lotobo/rand-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Release Random Tools 0.1.1

Browse Source
This commit is contained in:
zemion
2026-09-01 08:27:00 +02:00
parent 2ed2560b95
commit e4aa85a503
28 changed files with 1072 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ARCHITECTURE.md
+2 -2
View File
@@ -2,6 +2,6 @@
Random Tools is a static React/Vite application wrapped in the shared Toolbox shell. `random/source.ts` exposes one common interface over two deliberately distinct local sources: browser WebCrypto with rejection-sampled integers, and the versioned `toolbox-helpers` xoshiro128** seeded generator. Secure mode never falls back to deterministic mode.
`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. Each successful local result includes source identity, parameters and deterministic state where applicable. Operations are synchronous and bounded, so version 0.1 creates no worker.
`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. `random/draws.ts` adds local binary coin flips, standard playing-card deals, shuffled inclusive integer sequences, Gregorian calendar-date sampling, exact decimal-digit fractions and equal-area points on a spherical surface model. Date sampling can filter weekdays and use a partial Fisher–Yates mapping for selection without replacement; it does not allocate every date in a large range.
`random/remote.ts` is a separate, explicitly selected RANDOM.ORG integer client. Requests are validated, serialised, credentialless, no-referrer, no-store and subject to a 120-second abort timeout; responses are checked against the requested count/range. This is the only runtime network path and the production CSP permits only that origin in addition to self.
Each successful result includes source identity, parameters and deterministic state where applicable. Most operations are synchronous and bounded; custom word-list identity uses the asynchronous browser Web Crypto digest API without a worker. Custom lists are trimmed, emptied lines are dropped and uniqueness is checked once before both selection and metadata are derived. The application contains no third-party network client; its CSP limits connections to its own origin for loading the local application shell.
docs/PRIVACY-SECURITY.md
+3 -3
View File
@@ -1,7 +1,7 @@
# Privacy and security
Local WebCrypto is the default. It stays in the browser, has no remote fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit.
Local Web Crypto is the default. It stays in the browser, has no network or seeded fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit.
The RANDOM.ORG workspace is an opt-in exception to local processing. Only after checking consent and pressing the request button does the browser send the requested count and range to `https://www.random.org`; RANDOM.ORG and network intermediaries can observe the request and the user's IP address. Credentials and referrer are omitted. Browser CORS policy or service limits may prevent the request. No other operation substitutes this source automatically.
There is no third-party request path, telemetry, analytics, account, geolocation lookup or persistence. Coordinates are generated as mathematical samples and are not derived from the device location. Results and seeds remain in page memory unless copied or downloaded. A custom passphrase recipe contains the normalized list count and a versioned SHA-256 identity, not the list contents; the same normalized input is therefore still required for reproduction.
Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Results and seeds remain in page memory unless copied or downloaded. The app has no telemetry, analytics, account or persistence and is not certified for regulated drawings or gambling.
Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Web Crypto is a browser-provided CSPRNG, not a physical randomness source. The app is not certified for regulated drawings or gambling.