Sheetwrite

SHOWCASE / SPREADSHEET INTEROPERABILITY

Interchange you can execute.

The published @sheetwrite/core interchange API and the optional @sheetwrite/xlsx codec, run against committed, independently produced fixture bytes — checksums verified in this browser. XLSX interchange guide →

Booting the WASM engine…

XLSX round-trip workbench

Edit any cell through the shell chrome, then download the document, re-import your own, or run the round-trip in place.

  • Orders + Invoice sheets
  • 9 formulas — per-row & cross-sheet
  • currency formats
  • merged footer
  • frozen header row

Document: Canonical invoice workbook

Committed independent fixtures

Bytes produced by other software, committed with full provenance, and hashed in your browser before use — load any of them into the workbench above.

provenance manifest: packages/xlsx/test/fixtures/manifest.json

  • LibreOffice 26.2.4.2hashing…

    sheetwrite-libreoffice-positive.xlsxcb7cba1a9a804d71

    • strings
    • numbers
    • date-formatted numeric cells
    • surrounding whitespace
    • multiple data rows
  • LibreOffice 26.2.4.2hashing…

    libreoffice-rich.xlsx75fb643cafcbe660

    • ordinary formulas
    • bold font and RGB font color
    • solid fill
    • per-side borders
    • horizontal alignment
    • currency number format
    • merged cells
    • decimal validation
    • legacy note/comment
    • hidden worksheet
    • active worksheet
    • frozen row and column
    • named range

    Manifest-documented warning: unsupported-feature: hidden worksheet visibility

  • LibreOffice 26.2.4.2hashing…

    libreoffice-metadata.xlsx5a676a11d56ae1e4

    • LibreOffice-preserved hidden Sheetwrite metadata worksheet
    • documentId
    • version
    • stable sheet ids and column metadata
    • native formula, validation, comment, merge, view, and named-range parts

    Manifest-documented warning: unsupported-feature: hidden worksheet visibility

Producer verification status

  • LibreOffice 26.2.4.2Verified here
    Scope and limitations

    Committed LibreOffice-produced workbooks import on this page, in your browser, with checksums verified against the fixture manifest.

    packages/xlsx/test/fixtures/manifest.json
  • Sheetwrite round-tripVerified here
    Scope and limitations

    The workbench below exports this document to .xlsx bytes and re-imports them live; formulas, formats, the merge, and frozen rows survive.

    toXlsxWorkbook / fromXlsxWorkbook on this page
  • Microsoft ExcelSuite verified
    Scope and limitations

    5 Excel-produced workbooks from the Apache POI test corpus (commit 913c78891b) are checksum-pinned and verified in the conformance suite. Those bytes are not redistributed here, so this page does not run them. Not yet verified from Excel bytes: hidden worksheet, Sheetwrite metadata resave.

    packages/xlsx/test/fixtures/external-corpus.json
  • Google SheetsSuite verified
    Scope and limitations

    1 genuine Google Sheets-exported workbook (google-sheets-public.xlsx) is checksum-pinned and verified in the conformance suite: shared strings, ten worksheets, 230 formulas, cell styles, frozen rows, exact drawing and reserved-fill warnings. Licensing does not permit redistributing the bytes here, so this page does not run them. Not yet verified from Google Sheets bytes: dates, merges, validations, notes, hidden active sheet, defined names, Sheetwrite metadata resave.

    packages/xlsx/test/fixtures/external-corpus.json

Fidelity warnings, not silent loss

Every import and export reports what it could not preserve as structured XlsxWorkbookWarning records — coded, per sheet, per cell. Warning codes →

No interchange operation has run yet. Run the round-trip or import a fixture — warnings from that operation land here with their codes.

CSV and TSV, hardened

Delimited exports neutralize formula-injection payloads before a cell ever reaches a spreadsheet that would execute them.

Export the live document

Row OP-1045 stores =HYPERLINK("https://evil.example","Q3 total") as text — export the sheet and inspect what the CSV emits.

Delimited text is intentionally lossier: formulas leave as their computed values, and styles and merges do not exist in CSV/TSV at all.

Import pasted CSV

Resource limits and hostile input

Ceilings are enforced before anything allocates, and hand-authored hostile OPC/SpreadsheetML packages are rejected with typed errors. Resource limits →

  • byte ceiling
  • entry ceiling
  • dimension ceiling
  • compression-ratio ceiling
  • cell ceiling
  • AbortSignal honored
Hand-authored attack packages (committed, checksum-pinned) and the live verdict.
PackageAttackLive verdict
traversal.xlsxZIP entry path traversalnot run yet
doctype.xlsxDTD and custom entity rejectionnot run yet
deep-xml.xlsxXML nesting-depth boundnot run yet
compression-ratio.xlsxCentral-directory compression-ratio preflightnot run yet
corrupt-deflate.xlsxCorrupt DEFLATE stream or CRC rejectionnot run yet

The XLSX codec is an optional package

@sheetwrite/core ships no XLSX implementation — workbook interchange throws a typed error until a host registers a backend. This page loads @sheetwrite/xlsx/register lazily on the first XLSX action; CSV/TSV interchange needs no optional package at all.

Probing registration state…