xlvane 1.0.1 → 1.1.1

package/dist/cli.js

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
-import { It as suggest, Sn as XlvError, _ as isoDate, an as parseRange, b as readWorkbook, g as inspect } from "./options-B7UhudO_.js";
-import { a as appendRows, c as fromCSV, d as fromJSON, f as pickSheet, h as toJSON, l as inferValue, n as insertRows, o as editCells, p as readTable, s as diff, t as deleteRows, u as toCSV } from "./rows-Cwte1t8m.js";
-import { i as readInput } from "./node-files-uazELnqk.js";
+import { On as XlvError, Vt as suggest, _ as isoDate, b as readWorkbook, dn as parseRange, g as inspect } from "./options-Ba6r4zP1.js";
+import { a as appendRows, c as fromCSV, d as fromJSON, f as pickSheet, h as toJSON, l as inferValue, n as insertRows, o as editCells, p as readTable, s as diff, t as deleteRows, u as toCSV } from "./rows-Biu_ddwz.js";
+import { i as readInput } from "./node-files-CsQVpKgP.js";
 import { existsSync, readFileSync } from "node:fs";
-import { chmod, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, lstat, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import process from "node:process";
-import { parseArgs, styleText } from "node:util";
+import { createRequire } from "node:module";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
+// src/cli/node-util.ts
+/** The `node:util` module. */
+const nodeUtil = createRequire(import.meta.url)("node:util");
 // src/cli/args.ts
 /** Options every command accepts. */
 const GLOBAL_OPTIONS = {
@@ -64,7 +67,7 @@ function parseCommandArgs(spec, args) {
 		...o.short ? { short: o.short } : {},
 		...o.multiple ? { multiple: true } : {}
 	};
-	const { tokens } = parseArgs({
+	const { tokens } = nodeUtil.parseArgs({
 		args: [...args],
 		options: config,
 		strict: false,
@@ -166,6 +169,259 @@ function headerOption(args, command) {
 		option: "--header"
 	});
 }
+// src/cli/east-asian-width.ts
+/**
+* Code points whose East_Asian_Width is Wide (W) or Fullwidth (F), including the unassigned code
+* points that default to W, as sorted pairs of first and last code point. Unicode 17.0.0.
+*/
+const EAST_ASIAN_WIDE = [
+	4352,
+	4447,
+	8986,
+	8987,
+	9001,
+	9002,
+	9193,
+	9196,
+	9200,
+	9200,
+	9203,
+	9203,
+	9725,
+	9726,
+	9748,
+	9749,
+	9776,
+	9783,
+	9800,
+	9811,
+	9855,
+	9855,
+	9866,
+	9871,
+	9875,
+	9875,
+	9889,
+	9889,
+	9898,
+	9899,
+	9917,
+	9918,
+	9924,
+	9925,
+	9934,
+	9934,
+	9940,
+	9940,
+	9962,
+	9962,
+	9970,
+	9971,
+	9973,
+	9973,
+	9978,
+	9978,
+	9981,
+	9981,
+	9989,
+	9989,
+	9994,
+	9995,
+	10024,
+	10024,
+	10060,
+	10060,
+	10062,
+	10062,
+	10067,
+	10069,
+	10071,
+	10071,
+	10133,
+	10135,
+	10160,
+	10160,
+	10175,
+	10175,
+	11035,
+	11036,
+	11088,
+	11088,
+	11093,
+	11093,
+	11904,
+	11929,
+	11931,
+	12019,
+	12032,
+	12245,
+	12272,
+	12350,
+	12353,
+	12438,
+	12441,
+	12543,
+	12549,
+	12591,
+	12593,
+	12686,
+	12688,
+	12773,
+	12783,
+	12830,
+	12832,
+	12871,
+	12880,
+	42124,
+	42128,
+	42182,
+	43360,
+	43388,
+	44032,
+	55203,
+	63744,
+	64255,
+	65040,
+	65049,
+	65072,
+	65106,
+	65108,
+	65126,
+	65128,
+	65131,
+	65281,
+	65376,
+	65504,
+	65510,
+	94176,
+	94180,
+	94192,
+	94198,
+	94208,
+	101589,
+	101631,
+	101662,
+	101760,
+	101874,
+	110576,
+	110579,
+	110581,
+	110587,
+	110589,
+	110590,
+	110592,
+	110882,
+	110898,
+	110898,
+	110928,
+	110930,
+	110933,
+	110933,
+	110948,
+	110951,
+	110960,
+	111355,
+	119552,
+	119638,
+	119648,
+	119670,
+	126980,
+	126980,
+	127183,
+	127183,
+	127374,
+	127374,
+	127377,
+	127386,
+	127488,
+	127490,
+	127504,
+	127547,
+	127552,
+	127560,
+	127568,
+	127569,
+	127584,
+	127589,
+	127744,
+	127776,
+	127789,
+	127797,
+	127799,
+	127868,
+	127870,
+	127891,
+	127904,
+	127946,
+	127951,
+	127955,
+	127968,
+	127984,
+	127988,
+	127988,
+	127992,
+	128062,
+	128064,
+	128064,
+	128066,
+	128252,
+	128255,
+	128317,
+	128331,
+	128334,
+	128336,
+	128359,
+	128378,
+	128378,
+	128405,
+	128406,
+	128420,
+	128420,
+	128507,
+	128591,
+	128640,
+	128709,
+	128716,
+	128716,
+	128720,
+	128722,
+	128725,
+	128728,
+	128732,
+	128735,
+	128747,
+	128748,
+	128756,
+	128764,
+	128992,
+	129003,
+	129008,
+	129008,
+	129292,
+	129338,
+	129340,
+	129349,
+	129351,
+	129535,
+	129648,
+	129660,
+	129664,
+	129674,
+	129678,
+	129734,
+	129736,
+	129736,
+	129741,
+	129756,
+	129759,
+	129770,
+	129775,
+	129784,
+	131072,
+	196605,
+	196608,
+	262141
+];
 // src/cli/output.ts
 /**
 * Whether to colour a stream. `util.styleText` respects NO_COLOR, NODE_DISABLE_COLORS,
@@ -207,8 +463,15 @@ var Output = class {
 		this.color = color;
 		this.width = width;
 	}
+	/**
+	* Colour codes are written with {@link STYLE_MARK} in place of ESC, and an ESC already in the
+	* text (from a file) is escaped, so that the final filter ({@link terminalSafe}) can tell the
+	* CLI's own colour codes from the same bytes in a sheet name or cell (D-H01).
+	*/
 	style(format, text) {
-		return this.color && text !== "" ? styleText(format, text, { validateStream: false }) : text;
+		if (!this.color || text === "") return text;
+		const safe = text.includes("\x1B") ? text.split("\x1B").join("\\x1b") : text;
+		return nodeUtil.styleText(format, safe, { validateStream: false }).split("\x1B").join(STYLE_MARK);
 	}
 	bold(text) {
 		return this.style("bold", text);
@@ -230,11 +493,11 @@ var Output = class {
 	}
 	/**
 	* An aligned table. Columns are cut with "…" to fit `width`; the widest columns shrink first.
-	* Width is counted in UTF-16 code units, so wide characters may misalign (documented).
+	* Widths are display columns ({@link displayWidth}), so CJK text and emoji stay aligned.
 	*/
 	table(headers, rows, indent = "", align = []) {
 		const count = headers.length;
-		const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => oneLine(r[i] ?? "").length)));
+		const widths = headers.map((h, i) => Math.max(displayWidth(oneLine(h)), ...rows.map((r) => displayWidth(oneLine(r[i] ?? "")))));
 		const gap = 2;
 		const available = Math.max(count * 4, this.width - indent.length - gap * (count - 1));
 		let total = widths.reduce((a, b) => a + b, 0);
@@ -248,7 +511,8 @@ var Output = class {
 		const line = (cells, head) => indent + cells.map((c, i) => {
 			const w = widths[i] ?? 0;
 			const text = fit(oneLine(c), w);
-			const padded = align[i] === "right" && !head ? text.padStart(w) : i === count - 1 ? text : text.padEnd(w);
+			const pad = " ".repeat(Math.max(0, w - displayWidth(text)));
+			const padded = align[i] === "right" && !head ? pad + text : i === count - 1 ? text : text + pad;
 			return head ? this.bold(padded) : padded;
 		}).join(" ".repeat(gap)).trimEnd();
 		return [line(headers, true), ...rows.map((r) => line(r, false))].join("\n");
@@ -262,7 +526,8 @@ function oneLine(text) {
 * which includes the 8-bit CSI U+009B) written as `\x1b`, and bidirectional formatting characters
 * written as `\u202e`, so text from a file, such as a cell
 * holding `_x001B_]0;title_x0007_`, cannot move the cursor, change the window title or hide
-* output (docs/decisions.md D-R02). Used for all human-readable output; `--json` is unchanged.
+* output (docs/decisions.md D-R02). Used for all human-readable output; `--json` writes the same
+* characters as `\uXXXX` escapes instead (D-H01).
 */
 function escapeControls(text) {
 	return text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`).replace(BIDI, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
@@ -274,34 +539,110 @@ function escapeControls(text) {
 * `\u202e` in human-readable output, like other control characters (D-R08).
 */
 const BIDI = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
-/** The colour sequences `Output` writes (styleText: bold, dim, red, green, yellow, cyan and their resets). */
-const OWN_STYLES = /\u001b\[(?:1|2|22|31|32|33|36|39)m/y;
+/**
+* Stands for ESC in the colour codes `Output` writes until {@link terminalSafe} turns it back:
+* NUL and 16 random hexadecimal digits, new for each process, so text from a file cannot contain
+* it by chance or design. Before 1.1.1 the filter kept every ESC sequence that looked like one of
+* the CLI's colours, including ones from a sheet name (D-H01).
+*/
+const STYLE_MARK = `\u0000${Array.from(globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(8)), (b) => b.toString(16).padStart(2, "0")).join("")}`;
+/** The colour sequences `Output` writes (styleText: bold, dim, red, green, yellow, cyan and their resets), after the mark. */
+const OWN_STYLE = /^\[(?:1|2|22|31|32|33|36|39)m/;
+const MARKED_STYLE = new RegExp(`${STYLE_MARK}\\[[0-9;]*m`, "g");
 /**
 * Final filter for human-readable output: escapes every control character (see
-* {@link escapeControls}) except line feeds, tabs and, when `keepStyles` is true, the exact
-* colour sequences that `Output` itself writes. Applied to everything the CLI prints for people.
+* {@link escapeControls}) except line feeds and tabs. When `keepStyles` is true, the colour codes
+* that `Output` wrote (marked with {@link STYLE_MARK}) are turned into ESC sequences; any ESC in
+* the text itself is escaped. Applied to everything the CLI prints for people.
 */
 function terminalSafe(text, keepStyles) {
+	if (!text.includes(STYLE_MARK)) return controlsSafe(text);
+	const parts = text.split(STYLE_MARK);
+	let result = controlsSafe(parts[0] ?? "");
+	for (const part of parts.slice(1)) {
+		const own = OWN_STYLE.exec(part)?.[0];
+		if (own === void 0) result += controlsSafe(part);
+		else result += (keepStyles ? `\u001b${own}` : "") + controlsSafe(part.slice(own.length));
+	}
+	return result;
+}
+/** Escapes the control characters of text (see {@link escapeControls}) except line feeds and tabs. */
+function controlsSafe(text) {
 	let result = "";
 	let start = 0;
 	for (let i = 0; i < text.length; i++) {
 		const code = text.charCodeAt(i);
 		if (!(code < 32 && code !== 10 && code !== 9 || code >= 127 && code <= 159 || code === 1564 || code === 8206 || code === 8207 || code >= 8234 && code <= 8238 || code >= 8294 && code <= 8297)) continue;
-		if (keepStyles && code === 27) {
-			OWN_STYLES.lastIndex = i;
-			const m = OWN_STYLES.exec(text);
-			if (m !== null) {
-				i += m[0].length - 1;
-				continue;
-			}
-		}
 		result += text.slice(start, i) + escapeControls(text[i]);
 		start = i + 1;
 	}
 	return start === 0 ? text : result + text.slice(start);
 }
+/** Cuts text to `width` display columns with "…", between grapheme clusters. */
 function fit(text, width) {
-	return text.length <= width ? text : `${text.slice(0, Math.max(0, width - 1))}…`;
+	if (displayWidth(text) <= width) return text;
+	let result = "";
+	let used = 0;
+	for (const part of graphemes(text)) {
+		const w = displayWidth(part);
+		if (used + w > width - 1) break;
+		result += part;
+		used += w;
+	}
+	return `${result}…`;
+}
+/**
+* Grapheme clusters of a text (Intl.Segmenter), or its code points when the Node.js build has no
+* Intl support, so that cutting never splits a surrogate pair or a letter from its accent.
+*/
+function graphemes(text) {
+	if (segmenter === void 0) return Array.from(text);
+	return Array.from(segmenter.segment(text), (s) => s.segment);
+}
+const segmenter = typeof Intl === "object" && typeof Intl.Segmenter === "function" ? new Intl.Segmenter(void 0, { granularity: "grapheme" }) : void 0;
+/**
+* The number of terminal columns a text takes, counted as Node.js counts them for its own output
+* (src/node_i18n.cc GetColumnWidth, v22.23.4; F-UNICODE-01): East Asian Wide and Fullwidth
+* characters (Unicode East_Asian_Width W and F) and emoji with Emoji_Presentation take two
+* columns; control and format characters (except the soft hyphen), nonspacing and enclosing marks
+* and emoji modifiers that are not Wide take none; every other character, including East Asian
+* Ambiguous ones, takes one. Each code point of an emoji sequence is counted, as Node.js does by
+* default, so a terminal that draws the sequence as one picture shows it narrower. Colour codes
+* (`ESC [ … m`, as `Output` writes them) take no columns, as Node.js strips them first.
+*/
+function displayWidth(text) {
+	if (text.includes("\x1B")) text = text.replace(/\u001b\[[0-9;]*m/g, "");
+	if (text.includes(STYLE_MARK)) text = text.replace(MARKED_STYLE, "");
+	let width = 0;
+	for (let i = 0; i < text.length; i++) {
+		const code = text.charCodeAt(i);
+		if (code >= 32 && code < 127) width++;
+		else {
+			for (const ch of text.slice(i)) width += codePointWidth(ch.codePointAt(0) ?? 0, ch);
+			break;
+		}
+	}
+	return width;
+}
+function codePointWidth(code, ch) {
+	if (isEastAsianWide(code) || EMOJI_PRESENTATION.test(ch)) return 2;
+	if (code !== 173 && ZERO_WIDTH.test(ch)) return 0;
+	return 1;
+}
+const EMOJI_PRESENTATION = /^\p{Emoji_Presentation}$/u;
+const ZERO_WIDTH = /^[\p{Cc}\p{Cf}\p{Me}\p{Mn}\p{Emoji_Modifier}]$/u;
+/** Binary search in the sorted [first, last, first, last, …] ranges of EAST_ASIAN_WIDE. */
+function isEastAsianWide(code) {
+	if (code < 4352) return false;
+	let lo = 0;
+	let hi = EAST_ASIAN_WIDE.length / 2 - 1;
+	while (lo <= hi) {
+		const mid = lo + hi >> 1;
+		if (code < EAST_ASIAN_WIDE[mid * 2]) hi = mid - 1;
+		else if (code > EAST_ASIAN_WIDE[mid * 2 + 1]) lo = mid + 1;
+		else return true;
+	}
+	return false;
 }
 /** Quotes an argument for a POSIX shell when needed, so "Try:" commands can be copied. */
 function quoteArg(arg) {
@@ -333,12 +674,12 @@ function humanSize(bytes) {
 	if (bytes < 1e6) return `${(bytes / 1e3).toFixed(1)} kB`;
 	return `${(bytes / 1e6).toFixed(1)} MB`;
 }
-/** Wraps a paragraph at `width` columns; lines after the first start with `indent`. */
+/** Wraps a paragraph at `width` display columns; lines after the first start with `indent`. */
 function wrap(text, width, indent = "", firstIndent = indent) {
 	const lines = [];
 	let line = "";
 	let prefix = firstIndent;
-	for (const word of text.split(/\s+/).filter((w) => w !== "")) if (line !== "" && prefix.length + line.length + 1 + word.length > width) {
+	for (const word of text.split(/\s+/).filter((w) => w !== "")) if (line !== "" && displayWidth(prefix) + displayWidth(line) + 1 + displayWidth(word) > width) {
 		lines.push(prefix + line);
 		prefix = indent;
 		line = word;
@@ -1015,7 +1356,7 @@ const DEFAULT_LIMIT$1 = 50;
 function showCell(c) {
 	if (c === null) return "(empty)";
 	const value = c.value === null ? "" : typeof c.value === "string" ? JSON.stringify(c.value) : String(c.value);
-	return c.formula !== null ? `=${c.formula}${value !== "" ? ` (${value})` : ""}` : value === "" ? "(no value)" : value;
+	return c.formula !== null ? `=${escapeControls(c.formula)}${value !== "" ? ` (${value})` : ""}` : value === "" ? "(no value)" : value;
 }
 function kindLabel(out, kind) {
 	const text = kind.padEnd(7);
@@ -1074,14 +1415,14 @@ const diffCommand = {
 			result: r,
 			exitCode: r.equal ? 0 : 1,
 			render: (out) => {
-				if (r.equal) return `${out.green("No differences")} between ${a} and ${b}.`;
+				if (r.equal) return `${out.green("No differences")} between ${escapeControls(a)} and ${escapeControls(b)}.`;
 				const s = r.summary;
-				const lines = [`${out.bold(`${a} → ${b}`)}: ${plural(s.cellsChanged, "cell")} changed, ${String(s.cellsAdded)} added, ${String(s.cellsRemoved)} removed` + (s.sheetsAdded + s.sheetsRemoved > 0 ? `; sheets added: ${String(s.sheetsAdded)}, removed: ${String(s.sheetsRemoved)}` : "")];
-				for (const name of r.sheetsAdded) lines.push(`${out.green("added sheet")}   "${name}"`);
-				for (const name of r.sheetsRemoved) lines.push(`${out.red("removed sheet")} "${name}"`);
+				const lines = [`${out.bold(`${escapeControls(a)} → ${escapeControls(b)}`)}: ${plural(s.cellsChanged, "cell")} changed, ${String(s.cellsAdded)} added, ${String(s.cellsRemoved)} removed` + (s.sheetsAdded + s.sheetsRemoved > 0 ? `; sheets added: ${String(s.sheetsAdded)}, removed: ${String(s.sheetsRemoved)}` : "")];
+				for (const name of r.sheetsAdded) lines.push(`${out.green("added sheet")}   "${escapeControls(name)}"`);
+				for (const name of r.sheetsRemoved) lines.push(`${out.red("removed sheet")} "${escapeControls(name)}"`);
 				for (const sheet of r.sheets) {
 					if (sheet.cells.length === 0 && !sheet.state) continue;
-					lines.push("", out.bold(`Sheet "${sheet.name}"`));
+					lines.push("", out.bold(`Sheet "${escapeControls(sheet.name)}"`));
 					if (sheet.state) lines.push(`  ${out.yellow("changed")} visibility: ${sheet.state.before} → ${sheet.state.after}`);
 					for (const c of sheet.cells.slice(0, limit)) {
 						const style = c.kind === "changed" && showCell(c.before) === showCell(c.after) ? " (formatting)" : "";
@@ -1438,17 +1779,17 @@ const inspectCommand = {
 	}
 };
 function renderReport(out, file, r, verbose) {
-	const lines = [`${out.bold(file)}: ${r.format}, ${plural(r.sheetCount, "sheet")}, date system ${r.dateSystem}${r.conformance === "strict" ? ", Strict conformance" : ""}`];
+	const lines = [`${out.bold(escapeControls(file))}: ${r.format}, ${plural(r.sheetCount, "sheet")}, date system ${r.dateSystem}${r.conformance === "strict" ? ", Strict conformance" : ""}`];
 	if (r.hasMacros) lines.push("Contains macros (not run).");
 	if (r.externalLinkCount > 0) lines.push(`Links to ${plural(r.externalLinkCount, "other workbook")} (not followed).`);
 	const props = Object.entries(r.properties);
 	if (props.length > 0) {
 		const keyWidth = Math.max(...props.map(([k]) => k.length));
-		lines.push(out.bold("Properties:"), ...props.map(([k, v]) => `  ${k.padEnd(keyWidth)}  ${v}`));
+		lines.push(out.bold("Properties:"), ...props.map(([k, v]) => `  ${k.padEnd(keyWidth)}  ${escapeControls(String(v))}`));
 	}
 	const names = verbose ? r.definedNames : r.definedNames.filter((n) => !(n.hidden && n.name.startsWith("_xlnm.")));
 	if (names.length > 0) {
-		const shown = names.slice(0, 5).map((n) => `${n.name}${n.sheet === null ? "" : ` (sheet "${n.sheet}")`}${n.hidden ? " (hidden)" : ""} =${n.refersTo}`);
+		const shown = names.slice(0, 5).map((n) => `${escapeControls(n.name)}${n.sheet === null ? "" : ` (sheet "${escapeControls(n.sheet)}")`}${n.hidden ? " (hidden)" : ""} =${escapeControls(n.refersTo)}`);
 		const more = names.length > 5 || r.definedNamesTruncated ? `, … (${r.definedNamesTruncated ? "more than " : ""}${String(names.length)} in total; see --json)` : "";
 		lines.push(`${out.bold("Defined names:")} ${shown.join(", ")}${more}`);
 	}
@@ -1456,16 +1797,16 @@ function renderReport(out, file, r, verbose) {
 		lines.push("");
 		const state = s.state === "visible" ? "" : ` (${s.state})`;
 		if (s.kind !== "worksheet") {
-			lines.push(`${out.bold(`Sheet "${s.name}"`)}${state}: ${s.kind}, no cells`);
+			lines.push(`${out.bold(`Sheet "${escapeControls(s.name)}"`)}${state}: ${s.kind}, no cells`);
 			continue;
 		}
 		if (s.usedRange === null) {
-			lines.push(`${out.bold(`Sheet "${s.name}"`)}${state}: empty`);
+			lines.push(`${out.bold(`Sheet "${escapeControls(s.name)}"`)}${state}: empty`);
 			continue;
 		}
-		lines.push(`${out.bold(`Sheet "${s.name}"`)}${state}: ${s.usedRange}, ${plural(s.rowCount, "row")} × ${plural(s.columnCount, "column")}, ${plural(s.cellCount, "cell")}, ${plural(s.formulaCount, "formula")}`);
+		lines.push(`${out.bold(`Sheet "${escapeControls(s.name)}"`)}${state}: ${s.usedRange}, ${plural(s.rowCount, "row")} × ${plural(s.columnCount, "column")}, ${plural(s.cellCount, "cell")}, ${plural(s.formulaCount, "formula")}`);
 		lines.push(s.headerRow ? `  Header row: ${String(s.headerRow.row)} (${s.headerRow.confidence} confidence)` : "  Header row: none detected");
-		if (s.mergedRangeCount > 0) lines.push(`  Merged: ${s.mergedRanges.slice(0, 10).join(", ")}${s.mergedRangeCount > 10 ? `, … (${String(s.mergedRangeCount)} in total)` : ""}`);
+		if (s.mergedRangeCount > 0) lines.push(`  Merged: ${escapeControls(s.mergedRanges.slice(0, 10).join(", "))}${s.mergedRangeCount > 10 ? `, … (${String(s.mergedRangeCount)} in total)` : ""}`);
 		if (s.columns.length > 0) {
 			lines.push(out.table([
 				"Column",
@@ -1480,23 +1821,23 @@ function renderReport(out, file, r, verbose) {
 			]), "  "));
 			if (s.columnsTruncated) lines.push(`  … ${plural(s.columnCount - s.columns.length, "more column")}; use --max-columns ${String(s.columnCount)} to see them`);
 		}
-		if (s.formulas.length > 0) lines.push(`  Formulas: ${s.formulas.slice(0, 3).map((f) => `${f.cell} =${f.formula ?? "(shared)"}`).join(", ")}`);
+		if (s.formulas.length > 0) lines.push(`  Formulas: ${s.formulas.slice(0, 3).map((f) => `${f.cell} =${escapeControls(f.formula ?? "(shared)")}`).join(", ")}`);
 		if (s.richTextCellCount > 0) lines.push(`  Rich text: ${plural(s.richTextCellCount, "cell")} (${s.richTextCells.slice(0, 5).join(", ")}${s.richTextCellCount > 5 ? ", …" : ""})`);
 		if (s.styledColumns.length > 0) lines.push(`  Column styles: ${s.styledColumns.slice(0, 10).join(", ")}${s.styledColumns.length > 10 ? ", …" : ""}`);
 		if (s.hyperlinkCount > 0) {
-			const shown = s.hyperlinks.slice(0, 3).map((l) => `${l.ref} → ${l.target ?? ""}${l.location === null ? "" : `${l.target === null ? "" : "#"}${l.location}`}`);
+			const shown = s.hyperlinks.slice(0, 3).map((l) => `${l.ref} → ${escapeControls(l.target ?? "")}${l.location === null ? "" : `${l.target === null ? "" : "#"}${escapeControls(l.location)}`}`);
 			lines.push(`  Hyperlinks: ${plural(s.hyperlinkCount, "link")} (${shown.join(", ")}${s.hyperlinkCount > 3 ? ", …" : ""})`);
 		}
 		if (s.imageCount > 0) lines.push(`  Images: ${plural(s.imageCount, "picture")} (${s.images.slice(0, 5).map((i) => `${i.cell ?? "absolute"} ${i.format ?? "other"}`).join(", ")}${s.imageCount > 5 ? ", …" : ""})`);
 		if (s.noteCount > 0) lines.push(`  Notes: ${plural(s.noteCount, "note")} (${s.notes.slice(0, 5).join(", ")}${s.noteCount > 5 ? ", …" : ""})`);
-		if (s.tables.length > 0) lines.push(`  Tables: ${s.tables.slice(0, 5).map((t) => `${t.name} ${t.ref}`).join(", ")}${s.tables.length > 5 ? ", …" : ""}`);
+		if (s.tables.length > 0) lines.push(`  Tables: ${s.tables.slice(0, 5).map((table) => `${escapeControls(table.name)} ${escapeControls(table.ref)}`).join(", ")}${s.tables.length > 5 ? ", …" : ""}`);
 		if (s.dataValidationCount > 0 || s.conditionalFormatCount > 0) {
 			const parts = [s.dataValidationCount > 0 ? plural(s.dataValidationCount, "data validation") : null, s.conditionalFormatCount > 0 ? plural(s.conditionalFormatCount, "conditional format rule") : null];
 			lines.push(`  Rules: ${parts.filter((p) => p !== null).join(", ")}`);
 		}
 		if (s.protected) lines.push("  Protected: yes");
 		if (s.printArea !== null || s.pageBreakCount > 0) {
-			const parts = [s.printArea === null ? null : `print area ${s.printArea.join(", ")}`, s.pageBreakCount > 0 ? plural(s.pageBreakCount, "page break") : null];
+			const parts = [s.printArea === null ? null : `print area ${escapeControls(s.printArea.join(", "))}`, s.pageBreakCount > 0 ? plural(s.pageBreakCount, "page break") : null];
 			lines.push(`  Printing: ${parts.filter((p) => p !== null).join(", ")}`);
 		}
 	}
@@ -1547,10 +1888,11 @@ async function sourceFiles(root) {
 			const path = join(dir, name);
 			let info;
 			try {
-				info = await stat(path);
+				info = await lstat(path);
 			} catch {
 				continue;
 			}
+			if (info.isSymbolicLink()) continue;
 			if (info.isDirectory()) await walk(path);
 			else if (info.isFile() && SOURCE.test(name) && info.size <= MAX_FILE_BYTES) files.push(path);
 		}
@@ -1579,6 +1921,75 @@ function scanSource(file, text) {
 	});
 	return findings;
 }
+/**
+* Offsets `[start, end)` of the string value (with its quotes) at `path` in valid JSON text, the
+* one JSON.parse reads when keys repeat, or `null`. Keys are compared after decoding their
+* escapes. Values off the path are skipped without recursion.
+*/
+function stringValueSpan(text, path) {
+	let i = 0;
+	const space = () => {
+		while (i < text.length && " 	\r\n".includes(text[i])) i++;
+	};
+	/** Skips a string starting at i (on its opening quote); returns its raw text. */
+	const string = () => {
+		const start = i++;
+		while (text[i] !== "\"") i += text[i] === "\\" ? 2 : 1;
+		i++;
+		return text.slice(start, i);
+	};
+	/** Skips any value starting at i, iteratively. */
+	const skip = () => {
+		let depth = 0;
+		do {
+			const c = text[i];
+			if (c === "\"") string();
+			else {
+				if (c === "{" || c === "[") depth++;
+				else if (c === "}" || c === "]") depth--;
+				i++;
+				if (depth === 0 && c !== "{" && c !== "[") while (i < text.length && !",]} 	\r\n".includes(text[i])) i++;
+			}
+		} while (depth > 0 && i < text.length);
+	};
+	const value = (level) => {
+		space();
+		if (level === path.length) {
+			if (text[i] !== "\"") {
+				skip();
+				return null;
+			}
+			const start = i;
+			string();
+			return [start, i];
+		}
+		if (text[i] !== "{") {
+			skip();
+			return null;
+		}
+		i++;
+		let found = null;
+		space();
+		if (text[i] === "}") {
+			i++;
+			return null;
+		}
+		for (;;) {
+			space();
+			const key = JSON.parse(string());
+			space();
+			i++;
+			if (key === path[level]) found = value(level + 1);
+			else {
+				space();
+				skip();
+			}
+			space();
+			if (text[i++] === "}") return found;
+		}
+	};
+	return value(0);
+}
 function jsonError(path, cause) {
 	return new XlvError("XLV_E_JSON_INVALID", `"${path}" is not a valid package.json.`, {
 		hint: "Fix the JSON syntax of package.json and run the command again.",
@@ -1626,11 +2037,14 @@ async function run$1(ctx) {
 	}
 	let write = null;
 	if (changes.length > 0 && flag(ctx.args, "force")) {
-		let updated = text;
-		for (const c of changes) {
-			const escaped = c.from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-			updated = updated.replace(new RegExp(`("exceljs"\\s*:\\s*)"${escaped}"`), `$1"${ALIAS}"`);
+		const spans = changes.map((c) => stringValueSpan(text, [c.section, "exceljs"])).filter((s) => s !== null);
+		let updated = "";
+		let at = 0;
+		for (const [start, end] of spans.sort((a, b) => a[0] - b[0])) {
+			updated += `${text.slice(at, start)}"${ALIAS}"`;
+			at = end;
 		}
+		updated += text.slice(at);
 		write = await writeOutput(ctx, pkgPath, updated, {
 			force: true,
 			dryRun: flag(ctx.args, "dry-run")
@@ -2031,14 +2445,14 @@ async function run(argv, io) {
 	const err = new Output(useColor(io.env, io.stderrIsTTY), io.stderrIsTTY ? width : 100);
 	const stdout = (text) => io.stdout(terminalSafe(text, out.color));
 	const stderr = (text) => io.stderr(terminalSafe(text, err.color));
-	const toJson = (value) => `${io.stdoutIsTTY ? JSON.stringify(value, null, 2) : JSON.stringify(value)}\n`;
+	const toJson = (value) => `${jsonSafe(io.stdoutIsTTY ? JSON.stringify(value, null, 2) : JSON.stringify(value))}\n`;
 	const json = optionArgs(argv).includes("--json");
 	const [first, ...rest] = argv;
 	let spec;
 	const state = { lastFile: null };
 	try {
 		if (first === void 0 || first === "--json" && rest.length === 0) {
-			io.stdout(welcome(out, io.version, COMMANDS));
+			stdout(welcome(out, io.version, COMMANDS));
 			return EXIT.ok;
 		}
 		if (first === "--version" || first === "-v") {
@@ -2048,7 +2462,7 @@ async function run(argv, io) {
 		if (first === "help" || first === "--help" || first === "-h") {
 			const topic = rest.find((a) => !a.startsWith("-"));
 			if (topic === void 0) {
-				io.stdout(welcome(out, io.version, COMMANDS));
+				stdout(welcome(out, io.version, COMMANDS));
 				return EXIT.ok;
 			}
 			stdout(commandHelp(out, findCommand(topic)));
@@ -2223,6 +2637,15 @@ function formatError(err, error, tryCommand, verbose = false) {
 		""
 	].join("\n");
 }
+/**
+* JSON text with DEL, the C1 controls (which include the 8-bit CSI U+009B), the bidirectional
+* formatting characters and U+2028/U+2029 written as `\uXXXX` escapes. JSON.stringify already
+* escapes C0 controls; these characters can occur only inside strings, so the escaped text is
+* valid JSON with the same value, and a terminal showing it does not act on them (D-H01).
+*/
+function jsonSafe(json) {
+	return json.replace(/[\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
 // src/cli/bin.ts
 function version() {
 	try {