xlvane 1.0.0 → 1.0.1

package/README.md

@@ -6,7 +6,7 @@ Read, inspect and write XLSX files; input files are treated as untrusted. ESM on
 npm install xlvane
 ```
 
-The package also contains `docs/` (error codes, JSON schemas, exceljs compatibility), the Agent Skill `skills/xlvane/SKILL.md` and `llms-full.txt` (all of it in one file), for reading without network access: after installing, they are in `node_modules/xlvane/`. Links below point to the same files on GitHub.
+The package also contains `docs/` (error codes, JSON schemas, exceljs compatibility), the Agent Skill `skills/xlvane/SKILL.md` and `llms-full.txt` (all of it in one file), for reading without network access: after installing, they are in `node_modules/xlvane/`. Links below point to the same files on GitHub. The skill can be installed into a project with the [`skills`](https://github.com/vercel-labs/skills) CLI, offline: `npx skills add ./node_modules/xlvane/skills --skill xlvane`.
 
 ## Quick start
 
@@ -30,12 +30,12 @@ From a shell: `npx xlvane inspect orders.xlsx`, then `npx xlvane read orders.xls
 - [Tasks in one call](#tasks-in-one-call): tables of rows, CSV, JSON, editing files, diff · [inserting and deleting rows](#inserting-and-deleting-rows)
 - [Large files: streaming](#large-files-streaming)
 - [Inspecting a workbook](#inspecting-a-workbook) · [Errors and warnings](#errors-and-warnings) · [Untrusted input and limits](#untrusted-input-and-limits)
-- [Limitations](#limitations) · [Package size](#package-size)
+- [Limitations](#limitations) · [Package size](#package-size) · [Links](#links)
 - exceljs users: [`@xlvane/compat`](https://www.npmjs.com/package/@xlvane/compat) and `xlvane migrate`
 
 ## Tested environments
 
-The core API (reading, writing, inspect, tables, CSV, editing, diff, streaming with Web Streams) and `@xlvane/compat` are tested in Node.js 22, 24 and 26, Bun, Deno, Chromium (Playwright) and the Cloudflare Workers runtime (workerd), with the same test bundle (`npm run test:runtimes`). Reading is tested on 340 files of the Apache POI test corpus (written by Excel for Windows, Mac and the web, LibreOffice, ONLYOFFICE and others, and damaged files) and on files saved by LibreOffice; see `tests/corpus/`.
+The core API (reading, writing, inspect, tables, CSV, editing, diff, streaming with Web Streams) and `@xlvane/compat` are tested in Node.js 22, 24 and 26, Bun, Deno, Chromium (Playwright) and the Cloudflare Workers runtime (workerd), with the same test bundle (`npm run test:runtimes`). In Deno, import from `npm:xlvane`; in browsers and Workers, through a bundler such as Vite, esbuild or webpack. `xlvane/node` and the command line need Node.js. Reading is tested on 340 files of the Apache POI test corpus (written by Excel for Windows, Mac and the web, LibreOffice, ONLYOFFICE and others, and damaged files) and on files saved by LibreOffice; see `tests/corpus/`.
 
 ## Command line in 5 minutes
 
@@ -335,7 +335,7 @@ const stream = writeWorkbookStream({ sheets: [{ name: 'Data', rows: rows() }] })
 
 ## Benchmark
 
-100 000 rows × 20 columns (numbers, texts, dates, booleans). Median of 5 runs, each in a fresh Node.js 22.22.0 process. Machine: Intel Xeon @ 2.10 GHz, 4 logical cores, 15.7 GiB RAM, Linux (a cloud VM). Measured on 2026-10-30. Peak RSS includes Node.js and the imported libraries; the baseline with all three libraries imported is 135 MiB. Method, raw data and caveats: [bench/perf/RESULTS.md](../../bench/perf/RESULTS.md). Reproduce with `npm run bench`.
+100 000 rows × 20 columns (numbers, texts, dates, booleans). Median of 5 runs, each in a fresh Node.js 22.22.0 process. Machine: Intel Xeon @ 2.10 GHz, 4 logical cores, 15.7 GiB RAM, Linux (a cloud VM). Measured on 2026-10-30. Peak RSS includes Node.js and the imported libraries; the baseline with all three libraries imported is 135 MiB. Method, raw data and caveats: [bench/perf/RESULTS.md](https://github.com/DevXord/xlvane/blob/main/bench/perf/RESULTS.md). Reproduce with `npm run bench`.
 
 | Write | Time, s | Peak RSS, MiB | | Read | Time, s | Peak RSS, MiB |
 |---|---|---|---|---|---|---|
@@ -392,7 +392,7 @@ Limits can be changed per call, for example `readWorkbook(bytes, { limits: { max
 
 ## Package size
 
-**Size budget:** 300 kB of gzip-compressed JavaScript for the library files in `dist/` (level 9, unminified as published; measured 208.6 kB on 2026-10-31). **CLI size budget:** 40 kB for `dist/cli.js`, which is not loaded by `import 'xlvane'` (measured 25.7 kB on 2026-10-31). `npm run check:pkg` fails when the budget is exceeded. The only dependency, fflate, adds about 22 kB gzip (its `esm/browser.js`, measured the same way).
+**Size budget:** 300 kB of gzip-compressed JavaScript for the library files in `dist/` (level 9, unminified as published; measured 209.1 kB for 1.0.0). **CLI size budget:** 40 kB for `dist/cli.js`, which is not loaded by `import 'xlvane'` (measured 27.3 kB for 1.0.0). `npm run check:pkg` fails when the budget is exceeded. The only dependency, fflate, adds about 22 kB gzip (its `esm/browser.js`, measured the same way).
 
 ## Limitations
 
@@ -401,4 +401,10 @@ Limits can be changed per call, for example `readWorkbook(bytes, { limits: { max
 - Charts, shapes, pivot tables, slicers and form controls are not modelled: reading skips them (with a warning for drawings), `editCells` keeps them unchanged, and row operations refuse sheets where they would have to move.
 - The command line reads files, not standard input.
 
+## Links
+
+- Changes in each version: [CHANGELOG.md](https://github.com/DevXord/xlvane/blob/main/CHANGELOG.md)
+- Bugs and questions: [GitHub issues](https://github.com/DevXord/xlvane/issues)
+- Reporting a vulnerability: [SECURITY.md](https://github.com/DevXord/xlvane/blob/main/SECURITY.md)
+
 License: MIT

package/dist/cli.js

@@ -1519,23 +1519,15 @@ const MAX_FILE_BYTES = 2097152;
 * exceljs API that @xlvane/compat does not support or supports only partly
 * (docs/exceljs-compat.md). Matching is textual, so a hit is a place to look at, not proof.
 */
-const PATTERNS = [
-	{
-		api: "addImage({ filename })",
-		status: "not supported",
-		re: /\.addImage\s*\(\s*\{\s*filename\b/
-	},
-	{
-		api: "ModelContainer",
-		status: "not supported",
-		re: /\bModelContainer\b/
-	},
-	{
-		api: "deep import (exceljs/lib/...)",
-		status: "not supported",
-		re: /['"]exceljs\/lib\/[^'"]*['"]/
-	}
-];
+const PATTERNS = [{
+	api: "ModelContainer",
+	status: "not supported",
+	re: /\bModelContainer\b/
+}, {
+	api: "deep import (exceljs/lib/...)",
+	status: "not supported",
+	re: /['"]exceljs\/lib\/[^'"]*['"]/
+}];
 async function sourceFiles(root) {
 	const files = [];
 	let limited = false;

package/docs/exceljs-compat.md

@@ -151,6 +151,7 @@ Status: **supported** means the same behaviour as exceljs for the cases covered
 | Named ESM imports | extra | Not available with exceljs 4.4.0. |
 | `exceljs/dist/es5`, `exceljs/dist/es5/index.js`, `exceljs/dist/exceljs.js`, `exceljs/dist/exceljs.min.js`, `exceljs/dist/exceljs.bare.js`, `exceljs/dist/exceljs.bare.min.js` | supported | Mapped to the main entry in the package's `exports` (an ES module; `require()` needs Node.js 22.12+). exceljs's files there are an ES5 build and UMD browser bundles; the API is the same (X4-26). |
 | Other deep imports (`exceljs/lib/...`) | not supported | Internal files of exceljs; not offered. |
+| `ModelContainer` | not supported | exceljs exports it as a holder of a workbook model with an `xlsx` property (`lib/exceljs.nodejs.js` L3, `lib/doc/modelcontainer.js`). The class is on the module object so that code referring to it loads; constructing it throws `XLV_E_NOT_SUPPORTED`. `xlvane migrate` lists its uses. |
 | `RelationshipType`, `DocumentType`, `ReadingOrder` | supported | The enums of `lib/doc/enums.js`, on the module object and as named exports. |
 | `PaperSize` | supported | exceljs declares it as a `const enum` in index.d.ts (inlined by TypeScript, absent at run time); @xlvane/compat exports it as an object and on the default export. |
 | TypeScript types (`ExcelJS.Worksheet`, `ExcelJS.Fill`, `ExcelJS.stream.xlsx.WorkbookWriterOptions`, …) | supported | The type names of exceljs's index.d.ts are exported and usable through `import * as ExcelJS`, `import ExcelJS from`, and `import ExcelJS = require('exceljs')`, under `moduleResolution` bundler, nodenext (ESM and CommonJS) and `module: commonjs` (`tests/exceljs/types-compat.test.ts`, which type-checks code from the exceljs README). In a CommonJS project TypeScript refuses `import ExcelJS = require(...)` of an ES module under `module: node16` (TS1471, checked with TypeScript 5.9.3); `module: nodenext` and `module: commonjs` accept it. `Buffer` is `Uint8Array`. Enums (`ValueType`, `FormulaType`, `ErrorValue`, `PaperSize`) are also types. `WorkbookStreamReaderOptions` is an alias of `WorkbookReaderOptions`. As in exceljs's declarations, `getTable(name)` returns `Table`, `workbook.getImage(id)` returns `Image`, `getImages()[i].range` is required and `fillFormula`'s `results` is `(row, col) => value`, a flat or a 2-D array (index.d.ts L1327, L1342–1346, L1365, L1780); at run time an unknown table name or image id gives `undefined`, as in exceljs. The module object is frozen: adding or replacing its properties (monkey-patching) has no effect. |

package/llms-full.txt

@@ -1,4 +1,4 @@
-# xlvane 1.0.0: documentation in one file
+# xlvane 1.0.1: documentation in one file
 
 This file joins the README of the xlvane package, the Agent Skill and the documentation in docs/. It is generated by scripts/package-docs.mjs; the separate files are in the same package.
 
@@ -12,7 +12,7 @@ Read, inspect and write XLSX files; input files are treated as untrusted. ESM on
 npm install xlvane
 ```
 
-The package also contains `docs/` (error codes, JSON schemas, exceljs compatibility), the Agent Skill `skills/xlvane/SKILL.md` and `llms-full.txt` (all of it in one file), for reading without network access: after installing, they are in `node_modules/xlvane/`. Links below point to the same files on GitHub.
+The package also contains `docs/` (error codes, JSON schemas, exceljs compatibility), the Agent Skill `skills/xlvane/SKILL.md` and `llms-full.txt` (all of it in one file), for reading without network access: after installing, they are in `node_modules/xlvane/`. Links below point to the same files on GitHub. The skill can be installed into a project with the [`skills`](https://github.com/vercel-labs/skills) CLI, offline: `npx skills add ./node_modules/xlvane/skills --skill xlvane`.
 
 ## Quick start
 
@@ -36,12 +36,12 @@ From a shell: `npx xlvane inspect orders.xlsx`, then `npx xlvane read orders.xls
 - [Tasks in one call](#tasks-in-one-call): tables of rows, CSV, JSON, editing files, diff · [inserting and deleting rows](#inserting-and-deleting-rows)
 - [Large files: streaming](#large-files-streaming)
 - [Inspecting a workbook](#inspecting-a-workbook) · [Errors and warnings](#errors-and-warnings) · [Untrusted input and limits](#untrusted-input-and-limits)
-- [Limitations](#limitations) · [Package size](#package-size)
+- [Limitations](#limitations) · [Package size](#package-size) · [Links](#links)
 - exceljs users: [`@xlvane/compat`](https://www.npmjs.com/package/@xlvane/compat) and `xlvane migrate`
 
 ## Tested environments
 
-The core API (reading, writing, inspect, tables, CSV, editing, diff, streaming with Web Streams) and `@xlvane/compat` are tested in Node.js 22, 24 and 26, Bun, Deno, Chromium (Playwright) and the Cloudflare Workers runtime (workerd), with the same test bundle (`npm run test:runtimes`). Reading is tested on 340 files of the Apache POI test corpus (written by Excel for Windows, Mac and the web, LibreOffice, ONLYOFFICE and others, and damaged files) and on files saved by LibreOffice; see `tests/corpus/`.
+The core API (reading, writing, inspect, tables, CSV, editing, diff, streaming with Web Streams) and `@xlvane/compat` are tested in Node.js 22, 24 and 26, Bun, Deno, Chromium (Playwright) and the Cloudflare Workers runtime (workerd), with the same test bundle (`npm run test:runtimes`). In Deno, import from `npm:xlvane`; in browsers and Workers, through a bundler such as Vite, esbuild or webpack. `xlvane/node` and the command line need Node.js. Reading is tested on 340 files of the Apache POI test corpus (written by Excel for Windows, Mac and the web, LibreOffice, ONLYOFFICE and others, and damaged files) and on files saved by LibreOffice; see `tests/corpus/`.
 
 ## Command line in 5 minutes
 
@@ -341,7 +341,7 @@ const stream = writeWorkbookStream({ sheets: [{ name: 'Data', rows: rows() }] })
 
 ## Benchmark
 
-100 000 rows × 20 columns (numbers, texts, dates, booleans). Median of 5 runs, each in a fresh Node.js 22.22.0 process. Machine: Intel Xeon @ 2.10 GHz, 4 logical cores, 15.7 GiB RAM, Linux (a cloud VM). Measured on 2026-10-30. Peak RSS includes Node.js and the imported libraries; the baseline with all three libraries imported is 135 MiB. Method, raw data and caveats: [bench/perf/RESULTS.md](../../bench/perf/RESULTS.md). Reproduce with `npm run bench`.
+100 000 rows × 20 columns (numbers, texts, dates, booleans). Median of 5 runs, each in a fresh Node.js 22.22.0 process. Machine: Intel Xeon @ 2.10 GHz, 4 logical cores, 15.7 GiB RAM, Linux (a cloud VM). Measured on 2026-10-30. Peak RSS includes Node.js and the imported libraries; the baseline with all three libraries imported is 135 MiB. Method, raw data and caveats: [bench/perf/RESULTS.md](https://github.com/DevXord/xlvane/blob/main/bench/perf/RESULTS.md). Reproduce with `npm run bench`.
 
 | Write | Time, s | Peak RSS, MiB | | Read | Time, s | Peak RSS, MiB |
 |---|---|---|---|---|---|---|
@@ -398,7 +398,7 @@ Limits can be changed per call, for example `readWorkbook(bytes, { limits: { max
 
 ## Package size
 
-**Size budget:** 300 kB of gzip-compressed JavaScript for the library files in `dist/` (level 9, unminified as published; measured 208.6 kB on 2026-10-31). **CLI size budget:** 40 kB for `dist/cli.js`, which is not loaded by `import 'xlvane'` (measured 25.7 kB on 2026-10-31). `npm run check:pkg` fails when the budget is exceeded. The only dependency, fflate, adds about 22 kB gzip (its `esm/browser.js`, measured the same way).
+**Size budget:** 300 kB of gzip-compressed JavaScript for the library files in `dist/` (level 9, unminified as published; measured 209.1 kB for 1.0.0). **CLI size budget:** 40 kB for `dist/cli.js`, which is not loaded by `import 'xlvane'` (measured 27.3 kB for 1.0.0). `npm run check:pkg` fails when the budget is exceeded. The only dependency, fflate, adds about 22 kB gzip (its `esm/browser.js`, measured the same way).
 
 ## Limitations
 
@@ -407,6 +407,12 @@ Limits can be changed per call, for example `readWorkbook(bytes, { limits: { max
 - Charts, shapes, pivot tables, slicers and form controls are not modelled: reading skips them (with a warning for drawings), `editCells` keeps them unchanged, and row operations refuse sheets where they would have to move.
 - The command line reads files, not standard input.
 
+## Links
+
+- Changes in each version: [CHANGELOG.md](https://github.com/DevXord/xlvane/blob/main/CHANGELOG.md)
+- Bugs and questions: [GitHub issues](https://github.com/DevXord/xlvane/issues)
+- Reporting a vulnerability: [SECURITY.md](https://github.com/DevXord/xlvane/blob/main/SECURITY.md)
+
 License: MIT
 
 <!-- file: skills/xlvane/SKILL.md -->
@@ -1348,6 +1354,7 @@ Status: **supported** means the same behaviour as exceljs for the cases covered
 | Named ESM imports | extra | Not available with exceljs 4.4.0. |
 | `exceljs/dist/es5`, `exceljs/dist/es5/index.js`, `exceljs/dist/exceljs.js`, `exceljs/dist/exceljs.min.js`, `exceljs/dist/exceljs.bare.js`, `exceljs/dist/exceljs.bare.min.js` | supported | Mapped to the main entry in the package's `exports` (an ES module; `require()` needs Node.js 22.12+). exceljs's files there are an ES5 build and UMD browser bundles; the API is the same (X4-26). |
 | Other deep imports (`exceljs/lib/...`) | not supported | Internal files of exceljs; not offered. |
+| `ModelContainer` | not supported | exceljs exports it as a holder of a workbook model with an `xlsx` property (`lib/exceljs.nodejs.js` L3, `lib/doc/modelcontainer.js`). The class is on the module object so that code referring to it loads; constructing it throws `XLV_E_NOT_SUPPORTED`. `xlvane migrate` lists its uses. |
 | `RelationshipType`, `DocumentType`, `ReadingOrder` | supported | The enums of `lib/doc/enums.js`, on the module object and as named exports. |
 | `PaperSize` | supported | exceljs declares it as a `const enum` in index.d.ts (inlined by TypeScript, absent at run time); @xlvane/compat exports it as an object and on the default export. |
 | TypeScript types (`ExcelJS.Worksheet`, `ExcelJS.Fill`, `ExcelJS.stream.xlsx.WorkbookWriterOptions`, …) | supported | The type names of exceljs's index.d.ts are exported and usable through `import * as ExcelJS`, `import ExcelJS from`, and `import ExcelJS = require('exceljs')`, under `moduleResolution` bundler, nodenext (ESM and CommonJS) and `module: commonjs` (`tests/exceljs/types-compat.test.ts`, which type-checks code from the exceljs README). In a CommonJS project TypeScript refuses `import ExcelJS = require(...)` of an ES module under `module: node16` (TS1471, checked with TypeScript 5.9.3); `module: nodenext` and `module: commonjs` accept it. `Buffer` is `Uint8Array`. Enums (`ValueType`, `FormulaType`, `ErrorValue`, `PaperSize`) are also types. `WorkbookStreamReaderOptions` is an alias of `WorkbookReaderOptions`. As in exceljs's declarations, `getTable(name)` returns `Table`, `workbook.getImage(id)` returns `Image`, `getImages()[i].range` is required and `fillFormula`'s `results` is `(row, col) => value`, a flat or a 2-D array (index.d.ts L1327, L1342–1346, L1365, L1780); at run time an unknown table name or image id gives `undefined`, as in exceljs. The module object is frozen: adding or replacing its properties (monkey-patching) has no effect. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xlvane",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Read, inspect and write XLSX files; input is treated as untrusted. ESM only, one runtime dependency (fflate).",
   "keywords": [
     "xlsx",