feat: add SVG Tools to Toolbox 0.10.0
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
# add·ideas Toolbox Portal
|
||||
|
||||
`toolbox-portal` is the static launcher and release assembler for the add·ideas
|
||||
browser toolbox. Version `0.2.11` reads one same-origin catalogue, shows each app
|
||||
browser toolbox. Version `0.2.12` reads one same-origin catalogue, shows each app
|
||||
as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
|
||||
visibility, and appearance in the current browser. Pinned tools have their own
|
||||
section; search, category, and clickable tag filters stay close to the tool
|
||||
@@ -36,8 +36,8 @@ the SDK and portal together.
|
||||
|
||||
Vite uses `base: './'`, so the built portal works at `/` or a nested static path.
|
||||
The development catalogue at `public/toolbox.catalog.json` points to assembled
|
||||
paths (`./apps/pdf/`, `./apps/xslt/`, `./apps/onenote/`, `./apps/av/`, and
|
||||
`./apps/regex/`).
|
||||
paths (`./apps/pdf/`, `./apps/xslt/`, `./apps/onenote/`, `./apps/av/`,
|
||||
`./apps/regex/`, and `./apps/svg/`).
|
||||
Those manifests will correctly appear as unavailable until an assembled release
|
||||
is being served.
|
||||
|
||||
@@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
|
||||
## Production deployment behind Traefik
|
||||
|
||||
The committed `compose.yaml` is the shortest production path. Its release
|
||||
container downloads the immutable Toolbox 0.9.3 ZIP during the image build,
|
||||
container downloads the immutable Toolbox 0.10.0 ZIP during the image build,
|
||||
verifies SHA-256 before extracting it, and then copies only the verified static
|
||||
files into the pinned unprivileged nginx image. Node.js and a local portal
|
||||
assembly are not required on the deployment host.
|
||||
@@ -121,9 +121,9 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
|
||||
must declare the pinned reverse-DNS id and version. Application and portal
|
||||
versions are independent.
|
||||
|
||||
`release/toolbox.lock.json` is the reviewed v0.9.3 lock. Its URLs and checksums
|
||||
`release/toolbox.lock.json` is the reviewed v0.10.0 lock. Its URLs and checksums
|
||||
pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4,
|
||||
Audio & Video Tools 0.3.0, and Regex Tools 0.4.2 release bytes. Use
|
||||
Audio & Video Tools 0.3.0, Regex Tools 0.4.2, and SVG Tools 0.1.0 release bytes. Use
|
||||
`release/toolbox.lock.example.json` as the template for a future release and
|
||||
verify every downloaded asset before committing updated values. Artifacts may be:
|
||||
|
||||
@@ -144,7 +144,7 @@ npm run assemble -- \
|
||||
--lock release/toolbox.lock.json \
|
||||
--portal-dist dist \
|
||||
--output build/toolbox \
|
||||
--archive build/add-ideas-toolbox-0.9.3.zip
|
||||
--archive build/add-ideas-toolbox-0.10.0.zip
|
||||
```
|
||||
|
||||
Existing output is refused. Pass `--force` only when replacing those exact
|
||||
@@ -164,10 +164,11 @@ build/toolbox/
|
||||
├── xslt/
|
||||
├── onenote/
|
||||
├── av/
|
||||
└── regex/
|
||||
├── regex/
|
||||
└── svg/
|
||||
|
||||
build/add-ideas-toolbox-0.9.3.zip
|
||||
build/add-ideas-toolbox-0.9.3.zip.sha256
|
||||
build/add-ideas-toolbox-0.10.0.zip
|
||||
build/add-ideas-toolbox-0.10.0.zip.sha256
|
||||
```
|
||||
|
||||
The assembler verifies SHA-256 before opening an artifact, validates every app
|
||||
@@ -188,7 +189,7 @@ directory separately:
|
||||
```sh
|
||||
npm run package:static -- \
|
||||
--input build/toolbox \
|
||||
--output artifacts/add-ideas-toolbox-0.9.3.zip
|
||||
--output artifacts/add-ideas-toolbox-0.10.0.zip
|
||||
```
|
||||
|
||||
This also emits a `.sha256` sidecar.
|
||||
@@ -197,9 +198,11 @@ This also emits a `.sha256` sidecar.
|
||||
|
||||
`Containerfile` serves only the assembled files with unprivileged nginx on port 8080. It adds restrictive browser headers, same-origin isolation, explicit
|
||||
`application/javascript` for `.mjs` engine modules and `application/wasm`,
|
||||
immutable caching only for Vite-hashed assets and narrowly
|
||||
matched semver-versioned FFmpeg core files, and revalidation for all other
|
||||
files. Assemble first, then:
|
||||
immutable caching only for Vite-hashed assets and narrowly matched
|
||||
semver-versioned FFmpeg core files, and revalidation for all other files. The
|
||||
opaque-origin SVG preview iframe loads its packaged controller with a URI-exact
|
||||
CORS and cross-origin resource-policy exception; all other files retain the
|
||||
same-origin policy and every normal security header. Assemble first, then:
|
||||
|
||||
The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's
|
||||
`ixsl:eval()` extension is therefore unsupported in this deployment profile;
|
||||
@@ -207,9 +210,9 @@ normal local XML/XSLT transformations do not require that permission.
|
||||
|
||||
```sh
|
||||
podman build -f Containerfile \
|
||||
-t git.add-ideas.de/lotobo/toolbox:0.9.3 .
|
||||
-t git.add-ideas.de/lotobo/toolbox:0.10.0 .
|
||||
podman run --rm -p 8080:8080 \
|
||||
git.add-ideas.de/lotobo/toolbox:0.9.3
|
||||
git.add-ideas.de/lotobo/toolbox:0.10.0
|
||||
```
|
||||
|
||||
For a direct-port local deployment after assembly, use the separate example:
|
||||
@@ -226,8 +229,8 @@ docker login git.add-ideas.de
|
||||
docker buildx build \
|
||||
--platform linux/amd64,linux/arm64 \
|
||||
--file Containerfile.release \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.9.3 \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.9 \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.10.0 \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.10 \
|
||||
--push .
|
||||
```
|
||||
|
||||
@@ -249,11 +252,11 @@ needs permission to push code, releases, and container packages to
|
||||
3. Verify downloaded app assets with `sha256sum -c <asset>.sha256`; copy those
|
||||
exact values into a reviewed toolbox lock.
|
||||
4. Run the assembler and serve `build/toolbox` from a nested test path. Open
|
||||
all five apps, switch between them, and confirm the encoded `toolbox`
|
||||
all six apps, switch between them, and confirm the encoded `toolbox`
|
||||
context.
|
||||
5. Verify the distribution with
|
||||
`(cd build && sha256sum -c add-ideas-toolbox-0.9.3.zip.sha256)`.
|
||||
6. Commit the reviewed lock, tag the toolbox release (for example `v0.9.3`), and
|
||||
`(cd build && sha256sum -c add-ideas-toolbox-0.10.0.zip.sha256)`.
|
||||
6. Commit the reviewed lock, tag the toolbox release (for example `v0.10.0`), and
|
||||
push the branch and tag to Gitea.
|
||||
7. In Gitea, open **Releases → New release**, select the tag, and upload the
|
||||
static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
|
||||
@@ -275,6 +278,7 @@ must not re-resolve app versions or substitute a newer release.
|
||||
| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity |
|
||||
| **`av-tools`** | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable |
|
||||
| **`regex-tools`** | Current local-first v0.4.2 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
|
||||
| **`svg-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and edit SVG source, structure, geometry, references and accessibility locally | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository |
|
||||
|
||||
## Planned tools
|
||||
|
||||
@@ -282,7 +286,6 @@ must not re-resolve app versions or substitute a newer release.
|
||||
| -------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| **`flow-tools`** | Later platform layer | Compose local processing operations across tools | Example: CSV → filter → QR generation → SVG template → PDF → ZIP; reusable recipes; typed inputs and outputs; progress and cancellation | Do not load complete React applications into one runtime; expose separate worker-safe operation packages only after several apps have stable operations |
|
||||
| **`file-tools`** | High priority; dedicated repository | Identify, inspect and organize local files | Magic-byte detection; hex view; decoded strings; checksums; directory manifests; split/join; duplicate detection; trailing-data detection; batch-rename preview | All inputs are untrusted; format inspectors require strict size and nesting limits; natural entry point to archive, privacy, crypto and package tools |
|
||||
| **`svg-tools`** | Planned; dedicated repository | Source and visual SVG editing | Synchronized DOM tree, code and canvas; optimization; path simplification; symbols; accessibility; animation; sanitization | SVG is potentially active content; previews require sanitization or sandboxing; integrate with `colour-tools`, `token-tools`, `image-tools` and `label-tools` |
|
||||
| **`image-tools`** | High priority; dedicated repository | Edit and batch-process raster images | Crop, resize, rotate, compress, convert, contact sheets, sprites, responsive sets, favicon generation, metadata removal and visual quality comparison | Use workers and off-main-thread rendering; preserve or deliberately remove colour profiles; integrate with colour, SVG, PDF and privacy tools |
|
||||
| **`subtitle-tools`** | Medium priority; dedicated repository | Edit, validate and synchronize captions | SRT, WebVTT and ASS; timing shifts; stretching; frame-rate conversion; overlap and reading-speed checks; waveform synchronization; revision comparison | Direct integration with `av-tools`; preserve style information when supported and disclose conversion losses |
|
||||
| **`midi-tools`** | Medium specialist app | MIDI event inspection and editing; transpose, quantize, tempo maps and controller data; device access should remain optional | |
|
||||
|
||||
Reference in New Issue
Block a user