Initial release of Barcode Tools 0.1.0

docs/ACCESSIBILITY.md

@@ -0,0 +1,3 @@
+# Accessibility
+
+The workbench uses semantic landmarks, headings and labelled native controls, supports keyboard operation, visible focus, reduced-width layouts, and system/light/dark themes through the Toolbox shell. Results do not rely on colour alone.

docs/ARCHITECTURE.md

@@ -0,0 +1,7 @@
+# Architecture
+
+Barcode Tools is a static React/Vite application wrapped in the shared Toolbox shell. `barcode/generate.ts` validates options, delegates encoding to the browser build of `bwip-js`, rejects active or linked constructs in the generated SVG string, and previews it through a revocable blob URL. It also parses the bounded two-column batch format and creates deterministic SVG ZIPs with `fflate`.
+
+`barcode/payloads.ts` escapes structured QR fields and validates GTIN check digits. The decode workspace lazy-loads ZXing only after a file or camera action. Image files are passed through a revocable object URL; camera acquisition is explicit and its controls are stopped on request or unmount. Decoded values are rendered as text and never navigated.
+
+Version 0.1 does not create an application worker or persist input. The camera requires a secure context but not a top-level browsing context. Relative entry and asset URLs keep the build relocatable below a nested portal path.

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,7 @@
+# Privacy and security
+
+Payloads, images and camera frames are processed in the browser. There is no telemetry, analytics, account, persistence or server upload. Camera access happens only after pressing **Start camera**, is governed by browser permission, requests video without audio, and can be stopped from the workspace.
+
+Images are limited to 20 MiB, generated payloads to 4,096 characters, and batch input to 256 KiB/100 rows. Structured QR fields are escaped and Wi-Fi security is restricted to WPA, WEP or nopass. Generated SVG is rejected if it contains scripts, foreign objects, event handlers or linked content; previews use local blob URLs.
+
+Decoded payloads are untrusted text and are never opened automatically. A valid check digit does not prove GS1 allocation, and the quiet-zone text is guidance rather than print-quality validation. Interoperability and physical print quality must be checked with the intended scanner and applicable specification.