Release Label Tools 0.1.0

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,12 @@
+# Accessibility
+
+Label Tools uses native labels, inputs, selects, buttons, tables, status
+regions, details and dialogs. All configuration is keyboard reachable, focus
+indicators are visible, and messages are not conveyed by colour alone. The
+layout becomes a single column on smaller screens and follows the toolbox light,
+dark and system themes.
+
+The SVG sheet preview has an accessible page label; source data and warnings
+also remain available as text. Printed labels may need larger type or a
+different layout for their audience. Please report issues with browser and
+assistive-technology details.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,17 @@
+# Architecture
+
+Label Tools separates untrusted input from rendering:
+
+1. `labels/data.ts` uses toolbox helpers for bounded CSV/JSON parsing and the
+   browser cryptographic RNG for optional virtual fields.
+2. `labels/stocks.ts` stores canonical millimetre geometry and validates every
+   preset/custom grid before rendering.
+3. `labels/render.ts` maps scalar fields into three fixed layouts, escapes XML,
+   embeds validated local raster data, and places reviewed bwip-js output.
+4. `labels/export.ts` exports exact SVG pages, deterministic fflate ZIPs, or
+   locally rasterized pdf-lib documents.
+
+The React workbench retains the last valid data model after parse errors and
+limits interactive preview to the first 12 pages. Complete SVG export remains
+available for all bounded rows. The shared toolbox shell owns theme and portal
+navigation; all app URLs are relative for nested deployment.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,16 @@
+# Privacy and security model
+
+Merge records and images stay in browser memory and are only serialized when
+the user explicitly exports. The application performs no telemetry, upload,
+remote font loading or network lookup. Barcode payload URLs are encoded as data
+inside the symbol; they are never requested.
+
+CSV/JSON structure, field lengths, record counts, image bytes/pixels, grid
+dimensions, calibration and output pages are bounded. Object URLs are revoked.
+User strings are normalized for label display and XML-escaped. Only built-in
+templates are supported, and only locally decoded PNG/JPEG/WebP is embedded.
+
+Printing crosses a physical boundary the browser cannot verify: installed font
+metrics, device drivers, page scaling, feed skew and stock tolerances. Use the
+calibration controls and test on plain paper. PDF is a 144 DPI raster export and
+does not embed or preserve font semantics.