lotobo/rand-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Release Random Tools 0.1.1

Browse Source
This commit is contained in:
zemion
2026-09-01 08:27:00 +02:00
parent 2ed2560b95
commit e4aa85a503
28 changed files with 1072 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/CHANGELOG.md
+7
View File
@@ -1,5 +1,12 @@
# Changelog
## 0.1.1 - 2026-09-01
- Removed the external randomness-service client and its network permission; Random Tools is now entirely local-only.
- Replaced the remote workspace with bounded local coin, card, sequence, calendar-date, decimal-fraction and spherical-coordinate draws.
- Added weekday and no-replacement date controls, recipe metadata and expanded cross-browser coverage.
- Hardened identifier and inclusive-integer bounds, added normalized custom-list identity, and limited screen-reader announcements to concise result status.
## 0.1.0 - 2026-09-01
- Added the initial local-first Random Tools workbench.
public/README.md
+4 -3
View File
@@ -10,9 +10,10 @@ Random Tools is a standalone local-first application in the [add·ideas Toolbox]
- Explicitly non-cryptographic, seeded deterministic generation with reproduction metadata
- Dice expressions, sampling without replacement, Fisher–Yates shuffling and passphrases
- UUIDv4, UUIDv7 and random ULID generation
- Optional RANDOM.ORG integer requests only after per-session consent
- Local draws for coin flips, shuffled card deals and unique integer sequences
- Random calendar dates with weekday and uniqueness controls, exact decimal fractions, and equal-area spherical coordinates
Secure local generation never falls back to the seeded or remote source. Deterministic results are reproducible but not suitable for secrets. The RANDOM.ORG workspace is the sole network-capable feature: it is not the default, requires an explicit consent checkbox, omits credentials/referrer and may still be unavailable because of browser CORS policy. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md).
All functionality runs locally. Secure generation never falls back to the seeded source, and deterministic results are reproducible but not suitable for secrets. Recipes for custom passphrases identify the normalized list by count and SHA-256 but do not embed it, so reproduction requires the same custom input. The browser CSPRNG is not physical entropy, and no operation is presented as certified for regulated drawings or gambling. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md).
## Development
@@ -26,7 +27,7 @@ npm run test:browser
## Release
`npm run release:artifact` creates a deterministic `release/rand-tools-0.1.0.zip` and checksum sidecar.
`npm run release:artifact` creates a deterministic `release/rand-tools-0.1.1.zip` and checksum sidecar.
## Licence
public/SOURCE.md
+2 -2
View File
@@ -1,7 +1,7 @@
# Corresponding source
The corresponding source for Random Tools 0.1.0 is available at:
The corresponding source for Random Tools 0.1.1 is available at:
https://git.add-ideas.de/lotobo/rand-tools/src/tag/v0.1.0
https://git.add-ideas.de/lotobo/rand-tools/src/tag/v0.1.1
Build with Node.js 22, npm 11, `npm ci`, and `npm run release:artifact`.
public/THIRD_PARTY_NOTICES.md
+1 -3
View File
@@ -1,6 +1,6 @@
# Third-party notices
Random Tools 0.1.0 directly depends on these runtime packages:
Random Tools 0.1.1 directly depends on these runtime packages:
| Package | Pinned version | Declared licence |
| -------------------------------- | -------------: | ---------------- |
@@ -10,6 +10,4 @@ Random Tools 0.1.0 directly depends on these runtime packages:
| `react` | 19.2.8 | MIT |
| `react-dom` | 19.2.8 | MIT |
The optional RANDOM.ORG feature calls a public HTTP API after explicit user consent; it does not embed or redistribute RANDOM.ORG code or data. Use of that service remains subject to its operator's terms and availability.
This table covers direct production dependencies, not transitive packages or development tooling. During a release build, the exact non-development dependency tree and discovered licence texts are generated from the lockfile into `LICENSES/npm-runtime-licenses.txt` and included in the release ZIP. Copyright and licence terms remain with their respective authors.
public/docs/ARCHITECTURE.md
+2 -2
View File
@@ -2,6 +2,6 @@
Random Tools is a static React/Vite application wrapped in the shared Toolbox shell. `random/source.ts` exposes one common interface over two deliberately distinct local sources: browser WebCrypto with rejection-sampled integers, and the versioned `toolbox-helpers` xoshiro128** seeded generator. Secure mode never falls back to deterministic mode.
`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. Each successful local result includes source identity, parameters and deterministic state where applicable. Operations are synchronous and bounded, so version 0.1 creates no worker.
`random/generators.ts` builds bounded numbers, strings, identifiers, dice, samples, shuffles, passphrases and normal samples on that interface. `random/draws.ts` adds local binary coin flips, standard playing-card deals, shuffled inclusive integer sequences, Gregorian calendar-date sampling, exact decimal-digit fractions and equal-area points on a spherical surface model. Date sampling can filter weekdays and use a partial Fisher–Yates mapping for selection without replacement; it does not allocate every date in a large range.
`random/remote.ts` is a separate, explicitly selected RANDOM.ORG integer client. Requests are validated, serialised, credentialless, no-referrer, no-store and subject to a 120-second abort timeout; responses are checked against the requested count/range. This is the only runtime network path and the production CSP permits only that origin in addition to self.
Each successful result includes source identity, parameters and deterministic state where applicable. Most operations are synchronous and bounded; custom word-list identity uses the asynchronous browser Web Crypto digest API without a worker. Custom lists are trimmed, emptied lines are dropped and uniqueness is checked once before both selection and metadata are derived. The application contains no third-party network client; its CSP limits connections to its own origin for loading the local application shell.
public/docs/PRIVACY-SECURITY.md
+3 -3
View File
@@ -1,7 +1,7 @@
# Privacy and security
Local WebCrypto is the default. It stays in the browser, has no remote fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit.
Local Web Crypto is the default. It stays in the browser, has no network or seeded fallback, and is the only mode intended for secrets. Seeded xoshiro128** output is reproducible and explicitly non-cryptographic; anyone with the seed/state/recipe can reproduce or predict it. The entropy estimate for a passphrase is a simple uniform-choice model, not a password-strength audit.
The RANDOM.ORG workspace is an opt-in exception to local processing. Only after checking consent and pressing the request button does the browser send the requested count and range to `https://www.random.org`; RANDOM.ORG and network intermediaries can observe the request and the user's IP address. Credentials and referrer are omitted. Browser CORS policy or service limits may prevent the request. No other operation substitutes this source automatically.
There is no third-party request path, telemetry, analytics, account, geolocation lookup or persistence. Coordinates are generated as mathematical samples and are not derived from the device location. Results and seeds remain in page memory unless copied or downloaded. A custom passphrase recipe contains the normalized list count and a versioned SHA-256 identity, not the list contents; the same normalized input is therefore still required for reproduction.
Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Results and seeds remain in page memory unless copied or downloaded. The app has no telemetry, analytics, account or persistence and is not certified for regulated drawings or gambling.
Counts, ranges, alphabets, list sizes and generated byte counts have explicit limits before large allocations. Web Crypto is a browser-provided CSPRNG, not a physical randomness source. The app is not certified for regulated drawings or gambling.
public/sw.js
+1 -1
View File
@@ -1,5 +1,5 @@
const CACHE_PREFIX = "rand-tools-shell-";
const CACHE_NAME = CACHE_PREFIX + "0.1.0";
const CACHE_NAME = CACHE_PREFIX + "0.1.1";
const CORE = ["./", "./manifest.webmanifest", "./favicon.svg"];
self.addEventListener("install", (event) => {
event.waitUntil(
public/toolbox-app.json
+14 -4
View File
@@ -3,12 +3,22 @@
"schemaVersion": 1,
"id": "de.add-ideas.rand-tools",
"name": "Random Tools",
"version": "0.1.0",
"version": "0.1.1",
"description": "Generate secure or reproducible random values locally in the browser.",
"entry": "./",
"icon": "./favicon.svg",
"categories": ["random", "developer", "productivity"],
"tags": ["random", "uuid", "ulid", "dice", "shuffle", "sample"],
"tags": [
"random",
"uuid",
"ulid",
"dice",
"shuffle",
"sample",
"cards",
"dates",
"coordinates"
],
"integration": {
"contextVersion": 1,
"launchModes": ["navigate", "new-tab"],
@@ -22,10 +32,10 @@
"topLevelContext": false
},
"privacy": {
"processing": "mixed",
"processing": "local",
"fileUploads": false,
"telemetry": false,
"label": "Local generation is the default; RANDOM.ORG is contacted only after explicit opt-in."
"label": "All generation runs locally; the application makes no third-party requests."
},
"source": {
"repository": "https://git.add-ideas.de/lotobo/rand-tools",