|
|
|
|
@@ -34,8 +34,9 @@ the SDK and portal together.
|
|
|
|
|
|
|
|
|
|
Vite uses `base: './'`, so the built portal works at `/` or a nested static path.
|
|
|
|
|
The development catalogue at `public/toolbox.catalog.json` points to assembled
|
|
|
|
|
paths (`./apps/pdf/` and `./apps/xslt/`). Those manifests will correctly appear
|
|
|
|
|
as unavailable until an assembled release is being served.
|
|
|
|
|
paths (`./apps/pdf/`, `./apps/xslt/`, and `./apps/onenote/`). Those manifests
|
|
|
|
|
will correctly appear as unavailable until an assembled release is being
|
|
|
|
|
served.
|
|
|
|
|
|
|
|
|
|
## Catalogue and launches
|
|
|
|
|
|
|
|
|
|
@@ -79,8 +80,9 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
|
|
|
|
|
must declare the pinned reverse-DNS id and version. Application and portal
|
|
|
|
|
versions are independent.
|
|
|
|
|
|
|
|
|
|
`release/toolbox.lock.json` is the reviewed v0.1.0 lock. Its URLs and checksums
|
|
|
|
|
pin the published PDF Tools 0.3.4 and XSLT Tools 0.3.2 release bytes. Use
|
|
|
|
|
`release/toolbox.lock.json` is the reviewed v0.2.0 lock. Its URLs and checksums
|
|
|
|
|
pin the published PDF Tools 0.3.4, XSLT Tools 0.3.2, and OneNote Tools 0.1.0
|
|
|
|
|
release bytes. Use
|
|
|
|
|
`release/toolbox.lock.example.json` as the template for a future release and
|
|
|
|
|
verify every downloaded asset before committing updated values. Artifacts may be:
|
|
|
|
|
|
|
|
|
|
@@ -101,7 +103,7 @@ npm run assemble -- \
|
|
|
|
|
--lock release/toolbox.lock.json \
|
|
|
|
|
--portal-dist dist \
|
|
|
|
|
--output build/toolbox \
|
|
|
|
|
--archive build/add-ideas-toolbox-0.1.0.zip
|
|
|
|
|
--archive build/add-ideas-toolbox-0.2.0.zip
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Existing output is refused. Pass `--force` only when replacing those exact
|
|
|
|
|
@@ -118,10 +120,11 @@ build/toolbox/
|
|
|
|
|
├── THIRD_PARTY_NOTICES.md
|
|
|
|
|
└── apps/
|
|
|
|
|
├── pdf/
|
|
|
|
|
└── xslt/
|
|
|
|
|
├── xslt/
|
|
|
|
|
└── onenote/
|
|
|
|
|
|
|
|
|
|
build/add-ideas-toolbox-0.1.0.zip
|
|
|
|
|
build/add-ideas-toolbox-0.1.0.zip.sha256
|
|
|
|
|
build/add-ideas-toolbox-0.2.0.zip
|
|
|
|
|
build/add-ideas-toolbox-0.2.0.zip.sha256
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
The assembler verifies SHA-256 before opening an artifact, validates every app
|
|
|
|
|
@@ -142,7 +145,7 @@ directory separately:
|
|
|
|
|
```sh
|
|
|
|
|
npm run package:static -- \
|
|
|
|
|
--input build/toolbox \
|
|
|
|
|
--output artifacts/add-ideas-toolbox-0.1.0.zip
|
|
|
|
|
--output artifacts/add-ideas-toolbox-0.2.0.zip
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
This also emits a `.sha256` sidecar.
|
|
|
|
|
@@ -159,9 +162,9 @@ normal local XML/XSLT transformations do not require that permission.
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
podman build -f Containerfile \
|
|
|
|
|
-t git.add-ideas.de/zemion/toolbox:0.1.0 .
|
|
|
|
|
-t git.add-ideas.de/zemion/toolbox:0.2.0 .
|
|
|
|
|
podman run --rm -p 8080:8080 \
|
|
|
|
|
git.add-ideas.de/zemion/toolbox:0.1.0
|
|
|
|
|
git.add-ideas.de/zemion/toolbox:0.2.0
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
For a local deployment, copy `compose.example.yaml` to `compose.yaml` and run
|
|
|
|
|
@@ -175,8 +178,8 @@ docker login git.add-ideas.de
|
|
|
|
|
docker buildx build \
|
|
|
|
|
--platform linux/amd64,linux/arm64 \
|
|
|
|
|
--file Containerfile \
|
|
|
|
|
--tag git.add-ideas.de/zemion/toolbox:0.1.0 \
|
|
|
|
|
--tag git.add-ideas.de/zemion/toolbox:0.1 \
|
|
|
|
|
--tag git.add-ideas.de/zemion/toolbox:0.2.0 \
|
|
|
|
|
--tag git.add-ideas.de/zemion/toolbox:0.2 \
|
|
|
|
|
--push .
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
@@ -198,10 +201,11 @@ permission to push code, releases, and container packages.
|
|
|
|
|
3. Verify downloaded app assets with `sha256sum -c <asset>.sha256`; copy those
|
|
|
|
|
exact values into a reviewed toolbox lock.
|
|
|
|
|
4. Run the assembler and serve `build/toolbox` from a nested test path. Open
|
|
|
|
|
both apps, switch between them, and confirm the encoded `toolbox` context.
|
|
|
|
|
all three apps, switch between them, and confirm the encoded `toolbox`
|
|
|
|
|
context.
|
|
|
|
|
5. Verify the distribution with
|
|
|
|
|
`(cd build && sha256sum -c add-ideas-toolbox-0.1.0.zip.sha256)`.
|
|
|
|
|
6. Commit the reviewed lock, tag the portal source (for example `v0.1.0`), and
|
|
|
|
|
`(cd build && sha256sum -c add-ideas-toolbox-0.2.0.zip.sha256)`.
|
|
|
|
|
6. Commit the reviewed lock, tag the toolbox release (for example `v0.2.0`), and
|
|
|
|
|
push the branch and tag to Gitea.
|
|
|
|
|
7. In Gitea, open **Releases → New release**, select the tag, and upload the
|
|
|
|
|
static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
|
|
|
|
|
@@ -217,7 +221,7 @@ must not re-resolve app versions or substitute a newer release.
|
|
|
|
|
## Planned / existing tools
|
|
|
|
|
|
|
|
|
|
| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations |
|
|
|
|
|
| ------------------- | --------------------------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
|
|
|
| -------------------- | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
|
|
|
| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` |
|
|
|
|
|
| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` |
|
|
|
|
|
| **`svg-tools`** | Planned; dedicated repository | Source and visual SVG editing | Synchronized DOM tree, code and canvas; optimization; path simplification; symbols; accessibility; animation; sanitization | SVG is potentially active content; previews require sanitization or sandboxing; integrate with `colour-tools`, `token-tools`, `image-tools` and `label-tools` |
|
|
|
|
|
@@ -227,7 +231,7 @@ must not re-resolve app versions or substitute a newer release.
|
|
|
|
|
| **`barcode-tools`** | Planned; dedicated repository | Generate, inspect and decode QR and barcodes | QR, common one- and two-dimensional codes; camera/image decoding; GS1 assistance; CSV batch generation; quiet-zone and print-size checks; structured payload builders | Treat decoded payloads as untrusted; never open links automatically; camera permission must be optional; integrate with `label-tools`, `contact-tools` and `crypto-tools` |
|
|
|
|
|
| **`av-tools`** | Planned; large dedicated repository | Light audio and video editing and transcoding | Trim, split, concatenate, crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, thumbnail/contact-sheet generation and export presets | Heavy WASM and worker workloads; temporary-file storage; configurable memory limits; possibly special cross-origin-isolation headers; integrate with `subtitle-tools` and `image-tools` |
|
|
|
|
|
| **`crypto-tools`** | Planned; dedicated repository | Inspect keys, certificates and signatures; validate chains | X.509 PEM/DER, CSR, CRL, PKCS #8, encrypted PKCS #8, PKCS #12/PFX, JWK/JWKS; key/certificate matching; path construction; hostname, purpose and time checks; CMS/JWS later | Inspection-first; explicit trust anchors; no implication that browser/OS trust stores are used; no private-key persistence; offline revocation first; network checks opt-in; restrictive CSP and worker isolation |
|
|
|
|
|
| **`onenote-tools`** | Immediate candidate; dedicated repository | Open, browse, search and extract OneNote notebooks | `.onepkg` and `.one`; section/page tree; positioned page rendering; rich text, lists, tables, links, images, timestamps and attachments; diagnostics and HTML export later | `.onepkg` is CAB; parser must run in a worker/WASM; untrusted content must not execute; bounded decompression; safe attachment names; no editing in the first release |
|
|
|
|
|
| **`onenote-tools`** | Existing MVP2 subset; dedicated repository | Open and browse OneNote sections and packages locally | Tested desktop `.one`; LZX/uncompressed `.onepkg`; section/page navigation, titles, timestamps, plain text and diagnostics; visual rendering and export later | `.onepkg` is CAB; native TypeScript worker with no Wasm; untrusted content does not execute; bounded decompression; no editing |
|
|
|
|
|
| **`data-tools`** | High priority; dedicated repository | Inspect, edit, validate, query and convert structured data | JSON, YAML, TOML, XML, CSV and NDJSON; tree/table/source views; schema inference; flattening; filtering; field mapping; JSONPath-style queries; conversion recipes | Every conversion should disclose information loss, coercion and round-trip instability; XML-specialist workflows hand off to `xslt-tools` |
|
|
|
|
|
| **`image-tools`** | High priority; dedicated repository | Edit and batch-process raster images | Crop, resize, rotate, compress, convert, contact sheets, sprites, responsive sets, favicon generation, metadata removal and visual quality comparison | Use workers and off-main-thread rendering; preserve or deliberately remove colour profiles; integrate with colour, SVG, PDF and privacy tools |
|
|
|
|
|
| **`diff-tools`** | High priority; dedicated repository or shared engine plus UI | Compare documents and files semantically | Text; JSON object-aware comparison; XML normalization; CSV keyed comparison; images with overlay/heatmap; archives and directories; PDF pages; optional audio waveform comparison | Normalization and ignored properties must be visible; produce portable reports and standard patch formats where possible |
|
|
|
|
|
@@ -266,8 +270,6 @@ must not re-resolve app versions or substitute a newer release.
|
|
|
|
|
| **`device-tools`** | Specialist app | Serial terminal, sensor logger, microcontroller console and controlled firmware installation; explicit permission and browser-capability checks | |
|
|
|
|
|
| **`helpers-tools`** | One shared artifact with deep links | Stateless Base64, URL encoding, case conversion, number bases, Unicode code points, unit conversion, small checksums, subnet and timestamp calculators; avoid a repository per calculator | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Licensing
|
|
|
|
|
|
|
|
|
|
Portal source is `AGPL-3.0-only`; see `LICENSE`. The contract is Apache-2.0, and
|
|
|
|
|
|
