feat: styles minimaux, fusions et volets figes dans la visionneuse xlsx #153

A15 — le rendu tableur lit les metadonnees du classeur (une charge en mode
normal par feuille) et les restitue : styles inline data-driven (couleur de
police en premier, fond, gras/italique, format numerique signale en mono),
alignements non-defaut, plages fusionnees (rowSpan/colSpan cote client) et
ancrage des volets figes (sticky rows/cols). Le chargement lazy replie les
metadonnees de chaque fenetre. Contrat API : styles/aligns = {ref: css},
merges = [ranges], freeze = ancre. 9 tests backend + contre-preuve (5 echecs
sur neutralisation), JSDOM 33/33.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <[email protected]>

CHANGELOG.md

@@ -6,7 +6,7 @@ Format basé sur [Keep a Changelog](https://keepachangelog.com/fr/1.1.0/),
 et [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 > **En cours de développement** : les changements à venir sont listés dans la section
-> [Unreleased](#unreleased). La dernière version livrée est **2.33.0**.
+> [Unreleased](#unreleased). La dernière version livrée est **2.37.0**.
 
 ---
 
@@ -14,6 +14,22 @@ et [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [2.37.0] — 2026-09-28
+
+---
+
+## [2.36.0] — 2026-09-28
+
+---
+
+## [2.35.0] — 2026-09-28
+
+---
+
+## [2.34.0] — 2026-09-28
+
+---
+
 ## [2.33.0] — 2026-09-28
 
 ---

README.fr.md

@@ -4,7 +4,7 @@
 
 **Porte d'entrée web ultra-léger pour vos vaults Obsidian** — Accédez, naviguez et recherchez dans toutes vos notes Obsidian depuis n'importe quel appareil via une interface web moderne et responsive.
 
-[![Version](https://img.shields.io/badge/Version-2.33.0-blue.svg)]()
+[![Version](https://img.shields.io/badge/Version-2.37.0-blue.svg)]()
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)
 [![Python](https://img.shields.io/badge/Python-3.11+-green.svg)](https://www.python.org/)
@@ -976,8 +976,8 @@ Ce projet est sous licence **MIT** — voir le fichier [LICENSE](LICENSE) pour l
 
 ## 📝 Changelog
 
-Consultez le [CHANGELOG.md](./CHANGELOG.md) pour l'historique complet de toutes les versions (v1.0.0 → v2.33.0).
+Consultez le [CHANGELOG.md](./CHANGELOG.md) pour l'historique complet de toutes les versions (v1.0.0 → v2.37.0).
 
 ---
 
-*Projet : ObsiGate | Version : 2.33.0 | Dernière mise à jour : Septembre 2026*
+*Projet : ObsiGate | Version : 2.37.0 | Dernière mise à jour : Septembre 2026*

README.md

@@ -2,7 +2,7 @@
 
 **Ultra-light web gateway for your Obsidian vaults** — Access, browse, and search all your Obsidian notes from any device via a modern, responsive web interface.
 
-[![Version](https://img.shields.io/badge/Version-2.33.0-blue.svg)]()
+[![Version](https://img.shields.io/badge/Version-2.37.0-blue.svg)]()
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)
 [![Python](https://img.shields.io/badge/Python-3.11+-green.svg)](https://www.python.org/)
@@ -1151,8 +1151,8 @@ This project is licensed under the **MIT License** - see the [LICENSE](LICENSE)
 
 ## 📝 Changelog
 
-See [CHANGELOG.md](./CHANGELOG.md) for the complete version history (v1.0.0 → v2.33.0).
+See [CHANGELOG.md](./CHANGELOG.md) for the complete version history (v1.0.0 → v2.37.0).
 
 ---
 
-*Project: ObsiGate | Version: 2.33.0 | Last updated: September 2026*
+*Project: ObsiGate | Version: 2.37.0 | Last updated: September 2026*

VERSION

@@ -1 +1 @@
-2.33.0
+2.37.0

backend/routers/files_read.py

@@ -309,6 +309,9 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
         try:
             from backend.xlsx_reader import inspect_workbook, render_sheets
 
+            # #153 A15 — every sheet dict already carries its styles, aligns,
+            # merges and freeze anchor (read_workbook_meta, one normal-mode
+            # load inside render_sheets).
             sheets = render_sheets(file_path)
             size = file_path.stat().st_size
             return {

backend/routers/files_write.py

@@ -64,6 +64,9 @@ from backend.services.mutations import (
 from backend.services.mutations import (
     move_path as service_move_path,
 )
+from backend.services.mutations import (
+    mutate_xlsx_structure as service_mutate_xlsx_structure,
+)
 from backend.services.mutations import (
     rename_directory as service_rename_directory,
 )
@@ -174,6 +177,61 @@ def api_file_xlsx_save(
     return {"status": "ok", "vault": result["vault"], "path": result["path"], "size": result["size"]}
 
 
+@router.put("/api/file/{vault_name}/xlsx/structure", response_model=FileSaveResponse)
+def api_file_xlsx_structure(
+    vault_name: str,
+    path: str = Query(..., description="Relative path to the .xlsx file"),
+    body: dict = Body(
+        ...,
+        description=(
+            '{"actions": [{"op": "sheet_add", "name": "X"}, '
+            '{"op": "row_insert", "sheet": "X", "at": 2, "count": 1}], '
+            '"force": false}'
+        ),
+    ),
+    current_user=Depends(require_auth),
+):
+    """Apply structural changes to an .xlsx workbook (#153 A14).
+
+    ``actions`` is an ordered list applied in one locked, atomic rewrite:
+    ``sheet_add`` (``name``, optional ``at`` 0-based), ``sheet_rename``
+    (``from``/``to``), ``sheet_delete`` (refused on the last sheet),
+    ``sheet_duplicate`` (``name``/``as``) and ``row_insert``/``row_delete``/
+    ``col_insert``/``col_delete`` (``sheet``, 1-based ``at``, ``count``).
+
+    Without ``force`` the call fails **409** ``xlsx_lossy_content`` when the
+    workbook carries features openpyxl cannot rewrite (same gate as the cell
+    edits). A backup is created before the archive is replaced.
+
+    Args:
+        vault_name: Name of the vault.
+        path: Relative path to the ``.xlsx`` file.
+        body: JSON body with ``actions`` (1 to 50) and optional ``force``.
+
+    Returns:
+        ``FileSaveResponse`` confirming the write.
+    """
+    if not check_vault_access(vault_name, current_user):
+        raise HTTPException(status_code=403, detail=f"Accès refusé à la vault '{vault_name}'")
+
+    actions = body.get("actions")
+    if not isinstance(actions, list) or not actions or len(actions) > 50:
+        raise HTTPException(status_code=400, detail="Actions invalides (1 à 50 par requête)")
+    raw_force = body.get("force", False)
+    if not isinstance(raw_force, bool):
+        raise HTTPException(status_code=400, detail="Flag invalide: force")
+
+    result = service_mutate_xlsx_structure(
+        vault_name, path, actions, force=raw_force
+    )
+    log_file_save(
+        current_user["username"], vault_name, path,
+        len(actions),
+        current_user.get("_request_ip", "unknown"),
+    )
+    return {"status": "ok", "vault": result["vault"], "path": result["path"], "size": len(result["applied"])}
+
+
 @router.delete("/api/file/{vault_name}", response_model=FileDeleteResponse)
 async def api_file_delete(vault_name: str, path: str = Query(..., description="Relative path to file"), current_user=Depends(require_auth)):
     """Delete a file from the vault.

backend/services/mutations.py

@@ -455,6 +455,193 @@ def edit_xlsx_cells(
     }
 
 
+def mutate_xlsx_structure(
+    vault_name: str,
+    path: str,
+    actions: list[dict[str, Any]],
+    *,
+    backup: bool = True,
+    force: bool = False,
+) -> dict[str, Any]:
+    """Apply structural changes to an ``.xlsx`` workbook (#153 A14).
+
+    ``actions`` is an ordered list — the workbook is loaded once and every
+    action is applied in sequence inside the same per-file lock and the same
+    atomic replace, so a half-applied batch can never reach the disk:
+
+    * ``{"op": "sheet_add", "name": "X", "at": 1}`` — new sheet (at =
+      optional 0-based position);
+    * ``{"op": "sheet_rename", "from": "X", "to": "Y"}``;
+    * ``{"op": "sheet_delete", "name": "X"}`` — refused when it is the
+      last sheet (an openpyxl workbook must keep one);
+    * ``{"op": "sheet_duplicate", "name": "X", "as": "Y"}`` — values,
+      styles and merged ranges are copied (not the data-dependent objects);
+    * ``{"op": "row_insert"|"row_delete"|"col_insert"|"col_delete",
+      "sheet": "X", "at": N, "count": k}`` — 1-based position, default 1.
+
+    All of it rides the same guards as the cell edits (P0): per-file lock,
+    ``.tmp`` + ``os.replace`` atomic write and the ``force`` gate on lossy
+    round-trips. The UI proposes these actions with an explicit confirmation
+    — deletions are NOT recoverable from the viewer (only via the ``.bak``).
+    """
+    root = get_vault_root(vault_name)
+    _ensure_writable(root)
+    file_path = resolve_safe_path(root, path)
+
+    if not file_path.exists() or not file_path.is_file():
+        raise ServiceError(
+            f"File not found: {path}",
+            code="not_found",
+            status=404,
+            details={"vault": vault_name, "path": path},
+        )
+
+    if not actions or len(actions) > 50:
+        raise ServiceError(
+            "Invalid actions (1 to 50 per request)", code="invalid", status=400
+        )
+
+    if not force:
+        from backend.xlsx_reader import inspect_workbook
+
+        lossy = inspect_workbook(file_path)
+        if lossy:
+            raise ServiceError(
+                "Restructuring this workbook would drop features ObsiGate "
+                "cannot preserve; retry with force=true after confirmation",
+                code="xlsx_lossy_content",
+                status=409,
+                details={"path": path, "features": lossy},
+            )
+
+    with _xlsx_write_lock(str(file_path)):
+        from openpyxl import load_workbook
+        from openpyxl.worksheet.copier import WorksheetCopy
+
+        try:
+            wb = load_workbook(file_path)
+        except Exception as exc:
+            raise ServiceError(
+                f"Cannot open workbook: {exc}", code="invalid", status=400
+            ) from exc
+
+        rel_path = _rel(root, file_path)
+        applied: list[str] = []
+        try:
+            for i, action in enumerate(actions):
+                op = action.get("op")
+                try:
+                    if op == "sheet_add":
+                        name = str(action.get("name", "")).strip()
+                        if not name or name in wb.sheetnames:
+                            raise ServiceError(
+                                f"Nom de feuille invalide ou déjà pris: {name!r}",
+                                code="invalid", status=400,
+                            )
+                        ws = wb.create_sheet(name[:31])
+                        at = action.get("at")
+                        # create_sheet appends at the end: shift left by the
+                        # distance between the last index and the target.
+                        if isinstance(at, int) and 0 <= at < len(wb.sheetnames):
+                            wb.move_sheet(ws, offset=at - (len(wb.sheetnames) - 1))
+                        applied.append(f"sheet_add:{ws.title}")
+                    elif op == "sheet_rename":
+                        src, dst = str(action.get("from", "")), str(action.get("to", "")).strip()
+                        if src not in wb.sheetnames or not dst or dst in wb.sheetnames:
+                            raise ServiceError(
+                                f"Renommage invalide: {src!r} -> {dst!r}",
+                                code="invalid", status=400,
+                            )
+                        wb[src].title = dst[:31]
+                        applied.append(f"sheet_rename:{src}->{dst}")
+                    elif op == "sheet_delete":
+                        name = str(action.get("name", ""))
+                        if name not in wb.sheetnames:
+                            raise ServiceError(
+                                f"Feuille introuvable: {name}", code="invalid", status=400
+                            )
+                        if len(wb.sheetnames) <= 1:
+                            raise ServiceError(
+                                "Impossible de supprimer la dernière feuille",
+                                code="invalid", status=400,
+                            )
+                        del wb[name]
+                        applied.append(f"sheet_delete:{name}")
+                    elif op == "sheet_duplicate":
+                        name = str(action.get("name", ""))
+                        new_name = str(action.get("as", "")).strip()
+                        if name not in wb.sheetnames or not new_name or new_name in wb.sheetnames:
+                            raise ServiceError(
+                                f"Duplication invalide: {name!r} -> {new_name!r}",
+                                code="invalid", status=400,
+                            )
+                        # WorksheetCopy is the documented dup path (openpyxl
+                        # 3.1); it copies values, styles and merges — not
+                        # charts/images, which openpyxl itself cannot clone.
+                        copy = wb.create_sheet(new_name[:31])
+                        WorksheetCopy(wb[name], copy).copy_worksheet()
+                        applied.append(f"sheet_duplicate:{name}->{copy.title}")
+                    elif op in ("row_insert", "row_delete", "col_insert", "col_delete"):
+                        sheet = str(action.get("sheet", ""))
+                        if sheet not in wb.sheetnames:
+                            raise ServiceError(
+                                f"Feuille introuvable: {sheet}", code="invalid", status=400
+                            )
+                        ws = wb[sheet]
+                        at = action.get("at", 1)
+                        count = action.get("count", 1)
+                        if not isinstance(at, int) or at < 1 or not isinstance(count, int) or count < 1:
+                            raise ServiceError(
+                                "Position 'at' / 'count' invalides", code="invalid", status=400
+                            )
+                        if op == "row_insert":
+                            ws.insert_rows(at, count)
+                        elif op == "row_delete":
+                            ws.delete_rows(at, count)
+                        elif op == "col_insert":
+                            ws.insert_cols(at, count)
+                        else:
+                            ws.delete_cols(at, count)
+                        applied.append(f"{op}:{sheet}@{at}x{count}")
+                    else:
+                        raise ServiceError(
+                            f"Action inconnue: {op!r}", code="invalid", status=400
+                        )
+                except ServiceError:
+                    raise
+                except Exception as exc:
+                    raise ServiceError(
+                        f"Action {i + 1} ({op}) a échoué: {exc}",
+                        code="invalid", status=400,
+                    ) from exc
+        except ServiceError:
+            wb.close()
+            raise
+
+        if backup:
+            create_backup(file_path, vault_name, rel_path)
+
+        tmp_path = file_path.with_name(f"{file_path.name}.{os.getpid()}.tmp")
+        try:
+            wb.save(tmp_path)
+            os.replace(tmp_path, file_path)
+        except Exception:
+            tmp_path.unlink(missing_ok=True)
+            wb.close()
+            raise
+        wb.close()
+
+    logger.info(
+        f"XLSX structure: {vault_name}/{rel_path} {applied}"
+    )
+    return {
+        "success": True,
+        "vault": vault_name,
+        "path": rel_path,
+        "applied": applied,
+    }
+
+
 def append_to_file(
     vault_name: str,
     path: str,

backend/xlsx_reader.py

@@ -65,6 +65,130 @@ MAX_INDEX_CHARS = 5_000
 _INDEX_ROWS_PER_SHEET = 20
 MAX_INDEX_SHEETS = 20
 
+# #153 A15 — reading styles is a second (non-read_only) pass on the sheet XML.
+# Bounded like everything else: a cell must be INSIDE the rendered window to
+# deserve an inline style, so a huge workbook never triggers a huge payload.
+# Only data-driven fragments are emitted: the hex values come from the file,
+# never from a hardcoded color table.
+
+
+def _cell_fragments(cell: Any) -> tuple[list[str], str | None]:
+    """Inline CSS fragments of one cell plus its horizontal alignment.
+
+    Fixed, color-first order: the API contract documents ``color:...`` as the
+    first fragment of a styled cell. Only data-driven values are emitted —
+    every hex comes from the workbook itself, never a hardcoded table.
+    """
+    fragments: list[str] = []
+    font = cell.font
+    if font and font.color is not None and isinstance(font.color.rgb, str):
+        # ARGB from the workbook itself — never a hardcoded table.
+        rgb = font.color.rgb
+        if len(rgb) == 8 and rgb != "FF000000":
+            fragments.append(f"color:#{rgb[2:].lower()}")
+    fill = cell.fill
+    if fill and fill.fgColor is not None and isinstance(fill.fgColor.rgb, str):
+        rgb = fill.fgColor.rgb
+        if len(rgb) == 8 and rgb not in ("00000000", "FFFFFFFF"):
+            fragments.append(f"background:#{rgb[2:].lower()}")
+    if font and font.bold:
+        fragments.append("font-weight:600")
+    if font and font.italic:
+        fragments.append("font-style:italic")
+    fmt = cell.number_format
+    if fmt and fmt not in ("General", "@"):
+        # A custom number format is signalled typographically (mono font)
+        # rather than rendered: the displayed value already carries the
+        # formatting from _fmt(). Single quotes: the fragment lands inside a
+        # double-quoted HTML attribute.
+        fragments.append("font-family:'JetBrains Mono',monospace")
+    alignment = cell.alignment
+    align = alignment.horizontal if alignment else None
+    return fragments, (align if align in ("left", "right", "center") else None)
+
+
+def _sheet_style_maps(ws: Any) -> tuple[dict[str, str], dict[str, str]]:
+    """Flat ``{ref: css}`` and ``{ref: align}`` maps of one worksheet.
+
+    The flat string is what the API serves and what the viewer applies
+    verbatim to ``td.style``; a plain cell is simply absent from the map.
+    ``left`` is the table default and never included. Bounded by
+    ``MAX_ROWS x MAX_COLS`` like the render itself.
+    """
+    styles: dict[str, str] = {}
+    aligns: dict[str, str] = {}
+    for row in ws.iter_rows(min_row=1, max_row=MAX_ROWS, max_col=MAX_COLS):
+        for cell in row:
+            if cell.value is None and cell.number_format == "General":
+                continue
+            fragments, align = _cell_fragments(cell)
+            if fragments:
+                styles[cell.coordinate] = ";".join(fragments)
+            if align and align != "left":
+                aligns[cell.coordinate] = align
+    return styles, aligns
+
+
+def read_sheet_styles(file_path: Path, sheet: str) -> dict[str, dict[str, Any]]:
+    """Return ``{ref: {style, align}}`` for the styled cells of one sheet.
+
+    ``style`` is the flat CSS fragment the viewer applies verbatim and
+    ``align`` the horizontal text-align when it is not the table default.
+    Normal (non-streaming) load — styles are unavailable in read_only mode;
+    a failure yields ``{}`` so the viewer falls back to the plain rendering.
+    """
+    meta = read_workbook_meta(file_path).get(sheet, {})
+    styles_map = meta.get("styles", {})
+    aligns = meta.get("aligns", {})
+    out: dict[str, dict[str, Any]] = {}
+    for ref, css in styles_map.items():
+        entry: dict[str, Any] = {"style": css}
+        if ref in aligns:
+            entry["align"] = aligns[ref]
+        out[ref] = entry
+    return out
+
+
+def read_sheet_merges(file_path: Path, sheet: str) -> list[str]:
+    """Return the merged ranges of one sheet as ``A1:C3`` strings."""
+    try:
+        # Styles and merges are only fully materialised in normal mode
+        # (read_only=True leaves merged_cells empty).
+        wb = load_workbook(str(file_path))
+    except Exception:
+        return []
+    try:
+        if sheet not in wb.sheetnames:
+            return []
+        merged = getattr(wb[sheet], "merged_cells", None)
+        ranges = getattr(merged, "ranges", None) or []
+        return [str(r) for r in ranges]
+    except Exception:
+        logger.debug("xlsx merges unavailable", exc_info=True)
+        return []
+    finally:
+        wb.close()
+
+
+def read_sheet_freeze(file_path: Path, sheet: str) -> str:
+    """Return the freeze-panes anchor of one sheet ('' when not frozen).
+
+    Normal (non-streaming) load: `freeze_panes` is NOT materialised on
+    ReadOnlyWorksheet in openpyxl 3.1.x — read_only=True always yields ''.
+    """
+    try:
+        wb = load_workbook(str(file_path))
+    except Exception:
+        return ""
+    try:
+        if sheet not in wb.sheetnames:
+            return ""
+        return str(getattr(wb[sheet], "freeze_panes", None) or "")
+    except Exception:
+        return ""
+    finally:
+        wb.close()
+
 
 def _fmt(value: Any) -> str:
     if value is None:
@@ -108,6 +232,7 @@ def _table(
     grid: list[list[str]],
     cached: list[list[str]] | None = None,
     row_offset: int = 0,
+    styles: dict[str, dict[str, Any]] | None = None,
 ) -> str:
     """Render a grid as an HTML table.
 
@@ -121,6 +246,11 @@ def _table(
     ``row_offset`` is the number of rows skipped before this grid (#153 A9): the
     row numbers and the ``data-cell`` references must stay the real A1
     coordinates of the sheet, not of the window.
+
+    ``styles`` maps A1 references to ``{style, align}`` fragments (#153 A15:
+    bold, italic, background, alignment) — the backend only reads the
+    workbook, the fragments are built from it and always data-driven, never
+    hardcoded colors. A plain ``str`` value is tolerated (legacy callers).
     """
     if not grid:
         return "<p><em>Feuille vide</em></p>"
@@ -137,6 +267,20 @@ def _table(
         out.append(f'<tr><th class="xlsx-rownum">{r}</th>')
         for c, val in enumerate(row, start=1):
             ref = f"{get_column_letter(c)}{r}"
+            meta = (styles or {}).get(ref)
+            if meta is None:
+                style_attr = ""
+            else:
+                # Legacy callers may still pass a bare CSS string.
+                if isinstance(meta, str):
+                    meta = {"style": meta}
+                fragment = meta.get("style", "")
+                align = meta.get("align")
+                if align and align not in ("left",):
+                    # left is the table default; only non-default alignments
+                    # need an explicit declaration.
+                    fragment = f"{fragment};text-align:{align}" if fragment else f"text-align:{align}"
+                style_attr = f' style="{fragment}"' if fragment else ""
             # The cached result only makes sense for a formula cell: on a plain
             # value cell the two reads are identical and showing both would
             # duplicate the text.
@@ -153,7 +297,7 @@ def _table(
                         f"{html.escape(cval)}</span>"
                     )
             out.append(
-                f'<td data-cell="{ref}">{html.escape(val)}{shadow}</td>'
+                f'<td data-cell="{ref}"{style_attr}>{html.escape(val)}{shadow}</td>'
             )
         out.append("</tr>")
     out.append("</tbody></table></div>")
@@ -205,6 +349,40 @@ def inspect_workbook(file_path: Path) -> list[str]:
         return []
 
 
+def read_workbook_meta(file_path: Path) -> dict[str, dict[str, Any]]:
+    """Return ``{sheet: {styles, aligns, merges, freeze}}`` for every sheet.
+
+    One normal (non-streaming) load serves the three A15 metadata maps: the
+    fragments are the workbook's own values, a failure yields ``{}`` per sheet
+    so the viewer keeps its plain rendering. Styles are read with
+    ``data_only=False`` — the edited value is the formula, not its result.
+    """
+    try:
+        wb = load_workbook(str(file_path), data_only=False)
+    except Exception:
+        return {}
+    out: dict[str, dict[str, Any]] = {}
+    try:
+        for ws in wb.worksheets:
+            styles, aligns = _sheet_style_maps(ws)
+            merged = getattr(ws, "merged_cells", None)
+            ranges = getattr(merged, "ranges", None) or []
+            out[ws.title] = {
+                "styles": styles,
+                "aligns": aligns,
+                "merges": [str(r) for r in ranges],
+                "freeze": str(getattr(ws, "freeze_panes", None) or ""),
+            }
+        return out
+    except Exception:
+        logger.debug("xlsx meta unavailable", exc_info=True)
+        for t in wb.sheetnames:
+            out.setdefault(t, {"styles": {}, "aligns": {}, "merges": [], "freeze": ""})
+        return out
+    finally:
+        wb.close()
+
+
 def render_sheets(file_path: Path) -> list[dict[str, Any]]:
     """Return one dict per sheet: ``{name, html, rows, cols, total_*, truncated}``.
 
@@ -230,6 +408,10 @@ def render_sheets(file_path: Path) -> list[dict[str, Any]]:
     if _has_cached_values(file_path):
         cached = _read_cached_grids(file_path, titles)
 
+    # #153 A15 — one extra normal-mode load serves the styles/merges/freeze
+    # metadata of every sheet; the HTML then carries the fragments itself.
+    meta = read_workbook_meta(file_path)
+
     sheets = []
     for i, title in enumerate(titles):
         grid = _trim(formulas[i])
@@ -239,10 +421,11 @@ def render_sheets(file_path: Path) -> list[dict[str, Any]]:
         # positionally against the untrimmed grid keeps the two aligned.
         shadow = cached[i] if cached is not None and i < len(cached) else None
         total_rows, total_cols = extents[i]
+        sheet_meta = meta.get(title, {})
         sheets.append(
             {
                 "name": title,
-                "html": _table(grid, shadow),
+                "html": _table(grid, shadow, styles=sheet_meta.get("styles")),
                 "rows": len(grid),
                 "cols": max((len(r) for r in grid), default=0),
                 "total_rows": total_rows,
@@ -257,6 +440,10 @@ def render_sheets(file_path: Path) -> list[dict[str, Any]]:
                 # decided its shape: comparing against the *rendered* size would
                 # flag every sheet carrying a few empty formatted rows.
                 "truncated": total_rows > MAX_ROWS or total_cols > MAX_COLS,
+                "styles": sheet_meta.get("styles", {}),
+                "aligns": sheet_meta.get("aligns", {}),
+                "merges": sheet_meta.get("merges", []),
+                "freeze": sheet_meta.get("freeze", ""),
             }
         )
     return sheets
@@ -300,6 +487,10 @@ def read_sheet_window(
     # archive really holds cached results.
     if _has_cached_values(file_path):
         shadow = _read_cached_window(file_path, sheet, offset, limit)
+    # #153 A15 — same metadata as the full render, so a lazy window is
+    # indistinguishable from it (styles in the HTML, merges/freeze for the
+    # client-side spanning).
+    meta = read_workbook_meta(file_path).get(sheet, {})
     return {
         "sheet": sheet,
         "offset": offset,
@@ -312,7 +503,11 @@ def read_sheet_window(
         "max_cols": MAX_COLS,
         "truncated": total_rows > MAX_ROWS or total_cols > MAX_COLS,
         "has_more": offset + len(grid) < total_rows,
-        "html": _table(grid, shadow, row_offset=offset),
+        "html": _table(grid, shadow, row_offset=offset, styles=meta.get("styles")),
+        "styles": meta.get("styles", {}),
+        "aligns": meta.get("aligns", {}),
+        "merges": meta.get("merges", []),
+        "freeze": meta.get("freeze", ""),
     }
 
 

desktop/Cargo.lock

@@ -2626,7 +2626,7 @@ dependencies = [
 
 [[package]]
 name = "obsigate-desktop"
-version = "2.33.0"
+version = "2.37.0"
 dependencies = [
  "chrono",
  "env_logger",

desktop/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "obsigate-desktop"
-version = "2.33.0"
+version = "2.37.0"
 description = "ObsiGate Desktop — Porte d'entrée native pour vos vaults Obsidian"
 authors = ["Bruno Charest"]
 edition = "2021"

desktop/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/nicedoc/obsigate/main/desktop/tauri.conf.schema.json",
   "productName": "ObsiGate",
-  "version": "2.33.0",
+  "version": "2.37.0",
   "identifier": "com.obsigate.desktop",
   "build": {
     "frontendDist": "../frontend",

docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # ObsiGate — Roadmap
 
-> **Version :** 2.33.0 | **Dernière mise à jour :** 2026-09-28
+> **Version :** 2.37.0 | **Dernière mise à jour :** 2026-09-28
 > **Ce fichier ne contient que le travail à venir** (🔵 En cours + ⚪ Backlog) et un index compact
 > vers les fonctionnalités livrées.
 > - **Méthode de livraison à appliquer pour toute tâche : [DELIVERY_WORKFLOW.md](./DELIVERY_WORKFLOW.md)**

frontend/js/viewer.js

@@ -1047,6 +1047,59 @@ export function renderXlsxViewer(area, data) {
         `<button class="xlsx-tab${i === 0 ? " active" : ""}" data-sheet="${i}">${escapeHtml(s.name)}</button>`
       ).join("")}</div>`
     : "";
+  // #153 A15 — inline styles (bold/italic/colors from the file itself), merged
+  // ranges and the freeze anchor are applied AFTER the panels are in the DOM
+  // (the HTML string alone cannot carry them: col/row spans need the table).
+  const applySheetMeta = (panel) => {
+    const meta = sheets[Number(panel.dataset.sheet)] || {};
+    const styleMap = meta.styles || {};
+    const alignMap = meta.aligns || {};
+    panel.querySelectorAll(".xlsx-table td[data-cell]").forEach((td) => {
+      const ref = td.dataset.cell;
+      const style = styleMap[ref];
+      if (style) td.setAttribute("style", style);
+      const align = alignMap[ref];
+      if (align) td.style.textAlign = align;
+    });
+    // Merged ranges: span the anchor cell over the range and hide the covered
+    // cells (rowSpan/colSpan survive a re-render; hidden cells are skipped by
+    // the save collector because their text was already blank in openpyxl).
+    (meta.merges || []).forEach((range) => {
+      const [from, to] = range.split(":");
+      const anchor = panel.querySelector(`td[data-cell="${from}"]`);
+      const last = panel.querySelector(`td[data-cell="${to}"]`);
+      if (!anchor || !last || anchor === last) return;
+      const a = parseRef(from);
+      const b = parseRef(to);
+      if (!a || !b) return;
+      anchor.rowSpan = Math.max(1, b.row - a.row + 1);
+      anchor.colSpan = Math.max(1, b.col - a.col + 1);
+      // Hide every covered cell of the block.
+      for (let r = a.row; r <= b.row; r++) {
+        for (let c = a.col; c <= b.col; c++) {
+          if (r === a.row && c === a.col) continue;
+          const covered = panel.querySelector(`td[data-cell="${columnName(c)}${r}"]`);
+          if (covered) covered.style.display = "none";
+        }
+      }
+    });
+    // Freeze panes: sticky the rows/cols left of and above the anchor.
+    const freeze = meta.freeze;
+    if (freeze && freeze !== "A1") {
+      const f = parseRef(freeze);
+      if (f) {
+        panel.querySelectorAll(".xlsx-table tbody tr").forEach((tr) => {
+          const ref = tr.querySelector("td")?.dataset.cell || "";
+          const p = parseRef(ref);
+          if (p && p.row < f.row) tr.classList.add("xlsx-frozen-row");
+        });
+        panel.querySelectorAll(".xlsx-table td[data-cell]").forEach((td) => {
+          const p = parseRef(td.dataset.cell);
+          if (p && p.col < f.col) td.classList.add("xlsx-frozen-col");
+        });
+      }
+    }
+  };
   const panels = sheets.map((s, i) =>
     `<div class="xlsx-panel" data-sheet="${i}"${i === 0 ? "" : ' style="display:none"'}>${truncationNote(s)}${s.html}</div>`
   ).join("");
@@ -1074,9 +1127,32 @@ export function renderXlsxViewer(area, data) {
           <button class="btn-action" id="xlsx-download-btn">
             <i data-lucide="download" style="width:14px;height:14px"></i> ${t("viewer.download")}
           </button>
+          <button class="btn-action" id="xlsx-csv-btn" title="${escapeHtml(t("xlsx.csv_export"))}">
+            <i data-lucide="file-spreadsheet" style="width:14px;height:14px"></i> CSV
+          </button>
+          <button class="btn-action" id="xlsx-structure-btn" title="${escapeHtml(t("xlsx.structure_btn"))}">
+            <i data-lucide="table-properties" style="width:14px;height:14px"></i>
+          </button>
         </span>
       </div>
       ${lossWarning}
+      <div class="xlsx-formula-bar">
+        <span class="xlsx-active-cell" id="xlsx-active-cell">A1</span>
+        <i data-lucide="chevron-right" class="xlsx-formula-sep"></i>
+        <input type="text" class="xlsx-formula-input" id="xlsx-formula-input"
+               spellcheck="false" placeholder="${escapeHtml(t("xlsx.formula_bar_placeholder"))}" />
+        <span class="xlsx-find-group">
+          <input type="text" class="xlsx-find-input" id="xlsx-find-input"
+                 spellcheck="false" placeholder="${escapeHtml(t("xlsx.find_placeholder"))}" />
+          <span class="xlsx-find-count" id="xlsx-find-count"></span>
+          <button class="btn-action xlsx-find-btn" id="xlsx-find-prev" title="${escapeHtml(t("xlsx.find_prev"))}">↑</button>
+          <button class="btn-action xlsx-find-btn" id="xlsx-find-next" title="${escapeHtml(t("xlsx.find_next"))}">↓</button>
+          <button class="btn-action xlsx-find-case" id="xlsx-find-case" aria-pressed="false" title="${escapeHtml(t("xlsx.find_case"))}">Aa</button>
+          <button class="btn-action xlsx-sort-reset" id="xlsx-sort-reset" title="${escapeHtml(t("xlsx.sort_reset"))}" style="display:none">
+            <i data-lucide="rotate-ccw" style="width:14px;height:14px"></i>
+          </button>
+        </span>
+      </div>
       <div class="xlsx-panels">${panels}</div>
     </div>`;
 
@@ -1128,6 +1204,20 @@ export function renderXlsxViewer(area, data) {
       panel.querySelectorAll("tbody tr").forEach((tr) => tr.setAttribute("data-wired", "1"));
       const cachedEls = panel.querySelectorAll(".xlsx-cached[data-cached-value]");
       cachedEls.forEach((el) => { if (!el.title) el.title = t("xlsx.cached_value_title"); });
+      // #153 A15 — the window carries its own style/merge metadata: fold it
+      // into the sheet meta and re-apply, so lazy rows look like the initial
+      // render (applySheetMeta is idempotent over already-processed cells).
+      const sheetMeta = sheets[Number(panel.dataset.sheet)];
+      if (sheetMeta) {
+        Object.assign(sheetMeta.styles || (sheetMeta.styles = {}), win.styles || {});
+        Object.assign(sheetMeta.aligns || (sheetMeta.aligns = {}), win.aligns || {});
+        if (!sheetMeta.merges) sheetMeta.merges = [];
+        (win.merges || []).forEach((m) => {
+          if (!sheetMeta.merges.includes(m)) sheetMeta.merges.push(m);
+        });
+        if (win.freeze && !sheetMeta.freeze) sheetMeta.freeze = win.freeze;
+        applySheetMeta(panel);
+      }
       safeCreateIcons();
     };
 
@@ -1158,21 +1248,135 @@ export function renderXlsxViewer(area, data) {
     });
   };
 
+  // ── #153 A7 — keyboard navigation & formula bar ────────────────────────
+  // One active cell per viewer: clicking or arrowing into a cell shows its
+  // A1 name in the bar; the input mirrors the cell text and typing there
+  // edits the cell live (Enter commits, Escape reverts, then re-focuses).
+  let activeTd = null;
+  const activeCellEl = area.querySelector("#xlsx-active-cell");
+  const formulaInput = area.querySelector("#xlsx-formula-input");
+  const syncing = { value: false }; // guard against input-event feedback loops
+
+  const cellName = (td) => td?.dataset.cell || "";
+
+  const setActiveCell = (td) => {
+    activeTd = td || null;
+    if (area.querySelector("td.xlsx-active")) area.querySelector("td.xlsx-active").classList.remove("xlsx-active");
+    if (!td) {
+      activeCellEl.textContent = "—";
+      formulaInput.value = "";
+      formulaInput.disabled = true;
+      return;
+    }
+    td.classList.add("xlsx-active");
+    activeCellEl.textContent = cellName(td);
+    formulaInput.disabled = false;
+    formulaInput.value = td.textContent;
+  };
+
+  const syncFormulaBar = (td) => {
+    if (td !== activeTd) return;
+    if (!syncing.value) formulaInput.value = td.textContent;
+  };
+
+  // Parse an A1 reference into its (row, col) parts.
+  const parseRef = (ref) => {
+    const m = /^([A-Z]+)(\d+)$/.exec(ref || "");
+    if (!m) return null;
+    let col = 0;
+    for (const ch of m[1]) col = col * 26 + (ch.charCodeAt(0) - 64);
+    return { row: Number(m[2]), col };
+  };
+
+  const findTd = (panel, row, col) =>
+    panel.querySelector(`td[data-cell="${columnName(col)}${row}"]`);
+
+  const columnName = (col) => {
+    let name = "";
+    while (col > 0) {
+      const rem = (col - 1) % 26;
+      name = String.fromCharCode(65 + rem) + name;
+      col = Math.floor((col - 1) / 26);
+    }
+    return name;
+  };
+
+  const moveActive = (td, key, forward = true) => {
+    const ref = parseRef(cellName(td));
+    if (!ref) return;
+    let { row, col } = ref;
+    if (key === "Tab") col += forward ? 1 : -1;
+    else if (key === "ArrowRight") col += 1;
+    else if (key === "ArrowLeft") col -= 1;
+    else if (key === "ArrowDown") row += 1;
+    else if (key === "ArrowUp") row -= 1;
+    if (row < 1 || col < 1) return;
+    const panel = td.closest(".xlsx-panel");
+    const next = findTd(panel, row, col);
+    if (!next) return; // edge of the rendered window: no wrap
+    td.blur();
+    next.focus();
+    setActiveCell(next);
+  };
+
+  formulaInput.addEventListener("input", () => {
+    if (!activeTd) return;
+    syncing.value = true;
+    activeTd.textContent = formulaInput.value;
+    syncing.value = false;
+    activeTd.classList.add("xlsx-dirty");
+    refreshSaveState();
+  });
+  formulaInput.addEventListener("keydown", (e) => {
+    if (!activeTd) return;
+    if (e.key === "Enter") {
+      e.preventDefault();
+      activeTd.blur();
+      activeTd.focus();
+    } else if (e.key === "Escape") {
+      e.preventDefault();
+      activeTd.textContent = activeTd.dataset.orig;
+      activeTd.classList.remove("xlsx-dirty");
+      syncFormulaBar(activeTd);
+      refreshSaveState();
+      activeTd.focus();
+    }
+  });
+
   const setupCell = (td) => {
     td.contentEditable = "true";
     td.spellcheck = false;
+    // Focusable without a pointing device: JSDOM requires it to fire focus
+    // events on contenteditable cells, and a keyboard user tabbing into the
+    // table from outside lands on the first cell thanks to it.
+    td.tabIndex = 0;
     td.dataset.orig = td.textContent;
     td.addEventListener("input", () => {
       td.classList.add("xlsx-dirty");
+      syncFormulaBar(td);
       refreshSaveState();
     });
+    td.addEventListener("focus", () => setActiveCell(td));
     td.addEventListener("keydown", (e) => {
-      if (e.key === "Enter") { e.preventDefault(); td.blur(); }
+      if (e.key === "Enter" && !e.shiftKey) { e.preventDefault(); td.blur(); }
       if (e.key === "Escape") {
         td.textContent = td.dataset.orig;
         td.classList.remove("xlsx-dirty");
+        syncFormulaBar(td);
         refreshSaveState();
       }
+      if (e.key === "Tab" || e.key === "ArrowUp" || e.key === "ArrowDown"
+          || e.key === "ArrowLeft" || e.key === "ArrowRight") {
+        // Excel-like: arrows and Tab move to the neighbour cell. Direction is
+        // the key's own (Left/Up = back, Right/Down = forward); Tab follows
+        // Shift. Prevented so Tab never leaves the table and arrows never
+        // move the caret (they move the SELECTION instead).
+        e.preventDefault();
+        const forward = e.key === "Tab"
+          ? !e.shiftKey
+          : (e.key === "ArrowRight" || e.key === "ArrowDown");
+        moveActive(td, e.key, forward);
+      }
     });
     td.addEventListener("paste", (e) => {
       e.preventDefault();
@@ -1187,9 +1391,12 @@ export function renderXlsxViewer(area, data) {
     el.title = t("xlsx.cached_value_title");
   });
 
-  // Editable cells: Enter blurs, Escape reverts, paste stays single-line.
+  // Editable cells: Enter blurs, Escape reverts, arrows/Tab navigate.
   area.querySelectorAll(".xlsx-table td").forEach(setupCell);
   panelEls.forEach(wireLazyRows);
+  panelEls.forEach(applySheetMeta);
+  // The formula bar starts disabled: nothing is selected yet.
+  setActiveCell(null);
 
   area.querySelectorAll(".xlsx-tab").forEach((tab) => {
     tab.addEventListener("click", () => {
@@ -1253,6 +1460,7 @@ export function renderXlsxViewer(area, data) {
         td.classList.remove("xlsx-dirty");
         td.dataset.orig = td.textContent;
       });
+      if (activeTd) syncFormulaBar(activeTd);
       refreshSaveState();
       showToast(t("editor.saved"), "success");
     } catch (err) {
@@ -1270,6 +1478,286 @@ export function renderXlsxViewer(area, data) {
     window.open(`/api/file/${encodeURIComponent(data.vault)}/download?path=${encodeURIComponent(data.path)}`, "_blank");
   });
 
+  // ── #153 A13 — sort / filter / find in the sheet + CSV export ──────────
+  // ALL of these act on the RENDERED grid only: the workbook is never
+  // rewritten by a sort or a filter (the save pipeline stays the only write
+  // path, and the note in xlsx.sort_applied says so).
+  const visiblePanel = () =>
+    panelEls.find((p) => p.style.display !== "none") || panelEls[0];
+
+  // Sorting reorders <tr> rows by the text of one column. Dirty cells travel
+  // with their row, so a sort never loses an unsaved edit.
+  let sortState = null; // { col, dir } on the visible panel
+
+  const applySort = (panel, col, dir) => {
+    const tbody = panel.querySelector(".xlsx-table tbody");
+    if (!tbody) return;
+    const rows = [...tbody.querySelectorAll("tr")];
+    const numeric = rows.every((tr) => {
+      const td = tr.querySelector(`td[data-cell^="${columnName(col)}"]`);
+      const v = td ? td.textContent.trim() : "";
+      return v === "" || !isNaN(Number(v));
+    });
+    rows.sort((a, b) => {
+      const ta = a.querySelector(`td[data-cell^="${columnName(col)}"]`);
+      const tb = b.querySelector(`td[data-cell^="${columnName(col)}"]`);
+      const va = ta ? ta.textContent.trim() : "";
+      const vb = tb ? tb.textContent.trim() : "";
+      const cmp = numeric
+        ? (parseFloat(va) || 0) - (parseFloat(vb) || 0)
+        : va.localeCompare(vb, "fr");
+      return dir === "asc" ? cmp : -cmp;
+    });
+    rows.forEach((tr) => tbody.appendChild(tr));
+    sortState = { col, dir };
+    sortResetBtn.style.display = "";
+    showToast(t("xlsx.sort_applied", { col: columnName(col) }), "info");
+  };
+
+  // Header click cycles: asc → desc → back to the sheet order.
+  const wireHeaderSort = (panel) => {
+    const thead = panel.querySelector(".xlsx-table thead");
+    if (!thead || thead.dataset.sortWired) return;
+    thead.dataset.sortWired = "1";
+    thead.querySelectorAll("th:not(.xlsx-corner)").forEach((th) => {
+      th.style.cursor = "pointer";
+      th.title = t("xlsx.sort_asc");
+      th.addEventListener("click", () => {
+        // The corner th is column 0, so the child index IS the column number.
+        const col = [...th.parentElement.children].indexOf(th);
+        const current = sortState && sortState.col === col ? sortState.dir : null;
+        const dir = current === "asc" ? "desc" : "asc";
+        applySort(panel, col, dir);
+        th.title = dir === "asc" ? t("xlsx.sort_desc") : t("xlsx.sort_asc");
+      });
+    });
+  };
+
+  // Filter: rows whose cell text lacks the needle are hidden.
+  const applyFilter = (panel, needle) => {
+    const n = needle.trim().toLowerCase();
+    panel.querySelectorAll(".xlsx-table tbody tr").forEach((tr) => {
+      const text = tr.textContent.toLowerCase();
+      tr.style.display = !n || text.includes(n) ? "" : "none";
+    });
+    if (n) sortResetBtn.style.display = "";
+  };
+
+  panelEls.forEach(wireHeaderSort);
+
+  const sortResetBtn = area.querySelector("#xlsx-sort-reset");
+  sortResetBtn.addEventListener("click", () => {
+    // Full reset: re-render the current file (server truth), clear find too.
+    sortResetBtn.style.display = "none";
+    renderXlsxViewer(area, data);
+  });
+
+  // Find-in-sheet: highlight matches, navigate with ↑/↓.
+  let findMatches = [];
+  let findIndex = -1;
+  const findInput = area.querySelector("#xlsx-find-input");
+  const findCount = area.querySelector("#xlsx-find-count");
+  let findCase = false;
+
+  const clearFind = () => {
+    findMatches.forEach(({ td, mark }) => {
+      mark.replaceWith(document.createTextNode(mark.textContent));
+      td.normalize();
+    });
+    findMatches = [];
+    findIndex = -1;
+    findCount.textContent = "";
+  };
+
+  const runFind = () => {
+    clearFind();
+    const needle = findInput.value;
+    if (!needle.trim()) return;
+    const panel = visiblePanel();
+    const hay = findCase ? (s) => s : (s) => s.toLowerCase();
+    const n = hay(needle);
+    panel.querySelectorAll(".xlsx-table td").forEach((td) => {
+      const text = td.textContent;
+      const pos = hay(text).indexOf(n);
+      if (pos === -1 || !text) return;
+      // Wrap the match in a <mark> by splitting the cell's first text node at
+      // the hit (cells are text-first; the cached-value span stays untouched).
+      const first = td.firstChild;
+      if (first && first.nodeType === 3) {
+        const mark = document.createElement("mark");
+        mark.className = "xlsx-find-hit";
+        mark.textContent = text.substr(pos, needle.length);
+        const tail = first.splitText(pos);
+        tail.splitText(needle.length);
+        td.replaceChild(mark, tail);
+        findMatches.push({ td, mark });
+      }
+    });
+    findCount.textContent = findMatches.length
+      ? t("xlsx.find_count", { index: 1, count: findMatches.length })
+      : t("xlsx.find_no_match");
+    if (findMatches.length) focusMatch(0);
+  };
+
+  const focusMatch = (i) => {
+    findMatches.forEach(({ mark }) => mark.classList.remove("xlsx-find-current"));
+    findIndex = (i + findMatches.length) % findMatches.length;
+    const { td, mark } = findMatches[findIndex];
+    mark.classList.add("xlsx-find-current");
+    // scrollIntoView is missing in JSDOM; guard it (real browsers have it).
+    if (typeof td.scrollIntoView === "function") td.scrollIntoView({ block: "nearest" });
+    findCount.textContent = t("xlsx.find_count", { index: findIndex + 1, count: findMatches.length });
+  };
+
+  // One input drives both the highlight (find) and the row filter (A13):
+  // typing narrows the sheet to the matching rows AND highlights the hits.
+  findInput.addEventListener("input", () => {
+    panelEls.forEach((p) => applyFilter(p, findInput.value));
+    runFind();
+  });
+  findInput.addEventListener("keydown", (e) => {
+    if (e.key === "Enter") { e.preventDefault(); focusMatch(findIndex + (e.shiftKey ? -1 : 1)); }
+  });
+  area.querySelector("#xlsx-find-prev").addEventListener("click", () => focusMatch(findIndex - 1));
+  area.querySelector("#xlsx-find-next").addEventListener("click", () => focusMatch(findIndex + 1));
+  const caseBtn = area.querySelector("#xlsx-find-case");
+  caseBtn.addEventListener("click", () => {
+    findCase = !findCase;
+    caseBtn.setAttribute("aria-pressed", String(findCase));
+    caseBtn.classList.toggle("active", findCase);
+    runFind();
+  });
+
+  // ── #153 A14 — workbook structure menu (sheets, rows, columns) ─────────
+  // Every action is an explicit user gesture (prompt/confirm) and goes to
+  // PUT …/xlsx/structure — one locked, atomic rewrite with a backup.
+  const visibleSheetIndex = () =>
+    Number((visiblePanel() || panelEls[0])?.dataset.sheet) || 0;
+
+  const putStructure = async (actions, force = false) => {
+    await api(
+      `/api/file/${encodeURIComponent(data.vault)}/xlsx/structure?path=${encodeURIComponent(data.path)}`,
+      {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ actions, force }),
+      },
+    );
+    showToast(t("xlsx.structure_saved"), "success");
+    // Re-render from the server so the viewer shows the new structure.
+    const fresh = await api(
+      `/api/file/${encodeURIComponent(data.vault)}?path=${encodeURIComponent(data.path)}`,
+    );
+    renderXlsxViewer(area, fresh);
+  };
+
+  const structureError = (err, retryActions) => {
+    if (err && err.code === "xlsx_lossy_content") {
+      const features = (err.details && err.details.features) || lossy;
+      const labels = features.map((f) => t("xlsx.feature_" + f)).join(", ");
+      if (confirm(t("xlsx.lossy_confirm", { features: labels }))) {
+        return putStructure(retryActions, true); // re-emitted with force
+      }
+      showToast(t("xlsx.lossy_cancelled"), "info");
+      return null;
+    }
+    showToast(`${t("xlsx.structure_error")}: ${err.message || err}`, "error");
+    return null;
+  };
+
+  // Structure menu: built on demand, positioned under the button.
+  area.querySelector("#xlsx-structure-btn").addEventListener("click", (e) => {
+    const old = area.querySelector(".xlsx-structure-menu");
+    if (old) { old.remove(); return; }
+    const idx = visibleSheetIndex();
+    const sheetName = sheets[idx]?.name || "";
+    const activeRef = cellName(activeTd && activeTd.closest(".xlsx-panel") === visiblePanel() ? activeTd : null);
+    const parsed = parseRef(activeRef);
+    const menu = document.createElement("div");
+    menu.className = "xlsx-structure-menu";
+    const item = (label, fn) => {
+      const b = document.createElement("button");
+      b.type = "button";
+      b.className = "btn-action xlsx-structure-item";
+      b.textContent = label;
+      b.addEventListener("click", () => { menu.remove(); fn(); });
+      menu.appendChild(b);
+    };
+    item(t("xlsx.sheet_add"), async () => {
+      const name = prompt(t("xlsx.structure_prompt_add"));
+      if (!name) return;
+      const actions = [{ op: "sheet_add", name }];
+      try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+    });
+    item(t("xlsx.sheet_rename"), async () => {
+      const to = prompt(t("xlsx.structure_prompt_rename"), sheetName);
+      if (!to || to === sheetName) return;
+      const actions = [{ op: "sheet_rename", from: sheetName, to }];
+      try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+    });
+    item(t("xlsx.sheet_duplicate"), async () => {
+      const as = prompt(t("xlsx.structure_prompt_add"), `${sheetName} (copie)`);
+      if (!as) return;
+      const actions = [{ op: "sheet_duplicate", name: sheetName, as }];
+      try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+    });
+    item(t("xlsx.sheet_delete"), async () => {
+      if (sheets.length <= 1) { showToast(t("xlsx.last_sheet"), "info"); return; }
+      if (!confirm(t("xlsx.structure_confirm_delete_sheet", { name: sheetName }))) return;
+      const actions = [{ op: "sheet_delete", name: sheetName }];
+      try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+    });
+    if (parsed) {
+      menu.appendChild(Object.assign(document.createElement("div"), { className: "xlsx-structure-sep" }));
+      item(t("xlsx.row_insert"), async () => {
+        const actions = [{ op: "row_insert", sheet: sheetName, at: parsed.row }];
+        try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+      });
+      item(t("xlsx.row_delete"), async () => {
+        if (!confirm(t("xlsx.structure_confirm_row", { n: parsed.row }))) return;
+        const actions = [{ op: "row_delete", sheet: sheetName, at: parsed.row }];
+        try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+      });
+      item(t("xlsx.col_insert"), async () => {
+        const actions = [{ op: "col_insert", sheet: sheetName, at: parsed.col }];
+        try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+      });
+      item(t("xlsx.col_delete"), async () => {
+        if (!confirm(t("xlsx.structure_confirm_col", { n: columnName(parsed.col) }))) return;
+        const actions = [{ op: "col_delete", sheet: sheetName, at: parsed.col }];
+        try { await putStructure(actions); } catch (err) { structureError(err, actions); }
+      });
+    }
+    e.target.closest(".xlsx-toolbar").appendChild(menu);
+  });
+
+  // CSV export of the visible sheet (post-trim, pre-save data).
+  area.querySelector("#xlsx-csv-btn").addEventListener("click", () => {
+    const panel = visiblePanel();
+    const idx = Number(panel.dataset.sheet);
+    const rows = [];
+    panel.querySelectorAll(".xlsx-table tbody tr").forEach((tr) => {
+      rows.push(
+        [...tr.querySelectorAll("td")].map((td) => {
+          const clone = td.cloneNode(true);
+          clone.querySelectorAll(".xlsx-cached").forEach((el) => el.remove());
+          return clone.textContent;
+        }),
+      );
+    });
+    const csv = rows
+      .map((r) => r.map((v) => (/[";\n]/.test(v) ? `"${v.replace(/"/g, '""')}"` : v)).join(";"))
+      .join("\n");
+    const blob = new Blob([`\uFEFF${csv}`], { type: "text/csv;charset=utf-8" });
+    const a = document.createElement("a");
+    a.href = URL.createObjectURL(blob);
+    a.download = `${sheets[idx]?.name || "feuille"}.csv`;
+    document.body.appendChild(a);
+    a.click();
+    document.body.removeChild(a);
+    URL.revokeObjectURL(a.href);
+  });
+
   safeCreateIcons();
 }
 

frontend/locales/en.json

@@ -1836,6 +1836,38 @@
   "xlsx.load_more": "Load more",
   "xlsx.loading_more": "Loading…",
   "xlsx.load_error": "Could not load the remaining rows",
+  "xlsx.formula_bar_placeholder": "Active cell content",
+  "xlsx.active_cell": "Cell",
+  "xlsx.find_placeholder": "Search in the sheet…",
+  "xlsx.find_prev": "Previous",
+  "xlsx.find_next": "Next",
+  "xlsx.find_case": "Match case",
+  "xlsx.find_no_match": "No match",
+  "xlsx.find_count": "{index}/{count}",
+  "xlsx.csv_export": "Export the sheet as CSV",
+  "xlsx.sort_asc": "Sort column A→Z",
+  "xlsx.sort_desc": "Sort column Z→A",
+  "xlsx.sort_applied": "Sort applied on {col} — display only, the workbook is unchanged",
+  "xlsx.sort_reset": "Reset sort and filter",
+  "xlsx.filter_placeholder": "Filter rows…",
+  "xlsx.structure_btn": "Sheet structure",
+  "xlsx.structure_title": "Edit the workbook structure",
+  "xlsx.sheet_add": "Add a sheet",
+  "xlsx.sheet_rename": "Rename the current sheet",
+  "xlsx.sheet_duplicate": "Duplicate the current sheet",
+  "xlsx.sheet_delete": "Delete the current sheet",
+  "xlsx.row_insert": "Insert a row above",
+  "xlsx.row_delete": "Delete the active cell's row",
+  "xlsx.col_insert": "Insert a column to the left",
+  "xlsx.col_delete": "Delete the active cell's column",
+  "xlsx.structure_prompt_add": "Name of the new sheet:",
+  "xlsx.structure_prompt_rename": "New name of the sheet:",
+  "xlsx.structure_confirm_delete_sheet": "Permanently delete the sheet “{name}”? This changes the file (a backup is created).",
+  "xlsx.structure_confirm_row": "Delete row {n}? This changes the file (a backup is created).",
+  "xlsx.structure_confirm_col": "Delete column {n}? This changes the file (a backup is created).",
+  "xlsx.structure_saved": "Structure updated",
+  "xlsx.structure_error": "Could not change the structure",
+  "xlsx.last_sheet": "The last sheet cannot be deleted",
   "xlsx.feature_cached_values": "cached values",
   "xlsx.feature_slicers": "slicers and timelines",
   "xlsx.feature_form_controls": "form controls",

frontend/locales/fr.json

@@ -1836,6 +1836,38 @@
   "xlsx.load_more": "Charger la suite",
   "xlsx.loading_more": "Chargement…",
   "xlsx.load_error": "Chargement de la suite impossible",
+  "xlsx.formula_bar_placeholder": "Contenu de la cellule active",
+  "xlsx.active_cell": "Cellule",
+  "xlsx.find_placeholder": "Rechercher dans la feuille…",
+  "xlsx.find_prev": "Précédent",
+  "xlsx.find_next": "Suivant",
+  "xlsx.find_case": "Respecter la casse",
+  "xlsx.find_no_match": "Aucune correspondance",
+  "xlsx.find_count": "{index}/{count}",
+  "xlsx.csv_export": "Exporter la feuille en CSV",
+  "xlsx.sort_asc": "Trier la colonne A→Z",
+  "xlsx.sort_desc": "Trier la colonne Z→A",
+  "xlsx.sort_applied": "Tri appliqué sur {col} — l'affichage seul, le classeur n'est pas modifié",
+  "xlsx.sort_reset": "Réinitialiser le tri et le filtre",
+  "xlsx.filter_placeholder": "Filtrer les lignes…",
+  "xlsx.structure_btn": "Structure de la feuille",
+  "xlsx.structure_title": "Modifier la structure du classeur",
+  "xlsx.sheet_add": "Ajouter une feuille",
+  "xlsx.sheet_rename": "Renommer la feuille courante",
+  "xlsx.sheet_duplicate": "Dupliquer la feuille courante",
+  "xlsx.sheet_delete": "Supprimer la feuille courante",
+  "xlsx.row_insert": "Insérer une ligne au-dessus",
+  "xlsx.row_delete": "Supprimer la ligne de la cellule active",
+  "xlsx.col_insert": "Insérer une colonne à gauche",
+  "xlsx.col_delete": "Supprimer la colonne de la cellule active",
+  "xlsx.structure_prompt_add": "Nom de la nouvelle feuille :",
+  "xlsx.structure_prompt_rename": "Nouveau nom de la feuille :",
+  "xlsx.structure_confirm_delete_sheet": "Supprimer définitivement la feuille « {name} » ? Cette action modifie le fichier (un backup est créé).",
+  "xlsx.structure_confirm_row": "Supprimer la ligne {n} ? Cette action modifie le fichier (un backup est créé).",
+  "xlsx.structure_confirm_col": "Supprimer la colonne {n} ? Cette action modifie le fichier (un backup est créé).",
+  "xlsx.structure_saved": "Structure mise à jour",
+  "xlsx.structure_error": "Modification de la structure impossible",
+  "xlsx.last_sheet": "Impossible de supprimer la dernière feuille",
   "xlsx.feature_cached_values": "valeurs calculées",
   "xlsx.feature_slicers": "segments et chronologies",
   "xlsx.feature_form_controls": "contrôles de formulaire",

frontend/style.css

@@ -10931,6 +10931,7 @@ body.desktop-mode .editor-container {
   gap: 10px;
   margin-bottom: 8px;
   flex-wrap: wrap;
+  position: relative; /* anchors the A14 structure menu */
 }
 .xlsx-toolbar-actions {
   margin-left: auto;
@@ -10996,6 +10997,150 @@ body.desktop-mode .editor-container {
   outline: 2px solid var(--accent, #4a90d9);
   outline-offset: -2px;
 }
+/* #153 A7 — the active cell keeps its outline even when focus moves to the
+   formula bar, so the user never loses track of what the bar edits. */
+.xlsx-table td.xlsx-active:not(:focus) {
+  outline: 2px dashed var(--accent, #4a90d9);
+  outline-offset: -2px;
+}
+
+/* #153 A7 — formula bar under the toolbar: [ A1 | > | input ] */
+.xlsx-formula-bar {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-bottom: 8px;
+}
+.xlsx-active-cell {
+  min-width: 52px;
+  padding: 4px 8px;
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  background: var(--surface);
+  color: var(--text-primary);
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+  font-size: 0.8rem;
+  text-align: center;
+  font-variant-numeric: tabular-nums;
+}
+.xlsx-formula-sep {
+  width: 14px;
+  height: 14px;
+  flex: 0 0 auto;
+  color: var(--text-muted);
+}
+.xlsx-formula-input {
+  flex: 1;
+  min-width: 0;
+  padding: 5px 10px;
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  background: var(--surface);
+  color: var(--text-primary);
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+  font-size: 0.82rem;
+}
+.xlsx-formula-input:focus {
+  outline: 2px solid var(--accent, #4a90d9);
+  outline-offset: -2px;
+}
+.xlsx-formula-input:disabled {
+  opacity: 0.55;
+}
+
+/* #153 A13 — find-in-sheet + filter/sort controls */
+.xlsx-find-group {
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  margin-left: auto;
+  min-width: 0;
+}
+.xlsx-find-input {
+  flex: 1;
+  min-width: 120px;
+  max-width: 220px;
+  padding: 4px 8px;
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  background: var(--surface);
+  color: var(--text-primary);
+  font-size: 0.8rem;
+}
+.xlsx-find-input:focus {
+  outline: 2px solid var(--accent, #4a90d9);
+  outline-offset: -2px;
+}
+.xlsx-find-count {
+  color: var(--text-muted);
+  font-size: 0.75rem;
+  white-space: nowrap;
+}
+.xlsx-find-btn,
+.xlsx-find-case,
+.xlsx-sort-reset {
+  padding: 3px 8px;
+  font-size: 0.78rem;
+}
+.xlsx-find-hit {
+  background: var(--warning, #e0a800);
+  color: var(--text-primary);
+  border-radius: 2px;
+}
+.xlsx-find-current {
+  outline: 2px solid var(--accent, #4a90d9);
+  outline-offset: 1px;
+}
+
+/* #153 A15 — freeze panes: frozen rows sit UNDER the sticky thead, frozen
+   columns stay left. z-index mirrors thead (3) without covering it. */
+.xlsx-table tr.xlsx-frozen-row td,
+.xlsx-table tr.xlsx-frozen-row th {
+  position: sticky;
+  top: 33px; /* thead height — keeps the frozen row below the header */
+  z-index: 2;
+  background: var(--surface);
+}
+.xlsx-table td.xlsx-frozen-col {
+  position: sticky;
+  left: 44px; /* the row-number column width */
+  background: var(--surface);
+}
+
+/* #153 A14 — structure menu (sheets / rows / columns) */
+.xlsx-structure-menu {
+  position: absolute;
+  z-index: 30;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 240px;
+  margin-top: 4px;
+  padding: 6px;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  background: var(--surface);
+  box-shadow: 0 8px 24px var(--shadow, rgba(0, 0, 0, 0.25));
+}
+.xlsx-structure-item {
+  text-align: left;
+  border: none;
+  background: transparent;
+  color: var(--text-primary);
+}
+.xlsx-structure-item:hover {
+  background: var(--bg-secondary);
+}
+.xlsx-structure-sep {
+  height: 1px;
+  margin: 4px 0;
+  background: var(--border);
+}
+
+/* JSDOM shims for the tests that click anchors */
+mark {
+  font: inherit;
+}
 .xlsx-table td.xlsx-dirty {
   background: rgba(255, 196, 0, 0.18);
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "obsigate",
-  "version": "2.33.0",
+  "version": "2.37.0",
   "description": "**Porte d'entrée web ultra-léger pour vos vaults Obsidian** — Accédez, naviguez et recherchez dans toutes vos notes Obsidian depuis n'importe quel appareil via une interface web moderne et responsive.",
   "main": "patch.js",
   "directories": {

tests/e2e/xlsx-viewer.spec.js

@@ -231,4 +231,28 @@ test.describe('Excel viewer — troncature et navigation (#153 A8/A9)', () => {
     // Tout est chargé → le pied de page est masqué.
     await expect(foot).toBeHidden();
   });
+
+  test('barre de formule et navigation clavier (#153 A7)', async ({ page }) => {
+    await login(page);
+    await openXlsx(page, LARGE);
+
+    // Un clic sur une cellule active la barre avec son nom et son contenu.
+    const cell = page.locator('#content-area td[data-cell="B2"]');
+    await cell.click();
+    await expect(page.locator('#xlsx-active-cell')).toHaveText('B2');
+    const bar = page.locator('#xlsx-formula-input');
+    await expect(bar).toHaveValue(/Operation 1/);
+
+    // Les flèches déplacent la cellule active.
+    await cell.press('ArrowDown');
+    await expect(page.locator('#xlsx-active-cell')).toHaveText('B3');
+    await page.locator('#content-area td[data-cell="B3"]').press('ArrowRight');
+    await expect(page.locator('#xlsx-active-cell')).toHaveText('C3');
+
+    // Éditer depuis la barre marque la cellule dirty, Échap annule.
+    await bar.fill('Operation 2 modifiee');
+    await expect(page.locator('#content-area td[data-cell="C3"]')).toHaveClass(/xlsx-dirty/);
+    await page.locator('#content-area td[data-cell="C3"]').press('Escape');
+    await expect(page.locator('#content-area td.xlsx-dirty')).toHaveCount(0);
+  });
 });

tests/frontend/xlsx-viewer.test.mjs

@@ -11,6 +11,12 @@
  *  - A9bis : the tail of a truncated sheet is fetched window by window from
  *         GET …/xlsx/sheet (scroll sentinel + click), and the appended rows are
  *         editable like the initial ones.
+ *  - A7 : formula bar mirrors the active cell; arrows/Tab navigate; editing
+ *         from the bar marks the cell dirty; Escape reverts.
+ *  - A13 : header click sorts the rendered rows, the filter hides rows, the
+ *         find highlights matches, CSV export downloads the visible sheet.
+ *  - A14 : the structure menu sends one PUT …/xlsx/structure with the action,
+ *         then re-renders from the server; destructive actions confirm first.
  *
  * Usage: node tests/frontend/xlsx-viewer.test.mjs
  */
@@ -121,8 +127,9 @@ await initI18n();
 
 const sheetHtml = (value) =>
   '<div class="csv-table-wrapper"><table class="csv-table xlsx-table">' +
-  '<thead><tr><th class="xlsx-corner"></th><th>A</th></tr></thead><tbody>' +
-  `<tr><th class="xlsx-rownum">1</th><td data-cell="A1">${value}</td></tr>` +
+  '<thead><tr><th class="xlsx-corner"></th><th>A</th><th>B</th></tr></thead><tbody>' +
+  `<tr><th class="xlsx-rownum">1</th><td data-cell="A1">${value}</td><td data-cell="B1">B1</td></tr>` +
+  '<tr><th class="xlsx-rownum">2</th><td data-cell="A2">A2</td><td data-cell="B2">B2</td></tr>' +
   "</tbody></table></div>";
 
 // The JSDOM fetch double serves locale files; everything else is a recorded
@@ -414,6 +421,233 @@ await test("a failed window fetch keeps the footnote and shows an error toast",
   assert.equal(area.querySelector(".xlsx-load-more").classList.contains("done"), true);
 });
 
+// ── A7 — formula bar & keyboard navigation ──────────────────────────────────
+
+await test("the formula bar starts empty and disabled", () => {
+  const area = mount();
+  assert.equal(area.querySelector("#xlsx-active-cell").textContent, "—");
+  assert.equal(area.querySelector("#xlsx-formula-input").disabled, true);
+});
+
+await test("focusing a cell shows its name and content in the bar", () => {
+  const area = mount();
+  const td = area.querySelector('td[data-cell="A1"]');
+  td.dispatchEvent(new w.Event("focus", { bubbles: false }));
+  // JSDOM does not run the default focus behaviour on dispatchEvent, so go
+  // through the real API:
+  td.focus();
+  assert.equal(area.querySelector("#xlsx-active-cell").textContent, "A1");
+  assert.equal(area.querySelector("#xlsx-formula-input").value, "100");
+  assert.equal(area.querySelector("#xlsx-formula-input").disabled, false);
+});
+
+await test("typing in the bar edits the cell live and marks it dirty", () => {
+  const area = mount();
+  const td = area.querySelector('td[data-cell="A1"]');
+  td.focus();
+  const input = area.querySelector("#xlsx-formula-input");
+  input.value = "depuis la barre";
+  input.dispatchEvent(new w.Event("input", { bubbles: true }));
+  assert.equal(td.textContent, "depuis la barre");
+  assert.equal(td.classList.contains("xlsx-dirty"), true);
+  assert.equal(area.querySelector("#xlsx-save-btn").disabled, false);
+  // The save payload carries the cell edit.
+  area.querySelector("#xlsx-save-btn").click();
+  return new Promise((r) => setTimeout(r, 5)).then(() => {
+    assert.deepEqual(calls[0].body.cells, { A1: "depuis la barre" });
+  });
+});
+
+await test("Tab and arrows move to the neighbour cell", () => {
+  const area = mount();
+  const a1 = area.querySelector('td[data-cell="A1"]');
+  a1.focus();
+  a1.dispatchEvent(new w.KeyboardEvent("keydown", { key: "Tab", bubbles: true }));
+  assert.equal(area.querySelector("#xlsx-active-cell").textContent, "B1");
+  const b1 = area.querySelector('td[data-cell="B1"]');
+  b1.dispatchEvent(new w.KeyboardEvent("keydown", { key: "ArrowDown", bubbles: true }));
+  assert.equal(area.querySelector("#xlsx-active-cell").textContent, "B2");
+  const b2 = area.querySelector('td[data-cell="B2"]');
+  b2.dispatchEvent(new w.KeyboardEvent("keydown", { key: "ArrowLeft", bubbles: true }));
+  assert.equal(area.querySelector("#xlsx-active-cell").textContent, "A2");
+});
+
+await test("Enter commits and Shift+Tab goes backwards", () => {
+  const area = mount();
+  const a1 = area.querySelector('td[data-cell="A1"]');
+  a1.focus();
+  a1.dispatchEvent(new w.KeyboardEvent("keydown", { key: "Tab", bubbles: true }));
+  const b1 = area.querySelector('td[data-cell="B1"]');
+  b1.dispatchEvent(new w.KeyboardEvent("keydown", { key: "Tab", shiftKey: true, bubbles: true }));
+  assert.equal(area.querySelector("#xlsx-active-cell").textContent, "A1");
+});
+
+await test("a saved edit from the bar resets the dirty flag and orig value", async () => {
+  const area = mount();
+  const td = area.querySelector('td[data-cell="A1"]');
+  td.focus();
+  const input = area.querySelector("#xlsx-formula-input");
+  input.value = "200";
+  input.dispatchEvent(new w.Event("input", { bubbles: true }));
+  area.querySelector("#xlsx-save-btn").click();
+  await new Promise((r) => setTimeout(r, 5));
+  assert.equal(area.querySelectorAll("td.xlsx-dirty").length, 0);
+  assert.equal(td.dataset.orig, "200");
+});
+
+// ── A13 — sort / filter / find / CSV export ─────────────────────────────────
+
+const mountGrid = () => {
+  const area = document.getElementById("content-area");
+  area.innerHTML = "";
+  const grid =
+    '<div class="csv-table-wrapper"><table class="csv-table xlsx-table">' +
+    '<thead><tr><th class="xlsx-corner"></th><th>A</th><th>B</th></tr></thead><tbody>' +
+    '<tr><th class="xlsx-rownum">1</th><td data-cell="A1">Banane</td><td data-cell="B1">3</td></tr>' +
+    '<tr><th class="xlsx-rownum">2</th><td data-cell="A2">Abricot</td><td data-cell="B2">10</td></tr>' +
+    '<tr><th class="xlsx-rownum">3</th><td data-cell="A3">Cerise</td><td data-cell="B3">2</td></tr>' +
+    "</tbody></table></div>";
+  renderXlsxViewer(area, {
+    vault: "V", path: "data.xlsx", is_xlsx: true,
+    xlsx_sheets: [{ name: "Fruits", html: grid, rows: 3, cols: 2, total_rows: 3, total_cols: 2, max_rows: 500, max_cols: 40, truncated: false }],
+    xlsx_lossy_features: [],
+  });
+  return area;
+};
+
+await test("clicking a header sorts the rows numerically or lexically", () => {
+  const area = mountGrid();
+  // Sort by column B (numbers) ascending: 2, 3, 10.
+  area.querySelector(".xlsx-table thead th:nth-child(3)").click();
+  let cells = [...area.querySelectorAll("tbody td[data-cell^=\"B\"]")].map((td) => td.textContent);
+  assert.deepEqual(cells, ["2", "3", "10"]);
+  // Second click: descending.
+  area.querySelector(".xlsx-table thead th:nth-child(3)").click();
+  cells = [...area.querySelectorAll("tbody td[data-cell^=\"B\"]")].map((td) => td.textContent);
+  assert.deepEqual(cells, ["10", "3", "2"]);
+});
+
+await test("a dirty cell travels with its row during a sort", () => {
+  const area = mountGrid();
+  editCell(area, "A3", "Cerise modifiée");
+  area.querySelector(".xlsx-table thead th:nth-child(3)").click();
+  const aCells = [...area.querySelectorAll("tbody td[data-cell^=\"A\"]")].map((td) => td.textContent);
+  assert.ok(aCells.includes("Cerise modifiée"), aCells.join("|"));
+  assert.equal(area.querySelectorAll("td.xlsx-dirty").length, 1);
+});
+
+await test("the filter hides the rows that do not match", () => {
+  const area = mountGrid();
+  // The filter reuses the find input: type and the rows filter live.
+  const input = area.querySelector("#xlsx-find-input");
+  input.value = "abri";
+  input.dispatchEvent(new w.Event("input", { bubbles: true }));
+  const visible = [...area.querySelectorAll("tbody tr")].filter((tr) => tr.style.display !== "none");
+  assert.equal(visible.length, 1);
+  assert.ok(visible[0].textContent.includes("Abricot"));
+});
+
+await test("find highlights matches and navigates with the counter", () => {
+  const area = mountGrid();
+  const input = area.querySelector("#xlsx-find-input");
+  const count = area.querySelector("#xlsx-find-count");
+  input.value = "cerise"; // lowercase: the default search ignores the case
+  input.dispatchEvent(new w.Event("input", { bubbles: true }));
+  assert.equal(area.querySelectorAll("mark.xlsx-find-hit").length, 1);
+  assert.ok(count.textContent.includes("1/1"), count.textContent);
+  // The hit is inside the matching cell.
+  assert.ok(area.querySelector('td[data-cell="A3"] mark.xlsx-find-hit'));
+});
+
+await test("CSV export downloads the visible sheet without the cached shadows", () => {
+  const area = mountGrid();
+  const clicks = [];
+  const realCreate = document.createElement.bind(document);
+  const anchor = realCreate("a");
+  document.createElement = (tag) => {
+    if (tag === "a") { clicks.push(1); return anchor; }
+    return realCreate(tag);
+  };
+  let href = "";
+  Object.defineProperty(anchor, "href", { set(v) { href = v; }, get: () => href });
+  URL.createObjectURL = () => "blob:x";
+  URL.revokeObjectURL = () => {};
+  area.querySelector("#xlsx-csv-btn").click();
+  document.createElement = realCreate;
+  assert.equal(clicks.length, 1);
+  assert.equal(anchor.download, "Fruits.csv");
+});
+
+// ── A14 — structure menu ───────────────────────────────────────────────────
+
+await test("sheet_add asks for a name, PUTs the action and re-renders", async () => {
+  const area = mount();
+  // The prompt is resolved through the module scope: stub it globally.
+  const realPrompt = globalThis.prompt;
+  globalThis.prompt = () => "Feuille 2";
+  apiQueue.push({ ok: true, status: 200, body: { status: "ok" } }); // PUT
+  apiQueue.push({
+    ok: true, status: 200,
+    body: { is_xlsx: true, vault: "V", path: "data.xlsx", xlsx_sheets: [{ name: "Feuille 2", html: sheetHtml("neuf") }], xlsx_lossy_features: [] },
+  }); // re-read
+  area.querySelector("#xlsx-structure-btn").click();
+  const items = [...area.querySelectorAll(".xlsx-structure-item")];
+  const addBtn = items.find((b) => b.textContent === FR["xlsx.sheet_add"]);
+  addBtn.click();
+  await new Promise((r) => setTimeout(r, 5));
+  globalThis.prompt = realPrompt;
+  assert.equal(calls.length, 2);
+  assert.match(calls[0].url, /\/xlsx\/structure\?path=data\.xlsx/);
+  assert.deepEqual(calls[0].body.actions, [{ op: "sheet_add", name: "Feuille 2" }]);
+  assert.equal(calls[0].body.force, false);
+  // The viewer re-rendered from the server payload (a single sheet → no tabs).
+  assert.ok(
+    area.querySelector("#content-area, .xlsx-viewer") || area,
+    "the viewer was rebuilt",
+  );
+  assert.ok(
+    area.querySelector('td[data-cell="A1"]')?.textContent === "neuf",
+    "the re-render shows the fresh payload",
+  );
+});
+
+await test("sheet_delete confirms and is refused on the last sheet", async () => {
+  const area = mount();
+  const delBtn = () => {
+    area.querySelector("#xlsx-structure-btn").click();
+    const items = [...area.querySelectorAll(".xlsx-structure-item")];
+    const b = items.find((x) => x.textContent === FR["xlsx.sheet_delete"]);
+    b.click();
+  };
+  // One sheet only → blocked before even confirming (no network call).
+  delBtn();
+  assert.equal(calls.length, 0, "nothing sent: last sheet");
+});
+
+await test("the 409 lossy flow re-emits with force after confirmation", async () => {
+  const area = mount();
+  // The prompt is resolved through the module scope: stub it globally.
+  const realPrompt = globalThis.prompt;
+  globalThis.prompt = () => "Feuille 2";
+  apiQueue.push({
+    ok: false, status: 409,
+    body: { detail: "…", code: "xlsx_lossy_content", details: { features: ["slicers"] } },
+  });
+  apiQueue.push({ ok: true, status: 200, body: { status: "ok" } }); // retry w/ force
+  apiQueue.push({
+    ok: true, status: 200,
+    body: { is_xlsx: true, vault: "V", path: "data.xlsx", xlsx_sheets: [{ name: "Feuille1", html: sheetHtml("1") }], xlsx_lossy_features: [] },
+  });
+  area.querySelector("#xlsx-structure-btn").click();
+  const items = [...area.querySelectorAll(".xlsx-structure-item")];
+  items.find((b) => b.textContent === FR["xlsx.sheet_add"]).click();
+  await new Promise((r) => setTimeout(r, 10));
+  globalThis.prompt = realPrompt;
+  assert.equal(confirmCalls, 1, "the user is asked about the lossy write");
+  assert.equal(calls.length, 3);
+  assert.equal(calls[1].body.force, true);
+});
+
 await test("two windows in a row walk the whole sheet", async () => {
   const area = mountTruncated({ total: 1200 });
   apiQueue.push({

tests/test_xlsx_structure.py

@@ -0,0 +1,188 @@
+"""Structural mutations of an .xlsx workbook (#153 A14): service + endpoint.
+
+Covers sheet add/rename/delete/duplicate and row/col insert/delete, the
+atomicity of the batch (one locked rewrite) and the shared P0 guards
+(lossy 409 gate, backup, path safety).
+"""
+
+from __future__ import annotations
+
+import zipfile
+from pathlib import Path
+
+import pytest
+
+openpyxl = pytest.importorskip("openpyxl")
+
+VAULT = "TestVault"
+
+
+@pytest.fixture
+def book(test_vault_dir: str) -> str:
+    path = Path(test_vault_dir) / "struct.xlsx"
+    wb = openpyxl.Workbook()
+    ws = wb.active
+    ws.title = "Data"
+    ws.append(["Nom", "Valeur"])
+    ws.append(["a", 1])
+    ws.append(["b", 2])
+    wb.create_sheet("Vide")
+    wb.save(path)
+    return str(path)
+
+
+def _put(client, path="struct.xlsx", actions=None, **extra):
+    return client.put(
+        f"/api/file/{VAULT}/xlsx/structure",
+        params={"path": path},
+        json={"actions": actions, **extra},
+    )
+
+
+def _wb(path):
+    wb = openpyxl.load_workbook(path)
+    try:
+        return wb
+    finally:
+        pass
+
+
+class TestSheetOps:
+    def test_add_rename_delete_sheet(self, client, book):
+        resp = _put(client, actions=[
+            {"op": "sheet_add", "name": "Extra", "at": 0},
+            {"op": "sheet_rename", "from": "Vide", "to": "Renommée"},
+        ])
+        assert resp.status_code == 200
+        wb = openpyxl.load_workbook(book)
+        assert wb.sheetnames[0] == "Extra"  # inserted at position 0
+        assert "Renommée" in wb.sheetnames and "Vide" not in wb.sheetnames
+        wb.close()
+
+        resp = _put(client, actions=[{"op": "sheet_delete", "name": "Extra"}])
+        assert resp.status_code == 200
+        wb = openpyxl.load_workbook(book)
+        assert "Extra" not in wb.sheetnames
+        wb.close()
+
+    def test_delete_last_sheet_refused(self, client, test_vault_dir):
+        (Path(test_vault_dir) / "solo.xlsx").write_bytes(book_bytes("Solo"))
+        resp = _put(client, path="solo.xlsx", actions=[
+            {"op": "sheet_delete", "name": "Solo"},
+        ])
+        assert resp.status_code == 400
+
+    def test_duplicate_copies_values(self, client, book):
+        resp = _put(client, actions=[
+            {"op": "sheet_duplicate", "name": "Data", "as": "Data copie"},
+        ])
+        assert resp.status_code == 200
+        wb = openpyxl.load_workbook(book)
+        assert wb["Data copie"]["A1"].value == "Nom"
+        assert wb["Data copie"]["B3"].value == 2
+        wb.close()
+
+
+def book_bytes(sheet_name: str) -> bytes:
+    import io
+
+    wb = openpyxl.Workbook()
+    wb.active.title = sheet_name
+    buf = io.BytesIO()
+    wb.save(buf)
+    return buf.getvalue()
+
+
+class TestRowColOps:
+    def test_row_insert_shifts_and_delete_removes(self, client, book):
+        resp = _put(client, actions=[
+            {"op": "row_insert", "sheet": "Data", "at": 2, "count": 1},
+        ])
+        assert resp.status_code == 200
+        wb = openpyxl.load_workbook(book)
+        ws = wb["Data"]
+        assert ws["A2"].value is None  # the new blank row
+        assert ws["A3"].value == "a"   # shifted down
+        wb.close()
+
+        resp = _put(client, actions=[
+            {"op": "row_delete", "sheet": "Data", "at": 2, "count": 1},
+        ])
+        assert resp.status_code == 200
+        wb = openpyxl.load_workbook(book)
+        assert wb["Data"]["A2"].value == "a"
+        wb.close()
+
+    def test_col_insert_and_delete(self, client, book):
+        assert _put(client, actions=[
+            {"op": "col_insert", "sheet": "Data", "at": 2},
+        ]).status_code == 200
+        wb = openpyxl.load_workbook(book)
+        assert wb["Data"]["B1"].value is None
+        assert wb["Data"]["C1"].value == "Valeur"
+        wb.close()
+
+        assert _put(client, actions=[
+            {"op": "col_delete", "sheet": "Data", "at": 2},
+        ]).status_code == 200
+        wb = openpyxl.load_workbook(book)
+        assert wb["Data"]["B1"].value == "Valeur"
+        wb.close()
+
+
+class TestGuards:
+    def test_unknown_sheet_is_400(self, client, book):
+        resp = _put(client, actions=[{"op": "row_insert", "sheet": "Nope", "at": 1}])
+        assert resp.status_code == 400
+
+    def test_unknown_op_is_400(self, client, book):
+        resp = _put(client, actions=[{"op": "sheet_explode", "name": "X"}])
+        assert resp.status_code == 400
+
+    def test_bad_position_is_400(self, client, book):
+        resp = _put(client, actions=[
+            {"op": "row_insert", "sheet": "Data", "at": "deux"},
+        ])
+        assert resp.status_code == 400
+
+    def test_empty_actions_is_400(self, client, book):
+        assert _put(client, actions=[]).status_code == 400
+
+    def test_lossy_workbook_refused_without_force(self, client, test_vault_dir):
+        """Same 409 gate as the cell edits (A1)."""
+        path = Path(test_vault_dir) / "lossy-struct.xlsx"
+        wb = openpyxl.Workbook()
+        wb.active.title = "S"
+        wb["S"]["A1"] = "=A2"  # no cached value -> add one via the raw XML
+        wb.save(path)
+        with zipfile.ZipFile(path) as zf:
+            items = {n: zf.read(n) for n in zf.namelist()}
+        sheet = next(n for n in items if n.startswith("xl/worksheets/sheet"))
+        items[sheet] = items[sheet].decode("utf-8").replace(
+            "<f>A2</f>", "<f>A2</f><v>7</v>"
+        ).encode("utf-8")
+        with zipfile.ZipFile(path, "w", zipfile.ZIP_DEFLATED) as zf:
+            for name, blob in items.items():
+                zf.writestr(name, blob)
+
+        resp = _put(client, path="lossy-struct.xlsx", actions=[
+            {"op": "sheet_add", "name": "X"},
+        ])
+        assert resp.status_code == 409
+        assert resp.json()["code"] == "xlsx_lossy_content"
+
+        resp = _put(client, path="lossy-struct.xlsx", actions=[
+            {"op": "sheet_add", "name": "X"},
+        ], force=True)
+        assert resp.status_code == 200
+
+    def test_atomicity_one_bad_action_writes_nothing(self, client, book):
+        """A batch with a valid action followed by a bad one writes nothing."""
+        resp = _put(client, actions=[
+            {"op": "sheet_add", "name": "Temp"},
+            {"op": "sheet_delete", "name": "Inexistante"},
+        ])
+        assert resp.status_code == 400
+        wb = openpyxl.load_workbook(book)
+        assert "Temp" not in wb.sheetnames
+        wb.close()

tests/test_xlsx_styles.py

@@ -0,0 +1,99 @@
+"""Style metadata in the .xlsx viewer (#153 A15): bold, colors, number formats,
+merged ranges and freeze panes — plus the endpoint wiring."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+openpyxl = pytest.importorskip("openpyxl")
+
+VAULT = "TestVault"
+
+
+@pytest.fixture
+def styled_book(test_vault_dir: str) -> str:
+    """A workbook with a bold red-font header, a filled cell, a merge and a freeze."""
+    from openpyxl.styles import Font, PatternFill
+
+    path = Path(test_vault_dir) / "styles.xlsx"
+    wb = openpyxl.Workbook()
+    ws = wb.active
+    ws.title = "Data"
+    ws["A1"] = "En-tête"
+    ws["A1"].font = Font(bold=True, italic=True, color="FFCC0000")
+    ws["B1"] = "Total"
+    ws["B1"].fill = PatternFill("solid", fgColor="FFFFEE99")
+    ws["B2"] = 1234.5
+    ws["B2"].number_format = "#,##0.00"
+    ws["C3"] = "fusionnée"
+    ws.merge_cells("C3:D3")
+    ws["C3"].value = "fusionnée"
+    ws.freeze_panes = "A2"
+    wb.save(path)
+    return str(path)
+
+
+class TestStyleReading:
+    def test_bold_italic_and_font_color(self, styled_book):
+        from backend.xlsx_reader import read_sheet_styles
+
+        styles = read_sheet_styles(Path(styled_book), "Data")
+        a1 = styles["A1"]
+        assert "font-weight:600" in a1["style"]
+        assert "font-style:italic" in a1["style"]
+        assert a1["style"].startswith("color:#cc0000")
+
+    def test_background_fill_is_read(self, styled_book):
+        from backend.xlsx_reader import read_sheet_styles
+
+        styles = read_sheet_styles(Path(styled_book), "Data")
+        assert "background:#ffee99" in styles["B1"]["style"]
+
+    def test_number_format_is_signalled(self, styled_book):
+        from backend.xlsx_reader import read_sheet_styles
+
+        styles = read_sheet_styles(Path(styled_book), "Data")
+        assert "font-family" in styles["B2"]["style"]
+
+    def test_plain_cell_has_no_entry(self, styled_book):
+        from backend.xlsx_reader import read_sheet_styles
+
+        styles = read_sheet_styles(Path(styled_book), "Data")
+        assert "A2" not in styles  # untouched cell
+
+    def test_merges_and_freeze(self, styled_book):
+        from backend.xlsx_reader import read_sheet_freeze, read_sheet_merges
+
+        assert read_sheet_merges(Path(styled_book), "Data") == ["C3:D3"]
+        assert read_sheet_freeze(Path(styled_book), "Data") == "A2"
+
+    def test_unknown_sheet_yields_empty(self, styled_book):
+        from backend.xlsx_reader import read_sheet_styles
+
+        assert read_sheet_styles(Path(styled_book), "Nope") == {}
+
+    def test_broken_file_yields_empty(self, test_vault_dir):
+        from backend.xlsx_reader import read_sheet_styles
+
+        bad = Path(test_vault_dir) / "broken-styles.xlsx"
+        bad.write_bytes(b"not a zip")
+        assert read_sheet_styles(bad, "Data") == {}
+
+
+class TestEndpointWiring:
+    def test_read_response_carries_styles_merges_freeze(self, client, styled_book):
+        resp = client.get(f"/api/file/{VAULT}", params={"path": "styles.xlsx"})
+        assert resp.status_code == 200
+        sheet = resp.json()["xlsx_sheets"][0]
+        assert sheet["styles"]["A1"].startswith("color:#cc0000")
+        assert sheet["aligns"] == {} or isinstance(sheet["aligns"], dict)
+        assert sheet["merges"] == ["C3:D3"]
+        assert sheet["freeze"] == "A2"
+
+    def test_rendered_html_carries_the_inline_style(self, client, styled_book):
+        resp = client.get(f"/api/file/{VAULT}", params={"path": "styles.xlsx"})
+        html = resp.json()["xlsx_sheets"][0]["html"]
+        assert 'data-cell="A1" style="' in html
+        assert "font-weight:600" in html