# Office Tools

Office Tools is a local-first browser application for opening and inspecting
office documents without sending them to a server. The initial release focuses
on safe, useful viewing of documents, spreadsheets and presentations in both
Office Open XML and OpenDocument packages.

The application is part of the
[add·ideas Toolbox](https://git.add-ideas.de/lotobo/toolbox-portal), but remains
fully usable as a standalone static site at any URL depth.

## Initial format scope

| Kind          | Office Open XML | OpenDocument | Legacy binary                         |
| ------------- | --------------- | ------------ | ------------------------------------- |
| Documents     | `.docx`         | `.odt`       | `.doc` is a later compatibility track |
| Spreadsheets  | `.xlsx`         | `.ods`       | `.xls` is a later compatibility track |
| Presentations | `.pptx`         | `.odp`       | `.ppt` is a later compatibility track |

The viewer is deliberately read-only. It aims to preserve readable content,
structure and useful styling while clearly reporting features it cannot render.
It does not claim pixel-perfect fidelity with Microsoft Office or LibreOffice.
Macros, scripts, external resources and embedded active content are never run.

Office Open XML files use local Rust/WebAssembly parsers and canvas renderers.
OpenDocument files use the project's bounded ZIP/XML reader and semantic React
views. Both paths run locally, keep the interface responsive, support search and
navigation, and accept source files up to 100 MiB.

See [docs/FORMAT-SUPPORT.md](docs/FORMAT-SUPPORT.md) for the feature matrix and
known limits.

## Privacy and security

- File bytes are read locally and are never uploaded.
- There is no telemetry, analytics or CDN runtime dependency.
- Imported markup is converted to application-owned React output; it is not
  inserted as trusted HTML.
- Document links remain inert in this release, and no macros, scripts or
  embedded active objects are executed.
- Parsing uses explicit file, package and rendering limits. A malformed file
  fails as data rather than taking over the application.

See [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md) for the threat model.

## Development

Requirements: Node.js 22 or newer and npm 11 or newer. The committed `.npmrc`
points the `@add-ideas` scope at the ADD Ideas package registry; credentials stay
in the caller's npm configuration.

```sh
npm ci
npm run dev
```

The complete local verification gate is:

```sh
npm run check
npm run test:browser
```

`vite.config.ts` uses `base: './'`. All application URLs, WASM and worker assets
must remain relative so a production build works at `/apps/office/`, in a deeper
test path, or standalone.

## Release artifact

Create the deterministic application ZIP and checksum with:

```sh
npm run release:artifact
```

The result is written to:

```text
release/office-tools-0.1.0.zip
release/office-tools-0.1.0.zip.sha256
```

The archive contains `toolbox-app.json`, built assets, the full GPL licence,
third-party notices, a generated runtime licence inventory, documentation and
`SOURCE.md`. File order, timestamps and modes are normalized for reproducible
output.

## Toolbox identity

- Manifest id: `de.add-ideas.office-tools`
- Portal target: `office`
- Source: <https://git.add-ideas.de/lotobo/office-tools>
- Licence: `GPL-3.0-or-later`

The application uses `@add-ideas/toolbox-shell-react` 0.2.3 and validates its
production tree with `@add-ideas/toolbox-testkit`.

## Licence

Office Tools is free software licensed under GPL-3.0-or-later. See
[LICENSE](LICENSE). Bundled dependencies retain their own licences; see
[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) and [LICENSES](LICENSES/README.md).