@pro-softs/excel-schemaflow-js

Excel parsing, sheet layout hints, optional OpenAI-assisted header detection, and schema file generators (SQL dialects, MongoDB JSON Schema, JSON Schema, Prisma snippets). No database — pass a file path and process in memory.

Bundled dependency: exceljs only. openai is optional — install it only if you use the LLM helpers (see below).

The package does not read process.env itself. Use configureSchemaflow() to pass the API key and model from your app (after you load env however you like).

Usage

npm install @pro-softs/excel-schemaflow-js

LLM features require the openai package (install separately), configureSchemaflow, and an API key:

npm install openai

import {
  configureSchemaflow,
  readWorkbook,
  sheetToRows,
  exportSchemaForDialect,
  headerSignature,
  SCHEMA_DIALECTS,
} from "@pro-softs/excel-schemaflow-js";

// After loading env in your app (e.g. dotenv):
configureSchemaflow({
  openaiApiKey: process.env.OPENAI_API_KEY,
  openaiModel: process.env.OPENAI_MODEL, // optional; default gpt-4o-mini
});

Without openai installed, without configureSchemaflow, or without a key, LLM helpers return null and heuristics still apply where applicable.

Schema export (from column descriptors)

| Dialect | Output | |--------|--------| | postgresql, mysql, sqlite, mssql | CREATE TABLE SQL | | mongodb | JSON with $jsonSchema + collection metadata | | json-schema | JSON Schema | | prisma | Prisma model snippet (text only — not the Prisma runtime) |

Security practices

• File paths — readWorkbook(filePath) reads whatever path you pass; validate and sandbox paths from uploads (avoid path traversal).
• Untrusted .xlsx files — Spreadsheets are ZIP-based; malicious or huge files can stress CPU and memory. Enforce max file size and max rows in your application before calling this library.
• OpenAI (optional) — Install only if you need LLM helpers. When configured, sheet fragments and headers are sent to OpenAI; treat as data egress and review compliance.
• Generated SQL / schema strings — DDL is built from your column metadata. Do not execute generated SQL from untrusted sources without review.
• Exports to spreadsheets — Cells starting with = can be interpreted as formulas when users open CSV/Excel exports; sanitize when content is untrusted (formula injection).
• Dependencies — Run npm audit and keep exceljs (and openai if installed) updated.

License

ISC