@silurus/ooxml 0.70.1 → 0.71.0

package/README.md

@@ -1,5 +1,20 @@
 > **This entire codebase — Rust parsers, TypeScript renderers, tests, and tooling — was implemented by [Claude](https://claude.ai)** (Anthropic's AI assistant) through iterative prompting. No human-written application code exists in this repository.
 
+<details>
+<summary><b>Why this project exists — a note from the author</b></summary>
+
+<br>
+
+OOXML's behavior is defined by a written specification (ECMA-376 / ISO-29500), and there is a clear answer to compare against: Word, Excel, and PowerPoint themselves. In principle, anyone with enough patience could have built a faithful viewer — the spec says what to implement, and the Office applications show whether you got it right.
+
+In practice, it didn't happen. For more than a decade, no free, open-source library reached a rendering quality good enough for real use. There are a few commercial libraries with decent fidelity (and editing support), but their pricing makes them hard to adopt casually. I think the reason is simply cost: the specification is huge, and reading and implementing it faithfully takes far more effort than volunteers can afford.
+
+Generative AI changed that. A viewer is an unusually good fit for AI-driven iterative development ("vibe coding"): there is a spec to read and a correct output to aim for, so the work comes down to interpreting the specification and refining the rendering until it matches. Limiting the scope to viewing also avoids the most serious risk an Office library can carry — corrupting a user's files.
+
+So I'm building this library with Claude, spec-first, and keeping it free to use. For some documents it already reproduces the desktop Office applications more faithfully than commercial libraries — and sometimes even the official Microsoft 365 web apps.
+
+</details>
+
 <p align="center">
   <img src="docs/images/icon.png" alt="office-open-xml-viewer" width="160" height="160">
 </p>
@@ -29,15 +44,23 @@ pnpm add @silurus/ooxml
 
 > **Bundler note**: the Rust parsers ship as real `.wasm` asset files next to the
 > JavaScript, referenced with the standard `new URL('…', import.meta.url)` form
-> and fetched (streaming-compiled) at load time. Vite, webpack 5, Rollup and
-> Parcel detect that reference and copy the asset automatically — no extra
-> WebAssembly plugin is required. esbuild and the Angular CLI (whose application
-> builder is esbuild-based) do **not** process that reference
-> ([esbuild#795](https://github.com/evanw/esbuild/issues/795)): copy the `.wasm`
-> into your served output yourself and point the viewer at it with the `wasmUrl`
-> load option — see the [Angular example](#framework-examples) for the two-step
-> setup. `wasmUrl` also serves the parser WASM from a CDN or any path you
-> control:
+> and fetched (streaming-compiled) at load time. Verified to work with zero
+> config: **webpack 5**, **Next.js** (Turbopack, dev and build), **Vite 8**
+> (dev and build), **Vite 7 production builds**, and a plain
+> `<script type="module">` with no bundler at all. Two setups need a hand:
+>
+> - **Vite 7 dev server**: the dependency optimizer rewrites the asset reference
+>   into its own cache path and the load fails (fixed in Vite 8). Add
+>   `optimizeDeps: { exclude: ['@silurus/ooxml'] }` to your `vite.config` —
+>   production builds are unaffected.
+> - **esbuild / Angular CLI** (whose application builder is esbuild-based):
+>   `new URL` asset references are not processed
+>   ([esbuild#795](https://github.com/evanw/esbuild/issues/795)). Copy the
+>   `.wasm` into your served output and point the viewer at it with the
+>   `wasmUrl` load option — see the [Angular example](#framework-examples) for
+>   the two-step setup.
+>
+> `wasmUrl` also serves the parser WASM from a CDN or any path you control:
 >
 > ```typescript
 > new DocxViewer(canvas, { wasmUrl: 'https://cdn.example.com/docx_parser_bg.wasm' });
@@ -233,6 +256,41 @@ here instead of crashing the scroll loop). The parse/render knobs from the
 headless engines (`mode`, `useGoogleFonts`, `maxZipEntryBytes`, `math`, `dpr`)
 are accepted too.
 
+### Markdown export
+
+Every headless engine can project its document to GitHub-flavoured markdown for
+LLM ingestion, full-text search, or diffing — headings, lists, tables, and (for
+docx) footnotes / comments are preserved; layout, fonts, and positioning are
+dropped. The projection is compiled into the parser WASM you already ship, so it
+adds **zero** bundle weight. `toMarkdown()` works in both `mode: 'main'` and
+`mode: 'worker'` (it runs off the archive opened at `load()`):
+
+```typescript
+import { DocxDocument } from '@silurus/ooxml/docx';
+
+const doc = await DocxDocument.load('/document.docx');
+const md = await doc.toMarkdown();
+```
+
+`PptxPresentation.toMarkdown()` (title slides → `#` headings, body → nested
+bullets, notes / comments collated) and `XlsxWorkbook.toMarkdown()` (each sheet →
+a `## SheetName` pipe table) are the twins.
+
+For a one-off conversion outside a viewer, the standalone
+`@silurus/ooxml-markdown` package exposes the low-level functions and a CLI:
+
+```typescript
+import { docxToMarkdown, initDocxFromBytes } from '@silurus/ooxml-markdown';
+
+initDocxFromBytes(wasmBytes);          // the docx parser's `_bg.wasm`
+const md = docxToMarkdown(fileBytes);  // ArrayBuffer | Uint8Array | Buffer
+```
+
+```bash
+npx ooxml-md document.docx            # → stdout
+npx ooxml-md deck.pptx -o deck.md     # → file
+```
+
 ---
 
 <details>
@@ -567,6 +625,9 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Page size and margins | ✅ |
 | | Headers / footers (default / first / even) | ✅ |
 | | Section breaks (continuous / nextPage / oddPage / evenPage) | ✅ |
+| | Page borders (`w:pgBorders`, §17.6.10 — standard line styles, offsetFrom / display / zOrder; art borders not yet supported) | ✅ |
+| | Line numbering (`w:lnNumType`, §17.6.8) | ✅ |
+| | Section vertical alignment (`w:vAlign`, §17.6.22) | ✅ |
 | **Text** | Paragraphs | ✅ |
 | | Bold, italic, underline, strikethrough | ✅ |
 | | Font family, size, color | ✅ |
@@ -587,22 +648,33 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | keepNext / keepLines / widowControl | ✅ |
 | | Right-to-left text — UAX#9 bidi, `w:bidi` / `w:rtl`, complex-script formatting (`w:szCs` / `w:bCs` / `rFonts@cs`, §17.3.2.26), RTL lists and indents | ✅ |
 | | Japanese kinsoku line breaking (`w:kinsoku`, §17.15.1.58 — 行頭/行末禁則) | ✅ |
+| | Vertical writing (縦書き — UAX#50 vertical glyph forms, 縦中横 tate-chu-yoko runs, 、。 upper-right positioning; §17.3.2 vertical text) | ✅ |
 | **Elements** | Tables (with borders, fills, merges, banding, alignment) | ✅ |
 | | Table auto-layout by preferred widths (`w:tblLayout` autofit, §17.4.52; min content width) | ✅ |
+| | Table indent (`w:tblInd`, §17.4.50) | ✅ |
 | | Right-to-left table column order (`w:bidiVisual`, §17.4.1) | ✅ |
+| | Charts (embedded DrawingML `c:chart` — bar / line / area / pie / doughnut / radar / scatter, via the shared core chart renderer; data labels honour `dLblPos`, §21.2.2.48) | ✅ |
 | | Math equations (OMML `m:oMath` / `m:oMathPara`, rendered via MathJax — opt-in `@silurus/ooxml/math`) | ✅ |
 | | Images (inline and anchored, with text wrap) | ✅ |
 | | SVG images (`asvg:svgBlip` MS-2016 extension — vector drawn from the embedded `.svg`, raster fallback) | ✅ |
 | | Text boxes / drawing shapes (`wps:txbx`, `a:prstGeom` — 186 preset geometries via the shared engine; connector arrow heads `headEnd` / `tailEnd` (§20.1.8.3) and `prstDash` dash patterns (§20.1.8.48)). Text-box paragraphs run through the **same line-layout engine as body text**, so kinsoku 行頭/行末禁則 (§17.15.1.58–60), UAX#9 bidi (`w:bidi`, §17.3.1.6), justification (§17.18.44) and tab stops (§17.3.1.37) all apply inside a box | ✅ |
-| | WMF metafile images (legacy vector, incl. inside text boxes) — rasterized via a built-in player (window mapping, pens/brushes, poly/rect); true EMF detected but not yet rendered | ✅ |
+| | WMF **and EMF** metafile images (legacy vector, incl. inside text boxes) — rasterized via a built-in player: window→viewport mapping (MS-EMF map modes, world transform), pens/brushes, poly/rect/ellipse, text-out, path clipping, and embedded DIB blits | ✅ |
+| | OLE embedded objects (`w:object` — the baked VML `v:imagedata` preview is drawn; the embedded app is not run) | ✅ |
 | **Advanced** | Footnotes — reference markers + bottom-of-page bodies with separator rule, numbered (`w:footnoteReference` / `w:footnoteRef`, §17.11) | ✅ |
 | | Endnotes — reference markers + bodies at document end (`w:endnoteReference`, §17.11) | ✅ |
+| | Page-number formats (`w:pgNumType` restart / format §17.6.12; PAGE `\*` switches — decimal / roman / letter / hex / ordinal-dash / hebrew2 / koreanLegal, §17.18.59) | ✅ |
+| | Field date/time pictures (`TIME` / `DATE` field `\@` format, §17.16.5.72 / .16) | ✅ |
 | | `w:snapToGrid` opt-out of the document grid (§17.3.1.32) | ✅ |
 | | Track changes (`w:ins` / `w:del` — author-coloured underline / strikethrough) | ✅ |
 | | Comments — author / date / text via the document model (`doc.comments`, §17.13.4; not drawn on the page) | ✅ |
+| | Markdown export (`DocxDocument.toMarkdown()` — headings, lists, tables, footnotes / comments; also `@silurus/ooxml-markdown` + the `ooxml-md` CLI) | ✅ |
 | | Mail merge fields | ❌ Not planned |
 | **Interaction** | Text selection (transparent overlay, native copy) | ✅ |
+| | In-document find (`findText` / `findNext` / `findPrev` / `clearFind` — full-text search, all hits highlighted, each match tagged with its page) | ✅ |
+| | Runtime zoom (`getScale` / `setScale` / `fitWidth` / `fitPage`) | ✅ |
+| | Clickable hyperlinks (overlay hit-test, `onHyperlinkClick`; internal bookmark / anchor navigation) | ✅ |
 | | Continuous scroll viewer (`DocxScrollViewer` — virtualized page list, desk background / shadow, Ctrl/⌘+wheel zoom, engine injection) | ✅ |
+| **Loading** | Password-protected files ([MS-OFFCRYPTO] Agile Encryption — `load(bytes, { password })`, decrypted client-side via WebCrypto; legacy Standard / Extensible encryption → typed `unsupported-encryption`) | ✅ |
 
 ---
 
@@ -616,6 +688,7 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Formula results (from cached `<v>`) | ✅ |
 | | Dates (ECMA-376 date format codes) | ✅ |
 | | Rich text (per-run formatting) | ✅ |
+| | East-Asian furigana (`<rPh>` §18.4.6 + `<phoneticPr>` §18.4.3 — drawn when a cell opts in via `ph="1"`; row-level `<row ph>` inheritance) | ✅ |
 | **Formatting** | Bold, italic, underline (`single` / `double` / `singleAccounting` / `doubleAccounting`), strikethrough | ✅ |
 | | Superscript / subscript (`vertAlign`) | ✅ |
 | | Font family, size, color | ✅ |
@@ -632,12 +705,14 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Frozen panes | ✅ |
 | | Row / column sizing (custom widths and heights) | ✅ |
 | | Hidden rows / columns | ✅ |
+| | Row / column outline grouping (`outlineLevel` / `collapsed` §18.3.1.73 / .13, `<outlinePr>` — gutter brackets, +/− collapse, numbered level buttons; view-only) | ✅ |
 | **Elements** | Images (`<xdr:twoCellAnchor>`) | ✅ |
+| | OLE embedded objects (`<oleObjects>` — the legacy VML `v:imagedata` preview keyed by `oleObject@shapeId` is drawn; an image-typed `objectPr` target is preferred when present, and the embedded app is not run) | ✅ |
 | | SVG images (`asvg:svgBlip` MS-2016 extension — vector drawn from the embedded `.svg`, raster fallback) | ✅ |
 | | Drawing shapes / text boxes (`xdr:sp`, `xdr:txBody` — 186 preset geometries via the shared engine, with `avLst` adjust handles) | ✅ |
 | | Math equations in shapes (OMML `m:oMath` / `m:oMathPara` in `xdr:txBody`, incl. `a14:m` / `mc:AlternateContent`; rendered via MathJax — opt-in `@silurus/ooxml/math`) | ✅ |
 | | Charts (bar, line, area, pie, doughnut, radar, scatter / bubble) | ✅ |
-| | Chart markers (circle / square / diamond / triangle / x / plus / star / dot / dash, per-point `<c:dPt>` overrides) | ✅ |
+| | Chart markers (circle / square / diamond / triangle / x / plus / star / dot / dash, per-point `<c:dPt>` overrides; markers-only scatter series draw a marker legend key) | ✅ |
 | | Chart data labels (`<c:dLbl>` per-point with CELLRANGE / VALUE / SERIESNAME / CATEGORYNAME field references, position `l`/`r`/`t`/`b`/`ctr`/`outEnd`) | ✅ |
 | | Chart error bars (`<c:errBars>` X/Y direction, `cust` / `fixedVal` / `stdErr` / `stdDev` / `percentage`, dashed/styled lines) | ✅ |
 | | Chart manual layout (`<c:title><c:layout>` and `<c:plotArea><c:layout>`) | ✅ |
@@ -647,6 +722,7 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Pivot tables | ❌ Not planned |
 | | Cell comments / notes (classic `xl/commentsN.xml` + Office-365 threaded comments — red triangle indicator + author / text via the worksheet model, shown in an Excel-style hover popup) | ✅ |
 | | Data validation (rules via the worksheet model; `list`-type dropdown arrow on the selected cell whose click opens a panel showing the allowed values — read-only) | ✅ |
+| | Markdown export (`XlsxWorkbook.toMarkdown()` — each sheet as a `## SheetName` pipe table; also `@silurus/ooxml-markdown` + the `ooxml-md` CLI) | ✅ |
 | **Interaction** | Cell selection (single / range / row / column / all) | ✅ |
 | | Excel-style row / column header highlight on selection | ✅ |
 | | Shift+click to extend, Ctrl+C to copy as TSV | ✅ |
@@ -654,8 +730,12 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | `onSelectionChange` callback, `getCellAt(x, y)` API | ✅ |
 | | Zoom slider (Excel-style, right of the tab bar, 10–400% with 100% centered; `showZoomSlider` option) | ✅ |
 | | Ctrl/⌘ + mouse-wheel and trackpad-pinch zoom (in addition to the slider) | ✅ |
+| | Runtime fit / zoom API (`fitWidth` / `fitPage` / `getScale` / `setScale`, in addition to the slider) | ✅ |
+| | In-document find (`findText` / `findNext` / `findPrev` / `clearFind` — matches tagged with sheet + cell) | ✅ |
+| | Clickable hyperlinks (`onHyperlinkClick`; internal defined-name / cell navigation) | ✅ |
 | | Drag-to-resize columns / rows by dragging header borders (`resizable` option, default on) — **view-only: changes the on-screen view only and never modifies the loaded file** | ✅ |
 | | Customizable cell-selection color (`selectionColor` option, `setSelectionColor()`) | ✅ |
+| **Loading** | Password-protected files ([MS-OFFCRYPTO] Agile Encryption — `load(bytes, { password })`, decrypted client-side via WebCrypto; legacy Standard / Extensible encryption → typed `unsupported-encryption`) | ✅ |
 
 ---
 
@@ -669,6 +749,7 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Slide background (solid, gradient, image) | ✅ |
 | | Slide numbers | ✅ |
 | | Speaker notes (plain text via `getNotes()`) | ✅ |
+| | Markdown export (`PptxPresentation.toMarkdown()` — title slides → headings, body → nested bullets, notes / comments collated; also `@silurus/ooxml-markdown` + the `ooxml-md` CLI) | ✅ |
 | | Animations / transitions | ❌ Not planned |
 | **Element types** | Shapes (`sp`) | ✅ |
 | | Pictures (`pic`) | ✅ |
@@ -681,8 +762,10 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Charts (scatter — `scatterStyle` marker / line / smooth variants) | ✅ |
 | | Charts (bubble — `bubbleSize` per-point area scaling) | ✅ |
 | | Charts (combo — bar + line with a secondary value axis on the right) | ✅ |
-| | SmartArt (renders the PowerPoint-saved drawing layout `dsp:drawing`; no native diagram layout engine) | ✅ |
-| | OLE embedded objects (`p:oleObj` — preview/icon rendering) | ❌ Not planned |
+| | Charts (chartEx — funnel / histogram / treemap / sunburst / box &amp; whisker) | ✅ |
+| | Charts (stock — high / low / close candlesticks) | ✅ |
+| | SmartArt (renders the PowerPoint-saved drawing layout `dsp:drawing`, or a staged fallback to a text list when no drawing part is present; no native diagram layout engine) | ✅ |
+| | OLE embedded objects (`p:oleObj` — the baked preview `p:pic` is drawn; the embedded app is not run) | ✅ |
 | | Video / audio (poster + interactive playback) | ✅ |
 | | Ink / handwriting (`p:contentPart`, raster fallback) | ✅ |
 | **Shape geometry** | 186 preset shapes (`prstGeom` — incl. 3D presets cube / can / bevel / frame) | ✅ |
@@ -719,6 +802,7 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Hyperlinks (`hlinkClick` — theme `hlink` colour + auto underline) | ✅ |
 | | Text shadow (`rPr > effectLst > outerShdw`) | ✅ |
 | | Text outline (`rPr > a:ln`) | ✅ |
+| | WordArt text warps (`a:prstTxWarp`, §20.1.9.19 — all 40 presets, per-glyph envelope fit incl. Follow Path) | ✅ |
 | | Text highlight / marker (`a:highlight` — §21.1.2.3.4) | ✅ |
 | | Math equations (OMML `m:oMath` / `m:oMathPara`, incl. `a14:m` / `mc:AlternateContent`; STIX Two Math via MathJax — opt-in `@silurus/ooxml/math`) | ✅ |
 | **Text — paragraphs** | Horizontal alignment (left / center / right / justify) | ✅ |
@@ -747,7 +831,11 @@ export const PptxViewerComponent = component$<{ src: string }>(({ src }) => {
 | | Font scheme (`+mj-lt`, `+mn-lt`) | ✅ |
 | | lumMod / lumOff / alpha transforms | ✅ |
 | **Interaction** | Text selection (transparent overlay, native copy) | ✅ |
+| | In-document find (`findText` / `findNext` / `findPrev` / `clearFind` — matches tagged with slide) | ✅ |
+| | Runtime zoom (`getScale` / `setScale` / `fitWidth` / `fitPage`) | ✅ |
+| | Clickable hyperlinks (`onHyperlinkClick`; internal slide-jump navigation) | ✅ |
 | | Continuous scroll viewer (`PptxScrollViewer` — virtualized slide list, desk background / shadow, Ctrl/⌘+wheel zoom, engine injection) | ✅ |
+| **Loading** | Password-protected files ([MS-OFFCRYPTO] Agile Encryption — `load(bytes, { password })`, decrypted client-side via WebCrypto; legacy Standard / Extensible encryption → typed `unsupported-encryption`) | ✅ |
 
 ---
 
@@ -806,7 +894,29 @@ cd packages/pptx/parser && wasm-pack build --target web && cp pkg/pptx_parser_bg
   Supported uniformly by `DocxViewer`, `PptxViewer`, and `XlsxViewer`. Zero / negative values fall back to the default.
 - **No network by default.** The library does not send telemetry or analytics, and does not contact third-party services unless you ask it to. In particular, theme webfonts, Office font metric substitutes (Carlito/Caladea), and the script fallback fonts are **not** loaded from Google Fonts unless you pass `useGoogleFonts: true` to the relevant `Viewer` / `load(...)` options — supported uniformly by `DocxViewer`, `PptxViewer`, and `XlsxViewer`. When enabled, fonts for non-Latin scripts are supplied on demand from Noto families so text does not fall back to tofu: Arabic (Noto Naskh/Sans Arabic), CJK (Noto Sans/Serif KR · SC · TC · JP, picked per document language so shared Han glyphs take the right shapes), Cyrillic (Noto Sans/Serif), Hebrew (Noto Sans/Serif Hebrew, RTL), Thai (Noto Sans Thai) and Devanagari (Noto Sans Devanagari). No font binaries ship in the bundle. Enabling this option causes the end-user's browser to send an HTTP request (IP and User-Agent) to `fonts.googleapis.com`, which may have GDPR implications for your application — consider self-hosting the required fonts via `@font-face` instead.
 - **XML parsing.** Uses `roxmltree`, which does not resolve external entities (XXE-safe by default).
+- **Encrypted OOXML ([MS-OFFCRYPTO] Agile Encryption).** Password-protected `.docx` / `.xlsx` / `.pptx` files are OLE2/CFB containers, not ZIPs. Pass `password` to `load(...)` and the file is decrypted **client-side** via WebCrypto — no bytes and no password leave the browser:
+  ```ts
+  const doc = await DocxDocument.load(bytes, { password: 'secret' });
+  ```
+  Key derivation (SHA-512 spin, commonly 100,000 iterations) and AES-CBC segment decryption run on the main thread and add roughly a second before parsing. Failures are typed [`OoxmlError`](packages/core/src/errors/ooxml-error.ts)s: no `password` on an encrypted file → `encrypted`, wrong `password` → `invalid-password`, a non-Agile scheme (legacy **Standard** / **Extensible** encryption, or an encrypted legacy binary `.doc`/`.xls`/`.ppt`) → `unsupported-encryption`. **Note:** decryption recovers the plaintext but does **not** verify the file's HMAC data-integrity tag ([MS-OFFCRYPTO] §2.3.4.14), so tampering with the ciphertext is not detected — treat decrypted output from untrusted sources with the same care as any other input.
 
 ## License
 
 MIT
+
+## Third-Party Notices
+
+The library's own code is MIT-licensed. It also bundles a small set of
+permissively-licensed third-party components — see
+[THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md) (included in the npm
+tarball) for the full list and license texts. Highlights:
+
+- **[MathJax](https://www.mathjax.org/) + STIX Two Math**
+  (Apache License 2.0) — the equation-rendering engine behind the
+  opt-in `@silurus/ooxml/math` entry described in
+  [Rendering equations](#rendering-equations). It ships in the tarball as
+  a standalone ~3 MB asset but is never loaded by a consuming app unless
+  that app imports `@silurus/ooxml/math` and the viewer is handed a
+  document that actually contains an equation.
+- **Rust crate dependencies** of the WASM parsers (docx/pptx/xlsx) — all
+  MIT / Apache-2.0 (or compatible permissive licenses), no copyleft.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,283 @@
+# Third-Party Notices
+
+`@silurus/ooxml` is MIT-licensed (see [LICENSE](./LICENSE)). It bundles the
+third-party components listed below, none of which are copyleft. This file
+is included in the npm tarball so it travels with every install.
+
+## JavaScript / bundled asset
+
+### MathJax + STIX Two Math (`mathjax-stix2.js`)
+
+The optional equation-rendering engine (`@silurus/ooxml/math`, opt-in —
+see the [README's "Rendering equations" section](./README.md#rendering-equations))
+pre-bundles two Apache-2.0 packages into a single ~3 MB asset
+(`packages/core/assets/mathjax-stix2.js`, built by
+[`packages/core/build/build-mathjax.mjs`](./packages/core/build/build-mathjax.mjs)).
+It ships in the npm tarball but is only fetched by a consuming app at
+runtime if that app imports `@silurus/ooxml/math` **and** the loaded
+document actually contains an equation.
+
+- **[MathJax](https://www.mathjax.org/)** (`@mathjax/src`, v4.1.2) —
+  Copyright © MathJax Consortium. Licensed under the
+  [Apache License, Version 2.0](#apache-license-20-full-text).
+  <https://github.com/mathjax/MathJax-src>
+- **STIX Two Math font, as packaged for MathJax v4**
+  (`@mathjax/mathjax-stix2-font`, v4.1.2) — Copyright © MathJax Consortium.
+  The npm package declares `"license": "Apache-2.0"` in its `package.json`
+  (verified by reading `node_modules/@mathjax/mathjax-stix2-font/package.json`
+  directly; the package does not bundle its own `LICENSE` file, so this is
+  the authoritative declaration). Licensed under the
+  [Apache License, Version 2.0](#apache-license-20-full-text).
+  <https://github.com/mathjax/MathJax-fonts>
+
+  Note: the STIX Two Math font is also separately distributed upstream
+  (<https://github.com/stipub/stixfonts>) under the SIL Open Font License
+  1.1. The build in this repository consumes the Apache-2.0-licensed
+  `@mathjax/mathjax-stix2-font` npm package specifically, not the upstream
+  OFL font files directly, so Apache-2.0 is the governing license for the
+  bytes actually shipped here.
+
+  Neither package includes a Apache-2.0 §4(d) `NOTICE` file (checked in
+  the installed `node_modules` tree), so there is no additional NOTICE
+  content to reproduce beyond the attribution above.
+
+### Build-time only (not shipped)
+
+The library also declares `esbuild` (MIT) as a build-time dependency
+(bundles `mathjax-stix2.js` above) and TypeScript (Apache-2.0) as a
+dev/type-check dependency. Neither's code is included in the published
+package — noted here for completeness only.
+
+## Rust / WebAssembly
+
+The three parser crates (`docx-parser`, `pptx-parser`, `xlsx-parser`) and
+their shared `ooxml-common` crate compile to the `*_parser_bg.wasm` binaries
+shipped in `dist/`. Their `wasm32-unknown-unknown` dependency graph is
+identical across all three crates (verified with `cargo license
+--filter-platform wasm32-unknown-unknown`) and consists entirely of
+permissively-licensed crates — no copyleft (GPL/LGPL/AGPL) dependencies:
+
+| License | Crates |
+|---|---|
+| MIT OR Apache-2.0 | bumpalo, cfg-if, console_error_panic_hook, crc32fast, displaydoc, equivalent, flate2, hashbrown, indexmap, itoa, log, once_cell, proc-macro2, quote, roxmltree, rustversion, serde, serde_core, serde_derive, serde_json, syn, thiserror, thiserror-impl, wasm-bindgen, wasm-bindgen-macro, wasm-bindgen-macro-support, wasm-bindgen-shared |
+| (Apache-2.0 OR MIT) AND Unicode-3.0 | unicode-ident |
+| 0BSD OR Apache-2.0 OR MIT | adler2 |
+| Apache-2.0 | zopfli |
+| Apache-2.0 OR MIT OR Zlib | miniz_oxide |
+| MIT | simd-adler32, zip, zmij |
+| MIT OR Unlicense | memchr |
+
+Full license texts for each crate are available from
+[crates.io](https://crates.io/) or the crate's own repository; SPDX
+identifiers above match each crate's `Cargo.toml` `license` field. This
+list was generated with:
+
+```bash
+cargo install cargo-license
+cargo license --manifest-path packages/pptx/parser/Cargo.toml \
+  --avoid-dev-deps --filter-platform wasm32-unknown-unknown
+# docx-parser / xlsx-parser produce an identical dependency set
+```
+
+### MCP server (`ooxml-mcp-server`, separate distribution)
+
+`packages/mcp-server` is not part of the `@silurus/ooxml` npm package — it
+is a standalone binary distributed independently (see the repository's MCP
+server documentation). Its dependency graph is a superset of the table
+above (adds `tokio`, `rmcp`, `anyhow`, `schemars`, `tracing`, and their
+transitive deps for the async runtime and MCP protocol implementation) and
+remains entirely MIT / Apache-2.0, with no copyleft licenses:
+
+```bash
+cargo license --manifest-path packages/mcp-server/Cargo.toml --avoid-dev-deps
+```
+
+## License texts
+
+- **MIT** — see [LICENSE](./LICENSE) (this repository's own license; the
+  MIT-licensed dependencies above use the same standard text with their own
+  copyright holder).
+- **Apache License, Version 2.0** — full text at
+  <https://www.apache.org/licenses/LICENSE-2.0>, reproduced below for
+  convenience.
+
+### Apache License 2.0 (full text)
+
+```
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+```