@@ -1,7 +1,7 @@
|
||||
# add·ideas Toolbox Portal
|
||||
|
||||
`toolbox-portal` is the static launcher and release assembler for the add·ideas
|
||||
browser toolbox. Version `0.2.22` reads one same-origin catalogue, shows each app
|
||||
browser toolbox. Version `0.2.23` reads one same-origin catalogue, shows each app
|
||||
as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
|
||||
visibility, and appearance in the current browser. Pinned tools have their own
|
||||
section; search, category, and clickable tag filters stay close to the tool
|
||||
@@ -30,7 +30,7 @@ npm run build
|
||||
npm run dev
|
||||
```
|
||||
|
||||
The package lock resolves the `^0.2.3` SDK ranges to the published `0.2.3`
|
||||
The package lock resolves the `^0.3.0` SDK ranges to the published `0.3.0`
|
||||
packages. A sibling SDK checkout is only needed when intentionally developing
|
||||
the SDK and portal together.
|
||||
|
||||
@@ -80,7 +80,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
|
||||
## Production deployment behind Traefik
|
||||
|
||||
The committed `compose.yaml` is the shortest production path. Its release
|
||||
container downloads the immutable Toolbox 0.19.0 ZIP during the image build,
|
||||
container downloads the immutable Toolbox 0.20.0 ZIP during the image build,
|
||||
verifies SHA-256 before extracting it, and then copies only the verified static
|
||||
files into the pinned unprivileged nginx image. Node.js and a local portal
|
||||
assembly are not required on the deployment host.
|
||||
@@ -144,17 +144,15 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
|
||||
must declare the pinned reverse-DNS id and version. Application and portal
|
||||
versions are independent.
|
||||
|
||||
`release/toolbox.lock.json` is the reviewed Toolbox v0.19.0 / Portal v0.2.22
|
||||
lock. Its URLs and checksums pin the published PDF Tools 0.4.4, XSLT Tools
|
||||
0.4.3, OneNote Tools 0.3.4,
|
||||
Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, OTP & Passkey
|
||||
Tools 0.3.1, Sudoku Tools 0.2.1, Colour Tools 0.1.0, Office Tools 0.1.0,
|
||||
Random Tools 0.1.1, and the 0.1.0 releases of Image, File, EPUB, Archive,
|
||||
Privacy, Crypto, Barcode, Network, Geo, Helper, Data, Diff, Time, Text, Unicode,
|
||||
Flow, Subtitle, MIDI, 3D, Query, Scan, Package, Label, Font, Fixture, Minimize,
|
||||
Format Lab, Repro, Log, Binary, Git, API, Mail, Calendar, Contact,
|
||||
Diagram, Token, and Device Tools.
|
||||
Schema Tools is pinned at its hardened v0.1.2 release.
|
||||
`release/toolbox.lock.json` is the reviewed Toolbox v0.20.0 / Portal v0.2.23
|
||||
lock. Its URLs and checksums pin PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote
|
||||
Tools 0.3.4, Audio & Video Tools 0.3.0, Regex Tools 0.4.2, OTP & Passkey Tools
|
||||
0.3.1, Sudoku Tools 0.2.1, and the coordinated 0.2.0 releases of SVG, Colour,
|
||||
Office, Image, File, EPUB, Archive, Privacy, Crypto, Barcode, Network, Geo,
|
||||
Helper, Random, Data, Diff, Time, Text, Unicode, Flow, Subtitle, MIDI, 3D,
|
||||
Query, Scan, Package, Label, Font, Fixture, Minimize, Format Lab, Repro, Schema,
|
||||
Log, Binary, Git, API, Mail, Calendar, Contact, Diagram, Token, and Device
|
||||
Tools.
|
||||
Use
|
||||
`release/toolbox.lock.example.json` as the template for a future release and
|
||||
verify every downloaded asset before committing updated values. Artifacts may be:
|
||||
@@ -176,7 +174,7 @@ npm run assemble -- \
|
||||
--lock release/toolbox.lock.json \
|
||||
--portal-dist dist \
|
||||
--output build/toolbox \
|
||||
--archive build/add-ideas-toolbox-0.19.0.zip
|
||||
--archive build/add-ideas-toolbox-0.20.0.zip
|
||||
```
|
||||
|
||||
Existing output is refused. Pass `--force` only when replacing those exact
|
||||
@@ -243,8 +241,8 @@ build/toolbox/
|
||||
├── token/
|
||||
└── device/
|
||||
|
||||
build/add-ideas-toolbox-0.19.0.zip
|
||||
build/add-ideas-toolbox-0.19.0.zip.sha256
|
||||
build/add-ideas-toolbox-0.20.0.zip
|
||||
build/add-ideas-toolbox-0.20.0.zip.sha256
|
||||
```
|
||||
|
||||
The assembler verifies SHA-256 before opening an artifact, validates every app
|
||||
@@ -265,7 +263,7 @@ directory separately:
|
||||
```sh
|
||||
npm run package:static -- \
|
||||
--input build/toolbox \
|
||||
--output artifacts/add-ideas-toolbox-0.19.0.zip
|
||||
--output artifacts/add-ideas-toolbox-0.20.0.zip
|
||||
```
|
||||
|
||||
This also emits a `.sha256` sidecar.
|
||||
@@ -298,9 +296,9 @@ Assemble first, then:
|
||||
|
||||
```sh
|
||||
podman build -f Containerfile \
|
||||
-t git.add-ideas.de/lotobo/toolbox:0.19.0 .
|
||||
-t git.add-ideas.de/lotobo/toolbox:0.20.0 .
|
||||
podman run --rm -p 8080:8080 \
|
||||
git.add-ideas.de/lotobo/toolbox:0.19.0
|
||||
git.add-ideas.de/lotobo/toolbox:0.20.0
|
||||
```
|
||||
|
||||
For a direct-port local deployment after assembly, use the separate example:
|
||||
@@ -317,8 +315,8 @@ docker login git.add-ideas.de
|
||||
docker buildx build \
|
||||
--platform linux/amd64,linux/arm64 \
|
||||
--file Containerfile.release \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.19.0 \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.19 \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.20.0 \
|
||||
--tag git.add-ideas.de/lotobo/toolbox:0.20 \
|
||||
--push .
|
||||
```
|
||||
|
||||
@@ -343,8 +341,8 @@ needs permission to push code, releases, and container packages to
|
||||
all 50 apps, switch between them, and confirm the encoded `toolbox`
|
||||
context.
|
||||
5. Verify the distribution with
|
||||
`(cd build && sha256sum -c add-ideas-toolbox-0.19.0.zip.sha256)`.
|
||||
6. Commit the reviewed lock, tag the toolbox release (for example `v0.19.0`), and
|
||||
`(cd build && sha256sum -c add-ideas-toolbox-0.20.0.zip.sha256)`.
|
||||
6. Commit the reviewed lock, tag the toolbox release (for example `v0.20.0`), and
|
||||
push the branch and tag to Gitea.
|
||||
7. In Gitea, open **Releases → New release**, select the tag, and upload the
|
||||
static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
|
||||
@@ -357,60 +355,86 @@ the exact tag, install with `npm ci`, run the same verification/assembly command
|
||||
and upload only the already-created ZIP/checksum and OCI image. The workflow
|
||||
must not re-resolve app versions or substitute a newer release.
|
||||
|
||||
## Toolbox 0.20.0 portfolio expansion
|
||||
|
||||
Toolbox 0.20.0 publishes the coordinated multi-repository depth pass. It adds:
|
||||
|
||||
- bounded byte/stream/worker/blob helpers, manifest I/O and capability profiles,
|
||||
versioned evidence envelopes, and same-origin one-time artifact transfers;
|
||||
- deeper batch, conversion, safe-share, schema, semantic diff, reproducibility,
|
||||
archive, text, Unicode, colour, random, network, barcode, crypto and geospatial
|
||||
workflows;
|
||||
- richer EPUB, Office, SVG, image, subtitle, MIDI, 3D, scan, label, font,
|
||||
diagram, design-token and structured-flow authoring/inspection, including
|
||||
bounded HTML/Markdown/text-to-EPUB adaptation and TTC/OTC face inspection;
|
||||
- modern PBES2/PBKDF2 PKCS #12 inspection, structural 7z/RAR inventory, and
|
||||
OpenAPI 3.1/3.2 webhook receiver analysis with explicit fail-closed limits;
|
||||
- expanded Query, Fixture, Minimize, Format Lab, Binary, Git, API, Mail,
|
||||
Calendar, Contact, Log and Device evidence and interoperability; and
|
||||
- repository-native Gitea verification workflows covering formatting, lint,
|
||||
unit tests, production builds, Toolbox smoke checks, runtime dependency audit
|
||||
and browser tests where applicable.
|
||||
|
||||
Every addition remains local-first, bounded and explicit about unsupported
|
||||
formats or incomplete standards coverage. The release order is Toolbox SDK
|
||||
`0.3.0`, `@add-ideas/toolbox-helpers@0.2.0`, the 43 app releases at `0.2.0`, and
|
||||
Portal `0.2.23` with aggregate Toolbox `0.20.0`. The reviewed lock pins those
|
||||
exact immutable app archives and checksums.
|
||||
|
||||
## Existing tools
|
||||
|
||||
| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations |
|
||||
| -------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` |
|
||||
| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` |
|
||||
| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity |
|
||||
| **`av-tools`** | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable |
|
||||
| **`regex-tools`** | Current local-first v0.4.2 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
|
||||
| **`svg-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and edit SVG source, structure, geometry, references and accessibility locally | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository |
|
||||
| **`auth-tools`** | Current local-first v0.3.1 release; dedicated repository | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; v0.3.1 corrects source provenance and cross-timezone artifact reproducibility; no raw CTAP administration |
|
||||
| **`sudoku-tools`** | Current local-first v0.2.1 release; dedicated repository | Set, play, generate, analyse and solve classic, Killer and rich variant Sudoku locally | 4×4–16×16 grids; registry-backed constraint packs including cages, lines, dots, XV, inequalities, indexing and Fog of War; staged hints, candidate maintenance, advanced logical techniques, setter quality checks, mixed-variant generation, source-preserving f-puzzles/SudokuPad interoperability, autosave recovery and searchable local projects | Worker-bounded solving, generation and quality analysis; strict inert imported-visual validation; fog-safe play assistance; IndexedDB history with memory fallback; stable workspace geometry, responsive zoom and pan, a 3×3 standard keypad, tap selection, patterned colours, accessibility controls and an offline-capable PWA shell |
|
||||
| **`colour-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert, composite, interpolate, pick, sample, analyse and export colours locally | General colour conversion; arbitrary RGBA compositing; multi-stop colour steps; large visual and native pickers; local image sampling and palette extraction; contrast, gamut and colour-vision-deficiency analysis; harmonies and design-token export | Processing and image access remain local; colour spaces, encoded versus linear-light compositing, interpolation and gamut-mapping assumptions are explicit; mathematical conversion is distinguished from display simulation; integrates with SVG, image and token tools |
|
||||
| **`office-tools`** | Initial local-first v0.1.0 read-only release; dedicated repository | Open and view word-processing documents, spreadsheets and presentations locally | DOCX, XLSX and PPTX plus ODT, ODS and ODP; document, sheet and slide views with search, outline or thumbnail navigation and zoom; text, tables, images, styles, metadata, cached formula values and presentation notes | Bounded worker-based inert package and XML parsers never execute macros, scripts, formulas, active content or external resources; legacy binary DOC, XLS and PPT are unsupported; viewing is intentionally read-only and does not promise pixel-perfect Office-suite layout fidelity |
|
||||
| **`image-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, crop, rotate, resize, compare and batch-convert raster images locally | Static JPEG, PNG and WebP; bounded queues; aspect presets; fit/fill/exact resize; PNG/JPEG/WebP export; per-result operation reports | Animated and multi-picture inputs are inspect-only; canvas re-encoding does not preserve arbitrary metadata, ICC profiles, HDR precision or byte identity |
|
||||
| **`file-tools`** | Initial local-first v0.1.0 release; dedicated repository | Identify, inspect, hash and inventory local files | Signature and claimed-MIME comparison; paged hex/ASCII and string views; SHA-256/SHA-512; deterministic JSON/CSV manifests; duplicate candidates | Detection and entropy are heuristics rather than validation or malware analysis; v0.1 intentionally does not mutate, split, join or rename files |
|
||||
| **`epub-tools`** | Initial local-first v0.1.0 release; dedicated repository | Read, inspect, validate and repair EPUB 2/3 publications | Package, metadata, spine, EPUB 3 nav and EPUB 2 NCX views; sandboxed reading; link checks; metadata and cover editing; text/chapter/report export; normalized rebuilds | Strict bounded ZIP and XML handling; active and external content are blocked; DRM is detected but never bypassed; focused preflight is not a complete EPUBCheck implementation |
|
||||
| **`archive-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, create, compare and safely extract archive content | ZIP/ZIP64, TAR/USTAR/PAX, gzip and tar.gz; inert previews; deterministic ZIP/TAR output; cross-format inventory comparison; selected-file repackaging | Path, entry-count, expanded-size and compression-ratio limits; no direct filesystem restoration, nested expansion, encrypted or multipart ZIP support; links and special entries are blocked |
|
||||
| **`privacy-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect image metadata and make independently verified sharing copies | Deep JPEG, PNG and WebP scans for EXIF/IPTC/XMP/profiles/previews/provenance and trailing data; orientation-normalized pixel re-encoding; source/output hashes; JSON and ZIP reports | Not an anonymity guarantee; static supported images only; re-encoding can change pixels and remove colour, resolution and authenticity information; reports can themselves contain sensitive metadata |
|
||||
| **`crypto-tools`** | Initial local-first v0.1.0 inspection release; dedicated repository | Inspect certificate, request, revocation-list, key and JWK material | Bounded PEM/DER X.509, CSR and CRL inspection; public/private key identification; JWK/JWKS warnings and RFC 7638 thumbprints; explicit issuer-signature links; DNS SAN hostname checks | No browser/OS trust implication, complete RFC 5280 path validation, revocation service, issuance, key generation, private-key decryption or general signature verification |
|
||||
| **`barcode-tools`** | Initial local-first v0.1.0 release; dedicated repository | Generate and decode QR codes and common barcodes | SVG QR, Data Matrix, PDF417, Aztec and selected linear formats; bounded image or opt-in camera decode; structured QR payloads; CSV batch ZIP; GTIN and quiet-zone assistance | Decoded payloads remain inert text and are never opened automatically; camera is path-scoped and user initiated; generated output, GS1 allocation and print quality still require applicable interoperability checks |
|
||||
| **`network-tools`** | Initial offline v0.1.0 release; dedicated repository | Calculate IP networks and construct or inspect common network values | IPv4/IPv6 canonicalization and CIDR ranges; URL/query parsing without navigation; DNS-record construction; response-header inspection; CSP builder; MIME reference | Performs no DNS, URL, HTTP or scanning request; pasted values remain bounded and inert; results are construction and calculation aids rather than live network observations |
|
||||
| **`geo-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, convert, simplify and analyse geospatial files | GeoJSON, GPX, KML and coordinate CSV; WGS 84 bounds, distance and elevation; Douglas–Peucker simplification; decimal/DMS conversion; coordinate-only sketch | Small Point/LineString/Polygon model with scalar properties; conversion losses are explicit; no CRS transformation, basemap request or survey-grade claim |
|
||||
| **`helper-tools`** | Initial v0.1.0 app and reusable package release | Encode, convert, inspect and calculate with shared bounded primitives | Base/byte/text/URL conversion; Unicode and line transforms; exact number and unit conversion; hashes; CIDR; timestamps; hardened JSON/CSV; secure and seeded random primitives; deep-linked calculator workspaces | Framework-free `@add-ideas/toolbox-helpers` package is consumed directly by eleven v0.1 apps; operations disclose strictness, limits and non-cryptographic seeded boundaries |
|
||||
| **`rand-tools`** | Local-only v0.1.1 release; dedicated repository | Generate secure or reproducible random values through focused workspaces | Unbiased WebCrypto integers/strings; seeded reproducible generation; UUIDv4/v7 and ULID; dice; sampling, shuffle, passphrases and normal distribution; all generators run entirely in the browser | Secure local generation never falls back; deterministic output is reproducible rather than secret; the app makes no third-party randomness request and the Portal grants it no external network destination |
|
||||
| **`data-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, format, query, flatten and convert structured data | JSON, YAML 1.2, TOML, XML, CSV, TSV and NDJSON; exact JSON numbers; bounded tree/table/leaf views; JSON Pointer and safe path queries; all-format conversion with loss/coercion reports; spreadsheet-formula neutralization | Disposable bounded parser worker; rejects active XML constructs and unsafe object keys; conversions surface information loss and round-trip instability |
|
||||
| **`diff-tools`** | Initial local-first v0.1.0 release; dedicated repository | Compare text, JSON, XML and delimited data semantically | Line/word/code-point/grapheme text diff; exact newline state; object-aware exact-number JSON and RFC 6902; namespace-aware XML rules; keyed CSV/TSV; unified/side-by-side views and portable reports | Normalization settings and ignored distinctions remain visible; bounded disposable worker; v0.1 intentionally excludes images, binary documents, directories and archives |
|
||||
| **`time-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert timestamps and explore zones, arithmetic and recurrence | Exact signed nanosecond epochs; IANA-zone comparisons and DST ambiguity; wall-clock versus elapsed arithmetic; bounded cron and RRULE previews; business days; escaped UTC ICS export | Uses the browser's IANA data and does not model leap seconds; regional holidays are never inferred; recurrence and skipped/ambiguous local-time choices are explicit |
|
||||
| **`text-tools`** | Initial local-first v0.1.0 release; dedicated repository | Build ordered, inspectable plain-text transformation pipelines | Line endings, trimming, whitespace, sort/deduplicate, locale case, Unicode normalization, transliteration, escapes, wrapping, columns, explicit file decoding and versioned recipes | Exact source/result and per-step changes stay visible; compatibility normalization, transliteration, narrow encodings and selected transforms warn when they may be lossy |
|
||||
| **`unicode-tools`** | Initial local-first v0.1.0 release; dedicated repository | Search and inspect Unicode characters, emoji, scripts, text and confusables | Checksum-pinned Unicode 17.0 catalogue; character/alias/code-point search; emoji and named sequences; UTF-8/UTF-16/escape inspection; grapheme segmentation; normalization; UTS #39 skeleton; selected Unihan fields; symbol collections | Official Unicode data is redistributed under Unicode-3.0 and is not scraped from symbol sites; private-use and surrogate ranges are not misrepresented as assigned characters; confusable and mixed-script results are review signals, not security verdicts |
|
||||
| **`flow-tools`** | Initial local-first v0.1.0 release; dedicated repository | Design and run deterministic structured-data pipelines | Bounded JSON, CSV, NDJSON and XML sources; select, rename, filter, map, sort, group, join, format and export stages; inspectable snapshot and loss notes at every stage; portable validated recipes | 2 MiB sources, 10,000 input rows, 20,000 join rows, 200 fields and 30 stages; no arbitrary code, eval, plug-in or network stage |
|
||||
| **`subtitle-tools`** | Initial local-first v0.1.0 release; dedicated repository | Edit, validate, synchronize, compare and convert captions | Bounded SRT, WebVTT and ASS/SSA; cue editing, shift/stretch and frame-rate conversion; editorial diagnostics; revision comparison; local media playback and waveform peaks | Preserves format-specific information where possible and reports cross-format loss; no speech recognition, automatic alignment, semantic comparison or pixel-perfect ASS rendering |
|
||||
| **`midi-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, visualize, edit, audition and export Standard MIDI files | SMF type 0/1 events, tempo/time/key timelines, piano roll; transpose, quantize, tempo, crop and channel operations; deterministic MIDI/CSV/JSON export; Web Audio sine preview | 8 MiB, 256-track and 250,000-event caps; PPQN only; bounded preview is not a General MIDI instrument or soundfont renderer; editing semantics are explicit |
|
||||
| **`3d-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, preview, repair and export triangle meshes | OBJ, binary/ASCII STL, ASCII/binary little-endian PLY and glTF/GLB 2; mesh statistics; capped WebGL preview; normal repair and transform baking; normalized OBJ/STL export | 32 MiB and one-million-vertex/triangle caps; glTF is an embedded, static TRIANGLES subset with no external assets, sparse accessors, animation, skins, texture or compression decoding; source material graphs and node transforms are not recreated |
|
||||
| **`query-tools`** | Initial local-first v0.1.0 release; dedicated repository | Query structured local data through bounded row and path languages | JSON, CSV, NDJSON and inert XML; focused SQL-like select/filter/group/aggregate/sort/limit; JSONPath-like property/index/wildcard/filter paths; table, tree and JSON results; saved queries and export | Not full SQL, JSONPath or JMESPath compatibility; 2 MiB, 10,000-row/value, 200-field and 200,000-node caps; XML DTD/entities and code evaluation are rejected |
|
||||
| **`scan-tools`** | Initial local-first v0.1.0 release; dedicated repository | Correct photographed pages, run optional OCR and assemble local output | Up to 24 PNG/JPEG/WebP pages; perspective correction, rotate/deskew, tonal and threshold controls; reorder; image and PDF export; bundled same-origin English Tesseract model | Camera is exact-path and opt-in; strict pixel/byte/page caps; OCR is memory-heavy and not an accuracy guarantee; no PDF input, automatic corners, handwriting guarantee, shadow/finger removal or searchable PDF text layer |
|
||||
| **`package-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and compare ZIP/ZIP64 compound packages | Package trees and ZIP risk diagnostics; EPUB, OOXML, ODF, JAR, APK and WebExtension adapters; relationships/manifests; media preview/download; signature-material inventory; inventory comparison/export | Inspection does not render specialized formats, decode APK signing blocks or establish signature validity/trust; encrypted, split, unsafe, unsupported or over-budget entries remain inventory-only |
|
||||
| **`label-tools`** | Initial local-first v0.1.0 release; dedicated repository | Merge local records into printable labels, badges and asset tags | CSV/JSON mapping; serial/random values; local raster assets; QR and common 1D/2D barcodes; mm/in/pt stock and custom grids; calibration/marks; paginated preview; SVG, ZIP and 144-DPI PDF export | 2 MiB/2,000-row/100-field data bounds and bounded images/pages; stock names are geometries, not vendor certification; system fonts are not embedded and PDF is rasterized, not archival/press quality |
|
||||
| **`font-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, compare, preview and prepare local fonts | TTF, OTF and WOFF metadata/tables, Unicode coverage, variable axes, fallbacks and embedding signals; arbitrary-text sandbox; safe CSS; rights-confirmed static glyf/CFF subset with loss report | Disposable worker and strict file/table/glyph bounds; WOFF2/TTC unsupported; fsType is a technical signal, not legal advice; no variable flattening or shaping/composite closure, and subsetting discards advanced tables |
|
||||
| **`fixture-tools`** | Initial local-first v0.1.0 release; dedicated repository | Generate deterministic synthetic test fixtures | Focused JSON Schema, SQL DDL, XSD, CSV-heading and portable-model import; relationships, distributions, boundaries and deliberate violations; JSON/CSV/NDJSON/XML/SQL/recipe export | Importers are documented subsets; 2 MiB input, 20 tables, 100 fields/table, 50,000 rows and bounded output; synthetic data is not anonymization and seeded output is reproducible, not secret |
|
||||
| **`minimize-tools`** | Initial local-first v0.1.0 release; dedicated repository | Reduce failing inputs while continuously preserving a selected predicate | Line/token/code-point and structure-aware JSON/XML reduction; literal, invalid syntax, regex, focused JSON Schema and local XSLT predicates; budgets, cancellation, trace and report export | Produces a locally minimal attempted case, not a globally shortest one; focused schema/XSLT subsets fail closed; 2 MiB, 2,000-test and 30-second caps, with a disposable one-second regex worker |
|
||||
| **`format-lab`** | Initial local-first v0.1.0 release; dedicated repository | Explore conversion paths and measure representative round-trip loss | Conservative data/image/AV/subtitle format graphs; executable JSON/NDJSON/CSV/typed-XML record conversion; property selection, path ranking, round-trip evidence and deterministic reports | Media graphs plan handoffs rather than duplicate codecs; executable lab handles bounded records, not arbitrary documents; catalogue expectations are not file measurements and untested properties remain explicit |
|
||||
| **`repro-tools`** | Initial local-first v0.1.0 release; dedicated repository | Build, compare, sign and package reproducible local file inventories | SHA-256/SHA-512 manifests; deterministic path ordering and JSON/CSV; reference comparison; fixed-metadata ZIP; optional memory-only P-256 signature envelope | 64 MiB/file, 256 MiB/selection and 10,000-entry caps; ZIP is capped at 128 MiB; signatures prove integrity relative to an independently authenticated public key and are intentionally not byte-reproducible |
|
||||
| **`schema-tools`** | Hardened local-first v0.1.2 release; dedicated repository | Inspect, validate, compare and derive examples from schema workspaces | Local JSON Schema/OpenAPI reference graphs; focused JSON Schema validation; OpenAPI operation/sample/change analysis; XSD, Relax NG and Schematron structure; bounded heuristic XML samples | Remote/escaping references, entities, code and XPath are blocked; JSON Schema/OpenAPI support is a documented subset, while XML languages receive structural inspection rather than complete instance validation; shared work/node/depth/text/output budgets, linear cached traversal and well-formed XML fallbacks are regression-tested |
|
||||
| **`log-tools`** | Initial local-first v0.1.0 release; dedicated repository | Stream, inspect, correlate, redact and export large logs | Incremental UTF-8 file scan; plain, JSONL, nginx, syslog and logfmt parsing; normalized fields, aggregation, search/filter; deterministic redaction recipes; CSV/NDJSON/text export | Eight-GiB gate and five-million-line stop without whole-file strings; only a bounded 10,000-record/32 MiB preview supports search, redaction and export; parsers and autodetection are focused/heuristic |
|
||||
| **`binary-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert, inspect and decode byte-oriented values | Synchronized UTF-8/hex/Base64/Base32/Base58; paged byte inspector; CBOR and MessagePack; strict DER tree; Protocol Buffers wire view with optional scalar/nested schema | Inert, no requests or evaluation; 1 MiB, depth-64 and 10,000-node bounds; Base58 capped at 4 KiB; protobuf groups and a complete generated runtime are out of scope |
|
||||
| **`git-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and author Git interchange text without repository access | Unified/git patch parse, stats and bounded before/after authoring; root `.gitignore` matcher with explanations; SemVer compare/ranges; Conventional Commit builder/lint; changelog normalization | Patch/matrix/count bounds; ignore matching covers one root file, not nested/global/index state; SemVer and changelog behavior is intentionally focused; no workspace or `.git` access |
|
||||
| **`api-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and compare OpenAPI descriptions and saved HTTP evidence | Bounded JSON/YAML OpenAPI 3.0/3.1; local multi-file `$ref`; navigation, samples, examples and security inventory; inert curl/Fetch/Python text; conservative change report; HAR/exchange summaries | Never executes HTTP, follows URLs, resolves remote references or stores credentials; focused validation/sample generation is not a complete validator, code generator, client, proxy or security scanner |
|
||||
| **`mail-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, compare, download and redact EML/MIME content | Folded/RFC 2047 headers; bounded multipart/nested-message tree; Base64/quoted-printable; text and opaque sandboxed sanitized HTML; attachment inventory/download; auth-header diagnostics; canonical/redacted export | Remote and active HTML content is removed and never loaded; no mailbox, server, decryption, DKIM verification, identity, malware or anonymity claim; bounded normalization does not promise byte identity |
|
||||
| **`calendar-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, repair, merge and reconcile iCalendar data | RFC 5545 events/metadata/attendees/timezones; bounded recurrence preview; duplicate/overlap diagnostics; UID/RECURRENCE-ID merge; conservative canonical repair; DST transition/gap/overlap evidence | 4 MiB, line/component/event and recurrence-horizon caps; browser IANA data and focused recurrence interpretation are evidence rather than a complete calendar-server implementation |
|
||||
| **`contact-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, edit, convert and reconcile sensitive contacts | vCard 3/4 parsing/editing/export; inferred reviewable CSV mapping; duplicate candidates and conflict-reporting merge; bounded local vCard QR; masked overview and memory clearing | 2 MiB, 50,000-line and 2,000-contact caps; binary/quoted-printable values are diagnosed rather than decoded and unsupported properties are not silently round-tripped; no persistence or telemetry |
|
||||
| **`diagram-tools`** | Initial local-first v0.1.0 release; dedicated repository | Author safe deterministic text diagrams and export accessible graphics | Independent Mermaid-like flow/graph, sequence, class and state subset; diagnostics, pan/zoom, SVG/2× PNG and textual outline | Not full Mermaid or Graphviz; directives, clicks, styles, scripts, HTML and remote assets are rejected; 50,000-character, 2,000-line, 200-node, 500-edge and 20-megapixel caps |
|
||||
| **`token-tools`** | Initial local-first v0.1.0 release; dedicated repository | Edit, validate, theme and export design tokens | W3C-style nested JSON plus local sets/themes; alias resolution and cycle/type diagnostics; colour, dimension, typography, shadow and scalar values; JSON, CSS, Sass, Android and Swift export with loss report | The set/theme wrapper is app-specific; 1 MiB, depth-64 and 10,000-token bounds; unknown/conflicting shapes fail explicitly and platform composite losses are never silently omitted |
|
||||
| **`device-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect browser capability evidence without creating a device fingerprint | Passive context/display/input/accessibility/media/storage/PWA/API inventory; opt-in permission, storage, WebGL/WebGPU, media, battery, network, camera, microphone and screen probes; redacted reports | No identifier, score, high-entropy report, recording, persistence or passive prompt; sensitive probes are exact-path, individually initiated and immediately stop returned tracks; results are capability evidence, not a reliability guarantee |
|
||||
| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations |
|
||||
| -------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` |
|
||||
| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` |
|
||||
| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity |
|
||||
| **`av-tools`** | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable |
|
||||
| **`regex-tools`** | Current local-first v0.4.2 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
|
||||
| **`svg-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect and edit SVG source, structure, geometry, references and accessibility locally | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; app-owned, validated opacity-animation preview; exact, sanitized, raster and project export | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository |
|
||||
| **`auth-tools`** | Current local-first v0.3.1 release; dedicated repository | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; v0.3.1 corrects source provenance and cross-timezone artifact reproducibility; no raw CTAP administration |
|
||||
| **`sudoku-tools`** | Current local-first v0.2.1 release; dedicated repository | Set, play, generate, analyse and solve classic, Killer and rich variant Sudoku locally | 4×4–16×16 grids; registry-backed constraint packs including cages, lines, dots, XV, inequalities, indexing and Fog of War; staged hints, candidate maintenance, advanced logical techniques, setter quality checks, mixed-variant generation, source-preserving f-puzzles/SudokuPad interoperability, autosave recovery and searchable local projects | Worker-bounded solving, generation and quality analysis; strict inert imported-visual validation; fog-safe play assistance; IndexedDB history with memory fallback; stable workspace geometry, responsive zoom and pan, a 3×3 standard keypad, tap selection, patterned colours, accessibility controls and an offline-capable PWA shell |
|
||||
| **`colour-tools`** | Current local-first v0.2.0 release; dedicated repository | Convert, composite, interpolate, pick, sample, analyse and export colours locally | General colour conversion; arbitrary RGBA compositing; multi-stop colour steps and gradient editing; large visual/native/EyeDropper pickers; local image sampling and palette extraction; contrast, gamut, Delta E and colour-vision analysis; harmonies; DTCG 2025.10 token import/export with local reference resolution; directional contrast matrices; CSS and recipe export | Processing and image access remain local; colour spaces, encoded versus linear-light compositing, interpolation and gamut-mapping assumptions are explicit; mathematical conversion is distinguished from display simulation; integrates with SVG, image and token tools |
|
||||
| **`office-tools`** | Current local-first v0.2.0 read-only release; dedicated repository | Open, inspect and view word-processing documents, spreadsheets and presentations locally; download exact source copies and bounded ODF semantic exports | DOCX/DOCM/DOTX/DOTM, XLSX/XLSM/XLTX/XLTM and PPTX/PPTM/POTX/POTM/PPSX/PPSM plus ODT/ODS/ODP; search/navigation/zoom; text, tables, images, styles, metadata, cached formula values and notes; exact source-copy plus ODF text/CSV/outline/JSON export | Bounded worker-based inert package and XML parsers never execute macros, scripts, formulas, active content or external resources; legacy binary DOC, XLS and PPT are unsupported; viewing is intentionally read-only and does not promise pixel-perfect Office-suite layout fidelity |
|
||||
| **`image-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, crop, rotate, resize, preview before/after and batch-convert static raster images locally | Static JPEG/PNG/WebP; bounded pre-decode animation/profile inspection; synchronized 25–400% source/result zoom; pointer/keyboard crop and fit/fill/exact resize; versioned recipes; cancellable batch ZIP with per-image reports; capability-probed PNG/JPEG/WebP export | Animated and multi-picture inputs are inspect-only; canvas re-encoding does not preserve arbitrary metadata, ICC profiles, HDR precision or byte identity |
|
||||
| **`file-tools`** | Current local-first v0.2.0 release; dedicated repository | Identify, inspect, hash, compare, inventory, rename-copy, split and join local files | Signature and claimed-MIME comparison; paged hex/ASCII and strings; SHA-256/SHA-512; deterministic manifests; duplicate candidates; collision-safe rename/copy plans; byte-exact split/join | Detection and entropy are heuristics rather than validation or malware analysis; rename operations export safe copies and never mutate the source filesystem |
|
||||
| **`epub-tools`** | Current local-first v0.2.0 release; dedicated repository | Read, inspect and validate EPUB 2/3 publications; adapt text formats, edit metadata and covers, and rebuild EPUBs locally | EPUB 2/3 package/nav/spine inspection; determinate open progress; sandboxed reflow/fixed-layout reading with packaged CSS/fonts/images/media; bounded HTML/XHTML/Markdown/text adapters; search, bookmarks and annotations; metadata/cover editing; text/Markdown/safe-HTML/chapter/report exports; normalized rebuilds with IDPF font-obfuscation preservation | Strict bounded ZIP and XML handling; active and external content are blocked; DRM is detected but never bypassed; focused preflight is not a complete EPUBCheck implementation |
|
||||
| **`archive-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, create, compare and safely extract archive content | ZIP/ZIP64, TAR/USTAR/PAX, gzip and tar.gz plus bounded structural 7z and RAR4/RAR5 inspection; inert previews; ZipCrypto/WinZip AES read and create; deterministic unencrypted ZIP/TAR/tar.gz; cross-format comparison; selected-file verification and repackaging | Path, entry-count, expanded-size and compression-ratio limits; no direct filesystem restoration or nested expansion; multipart ZIP and 7z/RAR decompression/extraction remain unsupported; links and special entries are inventory-only and blocked from restoration |
|
||||
| **`privacy-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect image metadata and make independently verified sharing copies | Deep JPEG/PNG/WebP EXIF/IPTC/XMP/profile/preview/provenance/trailing-data scans; orientation-normalized re-encoding with mandatory output rescan and pixel comparison; source/output hashes; pseudonymized safe-share and detailed JSON/ZIP reports; reusable remove/preserve/review policy evidence | Not an anonymity guarantee; verified re-encoding is limited to complete static JPEG/PNG/WebP scans, while other recognized formats are inventory/inspect-only; re-encoding can change pixels and remove colour, resolution and authenticity information; detailed reports can contain sensitive metadata |
|
||||
| **`crypto-tools`** | Current local-first v0.2.0 inspection and operations release; dedicated repository | Inspect certificates, requests, CRLs, keys, encrypted PKCS #8, PKCS #12/PFX and JWK/JWKS material, and run fixed-profile local cryptographic operations | Bounded X.509/CSR/CRL, PBES2/PBKDF2 PKCS #8 and PKCS #12 inspection/decryption; JWK/JWKS and RFC 7638; explicit certificate-path checks without trust claims; DNS SAN checks; fixed-profile RSA-PSS/PKCS1, ECDSA and browser-supported Ed25519 sign/verify; RSA-OAEP and AES-256-GCM text operations | No browser/OS trust implication, complete RFC 5280 validation, revocation service, issuance, CMS/JWS, legacy PKCS #1/SEC1 conversion, legacy PKCS #12 PBE or general-purpose file cryptography; sensitive inputs remain bounded and memory-only, with documented temporary-buffer wiping |
|
||||
| **`barcode-tools`** | Current local-first v0.2.0 release; dedicated repository | Generate and decode QR codes and common barcodes | SVG QR, Data Matrix, PDF417, Aztec and selected linear formats; bounded image or explicit camera decode; escaped structured QR payloads; deterministic CSV batch ZIP; common GS1 AI/FNC1/date/check-digit/decimal validation; GTIN checks; physical/raster planning and print-sized SVG export | Decoded payloads remain inert text and are never opened automatically; camera is path-scoped and user initiated; generated output, GS1 allocation and print quality still require applicable interoperability checks |
|
||||
| **`network-tools`** | Current offline v0.2.0 release; dedicated repository | Calculate IP networks and construct or inspect common network values | IPv4/IPv6 canonicalization and CIDR ranges plus largest-first IPv4 VLSM; URL/query parsing with password-redacted display; DNS-record construction and bounded inert zone-file parsing; CSP and HTTP security-header analysis/builder; offline MIME reference | Performs no DNS, URL, HTTP or scanning request; pasted values remain bounded and inert; results are construction and calculation aids rather than live network observations |
|
||||
| **`geo-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, edit, convert, simplify, measure and analyse geospatial files locally | GeoJSON, GPX, KML and coordinate CSV; full Point/MultiPoint/LineString/MultiLineString/Polygon/MultiPolygon/nested GeometryCollection model; bounds, distance, elevation and simplification; validated feature/coordinate edits and line reversal; track inventory; local distance/bearing/midpoint ruler; coordinate-only sketch | Full geometry model retains scalar properties, while GPX/CSV conversion may flatten grouping; no topology repair, CRS transformation, basemap request or survey-grade claim; conversion losses are explicit |
|
||||
| **`helper-tools`** | Current v0.2.0 app and reusable package release | Encode, convert, inspect and calculate with shared bounded primitives | Base/byte/text/URL conversion; byte cursors and streams; worker jobs; Unicode and line transforms; exact numbers and units; incremental hashes; CIDR; timestamps; hardened JSON/CSV; random primitives | Framework-free `@add-ideas/toolbox-helpers` 0.2.0 is consumed directly across the Toolbox app set; operations disclose strictness, limits and non-cryptographic seeded boundaries |
|
||||
| **`rand-tools`** | Local-only v0.2.0 release; dedicated repository | Generate secure or reproducible random values through focused workspaces | Unbiased WebCrypto integers/strings; explicitly seeded deterministic generation; UUIDv4/v7 and ULID; dice, samples, shuffles, passphrases and normal values; local coin/card/date/fraction/spherical draws; exact weighted sampling; versioned executable recipes; domain-separated WebCrypto commit–reveal | Secure local generation never falls back; deterministic output is reproducible rather than secret; the app makes no third-party randomness request and the Portal grants it no external network destination |
|
||||
| **`data-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, format, query, infer schemas, edit, flatten and convert structured data | JSON, YAML 1.2, TOML, XML, CSV, TSV and NDJSON; exact JSON numbers; bounded tree/table/leaf views; JSON Pointer and safe path queries; sample-labelled JSON Schema inference; reviewed immutable RFC 6901 add/replace/remove edits; registry-backed all-format conversion with loss/coercion reports; spreadsheet-formula neutralization | Disposable bounded parser worker; rejects active XML constructs and unsafe object keys; conversions surface information loss and round-trip instability |
|
||||
| **`diff-tools`** | Current local-first v0.2.0 release; dedicated repository | Compare text and structured files, build directory manifests and perform bounded three-way merges locally | Line/word/code-point/grapheme text diff; exact-number JSON/RFC 6902; namespace-aware XML; keyed CSV/TSV; bounded directory manifests; line-oriented three-way merge; portable reports | Normalization and ignored distinctions remain visible; bounded disposable workers and two-file hash concurrency; directory comparison is manifest-based and merge conflicts remain explicit |
|
||||
| **`time-tools`** | Current local-first v0.2.0 release; dedicated repository | Convert exact timestamps, plan across IANA zones and inspect calendars, arithmetic and recurrences locally | Signed nanosecond epochs; IANA-zone/DST comparison; wall-clock versus elapsed arithmetic; explicit Unix/Vixie, GitHub Actions, Croner, Quartz and EventBridge cron dialects; RRULE previews; multi-participant meeting planner; business days; bounded ICS import with EXDATE/RDATE and recurrence overrides; escaped UTC ICS export | Uses browser IANA data and does not model leap seconds; holidays are only those supplied; custom VTIMEZONE data is inventoried but not guessed when the browser cannot execute its TZID; URLs and attachments are inert and never fetched |
|
||||
| **`text-tools`** | Current local-first v0.2.0 release; dedicated repository | Build ordered, inspectable plain-text transformation pipelines | Ordered literal/line transforms; locale case, Unicode normalization and transliteration; strict escape/decode stages; RFC-style quoted CSV column selection; explicit UTF-8, UTF-16LE and Latin-1 file decoding with byte evidence; versioned recipes and paired text/provenance artifacts | Exact source/result and per-step changes stay visible; compatibility normalization, transliteration, narrow encodings and selected transforms may be lossy; artifact evidence is portable, but automatic Toolbox handoff is not enabled in v0.2.0 |
|
||||
| **`unicode-tools`** | Current local-first v0.2.0 release; dedicated repository | Search and inspect Unicode characters, emoji, scripts, text and confusables | Checksum-pinned Unicode 17.0 catalogue and virtualized code chart; name/alias/code-point search; emoji and named sequences with bounded variant construction; UTF-8/UTF-16/escape and grapheme inspection; normalization; UTS #39 skeleton, Identifier_Status/Type and restriction evidence; selected Unihan fields; source-identity reports | Official Unicode data is redistributed under Unicode-3.0 and no symbol-site content is scraped; unassigned, private-use, noncharacter and surrogate states remain distinct; constructed emoji do not claim RGI or font support; confusable/mixed-script findings are review signals, not verdicts |
|
||||
| **`flow-tools`** | Current local-first v0.2.0 release; dedicated repository | Design and run deterministic structured-data pipelines | Bounded JSON, CSV, NDJSON and XML sources; select, rename, filter, map, sort, group, join, type-format, deduplicate, slice and explode stages; per-stage snapshots, analysis and loss notes; validated recipes plus JSON/CSV and inert pipeline-SVG export | 2 MiB sources, 10,000 input rows, 20,000 expanded rows, 200 fields, 30 stages and 256 KiB recipes; no arbitrary code, eval, plug-in or network stage |
|
||||
| **`subtitle-tools`** | Current local-first v0.2.0 release; dedicated repository | Edit, validate, synchronize, compare and convert captions | Bounded SRT, WebVTT, ASS/SSA and flat-profile TTML/DFXP; cue add/duplicate/split/merge/delete and direct editing; shift/stretch, frame-rate conversion and snapping; editorial diagnostics and index-aligned revision comparison; immediate media playback with cancellable waveform extraction and navigation; explicit UTF-8/UTF-16/Latin-1 decoding | Preserves format-specific data where possible and reports conversion loss; TTML regions, styling definitions and inherited timing are inspected but not laid out and export is a flat resource-free profile; no speech recognition, automatic alignment, semantic comparison or pixel-perfect ASS rendering |
|
||||
| **`midi-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, visualize, edit, audition and export Standard MIDI files | SMF type 0/1 events and metadata; worker-backed edit/export with progress and cancellation; tempo/time/key timelines and piano roll; paired-note editing, transpose, quantize, tempo, crop and channel operations with undo; Web Audio preview and opt-in Web MIDI output; bounded local SF2/SF3 structure inspection; deterministic MIDI/CSV/JSON export | 8 MiB, 256-track and 250,000-event caps; PPQN only; Web MIDI is permission-gated and sends channel-note messages without SysEx; SF2/SF3 is inspection-only; the bounded sine preview is not a General MIDI or SoundFont renderer |
|
||||
| **`3d-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, preview, repair and export triangle meshes | OBJ, binary/ASCII STL, ASCII/binary little-endian PLY and embedded glTF/GLB 2; selected-scene hierarchy/TRS/matrix and instancing flattening; material, node, bounds, area and degeneracy statistics; worker-backed capped WebGL preview; normal/degeneracy repair and transform baking; normalized OBJ, binary STL and ASCII PLY export | 32 MiB and one-million-vertex/triangle caps; glTF is an embedded FLOAT POSITION/NORMAL TRIANGLES subset with no external assets, sparse accessors, animation, skins, texture or compression decoding; selected-scene transforms and instances are baked into the normalized mesh, but source material graphs are not recreated |
|
||||
| **`query-tools`** | Current local-first v0.2.0 release; dedicated repository | Query structured local data through bounded row and path languages | JSON, CSV, NDJSON and inert XML with raw inference/precision evidence; parsed SQL/path syntax trees; focused SQL-like and JSONPath-like modes; optional bounded read-only DuckDB-WASM SELECT mode; table/tree/JSON views, saved queries and JSON/CSV/NDJSON export | Built-in modes are not full SQL, JSONPath or JMESPath; 2 MiB/10,000-row-or-value/200-field/200,000-node caps; DuckDB is capped at 10,000 input and 1,000 result rows, 128 MiB, 30-second startup and ten-second queries with no files, network, extensions, DDL/DML, COPY or PRAGMA; hosting needs correct WASM MIME/cache and scoped `wasm-unsafe-eval` |
|
||||
| **`scan-tools`** | Current local-first v0.2.0 release; dedicated repository | Correct photographed pages, run optional OCR and assemble local output | Up to 24 PNG/JPEG/WebP pages; precise four-corner projective correction, rotate/deskew, tonal, grayscale and threshold controls in cancellable workers with bounded fallback; drag reorder; PNG/JPEG and image-only PDF export; bundled same-origin English OCR with word geometry plus text, hOCR, TSV and combined multipage-text export | Camera is exact-path and opt-in; strict pixel/byte/page caps; English-only OCR may use roughly 100–300 MiB transient memory and is not an accuracy guarantee; no PDF input, automatic corners, handwriting guarantee, shadow/finger removal or searchable PDF text layer |
|
||||
| **`package-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect and compare ZIP/ZIP64 compound packages | ZIP/ZIP64 tree and risk diagnostics; EPUB, OOXML, ODF, JAR, APK and WebExtension adapters; relationships, manifests and orphan evidence; signature-material/digest plus dependency/licence inventories; bounded text/media preview and verified entry download/share; decompressed SHA-256 comparison with safe semantic diffs; JSON inventory export | Inspection is not a specialized renderer, APK signing-block decoder, signature/trust verifier, dependency resolver, vulnerability scanner or legal licence interpretation; encrypted, split, unsafe, unsupported and over-budget entries stay inventory-only; an explicitly chosen OS share target may upload an entry even though the app itself does not |
|
||||
| **`label-tools`** | Current local-first v0.2.0 release; dedicated repository | Merge local records into printable labels, badges and asset tags | CSV/JSON mapping; visual text/image/barcode/shape template designer with drag, keyboard and exact-unit positioning; serial/random values; ten QR/1D/2D barcode formats; stock/custom grids, calibration and marks; template JSON; paginated preview; physical-size SVG, deterministic multi-page ZIP and vector PDF export | 2 MiB/2,000-row/100-field data bounds and bounded images/pages; stock names are geometries, not vendor certification; system fonts are not embedded; vector PDF uses built-in Helvetica/WinAnsi, visibly replaces unsupported characters and omits WebP images, so it is print-dimensioned rather than archival/press quality |
|
||||
| **`font-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, compare, preview and prepare local fonts | TTF, OTF, WOFF, WOFF2, TTC and OTC metadata/tables; Unicode coverage, variable axes, GSUB/GPOS inventories and embedding signals; sandboxed shaping/fallback comparison; safe CSS; validated collection face selection; rights-confirmed static glyf/CFF subset with loss report | Disposable eight-second worker and strict file/table/face/glyph bounds; WOFF2 is decoded locally and TTC/OTC faces are reconstructed only for bounded in-memory preview; WOFF2/collection subset and collection export remain disabled; fsType is technical evidence, variable flattening is unsupported and browser shaping is not a HarfBuzz reference |
|
||||
| **`fixture-tools`** | Current local-first v0.2.0 release; dedicated repository | Generate deterministic synthetic test fixtures | Focused JSON Schema, SQL DDL, XSD, CSV-heading and portable-model import; scalar/composite uniqueness and foreign keys; dependency-topological generation with uniform, sequential, normal and constant distributions; boundary/intentional-negative cases and a violation ledger; coverage matrix; person/network/commerce provider profiles; JSON/CSV/NDJSON/XML/SQL/recipe export | Importers are documented subsets; remote references, schema code, database access, XML entities, unsupported XSD/SQL constructs and cyclic relational recipes are rejected; 2 MiB input, 20 tables, 100 fields/table, 50,000 rows, 100,000 values and 8 MiB/output caps; synthetic data is not anonymization and seeded output is reproducible, not secret |
|
||||
| **`minimize-tools`** | Current local-first v0.2.0 release; dedicated repository | Reduce failing inputs while continuously preserving a selected predicate | Line/token/code-point and structure-aware JSON/XML reduction; literal, syntax, timing, isolated-regex, focused JSON Schema and restricted local-XSLT predicates with failure-signature preservation; single/majority/strict retry voting and flaky evidence; bounded multi-file bundle adapters; budgets, cancellation and deterministic minimized-case/trace/report export | Locally minimal under attempted transformations and budget, not globally shortest; schema/XSLT subsets fail closed; 2 MiB input, 2,000-test/30-second, one-second-regex and 200-XSLT-test caps; bundles are limited to 100 files/4 MiB and adapters neither emulate a filesystem nor execute a target program |
|
||||
| **`format-lab`** | Current local-first v0.2.0 release; dedicated repository | Explore conversion paths and measure representative round-trip loss | Conservative data/image/AV/subtitle format graphs; executable JSON/NDJSON/CSV/typed-XML record conversion; property selection and loss-aware path ranking; measured round trips beside catalogue expectations; versioned evidence envelopes and catalogue export; masked-offset signature catalogue; deterministic edge-case corpus and reports | Media graphs plan handoffs rather than duplicate codecs; executable conversion handles bounded canonical records, not arbitrary documents; catalogue expectations are not file measurements; signature hits suggest likely containers but do not validate safety or format conformance; catalogue-only formats are not claimed executable |
|
||||
| **`repro-tools`** | Current local-first v0.2.0 release; dedicated repository | Build, compare, sign and package reproducible local file inventories | Cancellable streamed SHA-256/SHA-512 manifests with deterministic paths and JSON/CSV; reference comparison; fixed-metadata ZIP; streaming ZIP-content manifests and compression-independent comparison; CycloneDX/SPDX/npm-lock inventory with portable evidence and explicit non-conformant local provenance; optional memory-only P-256 signature envelope | 64 MiB/file, 256 MiB/selection and 10,000-entry caps; ZIP creation is capped at 128 MiB and inspection at 5,000 entries/256 MiB expanded; signatures prove integrity only relative to an independently authenticated public key and are intentionally not byte-reproducible; provenance makes no SLSA, authority or builder-identity claim |
|
||||
| **`schema-tools`** | Hardened local-first v0.2.0 release; dedicated repository | Inspect, validate, compare and derive examples from schema workspaces | Local JSON Schema/OpenAPI reference graphs; focused JSON Schema validation; OpenAPI operation/sample/change analysis; XSD, Relax NG and Schematron structure; bounded heuristic XML samples | Remote/escaping references, entities, code and XPath are blocked; JSON Schema/OpenAPI support is a documented subset, while XML languages receive structural inspection rather than complete instance validation; shared work/node/depth/text/output budgets, linear cached traversal and well-formed XML fallbacks are regression-tested |
|
||||
| **`log-tools`** | Current local-first v0.2.0 release; dedicated repository | Stream, inspect, correlate, redact and export large logs | Incremental UTF-8 file scan; plain, JSONL, nginx, syslog and logfmt parsing with configurable Java/.NET/Python/generic multiline assembly; whole-scan aggregates; bounded multi-file temporal merge with trace/span and request-ID correlation; search/filter and deterministic redaction; OTLP/JSON plus CSV/NDJSON/text export, including a complete cancellable second pass with direct-file or bounded-Blob output | Eight-GiB gate and five-million-line stop without whole-file strings; interactive search/redaction uses a 10,000-record/32 MiB preview, while complete single-source export reapplies filters and recipes in a second streaming pass; multi-file correlation uses explicitly bounded retained evidence; parsers and auto/multiline detection are focused heuristics |
|
||||
| **`binary-tools`** | Current local-first v0.2.0 release; dedicated repository | Convert, inspect and decode byte-oriented values | Synchronized UTF-8/hex/Base64/Base32/Base58; checked byte insert/replace/delete; exact and wildcard search with isolated-worker deadline; paged byte inspector and endian integer/float/timestamp interpretations; bookmarks and audited PNG/RIFF/ELF templates; CBOR, MessagePack, strict DER and schema-assisted Protocol Buffers | Inert with no requests or evaluation; 1 MiB input/edit/output, depth-64 and 10,000-node bounds; Base58 and search patterns are capped at 4 KiB and large searches use a five-second disposable worker; protobuf groups/full generated runtime and complete template-based format validation are out of scope |
|
||||
| **`git-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect and author Git interchange text without repository access | Unified/git patch inspection and bounded authoring; exact atomic patch apply/reverse against explicit text snapshots with JSON/ZIP export; layered `.gitignore` plus tracked-state explanations; root `.gitattributes` evaluation; SemVer ranges; Conventional Commit build/lint and advisory release plan; changelog normalization | Patch/diff-matrix/snapshot bounds; patch application is exact, atomic and text-only against an explicit local JSON snapshot; ignore analysis models layered supplied global/info/nested sources and tracked state but not command-line excludes or submodule boundaries; attribute macros/nested attribute files are unsupported; no workspace or `.git` access |
|
||||
| **`api-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect and compare HTTP and event API descriptions and check saved HTTP evidence | Bounded JSON/YAML OpenAPI 3.0–3.2 and AsyncAPI 2.0–3.1; local multi-file `$ref`; path/webhook/channel/message navigation; security inventory and focused examples; inert curl/Fetch/Python text; conservative revision comparison; HAR 1.2 coverage and focused contract checks | Never executes HTTP, opens a broker connection, follows URLs, resolves remote references or stores credentials; focused OpenAPI/AsyncAPI/JSON Schema validation, examples and HAR checks are not a complete validator, code generator, HTTP/broker client, proxy or security scanner |
|
||||
| **`mail-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, thread, compare, download and redact EML/MIME and mbox content | Original-octet EML/MIME with RFC 2047 and RFC 2231 headers; bounded multipart/nested-message tree; Base64/quoted-printable and byte-safe attachments; mbox/mboxrd threading/search; text and opaque sandboxed HTML with safe local CID images; auth-header diagnostics plus pasted-key RSA/Ed25519 DKIM verification; canonical and deeper redacted export | Remote/active HTML is removed and never loaded; no mail/DNS contact, mailbox client, decryption, sender-identity, malware or anonymity claim; local DKIM verification proves preserved bytes only against the pasted key and cannot establish that key's authenticity or currency; canonical/redacted export does not promise byte identity |
|
||||
| **`calendar-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, repair, merge and reconcile iCalendar data | RFC 5545 events, VTODO, VJOURNAL, VFREEBUSY, VALARM, attendees and VTIMEZONE; recurrence preview with moved/cancelled/duration-changing/RANGE=THISANDFUTURE overrides; duplicate/overlap diagnostics and UID/RECURRENCE-ID merge; canonical repair and DST evidence; agenda/month views, bounded event/task authoring and free-slot planning; lossless jCal and focused JSCalendar Event/Task interchange | 4 MiB plus line/component/event and recurrence-horizon caps; browser IANA data and focused recurrence interpretation are evidence, not a calendar-server implementation; JSCalendar is a focused Event/Task adapter with explicit loss warnings |
|
||||
| **`contact-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect, edit, convert and reconcile sensitive contacts | vCard 2.1/3/4 parsing, core editing and canonical export; bounded quoted-printable/Base64 decoding plus grouped and unmapped-property preservation; inferred reviewable CSV mapping; jCard and focused JSContact import/export with loss evidence; duplicate candidates, conflict-reporting merge and bounded local vCard QR | 2 MiB, 50,000-line and 2,000-contact caps; encoded properties are capped at 64 KiB and malformed encodings retain raw evidence; JSContact support is focused and unsupported values are surfaced rather than silently lost; no persistence or telemetry |
|
||||
| **`diagram-tools`** | Current local-first v0.2.0 release; dedicated repository | Author safe deterministic text diagrams and export accessible graphics | Independent script-free flow/graph, sequence, class, state, entity-relationship, mind-map and timeline grammars; line diagnostics, examples, pan/zoom, normalized JSON, deterministic SVG/2× PNG and accessible textual outline/source export | Not full Mermaid or Graphviz; directives, clicks, styles, scripts, HTML and remote assets are rejected; 50,000-character, 2,000-line, 200-node, 500-edge and 20-megapixel caps |
|
||||
| **`token-tools`** | Current local-first v0.2.0 release; dedicated repository | Edit, validate, theme and export design tokens | DTCG-style nested `$type`/`$value` JSON with inherited groups plus local sets/themes/modes; recursive aliases inside composite values with cycle/missing/type diagnostics; colour, dimension, duration, font, Bézier, stroke, border, transition, gradient, typography, shadow and scalar tokens; W3C-style JSON, CSS, Sass, Android and Swift export with collision and loss reports | The `$sets`/`$themes` wrapper is app-specific; 1 MiB, depth-64, 10,000-token and 50,000-node bounds; malformed wrappers, unknown types and token/group conflicts fail explicitly; Android/Swift composite output requires project conventions and unsupported values are reported as losses |
|
||||
| **`device-tools`** | Current local-first v0.2.0 release; dedicated repository | Inspect browser capability evidence without creating a device fingerprint | Passive context/display/input/accessibility/media/storage/PWA/API inventory; individually initiated permission, storage, WebGL/WebGPU, media-device, battery, network, camera, microphone and screen probes; pasted Toolbox-manifest compatibility analysis with required/optional/unknown capability evidence; opt-in MediaCapabilities codec lab; deterministic bucketed JSON/CSV reports | No identifier, uniqueness score, high-entropy report, recording, persistence, canvas/audio fingerprint or passive permission prompt; sensitive probes are exact-path and individually initiated, returned tracks stop immediately, and downloaded reports bucket precision; results are capability evidence, not a reliability guarantee |
|
||||
|
||||
## Planned tools
|
||||
|
||||
|
||||
Reference in New Issue
Block a user