SHOWCASE / SPREADSHEET INTEROPERABILITY
Interchange you can execute.
The published @sheetwrite/core interchange API and the optional @sheetwrite/xlsx codec, run against committed, independently produced fixture bytes — checksums verified in this browser. XLSX interchange guide →
Booting the WASM engine…
XLSX round-trip workbench
Edit any cell through the shell chrome, then download the document, re-import your own, or run the round-trip in place.
- Orders + Invoice sheets
- 9 formulas — per-row & cross-sheet
- currency formats
- merged footer
- frozen header row
Document: Canonical invoice workbook
Committed independent fixtures
Bytes produced by other software, committed with full provenance, and hashed in your browser before use — load any of them into the workbench above.
provenance manifest: packages/xlsx/test/fixtures/manifest.json
- LibreOffice 26.2.4.2hashing…
sheetwrite-libreoffice-positive.xlsx
cb7cba1a9a804d71…- strings
- numbers
- date-formatted numeric cells
- surrounding whitespace
- multiple data rows
- LibreOffice 26.2.4.2hashing…
libreoffice-rich.xlsx
75fb643cafcbe660…- ordinary formulas
- bold font and RGB font color
- solid fill
- per-side borders
- horizontal alignment
- currency number format
- merged cells
- decimal validation
- legacy note/comment
- hidden worksheet
- active worksheet
- frozen row and column
- named range
Manifest-documented warning: unsupported-feature: hidden worksheet visibility
- LibreOffice 26.2.4.2hashing…
libreoffice-metadata.xlsx
5a676a11d56ae1e4…- LibreOffice-preserved hidden Sheetwrite metadata worksheet
- documentId
- version
- stable sheet ids and column metadata
- native formula, validation, comment, merge, view, and named-range parts
Manifest-documented warning: unsupported-feature: hidden worksheet visibility
Producer verification status
- LibreOffice 26.2.4.2Verified here
Scope and limitations
Committed LibreOffice-produced workbooks import on this page, in your browser, with checksums verified against the fixture manifest.
packages/xlsx/test/fixtures/manifest.json - Sheetwrite round-tripVerified here
Scope and limitations
The workbench below exports this document to .xlsx bytes and re-imports them live; formulas, formats, the merge, and frozen rows survive.
toXlsxWorkbook / fromXlsxWorkbook on this page - Microsoft ExcelSuite verified
Scope and limitations
5 Excel-produced workbooks from the Apache POI test corpus (commit 913c78891b) are checksum-pinned and verified in the conformance suite. Those bytes are not redistributed here, so this page does not run them. Not yet verified from Excel bytes: hidden worksheet, Sheetwrite metadata resave.
packages/xlsx/test/fixtures/external-corpus.json - Google SheetsSuite verified
Scope and limitations
1 genuine Google Sheets-exported workbook (google-sheets-public.xlsx) is checksum-pinned and verified in the conformance suite: shared strings, ten worksheets, 230 formulas, cell styles, frozen rows, exact drawing and reserved-fill warnings. Licensing does not permit redistributing the bytes here, so this page does not run them. Not yet verified from Google Sheets bytes: dates, merges, validations, notes, hidden active sheet, defined names, Sheetwrite metadata resave.
packages/xlsx/test/fixtures/external-corpus.json
Fidelity warnings, not silent loss
Every import and export reports what it could not preserve as structured XlsxWorkbookWarning records — coded, per sheet, per cell. Warning codes →
No interchange operation has run yet. Run the round-trip or import a fixture — warnings from that operation land here with their codes.
CSV and TSV, hardened
Delimited exports neutralize formula-injection payloads before a cell ever reaches a spreadsheet that would execute them.
Export the live document
Row OP-1045 stores =HYPERLINK("https://evil.example","Q3 total") as text — export the sheet and inspect what the CSV emits.
Delimited text is intentionally lossier: formulas leave as their computed values, and styles and merges do not exist in CSV/TSV at all.
Import pasted CSV
Resource limits and hostile input
Ceilings are enforced before anything allocates, and hand-authored hostile OPC/SpreadsheetML packages are rejected with typed errors. Resource limits →
- byte ceiling
- entry ceiling
- dimension ceiling
- compression-ratio ceiling
- cell ceiling
- AbortSignal honored
| Package | Attack | Live verdict |
|---|---|---|
traversal.xlsx | ZIP entry path traversal | not run yet |
doctype.xlsx | DTD and custom entity rejection | not run yet |
deep-xml.xlsx | XML nesting-depth bound | not run yet |
compression-ratio.xlsx | Central-directory compression-ratio preflight | not run yet |
corrupt-deflate.xlsx | Corrupt DEFLATE stream or CRC rejection | not run yet |
The XLSX codec is an optional package
@sheetwrite/core ships no XLSX implementation — workbook interchange throws a typed error until a host registers a backend. This page loads @sheetwrite/xlsx/register lazily on the first XLSX action; CSV/TSV interchange needs no optional package at all.
Probing registration state…