Release Diff Tools 0.1.0

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,9 @@
+# Accessibility
+
+The workbench uses labelled native text areas, selects, checkboxes, file inputs and buttons. Comparison modes and result views are exposed as tab lists, status and diagnostic changes use live regions, and structured results use list or table semantics.
+
+Change kinds are written in text and indicated by `+`/`−` markers, not colour alone. Exact CR, LF and tab characters have visible glyphs. Focus indicators remain visible in light, dark and system themes, and controls meet a minimum 2.55 rem target height.
+
+The layout collapses inputs and paired changes to one column on narrow displays. Large side-by-side and summary tables scroll within their region. Reduced-motion preferences suppress the pending animation.
+
+Keyboard users can reach every option, file selector, editor, mode, result view and artifact action in document order. The Toolbox shell owns the global help, app switcher and personalization controls.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,22 @@
+# Architecture
+
+Diff Tools is a static React application with a relocatable `./` build. Its comparison pipeline is deliberately separated from the view:
+
+1. The workbench captures strings or decodes a selected file as strict UTF-8 after a byte-size check.
+2. A fresh module worker receives a plain comparison request. Changing input cancels and terminates the preceding worker; the last successful result remains on screen until a replacement succeeds.
+3. A mode-specific pure comparator produces display rows and diagnostics. Normalized rows are first-class output, not discarded state.
+4. The orchestrator adds exact input metadata, a bounded unified patch and a schema-labelled portable report.
+5. React renders values as text. The app never consumes or inserts HTML produced by a diff or parser library.
+
+When `Worker` is unavailable, such as in unit tests, the same pure comparator runs asynchronously on the calling thread.
+
+## Comparators
+
+- Text tokenizes lines without losing delimiters, or uses `Intl.Segmenter` for words and graphemes with bounded fallbacks. `diff` aligns token arrays.
+- JSON uses `lossless-json`, rejects duplicate and prototype-affecting keys, and compares numbers without converting to IEEE-754. Object member order is semantically ignored but reported.
+- XML rejects active declaration/include syntax and preflights structure before `@xmldom/xmldom` builds an inert DOM. Elements and attributes compare by expanded name when selected.
+- CSV/TSV uses Papa Parse in string mode. Unique composite keys align rows; no spreadsheet type inference is performed.
+
+All report and patch formats are generated locally. `de.add-ideas.diff-tools.report.v1` is the portable report schema identifier.
+
+The planned shared `@add-ideas/toolbox-helpers` package is not yet published at a compatible version, so v0.1 keeps its bounded domain functions inside `src/core`. They can be extracted without changing the worker protocol or report schema.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,26 @@
+# Privacy and security
+
+## Local processing
+
+Diff Tools has no account, telemetry, analytics or application network API. Text and selected files remain in the current browser context. A service worker may cache the published application shell; it does not cache user input or comparison output. Clipboard writes and downloads occur only after an explicit user action.
+
+The production CSP permits same-origin scripts and workers and blocks objects, framing and external connections. The release is designed to run below an arbitrary nested path.
+
+## Untrusted input
+
+- Selected files are checked against the byte limit before strict UTF-8 decoding.
+- All modes enforce character, token/edit, display and output limits. Structured modes add depth, node, row, column, cell and field limits.
+- XML containing DOCTYPE, entity declaration or XInclude syntax is rejected before DOM parsing. A lexical preflight rejects excessive element count or nesting before DOM construction.
+- JSON rejects duplicate keys and the prototype-affecting keys `__proto__`, `prototype` and `constructor`.
+- CSV/TSV fields remain strings; formulas are displayed as text and are not evaluated.
+- Imported strings are rendered through React text nodes and form controls. No library-generated HTML, imported markup or script is inserted into the document.
+
+These controls bound this tool's work; they are not a general-purpose sanitizer and do not make imported data safe for another application.
+
+## Availability and cancellation
+
+Each comparison normally uses a new module worker. Superseded workers are terminated and stale messages are ignored. A failed comparison leaves the last successful result visible, with the current diagnostic shown separately.
+
+## Export considerations
+
+Unified patches reflect exact source text, including missing final newline markers. RFC 6902 output is only offered for JSON and preserves decimal lexemes without binary rounding. Portable reports contain bounded source snippets and comparison rows, so users should review them before sharing.