => {\n  if (sheetJsCouldReadCdata(bytes)) throw cdataRejected()\n\n  return bytes\n}\n\nexport type SheetJsInputSheet = {\n  /** The sheet name exactly as SheetJS reads it from the generated workbook. */\n  readonly name: string\n  /** The validated source part handed over as this sheet's worksheet, if any. */\n  readonly part: string | undefined\n}\n\nexport type SheetJsInput = {\n  /** The stored-entry ZIP handed to SheetJS. */\n  readonly archive: Uint8Array\n  /** Entry names in `archive`, all canonical (see `isSheetJsInputName`). */\n  readonly names: ReadonlyArray<string>\n  /** Every sheet of the generated workbook, in order. */\n  readonly sheets: ReadonlyArray<SheetJsInputSheet>\n  /** The workbook title from its core properties, read without SheetJS. */\n  readonly title: string | undefined\n}\n\n/**\n * Build SheetJS's input from validated parts. Sheet `n` of the workbook gets relationship\n * `rId<n>` to `xl/worksheets/sheet<n>.xml`. That entry holds the sheet's worksheet when its\n * workbook relationship is an internal worksheet resolving to an `.xml` part; other sheets (chart\n * sheets, missing parts) keep their name and order but have no entry, so SheetJS skips them.\n *\n * Throws `FileExtractionError` when the workbook declares more than `maxSheets` sheets, when it\n * is malformed (see `readWorkbookModel`; two sheets on one worksheet part count too), or when a\n * copied part holds CDATA, all before SheetJS runs.\n */\nexport const buildSheetJsInput = (\n  parts: Readonly<Record<string, Uint8Array>>,\n  maxSheets: number\n): SheetJsInput => {\n  const index = indexParts(parts)\n  const workbook = index.find(workbookPartPath)\n\n  if (workbook === undefined)\n    throw new FileExtractionError({ format: 'xlsx', message: 'Invalid Office archive.' })\n\n  const workbookDirectory = directoryOf(workbookPartPath)\n\n  const workbookRelationships = relationships(\n    utf8Text(index.find(relationshipsPathFor(workbookPartPath))?.bytes)\n  )\n\n  const model = readWorkbookModel(workbook.bytes, maxSheets)\n  const files: Record<string, Uint8Array> = Object.create(null)\n  const overrides: Array<readonly [string, string]> = []\n  const sheetRelationships: Array<readonly [string, string, string]> = []\n  const sheets: Array<SheetJsInputSheet> = []\n  const included = new Set<string>()\n\n  for (const [position, sheet] of model.sheets.entries()) {\n    const name = `worksheets/sheet${position + 1}.xml`\n\n    sheetRelationships.push([\n      `rId${position + 1}`,\n      `${officeDocumentRelationshipsNamespace}/worksheet`,\n      name\n    ])\n\n    const relationship =\n      sheet.relationshipId === undefined\n        ? undefined\n        : workbookRelationships.get(sheet.relationshipId)\n\n    const part =\n      relationship === undefined || relationship.external || !hasKind(relationship, 'worksheet')\n        ? undefined\n        : xmlPart(index, resolvePartPath(workbookDirectory, relationship.target))\n\n    if (part === undefined) {\n      sheets.push({ name: sheet.name, part: undefined })\n      continue\n    }\n\n    // One part per sheet: SheetJS would parse and keep a shared part once per declaration.\n    if (included.has(part.name)) throw malformed()\n\n    included.add(part.name)\n    files[`xl/${name}`] = withoutCdata(part.bytes)\n    overrides.push([`xl/${name}`, contentType.worksheet])\n    sheets.push({ name: sheet.name, part: part.name })\n  }\n\n  const sharedStrings = relatedXmlPart(\n    index,\n    workbookRelationships,\n    workbookDirectory,\n    relationship => hasKind(relationship, 'sharedStrings'),\n    'xl/sharedStrings.xml'\n  )\n\n  if (sharedStrings !== undefined) {\n    files['xl/sharedStrings.xml'] = withoutCdata(sharedStrings.bytes)\n    overrides.push(['xl/sharedStrings.xml', contentType.sharedStrings])\n  }\n\n  const styles = relatedXmlPart(\n    index,\n    workbookRelationships,\n    workbookDirectory,\n    relationship => hasKind(relationship, 'styles'),\n    'xl/styles.xml'\n  )\n\n  if (styles !== undefined) {\n    files['xl/styles.xml'] = strToU8(stylesXml(readStyles(styles.bytes)))\n    overrides.push(['xl/styles.xml', contentType.styles])\n  }\n\n  const core = relatedXmlPart(\n    index,\n    relationships(utf8Text(index.find('_rels/.rels')?.bytes)),\n    '',\n    relationship => relationship.type !== undefined && corePropertiesTypes.has(relationship.type),\n    'docProps/core.xml'\n  )\n\n  const archive = {\n    '[Content_Types].xml': strToU8(\n      contentTypesXml([[workbookPartPath, contentType.workbook], ...overrides])\n    ),\n    '_rels/.rels': strToU8(\n      relationshipsXml([\n        ['rId1', `${officeDocumentRelationshipsNamespace}/officeDocument`, workbookPartPath]\n      ])\n    ),\n    [workbookPartPath]: strToU8(workbookXml(model)),\n    'xl/_rels/workbook.xml.rels': strToU8(relationshipsXml(sheetRelationships)),\n    ...files\n  }\n\n  return {\n    archive: zipSync(archive, { level: 0 }),\n    names: Object.keys(archive),\n    sheets,\n    title: coreTitle(core?.bytes)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,MAAM,oCAAoC;AAE1C,MAAM,sBAAsB,IAAI,IAAI,CAClC,yFACA,8FACF,CAAC;;AAGD,MAAM,WAAW,cAA4B,SAC3C,aAAa,SAAS,uEAA2C,UACjE,aAAa,SAAS,GAAG,kCAAkC,GAAG;;AAGhE,MAAa,oBAAoB;CAC/B;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,qBAAqB;AAE3B,MAAM,iBAAsC,IAAI,IAAI,iBAAiB;;AAGrE,MAAa,sBAAsB,SACjC,eAAe,IAAI,IAAI,KAAK,mBAAmB,KAAK,IAAI;AAE1D,MAAM,cAAc;CAClB,UAAU;CACV,WAAW;CACX,eAAe;CACf,QAAQ;AACV;AAEA,MAAM,mBAAmB,cACvB,GAAG,iBAAiB,wOAAwO,UACzP,KAAK,CAAC,MAAM,UAAU,wBAAwB,KAAK,iBAAiB,KAAK,IAAI,EAC7E,KAAK,EAAE,EAAE;AAEd,MAAM,oBAAoB,YACxB,GAAG,iBAAiB,sFAAsF,QACvG,KAAK,CAAC,IAAI,MAAM,YAAY,qBAAqB,GAAG,UAAU,KAAK,YAAY,OAAO,IAAI,EAC1F,KAAK,EAAE,EAAE;;AAGd,MAAM,WAAW,OAAkB,SAA6B;CAC9D,MAAM,OAAO,SAAS,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,IAAI;CAE7D,OAAO,SAAS,KAAA,KAAa,KAAK,KAAK,YAAY,EAAE,SAAS,MAAM,IAAI,OAAO,KAAA;AACjF;;AAGA,MAAM,kBACJ,OACA,SACA,eACA,SACA,qBACG;CACH,KAAK,MAAM,gBAAgB,QAAQ,OAAO,GACxC,IAAI,CAAC,aAAa,YAAY,QAAQ,YAAY,GAChD,OAAO,QAAQ,OAAO,gBAAgB,eAAe,aAAa,MAAM,CAAC;CAG7E,OAAO,QAAQ,OAAO,gBAAgB;AACxC;AAEA,MAAM,kBACJ,IAAI,oBAAoB;CAAE,QAAQ;CAAQ,SAAS;AAA8B,CAAC;AAEpF,MAAM,sBACJ,IAAI,oBAAoB;CACtB,QAAQ;CACR,SACE;AACJ,CAAC;;AAGH,MAAM,gBAAgB,UAAsB;CAC1C,IAAI,sBAAsB,KAAK,GAAG,MAAM,cAAc;CAEtD,OAAO;AACT;;;;;;;;;;;AA8BA,MAAa,qBACX,OACA,cACiB;CACjB,MAAM,QAAQ,WAAW,KAAK;CAC9B,MAAM,WAAW,MAAM,KAAK,gBAAgB;CAE5C,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,oBAAoB;EAAE,QAAQ;EAAQ,SAAS;CAA0B,CAAC;CAEtF,MAAM,oBAAoB,YAAY,gBAAgB;CAEtD,MAAM,wBAAwB,cAC5B,SAAS,MAAM,KAAK,qBAAqB,gBAAgB,CAAC,GAAG,KAAK,CACpE;CAEA,MAAM,QAAQ,kBAAkB,SAAS,OAAO,SAAS;CACzD,MAAM,QAAoC,OAAO,OAAO,IAAI;CAC5D,MAAM,YAA8C,CAAC;CACrD,MAAM,qBAA+D,CAAC;CACtE,MAAM,SAAmC,CAAC;CAC1C,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,CAAC,UAAU,UAAU,MAAM,OAAO,QAAQ,GAAG;EACtD,MAAM,OAAO,mBAAmB,WAAW,EAAE;EAE7C,mBAAmB,KAAK;GACtB,MAAM,WAAW;GACjB,GAAG,qCAAqC;GACxC;EACF,CAAC;EAED,MAAM,eACJ,MAAM,mBAAmB,KAAA,IACrB,KAAA,IACA,sBAAsB,IAAI,MAAM,cAAc;EAEpD,MAAM,OACJ,iBAAiB,KAAA,KAAa,aAAa,YAAY,CAAC,QAAQ,cAAc,WAAW,IACrF,KAAA,IACA,QAAQ,OAAO,gBAAgB,mBAAmB,aAAa,MAAM,CAAC;EAE5E,IAAI,SAAS,KAAA,GAAW;GACtB,OAAO,KAAK;IAAE,MAAM,MAAM;IAAM,MAAM,KAAA;GAAU,CAAC;GACjD;EACF;EAGA,IAAI,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM,UAAU;EAE7C,SAAS,IAAI,KAAK,IAAI;EACtB,MAAM,MAAM,UAAU,aAAa,KAAK,KAAK;EAC7C,UAAU,KAAK,CAAC,MAAM,QAAQ,YAAY,SAAS,CAAC;EACpD,OAAO,KAAK;GAAE,MAAM,MAAM;GAAM,MAAM,KAAK;EAAK,CAAC;CACnD;CAEA,MAAM,gBAAgB,eACpB,OACA,uBACA,oBACA,iBAAgB,QAAQ,cAAc,eAAe,GACrD,sBACF;CAEA,IAAI,kBAAkB,KAAA,GAAW;EAC/B,MAAM,0BAA0B,aAAa,cAAc,KAAK;EAChE,UAAU,KAAK,CAAC,wBAAwB,YAAY,aAAa,CAAC;CACpE;CAEA,MAAM,SAAS,eACb,OACA,uBACA,oBACA,iBAAgB,QAAQ,cAAc,QAAQ,GAC9C,eACF;CAEA,IAAI,WAAW,KAAA,GAAW;EACxB,MAAM,mBAAmB,QAAQ,UAAU,WAAW,OAAO,KAAK,CAAC,CAAC;EACpE,UAAU,KAAK,CAAC,iBAAiB,YAAY,MAAM,CAAC;CACtD;CAEA,MAAM,OAAO,eACX,OACA,cAAc,SAAS,MAAM,KAAK,aAAa,GAAG,KAAK,CAAC,GACxD,KACA,iBAAgB,aAAa,SAAS,KAAA,KAAa,oBAAoB,IAAI,aAAa,IAAI,GAC5F,mBACF;CAEA,MAAM,UAAU;EACd,uBAAuB,QACrB,gBAAgB,CAAC,CAAC,kBAAkB,YAAY,QAAQ,GAAG,GAAG,SAAS,CAAC,CAC1E;EACA,eAAe,QACb,iBAAiB,CACf;GAAC;GAAQ,GAAG,qCAAqC;GAAkB;EAAgB,CACrF,CAAC,CACH;GACC,mBAAmB,QAAQ,YAAY,KAAK,CAAC;EAC9C,8BAA8B,QAAQ,iBAAiB,kBAAkB,CAAC;EAC1E,GAAG;CACL;CAEA,OAAO;EACL,SAAS,QAAQ,SAAS,EAAE,OAAO,EAAE,CAAC;EACtC,OAAO,OAAO,KAAK,OAAO;EAC1B;EACA,OAAO,UAAU,MAAM,KAAK;CAC9B;AACF"}

package/dist/node/xlsx-styles.d.mts

@@ -0,0 +1,37 @@
+//#region src/node/xlsx-styles.d.ts
+/**
+ * `xl/styles.xml` is never handed to SheetJS as uploaded. With `cellText: true`, SheetJS formats
+ * every styled cell by re-parsing its number format (`SSF_format`, work proportional to the
+ * format's length, a quoted literal built one character at a time), so one huge format reused by
+ * many cells amplifies before any budget runs. The extractor writes a minimal stylesheet with
+ * only what display text needs: custom number formats (`numFmtId`, `formatCode`) of at most
+ * `maxNumberFormatCharacters`, and one `<xf numFmtId>` per source cell format, in order, so cell
+ * `s` indexes keep their meaning. Fonts, fills, borders, cell styles, and dxfs are left out:
+ * SheetJS parses fonts, fills, and borders whatever the options but uses them only with
+ * `cellStyles`, so leaving them out also removes their parsers from the input.
+ */
+/** Excel's own limit on a number format code, counted after unescaping. */
+declare const maxNumberFormatCharacters = 255;
+/** Custom number formats kept; later ones are dropped (their cells show General). */
+declare const maxCustomNumberFormats = 1000;
+/** Excel's limit on cell formats (`cellXfs`); later ones are dropped (General). */
+declare const maxCellFormats = 64000;
+type StylesSummary = {
+  /** Custom number formats in document order, as `[numFmtId, formatCode]`. */readonly numberFormats: ReadonlyArray<readonly [number, string]>; /** The `numFmtId` of each cell format in order, or `undefined` without a `cellXfs` element. */
+  readonly cellFormats: ReadonlyArray<number> | undefined;
+};
+/**
+ * Read the number formats and cell formats SheetJS would read from a stylesheet (same comment and
+ * doctype removal, same regions, same tag grammar), bounded by the caps above. A format longer
+ * than `maxNumberFormatCharacters` after unescaping, holding CDATA, or with an invalid id is
+ * dropped; a cell format without a valid `numFmtId` becomes General (0).
+ */
+declare const readStyles: (content: Uint8Array) => StylesSummary;
+/** The generated stylesheet SheetJS reads instead of the uploaded one. */
+declare const stylesXml: ({
+  numberFormats,
+  cellFormats
+}: StylesSummary) => string;
+//#endregion
+export { StylesSummary, maxCellFormats, maxCustomNumberFormats, maxNumberFormatCharacters, readStyles, stylesXml };
+//# sourceMappingURL=xlsx-styles.d.mts.map

package/dist/node/xlsx-styles.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xlsx-styles.d.mts","names":[],"sources":["../../src/node/xlsx-styles.ts"],"mappings":";;AAuBA;;;;AAAsC;AAGtC;;;;AAAmC;AAGnC;AAAA,cANa,yBAAA;;cAGA,sBAAA;AAGc;AAAA,cAAd,cAAA;AAAA,KAyDD,aAAA;uFAED,aAAA,EAAe,aAAA,6BAAf;EAAA,SAEA,WAAA,EAAa,aAAa;AAAA;;;AAAA;AASrC;;;cAAa,UAAA,GAAc,OAAA,EAAS,UAAA,KAAa,aAyChD;;cAGY,SAAA;EAAa,aAAA;EAAA;AAAA,GAAgC,aAAA"}

package/dist/node/xlsx-styles.mjs

@@ -0,0 +1,96 @@
+import { sheetJsAttributeEscape, sheetJsAttributeText, sheetJsTags, sheetJsXmlHeader, spreadsheetMainNamespace, stripSheetJsNamespace } from "./sheetjs-xml.mjs";
+import { Buffer } from "node:buffer";
+//#region src/node/xlsx-styles.ts
+/**
+* `xl/styles.xml` is never handed to SheetJS as uploaded. With `cellText: true`, SheetJS formats
+* every styled cell by re-parsing its number format (`SSF_format`, work proportional to the
+* format's length, a quoted literal built one character at a time), so one huge format reused by
+* many cells amplifies before any budget runs. The extractor writes a minimal stylesheet with
+* only what display text needs: custom number formats (`numFmtId`, `formatCode`) of at most
+* `maxNumberFormatCharacters`, and one `<xf numFmtId>` per source cell format, in order, so cell
+* `s` indexes keep their meaning. Fonts, fills, borders, cell styles, and dxfs are left out:
+* SheetJS parses fonts, fills, and borders whatever the options but uses them only with
+* `cellStyles`, so leaving them out also removes their parsers from the input.
+*/
+/** Excel's own limit on a number format code, counted after unescaping. */
+const maxNumberFormatCharacters = 255;
+/** Custom number formats kept; later ones are dropped (their cells show General). */
+const maxCustomNumberFormats = 1e3;
+/** Excel's limit on cell formats (`cellXfs`); later ones are dropped (General). */
+const maxCellFormats = 64e3;
+/** SheetJS `str_remove_ng(text, '<!--', '-->')`, including its unterminated-comment behavior. */
+const removeComments = (text) => {
+	let start = text.indexOf("<!--");
+	if (start === -1) return text;
+	const output = [];
+	let last = 0;
+	while (start > -1) {
+		output.push(text.slice(last, start));
+		const end = text.indexOf("-->", start + 4);
+		if (end === -1) break;
+		last = end + 3;
+		start = text.indexOf("<!--", last);
+		if (start === -1) output.push(text.slice(last));
+	}
+	return output.join("");
+};
+/** SheetJS `remove_doctype`. */
+const removeDoctype = (text) => {
+	const doctype = text.slice(0, 1024).indexOf("<!DOCTYPE");
+	if (doctype === -1) return text;
+	const element = /<\w/.exec(text);
+	return element === null ? text : text.slice(0, doctype) + text.slice(element.index);
+};
+/** SheetJS `str_match_xml_ns`: the first `<tag>` start tag through the next `</tag>` (any prefix). */
+const sheetJsRegion = (text, tag) => {
+	const start = new RegExp(`<(?:\\w+:)?${tag}\\b[^<>]*>`, "g");
+	const end = new RegExp(`</(?:\\w+:)?${tag}>`, "g");
+	const open = start.exec(text);
+	if (open === null) return void 0;
+	end.lastIndex = start.lastIndex;
+	return end.exec(text) === null ? void 0 : text.slice(open.index, end.lastIndex);
+};
+const numberFormatId = (raw) => {
+	const id = Number.parseInt(raw ?? "", 10);
+	return Number.isSafeInteger(id) && id >= 0 ? id : void 0;
+};
+/**
+* Read the number formats and cell formats SheetJS would read from a stylesheet (same comment and
+* doctype removal, same regions, same tag grammar), bounded by the caps above. A format longer
+* than `maxNumberFormatCharacters` after unescaping, holding CDATA, or with an invalid id is
+* dropped; a cell format without a valid `numFmtId` becomes General (0).
+*/
+const readStyles = (content) => {
+	const text = removeDoctype(removeComments(Buffer.from(content.buffer, content.byteOffset, content.byteLength).toString("latin1")));
+	const numberFormats = [];
+	const formatsRegion = sheetJsRegion(text, "numFmts");
+	if (formatsRegion !== void 0) for (const tag of sheetJsTags(formatsRegion)) {
+		if (numberFormats.length >= 1e3) break;
+		if (stripSheetJsNamespace(tag.head) !== "<numFmt") continue;
+		const id = numberFormatId(tag.attributes.get("numFmtId"));
+		const raw = tag.attributes.get("formatCode");
+		const code = raw === void 0 ? void 0 : sheetJsAttributeText(raw);
+		if (id !== void 0 && code !== void 0 && code.length <= 255) numberFormats.push([id, code]);
+	}
+	const cellFormatsRegion = sheetJsRegion(text, "cellXfs");
+	if (cellFormatsRegion === void 0) return {
+		numberFormats,
+		cellFormats: void 0
+	};
+	const cellFormats = [];
+	for (const tag of sheetJsTags(cellFormatsRegion)) {
+		if (cellFormats.length >= 64e3) break;
+		const head = stripSheetJsNamespace(tag.head);
+		if (head === "<xf" || head === "<xf/>" || head === "<xf>") cellFormats.push(numberFormatId(tag.attributes.get("numFmtId")) ?? 0);
+	}
+	return {
+		numberFormats,
+		cellFormats
+	};
+};
+/** The generated stylesheet SheetJS reads instead of the uploaded one. */
+const stylesXml = ({ numberFormats, cellFormats }) => `${sheetJsXmlHeader}<styleSheet xmlns="${spreadsheetMainNamespace}">${numberFormats.length === 0 ? "" : `<numFmts count="${numberFormats.length}">${numberFormats.map(([id, code]) => `<numFmt numFmtId="${id}" formatCode="${sheetJsAttributeEscape(code)}"/>`).join("")}</numFmts>`}${cellFormats === void 0 ? "" : `<cellXfs count="${cellFormats.length}">${cellFormats.map((id) => `<xf numFmtId="${id}"/>`).join("")}</cellXfs>`}</styleSheet>`;
+//#endregion
+export { maxCellFormats, maxCustomNumberFormats, maxNumberFormatCharacters, readStyles, stylesXml };
+
+//# sourceMappingURL=xlsx-styles.mjs.map

package/dist/node/xlsx-styles.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"xlsx-styles.mjs","names":[],"sources":["../../src/node/xlsx-styles.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\nimport {\n  sheetJsAttributeEscape,\n  sheetJsAttributeText,\n  sheetJsTags,\n  sheetJsXmlHeader,\n  spreadsheetMainNamespace,\n  stripSheetJsNamespace\n} from './sheetjs-xml.ts'\n\n/**\n * `xl/styles.xml` is never handed to SheetJS as uploaded. With `cellText: true`, SheetJS formats\n * every styled cell by re-parsing its number format (`SSF_format`, work proportional to the\n * format's length, a quoted literal built one character at a time), so one huge format reused by\n * many cells amplifies before any budget runs. The extractor writes a minimal stylesheet with\n * only what display text needs: custom number formats (`numFmtId`, `formatCode`) of at most\n * `maxNumberFormatCharacters`, and one `<xf numFmtId>` per source cell format, in order, so cell\n * `s` indexes keep their meaning. Fonts, fills, borders, cell styles, and dxfs are left out:\n * SheetJS parses fonts, fills, and borders whatever the options but uses them only with\n * `cellStyles`, so leaving them out also removes their parsers from the input.\n */\n\n/** Excel's own limit on a number format code, counted after unescaping. */\nexport const maxNumberFormatCharacters = 255\n\n/** Custom number formats kept; later ones are dropped (their cells show General). */\nexport const maxCustomNumberFormats = 1000\n\n/** Excel's limit on cell formats (`cellXfs`); later ones are dropped (General). */\nexport const maxCellFormats = 64_000\n\n/** SheetJS `str_remove_ng(text, '<!--', '-->')`, including its unterminated-comment behavior. */\nconst removeComments = (text: string) => {\n  let start = text.indexOf('<!--')\n\n  if (start === -1) return text\n\n  const output: Array<string> = []\n  let last = 0\n\n  while (start > -1) {\n    output.push(text.slice(last, start))\n\n    const end = text.indexOf('-->', start + 4)\n\n    if (end === -1) break\n\n    last = end + 3\n    start = text.indexOf('<!--', last)\n\n    if (start === -1) output.push(text.slice(last))\n  }\n\n  return output.join('')\n}\n\n/** SheetJS `remove_doctype`. */\nconst removeDoctype = (text: string) => {\n  const doctype = text.slice(0, 1024).indexOf('<!DOCTYPE')\n\n  if (doctype === -1) return text\n\n  const element = /<\\w/.exec(text)\n\n  return element === null ? text : text.slice(0, doctype) + text.slice(element.index)\n}\n\n/** SheetJS `str_match_xml_ns`: the first `<tag>` start tag through the next `</tag>` (any prefix). */\nconst sheetJsRegion = (text: string, tag: string) => {\n  const start = new RegExp(`<(?:\\\\w+:)?${tag}\\\\b[^<>]*>`, 'g')\n  const end = new RegExp(`</(?:\\\\w+:)?${tag}>`, 'g')\n  const open = start.exec(text)\n\n  if (open === null) return undefined\n\n  end.lastIndex = start.lastIndex\n\n  return end.exec(text) === null ? undefined : text.slice(open.index, end.lastIndex)\n}\n\nconst numberFormatId = (raw: string | undefined) => {\n  const id = Number.parseInt(raw ?? '', 10)\n\n  return Number.isSafeInteger(id) && id >= 0 ? id : undefined\n}\n\nexport type StylesSummary = {\n  /** Custom number formats in document order, as `[numFmtId, formatCode]`. */\n  readonly numberFormats: ReadonlyArray<readonly [number, string]>\n  /** The `numFmtId` of each cell format in order, or `undefined` without a `cellXfs` element. */\n  readonly cellFormats: ReadonlyArray<number> | undefined\n}\n\n/**\n * Read the number formats and cell formats SheetJS would read from a stylesheet (same comment and\n * doctype removal, same regions, same tag grammar), bounded by the caps above. A format longer\n * than `maxNumberFormatCharacters` after unescaping, holding CDATA, or with an invalid id is\n * dropped; a cell format without a valid `numFmtId` becomes General (0).\n */\nexport const readStyles = (content: Uint8Array): StylesSummary => {\n  const text = removeDoctype(\n    removeComments(\n      Buffer.from(content.buffer, content.byteOffset, content.byteLength).toString('latin1')\n    )\n  )\n\n  const numberFormats: Array<readonly [number, string]> = []\n  const formatsRegion = sheetJsRegion(text, 'numFmts')\n\n  if (formatsRegion !== undefined) {\n    for (const tag of sheetJsTags(formatsRegion)) {\n      if (numberFormats.length >= maxCustomNumberFormats) break\n\n      if (stripSheetJsNamespace(tag.head) !== '<numFmt') continue\n\n      const id = numberFormatId(tag.attributes.get('numFmtId'))\n      const raw = tag.attributes.get('formatCode')\n      const code = raw === undefined ? undefined : sheetJsAttributeText(raw)\n\n      if (id !== undefined && code !== undefined && code.length <= maxNumberFormatCharacters)\n        numberFormats.push([id, code])\n    }\n  }\n\n  const cellFormatsRegion = sheetJsRegion(text, 'cellXfs')\n\n  if (cellFormatsRegion === undefined) return { numberFormats, cellFormats: undefined }\n\n  const cellFormats: Array<number> = []\n\n  for (const tag of sheetJsTags(cellFormatsRegion)) {\n    if (cellFormats.length >= maxCellFormats) break\n\n    const head = stripSheetJsNamespace(tag.head)\n\n    if (head === '<xf' || head === '<xf/>' || head === '<xf>')\n      cellFormats.push(numberFormatId(tag.attributes.get('numFmtId')) ?? 0)\n  }\n\n  return { numberFormats, cellFormats }\n}\n\n/** The generated stylesheet SheetJS reads instead of the uploaded one. */\nexport const stylesXml = ({ numberFormats, cellFormats }: StylesSummary) =>\n  `${sheetJsXmlHeader}<styleSheet xmlns=\"${spreadsheetMainNamespace}\">${\n    numberFormats.length === 0\n      ? ''\n      : `<numFmts count=\"${numberFormats.length}\">${numberFormats\n          .map(\n            ([id, code]) =>\n              `<numFmt numFmtId=\"${id}\" formatCode=\"${sheetJsAttributeEscape(code)}\"/>`\n          )\n          .join('')}</numFmts>`\n  }${\n    cellFormats === undefined\n      ? ''\n      : `<cellXfs count=\"${cellFormats.length}\">${cellFormats\n          .map(id => `<xf numFmtId=\"${id}\"/>`)\n          .join('')}</cellXfs>`\n  }</styleSheet>`\n"],"mappings":";;;;;;;;;;;;;;;AAuBA,MAAa,4BAA4B;;AAGzC,MAAa,yBAAyB;;AAGtC,MAAa,iBAAiB;;AAG9B,MAAM,kBAAkB,SAAiB;CACvC,IAAI,QAAQ,KAAK,QAAQ,MAAM;CAE/B,IAAI,UAAU,IAAI,OAAO;CAEzB,MAAM,SAAwB,CAAC;CAC/B,IAAI,OAAO;CAEX,OAAO,QAAQ,IAAI;EACjB,OAAO,KAAK,KAAK,MAAM,MAAM,KAAK,CAAC;EAEnC,MAAM,MAAM,KAAK,QAAQ,OAAO,QAAQ,CAAC;EAEzC,IAAI,QAAQ,IAAI;EAEhB,OAAO,MAAM;EACb,QAAQ,KAAK,QAAQ,QAAQ,IAAI;EAEjC,IAAI,UAAU,IAAI,OAAO,KAAK,KAAK,MAAM,IAAI,CAAC;CAChD;CAEA,OAAO,OAAO,KAAK,EAAE;AACvB;;AAGA,MAAM,iBAAiB,SAAiB;CACtC,MAAM,UAAU,KAAK,MAAM,GAAG,IAAI,EAAE,QAAQ,WAAW;CAEvD,IAAI,YAAY,IAAI,OAAO;CAE3B,MAAM,UAAU,MAAM,KAAK,IAAI;CAE/B,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,GAAG,OAAO,IAAI,KAAK,MAAM,QAAQ,KAAK;AACpF;;AAGA,MAAM,iBAAiB,MAAc,QAAgB;CACnD,MAAM,QAAQ,IAAI,OAAO,cAAc,IAAI,aAAa,GAAG;CAC3D,MAAM,MAAM,IAAI,OAAO,eAAe,IAAI,IAAI,GAAG;CACjD,MAAM,OAAO,MAAM,KAAK,IAAI;CAE5B,IAAI,SAAS,MAAM,OAAO,KAAA;CAE1B,IAAI,YAAY,MAAM;CAEtB,OAAO,IAAI,KAAK,IAAI,MAAM,OAAO,KAAA,IAAY,KAAK,MAAM,KAAK,OAAO,IAAI,SAAS;AACnF;AAEA,MAAM,kBAAkB,QAA4B;CAClD,MAAM,KAAK,OAAO,SAAS,OAAO,IAAI,EAAE;CAExC,OAAO,OAAO,cAAc,EAAE,KAAK,MAAM,IAAI,KAAK,KAAA;AACpD;;;;;;;AAeA,MAAa,cAAc,YAAuC;CAChE,MAAM,OAAO,cACX,eACE,OAAO,KAAK,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU,EAAE,SAAS,QAAQ,CACvF,CACF;CAEA,MAAM,gBAAkD,CAAC;CACzD,MAAM,gBAAgB,cAAc,MAAM,SAAS;CAEnD,IAAI,kBAAkB,KAAA,GACpB,KAAK,MAAM,OAAO,YAAY,aAAa,GAAG;EAC5C,IAAI,cAAc,UAAA,KAAkC;EAEpD,IAAI,sBAAsB,IAAI,IAAI,MAAM,WAAW;EAEnD,MAAM,KAAK,eAAe,IAAI,WAAW,IAAI,UAAU,CAAC;EACxD,MAAM,MAAM,IAAI,WAAW,IAAI,YAAY;EAC3C,MAAM,OAAO,QAAQ,KAAA,IAAY,KAAA,IAAY,qBAAqB,GAAG;EAErE,IAAI,OAAO,KAAA,KAAa,SAAS,KAAA,KAAa,KAAK,UAAA,KACjD,cAAc,KAAK,CAAC,IAAI,IAAI,CAAC;CACjC;CAGF,MAAM,oBAAoB,cAAc,MAAM,SAAS;CAEvD,IAAI,sBAAsB,KAAA,GAAW,OAAO;EAAE;EAAe,aAAa,KAAA;CAAU;CAEpF,MAAM,cAA6B,CAAC;CAEpC,KAAK,MAAM,OAAO,YAAY,iBAAiB,GAAG;EAChD,IAAI,YAAY,UAAA,MAA0B;EAE1C,MAAM,OAAO,sBAAsB,IAAI,IAAI;EAE3C,IAAI,SAAS,SAAS,SAAS,WAAW,SAAS,QACjD,YAAY,KAAK,eAAe,IAAI,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC;CACxE;CAEA,OAAO;EAAE;EAAe;CAAY;AACtC;;AAGA,MAAa,aAAa,EAAE,eAAe,kBACzC,GAAG,iBAAiB,qBAAqB,yBAAyB,IAChE,cAAc,WAAW,IACrB,KACA,mBAAmB,cAAc,OAAO,IAAI,cACzC,KACE,CAAC,IAAI,UACJ,qBAAqB,GAAG,gBAAgB,uBAAuB,IAAI,EAAE,IACzE,EACC,KAAK,EAAE,EAAE,cAEhB,gBAAgB,KAAA,IACZ,KACA,mBAAmB,YAAY,OAAO,IAAI,YACvC,KAAI,OAAM,iBAAiB,GAAG,IAAI,EAClC,KAAK,EAAE,EAAE,YACjB"}

package/dist/node/xlsx-text.d.mts

@@ -0,0 +1,32 @@
+import { FileExtractorLimits } from "../limits.mjs";
+import { XlsxHyperlinks } from "./xlsx-hyperlinks.mjs";
+
+//#region src/node/xlsx-text.d.ts
+type XlsxTextLimits = Pick<FileExtractorLimits, 'maxXlsxCellVisits' | 'maxXlsxSheets' | 'maxXlsxTextCharacters'>;
+/** The parsed workbook as SheetJS returns it; sheets and cells are read as own properties. */
+type XlsxWorkbook = {
+  readonly SheetNames: ReadonlyArray<string>;
+  readonly Sheets: object;
+};
+type XlsxTextOptions = {
+  readonly hyperlinks?: XlsxHyperlinks; /** Some hyperlinks were never read because the workbook exceeded `maxXlsxHyperlinks`. */
+  readonly hyperlinksTruncated?: boolean;
+};
+/**
+ * Space reserved for the marker whenever a workbook has hyperlinks, so it always fits.
+ * `maxXlsxTextCharacters` must exceed it (`minimumXlsxTextCharacters`).
+ */
+declare const omittedHyperlinksMarkerReserve: number;
+/**
+ * Validate every sheet before touching any cell, then generate bounded CSV incrementally, never
+ * with `sheet_to_csv` (which can walk billions of absent cells or allocate an unbounded quoted
+ * string).
+ *
+ * Existing cells inside an external hyperlink are written as `text <url>`. Plain text is
+ * rendered first, so links only use budget the plain text leaves over: in document order, an
+ * annotation that no longer fits leaves its cell plain and one marker ends the output.
+ */
+declare const extractBoundedXlsxText: (workbook: XlsxWorkbook, limits: XlsxTextLimits, options?: XlsxTextOptions) => string;
+//#endregion
+export { XlsxTextLimits, XlsxTextOptions, XlsxWorkbook, extractBoundedXlsxText, omittedHyperlinksMarkerReserve };
+//# sourceMappingURL=xlsx-text.d.mts.map

package/dist/node/xlsx-text.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xlsx-text.d.mts","names":[],"sources":["../../src/node/xlsx-text.ts"],"mappings":";;;;KAQY,cAAA,GAAiB,IAAI,CAC/B,mBAAA;;KAKU,YAAA;EAAA,SACD,UAAA,EAAY,aAAa;EAAA,SACzB,MAAA;AAAA;AAAA,KAGC,eAAA;EAAA,SACD,UAAA,GAAa,cAAc,EANd;EAAA,SAQb,mBAAA;AAAA;;;;;cAcE,8BAAA;AAjBb;;;;;;;;AAG8B;AAH9B,cAmLa,sBAAA,GACX,QAAA,EAAU,YAAA,EACV,MAAA,EAAQ,cAAA,EACR,OAAA,GAAS,eAAA"}