styled-exceljs 0.21.2 → 0.21.4

package/xlsx.mjs

@@ -3,7 +3,7 @@
 /*exported XLSX */
 /*global process:false, Buffer:false, ArrayBuffer:false, DataView:false, Deno:false */
 var XLSX = {};
-XLSX.version = '0.21.2';
+XLSX.version = '0.21.4';
 var current_codepage = 1200, current_ansi = 1252;
 /*:: declare var cptable:any; */
 /*global cptable:true, window */
@@ -158,9 +158,9 @@ function Base64_decode(input) {
   var o = "";
   var c1 = 0, c2 = 0, c3 = 0, e1 = 0, e2 = 0, e3 = 0, e4 = 0;
   if (input.slice(0, 5) == "data:") {
-    var i = input.slice(0, 1024).indexOf(";base64,");
-    if (i > -1)
-      input = input.slice(i + 8);
+		var sep = input.slice(0, 1024).indexOf(";base64,");
+		if (sep > -1)
+			input = input.slice(sep + 8);
   }
   input = input.replace(/[^\w\+\/\=]/g, "");
   for (var i = 0; i < input.length; ) {
@@ -3300,7 +3300,7 @@ function blobify(data) {
 }
 /* write or download file */
 function write_dl(fname/*:string*/, payload/*:any*/, enc/*:?string*/) {
-	/*global IE_SaveFile, Blob, navigator, saveAs, document, File, chrome */
+	/*global IE_SaveFile, navigator, saveAs, document, chrome */
 	if(typeof _fs !== 'undefined' && _fs.writeFileSync) return enc ? _fs.writeFileSync(fname, payload, enc) : _fs.writeFileSync(fname, payload);
 	if(typeof Deno !== 'undefined') {
 		/* in this spot, it's safe to assume typed arrays and TextEncoder/TextDecoder exist */
@@ -3945,7 +3945,7 @@ function escapexmltag(text/*:string*/)/*:string*/{ return escapexml(text).replac
 var htmlcharegex = /[\u0000-\u001f]/g;
 function escapehtml(text/*:string*/)/*:string*/{
 	var s = text + '';
-	return s.replace(decregex, function(y) { return rencoding[y]; }).replace(/\n/g, "<br/>").replace(htmlcharegex,function(s) { return "&#x" + ("000"+s.charCodeAt(0).toString(16)).slice(-4) + ";"; });
+	return s.replace(decregex, function(y) { return rencoding[y]; }).replace(/\r\n|\r|\n/g, "<br/>").replace(htmlcharegex,function(s) { return "&#x" + ("000"+s.charCodeAt(0).toString(16)).slice(-4) + ";"; });
 }
 
 function escapexlml(text/*:string*/)/*:string*/{
@@ -3953,6 +3953,19 @@ function escapexlml(text/*:string*/)/*:string*/{
 	return s.replace(decregex, function(y) { return rencoding[y]; }).replace(htmlcharegex,function(s) { return "&#x" + (s.charCodeAt(0).toString(16)).toUpperCase() + ";"; });
 }
 
+/* Extract text from XML fragments in linear time.  This is a parser helper,
+ * not an HTML sanitizer: text is escaped separately at HTML output boundaries. */
+function strip_xml_tags(text/*:string*/)/*:string*/ {
+	var str = String(text), out = [], inTag = false;
+	for(var i = 0; i < str.length; ++i) {
+		var cc = str.charCodeAt(i);
+		if(!inTag && cc == 60 /* < */) inTag = true;
+		else if(inTag && cc == 62 /* > */) inTag = false;
+		else if(!inTag) out.push(str.charAt(i));
+	}
+	return out.join("");
+}
+
 /* TODO: handle codepages */
 var xlml_fixstr/*:StringConv*/ = /*#__PURE__*/(function() {
 	var entregex = /&#(\d+);/g;
@@ -4059,8 +4072,8 @@ var htmldecode/*:{(s:string):string}*/ = /*#__PURE__*/(function() {
 				.replace(/[\t\n\r ]+/g, " ")
 				// Replace <br> tags with new lines
 				.replace(/<\s*[bB][rR]\s*\/?>/g,"\n")
-				// Strip HTML elements
-				.replace(/<[^<>]*>/g,"");
+					;
+		o = strip_xml_tags(o);
 		for(var i = 0; i < entities.length; ++i) o = o.replace(entities[i][0], entities[i][1]);
 		return o;
 	};
@@ -4638,9 +4651,25 @@ function format_cell(cell/*:Cell*/, v/*:any*/, o/*:any*/) {
 	return safe_format_cell(cell, v);
 }
 
+/* Worksheet names are document-controlled.  A normal object treats
+ * "__proto__" as a setter, so all workbook sheet maps must use an own-property
+ * preserving dictionary and all lookups must reject inherited properties. */
+function sheet_map_new() {
+	return Object.create ? Object.create(null) : {};
+}
+function sheet_map_set(sheets, name/*:string*/, sheet/*:Worksheet*/) {
+	if(name == "__proto__" && Object.defineProperty) Object.defineProperty(sheets, name, {
+		value: sheet, configurable: true, enumerable: true, writable: true
+	});
+	else sheets[name] = sheet;
+}
+function sheet_map_get(sheets, name/*:string*/)/*:?Worksheet*/ {
+	return sheets != null && Object.prototype.hasOwnProperty.call(sheets, name) ? sheets[name] : void 0;
+}
+
 function sheet_to_workbook(sheet/*:Worksheet*/, opts)/*:Workbook*/ {
 	var n = opts && opts.sheet ? opts.sheet : "Sheet1";
-	var sheets = {}; sheets[n] = sheet;
+	var sheets = sheet_map_new(); sheet_map_set(sheets, n, sheet);
 	return { SheetNames: [n], Sheets: sheets };
 }
 
@@ -5726,6 +5755,7 @@ var RELS = ({
 	MS: "http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet",
 	IMG: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image",
 	DRAW: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing",
+	TABLE: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/table",
 	XLMETA: "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata",
 	TCMNT: "http://schemas.microsoft.com/office/2017/10/relationships/threadedComment",
 	PEOPLE: "http://schemas.microsoft.com/office/2017/10/relationships/person",
@@ -6315,8 +6345,8 @@ function parse_TypedPropertyValue(blob, type/*:number*/, _opts)/*:any*/ {
 		case 0x03 /*VT_I4*/: ret = blob.read_shift(4, 'i'); return ret;
 		case 0x0B /*VT_BOOL*/: return blob.read_shift(4) !== 0x0;
 		case 0x13 /*VT_UI4*/: ret = blob.read_shift(4); return ret;
-		case 0x1E /*VT_LPSTR*/: blob.l += 4; val = parse_VtString(blob, blob[blob.l-4]).replace(/(^|[^\u0000])\u0000+$/,"$1"); break;
-		case 0x1F /*VT_LPWSTR*/: blob.l += 4; val = parse_VtString(blob, blob[blob.l-4]).replace(/(^|[^\u0000])\u0000+$/,"$1"); break;
+		case 0x1E /*VT_LPSTR*/: blob.l += 4; return parse_VtString(blob, blob[blob.l-4]).replace(/(^|[^\u0000])\u0000+$/,"$1");
+		case 0x1F /*VT_LPWSTR*/: blob.l += 4; return parse_VtString(blob, blob[blob.l-4]).replace(/(^|[^\u0000])\u0000+$/,"$1");
 		case 0x40 /*VT_FILETIME*/: return parse_FILETIME(blob);
 		case 0x41 /*VT_BLOB*/: return parse_BLOB(blob);
 		case 0x47 /*VT_CF*/: return parse_ClipboardData(blob);
@@ -6827,7 +6857,6 @@ function parse_LongRGBA(blob/*::, length*/) { var r = blob.read_shift(1), g = bl
 /* 2.5.177 LongRGB */
 function parse_LongRGB(blob, length) { var x = parse_LongRGBA(blob, length); x[3] = 0; return x; }
 
-
 /* [MS-XLS] 2.5.19 */
 function parse_XLSCell(blob, length, opts)/*:Cell*/ {
 	var rw = blob.read_shift(2); // 0-indexed
@@ -8290,7 +8319,7 @@ function dbf_to_workbook(buf, opts)/*:Workbook*/ {
 		o.bookType = "dbf";
 		return o;
 	} catch(e) { if(opts && opts.WTF) throw e; }
-	return ({SheetNames:[],Sheets:{}});
+	return ({SheetNames:[],Sheets:sheet_map_new()});
 }
 
 var _RLEN = { 'B': 8, 'C': 250, 'L': 1, 'D': 8, '?': 0, '': 0 };
@@ -9186,7 +9215,7 @@ function read_wb_TABL(d, opts) {
 	try {
 		var out = DIF.to_workbook(d, o);
 		if(!out || !out.Sheets) throw "DIF bad workbook";
-		var ws = out.Sheets[out.SheetNames[0]];
+		var ws = sheet_map_get(out.Sheets, out.SheetNames[0]);
 		if(!ws || !ws["!ref"]) throw "DIF empty worksheet";
 		o.WTF = OLD_WTF;
 		return out;
@@ -9242,7 +9271,7 @@ var WK_ = /*#__PURE__*/(function() {
 		var o = opts || {};
 		if(DENSE != null && o.dense == null) o.dense = DENSE;
 		var s/*:Worksheet*/ = ({}/*:any*/), n = "Sheet1", next_n = "", sidx = 0;
-		var sheets = {}, snames = [], realnames = [], sdata = [];
+		var sheets = sheet_map_new(), snames = [], realnames = [], sdata = [];
 		if(o.dense) sdata = s["!data"] = [];
 
 		var refguess = {s: {r:0, c:0}, e: {r:0, c:0} };
@@ -9287,7 +9316,7 @@ var WK_ = /*#__PURE__*/(function() {
 					if(o.qpro) {
 						if(val[3] > sidx) {
 							s["!ref"] = encode_range(refguess);
-							sheets[n] = s;
+							sheet_map_set(sheets, n, s);
 							snames.push(n);
 							s = ({}/*:any*/); if(o.dense) sdata = s["!data"] = [];
 							refguess = {s: {r:0, c:0}, e: {r:0, c:0} };
@@ -9338,7 +9367,7 @@ var WK_ = /*#__PURE__*/(function() {
 				case 0x28: /* FORMULA28 */
 					if(val[3] > sidx) {
 						s["!ref"] = encode_range(refguess);
-						sheets[n] = s;
+							sheet_map_set(sheets, n, s);
 						snames.push(n);
 						s = ({}/*:any*/); if(o.dense) sdata = s["!data"] = [];
 						refguess = {s: {r:0, c:0}, e: {r:0, c:0} };
@@ -9361,17 +9390,17 @@ var WK_ = /*#__PURE__*/(function() {
 			}}, o);
 		} else throw new Error("Unrecognized LOTUS BOF " + d[2]);
 		s["!ref"] = encode_range(refguess);
-		sheets[next_n || n] = s;
+		sheet_map_set(sheets, next_n || n, s);
 		snames.push(next_n || n);
 		if(!realnames.length) return { SheetNames: snames, Sheets: sheets };
-		var osheets = {}, rnames = [];
+		var osheets = sheet_map_new(), rnames = [];
 		/* TODO: verify no collisions */
-		for(var i = 0; i < realnames.length; ++i) if(sheets[snames[i]]) {
+		for(var i = 0; i < realnames.length; ++i) if(sheet_map_get(sheets, snames[i])) {
 			rnames.push(realnames[i] || snames[i]);
-			osheets[realnames[i]] = sheets[realnames[i]] || sheets[snames[i]];
+			sheet_map_set(osheets, realnames[i] || snames[i], sheet_map_get(sheets, realnames[i]) || sheet_map_get(sheets, snames[i]));
 		} else {
 			rnames.push(realnames[i]);
-			osheets[realnames[i]] = ({ "!ref": "A1" });
+			sheet_map_set(osheets, realnames[i], ({ "!ref": "A1" }));
 		}
 		return { SheetNames: rnames, Sheets: osheets };
 	}
@@ -9425,11 +9454,11 @@ var WK_ = /*#__PURE__*/(function() {
 
 		write_biff_rec(ba, 0x00, write_BOF_WK3(wb));
 
-		for(var i = 0, cnt = 0; i < wb.SheetNames.length; ++i) if((wb.Sheets[wb.SheetNames[i]] || {})["!ref"]) write_biff_rec(ba, 0x1b, write_XFORMAT_SHEETNAME(wb.SheetNames[i], cnt++));
+		for(var i = 0, cnt = 0; i < wb.SheetNames.length; ++i) if((sheet_map_get(wb.Sheets, wb.SheetNames[i]) || {})["!ref"]) write_biff_rec(ba, 0x1b, write_XFORMAT_SHEETNAME(wb.SheetNames[i], cnt++));
 
 		var wsidx = 0;
 		for(i = 0; i < wb.SheetNames.length; ++i) {
-			var ws = wb.Sheets[wb.SheetNames[i]];
+			var ws = sheet_map_get(wb.Sheets, wb.SheetNames[i]);
 			if(!ws || !ws["!ref"]) continue;
 			var range = safe_decode_range(ws["!ref"]);
 			var dense = ws["!data"] != null;
@@ -9474,7 +9503,7 @@ var WK_ = /*#__PURE__*/(function() {
 		var rows = 0, cols = 0, wscnt = 0;
 		for(var i = 0; i < wb.SheetNames.length; ++i) {
 			var name = wb.SheetNames[i];
-			var ws = wb.Sheets[name];
+			var ws = sheet_map_get(wb.Sheets, name);
 			if(!ws || !ws["!ref"]) continue;
 			++wscnt;
 			var range = decode_range(ws["!ref"]);
@@ -10202,7 +10231,7 @@ var WK_ = /*#__PURE__*/(function() {
 		var SST = [], sname = "", formulae = [];
 		var range = {s:{r:-1,c:-1}, e:{r:-1,c:-1}};
 		var cnt = 0, type = 0, C = 0, R = 0;
-		var wb = { SheetNames: [], Sheets: {} };
+		var wb = { SheetNames: [], Sheets: sheet_map_new() };
 		var FMTS = [];
 		outer: while(d.l < d.length) {
 			var RT = d.read_shift(2), length = d.read_shift(2);
@@ -10506,13 +10535,13 @@ var parse_rs = /*#__PURE__*/(function() {
 
 /* Parse a list of <r> tags */
 var rs_to_html = /*#__PURE__*/(function parse_rs_factory() {
-	var nlregex = /(\r\n|\n)/g;
 	function parse_rpr2(font, intro, outro) {
 		var style/*:Array<string>*/ = [];
 
 		if(font.u) style.push("text-decoration: underline;");
-		if(font.uval) style.push("text-underline-style:" + font.uval + ";");
-		if(font.sz) style.push("font-size:" + font.sz + "pt;");
+		if(font.uval && /^(?:single|double|single-accounting|double-accounting)$/.test(font.uval)) style.push("text-underline-style:" + font.uval + ";");
+		var sz = +font.sz;
+		if(isFinite(sz) && sz > 0) style.push("font-size:" + Math.min(sz, 409) + "pt;");
 		if(font.outline) style.push("text-effect: outline;");
 		if(font.shadow) style.push("text-shadow: auto;");
 		intro.push('<span style="' + style.join("") + '">');
@@ -10537,7 +10566,7 @@ var rs_to_html = /*#__PURE__*/(function parse_rs_factory() {
 
 		if(r.s) parse_rpr2(r.s, terms[0], terms[2]);
 
-		return terms[0].join("") + terms[1].replace(nlregex,'<br/>') + terms[2].join("");
+		return terms[0].join("") + escapehtml(terms[1]) + terms[2].join("");
 	}
 
 	return function parse_rs(rs) {
@@ -11196,6 +11225,9 @@ function resolve_style_obj_color(obj, themes) {
 
 /* 18.3.1.13 width calculations */
 /* [MS-OI29500] 2.1.595 Column Width & Formatting */
+/* The file format does not store MDW directly.  Seven is the Office-compatible
+ * fallback when Normal-font metrics are unavailable.  A single stored column
+ * width is ambiguous and must not change the scale for the rest of a sheet. */
 var DEF_MDW = 7, MAX_MDW = 15, MIN_MDW = 1, MDW = DEF_MDW;
 function width2px(width) { return Math.floor(( width + (Math.round(128/MDW))/256 )* MDW ); }
 function px2char(px) { return (Math.floor((px - 5)/MDW * 100 + 0.5))/100; }
@@ -11272,6 +11304,15 @@ function style_font_family(style) {
 	var font = style && style.font || {};
 	return font.name || "Calibri";
 }
+function css_string_escape(value/*:any*/, quote/*:string*/)/*:string*/ {
+	var str = String(value), out = [];
+	for(var i = 0; i < str.length; ++i) {
+		var cc = str.charCodeAt(i), ch = str.charAt(i);
+		if(ch == quote || ch == "\\" || cc < 32 || cc == 127 || ch == "<" || ch == ">" || ch == "&") out.push("\\" + cc.toString(16) + " ");
+		else out.push(ch);
+	}
+	return out.join("");
+}
 function css_font_from_style(style) {
 	var font = style && style.font || {};
 	var parts = [];
@@ -11279,7 +11320,8 @@ function css_font_from_style(style) {
 	if(font.bold) parts.push("bold");
 	parts.push(style_font_size_pt(style) + "pt");
 	var name = style_font_family(style);
-	if(/[,\s'"]/.test(name)) name = '"' + String(name).replace(/"/g, '\\"') + '"';
+	if(/[,\s'"]/.test(name)) name = '"' + css_string_escape(name, '"') + '"';
+	else name = css_string_escape(name, '"');
 	parts.push(name);
 	return parts.join(" ");
 }
@@ -12019,6 +12061,47 @@ function parse_dxfs(t, styles, themes, opts) {
 	});
 }
 
+function parse_tableStyles(t, styles, opts) {
+	styles.TableStyles = {styles:[]};
+	var tableStyle = null, pass = false;
+	(t.match(tagregex)||[]).forEach(function(x) {
+		var y = parsexmltag(x), tag = strip_ns(y[0]);
+		switch(tag) {
+			case '<tableStyles': case '<tableStyles>':
+				if(y.defaultTableStyle) styles.TableStyles.defaultTableStyle = utf8read(unescapexml(y.defaultTableStyle));
+				if(y.defaultPivotStyle) styles.TableStyles.defaultPivotStyle = utf8read(unescapexml(y.defaultPivotStyle));
+				break;
+			case '<tableStyles/>': case '</tableStyles>': break;
+			case '<tableStyle': case '<tableStyle>': case '<tableStyle/>':
+				if(styles.TableStyles.styles.length >= TABLE_STYLE_MAX_TABLES) {
+					tableStyle = null;
+					break;
+				}
+				tableStyle = {
+					name:utf8read(unescapexml(y.name || "")),
+					pivot:y.pivot != null ? parsexmlbool(y.pivot) : false,
+					table:y.table != null ? parsexmlbool(y.table) : true,
+					elements:[]
+				};
+				styles.TableStyles.styles.push(tableStyle);
+				if(tag.slice(-2) == "/>") tableStyle = null;
+				break;
+			case '</tableStyle>': tableStyle = null; break;
+			case '<tableStyleElement': case '<tableStyleElement>': case '<tableStyleElement/>':
+				if(tableStyle && tableStyle.elements.length < 64 && table_style_element_type(y.type) && y.dxfId != null) tableStyle.elements.push({
+					type:y.type,
+					dxfId:parseInt(y.dxfId, 10),
+					size:y.size != null ? Math.max(1, parseInt(y.size, 10) || 1) : 1
+				});
+				break;
+			case '<extLst': case '<extLst>': case '</extLst>': break;
+			case '<ext': pass = true; break;
+			case '</ext>': pass = false; break;
+			default: if(opts && opts.WTF && !pass) throw new Error('unrecognized ' + y[0] + ' in tableStyles');
+		}
+	});
+}
+
 function parse_colors(t, styles, themes, opts) {
 	styles.Colors = {indexedColors:[], mruColors:[], themeColors:[]};
 	var target = null, pass = false;
@@ -12097,6 +12180,7 @@ return function parse_sty_xml(data, themes, opts) {
 	if((t=str_match_xml_ns(data, "dxfs"))) parse_dxfs(t[0], styles, themes, opts);
 
 	/* 18.8.42 tableStyles CT_TableStyles ? */
+	if((t=str_match_xml_ns(data, "tableStyles"))) parse_tableStyles(t[0], styles, opts);
 	/* 18.8.11 colors CT_Colors ? */
 	if((t=str_match_xml_ns(data, "colors"))) parse_colors(t[0], styles, themes, opts);
 
@@ -13262,7 +13346,7 @@ function parse_drawing_anchor(data) {
 function parse_drawing_text(data) {
 	var out = [];
 	(data.match(/<a:t\b[^>]*>[\s\S]*?<\/a:t>/g)||[]).forEach(function(t) {
-		out.push(unescapexml(t.replace(/<[^>]*>/g, "")));
+		out.push(unescapexml(strip_xml_tags(t)));
 	});
 	return out.join("");
 }
@@ -16625,7 +16709,11 @@ function validate_merges(ws/*:Worksheet*/, opts/*:?any*/) {
 				errors.push({code:"E_MERGE_OVERLAP", message:"Merge ranges overlap", index:i, other:j, range:enc, otherRange:encode_range(merges[j])});
 		}
 	}
-	if(errors.length && opts && opts.WTF) throw new Error(errors[0].message + " (" + (errors[0].range || errors[0].index) + ")");
+	if(errors.length && opts && opts.WTF) {
+		var err/*:any*/ = new Error(errors[0].message + " (" + (errors[0].range || errors[0].index) + ")");
+		err.code = errors[0].code;
+		throw err;
+	}
 	return errors;
 }
 
@@ -16643,7 +16731,25 @@ var mergecregex = /<(?:\w+:)?mergeCell ref=["'][A-Z0-9:]+['"]\s*[\/]?>/g;
 var hlinkregex = /<(?:\w+:)?hyperlink [^<>]*>/mg;
 var dimregex = /"(\w*:\w*)"/;
 var colregex = /<(?:\w+:)?col\b[^<>]*[\/]?>/g;
-var afregex = /<(?:\w:)?autoFilter[^>]*([\/]|>([\s\S]*)<\/(?:\w:)?autoFilter)>/g;
+function match_ws_xml_autofilter(data/*:string*/)/*:?string*/ {
+	var paired = str_match_xml_ns(data, "autoFilter");
+	if(paired) return paired[0];
+	var start = 0;
+	while((start = data.indexOf("<", start)) != -1) {
+		var end = data.indexOf(">", start + 1);
+		if(end == -1) return null;
+		var tag = data.slice(start + 1, end), p = 0;
+		while(p < tag.length && tag.charCodeAt(p) <= 32) ++p;
+		var nameEnd = p;
+		while(nameEnd < tag.length && tag.charCodeAt(nameEnd) > 32 && tag.charAt(nameEnd) != "/") ++nameEnd;
+		var name = tag.slice(p, nameEnd), colon = name.indexOf(":");
+		if(colon != -1) name = name.slice(colon + 1);
+		var tail = tag.slice(nameEnd).trim();
+		if(name == "autoFilter" && tail.charAt(tail.length - 1) == "/") return data.slice(start, end + 1);
+		start = end + 1;
+	}
+	return null;
+}
 var marginregex= /<(?:\w+:)?pageMargins[^<>]*\/>/g;
 var sheetprregex = /<(?:\w+:)?sheetPr\b[^<>]*?\/>/;
 
@@ -16692,8 +16798,8 @@ function parse_ws_xml(data/*:?string*/, opts, idx/*:number*/, rels, wb/*:WBWBPro
 	if(mtch) parse_ws_xml_data(mtch[1], s, opts, refguess, themes, styles, wb);
 
 	/* 18.3.1.2  autoFilter CT_AutoFilter */
-	var afilter = data2.match(afregex);
-	if(afilter) s['!autofilter'] = parse_ws_xml_autofilter(afilter[0]);
+	var afilter = match_ws_xml_autofilter(data2);
+	if(afilter) s['!autofilter'] = parse_ws_xml_autofilter(afilter);
 
 	/* 18.3.1.55 mergeCells CT_MergeCells */
 	var merges/*:Array<Range>*/ = [];
@@ -16731,7 +16837,7 @@ function parse_ws_xml(data/*:?string*/, opts, idx/*:number*/, rels, wb/*:WBWBPro
 	if(columns.length > 0) s["!cols"] = columns;
 	if(merges.length > 0) {
 		s["!merges"] = merges;
-		var mergeErrors = validate_merges(s, {WTF: !!(opts && (opts.WTF || opts.validateMerges))});
+		var mergeErrors = validate_merges(s, {WTF: !!(opts && opts.validateMerges)});
 		if(mergeErrors.length) s["!mergeErrors"] = mergeErrors;
 	}
 	if(rels['!id'][s['!rel']]) s['!drawel'] = rels['!id'][s['!rel']];
@@ -16846,7 +16952,8 @@ function parse_ws_xml_cols(columns, cols) {
 		var colm=parseInt(coll.min, 10)-1, colM=parseInt(coll.max,10)-1;
 		if(coll.outlineLevel) coll.level = (+coll.outlineLevel || 0);
 		delete coll.min; delete coll.max; coll.width = +coll.width;
-		/* OOXML widths share the workbook Normal-font MDW; do not infer a different scale per sheet. */
+		/* OOXML widths share the workbook Normal-font MDW.  Do not infer it from
+		 * one ambiguous stored width or leak another worksheet's scale. */
 		if(!seencol && coll.width) { seencol = true; MDW = DEF_MDW; }
 		process_col(coll);
 		while(colm <= colM) columns[colm++] = dup(coll);
@@ -17218,7 +17325,7 @@ function write_ws_xml(idx/*:number*/, opts, wb/*:Workbook*/, rels)/*:string*/ {
 		'xmlns:r': XMLNS.r
 	})];
 	var s = wb.SheetNames[idx], sidx = 0, rdata = "";
-	var ws = wb.Sheets[s];
+	var ws = sheet_map_get(wb.Sheets, s);
 	if(ws == null) ws = {};
 	var ref = ws['!ref'] || 'A1';
 	var range = safe_decode_range(ref);
@@ -17269,7 +17376,7 @@ function write_ws_xml(idx/*:number*/, opts, wb/*:Workbook*/, rels)/*:string*/ {
 	/* customSheetViews */
 
 	if(ws['!merges'] != null && ws['!merges'].length > 0) {
-		validate_merges(ws, {WTF:true});
+		validate_merges(ws, {WTF: !!(opts && opts.validateMerges)});
 		o[o.length] = (write_ws_xml_merges(ws['!merges']));
 	}
 
@@ -17334,6 +17441,312 @@ function write_ws_xml(idx/*:number*/, opts, wb/*:Workbook*/, rels)/*:string*/ {
 	if(o.length>1) { o[o.length] = ('</worksheet>'); o[1]=o[1].replace("/>",">"); }
 	return o.join("");
 }
+var TABLE_STYLE_MAX_TABLES = 1024;
+var TABLE_STYLE_MAX_COLUMNS = 16384;
+var TABLE_STYLE_MAX_XML_LENGTH = 5 * 1024 * 1024;
+var TABLE_STYLE_ELEMENT_TYPES = {
+	wholeTable:true, headerRow:true, totalRow:true,
+	firstColumn:true, lastColumn:true,
+	firstRowStripe:true, secondRowStripe:true,
+	firstColumnStripe:true, secondColumnStripe:true,
+	firstHeaderCell:true, lastHeaderCell:true,
+	firstTotalCell:true, lastTotalCell:true
+};
+
+function table_style_safe_key(key) {
+	return key != "__proto__" && key != "constructor" && key != "prototype";
+}
+
+function table_style_element_type(type) {
+	return Object.prototype.hasOwnProperty.call(TABLE_STYLE_ELEMENT_TYPES, type);
+}
+
+function table_style_attr(y, name) {
+	if(y[name] != null) return y[name];
+	return y[name.toLowerCase()];
+}
+
+function table_style_bool(y, name, fallback) {
+	var value = table_style_attr(y, name);
+	return value == null ? fallback : parsexmlbool(value);
+}
+
+function table_style_int(y, name) {
+	var value = table_style_attr(y, name);
+	if(value == null || value === "") return void 0;
+	value = parseInt(value, 10);
+	return isFinite(value) && value >= 0 ? value : void 0;
+}
+
+function table_style_merge(target, source) {
+	if(!source) return target;
+	if(!target) target = {};
+	keys(source).forEach(function(k) {
+		if(!table_style_safe_key(k)) return;
+		var value = source[k];
+		if(value && typeof value == "object" && !Array.isArray(value)) {
+			target[k] = table_style_merge(
+				target[k] && typeof target[k] == "object" && !Array.isArray(target[k]) ? table_style_merge({}, target[k]) : {},
+				value
+			);
+		} else target[k] = value;
+	});
+	return target;
+}
+
+function table_style_color(themes, theme, tint) {
+	return style_color_from_attrs({theme:String(theme), tint:String(tint || 0)}, themes);
+}
+
+function table_style_fill(color) {
+	return {fill:{patternType:"solid", fgColor:color}};
+}
+
+function table_style_font(color, bold) {
+	var font = {};
+	if(color) font.color = color;
+	if(bold) font.bold = 1;
+	return {font:font};
+}
+
+function table_style_border(side, color, style) {
+	var border = {}, out = {border:border};
+	border[side] = {style:style || "thin", color:color};
+	return out;
+}
+
+function table_style_accent(themes, index) {
+	var position = (index - 1) % 7;
+	/* The first style in each seven-style family is neutral. The remaining
+	 * six entries use the workbook's accent1..accent6 colors. */
+	return table_style_color(themes, position ? 3 + position : 1, 0);
+}
+
+function built_in_table_style_rules(name, themes) {
+	var match = /^TableStyle(Light|Medium|Dark)(\d+)$/i.exec(name || "");
+	if(!match) return null;
+	var family = match[1].toLowerCase(), index = parseInt(match[2], 10);
+	var maximum = family == "light" ? 21 : family == "medium" ? 28 : 11;
+	if(index < 1 || index > maximum) return null;
+	var accent = table_style_accent(themes, index);
+	var white = table_style_color(themes, 0, 0);
+	var dark = table_style_color(themes, 1, 0);
+	var rules = {};
+
+	if(family == "light") {
+		rules.headerRow = table_style_merge(
+			table_style_font(accent, true),
+			table_style_border("bottom", accent, "medium")
+		);
+		rules.totalRow = table_style_merge(
+			table_style_font(accent, true),
+			table_style_border("top", accent, "double")
+		);
+		rules.firstRowStripe = table_style_fill(table_style_color(themes, accent.theme, 0.9));
+		rules.firstColumnStripe = rules.firstRowStripe;
+	} else if(family == "medium") {
+		var group = Math.floor((index - 1) / 7);
+		rules.headerRow = table_style_merge(table_style_fill(accent), table_style_font(white, true));
+		rules.totalRow = table_style_merge(
+			table_style_font(accent, true),
+			table_style_border("top", accent, "double")
+		);
+		if(group == 1) {
+			/* Medium 8..14 use two theme-derived body fills. This is the family
+			 * used by Excel's TableStyleMedium13. */
+			rules.wholeTable = table_style_fill(table_style_color(themes, accent.theme, 0.8));
+			rules.firstRowStripe = table_style_fill(table_style_color(themes, accent.theme, 0.6));
+			rules.firstColumnStripe = rules.firstRowStripe;
+		} else if(group == 2) {
+			rules.firstRowStripe = table_style_fill(table_style_color(themes, accent.theme, 0.8));
+			rules.firstColumnStripe = rules.firstRowStripe;
+			rules.wholeTable = table_style_border("bottom", table_style_color(themes, accent.theme, 0.4), "thin");
+		} else if(group == 3) {
+			rules.wholeTable = table_style_fill(table_style_color(themes, accent.theme, 0.9));
+			rules.firstRowStripe = table_style_fill(table_style_color(themes, accent.theme, 0.7));
+			rules.firstColumnStripe = rules.firstRowStripe;
+		} else {
+			rules.firstRowStripe = table_style_fill(table_style_color(themes, accent.theme, 0.8));
+			rules.firstColumnStripe = rules.firstRowStripe;
+		}
+	} else {
+		rules.wholeTable = table_style_merge(table_style_fill(dark), table_style_font(white, false));
+		rules.headerRow = table_style_merge(table_style_fill(accent), table_style_font(white, true));
+		rules.firstRowStripe = table_style_fill(table_style_color(themes, accent.theme, -0.35));
+		rules.firstColumnStripe = rules.firstRowStripe;
+		rules.totalRow = table_style_merge(
+			table_style_font(white, true),
+			table_style_border("top", accent, "double")
+		);
+	}
+
+	rules.firstColumn = table_style_font(null, true);
+	rules.lastColumn = table_style_font(null, true);
+	return rules;
+}
+
+function custom_table_style_rules(name, styles) {
+	var tableStyles = styles && styles.TableStyles;
+	if(!tableStyles || !tableStyles.styles) return null;
+	for(var i = 0; i < tableStyles.styles.length; ++i) {
+		var tableStyle = tableStyles.styles[i];
+		if(tableStyle.name != name) continue;
+		var rules = Object.create(null);
+		(tableStyle.elements || []).forEach(function(element) {
+			if(!table_style_element_type(element.type)) return;
+			var dxf = styles.Dxfs && styles.Dxfs[element.dxfId];
+			if(dxf) rules[element.type] = {style:dup(dxf), size:element.size || 1};
+		});
+		return rules;
+	}
+	return null;
+}
+
+function parse_table_xml(data, path, themes, styles, opts) {
+	if(!data || data.length > TABLE_STYLE_MAX_XML_LENGTH) return null;
+	data = remove_doctype(str_remove_ng(data, "<!--", "-->"));
+	var table = {columns:[]}, column = null, pass = false;
+	(data.match(tagregex)||[]).forEach(function(x) {
+		var y = parsexmltag(x), tag = strip_ns(y[0]);
+		switch(tag) {
+			case '<table': case '<table>':
+				table.id = table_style_int(y, "id");
+				table.name = utf8read(unescapexml(table_style_attr(y, "name") || ""));
+				table.displayName = utf8read(unescapexml(table_style_attr(y, "displayName") || table.name));
+				table.ref = table_style_attr(y, "ref") || "";
+				table.headerRowCount = table_style_int(y, "headerRowCount");
+				table.totalsRowCount = table_style_int(y, "totalsRowCount");
+				table.totalsRowShown = table_style_bool(y, "totalsRowShown", false);
+				table.headerRowDxfId = table_style_int(y, "headerRowDxfId");
+				table.dataDxfId = table_style_int(y, "dataDxfId");
+				table.totalsRowDxfId = table_style_int(y, "totalsRowDxfId");
+				table.path = path;
+				break;
+			case '<tableColumn': case '<tableColumn>': case '<tableColumn/>':
+				if(table.columns.length >= TABLE_STYLE_MAX_COLUMNS) {
+					column = null;
+					break;
+				}
+				column = {
+					id:table_style_int(y, "id"),
+					name:utf8read(unescapexml(table_style_attr(y, "name") || "")),
+					headerRowDxfId:table_style_int(y, "headerRowDxfId"),
+					dataDxfId:table_style_int(y, "dataDxfId"),
+					totalsRowDxfId:table_style_int(y, "totalsRowDxfId")
+				};
+				table.columns.push(column);
+				if(tag.slice(-2) == "/>" ) column = null;
+				break;
+			case '</tableColumn>': column = null; break;
+			case '<tableStyleInfo': case '<tableStyleInfo>': case '<tableStyleInfo/>':
+				table.styleInfo = {
+					name:utf8read(unescapexml(table_style_attr(y, "name") || "")),
+					showFirstColumn:table_style_bool(y, "showFirstColumn", false),
+					showLastColumn:table_style_bool(y, "showLastColumn", false),
+					showRowStripes:table_style_bool(y, "showRowStripes", false),
+					showColumnStripes:table_style_bool(y, "showColumnStripes", false)
+				};
+				break;
+			case '<extLst': case '<extLst>': case '</extLst>': break;
+			case '<ext': pass = true; break;
+			case '</ext>': pass = false; break;
+			default: if(opts && opts.WTF && !pass) {
+				/* Table formulas and filter metadata are intentionally preserved by
+				 * the raw XML parser but do not affect visual style resolution. */
+				if(/^<\/?(?:tableColumns|autoFilter|sortState|calculatedColumnFormula|totalsRowFormula|xmlColumnPr)/.test(tag)) break;
+			}
+		}
+	});
+	if(!table.ref) return null;
+	try {
+		table.range = safe_decode_range(table.ref);
+		if(table.range.s.r < 0 || table.range.s.c < 0 || table.range.e.r > 1048575 || table.range.e.c > 16383) return null;
+	} catch(e) { return null; }
+	var styleName = table.styleInfo && table.styleInfo.name;
+	table.styleRules = custom_table_style_rules(styleName, styles) || built_in_table_style_rules(styleName, themes) || {};
+	table.dxfs = styles && styles.Dxfs ? styles.Dxfs : [];
+	return table;
+}
+
+function parse_sheet_tables(sheet, zip, path, rels, opts, themes, styles) {
+	if(!sheet || !rels || !rels['!id'] || !opts || !opts.cellStyles) return;
+	var tables = [], seen = Object.create(null);
+	keys(rels['!id']).forEach(function(id) {
+		if(tables.length >= TABLE_STYLE_MAX_TABLES) return;
+		var rel = rels['!id'][id];
+		if(!rel || rel.TargetMode == "External" || typeof rel.Target != "string" || !rel.Target ||
+			(rel.Type != RELS.TABLE && !/\/table$/.test(rel.Type || ""))) return;
+		var tablePath = resolve_path(rel.Target, path);
+		if(seen[tablePath]) return;
+		seen[tablePath] = true;
+		var table = parse_table_xml(getzipstr(zip, tablePath, true), tablePath, themes, styles, opts);
+		if(table) tables.push(table);
+	});
+	if(tables.length) sheet['!tables'] = tables;
+}
+
+function table_style_rule_value(rule) {
+	return rule && rule.style ? rule.style : rule;
+}
+
+function table_style_stripe_rule(first, second, offset) {
+	var firstSize = first && first.size || 1, secondSize = second && second.size || 1;
+	var period = firstSize + secondSize;
+	if(!period) return null;
+	return offset % period < firstSize ? first : second;
+}
+
+function table_style_dxf(table, id) {
+	return id == null || !table.dxfs ? null : table.dxfs[id];
+}
+
+function resolve_table_cell_style(ws, row, col, baseStyle) {
+	var tables = ws && ws['!tables'];
+	var resolved = baseStyle ? table_style_merge({}, baseStyle) : {};
+	if(!tables || !tables.length) return keys(resolved).length ? resolved : void 0;
+	for(var i = 0; i < tables.length; ++i) {
+		var table = tables[i], range = table.range;
+		if(!range || row < range.s.r || row > range.e.r || col < range.s.c || col > range.e.c) continue;
+		var rules = table.styleRules || {}, info = table.styleInfo || {};
+		var rowOffset = row - range.s.r, colOffset = col - range.s.c;
+		var headerRows = table.headerRowCount == null ? 1 : table.headerRowCount;
+		var totalRows = table.totalsRowCount != null ? table.totalsRowCount : table.totalsRowShown ? 1 : 0;
+		var dataStart = headerRows, dataEnd = range.e.r - range.s.r - totalRows;
+		var isHeader = rowOffset < headerRows;
+		var isTotal = totalRows > 0 && rowOffset > dataEnd;
+		var dataOffset = rowOffset - dataStart;
+		var column = table.columns && table.columns[colOffset];
+
+		resolved = table_style_merge(resolved, table_style_rule_value(rules.wholeTable));
+		if(!isHeader && !isTotal && dataOffset >= 0) {
+			if(info.showRowStripes) resolved = table_style_merge(resolved, table_style_rule_value(
+				table_style_stripe_rule(rules.firstRowStripe, rules.secondRowStripe, dataOffset)
+			));
+			if(info.showColumnStripes) resolved = table_style_merge(resolved, table_style_rule_value(
+				table_style_stripe_rule(rules.firstColumnStripe, rules.secondColumnStripe, colOffset)
+			));
+		}
+		if(info.showFirstColumn && col == range.s.c) resolved = table_style_merge(resolved, table_style_rule_value(rules.firstColumn));
+		if(info.showLastColumn && col == range.e.c) resolved = table_style_merge(resolved, table_style_rule_value(rules.lastColumn));
+		if(isHeader) {
+			resolved = table_style_merge(resolved, table_style_rule_value(rules.headerRow));
+			if(col == range.s.c) resolved = table_style_merge(resolved, table_style_rule_value(rules.firstHeaderCell));
+			if(col == range.e.c) resolved = table_style_merge(resolved, table_style_rule_value(rules.lastHeaderCell));
+			resolved = table_style_merge(resolved, table_style_dxf(table, table.headerRowDxfId));
+			resolved = table_style_merge(resolved, table_style_dxf(table, column && column.headerRowDxfId));
+		} else if(isTotal) {
+			resolved = table_style_merge(resolved, table_style_rule_value(rules.totalRow));
+			if(col == range.s.c) resolved = table_style_merge(resolved, table_style_rule_value(rules.firstTotalCell));
+			if(col == range.e.c) resolved = table_style_merge(resolved, table_style_rule_value(rules.lastTotalCell));
+			resolved = table_style_merge(resolved, table_style_dxf(table, table.totalsRowDxfId));
+			resolved = table_style_merge(resolved, table_style_dxf(table, column && column.totalsRowDxfId));
+		} else {
+			resolved = table_style_merge(resolved, table_style_dxf(table, table.dataDxfId));
+			resolved = table_style_merge(resolved, table_style_dxf(table, column && column.dataDxfId));
+		}
+	}
+	return keys(resolved).length ? resolved : void 0;
+}
 
 /* [MS-XLSB] 2.4.726 BrtRowHdr */
 function parse_BrtRowHdr(data, length) {
@@ -18332,7 +18745,7 @@ function write_SHEETPROTECT(ba, ws) {
 
 function write_ws_bin(idx/*:number*/, opts, wb/*:Workbook*/, rels) {
 	var ba = buf_array();
-	var s = wb.SheetNames[idx], ws = wb.Sheets[s] || {};
+	var s = wb.SheetNames[idx], ws = sheet_map_get(wb.Sheets, s) || {};
 	var c/*:string*/ = s; try { if(wb && wb.Workbook) c = wb.Workbook.Sheets[idx].CodeName || c; } catch(e) {}
 	var r = safe_decode_range(ws['!ref'] || "A1");
 	if(r.e.c > 0x3FFF || r.e.r > 0xFFFFF) {
@@ -18400,7 +18813,7 @@ function parse_Cache(data/*:string*/)/*:[Array<number|string>, string, ?string]*
 	/* 21.2.2.71 formatCode CT_Xstring */
 	var nf = unescapexml((str_match_xml(data, "c:formatCode") || ["","General"])[1]);
 
-	(str_match_ng(data, "<c:f>", "</c:f>")||[]).forEach(function(F) { f = F.replace(/<[^<>]*>/g,""); });
+	(str_match_ng(data, "<c:f>", "</c:f>")||[]).forEach(function(F) { f = strip_xml_tags(F); });
 
 	return [col, nf, f];
 }
@@ -18417,7 +18830,7 @@ function parse_chart_cache(data) {
 		return {values:s[0], formatCode:s[1], formula:s[2]};
 	}
 	var f = (str_match_ng(data, "<c:f>", "</c:f>")||[])[0];
-	return {values:[], formula:f ? f.replace(/<[^<>]*>/g,"") : void 0};
+	return {values:[], formula:f ? strip_xml_tags(f) : void 0};
 }
 
 function parse_chart_tx(data) {
@@ -18449,7 +18862,7 @@ function parse_chart_title(data) {
 	var title = str_match_xml_ns(data, "title");
 	if(!title) return "";
 	var out = [];
-	(title[0].match(/<a:t\b[^>]*>[\s\S]*?<\/a:t>/g)||[]).forEach(function(t) { out.push(unescapexml(t.replace(/<[^>]*>/g, ""))); });
+	(title[0].match(/<a:t\b[^>]*>[\s\S]*?<\/a:t>/g)||[]).forEach(function(t) { out.push(unescapexml(strip_xml_tags(t))); });
 	return out.join("");
 }
 
@@ -18754,9 +19167,12 @@ function check_wb(wb) {
 	if(!wb.SheetNames.length) throw new Error("Workbook is empty");
 	var Sheets = (wb.Workbook && wb.Workbook.Sheets) || [];
 	check_wb_names(wb.SheetNames, Sheets, !!wb.vbaraw);
-	for(var i = 0; i < wb.SheetNames.length; ++i) check_ws(wb.Sheets[wb.SheetNames[i]], wb.SheetNames[i], i);
+	for(var i = 0; i < wb.SheetNames.length; ++i) {
+		var ws = sheet_map_get(wb.Sheets, wb.SheetNames[i]);
+		check_ws(ws, wb.SheetNames[i], i);
+	}
 	wb.SheetNames.forEach(function(n, i) {
-		var ws = wb.Sheets[n];
+		var ws = sheet_map_get(wb.Sheets, n);
 		if(!ws || !ws["!autofilter"]) return;
 		var DN;
 		if(!wb.Workbook) wb.Workbook = {};
@@ -19545,7 +19961,7 @@ function parse_xlml_data(xml, ss, data, cell/*:any*/, base, styles, csty, row, a
 			break;
 		case 'String':
 			cell.t = 's'; cell.r = xlml_fixstr(unescapexml(xml));
-			cell.v = (xml.indexOf("<") > -1 ? unescapexml(ss||xml).replace(/<[^<>]*>/g, "") : cell.r); // todo: BR etc
+			cell.v = (xml.indexOf("<") > -1 ? strip_xml_tags(unescapexml(ss||xml)) : cell.r); // todo: BR etc
 			break;
 		case 'DateTime':
 			if(xml.slice(-1) != "Z") xml += "Z";
@@ -19640,7 +20056,7 @@ function parse_xlml_xml(d, _opts)/*:Workbook*/ {
 	var Rn;
 	var state = [], tmp;
 	if(DENSE != null && opts.dense == null) opts.dense = DENSE;
-	var sheets = {}, sheetnames/*:Array<string>*/ = [], cursheet/*:Worksheet*/ = ({}), sheetname = ""; if(opts.dense) cursheet["!data"] = [];
+	var sheets = sheet_map_new(), sheetnames/*:Array<string>*/ = [], cursheet/*:Worksheet*/ = ({}), sheetname = ""; if(opts.dense) cursheet["!data"] = [];
 	var cell = ({}/*:any*/), row = {};// eslint-disable-line no-unused-vars
 	var dtag = xlml_parsexmltag('<Data ss:Type="String">'), didx = 0;
 	var c = 0, r = 0;
@@ -19747,7 +20163,7 @@ function parse_xlml_xml(d, _opts)/*:Workbook*/ {
 				if(merges.length) cursheet["!merges"] = merges;
 				if(cstys.length > 0) cursheet["!cols"] = cstys;
 				if(rowinfo.length > 0) cursheet["!rows"] = rowinfo;
-				sheets[sheetname] = cursheet;
+				sheet_map_set(sheets, sheetname, cursheet);
 			} else {
 				refguess = {s: {r:2000000, c:2000000}, e: {r:0, c:0} };
 				r = c = 0;
@@ -20652,7 +21068,7 @@ function write_ws_xlml_table(ws/*:Worksheet*/, opts, idx/*:number*/, wb/*:Workbo
 function write_ws_xlml(idx/*:number*/, opts, wb/*:Workbook*/)/*:string*/ {
 	var o/*:Array<string>*/ = [];
 	var s = wb.SheetNames[idx];
-	var ws = wb.Sheets[s];
+	var ws = sheet_map_get(wb.Sheets, s);
 
 	var t/*:string*/ = ws ? write_ws_xlml_names(ws, opts, idx, wb) : "";
 	if(t.length > 0) o.push("<Names>" + t + "</Names>");
@@ -20886,7 +21302,7 @@ var parse_BIFFSurface = make_BIFFChartType("surfaceChart");
 // 2.3.2
 function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 	var wb = ({opts:{}}/*:any*/);
-	var Sheets = {};
+	var Sheets = sheet_map_new();
 	if(DENSE != null && options.dense == null) options.dense = DENSE;
 	var out/*:Worksheet*/ = ({}/*:any*/); if(options.dense) out["!data"] = [];
 	var Directory = {};
@@ -21181,7 +21597,7 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 	};
 	var finalize_sheet_visuals = function finalizesheetvisuals(ws) {
 		if(ws["!merges"] && ws["!merges"].length) {
-			var mergeErrors = validate_merges(ws, {WTF: !!(options && (options.WTF || options.validateMerges))});
+			var mergeErrors = validate_merges(ws, {WTF: !!(options && options.validateMerges)});
 			if(mergeErrors.length) ws["!mergeErrors"] = mergeErrors;
 		}
 		if(drawings && (drawings.images.length || drawings.shapes.length || drawings.charts.length || drawings.raw.length)) ws["!drawings"] = drawings;
@@ -21329,7 +21745,7 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 						finalize_sheet_visuals(out);
 						Workbook.Sheets.push(wsprops);
 					}
-					if(cur_sheet === "") Preamble = out; else Sheets[cur_sheet] = out;
+					if(cur_sheet === "") Preamble = out; else sheet_map_set(Sheets, cur_sheet, out);
 					out = ({}/*:any*/); if(options.dense) out["!data"] = [];
 				} break;
 				case 0x0009: case 0x0209: case 0x0409: case 0x0809 /* BOF */: {
@@ -21629,10 +22045,13 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 	if(!wb.SheetNames.length && Preamble["!ref"]) {
 		wb.SheetNames.push("Sheet1");
 		/*jshint -W069 */
-		if(wb.Sheets) wb.Sheets["Sheet1"] = Preamble;
+		if(wb.Sheets) sheet_map_set(wb.Sheets, "Sheet1", Preamble);
 		/*jshint +W069 */
 	} else wb.Preamble=Preamble;
-	if(wb.Sheets) FilterDatabases.forEach(function(r,i) { wb.Sheets[wb.SheetNames[i]]['!autofilter'] = r; });
+	if(wb.Sheets) FilterDatabases.forEach(function(r,i) {
+		var ws = sheet_map_get(wb.Sheets, wb.SheetNames[i]);
+		if(ws) ws['!autofilter'] = r;
+	});
 	wb.Strings = sst;
 	wb.SSF = dup(table_fmt);
 	if(opts.enc) wb.Encryption = opts.enc;
@@ -23257,7 +23676,7 @@ function write_biff2_buf(wb/*:Workbook*/, opts/*:WriteOpts*/) {
 	o.cellXfs = [{numFmtId: 0}];
 	o._BIFF2FmtTable/*:Array<string>*/ = ["General"]; o._Fonts = [];
 	var body = buf_array();
-	write_ws_biff2(body, wb.Sheets[wb.SheetNames[idx]], idx, o, wb);
+	write_ws_biff2(body, sheet_map_get(wb.Sheets, wb.SheetNames[idx]), idx, o, wb);
 
 	o._BIFF2FmtTable.forEach(function(f) {
 		if(o.biff <= 3) write_biff_rec(ba, 0x001E, write_BIFF2Format(f));
@@ -23668,7 +24087,7 @@ function write_ws_biff8_cell(ba/*:BufArray*/, cell/*:Cell*/, R/*:number*/, C/*:n
 /* [MS-XLS] 2.1.7.20.5 */
 function write_ws_biff8(idx/*:number*/, opts, wb/*:Workbook*/) {
 	var ba = buf_array();
-	var s = wb.SheetNames[idx], ws = wb.Sheets[s] || {};
+	var s = wb.SheetNames[idx], ws = sheet_map_get(wb.Sheets, s) || {};
 	var _WB/*:WBWBProps*/ = ((wb||{}).Workbook||{}/*:any*/);
 	var _sheet/*:WBWSProp*/ = ((_WB.Sheets||[])[idx]||{}/*:any*/);
 	var dense = ws["!data"] != null;
@@ -23737,7 +24156,7 @@ function write_ws_biff8(idx/*:number*/, opts, wb/*:Workbook*/) {
 	if(b8) write_biff_rec(ba, 0x023e /* Window2 */, write_Window2((_WB.Views||[])[0]));
 	/* ... */
 	if(b8 && (ws['!merges']||[]).length) {
-		validate_merges(ws, {WTF:true});
+		validate_merges(ws, {WTF: !!(opts && opts.validateMerges)});
 		write_biff_rec(ba, 0x00e5 /* MergeCells */, write_MergeCells(ws['!merges']));
 	}
 	/* [LRng] *QUERYTABLE [PHONETICINFO] CONDFMTS */
@@ -23867,7 +24286,7 @@ function write_biff8_buf(wb/*:Workbook*/, opts/*:WriteOpts*/) {
 
 function write_biff_buf(wb/*:Workbook*/, opts/*:WriteOpts*/) {
 	for(var i = 0; i <= wb.SheetNames.length; ++i) {
-		var ws = wb.Sheets[wb.SheetNames[i]];
+		var ws = sheet_map_get(wb.Sheets, wb.SheetNames[i]);
 		if(!ws || !ws["!ref"]) continue;
 		var range = decode_range(ws["!ref"]);
 		if(range.e.c > 255) { // note: 255 is IV
@@ -23949,15 +24368,66 @@ function html_to_sheet(str/*:string*/, _opts)/*:Workbook*/ {
 	return ws;
 }
 
-function cssesc(x) { return escapexml(String(x).replace(/"/g, "'")); }
 function css_color(color) {
 	if(!color) return "";
-	if(color.rgb) return "#" + String(color.rgb).slice(-6);
+	if(color.rgb && /^[0-9A-Fa-f]{6}(?:[0-9A-Fa-f]{2})?$/.test(String(color.rgb))) return "#" + String(color.rgb).slice(-6);
 	return "";
 }
 function css_font_family(name) {
 	if(!name) return "";
-	return "'" + cssesc(name).replace(/'/g, "\\'") + "'";
+	return "'" + css_string_escape(name, "'") + "'";
+}
+
+function html_attr_escape(value/*:any*/)/*:string*/ {
+	return String(value).replace(/[&<>"']/g, function(ch) {
+		return ch == "&" ? "&amp;" : ch == "<" ? "&lt;" : ch == ">" ? "&gt;" : ch == '"' ? "&quot;" : "&#39;";
+	});
+}
+function html_writextag(tag/*:string*/, content/*:?string*/, attrs)/*:string*/ {
+	var out = ["<", tag];
+	if(attrs) keys(attrs).forEach(function(key) { out.push(" ", key, '="', html_attr_escape(attrs[key]), '"'); });
+	if(content == null) { out.push("/>"); return out.join(""); }
+	out.push(">", content, "</", tag, ">");
+	return out.join("");
+}
+function safe_html_href(value/*:any*/)/*:?string*/ {
+	var href = String(value == null ? "" : value).trim();
+	if(!href || href.slice(0, 2) == "//") return null;
+	var colon = href.indexOf(":"), prefix = colon == -1 ? "" : href.slice(0, colon), compact = "";
+	for(var i = 0; i < prefix.length; ++i) if(prefix.charCodeAt(i) > 32 && prefix.charCodeAt(i) != 127) compact += prefix.charAt(i);
+	if(colon != -1 && !/^(?:https?|mailto|tel)$/i.test(compact)) return null;
+	return href;
+}
+function safe_html_image_src(value/*:any*/)/*:?string*/ {
+	var src = String(value == null ? "" : value);
+	return /^data:image\/[A-Za-z0-9.+-]+;base64,[A-Za-z0-9+/=\r\n]+$/.test(src) ? src : null;
+}
+function sanitize_cell_html(value/*:any*/)/*:string*/ {
+	var html = String(value == null ? "" : value), out = [], pos = 0;
+	while(pos < html.length) {
+		var start = html.indexOf("<", pos);
+		if(start == -1) { out.push(html.slice(pos)); break; }
+		out.push(html.slice(pos, start));
+		var end = html.indexOf(">", start + 1);
+		if(end == -1) { out.push("&lt;", html.slice(start + 1)); break; }
+		var raw = html.slice(start + 1, end).trim(), lower = raw.toLowerCase();
+		if(/^(?:\/?(?:b|i|s|sup|sub)|br\s*\/?)$/.test(lower)) out.push("<", lower == "br" ? "br/" : lower, ">");
+		else if(lower == "/span") out.push("</span>");
+		else if(lower.slice(0, 12) == 'span style="' && raw.charAt(raw.length - 1) == '"') {
+			var declarations = raw.slice(12, -1).split(";"), safe = [];
+			declarations.forEach(function(decl) {
+				var colon = decl.indexOf(":"), key = colon == -1 ? "" : decl.slice(0, colon).trim().toLowerCase(), val = colon == -1 ? "" : decl.slice(colon + 1).trim().toLowerCase();
+				if(key == "text-decoration" && val == "underline") safe.push("text-decoration:underline");
+				else if(key == "text-underline-style" && /^(?:single|double|single-accounting|double-accounting)$/.test(val)) safe.push("text-underline-style:" + val);
+				else if(key == "font-size" && /^\d+(?:\.\d+)?pt$/.test(val)) safe.push("font-size:" + val);
+				else if(key == "text-effect" && val == "outline") safe.push("text-effect:outline");
+				else if(key == "text-shadow" && val == "auto") safe.push("text-shadow:auto");
+			});
+			out.push('<span style="', safe.join(";"), safe.length ? ";" : "", '">');
+		} else out.push(html_attr_escape(html.slice(start, end + 1)));
+		pos = end + 1;
+	}
+	return out.join("");
 }
 function html_border_style(style) {
 	switch(style) {
@@ -23986,7 +24456,8 @@ function html_cell_style(cell/*:Cell*/, opts/*:Sheet2HTMLOpts*/) {
 	var s = cell.s, css = [];
 	var font = s.font || {};
 	if(font.name) css.push("font-family:" + css_font_family(font.name));
-	if(font.sz) css.push("font-size:" + font.sz + "pt");
+	var fontSize = +font.sz;
+	if(isFinite(fontSize) && fontSize > 0) css.push("font-size:" + Math.min(fontSize, 409) + "pt");
 	if(font.bold) css.push("font-weight:bold");
 	if(font.italic) css.push("font-style:italic");
 	var deco = [];
@@ -23999,8 +24470,9 @@ function html_cell_style(cell/*:Cell*/, opts/*:Sheet2HTMLOpts*/) {
 	if(fill.patternType != "none" && fill.patternType != "gray125") fillColor = css_color(fill.fgColor) || css_color(fill.bgColor);
 	if(fillColor) css.push("background-color:" + fillColor);
 	var alignment = s.alignment || {};
-	if(alignment.horizontal) css.push("text-align:" + alignment.horizontal);
-	if(alignment.vertical) css.push("vertical-align:" + alignment.vertical);
+	if(/^(?:left|right|center|justify|fill|distributed)$/.test(alignment.horizontal || "")) css.push("text-align:" + alignment.horizontal);
+	var vertical = alignment.vertical == "center" ? "middle" : alignment.vertical;
+	if(/^(?:top|middle|bottom|baseline)$/.test(vertical || "")) css.push("vertical-align:" + vertical);
 	if(alignment.textRotation != null && alignment.textRotation !== 0) {
 		var deg = alignment.textRotation == 255 ? 90 : alignment.textRotation > 90 ? 90 - alignment.textRotation : alignment.textRotation;
 		css.push("transform:rotate(" + deg + "deg)");
@@ -24073,13 +24545,14 @@ function make_html_row(ws/*:Worksheet*/, r/*:Range*/, R/*:number*/, o/*:Sheet2HT
 			if(cols[C] && cols[C].s) extend_style_obj(inherited, cols[C].s);
 			if(row && row.s) extend_style_obj(inherited, row.s);
 			if(cell && cell.s) extend_style_obj(inherited, cell.s);
+			inherited = resolve_table_cell_style(ws, R, C, inherited) || inherited;
 			if(keys(inherited).length) {
 				stylecell = cell ? dup(cell) : {t:'z'};
 				stylecell.s = inherited;
 			}
 		}
 		/* TODO: html entities */
-		var w = (cell && cell.v != null) && (cell.h || escapehtml(cell.w || (format_cell(cell), cell.w) || "")) || "";
+		var w = (cell && cell.v != null) && (cell.h ? sanitize_cell_html(cell.h) : escapehtml(cell.w || (format_cell(cell), cell.w) || "")) || "";
 		sp = ({}/*:any*/);
 		if(RS > 1) sp.rowspan = RS;
 		if(CS > 1) sp.colspan = CS;
@@ -24087,17 +24560,18 @@ function make_html_row(ws/*:Worksheet*/, r/*:Range*/, R/*:number*/, o/*:Sheet2HT
 		else if(cell) {
 			sp["data-t"] = cell && cell.t || 'z';
 			// note: data-v is unaffected by the timezone interpretation
-			if(cell.v != null) sp["data-v"] = escapehtml(cell.v instanceof Date ? cell.v.toISOString() : cell.v);
+			if(cell.v != null) sp["data-v"] = cell.v instanceof Date ? cell.v.toISOString() : cell.v;
 			if(cell.z != null) sp["data-z"] = cell.z;
-			if(cell.f != null) sp["data-f"] = escapehtml(cell.f);
-			if(cell.l && (cell.l.Target || "#").charAt(0) != "#" && (!o.sanitizeLinks || (cell.l.Target || "").slice(0, 11).toLowerCase() != 'javascript:')) w = '<a href="' + escapehtml(cell.l.Target) +'">' + w + '</a>';
+			if(cell.f != null) sp["data-f"] = cell.f;
+			var href = cell.l && safe_html_href(cell.l.Target);
+			if(href) w = '<a href="' + html_attr_escape(href) +'">' + w + '</a>';
 		}
 		var cstyle = html_cell_style(stylecell, o);
 		var lstyle = html_cell_layout_style(stylecell, o, C, CS, cols);
 		if(lstyle) cstyle = cstyle ? cstyle + ";" + lstyle : lstyle;
 		if(cstyle) sp.style = cstyle;
 		sp.id = (o.id || "sjs") + "-" + coord;
-		oo.push(writextag('td', w, sp));
+		oo.push(html_writextag('td', w, sp));
 	}
 	var rsp = ({}/*:any*/), rstyle = [];
 	if(row) {
@@ -24105,7 +24579,7 @@ function make_html_row(ws/*:Worksheet*/, r/*:Range*/, R/*:number*/, o/*:Sheet2HT
 		if(o.browserPixels) rstyle.push("height:" + html_row_height(row) + "px");
 	}
 	if(rstyle.length) rsp.style = rstyle.join(";");
-	return writextag('tr', oo.join(""), rsp);
+	return html_writextag('tr', oo.join(""), rsp);
 }
 
 var HTML_BEGIN = '<html><head><meta charset="utf-8"/><title>SheetJS Table Export</title></head><body>';
@@ -24241,8 +24715,10 @@ function render_html_drawings(ws, opts) {
 	var out = [], drawings = ws["!drawings"] || {}, charts = ws["!charts"] || [];
 	if(opts && opts.drawings && drawings.images) drawings.images.forEach(function(img) {
 		if(!img || !img.dataURI) return;
+		var src = safe_html_image_src(img.dataURI);
+		if(!src) return;
 		var pos = html_anchor_pos(ws, img.anchor, opts);
-		out.push('<img class="sjs-drawing-image" src="' + img.dataURI + '" style="' + html_abs_style(pos) + '"/>');
+		out.push('<img class="sjs-drawing-image" src="' + html_attr_escape(src) + '" style="' + html_abs_style(pos) + '"/>');
 	});
 	if(opts && opts.charts) charts.forEach(function(chart) {
 		var pos = html_anchor_pos(ws, chart.anchor, opts);
@@ -24257,7 +24733,7 @@ function make_html_preamble(ws/*:Worksheet*/, R/*:Range*/, o/*:Sheet2HTMLOpts*/)
 	if(o && o.id) tattr.id = o.id;
 	if(o && (o.browserPixels || o.autoFit)) tstyle.push("border-collapse:collapse;table-layout:fixed");
 	if(tstyle.length) tattr.style = tstyle.join(";");
-	var table = writextag("table", "", tattr).replace(/<\/table>$/, "");
+	var table = html_writextag("table", "", tattr).replace(/<\/table>$/, "");
 	var cols = o && o._htmlCols || ws["!cols"];
 	if(o && (o.browserPixels || o.autoFit) && cols) {
 		out.push("<colgroup>");
@@ -24265,7 +24741,7 @@ function make_html_preamble(ws/*:Worksheet*/, R/*:Range*/, o/*:Sheet2HTMLOpts*/)
 			var col = cols[C], style = [];
 			style.push("width:" + html_col_width(col) + "px");
 			if(col && col.hidden) style.push("display:none");
-			out.push(writextag("col", null, {style:style.join(";")}));
+			out.push(html_writextag("col", null, {style:style.join(";")}));
 		}
 		out.push("</colgroup>");
 	}
@@ -24432,7 +24908,7 @@ function parse_text_p(text/*:string*//*::, tag*/)/*:Array<any>*/ {
 		.replace(/<text:s text:c="(\d+)"\/>/g, function($$,$1) { return Array(parseInt($1,10)+1).join(" "); })
 		.replace(/<text:tab[^<>]*\/>/g,"\t")
 		.replace(/<text:line-break\/>/g,"\n");
-	var v = unescapexml(fixed.replace(/<[^<>]*>/g,""));
+	var v = unescapexml(strip_xml_tags(fixed));
 
 	return [v];
 }
@@ -24669,7 +25145,7 @@ function parse_content_xml(d/*:string*/, _opts, _nfm)/*:Workbook*/ {
 		var nfidx, NF = "", pidx = 0;
 		var sheetag/*:: = {name:"", '名称':""}*/;
 		var rowtag/*:: = {'行号':""}*/;
-		var Sheets = {}, SheetNames/*:Array<string>*/ = [];
+		var Sheets = sheet_map_new(), SheetNames/*:Array<string>*/ = [];
 		var ws = ({}/*:any*/); if(opts.dense) ws["!data"] = [];
 		var Rn, q/*:: :any = ({t:"", v:null, z:null, w:"",c:[],}:any)*/;
 		var ctag = ({value:""}/*:any*/), ctag2 = ({}/*:any*/);
@@ -24706,7 +25182,7 @@ function parse_content_xml(d/*:string*/, _opts, _nfm)/*:Workbook*/ {
 					sheetag.name = sheetag['名称'] || sheetag.name;
 					if(typeof JSON !== 'undefined') JSON.stringify(sheetag);
 					SheetNames.push(sheetag.name);
-					Sheets[sheetag.name] = ws;
+					sheet_map_set(Sheets, sheetag.name, ws);
 					WB.Sheets.push({
 						/* TODO: CodeName */
 						Hidden: (tstyles[sheetag["style-name"]] && tstyles[sheetag["style-name"]]["display"] ? (parsexmlbool(tstyles[sheetag["style-name"]]["display"]) ? 0 : 1) : 0)
@@ -25062,7 +25538,9 @@ function parse_content_xml(d/*:string*/, _opts, _nfm)/*:Workbook*/ {
 				if(Rn[1]==='/') break;
 				try {
 					_Ref = ods_to_csf_3D(parsexmltag(Rn[0])['target-range-address']);
-					Sheets[_Ref[0]]['!autofilter'] = { ref:_Ref[1] };
+					if(Object.prototype.hasOwnProperty.call(Sheets, _Ref[0]) && Sheets[_Ref[0]]) {
+						Sheets[_Ref[0]]['!autofilter'] = { ref:_Ref[1] };
+					}
 				} catch(e) {/* empty */}
 				break;
 
@@ -25572,7 +26050,7 @@ var write_content_ods/*:{(wb:any, opts:any):string}*/ = /* @__PURE__ */(function
 
 		/* column styles */
 		var cidx = 0;
-		wb.SheetNames.map(function(n) { return wb.Sheets[n]; }).forEach(function(ws) {
+		wb.SheetNames.map(function(n) { return sheet_map_get(wb.Sheets, n); }).forEach(function(ws) {
 			if(!ws) return;
 			if(ws["!cols"]) {
 				for(var C = 0; C < ws["!cols"].length; ++C) if(ws["!cols"][C]) {
@@ -25591,7 +26069,7 @@ var write_content_ods/*:{(wb:any, opts:any):string}*/ = /* @__PURE__ */(function
 
 		/* row styles */
 		var ridx = 0;
-		wb.SheetNames.map(function(n) { return wb.Sheets[n]; }).forEach(function(ws) {
+		wb.SheetNames.map(function(n) { return sheet_map_get(wb.Sheets, n); }).forEach(function(ws) {
 			if(!ws) return;
 			if(ws["!rows"]) {
 				for(var R = 0; R < ws["!rows"].length; ++R) if(ws["!rows"][R]) {
@@ -25624,7 +26102,7 @@ var write_content_ods/*:{(wb:any, opts:any):string}*/ = /* @__PURE__ */(function
 		/* number formats, table cells, text */
 		var nfs = {};
 		var nfi = 69;
-		wb.SheetNames.map(function(n) { return wb.Sheets[n]; }).forEach(function(ws) {
+		wb.SheetNames.map(function(n) { return sheet_map_get(wb.Sheets, n); }).forEach(function(ws) {
 			if(!ws) return;
 			var dense = (ws["!data"] != null);
 			if(!ws["!ref"]) return;
@@ -25707,7 +26185,7 @@ var write_content_ods/*:{(wb:any, opts:any):string}*/ = /* @__PURE__ */(function
 		o.push('  <office:body>\n');
 		o.push('    <office:spreadsheet>\n');
 		if(((wb.Workbook||{}).WBProps||{}).date1904) o.push('      <table:calculation-settings table:case-sensitive="false" table:search-criteria-must-apply-to-whole-cell="true" table:use-wildcards="true" table:use-regular-expressions="false" table:automatic-find-labels="false">\n        <table:null-date table:date-value="1904-01-01"/>\n      </table:calculation-settings>\n');
-		for(var i = 0; i != wb.SheetNames.length; ++i) o.push(write_ws(wb.Sheets[wb.SheetNames[i]], wb, i, opts, nfs, ((wb.Workbook||{}).WBProps||{}).date1904));
+		for(var i = 0; i != wb.SheetNames.length; ++i) o.push(write_ws(sheet_map_get(wb.Sheets, wb.SheetNames[i]), wb, i, opts, nfs, ((wb.Workbook||{}).WBProps||{}).date1904));
 		if((wb.Workbook||{}).Names) o.push(write_names_ods(wb.Workbook.Names, wb.SheetNames, -1));
 		o.push('    </office:spreadsheet>\n');
 		o.push('  </office:body>\n');
@@ -25759,7 +26237,6 @@ function write_ods(wb/*:any*/, opts/*:any*/) {
 
 	return zip;
 }
-
 /*! sheetjs (C) 2013-present SheetJS -- http://sheetjs.com */
 var subarray = function() {
   try {
@@ -27277,7 +27754,7 @@ function write_numbers_iwa(wb, opts) {
       docroot = numbers_iwa_find(cfb, deps, 1);
       sheetrefs = mappa(parse_shallow(docroot.messages[0].data)[1], parse_TSP_Reference);
     }
-    write_numbers_ws(cfb, deps, wb.Sheets[name], name, idx, sheetrefs[idx]);
+    write_numbers_ws(cfb, deps, sheet_map_get(wb.Sheets, name), name, idx, sheetrefs[idx]);
   });
   return cfb;
 }
@@ -28195,7 +28672,8 @@ function safe_parse_sheet(zip, path/*:string*/, relsPath/*:string*/, sheet, idx/
 			case 'dialog': _ws = parse_ds(data, path, idx, opts, sheetRels[sheet], wb, themes, styles); break;
 			default: throw new Error("Unrecognized sheet type " + stype);
 		}
-		sheets[sheet] = _ws;
+		if(stype == "sheet") parse_sheet_tables(_ws, zip, path, sheetRels[sheet], opts, themes, styles);
+		sheet_map_set(sheets, sheet, _ws);
 
 		/* scan rels for comments and threaded comments */
 		var comments = [], tcomments = [];
@@ -28215,7 +28693,9 @@ function safe_parse_sheet(zip, path/*:string*/, relsPath/*:string*/, sheet, idx/
 		if(tcomments && tcomments.length) sheet_insert_comments(_ws, tcomments, true, opts.people || []);
 		if(stype == "sheet") parse_sheet_drawing(_ws, stype, zip, path, idx, opts, wb);
 		parse_sheet_legacy_drawing(_ws, stype, zip, path, idx, opts, wb, comments);
-	} catch(e) { if(opts.WTF) throw e; }
+	} catch(e) {
+		if(opts.WTF || (opts.validateMerges && e && /^E_MERGE_/.test(e.code))) throw e;
+	}
 }
 
 function strip_front_slash(x/*:string*/)/*:string*/ { return x.charAt(0) == '/' ? x.slice(1) : x; }
@@ -28318,7 +28798,7 @@ function parse_zip(zip/*:ZIP*/, opts/*:?ParseOpts*/)/*:Workbook*/ {
 		if(opts.bookSheets && typeof sheets !== 'undefined') out.SheetNames = sheets;
 		if(opts.bookSheets ? out.SheetNames : opts.bookProps) return out;
 	}
-	sheets = {};
+	sheets = sheet_map_new();
 
 	var deps = {};
 	if(opts.bookDeps && dir.calcchain) deps=parse_cc(getzipdata(zip, strip_front_slash(dir.calcchain)),dir.calcchain,opts);
@@ -28521,7 +29001,7 @@ function write_zip_xlsb(wb/*:Workbook*/, opts/*:WriteOpts*/)/*:ZIP*/ {
 
 	for(rId=1;rId <= wb.SheetNames.length; ++rId) {
 		var wsrels = {'!id':{}};
-		var ws = wb.Sheets[wb.SheetNames[rId-1]];
+		var ws = sheet_map_get(wb.Sheets, wb.SheetNames[rId-1]);
 		var _type = (ws || {})["!type"] || "sheet";
 		switch(_type) {
 		case "chart":
@@ -28677,7 +29157,7 @@ function write_zip_xlsx(wb/*:Workbook*/, opts/*:WriteOpts*/)/*:ZIP*/ {
 
 	for(rId=1;rId <= wb.SheetNames.length; ++rId) {
 		var wsrels = {'!id':{}};
-		var ws = wb.Sheets[wb.SheetNames[rId-1]];
+		var ws = sheet_map_get(wb.Sheets, wb.SheetNames[rId-1]);
 		var _type = (ws || {})["!type"] || "sheet";
 		switch(_type) {
 		case "chart":
@@ -28773,7 +29253,6 @@ function write_zip_xlsx(wb/*:Workbook*/, opts/*:WriteOpts*/)/*:ZIP*/ {
 	delete opts.revssf; delete opts.ssf;
 	return zip;
 }
-
 function firstbyte(f/*:RawData*/,o/*:?TypeOpts*/)/*:Array<number>*/ {
 	var x = "";
 	switch((o||{}).type || "base64") {
@@ -29043,18 +29522,18 @@ function writeSync(wb/*:Workbook*/, opts/*:?WriteOpts*/) {
 		case 'xml':
 		case 'xlml': return write_string_type(write_xlml(wb, o), o);
 		case 'slk':
-		case 'sylk': return write_string_type(SYLK.from_sheet(wb.Sheets[wb.SheetNames[idx]], o, wb), o);
+		case 'sylk': return write_string_type(SYLK.from_sheet(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o, wb), o);
 		case 'htm':
-		case 'html': return write_string_type(sheet_to_html(wb.Sheets[wb.SheetNames[idx]], o), o);
-		case 'txt': return write_stxt_type(sheet_to_txt(wb.Sheets[wb.SheetNames[idx]], o), o);
-		case 'csv': return write_string_type(sheet_to_csv(wb.Sheets[wb.SheetNames[idx]], o), o, "\ufeff");
-		case 'dif': return write_string_type(DIF.from_sheet(wb.Sheets[wb.SheetNames[idx]], o), o);
-		case 'dbf': return write_binary_type(DBF.from_sheet(wb.Sheets[wb.SheetNames[idx]], o), o);
-		case 'prn': return write_string_type(PRN.from_sheet(wb.Sheets[wb.SheetNames[idx]], o), o);
-		case 'rtf': return write_string_type(sheet_to_rtf(wb.Sheets[wb.SheetNames[idx]], o), o);
-		case 'eth': return write_string_type(ETH.from_sheet(wb.Sheets[wb.SheetNames[idx]], o), o);
+		case 'html': return write_string_type(sheet_to_html(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
+		case 'txt': return write_stxt_type(sheet_to_txt(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
+		case 'csv': return write_string_type(sheet_to_csv(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o, "\ufeff");
+		case 'dif': return write_string_type(DIF.from_sheet(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
+		case 'dbf': return write_binary_type(DBF.from_sheet(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
+		case 'prn': return write_string_type(PRN.from_sheet(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
+		case 'rtf': return write_string_type(sheet_to_rtf(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
+		case 'eth': return write_string_type(ETH.from_sheet(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
 		case 'fods': return write_string_type(write_ods(wb, o), o);
-		case 'wk1': return write_binary_type(WK_.sheet_to_wk1(wb.Sheets[wb.SheetNames[idx]], o), o);
+		case 'wk1': return write_binary_type(WK_.sheet_to_wk1(sheet_map_get(wb.Sheets, wb.SheetNames[idx]), o), o);
 		case 'wk3': return write_binary_type(WK_.book_to_wk3(wb, o), o);
 		case 'biff2': if(!o.biff) o.biff = 2; /* falls through */
 		case 'biff3': if(!o.biff) o.biff = 3; /* falls through */
@@ -29320,6 +29799,7 @@ function sheet_add_json(_ws/*:?Worksheet*/, js/*:Array<any>*/, opts)/*:Worksheet
 			var _origin/*:CellAddress*/ = typeof o.origin == "string" ? decode_cell(o.origin) : o.origin;
 			_R = _origin.r; _C = _origin.c;
 		}
+		if(!isFinite(_R) || _R !== Math.floor(_R) || _R < -1 || !isFinite(_C) || _C !== Math.floor(_C) || _C < 0) throw new Error("Invalid origin");
 	}
 	var range/*:Range*/ = ({s: {c:0, r:0}, e: {c:_C, r:_R + js.length - 1 + offset}}/*:any*/);
 	if(ws['!ref']) {
@@ -29411,7 +29891,7 @@ function wb_sheet_idx(wb/*:Workbook*/, sh/*:number|string*/) {
 
 /* simple blank or single-sheet workbook object */
 function book_new(ws/*:?Worksheet*/, wsname/*:?string*/)/*:Workbook*/ {
-	var wb = { SheetNames: [], Sheets: {} };
+	var wb = { SheetNames: [], Sheets: sheet_map_new() };
 	if(ws) book_append_sheet(wb, ws, wsname || "Sheet1");
 	return wb;
 }
@@ -29431,7 +29911,7 @@ function book_append_sheet(wb/*:Workbook*/, ws/*:Worksheet*/, name/*:?string*/,
 	if(wb.SheetNames.indexOf(name) >= 0) throw new Error("Worksheet with name |" + name + "| already exists!");
 
 	wb.SheetNames.push(name);
-	wb.Sheets[name] = ws;
+	sheet_map_set(wb.Sheets, name, ws);
 	return name;
 }
 
@@ -29498,7 +29978,6 @@ function sheet_set_array_formula(ws/*:Worksheet*/, range, formula/*:string*/, dy
 	ws["!ref"] = encode_range(wsr);
 	return ws;
 }
-
 var utils/*:any*/ = {
 	encode_col: encode_col,
 	encode_row: encode_row,
@@ -29528,6 +30007,7 @@ var utils/*:any*/ = {
 	measure_text_width: measure_text_width,
 	auto_fit_columns: auto_fit_columns,
 	autofit_columns: auto_fit_columns,
+	resolve_table_cell_style: resolve_table_cell_style,
 	col_width_to_px: width2px,
 	px_to_col_width: function(px) { return char2width(px2char(px)); },
 	row_height_to_px: pt2px_browser,
@@ -29655,7 +30135,7 @@ function write_json_stream(sheet/*:Worksheet*/, opts/*:?Sheet2CSVOpts*/) {
 			if ((rowinfo[R]||{}).hidden) {
 				++R;
 				continue;
-			};
+			}
 			var row = make_json_row(sheet, r, R, cols, header, hdr, o);
 			++R;
 			if((row.isempty === false) || (header === 1 ? o.blankrows !== false : !!o.blankrows)) {
@@ -29684,7 +30164,7 @@ function write_xlml_stream(wb/*:Workbook*/, o/*:?Sheet2XLMLOpts*/) {
 
 	/* do one pass to determine styles since they must be added before tables */
 	wb.SheetNames.forEach(function(n) {
-		var ws = wb.Sheets[n];
+		var ws = sheet_map_get(wb.Sheets, n);
 		if(!ws || !ws["!ref"]) return;
 		var range = decode_range(ws["!ref"]);
 		var dense = ws["!data"] != null;
@@ -29704,7 +30184,7 @@ function write_xlml_stream(wb/*:Workbook*/, o/*:?Sheet2XLMLOpts*/) {
 	});
 	var sty = write_sty_xlml(wb, opts);
 
-	var stage = 0, wsidx = 0, ws = wb.Sheets[wb.SheetNames[wsidx]], range = safe_decode_range(ws), R = -1, T = false;
+	var stage = 0, wsidx = 0, ws = sheet_map_get(wb.Sheets, wb.SheetNames[wsidx]), range = safe_decode_range(ws), R = -1, T = false;
 
 	var marr = [], mi = 0, dense = false, darr = [], addr = {r:0,c:0};
 
@@ -29744,7 +30224,7 @@ function write_xlml_stream(wb/*:Workbook*/, o/*:?Sheet2XLMLOpts*/) {
 
 			stream.push("<Worksheet" + wxt_helper({ "ss:Name": escapexml(wb.SheetNames[wsidx])}) + ">");
 
-			ws = wb.Sheets[wb.SheetNames[wsidx]];
+			ws = sheet_map_get(wb.Sheets, wb.SheetNames[wsidx]);
 			if(!ws) { stream.push("</Worksheet>"); return void ++wsidx; }
 
 			var names = write_ws_xlml_names(ws, opts, wsidx, wb);