A3S Office is an open-source Office engine for product teams that need rich browser editing and agent-ready file automation without adopting an A3S backend. It ships complete editor surfaces, typed host contracts, browser file workflows, and a separate Rust automation plane.

• Embed complete editors through React, Vue 3, Web Components, or the framework-neutral Core API.
• Keep format-native behavior instead of forcing every file through one lowest-common-denominator model.
• Own the product boundary: your application controls content, storage, permissions, collaboration, and model providers.
• Collaborate across every editor with shared Yjs/Yrs content, Awareness participants and remote locations, plus browser, CLI, MCP, and A3S Code peers. Document reviewers can submit attributed insertions, deletions, and replacements without directly changing canonical text. Editors can also track character- and paragraph-formatting revisions, accept the new formatting or restore the exact prior marks/properties, and retain either result in the immutable shared decision audit.
• Automate deterministically through the native CLI, standard MCP server, or packaged Office Skill.

Latest on main

The 0.34.0 release plus the current main branch expose these capabilities as normal user-facing Playground templates, with matching implementation detail in the documentation:

| Editor | Latest capability | Public entry | | --- | --- | --- | | Presentation | Author, reorder, preview, collaborate on, and play ordered appear, fade, fly-in, and zoom entrance animations with on-click, with-previous, and after-previous triggers; the bounded subset round-trips through native PPTX timing trees | Playground Latest capabilities → 入场动画 · Presentation reference | | Writer | Compare the current document with an imported DOCX, HTML, or TXT version and generate deterministic insertion, deletion, character-formatting, and paragraph-formatting revisions; combine a reviewed copy only after exact baseline verification | Playground Latest capabilities → 文档比较 · Document reference | | Writer | Insert, customize, navigate, and explicitly refresh a typed Table of Contents with heading and native outline levels 1–9, hyperlinks, page numbers, alignment, four leader styles, and native DOCX TOC round trips | Playground Latest capabilities → 可更新目录 · Document reference | | Writer | Mark primary and secondary index terms, cross-references, and bold/italic page numbers; insert, navigate, customize, and refresh a bounded native index with editable DOCX XE and INDEX round trips | Playground Latest capabilities → 原生索引 · Document reference | | Writer | Native character shading with exact w:shd patterns, foreground/background color identity, explicit resets, authoring, and DOCX reopen | Playground Latest capabilities → 字符底纹 · Document reference | | Writer | Independent Latin, East Asian, and bidi proofing languages plus explicit w:noProof inclusion/exclusion | Playground Latest capabilities → 校对语言 · Document reference | | Spreadsheet | Complete common Data Validation input, blank/dropdown, and Stop/Warning/Information error settings with native XLSX round trips | Playground Latest capabilities → 数据验证 · Spreadsheet reference | | PDF | Insert, delete, rotate, reorder, extract, merge, and split pages through a dedicated Web Worker, with Blob-level Undo/Redo and independent binary reopen verification | Playground Latest capabilities → 组织 PDF 页面 · PDF reference |

All eight entries are reachable from the first Playground viewport. The seven content templates also remain under 新建; 组织 PDF 页面 opens the normal PDF file workflow because page organization must operate on host-provided source bytes. The highlighted strip keeps each capability discoverable without a deep documentation section or an ?e2e= fixture.

See it working

The images below are committed visual-regression baselines from the real Playground, not conceptual mockups.

Editor capability comparison

The tables below compare capability families, not button counts or visual similarity. Supported means the editable path has deterministic tests or native round-trip evidence. Partial means a useful path exists with a documented fidelity boundary. Gap means no product-grade editable path exists yet. Traditional Office availability varies by application, platform, edition, and subscription; its column describes the conventional suite baseline rather than one specific release.

Document

| Capability | A3S Office today | Traditional Office baseline | | --- | --- | --- | | Text, paragraphs, lists, and styles | Supported — structured editing, independent native ASCII, high ANSI, East Asian, and complex-script font slots with direct/theme identity, independent Latin/East Asian/bidi proofing-language slots and explicit proofing inclusion/exclusion, native all-caps and small-caps effects, exact DOCX character scale plus signed spacing, half-point kerning thresholds, all five native East Asian emphasis marks, native hidden text with explicit visible resets, native character borders with 25 visible line styles plus nil and none, direct or theme color, width, spacing, shadow, and frame semantics, four independent native outline/shadow/emboss/imprint effects with conflict-safe authoring, and baseline position in one advanced font dialog, all 18 native DOCX underline values with direct or theme color identity, independent native single/double strikethrough with explicit resets, formatting revisions, clipboard, format painter, and undo/redo | Mature authoring with a broader long-tail style and typography catalog | | Page layout and rendering | Partial — sections, margins, page size, columns, headers/footers, fields, and live pagination | Desktop-grade pagination, print layout, and vector output | | Tables, pictures, and equations | Partial — rich table geometry, floating pictures, crop/wrap, and structured OMML | Broader drawings, text boxes, charts, WordArt, and SmartArt | | Comments, revisions, and collaboration | Partial — comments, suggestions, text/format revisions, decisions, Yjs presence, and host relay contracts | Full revision families plus integrated sharing and review services | | Document compare and combine | Partial — deterministic same-layout paragraph/heading comparison produces reviewable text, character-formatting, and paragraph-formatting revisions; reviewed-copy combine requires an exact reject-all baseline match | Mature structural, object, move-range, and multi-copy conflict handling | | References and document generation | Partial — typed Table of Contents and native index authoring/refresh, bookmarks, links, captions, cross-references, citations, notes, and common fields | Mail merge, tables of figures/authorities, and broader fields | | Ribbon and shortcuts | Supported — responsive Office-style ribbon and editor-scoped daily-writing shortcuts | Complete desktop shortcut and contextual-tool surface | | Very large documents | Supported with boundaries — bounded 100,000-block plain-document windows and measured edit/navigation budgets | Native-engine virtualization with device-dependent limits | | DOCX and PDF fidelity | Partial — source-aware DOCX preservation and live-layout raster PDF export | Broader legacy/OOXML compatibility and searchable vector PDF output |

Spreadsheet

| Capability | A3S Office today | Traditional Office baseline | | --- | --- | --- | | Cells, sheets, navigation, and history | Supported — multiple sheets, sparse editing, search, clipboard, four-direction fill, exact formula/value copy from above, and undo/redo | Mature grid workflows across desktop and web | | Formatting and style rendering | Partial — native fonts, colors, borders, alignment, number formats, cell styles, all 17 native non-solid OOXML pattern fills, native linear/path XLSX gradients, and one Format Cells surface that authors none, solid, pattern, or gradient fills with exact geometry and 2–256 ordered stops; static date/time entry, contrast-safe font preview, native XLSX rich-text runs, selected-text font formatting, direct formula-bar/F2 insertion or deletion, and bounded authenticated formatted-HTML paste | Disjoint multi-edit rich-text authoring, broader themes, locale formats, and advanced style effects | | Ribbon and shortcuts | Partial — common Office-style Home/Data/View commands, grid-scoped shortcuts, and focused Font-dialog aliases | Larger command catalog and platform-specific accelerators | | Formulas and recalculation | Partial — dependency-aware calculation and common formula paths | Wider functions, arrays, volatile semantics, and calculation parity | | Tables, pivots, charts, and rules | Partial — native tables, pivots, charts, conditional formatting, and common validation rules with complete input/error-setting authoring | Calculated columns, slicers, pivot charts, custom/dependent validation rules, advanced analysis, and broader browser alert flows | | Large worksheets | Supported with boundaries — maximum-dimension sparse import/editing and viewport-bounded Canvas painting | Highly optimized native grid with hardware-dependent limits | | Files and printing | Partial — XLS/XLSX/ODS/CSV import, XLSX export, and PDF output | Broader round trips, external data, print fidelity, and legacy conversion | | External data, macros, and specialist analysis | Gap — active macros are never executed; bounded models are still needed for data connections and solver-like tools | Established data, macro/add-in, scenario, and optimization ecosystems |

Presentation

| Capability | A3S Office today | Traditional Office baseline | | --- | --- | --- | | Slide and object editing | Supported — slide lifecycle, scene editing, multi-selection, grouping, transforms, and guides | Mature slide and drawing workflows | | Text, shapes, tables, charts, and images | Partial — typed editable objects with native import/export paths | Broader shapes, connectors, effects, SmartArt, and embedded chart editing | | Masters and layouts | Partial — import/export inheritance with editable common paths | Full visual master, layout, and placeholder authoring | | Transitions and timings | Partial — fade, push, wipe, split, cut, and click/automatic advance | Broader transition catalog and timing controls | | Animations and media | Partial — the Work scene model authors, validates, copies, collaborates on, previews, and plays ordered appear/fade/fly-in/zoom entrance cues with click/with-previous/after-previous triggers and bounded timing; this supported entrance subset round-trips through native PPTX timing trees | Exit/emphasis effects, motion paths, audio, video, recording, and broader PPTX preservation | | Slideshow and presenter workflows | Supported — current/beginning start, keyboard playback, notes, timer, and responsive presenter view | Rehearsal, recording, ink/laser, and richer multi-display controls | | Review and collaboration | Partial — comments, shared presence, remote object locations, and host transport | Threads, assignments, mentions, and integrated cloud review | | PPTX, print, PDF, and video | Partial — PPTX round trip plus slide/notes/handout PDF models; no video export | Broader print controls, vector fidelity, media preservation, and video export |

PDF

| Capability | A3S Office today | Traditional Office baseline | | --- | --- | --- | | Rendering and navigation | Supported — PDFium pages, thumbnails, zoom, keyboard navigation, and bounded long-file windows | Mature desktop/web viewing and navigation | | Search and text evidence | Supported with boundaries — browser search and bounded native text-layer evidence | Broader tagged-PDF reading order and accessibility extraction | | Annotations, forms, and save | Supported — common annotations, appearance controls, form filling, history, and save | Broader stamps, measurements, form authoring, scripts, and signatures | | Existing text, image, and object editing | Gap — no safe production content-stream editing path | Direct text/object editing with font and layout recovery | | Page organization | Supported with boundaries — insert, delete, rotate, reorder, extract, merge, and split run in a dedicated Worker, replace one complete Blob per mutation, and participate in Undo/Redo | Broader document-level catalog preservation and signed/encrypted-file workflows | | Compression, conversion, and OCR | Gap / host boundary — provider contracts are required for authoritative conversion and OCR | Integrated optimization, conversion, and scanned-document recognition | | Signatures, protection, and redaction | Gap / host boundary — trusted identity and destructive-content guarantees are required | E-signing, certificate validation, encryption, sanitization, and true redaction | | AI and real-time collaboration | Host-owned — typed page/text evidence, Yjs review records, presence, and provider-neutral ports | Typically bundled with account, storage, and model services |

Markdown

Markdown is an A3S Office differentiator rather than a parity target.

| Capability | A3S Office today | Traditional Office baseline | | --- | --- | --- | | Source and visual editing | Supported — GFM source, visual mode, synchronized split preview, and source-native history | No standard first-class Markdown editor | | Tables, tasks, links, images, and code | Supported — format-native Markdown structures in both editing modes | Usually represented through rich-document conversion or plain text | | Responsive UI and shortcuts | Supported — desktop split view, phone single-surface modes, and editor-scoped formatting | Depends on a text editor, add-in, or conversion workflow | | Collaboration | Supported — Yjs content, Awareness presence, remote selections, and host-owned transport | Usually available only after conversion into a cloud document format | | Import, export, and automation | Supported — direct Markdown round trip plus typed browser, CLI, MCP, and agent mutations | No shared native Markdown automation contract |

Document and Markdown accept public TipTap Extensions. Spreadsheet, Presentation, and PDF expose stable host ports rather than private command contexts. Editor engines and large runtime assets load only when their surface is requested. The complete gap inventory and exit evidence live in the capability roadmap.

Why A3S Office

• Product-native UI — Complete Office-style surfaces with no required backend, account system, or storage model.
• Accessible responsive shell — Compact sidebars, slide navigation, AI panes, responsive chart inspectors, dialogs, menus, and popovers share bounded keyboard navigation, background isolation, topmost Escape handling, and focus restoration. Persistent desktop navigation and the temporary phone drawer keep separate open states, so live breakpoint changes never turn a desktop sidebar into an unexpected blocking modal or steal focus from the workspace. Shared color palettes expand to an eight-column touch layout on phones while preserving spatial arrow-key navigation. Shared Office selects use 44 px phone option rows and bounded internal scrolling while retaining keyboard selection and exact focus restoration.
• Editor-scoped zoom — Status controls and Ctrl/Cmd + mouse-wheel gestures share each surface's bounded zoom model without changing the host browser's page scale.
• Predictable state — Controlled content values, typed callbacks, explicit file actions, conflict-aware document edits, and one document typography baseline across editing, preview, and PDF rendering. Word editing and read-only preview retain the same canonical TipTap tree, while browser PDF export captures that same Worker/WASM page layout instead of rebuilding content from compatibility HTML. Caption numbering and cross-reference validity also update in that same transaction graph, including a truthful missing-target state after deletion. Paired Word bookmarks can span blocks, retain stable native identities through edits, drive live editable REF fields, and keep internal links distinct from external hyperlink relationships; deleting a target exposes truthful missing-link and missing-reference states that undo repairs. Footnote and endnote references remain paired with one editable definition, renumber live in independent reference-order sequences, receive new identities when copied, and are deleted or restored together through one undoable transaction. Body PAGE, NUMPAGES, SECTION, SECTIONPAGES, DATE, and TIME fields are atomic, copied under fresh stable identities, and resolve from the live Worker/WASM page containing each field. Automatic reflow updates numeric fields without adding history or ticking clock fields; F9 refreshes every field in one undoable action. Safe inline DOCX fields round-trip natively, while nested, incomplete, cross-paragraph, deleted, or instructionless structures stay text and produce an explicit compatibility warning. Writer Table of Contents blocks reuse the same heading outline and live Worker/WASM page resolver instead of maintaining parallel heading or page state. Insert, customize, and explicit refresh each commit one TipTap transaction and one Undo record. Semantic headings and native outline-level paragraphs cover levels 1–9; included items without a native paragraph identity receive one in the same transaction so hyperlinks survive structural edits. Page-number visibility and alignment, dot/dash/underline/no leaders, and at most 512 cached entries remain typed in the DOM. DOCX export writes a native w:sdt/TOC content control and live field with cached entries; import accepts the common \\o, \\h, \\z, \\u, full-range \\n, and space-separator \\p subset while diagnosing lossy custom style mappings. The Playground's 可更新目录 template exposes the complete flow. Writer indexes use hidden, selectable inline entry atoms and a separate selectable generated block. Primary terms, secondary terms, cross-references, and bold/italic page-number intent remain typed; duplicate terms on the same page merge while retaining every stable marker target. The live Worker/WASM field resolver remains the only page-number source. Mark, edit, insert, customize, and explicit all-index refresh each commit one TipTap transaction and one Undo record. At most 2,048 markers contribute to at most 512 cached rows, with explicit truncation beyond either bound. DOCX export writes native XE simple fields and a real w:sdt/INDEX content control with cached Index1/Index2 rows, columns, cross-references, page emphasis, alignment, and dot/dash/underline/no leaders. Import accepts the lossless common XE \\b, \\i, and \\t plus INDEX \\c, \\e, and \\r subset; unsupported switches remain diagnosed instead of approximated. The Playground's 原生索引 template exposes marking, navigation, refresh, export, and reopen.
• Framework choice — React components, Vue 3 adapters, Custom Elements, and a framework-neutral Core API over the same engine.
• Responsive computation — Lazy editor chunks, cancellable Workers, streamed dense XLSX and eligible large-DOCX parsing in dedicated transferable-input Workers, including a fail-closed plain-OOXML path that reuses the package Worker's decompressed worksheet XML and aborts speculative SheetJS parsing only after package authentication, CSS-compatible font-weight matching, Rust WebAssembly layout and calculation, and PDFium rendering. Spreadsheet Canvas painting is bounded to the visible row and column range. Eligible structurally plain large DOCX files retain one complete canonical structured model while TipTap initially materializes only two equal-position chunks and hydrates a selected chunk on demand. The large-DOCX Worker streams 2,048-item batches and columnar table metadata instead of cloning one complete object graph. Pooled semantic previews, physical page sheets, and pagination widgets are windowed independently. The PDF rail mounts at most 32 thumbnail buttons, aborts the exact PDFium task when a thumbnail leaves the window, and uses instant long-distance keyboard jumps so the destination retains focus. The checked 1,000-page fixture mounts 15 thumbnails and seven main-view pages at readiness. Presentation decks above 60 slides use independent thumbnail-node and scene windows. The checked 1,000-slide, 9,000-element fixture mounts 18 thumbnail buttons and 13 full thumbnail scenes, retains about 10.9 MiB of JavaScript heap, reaches slide 1,000 in 6.1–13.4 ms, and produces no Long Tasks. Design metadata is normalized once per controlled value and each visible thumbnail resolves only its own slide. The checked 100,000-block fixtures keep selection, editing, and export positions in the canonical model instead of replacing them with a React-only virtual list; rich and collaborative models deliberately retain the complete compatibility path. Consecutive controlled edits hash only changed lazy chunks and combine cached fingerprint segments, while cloned or persisted models still receive complete HTML verification.
• AI without UI scraping — Typed agent ports and host-defined selection actions receive structured context and editing commands.
• Automation outside the browser — The native Rust CLI, standard MCP server, and Office Skill share bounded mutation contracts. Coding agents can also keep a durable Yrs replica, exchange standard Yjs v1 updates and state vectors, perform authorized typed Markdown, Document, Spreadsheet cell/batch, Presentation scene-element and z-order, and PDF annotation, form-value, and review changes, including attributable Document selection comments, replies, text suggestions, and atomic final decisions, retain browser/native actor attribution, validate browser-created character- and paragraph-formatting revisions and their audit records, and checkpoint without replacing a whole Office file.

Real-time collaboration

Document, Markdown, Spreadsheet, Presentation, and PDF expose the same transport-neutral collaboration boundary. Two browser clients can edit one artifact live, render an accessible participant roster, and project remote text selections, cells, scene objects, pages, or annotations without moving the local user's viewport or focus. Native Yrs replicas join the same state through the CLI, standard MCP server, or A3S Code.

The host owns rooms, authentication, authorization, network delivery, offline buffering, persistence, and the Y.Doc; A3S Office owns format-specific bindings, local undo, validated presence, and conflict-local typed mutations. Spreadsheet table state uses ordered, ID-keyed records with creation claims; independent table name, style, stripe, column, and filter fields can converge without replacing a serialized worksheet. An authenticated Document comment session can select text, create a durable thread, reply, resolve or reopen it, and delete only review records owned by its actor while canonical content remains read-only. The server independently validates that review-only boundary before persistence and broadcast. An authenticated Document suggest session can submit attributed insertions, deletions, and replacements while canonical text, structure, formatting, options, comments, and other actors' suggestions remain protected. An edit participant accepts or rejects a proposal and appends the final actor-attributed decision to the immutable document.change-decisions audit trail. The A3S Boot service also persists edit-mode character- and paragraph-formatting revisions and validates their bounded prior-format snapshots before broadcast. Character decisions keep or restore direct marks. Paragraph decisions keep or restore alignment, direction, indentation, spacing, pagination, outline, tab stops, borders, shading, and collapsed state without deleting text. Authenticated suggest updates must preserve both revision kinds and cannot rewrite their identity or snapshot. suggest on non-Document formats remains receive-only. See the bilingual real-time collaboration guide for React, Vue, Web Component, reconnect, security, and native-agent setup. The repository also ships a runnable A3S Boot collaboration server with signed room tickets, Origin validation, durable Yrs storage, Awareness relay, a typed browser adapter, and actor-scoped browser or native room messages.

Quick start

Try the product locally

Node.js 20+, Bun 1.3+, and Rust 1.85+ are required.

git clone https://github.com/A3S-Lab/Office.git
cd Office
bun install --frozen-lockfile
bun run playground

Then open the local URL printed by the development server. For a zero-install tour, use the live Playground. Choose 体验格式修订, open 审阅, then 查看修订（2） to inspect the independent Formatting and Paragraph Formatting cards and exercise accept or reject semantics.

Embed a controlled React editor

Install the public package with its React peers:

bun add @a3s-lab/office react react-dom

Import the stylesheet once, give the editor an explicit-height host, and store the complete value emitted by onChange:

import { useState } from 'react';
import type { DocumentContent } from '@a3s-lab/office/core';
import { DocumentEditor } from '@a3s-lab/office/react';
import '@a3s-lab/office/styles.css';

const initialContent: DocumentContent = {
  type: 'document',
  html: '<h1>Project brief</h1><p>Start editing here.</p>',
  pageSize: 'a4',
  pageColor: '#ffffff',
};

export function ProjectBrief() {
  const [content, setContent] = useState(initialContent);

  return (
    <main style={{ height: '100dvh', minHeight: 0 }}>
      <DocumentEditor
        content={content}
        onChange={setContent}
        theme="system"
      />
    </main>
  );
}

The editor owns editing, layout, import/export, and browser rendering. The host owns persistence and decides when, where, and how the emitted content is saved.

Preload an anticipated PDF

Editor modules remain lazy. PDFium runtime loading is a separate, explicit choice because its unpacked WebAssembly binary is about 4.4 MiB. Warm both only from a high-confidence intent, and use the same URL when mounting PdfViewer:

import { PdfViewer, preloadOfficeEditor } from '@a3s-lab/office/react';

const pdfiumUrl = '/assets/pdfium.wasm';

void preloadOfficeEditor('pdf', {
  pdfWasmUrl: pdfiumUrl,
  preloadRuntimeAssets: true,
});

<PdfViewer loadSource={loadPdf} wasmUrl={pdfiumUrl} />;

The preload caches the module and, when the request succeeds, the response body. Runtime warming is best effort: a network failure does not block editor opening, and a later call retries it. The helper does not create a hidden viewer or pre-initialize the PDFium Worker. On the local reference machine it improved median shell mount by 41.6 ms but did not improve the viewer-ready median, so Worker initialization remains the measured boundary.

Organize and persist PDF pages

Providing onSave enables the page organizer. Every insert, delete, rotate, reorder, or merge produces one replacement PDF Blob and one page-history record; extract and split return separate files without changing the source. Use onPageExport when the host should persist those derived files instead of letting the viewer download them:

import type { PdfPageOrganizationExport } from '@a3s-lab/office/react';
import { PdfViewer } from '@a3s-lab/office/react';

async function persistPageExports(
  files: readonly PdfPageOrganizationExport[],
): Promise<boolean> {
  await Promise.all(
    files.map(({ fileName, pageCount, pdf }) =>
      storage.put(fileName, pdf, { pageCount }),
    ),
  );
  return true;
}

<PdfViewer
  fileName="contract.pdf"
  loadSource={() => storage.get('contract.pdf')}
  onSave={async (pdf) => {
    await storage.put('contract.pdf', pdf);
    return true;
  }}
  onPageExport={persistPageExports}
/>;

Page jobs load lazily in a dedicated Web Worker. The primary PDF is limited to 256 MiB, a merged PDF to 128 MiB, and every result to 4,096 pages. Toolbar Undo/Redo consumes native annotation or form history first, then page history. Signed or encrypted PDFs fail closed; delete, reorder, and merge also reject forms, outlines, or tagged structures whose page references cannot be safely rewritten. Extract and split surface a diagnostic when document-level catalog objects are intentionally not copied. Page organization is unavailable while collaboration or evidenceOverlay is active because those modes identify an immutable source PDF. See the complete PDF page-organization contract.

Persist a structured document snapshot

Hosts that round-trip controlled document values across a process or language boundary should use the public versioned snapshot codec instead of converting the editor value to Markdown or treating HTML as the complete document:

import {
  decodeDocumentSnapshot,
  encodeDocumentSnapshot,
} from '@a3s-lab/office/core';

const encoded = encodeDocumentSnapshot(content);
await storage.put(documentId, encoded);

const restored = decodeDocumentSnapshot(await storage.get(documentId));

The v1 envelope uses the application/vnd.a3s.office.document-snapshot+json;version=1 media type. It retains the synchronized HTML, structured ProseMirror model, page layout, comments, review state, and bibliography as deterministic bounded JSON. Decode fails closed for a different schema or version, malformed JSON, an oversized payload, or a model whose HTML fingerprint is stale. Optional undefined properties are omitted because they are outside the JSON data model.

Export the live Word layout to PDF

Give each mounted document a stable artifactId, then pass the matching, current artifact to downloadArtifactPdf. Export waits for the live pagination surface and crops the physical pages computed by the editor:

import { useState } from 'react';
import {
  createArtifact,
  downloadArtifactPdf,
} from '@a3s-lab/office/core';
import { DocumentEditor } from '@a3s-lab/office/react';

export function DocumentWithPdfExport() {
  const [artifact, setArtifact] = useState(() =>
    createArtifact('blank-document'),
  );

  if (artifact.content.type !== 'document') return null;

  return (
    <main style={{ display: 'flex', height: '100dvh', flexDirection: 'column' }}>
      <button
        type="button"
        onClick={() => void downloadArtifactPdf(artifact)}
      >
        Export PDF
      </button>
      <section style={{ flex: 1, minHeight: 0 }}>
        <DocumentEditor
          artifactId={artifact.id}
          content={artifact.content}
          onChange={(content) =>
            setArtifact((current) => ({
              ...current,
              content,
              revision: current.revision + 1,
              updatedAt: Date.now(),
            }))
          }
        />
      </section>
    </main>
  );
}

The live path preserves automatic page-break decorations, shaped text, table continuations, and page chrome. It currently rasterizes each physical page into the PDF; searchable text and vector output remain future fidelity work.

Choose an entry point

• @a3s-lab/office/react — Lazy React editor components and preload helpers.
• @a3s-lab/office/vue — Vue 3 adapters with v-model:content.
• @a3s-lab/office/web-component — Custom Elements for framework-agnostic UI composition.
• @a3s-lab/office/core — Typed models, templates, import, export, and browser file workflows, plus transport-neutral Yjs bindings for Markdown, Document, Spreadsheet, Presentation, and PDF collaboration.
• @a3s-lab/office/styles.css — Shared editor and interaction-system styles.

Copyable React, Vue, and Web Component examples live in the component documentation.

Controlled by design

A3S Office is headless at the product boundary, not at the UI boundary. The package includes complete toolbars, ribbons, panes, popovers, and dialogs while leaving product infrastructure to the host.

A3S Office owns: editing models and commands; import, export, layout, and rendering; editor UI and responsive interactions; typed selection and agent ports.

Your host owns: persistence and version history; identity, permissions, and collaboration; the application shell and navigation; AI providers, prompts, policy, and request lifecycle.

For collaborative surfaces, pass the host-owned typed Presence controller as presence beside its exact collaboration session. Every editor projects the same responsive participant roster across editing and preview chrome, including human/agent identity, mode, activity, and a format-specific location summary. Editors publish their local location and project remote locations without writing them into canonical content: Document and Markdown render text selections/carets, Spreadsheet uses Fortune Sheet's native cell-presence layer, Presentation frames stable object IDs, and PDF identifies peers on the current page or annotation. A remote roster row explicitly navigates and focuses that location; passive Awareness updates never move the local selection, viewport, or focus. The host continues to synchronize Awareness and own both lifecycles.

Document and Markdown selection menus can be replaced with host-defined typed actions. Each action receives an immutable selection snapshot, nearby text, the complete controlled content, and conflict-aware replaceText, insertBefore, insertAfter, and copyText commands. Markdown snapshots also identify whether the source or visual surface owns the selection. Async edits track unrelated visual-editor transactions and fail with stale-selection instead of changing the wrong text. The Playground's open-ended question action enters a focused draft before dispatch, so a host never receives an unfinished “Question:” request; attached context stays available without dominating the assistant surface.

Browser file workflows

The Core API creates typed blank artifacts and performs browser-side import or export without mounting an editor:

import {
  createArtifact,
  createArtifactBlob,
  importOfficeFile,
} from '@a3s-lab/office/core';

const controller = new AbortController();
const shell = createArtifact('blank-document');
const imported = await importOfficeFile(file, {
  artifactId: shell.id,
  signal: controller.signal,
  onProgress: ({ stage, progress }) => {
    console.info(stage, `${Math.round(progress * 100)}%`);
  },
});
const output = await createArtifactBlob(imported);
const blankDeck = createArtifact('blank-presentation');

const workbookShell = createArtifact('blank-spreadsheet');
if (workbookShell.content.type !== 'spreadsheet') {
  throw new Error('Expected a Spreadsheet shell.');
}
const workbook = await importOfficeFile(spreadsheetFile, {
  artifactId: workbookShell.id,
  spreadsheetSheetIds: workbookShell.content.sheets.flatMap((sheet) =>
    sheet.id ? [sheet.id] : [],
  ),
});

Import progress advances monotonically through reading, parsing, analyzing, and finalizing. Calling controller.abort() rejects with an AbortError; large reads and parser checkpoints yield so a host can keep the progress and Cancel controls responsive. An optional host-reserved artifactId lets the UI mount an editor shell before parsing finishes and then apply the imported controlled value without remounting that surface. The Playground uses this boundary to overlap DOCX Worker parsing with editor initialization; source-backed export remains attached to the reserved ID. A Spreadsheet host can also reserve worksheet identities with spreadsheetSheetIds. Eligible structurally plain workbooks then replace the authenticated frozen matrix inside the mounted Fortune instance instead of cloning one million cells through a second mount. Sheet-count or identity changes, preview mode, charts, protection, merged or styled geometry, and other stateful workbook structures retain the complete remount path. The plain-OOXML Worker authenticates row and cell coordinates directly in its XML buffer, so a million-cell import does not allocate or regex-match a million address strings.

Spreadsheet import and export preserve sparse worksheets up to the XLSX limit of 1,048,576 rows by 16,384 columns. The logical data.length, row, and column dimensions can be large while only populated indexes are materialized. Virtual scrolling never emits onChange, and editing a far blank row creates only that row. Data-validation regions remain compact in dataValidationRanges; direct dataVerification entries take precedence. Protection ranges, passwordless editable ranges, and conditional formatting also remain compact and round-trip through native XLSX records without allocating every covered cell.

Complete Spreadsheet data-validation settings

Data → Data Validation authors list, whole-number, decimal, date, and text-length rules across one or more selected ranges. The same dialog now owns the complete common input and error metadata: allowBlank, showDropdownArrow, hintTitle, hintValue, prohibitInput, errorStyle, errorTitle, and errorMessage. Titles are bounded to 32 Unicode code points, the input message to 255, and the error message to 225. Disabling a message keeps its text so a later re-enable does not discard the user's draft.

The mounted grid reads compact rules without expanding blank cells, honors allowBlank, can hide the in-cell list arrow, shows the authored input title and message, and uses the authored error title and message when rejecting an invalid value. The current Fortune boundary still has one blocking browser alert path whenever error alerts are enabled. stop, warning, and information therefore round-trip as exact native file semantics, but the browser does not yet reproduce the separate warning/information confirmation branches of a desktop suite. Custom formulas and dependent lists also remain explicit gaps.

XLSX import and export preserve allowBlank, showErrorMessage, showInputMessage, errorStyle, errorTitle, error, promptTitle, and prompt. The public showDropdownArrow name describes what users see, while SpreadsheetML stores the inverse in showDropDown. On the public Playground home page, choose 新建 → 数据验证 to inspect list, date, and priority examples with all three alert styles. This is a normal user-facing template, not an ?e2e= fixture or a documentation-only example.

Native XLSX pattern fills retain all 17 non-solid OOXML pattern identities plus their foreground and background RGB, theme, indexed, automatic, and tint color origins. Canvas draws them only for visible cells, behind text and below table or conditional-format fills. Format Painter, Paste Special Formats, unrelated formatting, Yjs collaboration, export, and reopen preserve the metadata; a new solid fill, No Fill, Clear Formats, or built-in Cell Style intentionally clears it. Malformed patterns fail closed, and semantic palette conflicts export literal RGB instead of a false theme or indexed reference.

Format Cells now authors every native pattern through one typed fill model. Users can switch between none, solid, all 17 pattern types, and gradients while retaining inactive drafts, preview the exact Canvas result, and edit pattern foreground/background colors. Apply publishes one controlled workbook update and one Undo record; export and reopen retain the authored native pattern.

Native XLSX gradient fills retain linear angles, path inner-rectangle geometry, two through 256 ordered stops, and each stop's RGB, theme, indexed, automatic, or tint identity. Fortune projects the first stop into bg; metadata remains active only while that projection matches. Visible linear fills use Canvas gradients, while path fills use at most 96 clipped rectangular contours, so off-viewport cells do no work and rendering stays bounded. Format Painter, Paste Special Formats, unrelated edits, Yjs collaboration, export, and reopen preserve the fill. Explicit fills and format resets clear it, malformed input fails closed, and semantic palette conflicts fall back to literal RGB.

The same Format Cells Fill tab authors linear or path gradients without a second style state. It exposes exact angle or inner-rectangle geometry, 2–256 ordered stops, midpoint insertion with interpolated color, stop removal and editing, mixed-selection safeguards, and a live native Canvas preview. Invalid stop order or path geometry blocks Apply before mutation; an accepted Apply remains one controlled update and one Undo record.

Worksheet Tables/ListObjects live in sheet.tables as semantic records with stable IDs, workbook-unique names, zero-based ranges, ordered columns, filters, header/totals flags, and built-in style identity. XLSX import and export keep native table parts and relationships. Table styling is resolved only for the visible Canvas cells; converting a table to a range materializes the confirmed appearance without densifying unrelated worksheet space. Structured-reference calculation, calculated columns, complete totals authoring, slicers, and external/query tables are not yet claimed.

Use downloadArtifact to start a browser download or createArtifactBlob when your application owns upload and persistence. Imported DOCX artifacts are source-backed: safe source-only OPC parts, content-type registrations, and relationships survive a regenerated export. Persist the original Blob alongside the artifact and call registerSourceBlob after a browser reload. If that source is unavailable, DOCX export fails explicitly instead of silently dropping complex package state. The artifact's source metadata carries a SHA-256 fingerprint, so registering a different DOCX under the same artifact ID also fails. Generated core parts remain authoritative; compatibility diagnostics identify known inline OOXML normalization and the deliberate removal of invalid signatures, VBA, ActiveX, and custom-ribbon parts. Within word/settings.xml, relationship-free ignorable attributes, elements, and structurally valid, non-conflicting mc:AlternateContent blocks survive strict or transitional UTF-8/UTF-16 sources. Generated Word settings still win, and this preservation does not yet restore behavior-changing settings. Regenerated word/styles.xml and word/numbering.xml also retain relationship-free passive extensions at the root and on uniquely matched identities. Styles match by type plus style ID; imported abstract-numbering, concrete-numbering, and level metadata follows regenerated IDs. Source-only or duplicate identities, malformed trees, relationship-bound content, and ambiguous one-to-many numbering mappings are dropped. Generated Word style and numbering semantics still win. In regenerated document, header, footer, footnote, and endnote parts, relationship-free passive extensions from non-OOXML ignorable namespaces also follow uniquely matched picture drawings, using normalized anchor and drawing-property IDs. Body, header, footer, footnote, and endnote imports retain those image identities in sanitized editable HTML. Passive extensions also follow uniquely matched, unchanged paragraphs and their paragraph properties by native w14:paraId plus w14:textId. Body and page-chrome HTML retain these identities; text edits rotate textId, formatting-only edits and moves keep it, and copies or splits receive new paragraph IDs. Source-only, duplicate, changed-text, relationship-bound, Microsoft/OOXML semantic, and ambiguous branches are dropped; generated paragraph and drawing semantics stay authoritative. Office 2013 w15:collapsed paragraph metadata also round-trips through body and page-chrome HTML as data-office-default-collapsed. Import accepts only an empty leaf or the exact core Word w:val lexicals true, on, 1, false, off, and 0; an omitted value means true, while a malformed or duplicated direct value fails closed instead of inheriting stale state. Export canonicalizes explicit states to 1 or 0, declares the Word 2012 namespace, and adds its prefix to mc:Ignorable. This metadata remains native-only: browser content stays expanded and editable, without conflating Word's initial collapsed-heading view with navigation-pane state or hidden text. Stable table hierarchies use native row w14:paraId plus w14:textId, ordered directly owned row IDs for tables, and directly owned paragraph IDs for cells. Passive extensions on w:tbl/w:tblPr, w:tr/w:trPr, and w:tc/w:tcPr survive body or page-chrome regeneration. Row text or structural edits rotate the row version; formatting-only edits and moves retain it, copies receive independent IDs, and nested rows or cells are isolated from their outer table. Duplicate or cross-kind identities and unsafe extension branches fail closed, while generated table geometry and formatting win. Imported footnotes and endnotes now retain their native positive w:id across reorderings, while copies receive independent IDs. Signed native comment and reply IDs, reply parentage, and resolved state also survive regeneration. Native DrawingML pictures inside footnotes and endnotes retain their identity, layout, wrapping, crop, and layer metadata through public import and artifact export. Export repairs missing image relationships in generated note parts, allocates collision-free relationship IDs, and validates each media payload. Changed, duplicate, namespace-spoofed, relationship-bound, or semantic drawing branches stay disconnected; generated geometry and media remain authoritative, while legacy VML, shapes, and SmartArt normalize.

Native Writer fonts retain the four independent WordprocessingML w:rFonts slots: ascii, hAnsi, eastAsia, and cs, together with their theme references and script hint. Mixed-script runs become bounded semantic spans so Latin, high ANSI, East Asian, and complex-script text each use the correct resolved browser family without rewriting the native source identity. The shared Cmd/Ctrl+D dialog exposes separate Latin, East Asian, and complex-text font controls, preserves untouched mixed selections, supports Follow style, uses one transaction and Undo record for combined character changes, and renders a script-aware preview. The Home font menu intentionally applies one all-text choice to all four slots. Body text, page chrome, notes, formatting revisions, strict/transitional import, exact export, and reopen share the typed model; malformed, duplicate, oversized, child-bearing, text-bearing, unknown, or namespace-spoofed w:rFonts data fails closed and is diagnosed.

Native Writer text also authors and reopens all five WordprocessingML w:em values: none, dot, comma, circle, and underDot. The shared Cmd/Ctrl+D advanced font dialog keeps mixed selections untouched until an explicit choice, distinguishes removing direct formatting from writing an explicit none inheritance reset, restores focus and selection, and commits with the other character settings in one transaction and one Undo record. Body text, headers, footers, footnotes, endnotes, inherited styles, Format Painter, formatting revisions, strict/transitional import, export, and reopen retain the typed value. The DOM projects it through data-office-emphasis-mark and CSS text-emphasis-*; paragraphs with visible marks use browser-authoritative line measurement so their out-of-line glyph extents are not approximated by the Worker/WASM shaper. No dedicated shortcut is invented.

Native Writer hidden text retains three distinct states: inherited formatting, native w:vanish, and an explicit w:vanish w:val="0" visible reset. The shared Cmd/Ctrl+D dialog preserves mixed selections until the checkbox is edited, while the standard Cmd/Ctrl+Shift+H command toggles the same typed mark and produces one Undo record. Body text, page chrome, footnotes, endnotes, Format Painter, formatting revisions, strict/transitional style inheritance, exact DOCX export, and reopen retain the value. Hidden text is suppressed by default; the View ribbon can reveal it only on editable Writer surfaces with a dotted underline. Read-only preview and detached PDF capture always suppress it. Unchanged comment XML remains source-preserved without claiming rich comment-text editing, and affected paragraphs use browser-authoritative line measurement so invisible glyphs never distort Worker/WASM pagination.

Native Writer outline, shadow, emboss, and imprint retain four independent nullable TextStyle properties backed by exact w:outline, w:shadow, w:emboss, and w:imprint values. Missing properties continue style inheritance and explicit false values remain native resets. Outline and shadow can be enabled together; emboss and imprint are mutually exclusive with every other enabled effect. The shared Cmd/Ctrl+D dialog exposes four independently mixed checkboxes, clears conflicts in the same transaction, and creates one Undo record. Body text, page chrome, notes, Format Painter, formatting revisions, strict/transitional import, exact export, and reopen share the same model. CSS provides bounded browser and PDF paint projections while eligible paragraphs remain on the Worker/WASM layout path. The Playground's 文字效果 template demonstrates all four effects and the conflict-safe transition.

Native Writer character borders retain all 25 visible WordprocessingML w:bdr line styles plus explicit nil and none resets. The typed model keeps direct or theme colors with tint and shade, widths from 2 through 96 eighth-points, text spacing from 0 through 31 points, and explicit shadow and frame flags. The Home Font group exposes a direct Character Border toggle, and the shared Cmd/Ctrl+D Advanced Font Settings dialog distinguishes mixed, Follow style, explicit no-border, and editable border states. Line style, color, width, spacing, shadow, and frame changes apply through one transaction and one Undo record; Format Painter uses the same mark. Traditional Office defines no dedicated shortcut for this command, so A3S Office does not invent one.

Document defaults, paragraph and character styles, body text, headers, footers, footnotes, endnotes, formatting revisions, strict or transitional DOCX import, exact export, and reopen share the model. Malformed, duplicated, misplaced, namespace-spoofed, child- or text-bearing, extra-attribute, art-style, out-of-range, and unresolved-theme input fails closed. The DOM uses data-office-run-border; CSS renders every edge with bounded line-style, padding, shadow, and cloned-fragment projections. Visible character borders use browser-authoritative line measurement because border and padding alter inline geometry, while explicit nil and none remain eligible for Worker/WASM layout. Browser and PDF paint are bounded visual approximations; the OOXML semantics remain exact. The Playground's 字符边框 template exercises the complete authoring and one-step Undo path.

Native Writer character shading retains one exact w:shd value rather than a flattened CSS fill. The typed model preserves every WordprocessingML pattern, direct or automatic foreground/background colors, independent theme channels with tint and shade, and explicit nil. Document defaults, paragraph and character styles, conditional table styles, body, page chrome, notes, formatting revisions, strict/transitional import, exact export, and reopen use the same resolver. Invalid or spoofed leaves fail closed and are diagnosed.

The shared Cmd/Ctrl+D Advanced Font Settings dialog distinguishes mixed, Follow style, explicit no-shading, and editable pattern/color states; changes commit with Format Painter and one-step Undo semantics. The DOM stores bounded JSON in data-office-run-shading, while CSS projects patterns without changing line geometry, so eligible content stays on the Worker/WASM path. Native w:highlight remains independent and takes display precedence without clobbering shading. The Playground's 字符底纹 template demonstrates the complete flow.

Native Writer proofing languages retain the three independent WordprocessingML w:lang slots: Latin w:val, East Asian w:eastAsia, and bidi w:bidi. Native w:noProof remains an independent three-state property: inherited, explicitly checked with w:val="false", or excluded from proofing. The Review ribbon's 设置校对语言 dialog accepts bounded BCP 47 language tags, keeps untouched mixed slots unchanged, exposes Follow style for each slot, and applies the touched language and proofing-state fields through one transaction and one Undo record. The same contract is available while editing headers and footers.

Document defaults, paragraph and character styles, body text, headers, footers, footnotes, endnotes, formatting revisions, strict/transitional DOCX import, exact export, and reopen share the closed model. Malformed, duplicated, misplaced, namespace-spoofed, nested, text-bearing, extra-attribute, invalid-tag, or invalid on/off input fails closed and appears in compatibility diagnostics. The DOM stores canonical JSON in data-office-proofing-languages, stores an explicit Boolean in data-office-no-proof, and projects the effective lang and spellcheck attributes without claiming a bundled dictionary or grammar service. Valid effective languages also reach the Worker/WASM text-layout run and RustyBuzz shaping buffer. The Playground's 校对语言 template demonstrates Latin, East Asian, bidi, explicitly checked, and excluded states.

Supported native OMML equations now survive as bounded structured objects in the document body, headers, footers, footnotes, and endnotes. Inline and display math, Unicode runs with literal/normal-text semantics, math script/style, manual-break, and alignment-point properties, common fractions, scripts, left-side pre-sub/superscripts with empty script slots, radicals with optional degrees, functions, n-ary operators, combining accents, overbars and underbars, group characters with explicit grouping-character placement and baseline justification, phantoms with visible or hidden bases, independently zeroed width, ascent, or descent, and transparent spacing, border boxes with independently visible edges and four strike directions, semantic boxes with operator-emulation, no-break, differential-spacing, manual-break, and alignment properties, bounded rectangular matrices with explicit column alignment, row-spacing and column-gap rules, and minimum column widths, equation arrays with 1–64 rows, vertical base alignment, maximum/object distribution, row-spacing rules, and & alignment/spacer markers, lower and upper limit objects, and delimiters regenerate as m:oMath or m:oMathPara and render an accessible MathML preview. Bar placement preserves the distinct OMML defaults for an omitted barPr and an omitted pos. Group-character normalization separately preserves an absent chr as U+23DF, an explicitly empty chr, bottom pos, and the absent-versus-empty vertJc defaults. Phantom normalization preserves the visible show default and disabled zeroWid, zeroAsc, zeroDesc, and transp defaults; MathML preview uses mphantom and mpadded without discarding the native spacing properties. Pre-scripts preserve required sub, sup, and e ordering and map empty left script slots to MathML none children after mprescripts. Right-side sSup, sSub, and sSubSup objects enforce their property-first argument order. sSubSupPr preserves alnScr, canonicalizes its absent or disabled value to unaligned scripts, and retains the enabled state through native export. Supported fraction, script, limit, radical, function, n-ary, accent, bar, group-character, phantom, border-box, box, matrix, equation-array, and delimiter property containers preserve one optional ordered m:ctrlPr control format through the same bounded Word run-property model. The control may contain a direct w:rPr or bounded tracked provenance rooted at w:ins, w:del, w:moveFrom, or w:moveTo. Each revision retains a non-negative 32-bit w:id, a bounded w:author, an optional validated w:date, and optional Microsoft 365 w16du:dateUtc with a UTC Z suffix. Word's legal moveFrom/moveTo -> ins/del and ins -> del chains are preserved, with the optional w:rPr at the deepest level. Every supported deg, den, e, fName, lim, num, sub, and sup argument slot preserves the same direct or revision-wrapped control format after its expressions. Empty ctrlPr or direct w:rPr values canonicalize away, while an empty revision remains native provenance. Safe object-control values project only onto separable MathML control/operator nodes; argument-slot formatting and all revision provenance remain native metadata because professional MathML has neither linear-build control characters nor Word review/move-range semantics. Document-level move-range pairing is not inferred from an isolated equation. Matrix properties follow the ordered baseJc -> plcHide -> rSpRule -> cGpRule -> rSp -> cSp -> cGp -> mcs -> ctrlPr grammar. Row and column rules accept single, 1.5, double, exact, and multiple spacing. rSp and cGp are bounded to 65,535, while the minimum column width cSp is bounded to 31,680 twips. If any spacing property is present, omitted or attribute-free peers take their Word defaults and native export emits a complete canonical spacing group. Row spacing and column gaps project to MathML rowspacing and columnspacing; cSp remains native-only for layout because MathML columnwidth is a fixed width rather than Word's minimum. Fractions enforce optional fPr before required num and den arguments. An absent type or an attribute-free type canonicalizes to bar; noBar, skw, and lin remain distinct through native export and MathML projection. Radicals enforce radPr, optional deg, and e ordering. An omitted or empty degree normalizes to a square root, while a visible nonempty degree remains an nth root. Native export emits the canonical radPr -> deg -> e shape and uses degHide=1 with an empty degree slot for square roots. Functions enforce optional funcPr before required fName and e slots. Both required slots may be empty. Every supported CT_OMathArg slot may likewise be empty and follows argPr -> expressions -> ctrlPr. Its optional trailing ctrlPr retains one bounded direct or revision-wrapped Word control; fixed slots use named metadata, while matrix cells, equation-array rows, and delimiter arguments use strictly dimension-aligned metadata. Absent or empty argument/control properties and absent, empty, or zero argSz values normalize to the default. Bounded argSz values from -2 through 2 round-trip as relative argument sizes. The Word-effective box/e, groupChr/e, limLow/lim, limUpp/lim, nary/sub, nary/sup, rad/deg, sPre/sub, sPre/sup, sSub/sub, sSubSup/sub, sSubSup/sup, and sSup/sup pairs project to inverse-sign relative MathML scriptlevel; valid sizes in other argument slots remain native metadata. Out-of-range or malformed sizes, duplicate or misplaced properties, malformed control-revision identities or nesting, and semantic argument properties fail closed. N-ary operators enforce optional naryPr before required sub, sup, and e slots. An omitted chr defaults to U+222B, while an attribute-free chr remains an explicitly empty unsupported operator; an attribute-free limLoc defaults to undOvr. Omitted or disabled grow values normalize to the non-growing default; an attribute-free or enabled grow round-trips and maps to MathML stretchy=true. Native export always emits both limit slots with subHide or supHide for absent scripts. Delimiters require optional dPr before 1–32 e arguments and preserve empty argument slots. Their properties follow begChr -> sepChr -> endChr -> grow -> shp -> ctrlPr; omitted characters normalize to (, U+2502, and ), while attribute-free character properties remain explicitly empty. Omitted or enabled grow and omitted, attribute-free, or centered shapes canonicalize to the growing centered defaults. Non-growing and match shapes round-trip in schema order. MathML projects fixed delimiters with stretchy=false and content-matched growing delimiters with symmetric=false; Word ignores shape while delimiter growth is disabled. Display equations preserve left, right, center, and centerGroup paragraph justification. The bounded native grammar accepts one optional m:oMathParaPr before one m:oMath, while absent properties, absent m:jc, and an attribute-