# Reference implementations

This record complements [`SOURCE.md`](../SOURCE.md). Revisions were inspected
on 2026-08-01/02 while implementing SVG Tools 0.1.0. Reference code, fixtures,
assets, branding and explanatory text were not copied or adapted; the shipped
path, transform, security and test code is project-authored.

| Reference        | Exact revision/version                                                    | Licence               | Purpose and decision                                                                                                                                                 |
| ---------------- | ------------------------------------------------------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Toolbox SDK      | `bc91659a424aaaadc88fff3a98a2cc2412237386` / packages 0.3.0               | Apache-2.0            | Adopted through its published contract, AppShell and testkit APIs.                                                                                                   |
| Toolbox Portal   | `55b2b12434465511586eaa2d0a43e81770868738` (v0.9.3 before integration)    | AGPL-3.0-only         | Studied for release assembly, nested deployment, catalogue and shell conventions. SVG Tools is consumed only as an immutable release artifact.                       |
| SVG-Edit         | `244a26c88e1ab1c32911c5b3637e214d7a7d8b25`                                | MIT                   | Interaction and implementation reference only. Its canvas/document model was not adopted because canonical SVG source must remain authoritative.                     |
| SVG Path Editor  | `937d75a83b6be2bdda11d02b9b3594841315223a`                                | MIT                   | Path interaction reference only. Its source was not copied; SVG Tools uses its own source-ranged path model.                                                         |
| SVGPathCommander | `9aa91dd2119ee6a65b1807d55d33e86b1ccb27fc`                                | MIT                   | Evaluated for parsing and geometry, then not shipped. The initial project-authored core is smaller and retains source-command fragments.                             |
| DOMPurify        | npm 3.4.14 / lockfile-pinned tarball integrity                            | MPL-2.0 OR Apache-2.0 | Adopted as the first projection-sanitization layer, followed by application-owned SVG, URL and parsed-CSS policy checks.                                             |
| SVGO             | npm 4.0.2, published `gitHead` `b2309cf541aee11634eb653157b0ff86ab326e98` | MIT                   | Adopted behind a cancelable application worker. Direct GitHub cloning was unavailable in the build environment, so the exact locked npm source identity is recorded. |
| css-tree         | npm 3.2.1                                                                 | MIT                   | Adopted for stylesheet, declaration and animation-value parsing.                                                                                                     |
| fflate           | npm 0.8.3                                                                 | MIT                   | Adopted for deterministic SVGZ output and bounded streaming decompression.                                                                                           |

Boxy SVG and SVGViewer were consulted only as public product/interaction
references. Their proprietary source and assets were not used.

No boolean geometry engine was adopted: PathBool.js was considered too early
for a mandatory production dependency, while Paper.js and PathKit would add a
large secondary geometry/runtime model before the required fixture and fuzz
spikes. No third-party raster engine was adopted; 0.1.0 uses the browser SVG
decoder and Canvas 2D behind explicit limits. These decisions deliberately
leave boolean operations and deterministic cross-browser rasterization on the
roadmap rather than overstating support.