Release API Tools 0.1.0

docs/ACCESSIBILITY.md

@@ -0,0 +1,7 @@
+# Accessibility
+
+The app uses native labels, buttons, headings, lists, tables and status/alert
+regions. Operation selection and all workspaces are keyboard accessible. Focus
+styles and light/dark/system themes come from the shared shell. Tables and code
+panes scroll, responsive layouts collapse to one column, and reduced motion is
+honoured.

docs/ARCHITECTURE.md

@@ -0,0 +1,12 @@
+# Architecture
+
+The shell lazy-loads a React workbench. Pure core modules parse and validate
+JSON-like values, hold a named in-memory document map, resolve only relative
+local references, collect operations, derive bounded examples, compare
+operation contracts and summarize saved exchanges. No module exposes a request
+executor.
+
+JSON uses hardened shared helpers. YAML is converted with bounded alias count
+and then recursively checked for depth, node count, dangerous keys and plain
+JSON values. Rendering uses React text nodes and read-only textareas. The
+same-origin service worker caches only packaged application resources.

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,12 @@
+# Privacy and security
+
+Descriptions and exchanges remain in memory and are never transmitted or
+persisted. All remote/absolute `$ref` forms fail closed. Displayed URLs are text,
+not links. There is no Try It button, OAuth flow, DNS lookup, HTTP execution,
+telemetry or external asset.
+
+HAR and saved exchanges commonly contain tokens, cookies, personal data and
+payloads. The summary does not render header values, yet the source editor still
+contains them. Clear it before sharing. Generated examples are heuristic and
+must not be treated as valid production data. Validation and compatibility
+checks cover a useful subset, not every OpenAPI or JSON Schema rule.