Alexandro.Net

Version 1.0.2

@stackline/wmf

Windows MetaFile (WMF) parser

Independent Stackline maintenance of wmf 1.0.2. The published license and original attribution are retained.

Installation

npm install --save-exact @stackline/wmf@1.0.2

To keep the upstream import name:

npm install --save-exact wmf@npm:@stackline/wmf@1.0.2

Usage and API

@stackline/wmf

Windows MetaFile (WMF) parser.

npm version license GitHub repository Docs Reddit community

Documentation | npm | Issues | Repository

Current package version: 1.0.2

Why this package?

Independently maintained Apache-2.0 fork of wmf@1.0.2. Original implementation, attribution and license are retained; this is not an official SheetJS release. The precise published source, git commit and SHA-512 integrity are recorded in UPSTREAM.json.

npm install @stackline/wmf

const library = require("@stackline/wmf");

Changes in 1.0.0

Processor for Windows MetaFile (WMF) files in JS (for the browser and nodejs).

Compatibility

Item Value
Package @stackline/wmf@1.0.2
Supported Node.js >=18
Module entry ./dist/wmf.node.js (CommonJS)
Runtime dependencies 0 direct dependencies
Types types

Installation

npm install @stackline/wmf

With npm:

$ npm install @stackline/wmf

In the browser:

<script src="wmf.js"></script>

The browser exposes a variable WMF.

Usage

const fs = require('node:fs');
const WMF = require('@stackline/wmf');
const bytes = fs.readFileSync('example.wmf');
console.log(WMF.image_size(bytes));
const actions = WMF.get_actions(bytes);

The data argument is expected to be an ArrayBuffer, Uint8Array or Buffer

Notes

const { createImageData } = require("canvas");
global.ImageData = createImageData;

const size = WMF.image_size(data);
const canvas = new OffscreenCanvas(size[0], size[1]);

Examples

Browser Fetch into canvas (click to show) 
// assume `canvas` is a DOM element
(async() => {
  const res = await fetch("url/for/image.wmf");
  const ab = await res.arrayBuffer();
  WMF.draw_canvas(ab, document.getElementById("canvas"));
})();
NodeJS (using `canvas` npm module) (click to show) 
const { createCanvas, createImageData } = require("canvas");
global.ImageData = createImageData;

const size = WMF.image_size(data);
const canvas = createCanvas(size[0], size[1]);
WMF.draw_canvas(data, canvas);

Security

Truncated headers and invalid record lengths are rejected before parsing, including zero-length records that cannot make progress.

API Surface

References

Local Development

Clone the repository and run the following commands from its root:

npm ci
npm run build
npm test
npm run lint

The retained upstream development notes below include historical tooling; the commands above are the maintained package checks.

Development and verification

Use Node.js 18 or newer for development (verified locally with Node 24). Run npm ci --ignore-scripts, npm run build, npm run lint, npm test, and npm run test:package. The fork declares Node >=18 for its rebuilt distribution; the original Node >=0.8 declaration is not carried forward. Browser builds expose the same WMF global and four public functions, without requiring a Node Buffer polyfill. The renderer itself is retained, not rewritten.

lint is a JavaScript syntax check, not a claim of a full style/security analysis. All packages have no runtime npm dependencies. npm audit reports registry advisories only; absence of findings is not proof that all format parsing is safe.

Five regression tests cover Buffer, Uint8Array, ArrayBuffer, browser-global exports, drawing entrypoint and malformed inputs. Rendering fidelity for arbitrary real-world WMF records is not claimed.

Sources reviewed on 2026-09-27:

Publication is performed by the repository GitHub workflow; do not publish from a local checkout. This fork does not modify or publish @stackline/xlsx.

Consumer Smoke Test

npm run test:package packs the library and exercises an isolated consumer using the repository fixture.

Release Checklist

  1. Update the package version, lockfile, generated version fields, and changelog together.
  2. Run the development checks above and audit both npm audit and npm audit --omit=dev.
  3. Use the GitHub publish workflow with its Prod environment to publish the exact CI tarball.
  4. Verify public npm bytes, package identity, provenance, and the immutable GitHub release evidence.

License

Apache-2.0. Original copyright notices and upstream attribution are retained.

Please consult the attached LICENSE file for details. All rights not explicitly granted by the Apache 2.0 License are reserved by the Original Author.

See NOTICE for retained attribution.

Credits and original authors

Original copyright, license notices and contributor acknowledgements remain part of this distribution. Stackline maintenance does not replace authorship of the original work.

Community and Links

Use this repository's issue tracker for reproducible bugs and feature requests. Join r/Stackline for examples, usage questions and release discussions.

Published files and origin

These documents were read from the existing npm 1.0.0 archive. Its SHA-512 matches the current registry integrity value. This documentation update does not publish a new package or establish a new provenance or immutable-release verification.

Archive integrity
sha512-n/UuyEfZf0bpLNUI7kw8Nx2/z97DjtRuIdzQUOMAb3uIvhTAnd4E5TDmpFdzHSYipCPYlHwehORbBhrd53RuzQ==