/**
 * Formula-injection neutralization — financial-statements (wave-13).
 *
 * Spreadsheet applications (Excel, LibreOffice, Google Sheets) execute cell
 * values that begin with =, +, -, @, tab, or carriage-return as formulas.
 * Attacker-influenced text (customer names, expense descriptions, bank-
 * transaction memos) can carry payloads; prefix a leading apostrophe to
 * force plain-text treatment in all three apps.
 *
 * Applies to every string cell: headers AND data rows.
 */

const FORMULA_TRIGGER = /^[=+\-@\t\r]/

/**
 * If `value` starts with a formula-trigger character, prefix a single quote
 * so spreadsheets treat the cell as literal text. Non-string or empty values
 * are returned unchanged.
 */
export function neutralizeFormula(value: string): string {
  if (FORMULA_TRIGGER.test(value)) {
    return `'${value}`
  }
  return value
}