diff --git a/CHANGELOG.md b/CHANGELOG.md index 2cbc568..82263c6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 0.1.1 - 2026-09-01 + +- Removed the external randomness-service client and its network permission; Random Tools is now entirely local-only. +- Replaced the remote workspace with bounded local coin, card, sequence, calendar-date, decimal-fraction and spherical-coordinate draws. +- Added weekday and no-replacement date controls, recipe metadata and expanded cross-browser coverage. +- Hardened identifier and inclusive-integer bounds, added normalized custom-list identity, and limited screen-reader announcements to concise result status. + ## 0.1.0 - 2026-09-01 - Added the initial local-first Random Tools workbench. diff --git a/README.md b/README.md index 0d1ff91..c80678b 100644 --- a/README.md +++ b/README.md @@ -10,9 +10,10 @@ Random Tools is a standalone local-first application in the [add·ideas Toolbox] - Explicitly non-cryptographic, seeded deterministic generation with reproduction metadata - Dice expressions, sampling without replacement, Fisher–Yates shuffling and passphrases - UUIDv4, UUIDv7 and random ULID generation -- Optional RANDOM.ORG integer requests only after per-session consent +- Local draws for coin flips, shuffled card deals and unique integer sequences +- Random calendar dates with weekday and uniqueness controls, exact decimal fractions, and equal-area spherical coordinates -Secure local generation never falls back to the seeded or remote source. Deterministic results are reproducible but not suitable for secrets. The RANDOM.ORG workspace is the sole network-capable feature: it is not the default, requires an explicit consent checkbox, omits credentials/referrer and may still be unavailable because of browser CORS policy. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md). +All functionality runs locally. Secure generation never falls back to the seeded source, and deterministic results are reproducible but not suitable for secrets. Recipes for custom passphrases identify the normalized list by count and SHA-256 but do not embed it, so reproduction requires the same custom input. The browser CSPRNG is not physical entropy, and no operation is presented as certified for regulated drawings or gambling. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md). ## Development @@ -26,7 +27,7 @@ npm run test:browser ## Release -`npm run release:artifact` creates a deterministic `release/rand-tools-0.1.0.zip` and checksum sidecar. +`npm run release:artifact` creates a deterministic `release/rand-tools-0.1.1.zip` and checksum sidecar. ## Licence diff --git a/SOURCE.md b/SOURCE.md index ce653bd..43795c7 100644 --- a/SOURCE.md +++ b/SOURCE.md @@ -1,7 +1,7 @@ # Corresponding source -The corresponding source for Random Tools 0.1.0 is available at: +The corresponding source for Random Tools 0.1.1 is available at: -https://git.add-ideas.de/lotobo/rand-tools/src/tag/v0.1.0 +https://git.add-ideas.de/lotobo/rand-tools/src/tag/v0.1.1 Build with Node.js 22, npm 11, `npm ci`, and `npm run release:artifact`. diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index d3acdb9..36eb28a 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -1,6 +1,6 @@ # Third-party notices -Random Tools 0.1.0 directly depends on these runtime packages: +Random Tools 0.1.1 directly depends on these runtime packages: | Package | Pinned version | Declared licence | | -------------------------------- | -------------: | ---------------- | @@ -10,6 +10,4 @@ Random Tools 0.1.0 directly depends on these runtime packages: | `react` | 19.2.8 | MIT | | `react-dom` | 19.2.8 | MIT | -The optional RANDOM.ORG feature calls a public HTTP API after explicit user consent; it does not embed or redistribute RANDOM.ORG code or data. Use of that service remains subject to its operator's terms and availability. - This table covers direct production dependencies, not transitive packages or development tooling. During a release build, the exact non-development dependency tree and discovered licence texts are generated from the lockfile into `LICENSES/npm-runtime-licenses.txt` and included in the release ZIP. Copyright and licence terms remain with their respective authors. diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 8d21d64..296606b 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -2,6 +2,6 @@ Random Tools is a static React/Vite application wrapped in the shared Toolbox shell. `random/source.ts` exposes one common interface over two deliberately distinct local sources: browser WebCrypto with rejection-sampled integers, and the versioned `toolbox-helpers` xoshiro128** seeded generator. Secure mode never falls back to deterministic mode. -`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. Each successful local result includes source identity, parameters and deterministic state where applicable. Operations are synchronous and bounded, so version 0.1 creates no worker. +`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. `random/draws.ts` adds local binary coin flips, standard playing-card deals, shuffled inclusive integer sequences, Gregorian calendar-date sampling, exact decimal-digit fractions and equal-area points on a spherical surface model. Date sampling can filter weekdays and use a partial Fisher–Yates mapping for selection without replacement; it does not allocate every date in a large range. -`random/remote.ts` is a separate, explicitly selected RANDOM.ORG integer client. Requests are validated, serialised, credentialless, no-referrer, no-store and subject to a 120-second abort timeout; responses are checked against the requested count/range. This is the only runtime network path and the production CSP permits only that origin in addition to self. +Each successful result includes source identity, parameters and deterministic state where applicable. Most operations are synchronous and bounded; custom word-list identity uses the asynchronous browser Web Crypto digest API without a worker. Custom lists are trimmed, emptied lines are dropped and uniqueness is checked once before both selection and metadata are derived. The application contains no third-party network client; its CSP limits connections to its own origin for loading the local application shell. diff --git a/docs/PRIVACY-SECURITY.md b/docs/PRIVACY-SECURITY.md index de9c475..99e2b5b 100644 --- a/docs/PRIVACY-SECURITY.md +++ b/docs/PRIVACY-SECURITY.md @@ -1,7 +1,7 @@ # Privacy and security -Local WebCrypto is the default. It stays in the browser, has no remote fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit. +Local Web Crypto is the default. It stays in the browser, has no network or seeded fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit. -The RANDOM.ORG workspace is an opt-in exception to local processing. Only after checking consent and pressing the request button does the browser send the requested count and range to `https://www.random.org`; RANDOM.ORG and network intermediaries can observe the request and the user's IP address. Credentials and referrer are omitted. Browser CORS policy or service limits may prevent the request. No other operation substitutes this source automatically. +There is no third-party request path, telemetry, analytics, account, geolocation lookup or persistence. Coordinates are generated as mathematical samples and are not derived from the device location. Results and seeds remain in page memory unless copied or downloaded. A custom passphrase recipe contains the normalized list count and a versioned SHA-256 identity, not the list contents; the same normalized input is therefore still required for reproduction. -Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Results and seeds remain in page memory unless copied or downloaded. The app has no telemetry, analytics, account or persistence and is not certified for regulated drawings or gambling. +Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Web Crypto is a browser-provided CSPRNG, not a physical randomness source. The app is not certified for regulated drawings or gambling. diff --git a/package-lock.json b/package-lock.json index 9961426..55fd820 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "rand-tools", - "version": "0.1.0", + "version": "0.1.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "rand-tools", - "version": "0.1.0", + "version": "0.1.1", "license": "GPL-3.0-or-later", "dependencies": { "@add-ideas/toolbox-contract": "0.2.3", diff --git a/package.json b/package.json index f2e26e0..2cd7e06 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "rand-tools", - "version": "0.1.0", + "version": "0.1.1", "description": "Generate secure or reproducible random values locally in the browser.", "license": "GPL-3.0-or-later", "author": "Albrecht Degering", diff --git a/public/CHANGELOG.md b/public/CHANGELOG.md index 2cbc568..82263c6 100644 --- a/public/CHANGELOG.md +++ b/public/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 0.1.1 - 2026-09-01 + +- Removed the external randomness-service client and its network permission; Random Tools is now entirely local-only. +- Replaced the remote workspace with bounded local coin, card, sequence, calendar-date, decimal-fraction and spherical-coordinate draws. +- Added weekday and no-replacement date controls, recipe metadata and expanded cross-browser coverage. +- Hardened identifier and inclusive-integer bounds, added normalized custom-list identity, and limited screen-reader announcements to concise result status. + ## 0.1.0 - 2026-09-01 - Added the initial local-first Random Tools workbench. diff --git a/public/README.md b/public/README.md index 0d1ff91..c80678b 100644 --- a/public/README.md +++ b/public/README.md @@ -10,9 +10,10 @@ Random Tools is a standalone local-first application in the [add·ideas Toolbox] - Explicitly non-cryptographic, seeded deterministic generation with reproduction metadata - Dice expressions, sampling without replacement, Fisher–Yates shuffling and passphrases - UUIDv4, UUIDv7 and random ULID generation -- Optional RANDOM.ORG integer requests only after per-session consent +- Local draws for coin flips, shuffled card deals and unique integer sequences +- Random calendar dates with weekday and uniqueness controls, exact decimal fractions, and equal-area spherical coordinates -Secure local generation never falls back to the seeded or remote source. Deterministic results are reproducible but not suitable for secrets. The RANDOM.ORG workspace is the sole network-capable feature: it is not the default, requires an explicit consent checkbox, omits credentials/referrer and may still be unavailable because of browser CORS policy. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md). +All functionality runs locally. Secure generation never falls back to the seeded source, and deterministic results are reproducible but not suitable for secrets. Recipes for custom passphrases identify the normalized list by count and SHA-256 but do not embed it, so reproduction requires the same custom input. The browser CSPRNG is not physical entropy, and no operation is presented as certified for regulated drawings or gambling. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md). ## Development @@ -26,7 +27,7 @@ npm run test:browser ## Release -`npm run release:artifact` creates a deterministic `release/rand-tools-0.1.0.zip` and checksum sidecar. +`npm run release:artifact` creates a deterministic `release/rand-tools-0.1.1.zip` and checksum sidecar. ## Licence diff --git a/public/SOURCE.md b/public/SOURCE.md index ce653bd..43795c7 100644 --- a/public/SOURCE.md +++ b/public/SOURCE.md @@ -1,7 +1,7 @@ # Corresponding source -The corresponding source for Random Tools 0.1.0 is available at: +The corresponding source for Random Tools 0.1.1 is available at: -https://git.add-ideas.de/lotobo/rand-tools/src/tag/v0.1.0 +https://git.add-ideas.de/lotobo/rand-tools/src/tag/v0.1.1 Build with Node.js 22, npm 11, `npm ci`, and `npm run release:artifact`. diff --git a/public/THIRD_PARTY_NOTICES.md b/public/THIRD_PARTY_NOTICES.md index d3acdb9..36eb28a 100644 --- a/public/THIRD_PARTY_NOTICES.md +++ b/public/THIRD_PARTY_NOTICES.md @@ -1,6 +1,6 @@ # Third-party notices -Random Tools 0.1.0 directly depends on these runtime packages: +Random Tools 0.1.1 directly depends on these runtime packages: | Package | Pinned version | Declared licence | | -------------------------------- | -------------: | ---------------- | @@ -10,6 +10,4 @@ Random Tools 0.1.0 directly depends on these runtime packages: | `react` | 19.2.8 | MIT | | `react-dom` | 19.2.8 | MIT | -The optional RANDOM.ORG feature calls a public HTTP API after explicit user consent; it does not embed or redistribute RANDOM.ORG code or data. Use of that service remains subject to its operator's terms and availability. - This table covers direct production dependencies, not transitive packages or development tooling. During a release build, the exact non-development dependency tree and discovered licence texts are generated from the lockfile into `LICENSES/npm-runtime-licenses.txt` and included in the release ZIP. Copyright and licence terms remain with their respective authors. diff --git a/public/docs/ARCHITECTURE.md b/public/docs/ARCHITECTURE.md index 8d21d64..296606b 100644 --- a/public/docs/ARCHITECTURE.md +++ b/public/docs/ARCHITECTURE.md @@ -2,6 +2,6 @@ Random Tools is a static React/Vite application wrapped in the shared Toolbox shell. `random/source.ts` exposes one common interface over two deliberately distinct local sources: browser WebCrypto with rejection-sampled integers, and the versioned `toolbox-helpers` xoshiro128** seeded generator. Secure mode never falls back to deterministic mode. -`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. Each successful local result includes source identity, parameters and deterministic state where applicable. Operations are synchronous and bounded, so version 0.1 creates no worker. +`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. `random/draws.ts` adds local binary coin flips, standard playing-card deals, shuffled inclusive integer sequences, Gregorian calendar-date sampling, exact decimal-digit fractions and equal-area points on a spherical surface model. Date sampling can filter weekdays and use a partial Fisher–Yates mapping for selection without replacement; it does not allocate every date in a large range. -`random/remote.ts` is a separate, explicitly selected RANDOM.ORG integer client. Requests are validated, serialised, credentialless, no-referrer, no-store and subject to a 120-second abort timeout; responses are checked against the requested count/range. This is the only runtime network path and the production CSP permits only that origin in addition to self. +Each successful result includes source identity, parameters and deterministic state where applicable. Most operations are synchronous and bounded; custom word-list identity uses the asynchronous browser Web Crypto digest API without a worker. Custom lists are trimmed, emptied lines are dropped and uniqueness is checked once before both selection and metadata are derived. The application contains no third-party network client; its CSP limits connections to its own origin for loading the local application shell. diff --git a/public/docs/PRIVACY-SECURITY.md b/public/docs/PRIVACY-SECURITY.md index de9c475..99e2b5b 100644 --- a/public/docs/PRIVACY-SECURITY.md +++ b/public/docs/PRIVACY-SECURITY.md @@ -1,7 +1,7 @@ # Privacy and security -Local WebCrypto is the default. It stays in the browser, has no remote fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit. +Local Web Crypto is the default. It stays in the browser, has no network or seeded fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit. -The RANDOM.ORG workspace is an opt-in exception to local processing. Only after checking consent and pressing the request button does the browser send the requested count and range to `https://www.random.org`; RANDOM.ORG and network intermediaries can observe the request and the user's IP address. Credentials and referrer are omitted. Browser CORS policy or service limits may prevent the request. No other operation substitutes this source automatically. +There is no third-party request path, telemetry, analytics, account, geolocation lookup or persistence. Coordinates are generated as mathematical samples and are not derived from the device location. Results and seeds remain in page memory unless copied or downloaded. A custom passphrase recipe contains the normalized list count and a versioned SHA-256 identity, not the list contents; the same normalized input is therefore still required for reproduction. -Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Results and seeds remain in page memory unless copied or downloaded. The app has no telemetry, analytics, account or persistence and is not certified for regulated drawings or gambling. +Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Web Crypto is a browser-provided CSPRNG, not a physical randomness source. The app is not certified for regulated drawings or gambling. diff --git a/public/sw.js b/public/sw.js index 69c18a3..0be2904 100644 --- a/public/sw.js +++ b/public/sw.js @@ -1,5 +1,5 @@ const CACHE_PREFIX = "rand-tools-shell-"; -const CACHE_NAME = CACHE_PREFIX + "0.1.0"; +const CACHE_NAME = CACHE_PREFIX + "0.1.1"; const CORE = ["./", "./manifest.webmanifest", "./favicon.svg"]; self.addEventListener("install", (event) => { event.waitUntil( diff --git a/public/toolbox-app.json b/public/toolbox-app.json index e613627..6470807 100644 --- a/public/toolbox-app.json +++ b/public/toolbox-app.json @@ -3,12 +3,22 @@ "schemaVersion": 1, "id": "de.add-ideas.rand-tools", "name": "Random Tools", - "version": "0.1.0", + "version": "0.1.1", "description": "Generate secure or reproducible random values locally in the browser.", "entry": "./", "icon": "./favicon.svg", "categories": ["random", "developer", "productivity"], - "tags": ["random", "uuid", "ulid", "dice", "shuffle", "sample"], + "tags": [ + "random", + "uuid", + "ulid", + "dice", + "shuffle", + "sample", + "cards", + "dates", + "coordinates" + ], "integration": { "contextVersion": 1, "launchModes": ["navigate", "new-tab"], @@ -22,10 +32,10 @@ "topLevelContext": false }, "privacy": { - "processing": "mixed", + "processing": "local", "fileUploads": false, "telemetry": false, - "label": "Local generation is the default; RANDOM.ORG is contacted only after explicit opt-in." + "label": "All generation runs locally; the application makes no third-party requests." }, "source": { "repository": "https://git.add-ideas.de/lotobo/rand-tools", diff --git a/scripts/serve-test.mjs b/scripts/serve-test.mjs index b55470a..bf247b5 100644 --- a/scripts/serve-test.mjs +++ b/scripts/serve-test.mjs @@ -24,7 +24,7 @@ const types = new Map([ ]); const headers = { "Content-Security-Policy": - "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self' https://www.random.org; worker-src 'self' blob:; manifest-src 'self'", + "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'", "Cross-Origin-Opener-Policy": "same-origin", "Cross-Origin-Resource-Policy": "same-origin", "Permissions-Policy": diff --git a/src/components/HelpDialog.tsx b/src/components/HelpDialog.tsx index 421c815..b77a8f7 100644 --- a/src/components/HelpDialog.tsx +++ b/src/components/HelpDialog.tsx @@ -35,9 +35,9 @@ export function HelpDialog({ Generate secure or reproducible random values locally in the browser.

- Local WebCrypto and seeded generation stay in this browser. RANDOM.ORG - is contacted only from its separate workspace after explicit consent; - local sources never fall back to it. Inputs and responses are bounded. + Web Crypto and seeded generation stay in this browser. The application + has no third-party network path, and local sources never fall back to + one another. Inputs and outputs are bounded.

); diff --git a/src/components/Workbench.tsx b/src/components/Workbench.tsx index 32e6edf..c4f9b04 100644 --- a/src/components/Workbench.tsx +++ b/src/components/Workbench.tsx @@ -1,19 +1,30 @@ -import { useState } from "react"; -import { bytesToHex, triggerBlobDownload } from "@add-ideas/toolbox-helpers"; +import { useRef, useState } from "react"; +import { + bytesToHex, + digestHex, + triggerBlobDownload, +} from "@add-ideas/toolbox-helpers"; import { DEFAULT_WORDS, + normalizeWordList, normalValues, - passphrase, + passphraseWithWordList, + randomIdentifiers, randomIntegers, randomString, rollDice, sampleValues, - ulid, - uuidV4, - uuidV7, } from "../random/generators"; -import { randomOrgIntegers } from "../random/remote"; +import { + coinFlips, + dealCards, + decimalFractions, + integerSequence, + randomCoordinates, + randomDates, +} from "../random/draws"; import { randomSource, type SourceMode } from "../random/source"; +import { APP_VERSION } from "../version"; type Tab = | "numbers" @@ -22,7 +33,18 @@ type Tab = | "dice" | "lists" | "passphrases" - | "remote"; + | "draws"; +type DrawKind = + "coins" | "cards" | "sequence" | "dates" | "decimals" | "coordinates"; +const WEEKDAYS = [ + "Sunday", + "Monday", + "Tuesday", + "Wednesday", + "Thursday", + "Friday", + "Saturday", +] as const; interface Output { title: string; text: string; @@ -34,12 +56,24 @@ function Result({ output }: { output: Output | undefined }) { if (!output) return

Generate a result to see it here.

; const report = JSON.stringify( - { schemaVersion: 1, generatedBy: "add-ideas Rand Tools 0.1.0", ...output }, + { + schemaVersion: 1, + generatedBy: `add-ideas Rand Tools ${APP_VERSION}`, + ...output, + }, null, 2, ); return ( -
+
+

+ Result ready: {output.title}. +

Last successful result

@@ -65,7 +99,7 @@ function Result({ output }: { output: Output | undefined }) {
- 
{output.text}
+ 
{output.text}
{output.note &&

{output.note}

}
Reproduction metadata @@ -109,7 +143,7 @@ function SourceControls({ )}

{mode === "secure" - ? "Uses crypto.getRandomValues. No fallback to seeded or remote randomness." + ? "Uses crypto.getRandomValues locally. There is no network or non-cryptographic fallback." : "Reproducible pseudorandom output is not cryptographic and must not be used for keys, passwords, or security tokens."}

@@ -145,38 +179,64 @@ export function Workbench() { const [shuffle, setShuffle] = useState(false); const [wordCount, setWordCount] = useState(6); const [customWords, setCustomWords] = useState(""); - const [remoteConsent, setRemoteConsent] = useState(false); - const [remoteBusy, setRemoteBusy] = useState(false); + const [drawKind, setDrawKind] = useState("coins"); + const [deckCount, setDeckCount] = useState(1); + const [dealCount, setDealCount] = useState(5); + const [dateStart, setDateStart] = useState("2026-01-01"); + const [dateEnd, setDateEnd] = useState("2026-12-31"); + const [dateWeekdays, setDateWeekdays] = useState([ + 0, 1, 2, 3, 4, 5, 6, + ]); + const [uniqueDates, setUniqueDates] = useState(false); + const [decimalPlaces, setDecimalPlaces] = useState(8); + const [coordinatePlaces, setCoordinatePlaces] = useState(6); + const activeOperation = useRef(0); + + type LocalResult = { + title: string; + text: string; + parameters: Record; + note?: string; + }; + + const completeLocal = ( + source: ReturnType, + result: LocalResult, + sourceSeed: string, + operation: number, + ) => { + if (operation !== activeOperation.current) return; + setOutput({ + title: result.title, + text: result.text, + note: result.note, + recipe: { + source: source.identity, + sourceClass: + source.mode === "secure" + ? "cryptographic" + : "deterministic-non-cryptographic", + seed: source.mode === "deterministic" ? sourceSeed : undefined, + stateAfter: source.state?.(), + parameters: result.parameters, + }, + }); + setError(""); + }; const local = ( - operation: (source: ReturnType) => { - title: string; - text: string; - parameters: Record; - note?: string; - }, + operation: (source: ReturnType) => LocalResult, ) => { + const operationId = ++activeOperation.current; try { - const source = randomSource(mode, seed); - const result = operation(source); - setOutput({ - title: result.title, - text: result.text, - note: result.note, - recipe: { - source: source.identity, - sourceClass: - mode === "secure" - ? "cryptographic" - : "deterministic-non-cryptographic", - seed: mode === "deterministic" ? seed : undefined, - stateAfter: source.state?.(), - parameters: result.parameters, - }, - }); - setError(""); + const sourceSeed = seed; + const source = randomSource(mode, sourceSeed); + completeLocal(source, operation(source), sourceSeed, operationId); } catch (reason) { - setError(reason instanceof Error ? reason.message : "Generation failed."); + if (operationId === activeOperation.current) + setError( + reason instanceof Error ? reason.message : "Generation failed.", + ); } }; @@ -207,13 +267,7 @@ export function Workbench() { const generateIdentifiers = () => local((source) => { const now = Date.now(); - const values = Array.from({ length: count }, () => - identifier === "uuid4" - ? uuidV4(source) - : identifier === "uuid7" - ? uuidV7(source, now) - : ulid(source, now), - ); + const values = randomIdentifiers(source, count, identifier, now); return { title: identifier === "uuid4" @@ -268,62 +322,149 @@ export function Workbench() { }, }; }); - const generatePassphrase = () => - local((source) => { - if (customWords.length > 4_000_000) - throw new Error( - "Custom word-list input exceeds 4,000,000 UTF-16 units.", - ); - const words = customWords.trim() - ? customWords.replaceAll("\r\n", "\n").split("\n") - : DEFAULT_WORDS; - const result = passphrase(source, wordCount, words); - return { - title: "Passphrase", - text: result.value, - parameters: { - wordCount, - listSize: new Set(words).size, - separator: "-", - entropyModelBits: result.entropy, + const generatePassphrase = async () => { + const operationId = ++activeOperation.current; + try { + const sourceSeed = seed; + const source = randomSource(mode, sourceSeed); + const custom = customWords.trim().length > 0; + const wordList = normalizeWordList(custom ? customWords : DEFAULT_WORDS); + const result = passphraseWithWordList(source, wordCount, wordList); + const wordListSha256 = await digestHex( + new TextEncoder().encode( + `${wordList.normalization}\0${wordList.canonical}`, + ), + "SHA-256", + 16 * 1024 * 1024, + ); + completeLocal( + source, + { + title: "Passphrase", + text: result.value, + parameters: { + wordCount, + wordList: { + identity: custom + ? "custom-normalized-word-list-v1" + : "rand-tools-bundled-word-list-v1", + normalization: wordList.normalization, + normalizedCount: result.listSize, + sha256: wordListSha256, + customInputRequiredForReproduction: custom, + }, + separator: "-", + entropyModelBits: result.entropy, + }, + note: `The ${result.entropy.toFixed(1)}-bit figure is only count × log₂(list size), assuming independent uniform choices. It is not a password-strength audit. ${custom ? "The recipe identifies but does not embed the normalized custom list; the same custom input is required to reproduce this result." : "The bundled list is project-authored; use a larger reviewed list for real passphrases."}`, }, - note: `The ${result.entropy.toFixed(1)}-bit figure is only count × log₂(list size), assuming independent uniform choices. It is not a password-strength audit. The bundled list is project-authored; use a larger reviewed list for real passphrases.`, - }; - }); + sourceSeed, + operationId, + ); + } catch (reason) { + if (operationId === activeOperation.current) + setError( + reason instanceof Error ? reason.message : "Generation failed.", + ); + } + }; const generateBytes = () => local((source) => ({ title: "Random bytes (hex)", text: bytesToHex(source.bytes(length)), parameters: { bytes: length, encoding: "lowercase hexadecimal" }, })); - const requestRemote = async () => { - if (!remoteConsent) { - setError("Confirm the external-service notice first."); - return; - } - setRemoteBusy(true); - setError(""); - try { - const values = await randomOrgIntegers({ count, minimum, maximum }); - setOutput({ - title: "RANDOM.ORG integers", - text: values.join("\n"), - note: "Remote values were returned by RANDOM.ORG over HTTPS. They are not used for Toolbox passwords, keys, or secure local workflows.", - recipe: { - source: "RANDOM.ORG HTTP integer generator", - sourceClass: "remote-unverified", - requestedAt: new Date().toISOString(), - parameters: { count, minimum, maximum }, - }, - }); - } catch (reason) { - setError( - reason instanceof Error ? reason.message : "Remote request failed.", - ); - } finally { - setRemoteBusy(false); - } - }; + const generateDraw = () => + local((source) => { + switch (drawKind) { + case "coins": { + const values = coinFlips(source, count); + const heads = values.filter((value) => value === "Heads").length; + return { + title: `${count} coin flip${count === 1 ? "" : "s"}`, + text: `${values.join("\n")}\n\nHeads: ${heads}\nTails: ${values.length - heads}`, + parameters: { draw: "independent binary coin flips", count }, + }; + } + case "cards": { + const values = dealCards(source, deckCount, dealCount); + return { + title: `Deal of ${dealCount} card${dealCount === 1 ? "" : "s"}`, + text: values.join("\n"), + parameters: { + draw: "Fisher–Yates shuffled standard deck", + deckCount, + dealtCards: dealCount, + withoutReplacement: true, + }, + }; + } + case "sequence": { + const values = integerSequence(source, minimum, maximum); + return { + title: "Shuffled integer sequence", + text: values.join("\n"), + parameters: { + draw: "Fisher–Yates shuffled inclusive integer range", + minimum, + maximumInclusive: maximum, + count: values.length, + }, + }; + } + case "dates": { + const values = randomDates(source, count, dateStart, dateEnd, { + weekdays: dateWeekdays, + withoutReplacement: uniqueDates, + }); + return { + title: "Random calendar dates", + text: values.join("\n"), + parameters: { + draw: `uniform Gregorian calendar day ${uniqueDates ? "without" : "with"} replacement`, + count, + startInclusive: dateStart, + endInclusive: dateEnd, + weekdays: dateWeekdays.map((day) => WEEKDAYS[day]), + withoutReplacement: uniqueDates, + timezone: "none (calendar dates)", + }, + }; + } + case "decimals": { + const values = decimalFractions(source, count, decimalPlaces); + return { + title: "Decimal fractions", + text: values.join("\n"), + parameters: { + draw: "independent uniform decimal digits", + interval: "[0, 1)", + count, + decimalPlaces, + }, + }; + } + case "coordinates": { + const values = randomCoordinates(source, count, coordinatePlaces); + return { + title: "Random coordinates", + text: values + .map( + ({ latitude, longitude }) => + `${latitude.toFixed(coordinatePlaces)}, ${longitude.toFixed(coordinatePlaces)}`, + ) + .join("\n"), + parameters: { + draw: "uniform point on a spherical surface model", + count, + decimalPlaces: coordinatePlaces, + latitudeMethod: "asin(2u - 1)", + }, + note: "Coordinates are mathematical samples on a spherical model, not surveyed locations; no geolocation API or map service is used.", + }; + } + } + }); const tabs = [ ["numbers", "Numbers"], @@ -332,20 +473,21 @@ export function Workbench() { ["dice", "Dice"], ["lists", "Lists"], ["passphrases", "Passphrases"], - ["remote", "RANDOM.ORG"], + ["draws", "Draws"], ] as const; return (
-

Secure local default

+

Entirely local

Rand Tools

- Generate numbers, strings, identifiers, dice, samples, shuffles, and - passphrases with explicit randomness sources. + Generate numbers, strings, identifiers, dice, samples, shuffles, + passphrases, and practical draws with explicit local randomness + sources.

- WebCrypto by default + No network requests
void generatePassphrase()} > Generate passphrase )} - {tab === "remote" && ( + {tab === "draws" && ( <> -

- This optional action contacts www.random.org, - revealing your IP address and request parameters to that - service. Browser JavaScript cannot set the contact-email - User-Agent requested by its automated-client guidance, so this - integration cannot claim complete guideline adherence. -

-
diff --git a/src/random/draws.ts b/src/random/draws.ts new file mode 100644 index 0000000..75212d2 --- /dev/null +++ b/src/random/draws.ts @@ -0,0 +1,252 @@ +import type { RandomSource } from "./source"; + +const MAX_RESULTS = 100_000; +const DAY_MILLISECONDS = 86_400_000; +const RANKS = [ + "A", + "2", + "3", + "4", + "5", + "6", + "7", + "8", + "9", + "10", + "J", + "Q", + "K", +] as const; +const SUITS = ["spades", "hearts", "diamonds", "clubs"] as const; +const SUIT_SYMBOLS: Record<(typeof SUITS)[number], string> = { + spades: "♠", + hearts: "♥", + diamonds: "♦", + clubs: "♣", +}; + +function validateCount(count: number, label = "Count"): void { + if (!Number.isSafeInteger(count) || count < 1 || count > MAX_RESULTS) + throw new Error( + `${label} must be 1–${MAX_RESULTS.toLocaleString("en-US")}.`, + ); +} + +export function coinFlips( + source: RandomSource, + count: number, +): Array<"Heads" | "Tails"> { + validateCount(count, "Flip count"); + return Array.from({ length: count }, () => + source.integer(0, 2) === 0 ? "Heads" : "Tails", + ); +} + +export function dealCards( + source: RandomSource, + deckCount: number, + cardCount: number, +): string[] { + if (!Number.isSafeInteger(deckCount) || deckCount < 1 || deckCount > 8) + throw new Error("Deck count must be 1–8."); + if ( + !Number.isSafeInteger(cardCount) || + cardCount < 1 || + cardCount > deckCount * 52 + ) + throw new Error(`Cards to deal must be 1–${deckCount * 52}.`); + + const deck = Array.from({ length: deckCount }, (_, deckIndex) => + SUITS.flatMap((suit) => + RANKS.map( + (rank) => + `${rank}${SUIT_SYMBOLS[suit]}${deckCount > 1 ? ` (deck ${deckIndex + 1})` : ""}`, + ), + ), + ).flat(); + return source.shuffle(deck).slice(0, cardCount); +} + +export function integerSequence( + source: RandomSource, + minimum: number, + maximumInclusive: number, +): number[] { + if ( + !Number.isSafeInteger(minimum) || + !Number.isSafeInteger(maximumInclusive) || + maximumInclusive < minimum + ) + throw new Error("Sequence bounds must be ordered safe integers."); + const length = maximumInclusive - minimum + 1; + if (!Number.isSafeInteger(length) || length < 1 || length > MAX_RESULTS) + throw new Error("A sequence may contain 1–100,000 integers."); + return source.shuffle(Array.from({ length }, (_, index) => minimum + index)); +} + +function dateToDay(value: string): number { + const match = /^(\d{4})-(\d{2})-(\d{2})$/u.exec(value); + if (!match) throw new Error("Dates must use the YYYY-MM-DD format."); + const year = Number(match[1]); + const month = Number(match[2]); + const day = Number(match[3]); + if (year < 1 || month < 1 || month > 12 || day < 1 || day > 31) + throw new Error("Date is outside the supported calendar range."); + const date = new Date(0); + date.setUTCHours(0, 0, 0, 0); + date.setUTCFullYear(year, month - 1, day); + if ( + date.getUTCFullYear() !== year || + date.getUTCMonth() !== month - 1 || + date.getUTCDate() !== day + ) + throw new Error("Date is not a valid Gregorian calendar date."); + return Math.floor(date.getTime() / DAY_MILLISECONDS); +} + +function dayToDate(dayIndex: number): string { + const date = new Date(dayIndex * DAY_MILLISECONDS); + return [ + String(date.getUTCFullYear()).padStart(4, "0"), + String(date.getUTCMonth() + 1).padStart(2, "0"), + String(date.getUTCDate()).padStart(2, "0"), + ].join("-"); +} + +function weekdayForDay(dayIndex: number): number { + // 1970-01-01 (day zero) was Thursday (4 in the Sunday-first convention). + return (((dayIndex + 4) % 7) + 7) % 7; +} + +function allowedDayCount( + first: number, + last: number, + weekdays: ReadonlySet, +): number { + const days = last - first + 1; + const fullWeeks = Math.floor(days / 7); + let count = fullWeeks * weekdays.size; + for (let offset = fullWeeks * 7; offset < days; offset += 1) + if (weekdays.has(weekdayForDay(first + offset))) count += 1; + return count; +} + +function dayAtAllowedIndex( + first: number, + index: number, + weekdays: ReadonlySet, +): number { + const fullWeeks = Math.floor(index / weekdays.size); + let remainder = index % weekdays.size; + const weekStart = first + fullWeeks * 7; + for (let offset = 0; offset < 7; offset += 1) { + if (!weekdays.has(weekdayForDay(weekStart + offset))) continue; + if (remainder === 0) return weekStart + offset; + remainder -= 1; + } + throw new Error("Could not map the selected calendar day."); +} + +function sampleIndices( + source: RandomSource, + population: number, + count: number, +): number[] { + const swaps = new Map(); + const values: number[] = []; + for (let index = 0; index < count; index += 1) { + const selected = source.integer(index, population); + values.push(swaps.get(selected) ?? selected); + swaps.set(selected, swaps.get(index) ?? index); + } + return values; +} + +export interface RandomDateOptions { + weekdays?: readonly number[]; + withoutReplacement?: boolean; +} + +export function randomDates( + source: RandomSource, + count: number, + start: string, + end: string, + options: RandomDateOptions = {}, +): string[] { + validateCount(count, "Date count"); + const first = dateToDay(start); + const last = dateToDay(end); + if (last < first) throw new Error("End date must not precede start date."); + const weekdays = new Set(options.weekdays ?? [0, 1, 2, 3, 4, 5, 6]); + if ( + weekdays.size < 1 || + [...weekdays].some( + (weekday) => !Number.isSafeInteger(weekday) || weekday < 0 || weekday > 6, + ) + ) + throw new Error("Select at least one valid weekday."); + const available = allowedDayCount(first, last, weekdays); + if (available < 1) + throw new Error("The range contains no dates on the selected weekdays."); + if (options.withoutReplacement && count > available) + throw new Error( + `Unique date count cannot exceed the ${available.toLocaleString("en-US")} matching dates.`, + ); + const indices = options.withoutReplacement + ? sampleIndices(source, available, count) + : Array.from({ length: count }, () => source.integer(0, available)); + return indices.map((index) => + dayToDate(dayAtAllowedIndex(first, index, weekdays)), + ); +} + +export function decimalFractions( + source: RandomSource, + count: number, + decimalPlaces: number, +): string[] { + validateCount(count, "Fraction count"); + if ( + !Number.isSafeInteger(decimalPlaces) || + decimalPlaces < 1 || + decimalPlaces > 64 + ) + throw new Error("Decimal places must be 1–64."); + if (count * decimalPlaces > 4_000_000) + throw new Error("Requested decimal output exceeds 4,000,000 digits."); + return Array.from({ length: count }, () => { + const digits = Array.from({ length: decimalPlaces }, () => + String(source.integer(0, 10)), + ).join(""); + return `0.${digits}`; + }); +} + +export interface Coordinate { + latitude: number; + longitude: number; +} + +export function randomCoordinates( + source: RandomSource, + count: number, + decimalPlaces: number, +): Coordinate[] { + validateCount(count, "Coordinate count"); + if ( + !Number.isSafeInteger(decimalPlaces) || + decimalPlaces < 0 || + decimalPlaces > 10 + ) + throw new Error("Coordinate decimal places must be 0–10."); + const round = (value: number) => { + const rounded = Number(value.toFixed(decimalPlaces)); + return Object.is(rounded, -0) ? 0 : rounded; + }; + return Array.from({ length: count }, () => ({ + // asin(2u - 1) makes equal-area latitude bands on a spherical model. + latitude: round((Math.asin(2 * source.float() - 1) * 180) / Math.PI), + longitude: round(source.float() * 360 - 180), + })); +} diff --git a/src/random/generators.ts b/src/random/generators.ts index cf02a14..b553a48 100644 --- a/src/random/generators.ts +++ b/src/random/generators.ts @@ -133,11 +133,16 @@ export function randomIntegers( if ( !Number.isSafeInteger(minimum) || !Number.isSafeInteger(maximumInclusive) || - maximumInclusive < minimum || - maximumInclusive - minimum >= 2 ** 32 + maximumInclusive < minimum ) + throw new Error("Integer bounds must be safe, ordered integers."); + if (maximumInclusive === Number.MAX_SAFE_INTEGER) throw new Error( - "Integer bounds must be safe, ordered, and span fewer than 2³² values.", + "Maximum inclusive must be less than Number.MAX_SAFE_INTEGER so its exclusive bound is exactly representable.", + ); + if (maximumInclusive - minimum >= 2 ** 32) + throw new Error( + "The inclusive integer range must contain at most 2³² values.", ); return Array.from({ length: count }, () => source.integer(minimum, maximumInclusive + 1), @@ -211,6 +216,25 @@ export function ulid(source: RandomSource, now = Date.now()): string { return left + right; } +export type IdentifierKind = "uuid4" | "uuid7" | "ulid"; + +export function randomIdentifiers( + source: RandomSource, + count: number, + kind: IdentifierKind, + now = Date.now(), +): string[] { + if (!Number.isSafeInteger(count) || count < 1 || count > 100_000) + throw new Error("Identifier count must be a safe integer from 1–100,000."); + return Array.from({ length: count }, () => + kind === "uuid4" + ? uuidV4(source) + : kind === "uuid7" + ? uuidV7(source, now) + : ulid(source, now), + ); +} + export interface DiceResult { expression: string; rolls: number[]; @@ -249,30 +273,65 @@ export function rollDice(source: RandomSource, expression: string): DiceResult { }; } +export interface NormalizedWordList { + readonly words: readonly string[]; + readonly canonical: string; + readonly normalization: "trim-lines-drop-empty-preserve-order-v1"; +} + +export function normalizeWordList( + input: string | readonly string[], +): NormalizedWordList { + if (typeof input === "string" && input.length > 4_000_000) + throw new Error("Custom word-list input exceeds 4,000,000 UTF-16 units."); + const words = typeof input === "string" ? input.split(/\r\n?|\n/u) : input; + if (words.length > 100_000 || words.some((word) => word.length > 10_000)) + throw new Error( + "Word lists are limited to 100,000 entries and 10,000 UTF-16 units per entry.", + ); + const normalized = words.map((word) => word.trim()).filter(Boolean); + const uniqueCount = new Set(normalized).size; + if (uniqueCount < 2 || uniqueCount !== normalized.length) + throw new Error( + "Word list must contain at least two unique non-empty entries after trimming.", + ); + return { + words: normalized, + canonical: normalized.join("\n"), + normalization: "trim-lines-drop-empty-preserve-order-v1", + }; +} + +export function passphraseWithWordList( + source: RandomSource, + count: number, + wordList: NormalizedWordList, + separator = "-", +): { value: string; entropy: number; listSize: number } { + if (!Number.isSafeInteger(count) || count < 1 || count > 100) + throw new Error("Passphrase word count must be 1–100."); + return { + value: Array.from( + { length: count }, + () => wordList.words[source.integer(0, wordList.words.length)]!, + ).join(separator), + entropy: count * Math.log2(wordList.words.length), + listSize: wordList.words.length, + }; +} + export function passphrase( source: RandomSource, count: number, words: readonly string[] = DEFAULT_WORDS, separator = "-", -): { value: string; entropy: number } { - if (words.length > 100_000 || words.some((word) => word.length > 10_000)) - throw new Error( - "Word lists are limited to 100,000 entries and 10,000 UTF-16 units per entry.", - ); - const clean = words.map((word) => word.trim()).filter(Boolean); - if (!Number.isSafeInteger(count) || count < 1 || count > 100) - throw new Error("Passphrase word count must be 1–100."); - if (new Set(clean).size < 2 || new Set(clean).size !== clean.length) - throw new Error( - "Word list must contain at least two unique non-empty entries.", - ); - return { - value: Array.from( - { length: count }, - () => clean[source.integer(0, clean.length)]!, - ).join(separator), - entropy: count * Math.log2(clean.length), - }; +): { value: string; entropy: number; listSize: number } { + return passphraseWithWordList( + source, + count, + normalizeWordList(words), + separator, + ); } export function normalValues( diff --git a/src/random/remote.ts b/src/random/remote.ts deleted file mode 100644 index e513bbf..0000000 --- a/src/random/remote.ts +++ /dev/null @@ -1,77 +0,0 @@ -export interface RemoteIntegerRequest { - count: number; - minimum: number; - maximum: number; -} - -const ENDPOINT = "https://www.random.org/integers/"; -let lastRequest: Promise = Promise.resolve(); - -export async function randomOrgIntegers( - request: RemoteIntegerRequest, - signal?: AbortSignal, -): Promise { - if ( - !Number.isInteger(request.count) || - request.count < 1 || - request.count > 1_000 - ) - throw new Error("Remote count must be 1–1,000."); - if ( - !Number.isSafeInteger(request.minimum) || - !Number.isSafeInteger(request.maximum) || - request.maximum < request.minimum || - request.minimum < -1_000_000_000 || - request.maximum > 1_000_000_000 - ) - throw new Error( - "RANDOM.ORG bounds must be ordered integers from −1,000,000,000 to 1,000,000,000.", - ); - const execute = async () => { - const timeout = new AbortController(); - const timer = window.setTimeout(() => timeout.abort(), 120_000); - const abort = () => timeout.abort(); - signal?.addEventListener("abort", abort, { once: true }); - try { - const url = new URL(ENDPOINT); - url.search = new URLSearchParams({ - num: String(request.count), - min: String(request.minimum), - max: String(request.maximum), - col: "1", - base: "10", - format: "plain", - rnd: "new", - }).toString(); - const response = await fetch(url, { - credentials: "omit", - referrerPolicy: "no-referrer", - cache: "no-store", - signal: timeout.signal, - }); - if (!response.ok) - throw new Error(`RANDOM.ORG returned HTTP ${response.status}.`); - const text = await response.text(); - const values = text.trim().split(/\s+/u).filter(Boolean).map(Number); - if ( - values.length !== request.count || - values.some( - (value) => - !Number.isSafeInteger(value) || - value < request.minimum || - value > request.maximum, - ) - ) - throw new Error( - "RANDOM.ORG response did not match the requested integer contract.", - ); - return values; - } finally { - window.clearTimeout(timer); - signal?.removeEventListener("abort", abort); - } - }; - const queued = lastRequest.then(execute, execute); - lastRequest = queued.catch(() => undefined); - return queued; -} diff --git a/src/styles.css b/src/styles.css index 7eb37cf..082d383 100644 --- a/src/styles.css +++ b/src/styles.css @@ -15,6 +15,16 @@ * { box-sizing: border-box; } +.visually-hidden { + position: absolute; + width: 1px; + height: 1px; + padding: 0; + overflow: hidden; + clip: rect(0 0 0 0); + white-space: nowrap; + border: 0; +} html { min-width: 20rem; min-height: 100%; @@ -259,6 +269,20 @@ textarea { width: auto; min-height: auto; } +.weekday-options { + display: grid; + grid-template-columns: repeat(auto-fit, minmax(5.3rem, 1fr)); + gap: 0.55rem; + margin: 0; + padding: 0.75rem; + border: 1px solid var(--toolbox-border); + border-radius: 0.65rem; +} +.weekday-options legend { + padding: 0 0.35rem; + font-size: 0.76rem; + font-weight: 750; +} .result { display: grid; gap: 0.8rem; diff --git a/src/toolbox/manifest.source.json b/src/toolbox/manifest.source.json index e613627..6470807 100644 --- a/src/toolbox/manifest.source.json +++ b/src/toolbox/manifest.source.json @@ -3,12 +3,22 @@ "schemaVersion": 1, "id": "de.add-ideas.rand-tools", "name": "Random Tools", - "version": "0.1.0", + "version": "0.1.1", "description": "Generate secure or reproducible random values locally in the browser.", "entry": "./", "icon": "./favicon.svg", "categories": ["random", "developer", "productivity"], - "tags": ["random", "uuid", "ulid", "dice", "shuffle", "sample"], + "tags": [ + "random", + "uuid", + "ulid", + "dice", + "shuffle", + "sample", + "cards", + "dates", + "coordinates" + ], "integration": { "contextVersion": 1, "launchModes": ["navigate", "new-tab"], @@ -22,10 +32,10 @@ "topLevelContext": false }, "privacy": { - "processing": "mixed", + "processing": "local", "fileUploads": false, "telemetry": false, - "label": "Local generation is the default; RANDOM.ORG is contacted only after explicit opt-in." + "label": "All generation runs locally; the application makes no third-party requests." }, "source": { "repository": "https://git.add-ideas.de/lotobo/rand-tools", diff --git a/src/version.ts b/src/version.ts index 76162f8..6979bce 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const APP_VERSION = "0.1.0"; +export const APP_VERSION = "0.1.1"; diff --git a/tests/browser/app.spec.ts b/tests/browser/app.spec.ts index 3355307..da6bf83 100644 --- a/tests/browser/app.spec.ts +++ b/tests/browser/app.spec.ts @@ -28,7 +28,7 @@ test("runs from a nested path without external requests", async ({ page }) => { expect(errors).toEqual([]); }); -test("repeats deterministic output without contacting the remote source", async ({ +test("repeats deterministic output without external requests", async ({ page, }) => { const external = await localOnly(page); @@ -50,6 +50,95 @@ test("repeats deterministic output without contacting the remote source", async expect(external).toEqual([]); }); +test("runs the local draw catalogue with recipe metadata", async ({ page }) => { + const external = await localOnly(page); + await page.goto("/deep/nested/rand/"); + await page.getByLabel("Random source").selectOption("deterministic"); + await page + .getByRole("textbox", { name: "Seed", exact: true }) + .fill("draw-catalogue"); + await page.getByRole("tab", { name: "Draws" }).click(); + + await page.getByLabel("Result count").fill("7"); + await page.getByRole("button", { name: "Generate draw" }).click(); + await expect(page.locator(".result > pre")).toContainText(/Heads|Tails/u); + + await page.getByLabel("Draw type").selectOption("cards"); + await page.getByLabel("Cards to deal").fill("5"); + await page.getByRole("button", { name: "Generate draw" }).click(); + await expect(page.locator(".result > pre")).toContainText(/[♠♥♦♣]/u); + + await page.getByLabel("Draw type").selectOption("sequence"); + await page.getByLabel("Sequence minimum").fill("5"); + await page.getByLabel("Sequence maximum (inclusive)").fill("8"); + await page.getByRole("button", { name: "Generate draw" }).click(); + const sequence = (await page.locator(".result > pre").textContent()) + ?.trim() + .split("\n") + .map(Number) + .sort((a, b) => a - b); + expect(sequence).toEqual([5, 6, 7, 8]); + + await page.getByLabel("Draw type").selectOption("dates"); + await page.getByLabel("Result count").fill("3"); + await page.getByLabel("Start date (inclusive)").fill("2026-01-01"); + await page.getByLabel("End date (inclusive)").fill("2026-01-31"); + await page.getByLabel("Do not repeat dates").check(); + await page.getByRole("button", { name: "Generate draw" }).click(); + await expect(page.locator(".result > pre")).toContainText(/2026-01-/u); + + await page.getByLabel("Draw type").selectOption("decimals"); + await page.getByLabel("Result count").fill("2"); + await page.getByLabel("Decimal places").fill("4"); + await page.getByRole("button", { name: "Generate draw" }).click(); + await expect(page.locator(".result > pre")).toContainText(/0\.\d{4}/u); + + await page.getByLabel("Draw type").selectOption("coordinates"); + await page.getByLabel("Result count").fill("2"); + await page.getByLabel("Coordinate decimal places").fill("4"); + await page.getByRole("button", { name: "Generate draw" }).click(); + await expect(page.locator(".result > pre")).toContainText( + /-?\d+\.\d{4}, -?\d+\.\d{4}/u, + ); + await expect( + page.getByText(/mathematical samples on a spherical model/u), + ).toBeVisible(); + expect(external).toEqual([]); +}); + +test("identifies normalized custom passphrase inputs without announcing output", async ({ + page, +}) => { + const external = await localOnly(page); + await page.goto("/deep/nested/rand/"); + await page.getByLabel("Random source").selectOption("deterministic"); + await page + .getByRole("textbox", { name: "Seed", exact: true }) + .fill("word-list-identity"); + await page.getByRole("tab", { name: "Passphrases" }).click(); + await page + .getByLabel(/Optional custom word list/u) + .fill(" alpha \n\nbeta\n gamma "); + await page.getByRole("button", { name: "Generate passphrase" }).click(); + + const result = page.locator(".result"); + await expect(result.getByRole("status")).toHaveText( + /Result ready: Passphrase/u, + ); + await expect(result).not.toHaveAttribute("aria-live"); + await result.getByText("Reproduction metadata").click(); + await expect(result.locator("details pre")).toContainText( + /"normalizedCount": 3/u, + ); + await expect(result.locator("details pre")).toContainText( + /"sha256": "[0-9a-f]{64}"/u, + ); + await expect(result.locator("details pre")).toContainText( + /"customInputRequiredForReproduction": true/u, + ); + expect(external).toEqual([]); +}); + test("serves the release identity and hardened headers", async ({ request, }) => { @@ -59,13 +148,16 @@ test("serves the release identity and hardened headers", async ({ "default-src 'self'", ); expect(index.headers()["content-security-policy"]).toContain( - "connect-src 'self' https://www.random.org", + "connect-src 'self'", + ); + expect(index.headers()["content-security-policy"]).not.toMatch( + /connect-src[^;]*https?:/u, ); expect(await index.text()).not.toMatch(/\b(?:src|href)=["']\//u); const manifest = await request.get("/deep/nested/rand/toolbox-app.json"); await expect(manifest.json()).resolves.toMatchObject({ id: "de.add-ideas.rand-tools", - version: "0.1.0", + version: "0.1.1", entry: "./", }); }); diff --git a/tests/components/app.test.tsx b/tests/components/app.test.tsx index 4e37ecb..edc410b 100644 --- a/tests/components/app.test.tsx +++ b/tests/components/app.test.tsx @@ -12,6 +12,8 @@ describe("Random Tools", () => { expect( await screen.findByRole("heading", { name: "Random Tools" }), ).toBeVisible(); - expect(await screen.findByText("WebCrypto by default")).toBeVisible(); + expect(await screen.findByText("No network requests")).toBeVisible(); + expect(screen.getByRole("tab", { name: "Draws" })).toBeVisible(); + expect(screen.queryByText(/RANDOM\.ORG/iu)).not.toBeInTheDocument(); }); }); diff --git a/tests/random/core.test.ts b/tests/random/core.test.ts index d1124cb..277f6ae 100644 --- a/tests/random/core.test.ts +++ b/tests/random/core.test.ts @@ -1,6 +1,9 @@ import { describe, expect, it } from "vitest"; import { + normalizeWordList, passphrase, + passphraseWithWordList, + randomIdentifiers, randomIntegers, randomString, rollDice, @@ -8,6 +11,14 @@ import { uuidV4, uuidV7, } from "../../src/random/generators"; +import { + coinFlips, + dealCards, + decimalFractions, + integerSequence, + randomCoordinates, + randomDates, +} from "../../src/random/draws"; import { randomSource } from "../../src/random/source"; describe("random generators", () => { @@ -28,6 +39,38 @@ describe("random generators", () => { expect(ulid(randomSource("deterministic", "id"), 0)).toMatch( /^[0-9A-HJKMNP-TV-Z]{26}$/u, )); + it("bounds identifier batches before allocating their output array", () => { + const source = randomSource("deterministic", "identifier-bounds"); + expect(() => randomIdentifiers(source, 0, "uuid4", 0)).toThrow( + /safe integer from 1–100,000/u, + ); + expect(() => randomIdentifiers(source, 100_001, "uuid7", 0)).toThrow( + /safe integer from 1–100,000/u, + ); + expect(() => randomIdentifiers(source, Number.NaN, "ulid", 0)).toThrow( + /safe integer from 1–100,000/u, + ); + expect(randomIdentifiers(source, 2, "uuid4", 0)).toHaveLength(2); + }); + it("rejects an inclusive MAX_SAFE_INTEGER bound before adding one", () => { + const source = randomSource("deterministic", "integer-boundary"); + expect(() => + randomIntegers( + source, + 1, + Number.MAX_SAFE_INTEGER, + Number.MAX_SAFE_INTEGER, + ), + ).toThrow(/less than Number\.MAX_SAFE_INTEGER/u); + expect( + randomIntegers( + source, + 1, + Number.MAX_SAFE_INTEGER - 1, + Number.MAX_SAFE_INTEGER - 1, + ), + ).toEqual([Number.MAX_SAFE_INTEGER - 1]); + }); it("rejects biased duplicate alphabets", () => expect(() => randomString(randomSource("deterministic", "x"), 3, "aab"), @@ -45,6 +88,21 @@ describe("random generators", () => { "four", ]).entropy, ).toBe(8)); + it("normalizes a custom word list once and reports its eligible count", () => { + const words = normalizeWordList(" one \r\n\r\ntwo\n three "); + expect(words).toMatchObject({ + words: ["one", "two", "three"], + canonical: "one\ntwo\nthree", + normalization: "trim-lines-drop-empty-preserve-order-v1", + }); + expect( + passphraseWithWordList( + randomSource("deterministic", "normalized-words"), + 4, + words, + ), + ).toMatchObject({ listSize: 3, entropy: 4 * Math.log2(3) }); + }); it("bounds alphabet and word-list allocation before generation", () => { const source = randomSource("deterministic", "bounds"); expect(() => randomString(source, 1, "ab".repeat(70_000))).toThrow( @@ -55,3 +113,98 @@ describe("random generators", () => { ); }); }); + +describe("local draws", () => { + it("reproduces coin flips and reports only binary outcomes", () => { + const first = coinFlips(randomSource("deterministic", "coins"), 50); + const second = coinFlips(randomSource("deterministic", "coins"), 50); + expect(first).toEqual(second); + expect(first.every((value) => value === "Heads" || value === "Tails")).toBe( + true, + ); + }); + + it("deals every card from a standard deck without replacement", () => { + const cards = dealCards(randomSource("deterministic", "cards"), 1, 52); + expect(cards).toHaveLength(52); + expect(new Set(cards).size).toBe(52); + expect( + cards.every((card) => /^(?:A|[2-9]|10|J|Q|K)[♠♥♦♣]$/u.test(card)), + ).toBe(true); + }); + + it("shuffles an inclusive integer range exactly once", () => { + const values = integerSequence( + randomSource("deterministic", "sequence"), + -2, + 3, + ); + expect(values).toHaveLength(6); + expect([...values].sort((a, b) => a - b)).toEqual([-2, -1, 0, 1, 2, 3]); + }); + + it("filters dates by weekday and can sample without replacement", () => { + const values = randomDates( + randomSource("deterministic", "dates"), + 4, + "2024-02-01", + "2024-02-29", + { weekdays: [1], withoutReplacement: true }, + ); + expect(values).toHaveLength(4); + expect(new Set(values).size).toBe(4); + expect( + values.every((value) => new Date(`${value}T00:00:00Z`).getUTCDay() === 1), + ).toBe(true); + expect(() => + randomDates( + randomSource("deterministic", "bad-date"), + 1, + "2023-02-29", + "2023-03-01", + ), + ).toThrow(/valid Gregorian/u); + }); + + it("generates exact-length decimal fractions with no binary formatting", () => { + const values = decimalFractions( + randomSource("deterministic", "fractions"), + 4, + 12, + ); + expect(values).toHaveLength(4); + expect(values.every((value) => /^0\.\d{12}$/u.test(value))).toBe(true); + }); + + it("generates reproducible coordinates inside geographic bounds", () => { + const first = randomCoordinates( + randomSource("deterministic", "coordinates"), + 100, + 6, + ); + const second = randomCoordinates( + randomSource("deterministic", "coordinates"), + 100, + 6, + ); + expect(first).toEqual(second); + expect( + first.every( + ({ latitude, longitude }) => + latitude >= -90 && + latitude <= 90 && + longitude >= -180 && + longitude <= 180, + ), + ).toBe(true); + }); + + it("rejects draw requests beyond their allocation bounds", () => { + const source = randomSource("deterministic", "bounds"); + expect(() => coinFlips(source, 100_001)).toThrow(/100,000/u); + expect(() => dealCards(source, 1, 53)).toThrow(/1–52/u); + expect(() => integerSequence(source, 0, 100_000)).toThrow(/100,000/u); + expect(() => decimalFractions(source, 100_000, 64)).toThrow(/4,000,000/u); + expect(() => randomCoordinates(source, 1, 11)).toThrow(/0–10/u); + }); +});