feat: release Colour Tools 0.1.0

2026-08-31 21:21:35 +02:00
commit 0c1fc94b58
100 changed files with 17406 additions and 0 deletions
@@ -0,0 +1,60 @@
+# Privacy, security and deployment
+
+## Data flow
+
+Colour input, saved palette entries, selected image bytes, decoded pixels and
+generated exports stay in the browser. The application does not issue API
+requests, load remote fonts, submit analytics or resolve remote colour
+references. A saved palette belongs to the current browser origin and is
+stored until the user clears it or browser storage is removed. Images are
+in-memory only.
+
+The static host still receives ordinary requests for HTML, JavaScript, CSS,
+icons and worker files on initial load and revalidation. Host logs, reverse
+proxy logs and browser extension behaviour are outside the application's local
+processing boundary.
+
+## Recommended headers
+
+Serve the static artifact over HTTPS and apply a policy equivalent to:
+
+```text
+Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Resource-Policy: same-origin
+Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=(), payment=()
+Referrer-Policy: no-referrer
+X-Content-Type-Options: nosniff
+```
+
+The shared Toolbox shell uses inline style properties for colour previews, so
+`style-src 'unsafe-inline'` is currently required. Do not add
+`script-src 'unsafe-inline'` or third-party script origins. `blob:` is required
+for local image object URLs and may be used for a worker fallback.
+
+Serve `.js` as `text/javascript`, `.json` as `application/json`, `.webmanifest`
+as `application/manifest+json`, and `.svg` as `image/svg+xml`. Hashed assets may
+use a long immutable cache lifetime; keep `index.html`, `sw.js` and
+`toolbox-app.json` on revalidation/no-cache so releases update predictably.
+
+## Reverse-proxy example
+
+For an nginx deployment rooted at `/apps/colour/`, use `try_files` only to
+resolve actual static files and the directory index; do not rewrite missing
+asset paths to HTML. The application itself uses relative paths and needs no
+server-side router. Keep the `sw.js` scope at the application directory.
+
+If the app is assembled into toolbox-portal, use the portal's release lock and
+assembly process instead of unpacking files into an existing live directory.
+Verify the ZIP against its SHA-256 sidecar before assembly.
+
+## File limits and cleanup
+
+The image picker enforces encoded-byte, dimension and decoded-pixel limits
+before expensive processing. Sampling radius and palette colour counts are
+bounded. Object URLs, decoded buffers and worker requests are released or
+cancelled when replaced. Browsers and image decoders remain security-sensitive
+dependencies, so deploy current supported browser versions and publish patched
+application releases promptly.
+
+See [SECURITY.md](../SECURITY.md) for private reporting instructions.