documonster 0.19.0 → 0.20.0

package/dist/esm/modules/excel/core/cell.js

@@ -1280,13 +1280,33 @@ class FormulaValue {
         return this._translatedFormula;
     }
     toCsvString() {
-        return `${this.model.result ?? ""}`;
+        return formulaResultText(this.model.result, true);
     }
     release() { }
     toString() {
-        return this.model.result ? this.model.result.toString() : "";
+        return formulaResultText(this.model.result, false);
     }
 }
+/**
+ * A formula's cached result as text — the same text the result would have as a plain cell value.
+ *
+ * Written out rather than `result ? result.toString() : ""`, which had two bugs: a falsy result (`0`,
+ * `false`) read as no result at all, and an error result is an object, so it read `"[object Object]"`
+ * where a stored error reads its code. A `Date` renders as {@link DateValue} renders one: ISO for CSV,
+ * `Date#toString` otherwise.
+ */
+function formulaResultText(result, csv) {
+    if (result === undefined || result === null) {
+        return "";
+    }
+    if (result instanceof Date) {
+        return csv ? result.toISOString() : result.toString();
+    }
+    if (typeof result === "object") {
+        return result.error;
+    }
+    return String(result);
+}
 class SharedStringValue {
     constructor(cell, value) {
         this.model = { address: cell.address, type: Types.SharedString, value };

package/dist/esm/modules/excel/core/table.js

@@ -1,6 +1,6 @@
-import { cellGetValue, cellSetValue, setFacetShared } from "./cell.js";
+import { cellFormula, cellGetValue, cellResult, cellSetValue, setFacetShared } from "./cell.js";
 import { sharedCellFacet } from "./style-sharing.js";
-import { getRow, getSheetWorkbook, rowGetCell } from "./worksheet-core.js";
+import { findCell, getRow, getSheetWorkbook, rowGetCell } from "./worksheet-core.js";
 import { TableError } from "../errors.js";
 import { colCache } from "../utils/col-cache.js";
 function clearStaleSortState(t) {
@@ -107,6 +107,43 @@ const SUBTOTAL_FUNCTIONS = {
     var: 110,
     sum: 109
 };
+/**
+ * Carry the totals row's cached results from the loaded sheet into a table model — **for a reader only**.
+ *
+ * The results are `<v>` values in the sheet's cells; the table part has nowhere to keep them, and
+ * {@link createTable} rewrites the totals cells from the model. A reader that does not call this loses
+ * every cached total on load.
+ *
+ * It belongs to the load path and nowhere else. A cached value is evidence about the data the *file*
+ * held; a table a caller builds with `Table.add` brings its own rows, and an old result sitting in the
+ * same cell — even under an identical formula — says nothing about them.
+ *
+ * `range` is the table's full extent (header and totals included). Only a result cached under the exact
+ * formula this table writes is taken, and a result the model already carries wins.
+ */
+export function adoptLoadedTotals(worksheet, table, range) {
+    if (table.totalsRow !== true) {
+        return;
+    }
+    const decoded = colCache.decode(range);
+    if (!("dimensions" in decoded)) {
+        return;
+    }
+    const t = { worksheet, table };
+    table.columns.forEach((column, j) => {
+        if (j === 0 || column.totalsRowResult !== undefined) {
+            return;
+        }
+        const cell = findCell(worksheet, decoded.bottom, decoded.left + j);
+        if (!cell) {
+            return;
+        }
+        const result = cellResult(cell);
+        if (result !== undefined && cellFormula(cell) === tableGetFormula(t, column)) {
+            column.totalsRowResult = result;
+        }
+    });
+}
 /** Create a table bound to a worksheet, validating + storing on-sheet if a model is given. */
 export function createTable(worksheet, table) {
     const t = { worksheet, table: table };

package/dist/esm/modules/excel/core/worksheet-core.js

@@ -173,6 +173,45 @@ export function findCell(ws, r, c) {
     const row = ws._rows[address.row - 1];
     return row ? rowFindCell(row, address.col) : undefined;
 }
+/**
+ * The existing cell at a reference, or `undefined` — resolved the way {@link getCell} resolves it, with
+ * the same errors for a malformed reference, but **without creating** anything.
+ *
+ * This is what a public reader resolves through. `getCell` materialises the row and the cell, so a read
+ * through it widened `rowCount`, `<dimension>` and, in a styled row or column, wrote a styled empty cell
+ * into the saved file (see `core/__tests__/read-side-effects.test.ts`).
+ *
+ * Validation matches `getCell` exactly, including its leniency: both decode the reference with
+ * `colCache.getAddress`, and `getCell` validates the *decoded* address only when it has to create a cell
+ * (in `cellCreate`). So this validates only on a miss, and a reference that decodes to an existing cell
+ * is accepted by both — strict validation of the raw string would be a separate, wider change. The hit
+ * path therefore allocates nothing and checks nothing beyond the decode.
+ */
+export function locateCell(ws, r, c) {
+    const decoded = colCache.getAddress(r, c);
+    const cell = ws._rows[decoded.row - 1]?.cells[decoded.col - 1];
+    if (cell === undefined) {
+        colCache.validateAddress(decoded.address);
+    }
+    return cell;
+}
+/**
+ * The fully-qualified address of a reference, validated like {@link getCell} — for a reader that answers
+ * from the address alone (defined names, validation rules, an absent cell's inherited format).
+ */
+export function resolveAddress(ws, r, c) {
+    const decoded = colCache.getAddress(r, c);
+    colCache.validateAddress(decoded.address);
+    return { sheetName: ws._name, address: decoded.address, row: decoded.row, col: decoded.col };
+}
+/**
+ * The number format an empty cell at `(row, col)` would inherit if it were
+ * created — the row's, else the column's — read without creating the row, the
+ * column record or the cell. Mirrors the `numFmt` precedence in `mergeCellStyle`.
+ */
+export function inheritedNumFmt(ws, row, col) {
+    return ws._rows[row - 1]?.style.numFmt || ws._columns[col - 1]?.style.numFmt || undefined;
+}
 export function getCell(ws, r, c) {
     const address = colCache.getAddress(r, c);
     const row = getRow(ws, address.row);

package/dist/esm/modules/excel/core/worksheet-load.js

@@ -3,7 +3,7 @@ import { createDataValidations } from "./data-validations.js";
 import { formCheckboxFromModel } from "./form-control.js";
 import { imageCreate } from "./image.js";
 import { rowCreate } from "./row.js";
-import { createTable, tableSetModel } from "./table.js";
+import { adoptLoadedTotals, createTable, tableSetModel } from "./table.js";
 import { mergeCellsWithoutStyle, setSheetName } from "./worksheet.js";
 import { columnFromModel, getSheetName, getSheetWorkbook, rowSetModel } from "./worksheet-core.js";
 // Type for data validation model - maps address to validation
@@ -69,6 +69,8 @@ export function setSheetModel(ws, value) {
     }
     ws.sheetProtection = value.sheetProtection;
     ws.tables = value.tables.reduce((tables, table) => {
+        // The cells were applied above, so the totals row's cached results are there to carry over.
+        adoptLoadedTotals(ws, table, table.tableRef ?? table.ref);
         const t = createTable(ws, table);
         tableSetModel(t, table);
         tables[table.name] = t;

package/dist/esm/modules/excel/stream/workbook-reader.browser.js

@@ -8,6 +8,7 @@
  * Node.js uses `workbook-reader.ts`, which extends the same base implementation
  * with filesystem-specific features (filename input + temp-file buffering).
  */
+import { FileTooLargeError } from "../../archive/core/errors.js";
 import { createParse } from "#platform/modules/archive/unzip/stream";
 import { ExcelFileError } from "../errors.js";
 import { HyperlinkReader } from "./hyperlink-reader.js";
@@ -72,10 +73,30 @@ import { MetadataXform } from "../xlsx/xform/core/metadata-xform.js";
 import { RelationshipsXform } from "../xlsx/xform/core/relationships-xform.js";
 import { parseXformStream } from "../xlsx/xform/parse-xform.js";
 import { StylesXform } from "../xlsx/xform/style/styles-xform.js";
-import { Readable } from "#platform/modules/stream/index";
+import { Readable, Transform } from "#platform/modules/stream/index";
 import { EventEmitter } from "../../../utils/event-emitter.js";
+import { assertLimitOption } from "../../../utils/limits.js";
 import { decodeOoxmlEscape } from "#platform/utils/utils";
 import { SaxParser, saxStream } from "../../xml/sax.js";
+/**
+ * `entry`'s bytes, failing with `FileTooLargeError` as soon as more than
+ * `limit` arrive — before a hostile part can be held in memory.
+ */
+function boundedPart(entry, limit) {
+    let seen = 0;
+    const bounded = new Transform({
+        transform(chunk, _encoding, callback) {
+            seen += chunk.length;
+            if (seen > limit) {
+                callback(new FileTooLargeError(entry.path, `holds more than ${limit} bytes (maxEntrySize)`));
+                return;
+            }
+            callback(null, chunk);
+        }
+    });
+    entry.on("error", (err) => bounded.destroy(err));
+    return entry.pipe(bounded);
+}
 // ============================================================================
 // Base Class
 // ============================================================================
@@ -99,6 +120,8 @@ export class WorkbookReaderBase extends EventEmitter {
         this.WorksheetReaderClass = WorksheetReaderClass;
         this.HyperlinkReaderClass = HyperlinkReaderClass;
         this._maxBufferedBytes = options.maxBufferedWorksheetBytes ?? 256 * 1024 * 1024;
+        assertLimitOption("maxEntrySize", options.maxEntrySize);
+        this._maxEntrySize = options.maxEntrySize ?? 512 * 1024 * 1024;
         this.options = {
             worksheets: "emit",
             sharedStrings: "cache",
@@ -664,21 +687,21 @@ export class WorkbookReaderBase extends EventEmitter {
                 case OOXML_PATHS.rootRels:
                     break;
                 case OOXML_PATHS.xlWorkbookRels:
-                    await this._parseRels(entry);
+                    await this._parseRels(boundedPart(entry, this._maxEntrySize));
                     break;
                 case OOXML_PATHS.xlWorkbook:
-                    await this._parseWorkbook(entry);
+                    await this._parseWorkbook(boundedPart(entry, this._maxEntrySize));
                     break;
                 case OOXML_PATHS.xlSharedStrings:
-                    for await (const item of this._parseSharedStrings(entry)) {
+                    for await (const item of this._parseSharedStrings(boundedPart(entry, this._maxEntrySize))) {
                         yield { eventType: "shared-strings", value: item };
                     }
                     break;
                 case OOXML_PATHS.xlStyles:
-                    await this._parseStyles(entry);
+                    await this._parseStyles(boundedPart(entry, this._maxEntrySize));
                     break;
                 case OOXML_PATHS.xlMetadata:
-                    await this._parseMetadata(entry);
+                    await this._parseMetadata(boundedPart(entry, this._maxEntrySize));
                     break;
                 // **The binary package's three prerequisite parts.**
                 //
@@ -688,18 +711,18 @@ export class WorkbookReaderBase extends EventEmitter {
                 // problem in both containers, and were already solved here for one of them.
                 default:
                     if (normalizedPath.toLowerCase() === "xl/_rels/workbook.bin.rels") {
-                        await this._parseRels(entry);
+                        await this._parseRels(boundedPart(entry, this._maxEntrySize));
                         continue;
                     }
                     switch (xlsbPartKind(normalizedPath)) {
                         case "workbook":
-                            await this._parseXlsbWorkbook(entry);
+                            await this._parseXlsbWorkbook(boundedPart(entry, this._maxEntrySize));
                             continue;
                         case "sharedStrings":
-                            await this._parseXlsbSharedStrings(entry);
+                            await this._parseXlsbSharedStrings(boundedPart(entry, this._maxEntrySize));
                             continue;
                         case "styles":
-                            await this._parseXlsbStyles(entry);
+                            await this._parseXlsbStyles(boundedPart(entry, this._maxEntrySize));
                             continue;
                         default:
                             break;
@@ -735,7 +758,7 @@ export class WorkbookReaderBase extends EventEmitter {
                     }
                     sheetNo = getWorksheetNoFromWorksheetRelsPath(normalizedPath)?.toString();
                     if (sheetNo) {
-                        yield* this._parseHyperlinks(iterateStream(entry), sheetNo);
+                        yield* this._parseHyperlinks(iterateStream(boundedPart(entry, this._maxEntrySize)), sheetNo);
                         continue;
                     }
                     break;

package/dist/esm/modules/excel/surface/cell.js

@@ -1,6 +1,9 @@
-import { cellAddName, cellAlignment, cellDateKind, cellGetDateParts, cellGetTemporal, cellSetDateParts, cellBorder, cellComment, cellDataValidation, cellDisplayText, cellEffectiveType, cellFill, cellFont, cellFormula, cellFullAddress, cellGetModel, cellOwnStyle, cellGetValue, cellHyperlink, cellIsMerged, cellMaster, cellNames, cellNote, cellNumFmt, cellProtection, cellRemoveAllNames, cellRemoveName, cellResult, cellSetAlignment, cellSetBorder, cellSetComment, cellSetDataValidation, cellSetFill, cellSetFont, cellSetModel, cellSetName, cellSetNames, cellSetNote, cellSetNumFmt, cellSetProtection, cellSetResult, cellSetStyle, cellSetValue, cellText, cellType, cellView } from "../core/cell.js";
+import { cellAddName, cellAlignment, cellDateKind, cellGetDateParts, cellGetTemporal, cellSetDateParts, cellBorder, cellComment, cellDisplayText, cellEffectiveType, cellFill, cellFont, cellFormula, cellGetModel, cellOwnStyle, cellGetValue, cellHyperlink, cellIsMerged, cellMaster, cellNote, cellNumFmt, cellProtection, cellRemoveAllNames, cellRemoveName, cellResult, cellSetAlignment, cellSetBorder, cellSetComment, cellSetDataValidation, cellSetFill, cellSetFont, cellSetModel, cellSetName, cellSetNames, cellSetNote, cellSetNumFmt, cellSetProtection, cellSetResult, cellSetStyle, cellSetValue, cellText, cellType, cellView } from "../core/cell.js";
+import { dataValidationFind } from "../core/data-validations.js";
+import { definedNamesGetNamesEx } from "../core/defined-names.js";
+import { ValueType } from "../core/enums.js";
 import { getCellStyle } from "../core/workbook-core.js";
-import { findCell, getCell, getSheetWorkbook } from "../core/worksheet-core.js";
+import { getCell, getSheetWorkbook, inheritedNumFmt, locateCell, resolveAddress } from "../core/worksheet-core.js";
 import { ExcelError } from "../errors.js";
 /**
  * Resolve the `(ws, addr)` / `(ws, row, col)` reader overload pair.
@@ -14,6 +17,23 @@ import { ExcelError } from "../errors.js";
 function target(ws, addr, col, argc) {
     return argc >= 3 ? getCell(ws, addr, col) : getCell(ws, addr);
 }
+/**
+ * {@link target} for a reader that answers with a value: resolves the same overload pair and fails on the
+ * same malformed references, but never creates the row or the cell — `undefined` when nothing is there,
+ * and the reader answers as for an empty cell.
+ *
+ * A read must not change what the workbook saves — materialising widened `rowCount` and `<dimension>`,
+ * and in a styled row or column wrote a styled empty cell into the file. The style-facet readers are the
+ * deliberate exception: they hand back the live facet object for the caller to edit in place
+ * (`Cell.getStyle(ws, "B2").font = …`), and there is nothing to edit until the cell exists.
+ */
+function peek(ws, addr, col, argc) {
+    return argc >= 3 ? locateCell(ws, addr, col) : locateCell(ws, addr);
+}
+/** The overload pair resolved to an address, for a reader that answers from the address alone. */
+function addressOf(ws, addr, col, argc) {
+    return argc >= 3 ? resolveAddress(ws, addr, col) : resolveAddress(ws, addr);
+}
 /**
  * {@link target}, for a reader that hands a *style facet* back to the caller.
  *
@@ -40,14 +60,16 @@ function targetWithValue(ws, addr, valueOrCol, value, argc) {
         : [getCell(ws, addr), valueOrCol];
 }
 export function getValue(ws, addr, col) {
-    return cellGetValue(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellGetValue(cell) : null;
 }
 export function setValue(ws, addr, valueOrCol, value) {
     const [cell, resolved] = targetWithValue(ws, addr, valueOrCol, value, arguments.length);
     cellSetValue(cell, resolved);
 }
 export function getDateParts(ws, addr, col) {
-    return cellGetDateParts(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellGetDateParts(cell) : undefined;
 }
 export function setDateParts(ws, addr, partsOrCol, partsOrKind, kind) {
     if (typeof partsOrCol === "number") {
@@ -57,30 +79,36 @@ export function setDateParts(ws, addr, partsOrCol, partsOrKind, kind) {
     cellSetDateParts(getCell(ws, addr), partsOrCol, partsOrKind);
 }
 export function getDateKind(ws, addr, col) {
-    return cellDateKind(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellDateKind(cell) : undefined;
 }
 export function getTemporal(ws, addr, colOrKind, kind) {
-    return typeof colOrKind === "number"
-        ? cellGetTemporal(getCell(ws, addr, colOrKind), kind)
-        : cellGetTemporal(getCell(ws, addr), colOrKind);
+    const cell = typeof colOrKind === "number" ? locateCell(ws, addr, colOrKind) : locateCell(ws, addr);
+    return cell ? cellGetTemporal(cell, typeof colOrKind === "number" ? kind : colOrKind) : undefined;
 }
 export function getText(ws, addr, col) {
-    return cellText(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellText(cell) : "";
 }
 export function getDisplayText(ws, addr, col) {
-    return cellDisplayText(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellDisplayText(cell) : "";
 }
 export function getType(ws, addr, col) {
-    return cellType(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellType(cell) : ValueType.Null;
 }
 export function getEffectiveType(ws, addr, col) {
-    return cellEffectiveType(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellEffectiveType(cell) : ValueType.Null;
 }
 export function getFormula(ws, addr, col) {
-    return cellFormula(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellFormula(cell) : undefined;
 }
 export function getResult(ws, addr, col) {
-    return cellResult(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellResult(cell) : undefined;
 }
 export function getStyle(ws, addr, col) {
     return cellOwnStyle(target(ws, addr, col, arguments.length));
@@ -101,23 +129,28 @@ export function applyCellStyle(ws, addr, nameOrCol, name) {
     cellSetStyle(getCell(ws, addr), { styleName });
 }
 export function isMerged(ws, addr, col) {
-    return cellIsMerged(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellIsMerged(cell) : false;
 }
 export function getMergeMaster(ws, addr, col) {
     return cellMaster(target(ws, addr, col, arguments.length));
 }
 export function getHyperlink(ws, addr, col) {
-    return cellHyperlink(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellHyperlink(cell) : undefined;
 }
 export function getNote(ws, addr, col) {
-    return cellNote(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellNote(cell) : undefined;
 }
 export function setNote(ws, addr, noteOrCol, note) {
     const [cell, resolved] = targetWithValue(ws, addr, noteOrCol, note, arguments.length);
     cellSetNote(cell, resolved);
 }
 export function getNames(ws, addr, col) {
-    return cellNames(target(ws, addr, col, arguments.length));
+    // Defined names live on the workbook, keyed by address; the cell itself holds none.
+    const address = addressOf(ws, addr, col, arguments.length);
+    return definedNamesGetNamesEx(getSheetWorkbook(ws)._definedNames, address);
 }
 export function addName(ws, addr, nameOrCol, name) {
     const [cell, resolved] = targetWithValue(ws, addr, nameOrCol, name, arguments.length);
@@ -139,7 +172,9 @@ export function removeAllNames(ws, addr, col) {
     cellRemoveAllNames(target(ws, addr, col, arguments.length));
 }
 export function getValidation(ws, addr, col) {
-    return cellDataValidation(target(ws, addr, col, arguments.length));
+    // Validation rules live on the sheet, keyed by address; the cell itself holds none.
+    const address = addressOf(ws, addr, col, arguments.length);
+    return dataValidationFind(ws.dataValidations, address.address);
 }
 export function setValidation(ws, addr, valueOrCol, value) {
     const [cell, resolved] = targetWithValue(ws, addr, valueOrCol, value, arguments.length);
@@ -160,7 +195,12 @@ export function setFont(ws, addr, valueOrCol, value) {
     cellSetFont(cell, resolved);
 }
 export function getNumFmt(ws, addr, col) {
-    return cellNumFmt(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    if (cell) {
+        return cellNumFmt(cell);
+    }
+    const { row, col: column } = addressOf(ws, addr, col, arguments.length);
+    return inheritedNumFmt(ws, row, column);
 }
 export function setNumFmt(ws, addr, valueOrCol, value) {
     const [cell, resolved] = targetWithValue(ws, addr, valueOrCol, value, arguments.length);
@@ -195,7 +235,8 @@ export function setProtection(ws, addr, valueOrCol, value) {
     cellSetProtection(cell, resolved);
 }
 export function getComment(ws, addr, col) {
-    return cellComment(target(ws, addr, col, arguments.length));
+    const cell = peek(ws, addr, col, arguments.length);
+    return cell ? cellComment(cell) : undefined;
 }
 export function setComment(ws, addr, commentOrCol, comment) {
     const [cell, resolved] = targetWithValue(ws, addr, commentOrCol, comment, arguments.length);
@@ -206,7 +247,7 @@ export function setResult(ws, addr, valueOrCol, value) {
     cellSetResult(cell, resolved);
 }
 export function getFullAddress(ws, addr, col) {
-    return cellFullAddress(target(ws, addr, col, arguments.length));
+    return addressOf(ws, addr, col, arguments.length);
 }
 export function find(ws, addr, col) {
     // Same `argc` discipline as `target`: which overload was called is decided by
@@ -215,7 +256,7 @@ export function find(ws, addr, col) {
     // `(ws, "A1", 99)`; a JavaScript caller that gets past them lands on the
     // (row, col) path and resolves some other address, exactly as every other
     // reader in this namespace does.
-    return arguments.length >= 3 ? findCell(ws, addr, col) : findCell(ws, addr);
+    return peek(ws, addr, col, arguments.length);
 }
 /**
  * Read a cell **handle** — the `CellData` handed to `Row.eachCell` /

package/dist/esm/modules/excel/utils/cell-format.js

@@ -1030,8 +1030,9 @@ export function getCellDisplayText(cell, dateFormat) {
         typeof value === "string") {
         return formatCellValue(value, fmt, dateFormat);
     }
-    // Formula type — use the result value
-    if (typeof value === "object" && "formula" in value) {
+    // Formula type — use the result value. A shared-formula clone carries `sharedFormula` and no `formula`,
+    // and is formatted exactly like the cell that defines it.
+    if (typeof value === "object" && ("formula" in value || "sharedFormula" in value)) {
         const result = value.result;
         if (result == null) {
             return "";

package/dist/esm/modules/excel/xlsb/read/package.js

@@ -21,7 +21,7 @@ import { dataValidationAdd } from "../../core/data-validations.js";
 import { definedNamesAdd } from "../../core/defined-names.js";
 import { loadWorkbookModel } from "../../core/model-load.js";
 import { applyPrintName, isPrintName } from "../../core/print-names.js";
-import { createTable, tableSetModel } from "../../core/table.js";
+import { adoptLoadedTotals, createTable, tableSetModel } from "../../core/table.js";
 import { addWorkbookImage, defineCellStyle, getDefinedNames, getWorksheets } from "../../core/workbook-core.js";
 import { addWorksheet, createWorkbook, getWorkbookModel } from "../../core/workbook.browser.js";
 import { addBackgroundImage, mergeCells, getColumn as worksheetColumn, getRow as worksheetRow, setHeaderFooterImage } from "../../core/worksheet.js";
@@ -734,6 +734,8 @@ async function readInto(workbook, bytes, source, options) {
             // the workbook so a second table cannot take it. Assigning the array put an array where a record
             // belonged and `setModel` then threw reading `.name` off an index.
             for (const model of found) {
+                // `ref` is the full range here — the XLSB reader has no separate `tableRef`.
+                adoptLoadedTotals(worksheet, model, model.tableRef ?? model.ref);
                 const handle = createTable(worksheet, model);
                 tableSetModel(handle, model);
                 worksheet.tables[model.name] = handle;

package/dist/esm/modules/excel/xlsx/read/package.js

@@ -98,11 +98,27 @@ export async function readXlsxInto(workbook, data, options) {
     }
     return readXlsxBytesInto(workbook, buffer, options);
 }
+/**
+ * Document-level container defaults. The archive library leaves both bounds
+ * unbounded because what a process can afford is host-dependent; a workbook is
+ * a narrower thing. A part count of 10,000 mirrors the Word reader's
+ * `maxPartCount` and is far above real workbooks (each sheet adds ~2–6 parts:
+ * sheet XML, rels, drawing, comments, table), which reach the low hundreds.
+ * 2 GiB total sits above what Excel itself can open — sheet XML compresses
+ * ~10:1, so this admits a ~200 MB `.xlsx` — while rejecting the many-entries
+ * bombs a per-entry bound alone lets through. Pass `Infinity` to lift either.
+ */
+const XLSX_DEFAULT_MAX_ENTRIES = 10000;
+const XLSX_DEFAULT_MAX_TOTAL_UNCOMPRESSED_SIZE = 2 * 1024 * 1024 * 1024;
 /**
  * Internal: Load from Uint8Array buffer
  */
 export async function readXlsxBytesInto(workbook, buffer, options) {
-    const parser = new ZipParser(buffer);
+    const parser = new ZipParser(buffer, {
+        ...options?.zip,
+        maxEntries: options?.zip?.maxEntries ?? XLSX_DEFAULT_MAX_ENTRIES,
+        maxTotalUncompressedSize: options?.zip?.maxTotalUncompressedSize ?? XLSX_DEFAULT_MAX_TOTAL_UNCOMPRESSED_SIZE
+    });
     const filesMap = await parser.extractAll();
     // Convert Map to Record for readXlsxFilesInto
     const allFiles = {};

package/dist/esm/modules/pdf/builder/document-builder.js

@@ -1382,7 +1382,9 @@ export class PdfDocumentBuilder {
         if (snapshot.metadata.title ||
             snapshot.metadata.author ||
             snapshot.metadata.subject ||
-            snapshot.metadata.creator) {
+            snapshot.metadata.creator ||
+            snapshot.metadata.creationDate ||
+            snapshot.metadata.modDate) {
             writer.addInfoDict(snapshot.metadata);
         }
         // Encryption