Release Archive Tools 0.1.0

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,7 @@
+# Accessibility
+
+The workbench uses semantic landmarks, heading order, labelled native file/search/select controls and real tables with row/column headers. Workspace tabs expose their selected state. Every inventory checkbox includes the corresponding path in its accessible name; blocked controls are disabled rather than visually implied.
+
+Status and parser errors use live `status` and `alert` roles. Safety and comparison states include text and do not rely on colour. Preview images receive entry-derived alternative text; textual and hexadecimal previews remain selectable and scrollable.
+
+All actions are keyboard operable, focus is visible, dense tables scroll rather than clipping, and the layout collapses to one column at narrow widths. Theme selection comes from the shared Toolbox shell. Reduced-motion preferences disable non-essential motion.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,28 @@
+# Architecture
+
+Archive Tools is a relocatable static React application. It has no backend, persistence, telemetry or runtime network dependency.
+
+## Layers
+
+- `src/archive/paths.ts` owns cross-platform path assessment and collision keys. It rejects traversal, absolute/drive/UNC paths, controls, ambiguous segments, Windows devices, alternate streams and excessive depth/length.
+- `src/archive/zip.ts` uses exactly pinned `@zip.js/zip.js` for ZIP/ZIP64 inventory, CRC-checked reads and deterministic writing. Listing uses bounded entry iteration. Content reads request strict local/central-header agreement, CRC-32 validation and overlapping-entry checks.
+- `src/archive/tar.ts` is a checked-offset TAR/USTAR/PAX reader and deterministic writer. Every header checksum is validated. PAX metadata is capped before UTF-8 decoding.
+- `src/archive/gzip.ts` streams compressed input through fflate in small chunks, stops at the expanded-byte ceiling and independently checks the single-member CRC-32 and ISIZE footer. Concatenated members are unsupported.
+- `src/archive/service.ts` detects formats, applies aggregate policies and exposes inspection, reading, safe repackaging, creation and reports.
+- `src/archive/preview.ts` recognizes only bounded plain text, bytes and static raster images. Nested archives are never recursively expanded.
+- `src/archive/compare.ts` compares normalized inventories without interpreting content.
+- `src/components/workspaces` contains React views. Imported text is rendered through React text nodes; there is no `dangerouslySetInnerHTML`.
+
+## Data flow
+
+Inspection checks the source size and format before parsing. ZIP inventory reads only archive metadata. TAR and gzip inputs are held in memory only after the source ceiling is satisfied and gzip expansion is stopped at its output ceiling. TAR/gzip payloads remain in the current React document solely to support later previews and selection; replacing the document releases those references.
+
+Preview and extraction never write source paths to the local filesystem. A selected entry is decoded into a bounded in-memory buffer, verified, and passed to a new deterministic ZIP writer using its already-assessed normalized path.
+
+## Determinism
+
+Creation sorts normalized paths by code-unit order. ZIP uses zip.js's bundled DEFLATE implementation at level 6 with native compression streams and workers disabled, fixed DOS dates, normalized regular-file modes, no extended timestamps and no data descriptors. TAR uses zero timestamps/IDs, regular mode `0644`, USTAR when possible and deterministic PAX path headers otherwise. gzip uses level 6 and mtime zero.
+
+## Memory model
+
+The parser refuses unsafe declared sizes before entry decompression. A bounded writable collects ZIP output and stops when actual output crosses the operation ceiling. gzip is pushed in 32 KiB source chunks and output is counted before retention. Creation and TAR parsing are deliberately capped because they currently use in-memory output/payloads.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,32 @@
+# Privacy and security
+
+## Privacy
+
+Inputs remain in the browser. There is no telemetry, account, analytics, upload endpoint, persistence or runtime CDN. Object URLs exist only long enough to display or download local results and are revoked after use.
+
+## Threat model
+
+Archives are adversarial binary input. Relevant risks include traversal and alternate-stream names, normalization/case collisions, deceptive local versus central ZIP headers, overlapping ZIP entries, CRC corruption, compression bombs, integer overflow, excessive counts, malformed PAX lengths, active HTML/SVG, recursive nested archives and special filesystem entries.
+
+Archive Tools responds as follows:
+
+- source, count, expanded-byte, per-entry, ratio, path and preview budgets are fixed in `src/archive/limits.ts`;
+- byte arithmetic uses checked safe integers and bounds before slicing;
+- extraction never targets the filesystem: eligible content is verified and repackaged into a newly created ZIP;
+- ZIP content reads enable CRC-32, strict local/central agreement and overlapping-entry checks;
+- every TAR header checksum is verified, PAX metadata is bounded and GNU long-name extensions are refused;
+- gzip output is counted during streaming and its CRC-32/ISIZE footer is independently verified;
+- path collision keys are Unicode-normalized and conservative across case-insensitive platforms;
+- symlinks, hardlinks, devices, FIFOs and unknown types are never restored;
+- imported text is rendered as text, and HTML/SVG are not mounted as documents;
+- raster images must pass byte/dimension/pixel/static checks before a browser decoder sees their Blob URL;
+- nested archives are shown as bytes and never recursively opened;
+- encrypted and multipart ZIP data is unsupported, with no password collection.
+
+## Limits
+
+The primary ceilings are 512 MiB source and aggregate expanded data, 256 MiB per entry, 20,000 entries and a 200:1 compression ratio. Preview limits are substantially smaller. Near-limit workloads may still be impractical on low-memory devices; the limits reduce risk but do not make untrusted archives inherently safe.
+
+## Output meaning
+
+“Safe file” means eligible for bounded verification and inclusion in a new ZIP under this policy. It is not a malware verdict. Archive Tools does not scan file semantics and does not make copied files trustworthy to open in another application.