XSLT 3.0 Studio

The XSLT Playground without the 1.0 ceiling.

A single Python file that embeds Saxon, so XSLT 1.0, 2.0 and 3.0 all run — the same range Workday accepts in both EIB and Studio. It opens a local UI in your browser, or runs one-shot in a pipeline.

Your files stay on your machine. The only server involved is the one the script starts on 127.0.0.1 for its own interface.

Download xslt3.py Get uv

One file, no other downloads. Python 3.9+.

Running it

Install uv once, then:

uv run xslt3.py

That opens the interface in your browser. The script declares its own dependencies inline (PEP 723), so uv builds a throwaway environment automatically — no virtualenv, no requirements.txt, nothing to rot.

Without uv: pip install saxonche && python xslt3.py

One-shot, for scripts and CI

uv run xslt3.py -x source.xml -s transform.xsl                # to stdout
uv run xslt3.py -x source.xml -s transform.xsl -o out.csv     # to a file
uv run xslt3.py -x source.xml -s transform.xsl -p year=2026   # with parameters
uv run xslt3.py -s build.xsl --initial-template main          # no source document

Output goes to stdout, errors to stderr with a non-zero exit code, so it pipes cleanly:

uv run xslt3.py -x in.xml -s t.xsl | wc -l

What works

Verified against SaxonC-HE 13: xsl:for-each-group with current-grouping-key(), tokenize(), replace(), upper-case(), maps and arrays with ? lookup, xsl:mode, text value templates, xs: constructors, format-number(), JSON serialisation, and stylesheet parameters. XPath 3.1 has its own tab.

Because it runs locally it can also read and write files by path, so a large extract never has to go through a textarea.

Error messages

Saxon's, with line, column and error code — rather than the browser's "the transform produced no result":

Error in {bogus(1)} in xsl:value-of/@select on line 1 column 137
XPST0017  Cannot find a 1-argument function named Q{...}bogus()

Security

Binds to 127.0.0.1 only — never reachable from another machine.
A fresh random token each run, required on every request, so another local process cannot drive it.
Requests whose Host header is not loopback are rejected, which blocks DNS-rebinding from a website you happen to have open.
Request bodies capped at 64 MB; use the path fields for anything larger.

All four were verified: no token → 403, bad token on the API → 403, spoofed Host → 403, correct token → 200.

Worth knowing before you install

saxonche is about 290 MB installed. It ships a native Saxon build. uv caches it once, so it is a one-time download — but it is not small, and it is why there is no single-file executable version.

SaxonC-HE is the open-source edition. Streaming (xsl:stream), schema-awareness and a few optimiser features are PE/EE only. Everything a typical EIB or Studio stylesheet uses is in HE.
Saxon is not thread-safe here, so requests are serialised behind a lock. Irrelevant for one person; it would matter if this were ever shared.
XPath results show nodes serialised rather than just their string value, which is the accurate XPath 3.1 result.

Which one should I use?

	Browser	This
XSLT version	1.0	1.0, 2.0, 3.0
Covers what Workday accepts	part of it	all of it
Install needed	none	uv + a 290 MB cache
File size	what fits in a textarea	anything on disk
Scriptable / CI	no	yes

EIB and Studio both accept XSLT 1.0 through 3.0, so the browser playground only covers part of what you can actually deploy. Use it for a quick 1.0 check or on a machine you cannot install on; use this for anything above 1.0, for large files, or in a pipeline.