release: publish toolbox aggregate 0.3.1

.env.example

@@ -0,0 +1,8 @@
+# Optional overrides for compose.yaml. Its defaults already match production.
+TOOLBOX_HOST=toolbox.add-ideas.de
+TRAEFIK_NETWORK=internal
+TRAEFIK_CERT_RESOLVER=netcup
+
+# Keep these two values paired when deploying a newer published toolbox release.
+TOOLBOX_RELEASE_VERSION=0.3.1
+TOOLBOX_RELEASE_SHA256=41d0f99ffa1a88a6b9cfd5f6a6ca2823a96c0a53cec5ee2a42a688de30b12465

.gitignore

@@ -5,4 +5,5 @@ artifacts/
 coverage/
 public/THIRD_PARTY_LICENSES.txt
 *.log
+.env
 .DS_Store

.prettierrc.json

@@ -2,5 +2,13 @@
   "singleQuote": true,
   "semi": true,
   "trailingComma": "es5",
-  "printWidth": 80
+  "printWidth": 80,
+  "overrides": [
+    {
+      "files": "compose.yaml",
+      "options": {
+        "singleQuote": false
+      }
+    }
+  ]
 }

Containerfile.release

@@ -0,0 +1,34 @@
+ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded39ff65e010ae4f831be18f19356f83c60bc546492c7eb6dd23
+
+FROM ${NGINX_IMAGE} AS release
+
+ARG TOOLBOX_RELEASE_VERSION=0.3.1
+ARG TOOLBOX_RELEASE_SHA256=41d0f99ffa1a88a6b9cfd5f6a6ca2823a96c0a53cec5ee2a42a688de30b12465
+ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/zemion/toolbox-portal/releases/download
+
+RUN set -eu; \
+    archive="add-ideas-toolbox-${TOOLBOX_RELEASE_VERSION}.zip"; \
+    curl --fail --location --silent --show-error --proto '=https' \
+      --proto-redir '=https' --tlsv1.2 \
+      --output "/tmp/${archive}" \
+      "${TOOLBOX_RELEASE_BASE_URL}/v${TOOLBOX_RELEASE_VERSION}/${archive}"; \
+    echo "${TOOLBOX_RELEASE_SHA256}  /tmp/${archive}" | sha256sum -c -; \
+    mkdir -p /tmp/toolbox; \
+    unzip -q "/tmp/${archive}" -d /tmp/toolbox; \
+    test -f /tmp/toolbox/index.html; \
+    test -f /tmp/toolbox/toolbox.catalog.json; \
+    test -f /tmp/toolbox/toolbox.release.json; \
+    test -f /tmp/toolbox/apps/pdf/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/xslt/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/onenote/toolbox-app.json; \
+    rm "/tmp/${archive}"
+
+FROM ${NGINX_IMAGE}
+
+COPY --chown=101:101 deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=release --chown=101:101 /tmp/toolbox/ /usr/share/nginx/html/
+
+USER 101:101
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget --quiet --spider http://127.0.0.1:8080/toolbox.catalog.json || exit 1

README.md

@@ -34,8 +34,9 @@ the SDK and portal together.
 
 Vite uses `base: './'`, so the built portal works at `/` or a nested static path.
 The development catalogue at `public/toolbox.catalog.json` points to assembled
-paths (`./apps/pdf/` and `./apps/xslt/`). Those manifests will correctly appear
-as unavailable until an assembled release is being served.
+paths (`./apps/pdf/`, `./apps/xslt/`, and `./apps/onenote/`). Those manifests
+will correctly appear as unavailable until an assembled release is being
+served.
 
 ## Catalogue and launches
 
@@ -62,6 +63,43 @@ transmit preferences. Because Toolbox apps share an origin, code explicitly
 trusted in an app can access same-origin browser storage; review each app's
 privacy and executable-code warning. Light, dark, and system modes are supported.
 
+## Production deployment behind Traefik
+
+The committed `compose.yaml` is the shortest production path. Its release
+container downloads the immutable Toolbox 0.3.1 ZIP during the image build,
+verifies SHA-256 before extracting it, and then copies only the verified static
+files into the pinned unprivileged nginx image. Node.js and a local portal
+assembly are not required on the deployment host.
+
+Prerequisites:
+
+- Docker with the Compose plugin;
+- Traefik attached to the existing external Docker network `internal`;
+- a Traefik HTTPS entrypoint named `websecure`;
+- a certificate resolver named `netcup`;
+- DNS for `toolbox.add-ideas.de` pointing to that Traefik instance; and
+- outbound HTTPS access to `git.add-ideas.de` while the image is built.
+
+Deploy a fresh clone with:
+
+```sh
+git clone https://git.add-ideas.de/zemion/toolbox-portal.git
+cd toolbox-portal
+docker compose up -d --build
+docker compose ps
+```
+
+No host port is published. Traefik routes
+`https://toolbox.add-ideas.de` to nginx on the shared network at port 8080 and
+obtains its TLS certificate through `netcup`. The hostname, network, resolver,
+release version, and matching checksum can be overridden through environment
+variables; copy `.env.example` to `.env` only when an override is needed. For
+example, set `TOOLBOX_HOST=staging.toolbox.add-ideas.de` for a staging host.
+
+The external network is deliberately not created by this project. Creating a
+private project-local network would prevent an independently managed Traefik
+container from reaching the service.
+
 ## Exact release assembly
 
 Every app release ZIP must put these items at its archive root:
@@ -79,8 +117,9 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.
 
-`release/toolbox.lock.json` is the reviewed v0.1.0 lock. Its URLs and checksums
-pin the published PDF Tools 0.3.4 and XSLT Tools 0.3.2 release bytes. Use
+`release/toolbox.lock.json` is the reviewed v0.3.1 lock. Its URLs and checksums
+pin the published PDF Tools 0.3.4, XSLT Tools 0.3.2, and OneNote Tools 0.2.1
+release bytes. Use
 `release/toolbox.lock.example.json` as the template for a future release and
 verify every downloaded asset before committing updated values. Artifacts may be:
 
@@ -101,7 +140,7 @@ npm run assemble -- \
   --lock release/toolbox.lock.json \
   --portal-dist dist \
   --output build/toolbox \
-  --archive build/add-ideas-toolbox-0.1.0.zip
+  --archive build/add-ideas-toolbox-0.3.1.zip
 ```
 
 Existing output is refused. Pass `--force` only when replacing those exact
@@ -118,10 +157,11 @@ build/toolbox/
 ├── THIRD_PARTY_NOTICES.md
 └── apps/
     ├── pdf/
-    └── xslt/
+    ├── xslt/
+    └── onenote/
 
-build/add-ideas-toolbox-0.1.0.zip
-build/add-ideas-toolbox-0.1.0.zip.sha256
+build/add-ideas-toolbox-0.3.1.zip
+build/add-ideas-toolbox-0.3.1.zip.sha256
 ```
 
 The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -142,12 +182,12 @@ directory separately:
 ```sh
 npm run package:static -- \
   --input build/toolbox \
-  --output artifacts/add-ideas-toolbox-0.1.0.zip
+  --output artifacts/add-ideas-toolbox-0.3.1.zip
 ```
 
 This also emits a `.sha256` sidecar.
 
-## Container image
+## Local assembled container and publication
 
 `Containerfile` serves only the assembled files with unprivileged nginx on port 8080. It adds restrictive browser headers, same-origin isolation, immutable
 caching only for Vite-hashed assets, and revalidation for all other files.
@@ -159,13 +199,16 @@ normal local XML/XSLT transformations do not require that permission.
 
 ```sh
 podman build -f Containerfile \
-  -t git.add-ideas.de/zemion/toolbox:0.1.0 .
+  -t git.add-ideas.de/zemion/toolbox:0.3.1 .
 podman run --rm -p 8080:8080 \
-  git.add-ideas.de/zemion/toolbox:0.1.0
+  git.add-ideas.de/zemion/toolbox:0.3.1
 ```
 
-For a local deployment, copy `compose.example.yaml` to `compose.yaml` and run
-`docker compose up --build -d` (or the Podman Compose equivalent).
+For a direct-port local deployment after assembly, use the separate example:
+
+```sh
+docker compose -f compose.example.yaml up -d --build
+```
 
 Publish both common architectures from a buildx-enabled workstation or Gitea
 runner:
@@ -174,9 +217,9 @@ runner:
 docker login git.add-ideas.de
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
-  --file Containerfile \
-  --tag git.add-ideas.de/zemion/toolbox:0.1.0 \
-  --tag git.add-ideas.de/zemion/toolbox:0.1 \
+  --file Containerfile.release \
+  --tag git.add-ideas.de/zemion/toolbox:0.3.1 \
+  --tag git.add-ideas.de/zemion/toolbox:0.3 \
   --push .
 ```
 
@@ -198,10 +241,11 @@ permission to push code, releases, and container packages.
 3. Verify downloaded app assets with `sha256sum -c <asset>.sha256`; copy those
    exact values into a reviewed toolbox lock.
 4. Run the assembler and serve `build/toolbox` from a nested test path. Open
-   both apps, switch between them, and confirm the encoded `toolbox` context.
+   all three apps, switch between them, and confirm the encoded `toolbox`
+   context.
 5. Verify the distribution with
-   `(cd build && sha256sum -c add-ideas-toolbox-0.1.0.zip.sha256)`.
-6. Commit the reviewed lock, tag the portal source (for example `v0.1.0`), and
+   `(cd build && sha256sum -c add-ideas-toolbox-0.3.1.zip.sha256)`.
+6. Commit the reviewed lock, tag the toolbox release (for example `v0.3.1`), and
    push the branch and tag to Gitea.
 7. In Gitea, open **Releases → New release**, select the tag, and upload the
    static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -214,6 +258,58 @@ the exact tag, install with `npm ci`, run the same verification/assembly command
 and upload only the already-created ZIP/checksum and OCI image. The workflow
 must not re-resolve app versions or substitute a newer release.
 
+## Planned / existing tools
+
+| Tool                 | State and boundary                                           | Principal workflows                                                                                                                                                                       | Important concrete scope                                                                                                                                                          | Critical considerations and integrations                                                                                                                                                                          |
+| -------------------- | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`pdf-tools`**      | Existing; dedicated repository                               | Merge, split, reorder, rotate and export PDF pages                                                                                                                                        | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                         | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                       |
+| **`xslt-tools`**     | Existing; dedicated repository                               | Develop, test and run XSLT transformations                                                                                                                                                | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                 | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                        |
+| **`svg-tools`**      | Planned; dedicated repository                                | Source and visual SVG editing                                                                                                                                                             | Synchronized DOM tree, code and canvas; optimization; path simplification; symbols; accessibility; animation; sanitization                                                        | SVG is potentially active content; previews require sanitization or sandboxing; integrate with `colour-tools`, `token-tools`, `image-tools` and `label-tools`                                                     |
+| **`regex-tools`**    | Planned; dedicated repository                                | Develop, test and apply regular expressions                                                                                                                                               | Corpus mode; replacement preview; capture table; flavour comparison; performance visualization; generated test cases; failing-input minimization                                  | Never claim exact equivalence across regex engines without qualification; bound execution; integrate with `text-tools`, `log-tools` and `minimize-tools`                                                          |
+| **`colour-tools`**   | Planned; small-to-medium dedicated repository                | Colour conversion, calculation and palette work                                                                                                                                           | sRGB, Display P3, Lab, LCH, OKLab and OKLCH; gamut mapping; contrast; colour-vision simulation; gradients; palette extraction; design-token export                                | Make colour-space assumptions explicit; distinguish mathematical conversion from display simulation; integrate with SVG, image and token tools                                                                    |
+| **`rand-tools`**     | Planned; small dedicated repository                          | Generate random numbers, strings, identifiers and samples                                                                                                                                 | Cryptographically secure generation; deterministic seeded generation; UUIDs, ULIDs, passphrases, dice notation, distributions, weighted selection and shuffling                   | Clearly separate secure randomness from reproducible pseudorandomness; no misleading “strength” claims; natural foundation for `fixture-tools`                                                                    |
+| **`barcode-tools`**  | Planned; dedicated repository                                | Generate, inspect and decode QR and barcodes                                                                                                                                              | QR, common one- and two-dimensional codes; camera/image decoding; GS1 assistance; CSV batch generation; quiet-zone and print-size checks; structured payload builders             | Treat decoded payloads as untrusted; never open links automatically; camera permission must be optional; integrate with `label-tools`, `contact-tools` and `crypto-tools`                                         |
+| **`av-tools`**       | Planned; large dedicated repository                          | Light audio and video editing and transcoding                                                                                                                                             | Trim, split, concatenate, crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, thumbnail/contact-sheet generation and export presets                          | Heavy WASM and worker workloads; temporary-file storage; configurable memory limits; possibly special cross-origin-isolation headers; integrate with `subtitle-tools` and `image-tools`                           |
+| **`crypto-tools`**   | Planned; dedicated repository                                | Inspect keys, certificates and signatures; validate chains                                                                                                                                | X.509 PEM/DER, CSR, CRL, PKCS #8, encrypted PKCS #8, PKCS #12/PFX, JWK/JWKS; key/certificate matching; path construction; hostname, purpose and time checks; CMS/JWS later        | Inspection-first; explicit trust anchors; no implication that browser/OS trust stores are used; no private-key persistence; offline revocation first; network checks opt-in; restrictive CSP and worker isolation |
+| **`onenote-tools`**  | Existing rich-reader release; dedicated repository           | Open, browse, inspect and export OneNote sections and packages locally                                                                                                                    | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                               |
+| **`data-tools`**     | High priority; dedicated repository                          | Inspect, edit, validate, query and convert structured data                                                                                                                                | JSON, YAML, TOML, XML, CSV and NDJSON; tree/table/source views; schema inference; flattening; filtering; field mapping; JSONPath-style queries; conversion recipes                | Every conversion should disclose information loss, coercion and round-trip instability; XML-specialist workflows hand off to `xslt-tools`                                                                         |
+| **`image-tools`**    | High priority; dedicated repository                          | Edit and batch-process raster images                                                                                                                                                      | Crop, resize, rotate, compress, convert, contact sheets, sprites, responsive sets, favicon generation, metadata removal and visual quality comparison                             | Use workers and off-main-thread rendering; preserve or deliberately remove colour profiles; integrate with colour, SVG, PDF and privacy tools                                                                     |
+| **`diff-tools`**     | High priority; dedicated repository or shared engine plus UI | Compare documents and files semantically                                                                                                                                                  | Text; JSON object-aware comparison; XML normalization; CSV keyed comparison; images with overlay/heatmap; archives and directories; PDF pages; optional audio waveform comparison | Normalization and ignored properties must be visible; produce portable reports and standard patch formats where possible                                                                                          |
+| **`file-tools`**     | High priority; dedicated repository                          | Identify, inspect and organize local files                                                                                                                                                | Magic-byte detection; hex view; decoded strings; checksums; directory manifests; split/join; duplicate detection; trailing-data detection; batch-rename preview                   | All inputs are untrusted; format inspectors require strict size and nesting limits; natural entry point to archive, privacy, crypto and package tools                                                             |
+| **`archive-tools`**  | Medium-to-high priority; dedicated repository                | Inspect, create, compare and extract archives                                                                                                                                             | ZIP, TAR, gzip and selected additional formats; selective extraction; content preview; deterministic archives; timestamp normalization; archive comparison                        | Expansion-ratio, entry-count and total-size limits; traversal-safe extraction; never execute extracted files                                                                                                      |
+| **`text-tools`**     | Medium priority; one app with deep-linked panels             | Transform and normalize plain text                                                                                                                                                        | Unicode normalization; line-ending conversion; encoding; sorting; deduplication; case changes; transliteration; escaping; column operations; transformation pipelines             | Preserve exact input/output visibility; warn about lossy encodings and Unicode confusables; integrate regex operations                                                                                            |
+| **`query-tools`**    | High-value but large; dedicated repository                   | Analyse local tabular and relational data with SQL                                                                                                                                        | CSV, JSON, NDJSON, Parquet and SQLite; schema inference; joins; aggregation; pivots; charts; export to common data formats                                                        | WASM memory and streaming; distinguish this analytical product from document-oriented `data-tools`; query work must remain local                                                                                  |
+| **`privacy-tools`**  | High priority; dedicated repository                          | Inspect and remove metadata before sharing                                                                                                                                                | EXIF and GPS; document author/comments; embedded thumbnails; PDF metadata and attachments; hidden package entries; AV tags; personal filenames; structured safe-sharing report    | Never promise absolute anonymity; explicitly state inspected, removed, preserved and unsupported structures; integrate with most file-oriented apps                                                               |
+| **`time-tools`**     | Medium priority; small dedicated app or helper family        | Work with dates, timestamps, time zones and recurrences                                                                                                                                   | Unix timestamps; date arithmetic; durations; ISO 8601; timezone comparison; cron; RRULE; ICS generation; business days; DST-transition visualization                              | Visualize actual recurrence instances and ambiguous/skipped local times; do not rely on simplified fixed-offset calculations                                                                                      |
+| **`subtitle-tools`** | Medium priority; dedicated repository                        | Edit, validate and synchronize captions                                                                                                                                                   | SRT, WebVTT and ASS; timing shifts; stretching; frame-rate conversion; overlap and reading-speed checks; waveform synchronization; revision comparison                            | Direct integration with `av-tools`; preserve style information when supported and disclose conversion losses                                                                                                      |
+| **`font-tools`**     | Medium priority; dedicated repository                        | Inspect, preview and prepare fonts                                                                                                                                                        | Glyph coverage; variable axes; metadata; fallback comparison; subsetting; CSS generation; arbitrary-text previews                                                                 | Font licensing and embedding restrictions must be visible; use untrusted-font isolation and strict parser limits                                                                                                  |
+| **`label-tools`**    | Medium priority; dedicated repository                        | Generate labels and badges from templates and data                                                                                                                                        | CSV/JSON merge into SVG templates; QR/barcode fields; serial numbers; A4 label sheets; badges; asset tags; cut marks; calibration                                                 | Strong suite demonstration linking data, SVG, barcode, random and PDF capabilities; print dimensions must be explicit and testable                                                                                |
+| **`flow-tools`**     | Later platform layer                                         | Compose local processing operations across tools                                                                                                                                          | Example: CSV → filter → QR generation → SVG template → PDF → ZIP; reusable recipes; typed inputs and outputs; progress and cancellation                                           | Do not load complete React applications into one runtime; expose separate worker-safe operation packages only after several apps have stable operations                                                           |
+| **`fixture-tools`**  | Medium priority                                              | Generate deterministic test data                                                                                                                                                          | JSON Schema, XSD, SQL DDL, CSV headings or interactive models to JSON, CSV, XML, SQL and NDJSON; foreign keys; distributions; boundary and invalid cases                          | Seeded reproducibility; uniqueness constraints; privacy-safe synthetic data; natural extension of `rand-tools`                                                                                                    |
+| **`minimize-tools`** | Distinctive specialist tool                                  | Reduce a failing input while preserving a failure                                                                                                                                         | Minimize XML triggering an XSLT error; shortest regex pathological input; smallest JSON schema failure; selectable failure predicates                                             | Expensive repeated execution must be bounded and cancellable; record the exact predicate and transformation versions                                                                                              |
+| **`format-lab`**     | Later, distinctive product                                   | Explore conversion paths and information loss                                                                                                                                             | Format graph; round-trip tests; property preservation; type coercion; metadata loss; recommended path selection across data, image, AV and subtitle formats                       | No conversion should be described as lossless without testing relevant properties                                                                                                                                 |
+| **`repro-tools`**    | Medium-to-later                                              | Create manifests and provenance records                                                                                                                                                   | File hashes; directory manifests; operation history; tool/version/parameter records; deterministic package creation; verification reports                                         | Useful foundation for reproducible workflows and signed manifests; integrates with crypto, archive and flow tools                                                                                                 |
+| **`package-tools`**  | Medium priority                                              | Inspect compound and package-based formats                                                                                                                                                | EPUB; DOCX/XLSX/PPTX; ODF; JAR; APK; browser extensions; package trees; manifests; relationships; embedded media; signatures; orphaned parts                                      | Generic container inspector with format adapters; complements rather than replaces `onenote-tools`, `epub-tools` and `office-tools`                                                                               |
+| **`schema-tools`**   | Dedicated specialist app                                     | Validate, inspect and generate examples for JSON Schema, XSD, Relax NG, Schematron and OpenAPI; visualize references and incompatibilities                                                |                                                                                                                                                                                   |
+| **`log-tools`**      | Dedicated app                                                | Stream and filter large logs; parse common formats; correlate records; build timelines; extract fields; anonymize values; avoid loading the complete file into memory                     |                                                                                                                                                                                   |
+| **`network-tools`**  | Helper family or small app                                   | IPv4/IPv6 subnetting; CIDR ranges; URL and query parsing; DNS-record construction; HTTP headers; CSP generation; MIME lookup; avoid turning it into an intrusive scanner                  |                                                                                                                                                                                   |
+| **`binary-tools`**   | Dedicated specialist app                                     | Base64, hexadecimal, CBOR, MessagePack, ASN.1 and Protocol Buffers; schema-assisted decoding; byte-range highlighting; strict depth and size limits                                       |                                                                                                                                                                                   |
+| **`git-tools`**      | Small-to-medium app                                          | Patch inspection and editing; `.gitignore` testing; semantic-version comparison; conventional commits; changelog normalization; no repository-hosting dependency                          |                                                                                                                                                                                   |
+| **`api-tools`**      | Medium app                                                   | OpenAPI validation; request and response examples; curl and client-command generation; saved HTTP-exchange inspection; direct browser requests remain subject to CORS                     |                                                                                                                                                                                   |
+| **`calendar-tools`** | Small-to-medium app                                          | ICS inspection, merging, deduplication, repair, recurrence visualization and timezone diagnostics                                                                                         |                                                                                                                                                                                   |
+| **`contact-tools`**  | Small-to-medium app                                          | vCard inspection and editing; CSV mapping; deduplication; contact QR generation; treat all contact data as sensitive                                                                      |                                                                                                                                                                                   |
+| **`mail-tools`**     | Medium app                                                   | EML and MIME inspection; header analysis; attachment extraction; body-part comparison; HTML mail must be heavily sandboxed                                                                |                                                                                                                                                                                   |
+| **`epub-tools`**     | Medium app                                                   | EPUB inspection, metadata and cover editing, link validation, chapter extraction and structural repair; sanitize embedded HTML and SVG                                                    |                                                                                                                                                                                   |
+| **`scan-tools`**     | Large app                                                    | Camera/document correction; crop, deskew and threshold; page assembly; local OCR; PDF output; model downloads and memory use must be explicit                                             |                                                                                                                                                                                   |
+| **`office-tools`**   | Medium-to-large app                                          | Inspect rather than reproduce an office suite: package structure, relationships, metadata, comments, embedded images and basic repairs                                                    |                                                                                                                                                                                   |
+| **`geo-tools`**      | Medium app                                                   | GeoJSON, GPX, KML and coordinate CSV; format conversion; track simplification; distance/elevation analysis; coordinate-reference assumptions must be explicit                             |                                                                                                                                                                                   |
+| **`diagram-tools`**  | Medium app                                                   | Code and visual editing for Mermaid, Graphviz and related representations; renderers require sanitization and sandboxing                                                                  |                                                                                                                                                                                   |
+| **`token-tools`**    | Small-to-medium app                                          | Design-token editing and conversion between JSON, CSS custom properties, Sass, Android and iOS forms; integrate with colour and SVG tools                                                 |                                                                                                                                                                                   |
+| **`3d-tools`**       | Large specialist app                                         | Inspect STL, OBJ and glTF; dimensions, bounding boxes, mesh simplification and common geometry defects; worker/GPU use and file limits                                                    |                                                                                                                                                                                   |
+| **`midi-tools`**     | Medium specialist app                                        | MIDI event inspection and editing; transpose, quantize, tempo maps and controller data; device access should remain optional                                                              |                                                                                                                                                                                   |
+| **`device-tools`**   | Specialist app                                               | Serial terminal, sensor logger, microcontroller console and controlled firmware installation; explicit permission and browser-capability checks                                           |                                                                                                                                                                                   |
+| **`helpers-tools`**  | One shared artifact with deep links                          | Stateless Base64, URL encoding, case conversion, number bases, Unicode code points, unit conversion, small checksums, subnet and timestamp calculators; avoid a repository per calculator |                                                                                                                                                                                   |
+
 ## Licensing
 
 Portal source is `AGPL-3.0-only`; see `LICENSE`. The contract is Apache-2.0, and

compose.example.yaml

@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: Containerfile
-    image: git.add-ideas.de/zemion/toolbox:0.1.0
+    image: git.add-ideas.de/zemion/toolbox:0.3.1
     restart: unless-stopped
     read_only: true
     ports:

compose.yaml

@@ -0,0 +1,38 @@
+name: addideas-toolbox
+
+services:
+  toolbox:
+    build:
+      context: .
+      dockerfile: Containerfile.release
+      args:
+        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.3.1}"
+        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-41d0f99ffa1a88a6b9cfd5f6a6ca2823a96c0a53cec5ee2a42a688de30b12465}"
+    image: "git.add-ideas.de/zemion/toolbox:${TOOLBOX_RELEASE_VERSION:-0.3.1}"
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,mode=1777
+      - /var/cache/nginx:size=16m,uid=101,gid=101
+      - /var/run:size=1m,uid=101,gid=101
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    networks:
+      - internal
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "${TRAEFIK_NETWORK:-internal}"
+      traefik.http.routers.addideas-toolbox.rule: "Host(`${TOOLBOX_HOST:-toolbox.add-ideas.de}`)"
+      traefik.http.routers.addideas-toolbox.priority: 900
+      traefik.http.routers.addideas-toolbox.entrypoints: websecure
+      traefik.http.routers.addideas-toolbox.tls: "true"
+      traefik.http.routers.addideas-toolbox.tls.certresolver: "${TRAEFIK_CERT_RESOLVER:-netcup}"
+      traefik.http.routers.addideas-toolbox.service: addideas-toolbox
+      traefik.http.services.addideas-toolbox.loadbalancer.server.port: "8080"
+
+networks:
+  internal:
+    external: true
+    name: "${TRAEFIK_NETWORK:-internal}"

deploy/nginx.conf

@@ -1,6 +1,6 @@
 map $uri $toolbox_cache_control {
   default "no-cache";
-  ~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\.[^/]+$ "public, max-age=31536000, immutable";
+  "~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\.[^/]+$" "public, max-age=31536000, immutable";
 }
 
 server {

index.html

@@ -7,7 +7,7 @@
     <meta name="theme-color" content="#172554" />
     <meta
       name="description"
-      content="A privacy-transparent browser toolbox for PDF and XSLT workflows."
+      content="A privacy-transparent browser toolbox for PDF, XSLT, and OneNote workflows."
     />
     <link rel="icon" href="./favicon.svg" type="image/svg+xml" />
     <title>add·ideas Toolbox</title>

public/toolbox.catalog.json

@@ -16,6 +16,10 @@
     {
       "manifest": "./apps/xslt/toolbox-app.json",
       "enabled": true
+    },
+    {
+      "manifest": "./apps/onenote/toolbox-app.json",
+      "enabled": true
     }
   ]
 }

release/toolbox.lock.example.json

@@ -1,7 +1,7 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.1.0",
+  "releaseVersion": "0.3.1",
   "portalVersion": "0.1.0",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
@@ -26,6 +26,13 @@
       "artifact": "https://git.add-ideas.de/zemion/xslt-tools/releases/download/v0.3.2/xslt-tools-0.3.2.zip",
       "sha256": "e1746ac60f7143037ce77d7f04c62f7da39a92d8cef42e7167acb2bc00786de1",
       "target": "xslt"
+    },
+    {
+      "id": "de.add-ideas.onenote-tools",
+      "version": "0.2.1",
+      "artifact": "https://git.add-ideas.de/zemion/onenote-tools/releases/download/v0.2.1/onenote-tools-0.2.1.zip",
+      "sha256": "be76b1086f709e6ede4891698c0bcc4b5a23a5665d37fbb860463b9a61b37989",
+      "target": "onenote"
     }
   ]
 }

release/toolbox.lock.json

@@ -1,7 +1,7 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.1.0",
+  "releaseVersion": "0.3.1",
   "portalVersion": "0.1.0",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
@@ -26,6 +26,13 @@
       "artifact": "https://git.add-ideas.de/zemion/xslt-tools/releases/download/v0.3.2/xslt-tools-0.3.2.zip",
       "sha256": "e1746ac60f7143037ce77d7f04c62f7da39a92d8cef42e7167acb2bc00786de1",
       "target": "xslt"
+    },
+    {
+      "id": "de.add-ideas.onenote-tools",
+      "version": "0.2.1",
+      "artifact": "https://git.add-ideas.de/zemion/onenote-tools/releases/download/v0.2.1/onenote-tools-0.2.1.zip",
+      "sha256": "be76b1086f709e6ede4891698c0bcc4b5a23a5665d37fbb860463b9a61b37989",
+      "target": "onenote"
     }
   ]
 }

scripts/deployment.test.ts

@@ -0,0 +1,76 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+const projectRoot = process.cwd();
+const compose = readFileSync(path.join(projectRoot, 'compose.yaml'), 'utf8');
+const containerfile = readFileSync(
+  path.join(projectRoot, 'Containerfile.release'),
+  'utf8'
+);
+const nginxConfig = readFileSync(
+  path.join(projectRoot, 'deploy', 'nginx.conf'),
+  'utf8'
+);
+const releaseLock = JSON.parse(
+  readFileSync(path.join(projectRoot, 'release', 'toolbox.lock.json'), 'utf8')
+) as { releaseVersion: string };
+
+describe('production deployment', () => {
+  it('keeps the release version and checksum pins synchronized', () => {
+    const containerVersion = containerfile.match(
+      /^ARG TOOLBOX_RELEASE_VERSION=(\S+)$/mu
+    )?.[1];
+    const composeVersion = compose.match(
+      /\$\{TOOLBOX_RELEASE_VERSION:-([^}]+)\}/u
+    )?.[1];
+    const containerChecksum = containerfile.match(
+      /^ARG TOOLBOX_RELEASE_SHA256=([a-f0-9]{64})$/mu
+    )?.[1];
+    const composeChecksum = compose.match(
+      /\$\{TOOLBOX_RELEASE_SHA256:-([a-f0-9]{64})\}/u
+    )?.[1];
+
+    expect(containerVersion).toBe(releaseLock.releaseVersion);
+    expect(composeVersion).toBe(containerVersion);
+    expect(composeChecksum).toBe(containerChecksum);
+  });
+
+  it('verifies the release before extraction and retains a rootless final image', () => {
+    expect(containerfile).toContain("--proto-redir '=https' --tlsv1.2");
+    expect(containerfile.indexOf('sha256sum -c -')).toBeGreaterThan(0);
+    expect(containerfile.indexOf('unzip -q')).toBeGreaterThan(
+      containerfile.indexOf('sha256sum -c -')
+    );
+    expect(containerfile).toContain(
+      'COPY --from=release --chown=101:101 /tmp/toolbox/'
+    );
+    expect(containerfile).toMatch(/\nUSER 101:101\nEXPOSE 8080\n/u);
+  });
+
+  it('uses only the requested external Traefik network and HTTPS router', () => {
+    expect(compose).toContain('dockerfile: Containerfile.release');
+    expect(compose).toContain('traefik.enable: "true"');
+    expect(compose).toContain(
+      'traefik.docker.network: "${TRAEFIK_NETWORK:-internal}"'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-toolbox.rule: "Host(`${TOOLBOX_HOST:-toolbox.add-ideas.de}`)"'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-toolbox.entrypoints: websecure'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-toolbox.tls.certresolver: "${TRAEFIK_CERT_RESOLVER:-netcup}"'
+    );
+    expect(compose).toContain('external: true');
+    expect(compose).not.toMatch(/^\s+ports:/mu);
+  });
+
+  it('quotes nginx regular expressions that contain brace quantifiers', () => {
+    expect(nginxConfig).toContain(
+      '"~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\\.[^/]+$"'
+    );
+    expect(nginxConfig).not.toMatch(/^\s*~[^\n]*\{\d/mu);
+  });
+});