ooxml-core 1.19.2 → 1.21.0

package/dist/xlsx/load/index.cjs

@@ -3254,6 +3254,19 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
+var XmlLimitError = class extends Error {
+  code = "xml-limit";
+  /** The limit that was exceeded. */
+  limit;
+  /** Its value: the largest depth or element count allowed. */
+  maximum;
+  constructor(message, limit2, maximum) {
+    super(message);
+    this.name = "XmlLimitError";
+    this.limit = limit2;
+    this.maximum = maximum;
+  }
+};
 var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
 var MARKUP_SKIPS = [
   ["<!--", "-->"],
@@ -3287,11 +3300,22 @@ function checkXmlLimits(xml, label2, limits = {}) {
       continue;
     }
     nodes++;
-    if (nodes > maxNodes) throw new Error(`${label2} XML exceeds the limit of ${maxNodes} elements`);
+    if (nodes > maxNodes)
+      throw new XmlLimitError(
+        `${label2} XML exceeds the limit of ${maxNodes} elements`,
+        "maxNodes",
+        maxNodes
+      );
     if (!selfClosing && ++depth > maxDepth)
-      throw new Error(`${label2} XML exceeds the nesting depth limit of ${maxDepth}`);
+      throw new XmlLimitError(
+        `${label2} XML exceeds the nesting depth limit of ${maxDepth}`,
+        "maxDepth",
+        maxDepth
+      );
   }
 }
+var CRLF_DECLARATION = /^<\?xml[^>]*\?>\r\n/;
+var crlfDeclarations = /* @__PURE__ */ new WeakSet();
 function parseXml(xml, options = {}) {
   const label2 = options.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
@@ -3313,9 +3337,13 @@ function parseXml(xml, options = {}) {
   }
   if (parseError || !parsed.documentElement)
     throw new Error(`Invalid ${label2} XML: ${parseError || "missing root element"}`);
+  if (CRLF_DECLARATION.test(xml)) crlfDeclarations.add(parsed);
   return parsed;
 }
-var buildXml = (node2) => new xmldom.XMLSerializer().serializeToString(node2);
+var buildXml = (node2) => {
+  const xml = new xmldom.XMLSerializer().serializeToString(node2);
+  return crlfDeclarations.has(node2) ? xml.replace(/^(<\?xml[^>]*\?>)\n/, "$1\r\n") : xml;
+};
 var isElement = (node2) => node2.nodeType === 1;
 var elements = (parent) => Array.from(parent.childNodes).filter(isElement);
 function named(element2, local, ns, lenient = true) {
@@ -3641,6 +3669,12 @@ function parseLiteFragment(xml, container2, namespaces) {
     }
     if (lt < 0) break;
     const next = source2.charCodeAt(lt + 1);
+    if (next === 33) {
+      const after = skipCommentOrCdata(source2, lt, top);
+      if (after < 0) return void 0;
+      pos = after;
+      continue;
+    }
     if (next === 47) {
       const gt = source2.indexOf(">", lt);
       if (gt < 0 || stack2.length < 2 || source2.slice(lt + 2, gt).trimEnd() !== top.tagName)
@@ -3661,6 +3695,25 @@ function parseLiteFragment(xml, container2, namespaces) {
   }
   return stack2.length === 1 ? root : void 0;
 }
+var DECLARATIONS = /<!DOCTYPE|<!ENTITY/i;
+function skipCommentOrCdata(source2, lt, parent) {
+  if (source2.startsWith("<!--", lt)) {
+    const end = source2.indexOf("-->", lt + 4);
+    if (end < 0) return -1;
+    const body = source2.slice(lt + 4, end);
+    if (body.includes("--") || body.endsWith("-") || DECLARATIONS.test(body)) return -1;
+    return end + 3;
+  }
+  if (source2.startsWith("<![CDATA[", lt)) {
+    const end = source2.indexOf("]]>", lt + 9);
+    if (end < 0) return -1;
+    const text2 = source2.slice(lt + 9, end);
+    if (DECLARATIONS.test(text2)) return -1;
+    parent.childNodes.push(text2);
+    return end + 3;
+  }
+  return -1;
+}
 function startTag(source2, from, namespaces) {
   const n = source2.length;
   let i2 = from;
@@ -3802,10 +3855,13 @@ var DEFAULT_ZIP_LIMITS = {
 var ZipLimitError = class extends Error {
   code = "ZIP_BOMB";
   limit;
+  /** The check that failed (absent when the error was built without one). */
+  kind;
   constructor(message, details) {
     super(message);
     this.name = "ZipLimitError";
     this.limit = details.limit;
+    this.kind = details.kind;
   }
 };
 var mib = (bytes) => Math.round(bytes / 1048576);
@@ -3828,7 +3884,7 @@ function resolveLimits(limits) {
     maxEntryBytes: limits.maxEntryBytes ?? DEFAULT_ZIP_LIMITS.maxEntryBytes,
     maxTotalBytes: limits.maxTotalBytes ?? DEFAULT_ZIP_LIMITS.maxTotalBytes,
     label: limits.label ?? "ZIP",
-    fail: (message, limit2) => create ? create(message, { limit: limit2 }) : new ZipLimitError(message, { limit: limit2 })
+    fail: (message, limit2, kind) => create ? create(message, { limit: limit2, kind }) : new ZipLimitError(message, { limit: limit2, kind })
   };
 }
 function inflateEntryGuarded(entry3, alreadyRead, limits) {
@@ -3851,13 +3907,18 @@ function inflateEntryGuarded(entry3, alreadyRead, limits) {
       size += chunk.byteLength;
       if (size > declared || size > r.maxEntryBytes)
         return abort(
-          r.fail(`${r.label} part ${entry3.name} inflates past its declared size`, r.maxEntryBytes)
+          r.fail(
+            `${r.label} part ${entry3.name} inflates past its declared size`,
+            r.maxEntryBytes,
+            size > declared ? "declaredSize" : "maxEntryBytes"
+          )
         );
       if (alreadyRead + size > r.maxTotalBytes)
         return abort(
           r.fail(
             `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-            r.maxTotalBytes
+            r.maxTotalBytes,
+            "maxTotalBytes"
           )
         );
       chunks.push(chunk);
@@ -3890,26 +3951,29 @@ function guardZip(zip, limits = {}) {
   if (entries.length > r.maxEntries)
     throw r.fail(
       `${r.label} package exceeds the ${r.maxEntries.toLocaleString("en-US")} part limit`,
-      r.maxEntries
+      r.maxEntries,
+      "maxEntries"
     );
   let declared = 0;
   for (const entry3 of entries) {
     const original = entry3.unsafeOriginalName;
     if (!isSafePartName(entry3.name) || original !== void 0 && !isSafePartName(original))
-      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries);
+      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries, "partName");
     if (entry3.dir) continue;
     const size = declaredEntrySize(entry3);
     if (size > r.maxEntryBytes)
       throw r.fail(
         `${r.label} part ${entry3.name} exceeds the uncompressed part size limit`,
-        r.maxEntryBytes
+        r.maxEntryBytes,
+        "maxEntryBytes"
       );
     declared += size;
   }
   if (declared > r.maxTotalBytes)
     throw r.fail(
       `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-      r.maxTotalBytes
+      r.maxTotalBytes,
+      "maxTotalBytes"
     );
   const produced = /* @__PURE__ */ new Map();
   let total2 = 0;
@@ -5599,6 +5663,9 @@ function formatValue(value2, format, options = {}) {
   if (options.width !== void 0) return fitNumber(value2, format, options);
   return formatNumber(value2, format, options.date1904 ?? false);
 }
+function isDateFormat(format) {
+  return compileFormat(format).isDate;
+}
 
 // xlsx/numfmt/input-date.ts
 var MONTH_NAMES = [
@@ -5821,9 +5888,9 @@ function parseCellInput(text2, options = {}) {
   return parsed.numFmt ? { value: parsed.value, numFmt: parsed.numFmt } : { value: parsed.value };
 }
 
-// xlsx/styles.ts
-function styleKey(style2) {
-  return JSON.stringify(sortKeys(style2));
+// xlsx/stable-key.ts
+function stableKey(value2) {
+  return JSON.stringify(sortKeys(value2));
 }
 function sortKeys(value2) {
   if (Array.isArray(value2)) return value2.map(sortKeys);
@@ -5837,6 +5904,11 @@ function sortKeys(value2) {
   }
   return value2;
 }
+
+// xlsx/styles.ts
+function styleKey(style2) {
+  return stableKey(style2);
+}
 function styleAt(workbook, styleId) {
   const style2 = workbook.styles[styleId ?? 0] ?? workbook.styles[0];
   if (!style2) throw new Error("Workbook has no default cell style");
@@ -9289,10 +9361,72 @@ function mergeComments(legacy, threaded) {
     (a2, b) => a2.address.row - b.address.row || a2.address.col - b.address.col
   );
 }
-var MAX_INPUT_BYTES = 50 * 1024 * 1024;
-var MAX_PARTS = 1e4;
-var MAX_UNCOMPRESSED_BYTES = 300 * 1024 * 1024;
-var MAX_PART_BYTES = 200 * 1024 * 1024;
+
+// xlsx/read/limits.ts
+var DEFAULT_XLSX_LOAD_LIMITS = {
+  maxInputBytes: 50 * 1024 * 1024,
+  maxParts: 1e4,
+  maxPartBytes: 200 * 1024 * 1024,
+  maxTotalBytes: 300 * 1024 * 1024,
+  maxXmlElements: 5e6
+};
+var WorkbookTooLargeError = class extends Error {
+  code = "workbook-too-large";
+  /** The limit that was exceeded, as named in {@link XlsxLoadLimits}. */
+  limit;
+  /** The value of that limit when the load failed. */
+  maximum;
+  constructor(message, limit2, maximum, options) {
+    super(message, options);
+    this.name = "WorkbookTooLargeError";
+    this.limit = limit2;
+    this.maximum = maximum;
+  }
+};
+function isWorkbookTooLargeError(error) {
+  return error instanceof Error && error.code === "workbook-too-large";
+}
+function resolveLoadLimits(limits = {}) {
+  const resolved = { ...DEFAULT_XLSX_LOAD_LIMITS };
+  for (const name of Object.keys(resolved)) {
+    const value2 = limits[name];
+    if (value2 === void 0) continue;
+    if (!Number.isFinite(value2) || value2 <= 0)
+      throw new RangeError(`limits.${name} must be a positive finite number`);
+    resolved[name] = value2;
+  }
+  return resolved;
+}
+var ZIP_LIMIT_NAMES = {
+  maxInputBytes: "maxInputBytes",
+  maxEntries: "maxParts",
+  maxEntryBytes: "maxPartBytes",
+  maxTotalBytes: "maxTotalBytes"
+};
+function zipLimitsFor(limits) {
+  return {
+    maxInputBytes: limits.maxInputBytes,
+    maxEntries: limits.maxParts,
+    maxEntryBytes: limits.maxPartBytes,
+    maxTotalBytes: limits.maxTotalBytes,
+    label: "XLSX",
+    createError: (message, { limit: limit2, kind }) => {
+      const name = ZIP_LIMIT_NAMES[kind];
+      return name ? new WorkbookTooLargeError(message, name, limit2) : new ZipLimitError(message, { limit: limit2, kind });
+    }
+  };
+}
+function parseDataXml(xml, label2, maxXmlElements = DEFAULT_XLSX_LOAD_LIMITS.maxXmlElements) {
+  try {
+    return parseXml(xml, { label: label2, limits: { maxNodes: maxXmlElements } });
+  } catch (error) {
+    if (error instanceof XmlLimitError && error.limit === "maxNodes")
+      throw new WorkbookTooLargeError(error.message, "maxXmlElements", error.maximum, {
+        cause: error
+      });
+    throw error;
+  }
+}
 var CONTENT_TYPES = {
   workbook: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml",
   workbookMacro: "application/vnd.ms-excel.sheet.macroEnabled.main+xml",
@@ -9382,16 +9516,15 @@ var SourceIndex = class {
 };
 var mib2 = (bytes) => Math.round(bytes / 1048576);
 async function readZipParts(input, limits = {}) {
-  const maxInput = limits.maxInputBytes ?? MAX_INPUT_BYTES;
-  const zipLimits = {
-    maxEntries: limits.maxParts ?? MAX_PARTS,
-    maxEntryBytes: limits.maxPartBytes ?? MAX_PART_BYTES,
-    maxTotalBytes: limits.maxTotalBytes ?? MAX_UNCOMPRESSED_BYTES,
-    label: "XLSX"
-  };
+  const resolved = resolveLoadLimits(limits);
+  const maxInput = resolved.maxInputBytes;
   const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
   if (bytes.byteLength > maxInput)
-    throw new Error(`XLSX package exceeds the ${mib2(maxInput)} MiB compressed input limit`);
+    throw new WorkbookTooLargeError(
+      `XLSX package exceeds the ${mib2(maxInput)} MiB compressed input limit`,
+      "maxInputBytes",
+      maxInput
+    );
   let loaded;
   try {
     loaded = await JSZip2__default.default.loadAsync(bytes);
@@ -9401,7 +9534,7 @@ async function readZipParts(input, limits = {}) {
       { cause: error }
     );
   }
-  const zip = guardZip(loaded, zipLimits);
+  const zip = guardZip(loaded, zipLimitsFor(resolved));
   const parts = /* @__PURE__ */ new Map();
   for (const entry3 of Object.values(zip.files)) {
     if (entry3.dir) continue;
@@ -9608,9 +9741,9 @@ function parseRichString(element2, palette) {
   const text2 = parsed.map((run2) => run2.text).join("");
   return { text: text2, runs: parsed };
 }
-function parseSharedStrings(xml, palette) {
+function parseSharedStrings(xml, palette, maxXmlElements) {
   if (!xml) return [];
-  const root = parseXml(xml, { label: "XLSX shared strings" }).documentElement;
+  const root = parseDataXml(xml, "XLSX shared strings", maxXmlElements).documentElement;
   return xChildren(root, "si").map((si) => parseRichString(si, palette));
 }
 
@@ -14002,21 +14135,50 @@ function rootNamespaces(xml) {
   for (const match2 of (root[2] ?? "").matchAll(DECLARATION2)) out[match2[1] ?? ""] = match2[3] ?? "";
   return out;
 }
+var SPECIAL = /<[!?]/g;
+var SECTIONS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
+function blankComments(xml) {
+  if (!xml.includes("<!--") && !xml.includes("<![CDATA[")) return xml;
+  const pieces = [];
+  let copied = 0;
+  SPECIAL.lastIndex = 0;
+  for (let match2 = SPECIAL.exec(xml); match2; match2 = SPECIAL.exec(xml)) {
+    const at = match2.index;
+    const section = SECTIONS.find(([open2]) => xml.startsWith(open2, at));
+    if (!section) return void 0;
+    const [open, close2] = section;
+    const end = xml.indexOf(close2, at + open.length);
+    if (end < 0) return void 0;
+    const after = end + close2.length;
+    if (open !== "<?") {
+      pieces.push(xml.slice(copied, at), " ".repeat(after - at));
+      copied = after;
+    }
+    SPECIAL.lastIndex = after;
+  }
+  pieces.push(xml.slice(copied));
+  return pieces.join("");
+}
 function splitSheetData(xml) {
-  if (xml.includes("<!--") || xml.includes("<![CDATA[")) return void 0;
-  const namespaces = rootNamespaces(xml);
-  const open = OPEN.exec(xml);
+  const plain3 = blankComments(xml);
+  if (plain3 === void 0) return void 0;
+  const namespaces = rootNamespaces(plain3);
+  const open = OPEN.exec(plain3);
   if (!namespaces || !open) return void 0;
   const prefix = (open[1] ?? "").slice(0, -1);
   const ns = namespaces[prefix];
   if (prefix && ns === void 0) return void 0;
   const tagName = `${open[1] ?? ""}sheetData`;
-  const openEnd = xml.indexOf(">", open.index);
+  const openEnd = plain3.indexOf(">", open.index);
   if (openEnd < 0) return void 0;
-  const attributes = xml.slice(open.index + tagName.length + 1, openEnd);
+  const attributes = plain3.slice(open.index + tagName.length + 1, openEnd);
   if (attributes.trimEnd().endsWith("/") || attributes.includes("xmlns")) return void 0;
-  const close2 = xml.indexOf(`</${tagName}`, openEnd);
-  if (close2 < 0 || OPEN.test(xml.slice(openEnd))) return void 0;
+  const close2 = plain3.indexOf(`</${tagName}`, openEnd);
+  if (close2 < 0 || OPEN.test(plain3.slice(openEnd))) return void 0;
   const container2 = new LiteElement(tagName, "sheetData", ns || null);
   const data = parseLiteFragment(xml.slice(openEnd + 1, close2), container2, namespaces);
   if (!data) return void 0;
@@ -14221,7 +14383,11 @@ function parseWorksheet(ctx, partName, name, sheetId) {
     return sheet;
   }
   const split = splitSheetData(xml);
-  const root = parseXml(split?.xml ?? xml, { label: "XLSX worksheet" }).documentElement;
+  const root = parseDataXml(
+    split?.xml ?? xml,
+    "XLSX worksheet",
+    ctx.maxXmlElements
+  ).documentElement;
   const byName = /* @__PURE__ */ new Map();
   const cfBlocks = [];
   for (const node2 of elements(root)) {
@@ -14295,8 +14461,9 @@ function liftPrintAreas(workbook) {
     return false;
   });
 }
-async function loadXlsx(input) {
-  const parts = await readZipParts(input);
+async function loadXlsx(input, options = {}) {
+  const limits = resolveLoadLimits(options.limits);
+  const parts = await readZipParts(input, limits);
   const source2 = new SourceIndex(parts);
   const workbookPart = source2.workbookPart();
   if (!workbookPart) throw new Error("XLSX package has no workbook part (xl/workbook.xml)");
@@ -14317,7 +14484,8 @@ async function loadXlsx(input) {
     source: source2,
     sharedStrings: parseSharedStrings(
       stringsPart ? source2.text(stringsPart) : void 0,
-      styles.palette
+      styles.palette,
+      limits.maxXmlElements
     ),
     xfMap: styles.xfMap,
     date1904: book.date1904,
@@ -14325,7 +14493,8 @@ async function loadXlsx(input) {
     dxfs: styles.dxfs,
     persons: parsePersons(personsPart ? source2.text(personsPart) : void 0),
     dynamicCells: parseDynamicArrayMetadata(metadataPart ? source2.text(metadataPart) : void 0),
-    warn
+    warn,
+    maxXmlElements: limits.maxXmlElements
   };
   const rels = source2.rels(workbookPart);
   const sheets = book.sheets.map((entry3) => {
@@ -16542,6 +16711,52 @@ function finite(value2) {
   return value2;
 }
 
+// xlsx/formula/operators.ts
+function power(base, exponent) {
+  if (base === 0 && exponent === 0) throw new ErrorSignal(ERR.NUM);
+  if (base === 0 && exponent < 0) throw new ErrorSignal(ERR.DIV0);
+  if (base < 0 && !Number.isInteger(exponent)) {
+    const inverse = 1 / exponent;
+    const odd = Math.round(inverse);
+    if (Math.abs(inverse - odd) < 1e-10 && Math.abs(odd) % 2 === 1) {
+      return -Math.pow(-base, exponent);
+    }
+    throw new ErrorSignal(ERR.NUM);
+  }
+  return Math.pow(base, exponent);
+}
+function pick(m, row2, col) {
+  const r = m.rows === 1 ? 0 : row2;
+  const c2 = m.cols === 1 ? 0 : col;
+  if (r >= m.rows || c2 >= m.cols) return ERR.NA;
+  return m.get(r, c2);
+}
+function broadcastShape(operands, at) {
+  let rows = 1;
+  let cols = 1;
+  for (const m of operands) {
+    rows = Math.max(rows, m.rows);
+    cols = Math.max(cols, m.cols);
+  }
+  if (!operands.some((m) => m.isPadded)) return Matrix.build(rows, cols, at);
+  let blockRows = 1;
+  let blockCols = 1;
+  for (const m of operands) {
+    blockRows = Math.max(blockRows, m.isPadded ? m.blockRows : m.rows);
+    blockCols = Math.max(blockCols, m.isPadded ? m.blockCols : m.cols);
+  }
+  blockRows = Math.min(blockRows, rows);
+  blockCols = Math.min(blockCols, cols);
+  const varies = operands.some(
+    (m) => blockRows < rows && m.rows === 1 && m.cols > 1 || blockCols < cols && m.cols === 1 && m.rows > 1
+  );
+  if (varies) return Matrix.build(rows, cols, at);
+  return Matrix.padded(Matrix.build(blockRows, blockCols, at), rows, cols, at(rows - 1, cols - 1));
+}
+
+// xlsx/formula/spill.ts
+var isSpilledCell = (cell) => cell !== void 0 && "spillAnchor" in cell;
+
 // xlsx/formula/functions/wildcard.ts
 var lower = (ch) => (ch ?? "").toLowerCase();
 var fold = (text2) => Array.from({ length: text2.length }, (_, i2) => lower(text2[i2]));
@@ -19826,49 +20041,6 @@ var INFO_FUNCTIONS = [
   )
 ];
 
-// xlsx/formula/operators.ts
-function power(base, exponent) {
-  if (base === 0 && exponent === 0) throw new ErrorSignal(ERR.NUM);
-  if (base === 0 && exponent < 0) throw new ErrorSignal(ERR.DIV0);
-  if (base < 0 && !Number.isInteger(exponent)) {
-    const inverse = 1 / exponent;
-    const odd = Math.round(inverse);
-    if (Math.abs(inverse - odd) < 1e-10 && Math.abs(odd) % 2 === 1) {
-      return -Math.pow(-base, exponent);
-    }
-    throw new ErrorSignal(ERR.NUM);
-  }
-  return Math.pow(base, exponent);
-}
-function pick(m, row2, col) {
-  const r = m.rows === 1 ? 0 : row2;
-  const c2 = m.cols === 1 ? 0 : col;
-  if (r >= m.rows || c2 >= m.cols) return ERR.NA;
-  return m.get(r, c2);
-}
-function broadcastShape(operands, at) {
-  let rows = 1;
-  let cols = 1;
-  for (const m of operands) {
-    rows = Math.max(rows, m.rows);
-    cols = Math.max(cols, m.cols);
-  }
-  if (!operands.some((m) => m.isPadded)) return Matrix.build(rows, cols, at);
-  let blockRows = 1;
-  let blockCols = 1;
-  for (const m of operands) {
-    blockRows = Math.max(blockRows, m.isPadded ? m.blockRows : m.rows);
-    blockCols = Math.max(blockCols, m.isPadded ? m.blockCols : m.cols);
-  }
-  blockRows = Math.min(blockRows, rows);
-  blockCols = Math.min(blockCols, cols);
-  const varies = operands.some(
-    (m) => blockRows < rows && m.rows === 1 && m.cols > 1 || blockCols < cols && m.cols === 1 && m.rows > 1
-  );
-  if (varies) return Matrix.build(rows, cols, at);
-  return Matrix.padded(Matrix.build(blockRows, blockCols, at), rows, cols, at(rows - 1, cols - 1));
-}
-
 // xlsx/formula/functions/lambda.ts
 var C17 = "Logical";
 function lambdaArg(value2) {
@@ -25128,9 +25300,6 @@ var paramKind = (spec2, index3) => {
   return params[Math.min(index3, params.length - 1)] ?? "value";
 };
 
-// xlsx/formula/spill.ts
-var isSpilledCell = (cell) => cell !== void 0 && "spillAnchor" in cell;
-
 // xlsx/formula/move.ts
 var same3 = (a2, b) => a2.toLowerCase() === b.toLowerCase();
 function deleteSheetInFormula(formula, sheetName, tableNames = []) {
@@ -27159,10 +27328,8 @@ function sheetFormatXml(sheet) {
   const current = { defaultRowHeight: sheet.defaultRowHeight };
   if (sheet.defaultColWidth !== void 0) current.defaultColWidth = sheet.defaultColWidth;
   if (sheet.format && Object.keys(sheet.format).length) current.format = sheet.format;
-  const rowLevel = Math.max(
-    0,
-    ...[...sheet.rowInfo.values()].map((info) => info.outlineLevel ?? 0)
-  );
+  let rowLevel = 0;
+  for (const info of sheet.rowInfo.values()) rowLevel = Math.max(rowLevel, info.outlineLevel ?? 0);
   const colLevel = Math.max(0, ...sheet.columns.map((col) => col.outlineLevel ?? 0));
   if (source2 && sameModel(readSheetFormat(source2), current) && Number(source2.getAttribute("outlineLevelRow") ?? 0) === rowLevel && Number(source2.getAttribute("outlineLevelCol") ?? 0) === colLevel)
     return snapshotXml(sheet, "sheetFormatPr") ?? "";
@@ -27464,11 +27631,10 @@ function pivotCacheDefinitionXml(pivot, workbook, data, recordRel) {
     const items = data.items[index3];
     if (pivot.dateFields?.includes(name) && items.every((v) => typeof v === "number")) {
       const serials = items;
-      const latest = Math.max(...serials);
-      const maxDate = Number.isInteger(latest) ? latest + 1 : latest;
+      const range = dateGroupRange({}, serials);
       const parent = derived.filter((entry3) => entry3.group.field === name).at(-1);
       const link = parent ? `<fieldGroup par="${parent.index}"/>` : "";
-      return `<cacheField${attrs({ name: encodeEscapes(name), numFmtId: 14 })}><sharedItems${attrs({ containsSemiMixedTypes: false, containsNonDate: false, containsDate: true, containsString: false, minDate: iso(Math.min(...serials)), maxDate: iso(maxDate), count: serials.length })}>${serials.map((serial) => `<d v="${iso(serial)}"/>`).join("")}</sharedItems>${link}</cacheField>`;
+      return `<cacheField${attrs({ name: encodeEscapes(name), numFmtId: 14 })}><sharedItems${attrs({ containsSemiMixedTypes: false, containsNonDate: false, containsDate: true, containsString: false, minDate: iso(range.start), maxDate: iso(range.end), count: serials.length })}>${serials.map((serial) => `<d v="${iso(serial)}"/>`).join("")}</sharedItems>${link}</cacheField>`;
     }
     const types = new Set(
       items.map((value2) => value2 === null || value2 === "" ? "blank" : typeof value2)
@@ -28339,6 +28505,332 @@ async function saveXlsx(workbook) {
   return writer.build();
 }
 
+// xlsx/load/csv-dates.ts
+var DAY_RE = /^(\d{1,4})([-/. ])(\d{1,4})\2(\d{1,4})$/;
+var COMPACT_RE = /^\d{8}$/;
+var PAIR_RE = /^(\d{1,2})\/(\d{1,2})$/;
+var FRACTION_RE = /\.(\d+)/;
+var TIME_RE3 = /^(\d{1,2}:\d{1,2}(?::\d{1,2}(?:\.\d+)?)?(?:\s*[ap]m?)?)\s*(Z|[+-]\d{2}(?::?\d{2})?)?$/i;
+var SPACE_RE = /\s/;
+var MAX_DATE_TEXT = 64;
+function splitTime(text2) {
+  const colon = text2.indexOf(":");
+  if (colon < 0) return [text2, void 0];
+  let start = colon;
+  while (start > 0 && colon - start < 2) {
+    const code = text2.charCodeAt(start - 1);
+    if (code < 48 || code > 57) break;
+    start--;
+  }
+  const before = text2[start - 1] ?? "";
+  if (start === colon || !before) return void 0;
+  if (before === "T" || before === "t") return [text2.slice(0, start - 1), text2.slice(start)];
+  return SPACE_RE.test(before) ? [text2.slice(0, start).trimEnd(), text2.slice(start)] : void 0;
+}
+function compactParts(text2, order) {
+  const parts = [];
+  let at = 0;
+  for (const kind of order) {
+    const size = kind === "Y" ? 4 : 2;
+    parts.push(text2.slice(at, at + size));
+    at += size;
+  }
+  return parts;
+}
+function pairParts(pair, order) {
+  let next = 0;
+  return [...order].map(
+    (kind) => kind === "Y" ? String((/* @__PURE__ */ new Date()).getFullYear()) : pair[next++] ?? ""
+  );
+}
+function dayParts(text2, order) {
+  const match2 = DAY_RE.exec(text2);
+  if (match2) return [match2[1] ?? "", match2[3] ?? "", match2[4] ?? ""];
+  if (COMPACT_RE.test(text2)) return compactParts(text2, order);
+  const pair = PAIR_RE.exec(text2);
+  return pair ? pairParts([pair[1] ?? "", pair[2] ?? ""], order) : void 0;
+}
+function inOrder(parts, order) {
+  const date = [0, 0, 0];
+  for (let i2 = 0; i2 < 3; i2++) {
+    const part = parts[i2] ?? "";
+    const kind = order[i2];
+    if (kind === "Y") {
+      if (part.length === 3 || part.length > 4) return void 0;
+      date[0] = fullYear(part);
+    } else if (part.length > 2) return void 0;
+    else date[kind === "M" ? 1 : 2] = Number(part);
+  }
+  return date;
+}
+function offsetMinutes(zone) {
+  if (zone === "Z" || zone === "z") return 0;
+  const hours = Number(zone.slice(1, 3));
+  const minutes = zone.length > 3 ? Number(zone.slice(-2)) : 0;
+  if (hours > 23 || minutes > 59) return void 0;
+  return (zone.startsWith("-") ? -1 : 1) * (hours * 60 + minutes);
+}
+function parseOrderedDate(text2, order, date1904, decimal = ".") {
+  if (text2.length > MAX_DATE_TEXT) return void 0;
+  const split = splitTime(text2);
+  if (!split) return void 0;
+  let clock = split[1];
+  if (clock !== void 0 && decimal !== ".")
+    clock = clock.includes(".") ? "" : clock.replace(decimal, ".");
+  const tail = clock === void 0 ? void 0 : TIME_RE3.exec(clock);
+  if (clock !== void 0 && !tail) return void 0;
+  const parts = dayParts(split[0], order);
+  const date = parts && inOrder(parts, order);
+  if (!date) return void 0;
+  const serial = serialOf(date[0], date[1], date[2], date1904);
+  if (serial === void 0) return void 0;
+  if (!tail) return { value: serial, numFmt: "yyyy-mm-dd", zoned: false };
+  const time = parseTime(tail[1] ?? "");
+  if (!time || time.fraction >= 1) return void 0;
+  const zone = tail[2];
+  const offset2 = zone === void 0 ? 0 : offsetMinutes(zone);
+  if (offset2 === void 0) return void 0;
+  const value2 = serial + time.fraction - offset2 / 1440;
+  if (value2 < (date1904 ? 0 : 1)) return void 0;
+  const digits2 = Math.min(3, FRACTION_RE.exec(tail[1] ?? "")?.[1]?.length ?? 0);
+  const format = digits2 ? `h:mm:ss.${"0".repeat(digits2)}` : time.format;
+  return { value: value2, numFmt: `yyyy-mm-dd ${format}`, zoned: zone !== void 0 };
+}
+
+// xlsx/load/csv-separators.ts
+function separatorsOf(decimal = ".", thousands = decimal === "," ? "." : ",") {
+  for (const separator of [decimal, thousands])
+    if (separator.length !== 1 || /[\d+-]/.test(separator))
+      throw new RangeError(`"${separator}" cannot be a decimal or thousands separator.`);
+  if (decimal === thousands)
+    throw new RangeError("The decimal and thousands separators must differ.");
+  return { decimal, thousands };
+}
+function separatorNormalizer({
+  decimal,
+  thousands
+}) {
+  if (decimal === "." && thousands === ",") return void 0;
+  const escape2 = (char) => char.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+  const pattern = new RegExp(`(${escape2(decimal)})|(\\d)${escape2(thousands)}(?=\\d)|[.,]`, "g");
+  const swap = (_, point, digit) => {
+    if (point !== void 0) return ".";
+    if (digit !== void 0) return `${digit},`;
+    return "
";
+  };
+  return (text2) => text2.replace(pattern, swap);
+}
+
+// xlsx/load/csv-traits.ts
+var LEADING_ZEROS = 1;
+var LONG_NUMBER = 2;
+var SCIENTIFIC = 4;
+var LETTER_DATE = 8;
+var TIME_ZONE = 16;
+var DATE_FALLBACK = 32;
+var isDigit4 = (code) => code >= 48 && code <= 57;
+var isLetter2 = (code) => (code | 32) >= 97 && (code | 32) <= 122;
+function numberTraits(text2, decimal, thousands) {
+  let traits = 0;
+  let digits2 = 0;
+  let first2 = true;
+  for (let i2 = 0; i2 < text2.length; i2++) {
+    const code = text2.charCodeAt(i2);
+    if (isDigit4(code)) {
+      if (first2 && code === 48) {
+        const next = text2.charCodeAt(i2 + 1);
+        if (isDigit4(next) || next === thousands && isDigit4(text2.charCodeAt(i2 + 2)))
+          traits |= LEADING_ZEROS;
+      }
+      first2 = false;
+      if (digits2 > 0 || code !== 48) digits2++;
+    } else if (code === decimal) first2 = false;
+    else if (code === 69 || code === 101) {
+      traits |= SCIENTIFIC;
+      break;
+    }
+  }
+  return digits2 > 15 ? traits | LONG_NUMBER : traits;
+}
+function significantDigits(text2) {
+  let digits2 = "";
+  for (const char of text2) {
+    if (char === "e" || char === "E") break;
+    if (char >= "0" && char <= "9" && (digits2 !== "" || char !== "0")) digits2 += char;
+  }
+  let end = digits2.length;
+  while (end > 0 && digits2[end - 1] === "0") end--;
+  return digits2.slice(0, end);
+}
+var keepsDigits = (field, value2) => significantDigits(field) === significantDigits(String(Math.abs(value2)));
+function dateTraits(field) {
+  const text2 = field.trimStart();
+  let i2 = 0;
+  while (isLetter2(text2.charCodeAt(i2))) i2++;
+  return i2 > 0 && isDigit4(text2.charCodeAt(i2)) ? LETTER_DATE : 0;
+}
+
+// xlsx/load/csv-import.ts
+var KINDS2 = [
+  {
+    conversion: "leadingZeros",
+    one: "value lost its leading zeros when converted to a number",
+    many: "values lost their leading zeros when converted to numbers"
+  },
+  {
+    conversion: "longNumbers",
+    one: "value with more than 15 digits lost digits when converted to a number",
+    many: "values with more than 15 digits lost digits when converted to numbers"
+  },
+  {
+    conversion: "scientific",
+    one: "value with the letter E lost digits when converted to a number",
+    many: "values with the letter E lost digits when converted to numbers"
+  },
+  {
+    conversion: "letterDates",
+    one: "value of letters and digits such as JAN1 was converted to a date",
+    many: "values of letters and digits such as JAN1 were converted to dates"
+  },
+  {
+    conversion: void 0,
+    one: "date-time with a time zone was converted to UTC",
+    many: "date-times with a time zone were converted to UTC"
+  },
+  {
+    conversion: void 0,
+    one: "value could not be read as a date in {order} order and was read as General",
+    many: "values could not be read as dates in {order} order and were read as General"
+  }
+];
+var FORMATS = /* @__PURE__ */ new Set(["general", "text", "skip", "MDY", "DMY", "YMD", "MYD", "DYM", "YDM"]);
+var DAY_FIRST = /* @__PURE__ */ new Set(["DMY", "DYM", "YDM"]);
+var MONTH_FIRST_RE = /^\d{1,2}[-/]\d{1,2}(?:[-/]\d{1,4})?(?:$|[\sT])/;
+var FRACTION_FORMATS = /* @__PURE__ */ new Set(["# ?/?", "# ??/??"]);
+var EN_US_SEPARATORS_RE = /[.,]/;
+var SIGNED_RE = /^\s*(?:[$€£]\s*)?[-+(]/;
+function columnFormats(columns) {
+  const formats = [];
+  for (const [key, format] of Object.entries(columns ?? {})) {
+    const col = Number(key);
+    if (!Number.isInteger(col) || col < 0 || col > MAX_COL)
+      throw new RangeError(`CSV column ${key} is not a zero-based column index.`);
+    if (!FORMATS.has(format))
+      throw new RangeError(`Unknown CSV column format "${String(format)}" for column ${col}.`);
+    formats[col] = format;
+  }
+  return formats;
+}
+function createFieldReader(options, date1904) {
+  const formats = columnFormats(options.columns);
+  const targets = [];
+  let skipped = 0;
+  for (let col = 0; col < formats.length; col++) {
+    if (formats[col] === "skip") {
+      targets.push(-1);
+      skipped++;
+    } else targets.push(col - skipped);
+  }
+  const target = (col) => col < targets.length ? targets[col] ?? -1 : col - skipped;
+  let keepText = 0;
+  KINDS2.forEach(({ conversion }, kind) => {
+    if (conversion && options.conversions?.[conversion] === false) keepText |= 1 << kind;
+  });
+  const separators = separatorsOf(options.decimalSeparator, options.thousandsSeparator);
+  const normalize = separatorNormalizer(separators);
+  const decimal = separators.decimal.charCodeAt(0);
+  const thousands = separators.thousands.charCodeAt(0);
+  const { formulas = false, trailingMinus = false } = options;
+  const counts = [];
+  const firstRows = [];
+  const report = (traits, row2, col) => {
+    if (options.reportConversions === false) return;
+    for (let kind = 0; kind < KINDS2.length; kind++) {
+      if (!(traits & 1 << kind)) continue;
+      const key = col * KINDS2.length + kind;
+      const count2 = counts[key];
+      if (count2 === void 0) firstRows[key] = row2;
+      counts[key] = (count2 ?? 0) + 1;
+    }
+  };
+  const dateFormats = /* @__PURE__ */ new Map();
+  const isDate = (numFmt) => {
+    if (numFmt === void 0) return false;
+    let known = dateFormats.get(numFmt);
+    if (known === void 0) {
+      known = isDateFormat(numFmt);
+      dateFormats.set(numFmt, known);
+    }
+    return known;
+  };
+  const isNumber = (parsed) => typeof parsed.value === "number" && parsed.formula === void 0 && !isDate(parsed.numFmt);
+  const localized = (text2, normalized) => {
+    const parsed = parseCellInput(normalized);
+    if (normalized === text2 || isNumber(parsed)) return parsed;
+    const plain3 = parseCellInput(text2);
+    if (isNumber(plain3) && EN_US_SEPARATORS_RE.test(text2)) return { value: text2 };
+    const dated = typeof parsed.value === "number" && parsed.formula === void 0;
+    return dated && typeof plain3.value === "string" ? parsed : plain3;
+  };
+  const type = normalize ? (text2) => localized(text2, normalize(text2)) : (text2) => parseCellInput(text2);
+  const negative = (field) => {
+    const text2 = field.trimEnd();
+    if (text2.length < 2 || !text2.endsWith("-")) return void 0;
+    const body = text2.slice(0, -1);
+    if (SIGNED_RE.test(body)) return void 0;
+    const parsed = type(body);
+    if (!isNumber(parsed)) return void 0;
+    return { ...parsed, value: parsed.value === 0 ? 0 : -parsed.value };
+  };
+  const general = (field, row2, col) => {
+    if (!formulas && field.startsWith("=")) return { value: field };
+    const parsed = (trailingMinus ? negative(field) : void 0) ?? type(field);
+    if (typeof parsed.value !== "number" || parsed.formula !== void 0) return parsed;
+    const grouping = FRACTION_FORMATS.has(parsed.numFmt ?? "") ? -1 : thousands;
+    const traits = isDate(parsed.numFmt) ? dateTraits(field) : numberTraits(field, decimal, grouping);
+    if (traits === 0) return parsed;
+    if (traits & keepText) return { value: field };
+    let lost = traits;
+    if (traits & (LONG_NUMBER | SCIENTIFIC)) {
+      if (keepsDigits(field, parsed.value)) lost &= -7;
+      else if (traits & LONG_NUMBER) lost &= ~SCIENTIFIC;
+    }
+    if (lost) report(lost, row2, col);
+    return parsed;
+  };
+  return {
+    target,
+    read(field, row2, col) {
+      const format = col < formats.length ? formats[col] : void 0;
+      if (format === void 0 || format === "general") return general(field, row2, col);
+      if (format === "text") return { value: field, numFmt: "@" };
+      if (format === "skip") return { value: null };
+      const date = parseOrderedDate(field.trim(), format, date1904, separators.decimal);
+      if (!date) {
+        const parsed = general(field, row2, col);
+        const dated = typeof parsed.value === "number" && isDate(parsed.numFmt);
+        if (dated && DAY_FIRST.has(format) && MONTH_FIRST_RE.test(field.trim()))
+          report(DATE_FALLBACK, row2, col);
+        return parsed;
+      }
+      if (date.zoned) report(TIME_ZONE, row2, col);
+      return { value: date.value, numFmt: date.numFmt };
+    },
+    warnings() {
+      const warnings = [];
+      counts.forEach((count2, key) => {
+        const kind = KINDS2[key % KINDS2.length];
+        const col = Math.floor(key / KINDS2.length);
+        const label2 = columnLabel(target(col));
+        const what = (count2 === 1 ? kind?.one : kind?.many)?.replace("{order}", formats[col] ?? "");
+        const row2 = (firstRows[key] ?? 0) + 1;
+        warnings.push(`Column ${label2}: ${count2} ${what} (first: ${label2}${row2}).`);
+      });
+      return warnings;
+    }
+  };
+}
+
 // xlsx/load/csv.ts
 var CANDIDATES = [",", ";", "	"];
 function delimiterCounts(text2, maxLines = 20) {
@@ -28435,6 +28927,7 @@ function csvToWorkbook(text2, options = {}) {
   workbook.format = "csv";
   const sheet = workbook.sheets[0];
   if (!sheet) return workbook;
+  const reader = createFieldReader(options, workbook.date1904);
   const base = styleAt(workbook, 0);
   const formats = /* @__PURE__ */ new Map();
   const rows = parseCsv(
@@ -28442,9 +28935,11 @@ function csvToWorkbook(text2, options = {}) {
     options.delimiter === void 0 ? {} : { delimiter: options.delimiter }
   );
   rows.forEach((fields, row2) => {
-    fields.forEach((field, col) => {
+    fields.forEach((field, source2) => {
       if (field === "") return;
-      const parsed = !options.formulas && field.startsWith("=") ? { value: field } : parseCellInput(field);
+      const col = reader.target(source2);
+      if (col < 0) return;
+      const parsed = reader.read(field, row2, source2);
       const cell = { value: parsed.value };
       if (parsed.formula !== void 0) cell.formula = parsed.formula;
       if (parsed.numFmt && parsed.numFmt !== "General") {
@@ -28463,6 +28958,7 @@ function csvToWorkbook(text2, options = {}) {
       cells.set(col, cell);
     });
   });
+  workbook.warnings.push(...reader.warnings());
   return workbook;
 }
 var FORMULA_TRIGGER = /^[=+\-@\t\r]/;
@@ -29713,7 +30209,7 @@ var RT = {
   OBPROJ: 211,
   SXSTREAMID: 213};
 var STATES = ["visible", "hidden", "veryHidden"];
-var KINDS2 = {
+var KINDS3 = {
   0: "worksheet",
   1: "macro",
   2: "chart",
@@ -29848,7 +30344,7 @@ function parseGlobals(records) {
       case RT.BOUNDSHEET: {
         const offset2 = r.u32();
         const state = STATES[r.u8() & 3] ?? "visible";
-        const kind = KINDS2[r.u8()] ?? "unknown";
+        const kind = KINDS3[r.u8()] ?? "unknown";
         out.sheets.push({ offset: offset2, state, kind, name: r.shortXlString() });
         break;
       }
@@ -31151,6 +31647,7 @@ async function decryptWorkbook(bytes, password) {
   return plain3;
 }
 async function loadWorkbook(input, options = {}) {
+  const limits = options.limits && resolveLoadLimits(options.limits);
   let bytes = toBytes3(input);
   let format = detectWorkbookFormat(bytes, options.fileName);
   const encrypted = format === "encrypted";
@@ -31162,12 +31659,13 @@ async function loadWorkbook(input, options = {}) {
   if (format === "xls") return loadLegacyXls(bytes);
   if (format === "csv") {
     return csvToWorkbook(decodeText(bytes), {
+      ...options.csv,
       sheetName: sheetNameFromFileName(options.fileName),
       ...options.delimiter === void 0 ? {} : { delimiter: options.delimiter },
       ...options.formulas === void 0 ? {} : { formulas: options.formulas }
     });
   }
-  const workbook = await loadXlsx(bytes);
+  const workbook = await loadXlsx(bytes, limits ? { limits } : {});
   if (format === "xlsm" && workbook.format === "xlsx") workbook.format = "xlsm";
   if (encrypted) workbook.warnings.push(ENCRYPTED_WARNING);
   return workbook;
@@ -31191,6 +31689,7 @@ exports.IncorrectPasswordError = IncorrectPasswordError;
 exports.LegacyXlsError = LegacyXlsError;
 exports.PasswordRequiredError = PasswordRequiredError;
 exports.UnsupportedWorkbookError = UnsupportedWorkbookError;
+exports.WorkbookTooLargeError = WorkbookTooLargeError;
 exports.csvToWorkbook = csvToWorkbook;
 exports.decodeSpreadsheetText = decodeSpreadsheetText;
 exports.decodeText = decodeText;
@@ -31198,6 +31697,7 @@ exports.detectDelimiter = detectDelimiter;
 exports.detectWorkbookFormat = detectWorkbookFormat;
 exports.isEncryptedOoxmlPackage = isEncryptedOoxmlPackage;
 exports.isOoxmlCryptoError = isOoxmlCryptoError;
+exports.isWorkbookTooLargeError = isWorkbookTooLargeError;
 exports.loadLegacyXls = loadLegacyXls;
 exports.loadWorkbook = loadWorkbook;
 exports.neutraliseCsvFormula = neutraliseCsvFormula;