@superblocksteam/shared 0.9614.3 → 0.9615.1

package/src/types/billing/usageSource.ts

@@ -112,3 +112,23 @@ const POOL_LIKE_EXHAUSTIVE: Record<UsageSource, boolean> = {
 export const POOL_LIKE_USAGE_SOURCES: readonly UsageSource[] = Object.entries(POOL_LIKE_EXHAUSTIVE)
   .filter(([, isPoolLike]) => isPoolLike)
   .map(([source]) => source as UsageSource);
+
+// Sources the live dollar_commit path actually writes ledger AI debits for.
+// Replacement repricing must use this allowlist: a denylist (`is_byo IS NOT TRUE`)
+// billed `overage_unbilled` (spend-cap usage the live path declined), plus `trial`
+// and `topup`, as net-new money under the replacement contract.
+const DOLLAR_COMMIT_LIVE_BILLED_EXHAUSTIVE: Record<UsageSource, boolean> = {
+  byo: false,
+  enterprise: false,
+  legacy: false,
+  on_demand: true,
+  overage_unbilled: false,
+  pool: true,
+  seat: false,
+  topup: false,
+  trial: false
+};
+
+export const DOLLAR_COMMIT_LIVE_BILLED_USAGE_SOURCES: readonly UsageSource[] = Object.entries(DOLLAR_COMMIT_LIVE_BILLED_EXHAUSTIVE)
+  .filter(([, billed]) => billed)
+  .map(([source]) => source as UsageSource);

package/src/types/event/index.ts

@@ -71,6 +71,7 @@ export const CombinedViewMode = { ...ViewMode, ...ExportViewMode };
 export type CombinedViewMode = ViewMode | ExportViewMode;
 
 export enum EventAction {
+  ABANDON_TURN = 'abandon_turn',
   CREATED = 'created',
   CLONED = 'cloned',
   DELETED = 'deleted',
@@ -103,6 +104,8 @@ export enum EventAction {
   TRIAL_EXTENDED = 'trial_extended',
   PLAN_UPGRADED = 'plan_upgraded',
   PLAN_DOWNGRADED = 'plan_downgraded',
+  /** Single plan transition for analytics: carries currentPlan and newPlan. */
+  PLAN_CHANGED = 'plan_changed',
   MEMBER_ADDED = 'member_added',
   MEMBER_REMOVED = 'member_removed',
   SENT = 'sent',
@@ -114,6 +117,7 @@ export enum EventAction {
   PULLED = 'pulled',
   PUSHED = 'pushed',
   LOGGED_IN = 'logged_in',
+  SESSION_REVERTED = 'session_reverted',
   SESSION_STARTED = 'session_started',
   GRANTED = 'granted',
   DEACTIVATED = 'deactivated',
@@ -123,7 +127,8 @@ export enum EventAction {
   DETECTED = 'detected',
   DISABLED = 'disabled',
   ENABLED = 'enabled',
-  PUBLISH_ANYWAY = 'publish_anyway'
+  PUBLISH_ANYWAY = 'publish_anyway',
+  EDIT_AFTER_CLARK = 'edit_after_clark'
 }
 
 export interface UserEvent {

package/src/types/policyGate/index.ts

@@ -74,6 +74,11 @@ export type PolicyGateReadinessItem = {
   mode: 'advisory' | 'approval' | 'blocking' | 'blocking_with_exceptions' | 'report_only';
   policyId: string;
   policyVersionId: string;
+  /**
+   * Latest completed run of this policy on the deployed commit. It is the
+   * baseline a diff-scoped scan reviews changes against.
+   */
+  priorReviewRunId?: string;
   progress?: PolicyGateScanProgress;
   reviewRunId?: string;
   runnerType?: ReviewPolicyRunnerType;
@@ -127,6 +132,15 @@ export function areReadinessItemsAckEligible(items: Pick<PolicyGateReadinessItem
   );
 }
 
+/**
+ * Whether a readiness item has reported an outcome. `running` is still
+ * deciding, and `missing` is what a poll between two runs returns, not an
+ * answer.
+ */
+export function hasPolicyItemReported(item: Pick<PolicyGateReadinessItem, 'status'>): boolean {
+  return item.status !== 'missing' && item.status !== 'running';
+}
+
 export type PolicyGateReadinessRun = {
   completedAt?: string;
   createdAt?: string;

package/src/utils/attachment-delivery.test.ts

@@ -50,3 +50,17 @@ describe('dump attachments', () => {
     ).toBe(true);
   });
 });
+
+describe('spreadsheet attachments', () => {
+  test('classifies .xlsx as a reference-only supported upload and leaves legacy Excel unsupported', () => {
+    expect(
+      classifyAttachmentDelivery({
+        fileName: 'budget.xlsx',
+        mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+      })
+    ).toBe('reference_only');
+    expect(isSupportedAttachmentUploadType({ fileName: 'budget.xlsx' })).toBe(true);
+    expect(isSupportedAttachmentUploadType({ fileName: 'inventory.xls' })).toBe(false);
+    expect(isSupportedAttachmentUploadType({ fileName: 'macros.xlsm' })).toBe(false);
+  });
+});

package/src/utils/attachment-delivery.ts

@@ -1,4 +1,4 @@
-import { getTextAttachmentType } from './attachment-upload.js';
+import { getTextAttachmentType, isXlsxAttachmentFile } from './attachment-upload.js';
 
 export type AttachmentDeliveryMode = 'inline_native' | 'reference_only';
 export type AttachmentArchiveType = 'gz' | 'tgz' | 'zip';
@@ -76,7 +76,7 @@ export function isDumpAttachment(input: AttachmentTypeInput): boolean {
 }
 
 export function isReferenceOnlySupportedAttachment(input: AttachmentTypeInput): boolean {
-  return detectAttachmentArchiveType(input) !== null || isDumpAttachment(input);
+  return detectAttachmentArchiveType(input) !== null || isDumpAttachment(input) || isXlsxAttachmentFile(input);
 }
 
 export function classifyAttachmentDelivery(input: AttachmentTypeInput): AttachmentDeliveryMode {

package/src/utils/attachment-upload.test.ts

@@ -9,14 +9,60 @@ import {
   createUploadedAttachmentFromServer,
   getAttachmentMimeTypeFromFileName,
   getTextAttachmentType,
+  isLegacyExcelFile,
   isOfficeXml,
   isTextLikeMimeType,
+  isXlsxAttachmentFile,
   normalizeAttachmentMimeType,
   parseUserFacingUploadError,
   toAttachmentUploadDescriptor,
   uploadAttachmentToServerApi
 } from './attachment-upload.js';
 
+describe('isXlsxAttachmentFile', () => {
+  test('is true for .xlsx only', () => {
+    expect(isXlsxAttachmentFile({ fileName: 'a.xlsx' })).toBe(true);
+    expect(isXlsxAttachmentFile({ fileName: 'b.xls' })).toBe(false);
+    expect(isXlsxAttachmentFile({ fileName: 'c.xlsm' })).toBe(false);
+    expect(isXlsxAttachmentFile({ fileName: 'd.xlsb' })).toBe(false);
+    expect(isXlsxAttachmentFile({ fileName: 'e.docx' })).toBe(false);
+  });
+
+  test('does not read a legacy .xls as .xlsx even when the MIME type says spreadsheet', () => {
+    expect(
+      isXlsxAttachmentFile({
+        fileName: 'inventory.xls',
+        mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+      })
+    ).toBe(false);
+  });
+});
+
+describe('isLegacyExcelFile', () => {
+  test('is true for the Excel formats that cannot be converted', () => {
+    expect(isLegacyExcelFile({ fileName: 'a.xls' })).toBe(true);
+    expect(isLegacyExcelFile({ fileName: 'b.XLSM' })).toBe(true);
+    expect(isLegacyExcelFile({ fileName: 'c.xlsb' })).toBe(true);
+    expect(isLegacyExcelFile({ fileName: 'sheet', mimeType: 'application/vnd.ms-excel' })).toBe(true);
+  });
+
+  test('is false for .xlsx and for files that are not Excel at all', () => {
+    expect(isLegacyExcelFile({ fileName: 'a.xlsx' })).toBe(false);
+    expect(isLegacyExcelFile({ fileName: 'b.csv' })).toBe(false);
+    expect(isLegacyExcelFile({ fileName: 'c.docx' })).toBe(false);
+    expect(isLegacyExcelFile({})).toBe(false);
+  });
+
+  test('reports a macro-enabled workbook even when the MIME type claims .xlsx', () => {
+    expect(
+      isLegacyExcelFile({
+        fileName: 'macro.xlsm',
+        mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+      })
+    ).toBe(true);
+  });
+});
+
 describe('getAttachmentMimeTypeFromFileName', () => {
   test.each([
     ['logo.png', 'image/png'],
@@ -29,7 +75,8 @@ describe('getAttachmentMimeTypeFromFileName', () => {
     ['server.log', 'text/plain'],
     ['rows.csv', 'text/csv'],
     ['config.json', 'application/json'],
-    ['orders_prod.dump', 'application/x-postgresql-dump']
+    ['orders_prod.dump', 'application/x-postgresql-dump'],
+    ['budget.xlsx', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet']
   ])('reads %s as %s', (fileName, expected) => {
     expect(getAttachmentMimeTypeFromFileName(fileName)).toBe(expected);
   });

package/src/utils/attachment-upload.ts

@@ -33,6 +33,8 @@ const TEXT_ATTACHMENT_MIME_TYPES = {
 
 const POSTGRES_DUMP_MIME_TYPES = new Set(['application/vnd.postgresql.dump', 'application/x-postgresql-dump']);
 
+export const XLSX_MIME_TYPE = 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet';
+
 export const TEXT_LIKE_FILE_EXTENSIONS = [
   '.txt',
   '.text',
@@ -86,7 +88,8 @@ const MIME_TYPE_FILE_EXTENSIONS: Record<string, string> = {
   'text/css': '.css',
   'text/csv': '.csv',
   'text/plain': '.txt',
-  'text/yaml': '.yaml'
+  'text/yaml': '.yaml',
+  [XLSX_MIME_TYPE]: '.xlsx'
 };
 
 type UploadAttachmentDataLike = {
@@ -238,6 +241,47 @@ export function isTextLikeMimeType(mimeType: string): boolean {
   );
 }
 
+const LEGACY_EXCEL_EXTENSIONS = ['.xls', '.xlsb', '.xlsm'] as const;
+const LEGACY_EXCEL_MIME_TYPES = ['application/vnd.ms-excel'] as const;
+
+/**
+ * Excel workbooks that Clark converts to CSV before import. Only the modern
+ * `.xlsx` format is read; legacy `.xls` and macro-enabled `.xlsm` files stay
+ * rejected with the rest of Office.
+ */
+export function isXlsxAttachmentFile(params: { fileName?: string; mimeType?: string | null }): boolean {
+  const normalizedFileName = normalizeNonEmptyString(params.fileName)?.toLowerCase();
+  if (normalizedFileName?.endsWith('.xlsx') === true) {
+    return true;
+  }
+  // Any other extension wins over the MIME type. These bytes are handed to a
+  // reader that only understands .xlsx, so a declared MIME type must never let
+  // another format through - not just the legacy Excel ones.
+  if (normalizedFileName !== undefined && /\.[^.]+$/.test(normalizedFileName)) {
+    return false;
+  }
+
+  return normalizeNonEmptyString(params.mimeType)?.toLowerCase() === XLSX_MIME_TYPE;
+}
+
+/** Legacy binary (`.xls`/`.xlsb`) and macro-enabled (`.xlsm`) Excel, which stay rejected. */
+export function isLegacyExcelFile(params: { fileName?: string; mimeType?: string | null }): boolean {
+  if (isXlsxAttachmentFile(params)) {
+    return false;
+  }
+
+  const normalizedFileName = normalizeNonEmptyString(params.fileName)?.toLowerCase();
+  if (normalizedFileName && LEGACY_EXCEL_EXTENSIONS.some((extension) => normalizedFileName.endsWith(extension))) {
+    return true;
+  }
+  if (normalizedFileName !== undefined && /\.[^.]+$/.test(normalizedFileName)) {
+    return false;
+  }
+
+  const normalizedMimeType = normalizeNonEmptyString(params.mimeType)?.toLowerCase();
+  return normalizedMimeType !== undefined && LEGACY_EXCEL_MIME_TYPES.includes(normalizedMimeType as never);
+}
+
 export function isOfficeXml(params: { fileName?: string; mimeType?: string | null }): boolean {
   const normalizedMimeType = normalizeNonEmptyString(params.mimeType)?.toLowerCase();
   if (normalizedMimeType && OFFICE_MIME_SUBSTRINGS.some((mimeType) => normalizedMimeType.includes(mimeType))) {
@@ -321,6 +365,9 @@ export function getAttachmentMimeTypeFromFileName(fileName?: string): string | u
   if (normalizedFileName.endsWith('.jpeg')) {
     return 'image/jpeg';
   }
+  if (normalizedFileName.endsWith('.xlsx')) {
+    return XLSX_MIME_TYPE;
+  }
   if (normalizedFileName.endsWith('.dump')) {
     return 'application/x-postgresql-dump';
   }

package/src/utils/attachment-validation.test.ts

@@ -4,6 +4,7 @@ import { describe, expect, test } from 'vitest';
 import {
   AttachmentValidationError,
   MAX_ARCHIVE_ATTACHMENT_BYTES,
+  MAX_SPREADSHEET_ATTACHMENT_BYTES,
   MAX_IMAGE_ATTACHMENT_BYTES,
   MAX_PDF_ATTACHMENT_BYTES,
   MAX_TEXT_ATTACHMENT_BYTES,
@@ -52,7 +53,8 @@ describe('attachment size policy', () => {
     ['notes.md', 'text/markdown', MAX_TEXT_ATTACHMENT_BYTES],
     ['bundle.zip', 'application/zip', MAX_ARCHIVE_ATTACHMENT_BYTES],
     ['bundle.tgz', 'application/octet-stream', MAX_ARCHIVE_ATTACHMENT_BYTES],
-    ['orders_prod.dump', 'application/octet-stream', MAX_ARCHIVE_ATTACHMENT_BYTES]
+    ['orders_prod.dump', 'application/octet-stream', MAX_ARCHIVE_ATTACHMENT_BYTES],
+    ['budget.xlsx', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', MAX_SPREADSHEET_ATTACHMENT_BYTES]
   ])('allows the exact limit and rejects one byte more for %s', (fileName, mimeType, limit) => {
     expect(getAttachmentUploadLimit({ fileName, mimeType })).toBe(limit);
     expect(() => assertAttachmentSize({ fileName, mimeType, sizeBytes: limit })).not.toThrow();
@@ -82,15 +84,26 @@ describe('attachment size policy', () => {
   test('uses the same policy for MIME types and extension fallback without trusting a conflicting extension', () => {
     expect(getAttachmentUploadPolicy({ fileName: 'SPEC.PDF' })).toEqual(getAttachmentUploadPolicy({ mimeType: 'application/pdf' }));
     expect(getAttachmentUploadPolicy({ fileName: 'spec.pdf', mimeType: 'image/png' }).maxBytes).toBe(3_750_000);
-    expect(getAttachmentLimitsHelp(false)).toBe('PDFs: 4.5 MB each, 100 pages total. Images: 3.75 MB after conversion. Text/code: 5 MiB.');
-    expect(getAttachmentLimitsHelp(true)).toBe(
+  });
+
+  test('lists limits only for the file families a surface accepts', () => {
+    expect(getAttachmentLimitsHelp({})).toBe('PDFs: 4.5 MB each, 100 pages total. Images: 3.75 MB after conversion. Text/code: 5 MiB.');
+    expect(getAttachmentLimitsHelp({ spreadsheetAttachmentsEnabled: true })).toBe(
+      'PDFs: 4.5 MB each, 100 pages total. Images: 3.75 MB after conversion. Text/code: 5 MiB. Excel workbooks (.xlsx): 5 MiB.'
+    );
+    expect(getAttachmentLimitsHelp({ archiveAttachmentsEnabled: true })).toBe(
       'PDFs: 4.5 MB each, 100 pages total. Images: 3.75 MB after conversion. Text/code: 5 MiB. Supported archives and .dump files: 50 MiB.'
     );
+    expect(getAttachmentLimitsHelp({ archiveAttachmentsEnabled: true, spreadsheetAttachmentsEnabled: true })).toBe(
+      'PDFs: 4.5 MB each, 100 pages total. Images: 3.75 MB after conversion. Text/code: 5 MiB. Supported archives and .dump files: 50 MiB. Excel workbooks (.xlsx): 5 MiB.'
+    );
   });
 
   test('rejects unsupported and Office types', () => {
     expectReason(() => getAttachmentUploadLimit({ fileName: 'logo.svg', mimeType: 'image/svg+xml' }), 'unsupported_type');
     expectReason(() => getAttachmentUploadLimit({ fileName: 'report.docx', mimeType: 'text/plain' }), 'unsupported_type');
+    expectReason(() => getAttachmentUploadLimit({ fileName: 'macros.xlsm' }), 'unsupported_type');
+    expectReason(() => getAttachmentUploadLimit({ fileName: 'inventory.xls', mimeType: 'application/vnd.ms-excel' }), 'unsupported_type');
     expectReason(() => getAttachmentUploadLimit({ fileName: 'notes.txt', mimeType: 'application/octet-stream' }), 'unsupported_type');
   });
 });
@@ -133,6 +146,25 @@ describe('attachment content validation', () => {
     );
   });
 
+  test('accepts Excel workbook magic for .xlsx', async () => {
+    await expect(
+      validateAttachmentBytes({
+        fileName: 'budget.xlsx',
+        mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        bytes: new Uint8Array([0x50, 0x4b, 0x03, 0x04])
+      })
+    ).resolves.toEqual({ pdfPages: 0 });
+    await expectAsyncReason(
+      () =>
+        validateAttachmentBytes({
+          fileName: 'budget.xlsx',
+          mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+          bytes: encoder.encode('not a workbook')
+        }),
+      'invalid_content'
+    );
+  });
+
   test('accepts dump mime type without a .dump filename', async () => {
     const bytes = encoder.encode('PGDMP\x01\x0e\x00');
     await expect(validateAttachmentBytes({ fileName: 'orders', mimeType: 'application/x-postgresql-dump', bytes })).resolves.toEqual({

package/src/utils/attachment-validation.ts

@@ -1,7 +1,7 @@
 import { PDFDocument, PDFPageLeaf, PDFPageTree } from 'pdf-lib';
 
 import { detectAttachmentArchiveType, isDumpAttachment } from './attachment-delivery.js';
-import { getTextAttachmentType, isOfficeXml } from './attachment-upload.js';
+import { getTextAttachmentType, isOfficeXml, isXlsxAttachmentFile } from './attachment-upload.js';
 
 const ATTACHMENT_UPLOAD_POLICIES = {
   archive: {
@@ -19,6 +19,16 @@ const ATTACHMENT_UPLOAD_POLICIES = {
     invalidContentMessage:
       'This database dump could not be read. Re-create it with pg_dump custom format (-Fc) so the file starts with PGDMP, then try again.'
   },
+  spreadsheet: {
+    // Reading a workbook builds the whole grid in memory: a 6 MB file already
+    // costs ~800 MB and a 32 MB one costs ~3 GB, which the editor process
+    // cannot absorb. Cap the upload where the conversion stays affordable.
+    maxBytes: 5 * 1024 * 1024,
+    sizeLabel: '5 MiB',
+    label: 'Excel workbook',
+    advice: 'Remove unused sheets or split the workbook before attaching it.',
+    invalidContentMessage: 'This Excel workbook could not be read. Re-save it as .xlsx without a password and try again.'
+  },
   image: {
     maxBytes: 3_750_000,
     sizeLabel: '3.75 MB after conversion',
@@ -46,11 +56,35 @@ export const MAX_PDF_ATTACHMENT_BYTES = ATTACHMENT_UPLOAD_POLICIES.pdf.maxBytes;
 export const MAX_IMAGE_ATTACHMENT_BYTES = ATTACHMENT_UPLOAD_POLICIES.image.maxBytes;
 export const MAX_TEXT_ATTACHMENT_BYTES = ATTACHMENT_UPLOAD_POLICIES.text.maxBytes;
 export const MAX_ARCHIVE_ATTACHMENT_BYTES = ATTACHMENT_UPLOAD_POLICIES.archive.maxBytes;
+export const MAX_SPREADSHEET_ATTACHMENT_BYTES = ATTACHMENT_UPLOAD_POLICIES.spreadsheet.maxBytes;
 export const MAX_PDF_ATTACHMENT_PAGES = 100;
 
-export function getAttachmentLimitsHelp(archiveAttachmentsEnabled: boolean): string {
+/**
+ * Which families of upload-and-reference files a surface accepts. Excel
+ * workbooks roll out separately from archives and dumps, so each family has
+ * its own switch.
+ */
+export type ReferenceOnlyAttachmentFlags = {
+  archiveAttachmentsEnabled?: boolean;
+  spreadsheetAttachmentsEnabled?: boolean;
+};
+
+export function getAttachmentLimitsHelp(flags: ReferenceOnlyAttachmentFlags): string {
   const { archive, image, pdf, text } = ATTACHMENT_UPLOAD_POLICIES;
-  return `PDFs: ${pdf.sizeLabel} each, ${MAX_PDF_ATTACHMENT_PAGES} pages total. Images: ${image.sizeLabel}. Text/code: ${text.sizeLabel}.${archiveAttachmentsEnabled ? ` Supported archives and .dump files: ${archive.sizeLabel}.` : ''}`;
+  const base = `PDFs: ${pdf.sizeLabel} each, ${MAX_PDF_ATTACHMENT_PAGES} pages total. Images: ${image.sizeLabel}. Text/code: ${text.sizeLabel}.`;
+  const archivesEnabled = flags.archiveAttachmentsEnabled === true;
+  const workbooksEnabled = flags.spreadsheetAttachmentsEnabled === true;
+
+  if (archivesEnabled && workbooksEnabled) {
+    return `${base} Supported archives and .dump files: ${archive.sizeLabel}. Excel workbooks (.xlsx): ${ATTACHMENT_UPLOAD_POLICIES.spreadsheet.sizeLabel}.`;
+  }
+  if (archivesEnabled) {
+    return `${base} Supported archives and .dump files: ${archive.sizeLabel}.`;
+  }
+  if (workbooksEnabled) {
+    return `${base} Excel workbooks (.xlsx): ${ATTACHMENT_UPLOAD_POLICIES.spreadsheet.sizeLabel}.`;
+  }
+  return base;
 }
 
 export type AttachmentValidationReason = 'invalid_content' | 'too_large' | 'too_many_pdf_pages' | 'unsupported_type';
@@ -60,7 +94,7 @@ const VALIDATION_MESSAGES: Record<AttachmentValidationReason, string> = {
   too_large: 'This upload is too large. Reduce its size and try again.',
   too_many_pdf_pages: `Clark supports up to ${MAX_PDF_ATTACHMENT_PAGES} PDF pages per request. Remove another PDF or attach fewer pages.`,
   unsupported_type:
-    'This file type is not supported. Use an image, PDF, text/code file, a supported ZIP, GZIP, or TGZ archive, or a Postgres .dump file.'
+    'This file type is not supported. Use an image, PDF, text/code file, an Excel workbook (.xlsx), a supported ZIP, GZIP, or TGZ archive, or a Postgres .dump file.'
 };
 
 export class AttachmentValidationError extends Error {
@@ -81,7 +115,7 @@ export type AttachmentTypeInput = {
   mimeType?: string | null;
 };
 
-type AttachmentKind = 'archive' | 'dump' | 'gif' | 'jpeg' | 'pdf' | 'png' | 'text' | 'webp';
+type AttachmentKind = 'archive' | 'dump' | 'gif' | 'jpeg' | 'pdf' | 'png' | 'spreadsheet' | 'text' | 'webp';
 const MAX_PDF_PAGE_TREE_NODES = 1_000;
 const POSTGRES_DUMP_MAGIC = [0x50, 0x47, 0x44, 0x4d, 0x50] as const;
 
@@ -94,6 +128,9 @@ function normalizedFileName(fileName?: string): string {
 }
 
 function getAttachmentKind(input: AttachmentTypeInput): AttachmentKind {
+  if (isXlsxAttachmentFile(input)) {
+    return 'spreadsheet';
+  }
   if (isOfficeXml(input)) {
     throw new AttachmentValidationError('unsupported_type');
   }
@@ -128,7 +165,10 @@ function getAttachmentKind(input: AttachmentTypeInput): AttachmentKind {
 /** Resolve the validated upload policy by MIME, falling back to the extension only when MIME is absent or generic. */
 export function getAttachmentUploadPolicy(input: AttachmentTypeInput) {
   const kind = getAttachmentKind(input);
-  const policy = ATTACHMENT_UPLOAD_POLICIES[kind === 'archive' || kind === 'dump' || kind === 'pdf' || kind === 'text' ? kind : 'image'];
+  const policy =
+    ATTACHMENT_UPLOAD_POLICIES[
+      kind === 'archive' || kind === 'dump' || kind === 'pdf' || kind === 'spreadsheet' || kind === 'text' ? kind : 'image'
+    ];
   return {
     ...policy,
     tooLargeMessage: `This ${policy.label} is too large. The limit is ${policy.sizeLabel}. ${policy.advice}`
@@ -188,6 +228,11 @@ function validateDump(bytes: Uint8Array): void {
   }
 }
 
+/** An .xlsx workbook is an OOXML zip, so the zip magic is what has to match. */
+function validateSpreadsheet(bytes: Uint8Array): void {
+  if (!isZip(bytes)) throw new AttachmentValidationError('invalid_content');
+}
+
 function validateText(bytes: Uint8Array): void {
   if (
     bytes.includes(0) ||
@@ -260,6 +305,7 @@ export async function validateAttachmentBytes(input: AttachmentTypeInput & { byt
     if (kind === 'text') validateText(input.bytes);
     else if (kind === 'archive') validateArchive(input, input.bytes);
     else if (kind === 'dump') validateDump(input.bytes);
+    else if (kind === 'spreadsheet') validateSpreadsheet(input.bytes);
     else validateImage(kind, input.bytes);
     return { pdfPages: 0 };
   } catch (error) {