ooxml-core 1.19.2 → 1.21.0

package/dist/index.cjs

@@ -1383,6 +1383,17 @@ function formatCompactAxisValue(value, formatCode) {
   return value.toFixed(1);
 }
 
+// chart/extent.ts
+function extentOf(values) {
+  let min = Infinity;
+  let max = -Infinity;
+  for (const value of values) {
+    min = Math.min(min, value);
+    max = Math.max(max, value);
+  }
+  return { min, max };
+}
+
 // chart/bubble-radius.ts
 function computeBubbleRadius(sizeVal, maxBubble, medianRadius, options2) {
   const scale = (options2?.bubbleScale ?? 100) / 100;
@@ -1393,7 +1404,7 @@ function computeBubbleRadius(sizeVal, maxBubble, medianRadius, options2) {
   return medianRadius * scale * 0.5 + ratio * medianRadius * scale * 1.5;
 }
 function maxBubbleSize(sizes) {
-  return sizes.length > 0 ? Math.max(1, ...sizes.map(Math.abs)) : 1;
+  return Math.max(1, extentOf(sizes.map(Math.abs)).max);
 }
 function medianBubbleRadius(plotWidth, plotHeight) {
   return Math.min(plotWidth, plotHeight) * 0.04;
@@ -1812,8 +1823,7 @@ function computeHistogramBins(values, options2, format = String) {
     });
   }
   if (regular.length > 0) {
-    const min = Math.min(...regular.map((item) => item.value));
-    const max = Math.max(...regular.map((item) => item.value));
+    const { min, max } = extentOf(regular.map((item) => item.value));
     const requestedSize = options2.binSize && options2.binSize > 0 ? options2.binSize : void 0;
     const requestedCount = options2.binCount && options2.binCount > 0 ? options2.binCount : void 0;
     const start = requestedSize ? Math.floor(min / requestedSize) * requestedSize : min;
@@ -2029,8 +2039,9 @@ function fitChartTrendline(options2, xVals, yVals) {
   }
   const model = fitModel(options2, xVals, yVals);
   if (!model) return noFit();
-  const startX = Math.min(...xVals) - (options2.backward ?? 0);
-  const endX = Math.max(...xVals) + (options2.forward ?? 0);
+  const xRange = extentOf(xVals);
+  const startX = xRange.min - (options2.backward ?? 0);
+  const endX = xRange.max + (options2.forward ?? 0);
   const steps = Math.max(Math.ceil((endX - startX) * 4), 20);
   const points = [];
   for (let step = 0; step <= steps; step++) {
@@ -2209,6 +2220,7 @@ __export(xml_exports, {
   DEFAULT_XML_LIMITS: () => DEFAULT_XML_LIMITS,
   LiteElement: () => LiteElement,
   NS: () => NS,
+  XmlLimitError: () => XmlLimitError,
   attr: () => attr,
   buildXml: () => buildXml,
   checkXmlLimits: () => checkXmlLimits,
@@ -2297,6 +2309,19 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
+var XmlLimitError = class extends Error {
+  code = "xml-limit";
+  /** The limit that was exceeded. */
+  limit;
+  /** Its value: the largest depth or element count allowed. */
+  maximum;
+  constructor(message, limit, maximum) {
+    super(message);
+    this.name = "XmlLimitError";
+    this.limit = limit;
+    this.maximum = maximum;
+  }
+};
 var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
 var MARKUP_SKIPS = [
   ["<!--", "-->"],
@@ -2330,11 +2355,22 @@ function checkXmlLimits(xml, label, limits = {}) {
       continue;
     }
     nodes++;
-    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (nodes > maxNodes)
+      throw new XmlLimitError(
+        `${label} XML exceeds the limit of ${maxNodes} elements`,
+        "maxNodes",
+        maxNodes
+      );
     if (!selfClosing && ++depth > maxDepth2)
-      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth2}`);
+      throw new XmlLimitError(
+        `${label} XML exceeds the nesting depth limit of ${maxDepth2}`,
+        "maxDepth",
+        maxDepth2
+      );
   }
 }
+var CRLF_DECLARATION = /^<\?xml[^>]*\?>\r\n/;
+var crlfDeclarations = /* @__PURE__ */ new WeakSet();
 function parseXml(xml, options2 = {}) {
   const label = options2.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
@@ -2356,9 +2392,13 @@ function parseXml(xml, options2 = {}) {
   }
   if (parseError || !parsed.documentElement)
     throw new Error(`Invalid ${label} XML: ${parseError || "missing root element"}`);
+  if (CRLF_DECLARATION.test(xml)) crlfDeclarations.add(parsed);
   return parsed;
 }
-var buildXml = (node) => new xmldom.XMLSerializer().serializeToString(node);
+var buildXml = (node) => {
+  const xml = new xmldom.XMLSerializer().serializeToString(node);
+  return crlfDeclarations.has(node) ? xml.replace(/^(<\?xml[^>]*\?>)\n/, "$1\r\n") : xml;
+};
 var isElement = (node) => node.nodeType === 1;
 var elements = (parent) => Array.from(parent.childNodes).filter(isElement);
 var textContent = (element2) => element2.textContent ?? "";
@@ -2459,6 +2499,12 @@ function parseLiteFragment(xml, container, namespaces) {
     }
     if (lt < 0) break;
     const next = source.charCodeAt(lt + 1);
+    if (next === 33) {
+      const after = skipCommentOrCdata(source, lt, top);
+      if (after < 0) return void 0;
+      pos = after;
+      continue;
+    }
     if (next === 47) {
       const gt = source.indexOf(">", lt);
       if (gt < 0 || stack.length < 2 || source.slice(lt + 2, gt).trimEnd() !== top.tagName)
@@ -2479,6 +2525,25 @@ function parseLiteFragment(xml, container, namespaces) {
   }
   return stack.length === 1 ? root : void 0;
 }
+var DECLARATIONS = /<!DOCTYPE|<!ENTITY/i;
+function skipCommentOrCdata(source, lt, parent) {
+  if (source.startsWith("<!--", lt)) {
+    const end = source.indexOf("-->", lt + 4);
+    if (end < 0) return -1;
+    const body = source.slice(lt + 4, end);
+    if (body.includes("--") || body.endsWith("-") || DECLARATIONS.test(body)) return -1;
+    return end + 3;
+  }
+  if (source.startsWith("<![CDATA[", lt)) {
+    const end = source.indexOf("]]>", lt + 9);
+    if (end < 0) return -1;
+    const text4 = source.slice(lt + 9, end);
+    if (DECLARATIONS.test(text4)) return -1;
+    parent.childNodes.push(text4);
+    return end + 3;
+  }
+  return -1;
+}
 function startTag(source, from, namespaces) {
   const n2 = source.length;
   let i2 = from;
@@ -6980,8 +7045,7 @@ function computeLogValueRange(series, logBase) {
   if (allValues.length === 0) {
     return { min: 1, max: logBase, span: 1, logScale: true, logBase };
   }
-  const dataMin = Math.min(...allValues);
-  const dataMax = Math.max(...allValues);
+  const { min: dataMin, max: dataMax } = extentOf(allValues);
   const logMin = Math.floor(Math.log(dataMin) / Math.log(logBase));
   const logMax = Math.ceil(Math.log(dataMax) / Math.log(logBase));
   const min = logBase ** logMin;
@@ -7596,8 +7660,9 @@ function waterfallView(chart, model, ctx) {
     colors: { increase: role(0), decrease: role(1), total: role(2) }
   };
   const ends = steps.flatMap((step) => [step.startValue, step.endValue]);
+  const range = extentOf(ends);
   model.valueAxis = {
-    ...ends.length ? niceScale(Math.min(...ends), Math.max(...ends)) : niceScale(0, 1),
+    ...ends.length ? niceScale(range.min, range.max) : niceScale(0, 1),
     percent: false
   };
   const labels = model.categories;
@@ -7713,7 +7778,8 @@ function chartSummaryView(chart, theme, options2 = {}) {
       s2.xValues = s2.values.map((_, k) => numeric ? toNumber(cats[k] ?? null) : k + 1);
     });
     const xs = series.flatMap((s2) => s2.xValues ?? []).filter((x) => x !== null);
-    model.xAxis = xs.length ? niceScale(Math.min(...xs), Math.max(...xs)) : niceScale(0, 1);
+    const range = extentOf(xs);
+    model.xAxis = xs.length ? niceScale(range.min, range.max) : niceScale(0, 1);
   }
   if (type === "stock") model.stock = stockView(chart.stock, ctx);
   if (type === "bubble") bubbleView(chart, model, ctx.evaluateRef);
@@ -7745,7 +7811,7 @@ function cartesianAxes(model, area, out) {
   const cats = Math.max(1, model.categories.length);
   const catW = Math.min(
     area.w * 0.3,
-    Math.max(...model.categories.map((c2) => textWidth(c2, categorySize)), 8) + 6
+    Math.max(extentOf(model.categories.map((c2) => textWidth(c2, categorySize))).max, 8) + 6
   );
   const second = horizontal ? void 0 : model.secondaryAxis;
   const secondLabels = second?.ticks.map((t) => axisTickText(t, model.axes?.secondary, second.percent)) ?? [];
@@ -8438,13 +8504,11 @@ function chartLegendSvg(model, area, frame2, options2) {
     chartAreaRect(model, "legend", { x: manual.x, y: manual.y, w: manual.width, h: manual.height })
   ];
   const baselineOffset = font ? (font.ascent - font.descent) / 2 : size * 0.35;
+  const widest = extentOf(widths).max;
   entries.forEach((entry3, i2) => {
     const available = horizontal ? chartTextWidth(entry3.label, attrs, options2) : Math.max(0, rowWidth - size / 2 - keySize - keyGap);
     const label = fitChartText(entry3.label, available, attrs, options2);
-    const contentWidth = Math.min(
-      horizontal ? widths[i2] ?? 0 : Math.max(...widths),
-      rowWidth - size / 2
-    );
+    const contentWidth = Math.min(horizontal ? widths[i2] ?? 0 : widest, rowWidth - size / 2);
     const x = horizontal ? horizontalX : manual.x + Math.max(size / 4, (rowWidth - contentWidth) / 2);
     const centerY = manual.y + (horizontal ? 0 : i2 * rowHeight) + rowHeight / 2;
     markup.push(rect(x, centerY - keySize / 2, keySize, keySize, entry3.color));
@@ -8516,7 +8580,7 @@ function automaticLegend(model, area, out, options2, bounds2) {
   }
   const width = Math.min(
     area.w * 0.35,
-    Math.max(...entries.map((e) => chartTextWidth(e.label, attrs, options2))) + 22
+    extentOf(entries.map((e) => chartTextWidth(e.label, attrs, options2))).max + 22
   );
   const height = entries.length * rowH;
   const x = pos === "l" ? area.x + 4 : area.x + area.w - width;
@@ -33198,10 +33262,13 @@ var DEFAULT_ZIP_LIMITS = {
 var ZipLimitError = class extends Error {
   code = "ZIP_BOMB";
   limit;
+  /** The check that failed (absent when the error was built without one). */
+  kind;
   constructor(message, details) {
     super(message);
     this.name = "ZipLimitError";
     this.limit = details.limit;
+    this.kind = details.kind;
   }
 };
 var mib = (bytes) => Math.round(bytes / 1048576);
@@ -33224,7 +33291,7 @@ function resolveLimits(limits) {
     maxEntryBytes: limits.maxEntryBytes ?? DEFAULT_ZIP_LIMITS.maxEntryBytes,
     maxTotalBytes: limits.maxTotalBytes ?? DEFAULT_ZIP_LIMITS.maxTotalBytes,
     label: limits.label ?? "ZIP",
-    fail: (message, limit) => create ? create(message, { limit }) : new ZipLimitError(message, { limit })
+    fail: (message, limit, kind) => create ? create(message, { limit, kind }) : new ZipLimitError(message, { limit, kind })
   };
 }
 function inflateEntryGuarded(entry3, alreadyRead, limits) {
@@ -33247,13 +33314,18 @@ function inflateEntryGuarded(entry3, alreadyRead, limits) {
       size += chunk.byteLength;
       if (size > declared || size > r.maxEntryBytes)
         return abort(
-          r.fail(`${r.label} part ${entry3.name} inflates past its declared size`, r.maxEntryBytes)
+          r.fail(
+            `${r.label} part ${entry3.name} inflates past its declared size`,
+            r.maxEntryBytes,
+            size > declared ? "declaredSize" : "maxEntryBytes"
+          )
         );
       if (alreadyRead + size > r.maxTotalBytes)
         return abort(
           r.fail(
             `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-            r.maxTotalBytes
+            r.maxTotalBytes,
+            "maxTotalBytes"
           )
         );
       chunks.push(chunk);
@@ -33286,26 +33358,29 @@ function guardZip(zip, limits = {}) {
   if (entries.length > r.maxEntries)
     throw r.fail(
       `${r.label} package exceeds the ${r.maxEntries.toLocaleString("en-US")} part limit`,
-      r.maxEntries
+      r.maxEntries,
+      "maxEntries"
     );
   let declared = 0;
   for (const entry3 of entries) {
     const original = entry3.unsafeOriginalName;
     if (!isSafePartName(entry3.name) || original !== void 0 && !isSafePartName(original))
-      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries);
+      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries, "partName");
     if (entry3.dir) continue;
     const size = declaredEntrySize(entry3);
     if (size > r.maxEntryBytes)
       throw r.fail(
         `${r.label} part ${entry3.name} exceeds the uncompressed part size limit`,
-        r.maxEntryBytes
+        r.maxEntryBytes,
+        "maxEntryBytes"
       );
     declared += size;
   }
   if (declared > r.maxTotalBytes)
     throw r.fail(
       `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-      r.maxTotalBytes
+      r.maxTotalBytes,
+      "maxTotalBytes"
     );
   const produced = /* @__PURE__ */ new Map();
   let total = 0;
@@ -33343,7 +33418,8 @@ async function openZip(input, limits = {}) {
   if (bytes.byteLength > maxInput)
     throw r.fail(
       `${r.label} package exceeds the ${mib(maxInput)} MiB compressed input limit`,
-      maxInput
+      maxInput,
+      "maxInputBytes"
     );
   return guardZip(await JSZip__default.default.loadAsync(bytes), limits);
 }

package/dist/index.mjs

@@ -1377,6 +1377,17 @@ function formatCompactAxisValue(value, formatCode) {
   return value.toFixed(1);
 }
 
+// chart/extent.ts
+function extentOf(values) {
+  let min = Infinity;
+  let max = -Infinity;
+  for (const value of values) {
+    min = Math.min(min, value);
+    max = Math.max(max, value);
+  }
+  return { min, max };
+}
+
 // chart/bubble-radius.ts
 function computeBubbleRadius(sizeVal, maxBubble, medianRadius, options2) {
   const scale = (options2?.bubbleScale ?? 100) / 100;
@@ -1387,7 +1398,7 @@ function computeBubbleRadius(sizeVal, maxBubble, medianRadius, options2) {
   return medianRadius * scale * 0.5 + ratio * medianRadius * scale * 1.5;
 }
 function maxBubbleSize(sizes) {
-  return sizes.length > 0 ? Math.max(1, ...sizes.map(Math.abs)) : 1;
+  return Math.max(1, extentOf(sizes.map(Math.abs)).max);
 }
 function medianBubbleRadius(plotWidth, plotHeight) {
   return Math.min(plotWidth, plotHeight) * 0.04;
@@ -1806,8 +1817,7 @@ function computeHistogramBins(values, options2, format = String) {
     });
   }
   if (regular.length > 0) {
-    const min = Math.min(...regular.map((item) => item.value));
-    const max = Math.max(...regular.map((item) => item.value));
+    const { min, max } = extentOf(regular.map((item) => item.value));
     const requestedSize = options2.binSize && options2.binSize > 0 ? options2.binSize : void 0;
     const requestedCount = options2.binCount && options2.binCount > 0 ? options2.binCount : void 0;
     const start = requestedSize ? Math.floor(min / requestedSize) * requestedSize : min;
@@ -2023,8 +2033,9 @@ function fitChartTrendline(options2, xVals, yVals) {
   }
   const model = fitModel(options2, xVals, yVals);
   if (!model) return noFit();
-  const startX = Math.min(...xVals) - (options2.backward ?? 0);
-  const endX = Math.max(...xVals) + (options2.forward ?? 0);
+  const xRange = extentOf(xVals);
+  const startX = xRange.min - (options2.backward ?? 0);
+  const endX = xRange.max + (options2.forward ?? 0);
   const steps = Math.max(Math.ceil((endX - startX) * 4), 20);
   const points = [];
   for (let step = 0; step <= steps; step++) {
@@ -2203,6 +2214,7 @@ __export(xml_exports, {
   DEFAULT_XML_LIMITS: () => DEFAULT_XML_LIMITS,
   LiteElement: () => LiteElement,
   NS: () => NS,
+  XmlLimitError: () => XmlLimitError,
   attr: () => attr,
   buildXml: () => buildXml,
   checkXmlLimits: () => checkXmlLimits,
@@ -2291,6 +2303,19 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
+var XmlLimitError = class extends Error {
+  code = "xml-limit";
+  /** The limit that was exceeded. */
+  limit;
+  /** Its value: the largest depth or element count allowed. */
+  maximum;
+  constructor(message, limit, maximum) {
+    super(message);
+    this.name = "XmlLimitError";
+    this.limit = limit;
+    this.maximum = maximum;
+  }
+};
 var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
 var MARKUP_SKIPS = [
   ["<!--", "-->"],
@@ -2324,11 +2349,22 @@ function checkXmlLimits(xml, label, limits = {}) {
       continue;
     }
     nodes++;
-    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (nodes > maxNodes)
+      throw new XmlLimitError(
+        `${label} XML exceeds the limit of ${maxNodes} elements`,
+        "maxNodes",
+        maxNodes
+      );
     if (!selfClosing && ++depth > maxDepth2)
-      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth2}`);
+      throw new XmlLimitError(
+        `${label} XML exceeds the nesting depth limit of ${maxDepth2}`,
+        "maxDepth",
+        maxDepth2
+      );
   }
 }
+var CRLF_DECLARATION = /^<\?xml[^>]*\?>\r\n/;
+var crlfDeclarations = /* @__PURE__ */ new WeakSet();
 function parseXml(xml, options2 = {}) {
   const label = options2.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
@@ -2350,9 +2386,13 @@ function parseXml(xml, options2 = {}) {
   }
   if (parseError || !parsed.documentElement)
     throw new Error(`Invalid ${label} XML: ${parseError || "missing root element"}`);
+  if (CRLF_DECLARATION.test(xml)) crlfDeclarations.add(parsed);
   return parsed;
 }
-var buildXml = (node) => new XMLSerializer().serializeToString(node);
+var buildXml = (node) => {
+  const xml = new XMLSerializer().serializeToString(node);
+  return crlfDeclarations.has(node) ? xml.replace(/^(<\?xml[^>]*\?>)\n/, "$1\r\n") : xml;
+};
 var isElement = (node) => node.nodeType === 1;
 var elements = (parent) => Array.from(parent.childNodes).filter(isElement);
 var textContent = (element2) => element2.textContent ?? "";
@@ -2453,6 +2493,12 @@ function parseLiteFragment(xml, container, namespaces) {
     }
     if (lt < 0) break;
     const next = source.charCodeAt(lt + 1);
+    if (next === 33) {
+      const after = skipCommentOrCdata(source, lt, top);
+      if (after < 0) return void 0;
+      pos = after;
+      continue;
+    }
     if (next === 47) {
       const gt = source.indexOf(">", lt);
       if (gt < 0 || stack.length < 2 || source.slice(lt + 2, gt).trimEnd() !== top.tagName)
@@ -2473,6 +2519,25 @@ function parseLiteFragment(xml, container, namespaces) {
   }
   return stack.length === 1 ? root : void 0;
 }
+var DECLARATIONS = /<!DOCTYPE|<!ENTITY/i;
+function skipCommentOrCdata(source, lt, parent) {
+  if (source.startsWith("<!--", lt)) {
+    const end = source.indexOf("-->", lt + 4);
+    if (end < 0) return -1;
+    const body = source.slice(lt + 4, end);
+    if (body.includes("--") || body.endsWith("-") || DECLARATIONS.test(body)) return -1;
+    return end + 3;
+  }
+  if (source.startsWith("<![CDATA[", lt)) {
+    const end = source.indexOf("]]>", lt + 9);
+    if (end < 0) return -1;
+    const text4 = source.slice(lt + 9, end);
+    if (DECLARATIONS.test(text4)) return -1;
+    parent.childNodes.push(text4);
+    return end + 3;
+  }
+  return -1;
+}
 function startTag(source, from, namespaces) {
   const n2 = source.length;
   let i2 = from;
@@ -6974,8 +7039,7 @@ function computeLogValueRange(series, logBase) {
   if (allValues.length === 0) {
     return { min: 1, max: logBase, span: 1, logScale: true, logBase };
   }
-  const dataMin = Math.min(...allValues);
-  const dataMax = Math.max(...allValues);
+  const { min: dataMin, max: dataMax } = extentOf(allValues);
   const logMin = Math.floor(Math.log(dataMin) / Math.log(logBase));
   const logMax = Math.ceil(Math.log(dataMax) / Math.log(logBase));
   const min = logBase ** logMin;
@@ -7590,8 +7654,9 @@ function waterfallView(chart, model, ctx) {
     colors: { increase: role(0), decrease: role(1), total: role(2) }
   };
   const ends = steps.flatMap((step) => [step.startValue, step.endValue]);
+  const range = extentOf(ends);
   model.valueAxis = {
-    ...ends.length ? niceScale(Math.min(...ends), Math.max(...ends)) : niceScale(0, 1),
+    ...ends.length ? niceScale(range.min, range.max) : niceScale(0, 1),
     percent: false
   };
   const labels = model.categories;
@@ -7707,7 +7772,8 @@ function chartSummaryView(chart, theme, options2 = {}) {
       s2.xValues = s2.values.map((_, k) => numeric ? toNumber(cats[k] ?? null) : k + 1);
     });
     const xs = series.flatMap((s2) => s2.xValues ?? []).filter((x) => x !== null);
-    model.xAxis = xs.length ? niceScale(Math.min(...xs), Math.max(...xs)) : niceScale(0, 1);
+    const range = extentOf(xs);
+    model.xAxis = xs.length ? niceScale(range.min, range.max) : niceScale(0, 1);
   }
   if (type === "stock") model.stock = stockView(chart.stock, ctx);
   if (type === "bubble") bubbleView(chart, model, ctx.evaluateRef);
@@ -7739,7 +7805,7 @@ function cartesianAxes(model, area, out) {
   const cats = Math.max(1, model.categories.length);
   const catW = Math.min(
     area.w * 0.3,
-    Math.max(...model.categories.map((c2) => textWidth(c2, categorySize)), 8) + 6
+    Math.max(extentOf(model.categories.map((c2) => textWidth(c2, categorySize))).max, 8) + 6
   );
   const second = horizontal ? void 0 : model.secondaryAxis;
   const secondLabels = second?.ticks.map((t) => axisTickText(t, model.axes?.secondary, second.percent)) ?? [];
@@ -8432,13 +8498,11 @@ function chartLegendSvg(model, area, frame2, options2) {
     chartAreaRect(model, "legend", { x: manual.x, y: manual.y, w: manual.width, h: manual.height })
   ];
   const baselineOffset = font ? (font.ascent - font.descent) / 2 : size * 0.35;
+  const widest = extentOf(widths).max;
   entries.forEach((entry3, i2) => {
     const available = horizontal ? chartTextWidth(entry3.label, attrs, options2) : Math.max(0, rowWidth - size / 2 - keySize - keyGap);
     const label = fitChartText(entry3.label, available, attrs, options2);
-    const contentWidth = Math.min(
-      horizontal ? widths[i2] ?? 0 : Math.max(...widths),
-      rowWidth - size / 2
-    );
+    const contentWidth = Math.min(horizontal ? widths[i2] ?? 0 : widest, rowWidth - size / 2);
     const x = horizontal ? horizontalX : manual.x + Math.max(size / 4, (rowWidth - contentWidth) / 2);
     const centerY = manual.y + (horizontal ? 0 : i2 * rowHeight) + rowHeight / 2;
     markup.push(rect(x, centerY - keySize / 2, keySize, keySize, entry3.color));
@@ -8510,7 +8574,7 @@ function automaticLegend(model, area, out, options2, bounds2) {
   }
   const width = Math.min(
     area.w * 0.35,
-    Math.max(...entries.map((e) => chartTextWidth(e.label, attrs, options2))) + 22
+    extentOf(entries.map((e) => chartTextWidth(e.label, attrs, options2))).max + 22
   );
   const height = entries.length * rowH;
   const x = pos === "l" ? area.x + 4 : area.x + area.w - width;
@@ -33192,10 +33256,13 @@ var DEFAULT_ZIP_LIMITS = {
 var ZipLimitError = class extends Error {
   code = "ZIP_BOMB";
   limit;
+  /** The check that failed (absent when the error was built without one). */
+  kind;
   constructor(message, details) {
     super(message);
     this.name = "ZipLimitError";
     this.limit = details.limit;
+    this.kind = details.kind;
   }
 };
 var mib = (bytes) => Math.round(bytes / 1048576);
@@ -33218,7 +33285,7 @@ function resolveLimits(limits) {
     maxEntryBytes: limits.maxEntryBytes ?? DEFAULT_ZIP_LIMITS.maxEntryBytes,
     maxTotalBytes: limits.maxTotalBytes ?? DEFAULT_ZIP_LIMITS.maxTotalBytes,
     label: limits.label ?? "ZIP",
-    fail: (message, limit) => create ? create(message, { limit }) : new ZipLimitError(message, { limit })
+    fail: (message, limit, kind) => create ? create(message, { limit, kind }) : new ZipLimitError(message, { limit, kind })
   };
 }
 function inflateEntryGuarded(entry3, alreadyRead, limits) {
@@ -33241,13 +33308,18 @@ function inflateEntryGuarded(entry3, alreadyRead, limits) {
       size += chunk.byteLength;
       if (size > declared || size > r.maxEntryBytes)
         return abort(
-          r.fail(`${r.label} part ${entry3.name} inflates past its declared size`, r.maxEntryBytes)
+          r.fail(
+            `${r.label} part ${entry3.name} inflates past its declared size`,
+            r.maxEntryBytes,
+            size > declared ? "declaredSize" : "maxEntryBytes"
+          )
         );
       if (alreadyRead + size > r.maxTotalBytes)
         return abort(
           r.fail(
             `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-            r.maxTotalBytes
+            r.maxTotalBytes,
+            "maxTotalBytes"
           )
         );
       chunks.push(chunk);
@@ -33280,26 +33352,29 @@ function guardZip(zip, limits = {}) {
   if (entries.length > r.maxEntries)
     throw r.fail(
       `${r.label} package exceeds the ${r.maxEntries.toLocaleString("en-US")} part limit`,
-      r.maxEntries
+      r.maxEntries,
+      "maxEntries"
     );
   let declared = 0;
   for (const entry3 of entries) {
     const original = entry3.unsafeOriginalName;
     if (!isSafePartName(entry3.name) || original !== void 0 && !isSafePartName(original))
-      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries);
+      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries, "partName");
     if (entry3.dir) continue;
     const size = declaredEntrySize(entry3);
     if (size > r.maxEntryBytes)
       throw r.fail(
         `${r.label} part ${entry3.name} exceeds the uncompressed part size limit`,
-        r.maxEntryBytes
+        r.maxEntryBytes,
+        "maxEntryBytes"
       );
     declared += size;
   }
   if (declared > r.maxTotalBytes)
     throw r.fail(
       `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-      r.maxTotalBytes
+      r.maxTotalBytes,
+      "maxTotalBytes"
     );
   const produced = /* @__PURE__ */ new Map();
   let total = 0;
@@ -33337,7 +33412,8 @@ async function openZip(input, limits = {}) {
   if (bytes.byteLength > maxInput)
     throw r.fail(
       `${r.label} package exceeds the ${mib(maxInput)} MiB compressed input limit`,
-      maxInput
+      maxInput,
+      "maxInputBytes"
     );
   return guardZip(await JSZip.loadAsync(bytes), limits);
 }

package/dist/math/index.cjs

@@ -2122,6 +2122,19 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
+var XmlLimitError = class extends Error {
+  code = "xml-limit";
+  /** The limit that was exceeded. */
+  limit;
+  /** Its value: the largest depth or element count allowed. */
+  maximum;
+  constructor(message, limit, maximum) {
+    super(message);
+    this.name = "XmlLimitError";
+    this.limit = limit;
+    this.maximum = maximum;
+  }
+};
 var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
 var MARKUP_SKIPS = [
   ["<!--", "-->"],
@@ -2155,11 +2168,22 @@ function checkXmlLimits(xml, label, limits = {}) {
       continue;
     }
     nodes++;
-    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (nodes > maxNodes)
+      throw new XmlLimitError(
+        `${label} XML exceeds the limit of ${maxNodes} elements`,
+        "maxNodes",
+        maxNodes
+      );
     if (!selfClosing && ++depth > maxDepth)
-      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth}`);
+      throw new XmlLimitError(
+        `${label} XML exceeds the nesting depth limit of ${maxDepth}`,
+        "maxDepth",
+        maxDepth
+      );
   }
 }
+var CRLF_DECLARATION = /^<\?xml[^>]*\?>\r\n/;
+var crlfDeclarations = /* @__PURE__ */ new WeakSet();
 function parseXml(xml, options = {}) {
   const label = options.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
@@ -2181,6 +2205,7 @@ function parseXml(xml, options = {}) {
   }
   if (parseError || !parsed.documentElement)
     throw new Error(`Invalid ${label} XML: ${parseError || "missing root element"}`);
+  if (CRLF_DECLARATION.test(xml)) crlfDeclarations.add(parsed);
   return parsed;
 }
 var isElement = (node) => node.nodeType === 1;