Release Colour Tools 0.2.0

docs/ARCHITECTURE.md

@@ -9,8 +9,9 @@ last valid result while an input is incomplete.
 
 1. `src/colour/` is the serialisable colour domain. It parses and formats
    colours, converts gamuts, composites layers, interpolates stops, evaluates
-   contrast and Delta E, simulates colour-vision deficiencies, and builds or
-   exports palettes. Its public API is re-exported from `src/colour/index.ts`.
+   contrast and Delta E, simulates colour-vision deficiencies, builds CSS
+   gradients, imports DTCG tokens, and builds or exports palettes. Its public
+   API is re-exported from `src/colour/index.ts`.
 2. `src/palette/` contains browser-independent raster bounds, sampling and
    deterministic OKLab clustering. `src/workers/palette.worker.ts` exposes the
    expensive extraction path to a dedicated worker.
@@ -35,6 +36,20 @@ Browser preview is a separate operation. It maps a value to sRGB and reports
 whether mapping occurred. This keeps display limitations from mutating the
 source colour used by later conversions or comparisons.
 
+`dtcg.ts` walks at most 32 group levels/10,000 tokens, validates DTCG 2025.10
+structured colour components, resolves local curly aliases and local JSON
+Pointer `$ref` token/property references with cycle detection, and resolves token type from
+the token, its nearest group or its reference. It does not infer a missing
+type. Numeric `none` semantics cannot be represented by `ColourValue`, so such
+tokens produce an explicit diagnostic. Imported wide-gamut coordinates are
+stored as CSS rather than being destructively mapped to the preview gamut.
+
+`accessibility.ts` parses a maximum of 64 palette colours once before its
+bounded 64×64 directional contrast loop. Each foreground/background cell
+reports WCAG ratio thresholds after flattening transparency against a stated
+canvas. `gradient.ts` validates 2–64 ascending stops and exports inert CSS plus
+a schema-versioned recipe for linear, radial, conic and repeating syntax.
+
 ## Raster pipeline
 
 The image picker validates the selected file before decode, rejects excessive

docs/PRIVACY-SECURITY.md

@@ -14,6 +14,12 @@ icons and worker files on initial load and revalidation. Host logs, reverse
 proxy logs and browser extension behaviour are outside the application's local
 processing boundary.
 
+DTCG documents and gradient recipes are parsed/generated in memory only. DTCG
+references are restricted to the same pasted JSON document; no URI or remote
+token resolver is used. Token/group depth, count and source size are bounded,
+and cycles stop with diagnostics. Imported names/values and gradient CSS are
+rendered as text or style values, never injected as HTML.
+
 ## Recommended headers
 
 Serve the static artifact over HTTPS and apply a policy equivalent to: