Release API Tools 0.2.0

public/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.0 - 2026-09-02
+
+- Added OpenAPI 3.1/3.2 webhook receiver inventory, inert placeholder examples,
+  and operation-level revision comparison without treating webhooks as captured
+  client requests.
+
 ## 0.1.0 - 2026-09-01
 
 - Initial local-only OpenAPI 3.0/3.1 inspection release.

public/LICENSES/npm-runtime-licenses.txt

@@ -1,5 +1,5 @@
 ==============================================================================
-@add-ideas/toolbox-contract@0.2.3
+@add-ideas/toolbox-contract@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---
@@ -198,7 +198,7 @@ Declared licence: Apache-2.0
 
 
 ==============================================================================
-@add-ideas/toolbox-helpers@0.1.0
+@add-ideas/toolbox-helpers@0.2.0
 Declared licence: GPL-3.0-or-later
 ==============================================================================
 --- LICENSE ---
@@ -879,7 +879,7 @@ Public License instead of this License.  But first, please read
 
 
 ==============================================================================
-@add-ideas/toolbox-shell-react@0.2.3
+@add-ideas/toolbox-shell-react@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---

public/README.md

@@ -1,15 +1,17 @@
 # API Tools
 
-API Tools is a local-first OpenAPI workbench. Version 0.1.0 parses bounded JSON
-or YAML OpenAPI 3.0/3.1 descriptions, navigates operations, resolves `$ref`
-values from explicitly supplied local files, inventories security schemes,
-generates schema/request/response examples and inert client command text,
-compares revisions, and summarizes saved HTTP exchanges or HAR 1.2 files.
+API Tools is a local-first HTTP and event API workbench. It parses bounded JSON
+or YAML OpenAPI 3.0–3.2 and AsyncAPI 2.0–3.1 descriptions, navigates path and
+webhook receiver operations, channels, and messages, resolves `$ref` values
+from explicitly supplied local files, inventories security schemes, generates
+focused schema examples, compares revisions, and checks saved HAR 1.2 traffic
+against a loaded OpenAPI contract while keeping request and broker execution
+disabled.
 
-It never executes HTTP, follows a URL, resolves a remote reference, stores a
-credential or loads an external asset. Generated curl, Fetch and Python snippets
-are text for review and may reproduce untrusted description values safely
-quoted for their target syntax.
+It never executes HTTP, connects or subscribes to a broker, follows a URL,
+resolves a remote reference, stores a credential, or loads an external asset.
+Generated curl, Fetch and Python snippets are text for review and may reproduce
+untrusted description values safely quoted for their target syntax.
 
 ## Development and release
 
@@ -22,20 +24,26 @@ npm run test:browser
 npm run release:artifact
 ```
 
-The release command writes deterministic `release/api-tools-0.1.0.zip` and a
+The release command writes deterministic `release/api-tools-0.2.0.zip` and a
 SHA-256 sidecar. Relative assets are tested at `/deep/nested/api/`.
 
 ## v0.1 boundary
 
 - JSON/YAML files up to 4 MiB each, 20 files/16 MiB per selected workspace,
   depth 64, 100,000 values, 50 YAML aliases, 2,000 operations;
-- focused OpenAPI identity/info/paths checks and remote-reference rejection;
+- focused OpenAPI identity/info/paths checks, including 3.2 `query` and
+  `additionalOperations` and 3.1/3.2 webhook receiver inventory/comparison,
+  plus AsyncAPI 2.x/3.x channel/operation/message inventories and
+  remote-reference rejection;
 - fragment/relative-file JSON Pointer resolution with missing/cycle reports;
 - bounded sample generation for common schema composition and scalar formats;
 - path/query/request/response examples and inert curl/Fetch/Python output;
 - security scheme inventory, conservative operation compatibility report;
-- HAR or raw saved-exchange summary without rendering bodies or secrets.
+- HAR coverage and focused method/path/parameter/status/media-type/JSON-body
+  contract checks without rendering bodies or secrets; raw exchanges retain a
+  summary-only mode.
 
-This is not a complete OpenAPI/JSON Schema validator, code generator, API
-client, proxy or security scanner. See the documented limitations and review
-generated values before use. Licensed under GPL-3.0-or-later.
+This is not a complete OpenAPI, AsyncAPI, or JSON Schema validator, code
+generator, API client, broker client, proxy, or security scanner. See the
+documented limitations and review generated values before use. Licensed under
+GPL-3.0-or-later.

public/SOURCE.md

@@ -1,8 +1,8 @@
 # Corresponding source
 
-The corresponding source for API Tools 0.1.0 is available at:
+The corresponding source for API Tools 0.2.0 is available at:
 
-https://git.add-ideas.de/lotobo/api-tools/src/tag/v0.1.0
+https://git.add-ideas.de/lotobo/api-tools/src/tag/v0.2.0
 
 Build with Node.js 22+, npm 11+, and `package-lock.json` by running
 `npm ci && npm run release:artifact`.

public/docs/ARCHITECTURE.md

@@ -2,11 +2,29 @@
 
 The shell lazy-loads a React workbench. Pure core modules parse and validate
 JSON-like values, hold a named in-memory document map, resolve only relative
-local references, collect operations, derive bounded examples, compare
-operation contracts and summarize saved exchanges. No module exposes a request
-executor.
+local references, collect OpenAPI HTTP operations or AsyncAPI channels,
+send/receive operations and messages, derive bounded examples, compare
+operation contracts and summarize saved exchanges. OpenAPI 3.2 fixed `query`
+and bounded custom `additionalOperations` method tokens are retained. OpenAPI
+3.1/3.2 webhook Path Items are inventoried and compared as receiver operations;
+their names do not declare real delivery URLs, so examples use an explicit
+placeholder and HAR matching excludes them. AsyncAPI 3.x root
+operation/channel/message references and the older 2.x
+publish/subscribe channel shape have separate, explicit adapters. HAR validation matches
+captured URLs to the most specific path template, checks required parameters,
+status and media declarations, and applies a bounded JSON Schema subset to
+available JSON bodies. It emits only locations and messages: captured header
+and body values never enter the report. No module exposes a request executor.
 
 JSON uses hardened shared helpers. YAML is converted with bounded alias count
 and then recursively checked for depth, node count, dangerous keys and plain
 JSON values. Rendering uses React text nodes and read-only textareas. The
 same-origin service worker caches only packaged application resources.
+
+Contract checking is limited to 2,000 exchanges, 100,000 schema evaluation
+steps, 5,000 diagnostics, 2 MiB per decoded JSON body, local references, and a
+focused type/composition/object/array/scalar subset. It is evidence and coverage
+analysis rather than a claim of complete OpenAPI conformance. AsyncAPI bindings,
+traits, correlation expressions and multi-format schemas are inventoried as
+inert data; only JSON-Schema-like payload/header objects receive heuristic
+sample generation.

public/docs/PRIVACY-SECURITY.md

@@ -1,12 +1,17 @@
 # Privacy and security
 
 Descriptions and exchanges remain in memory and are never transmitted or
-persisted. All remote/absolute `$ref` forms fail closed. Displayed URLs are text,
-not links. There is no Try It button, OAuth flow, DNS lookup, HTTP execution,
-telemetry or external asset.
+persisted. All remote/absolute `$ref` forms fail closed. Displayed URLs, broker
+hosts, channel addresses, protocol bindings, and generated commands are text,
+not live controls. There is no Try It button, broker connection, subscription,
+publish action, OAuth flow, DNS lookup, HTTP execution, telemetry, or external
+asset.
 
 HAR and saved exchanges commonly contain tokens, cookies, personal data and
-payloads. The summary does not render header values, yet the source editor still
-contains them. Clear it before sharing. Generated examples are heuristic and
-must not be treated as valid production data. Validation and compatibility
-checks cover a useful subset, not every OpenAPI or JSON Schema rule.
+payloads. Header and cookie values may be used transiently to check parameter
+presence and shape, and JSON bodies may be parsed for local schema checks, but
+the summary and contract report never retain or render those values. The source
+editor still contains the original capture; clear it before sharing. Generated
+examples are heuristic and must not be treated as valid production data.
+Validation and compatibility checks cover a useful bounded subset, not every
+OpenAPI or JSON Schema rule.

public/sw.js

@@ -1,5 +1,5 @@
 const CACHE_PREFIX = "api-tools-shell-";
-const CACHE_NAME = CACHE_PREFIX + "0.1.0";
+const CACHE_NAME = CACHE_PREFIX + "0.2.0";
 const CORE = [
   "./",
   "./manifest.webmanifest",

public/toolbox-app.json

@@ -3,12 +3,12 @@
   "schemaVersion": 1,
   "id": "de.add-ideas.api-tools",
   "name": "API Tools",
-  "version": "0.1.0",
-  "description": "Inspect and compare API descriptions locally.",
+  "version": "0.2.0",
+  "description": "Inspect and compare HTTP and event API descriptions locally.",
   "entry": "./",
   "icon": "./favicon.svg",
   "categories": ["developer", "data", "network"],
-  "tags": ["openapi", "swagger", "har", "schema", "http"],
+  "tags": ["openapi", "asyncapi", "har", "schema", "http", "events"],
   "integration": {
     "contextVersion": 1,
     "launchModes": ["navigate", "new-tab"],
@@ -21,6 +21,15 @@
     "crossOriginIsolated": false,
     "topLevelContext": false
   },
+  "io": {
+    "accepts": [
+      { "mediaType": "application/json", "extensions": [".json", ".har"] },
+      { "mediaType": "application/yaml", "extensions": [".yaml", ".yml"] },
+      { "mediaType": "text/plain", "extensions": [".txt", ".http"] }
+    ],
+    "produces": [{ "mediaType": "application/json", "extensions": [".json"] }]
+  },
+  "capabilities": { "required": [], "optional": ["workers"] },
   "privacy": {
     "processing": "local",
     "fileUploads": true,