feat: publish Toolbox 0.18.0 with sixteen new tools

.env.example

@@ -5,5 +5,5 @@ TRAEFIK_NETWORK=internal
 TRAEFIK_CERT_RESOLVER=netcup
 
 # Keep these two values paired when deploying a newer published toolbox release.
-TOOLBOX_RELEASE_VERSION=0.14.0
+TOOLBOX_RELEASE_VERSION=0.18.0
-TOOLBOX_RELEASE_SHA256=e79f4aadfce3222855a3829805e72ebe399ce863df5e2b57ea0bd606139c2d6d
+TOOLBOX_RELEASE_SHA256=77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c

Containerfile.release

@@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3
 
 FROM ${NGINX_IMAGE} AS release
 
-ARG TOOLBOX_RELEASE_VERSION=0.14.0
+ARG TOOLBOX_RELEASE_VERSION=0.18.0
-ARG TOOLBOX_RELEASE_SHA256=e79f4aadfce3222855a3829805e72ebe399ce863df5e2b57ea0bd606139c2d6d
+ARG TOOLBOX_RELEASE_SHA256=77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c
 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download
 
 RUN set -eu; \
@@ -26,6 +26,24 @@ RUN set -eu; \
     test -f /tmp/toolbox/apps/svg/toolbox-app.json; \
     test -f /tmp/toolbox/apps/auth/toolbox-app.json; \
     test -f /tmp/toolbox/apps/sudoku/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/colour/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/office/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/image/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/file/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/epub/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/archive/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/privacy/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/crypto/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/barcode/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/network/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/geo/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/helper/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/rand/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/data/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/diff/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/time/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/text/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/unicode/toolbox-app.json; \
     rm "/tmp/${archive}"
 
 FROM ${NGINX_IMAGE}

README.md

@@ -1,7 +1,7 @@
 # add·ideas Toolbox Portal
 
 `toolbox-portal` is the static launcher and release assembler for the add·ideas
-browser toolbox. Version `0.2.16` reads one same-origin catalogue, shows each app
+browser toolbox. Version `0.2.20` reads one same-origin catalogue, shows each app
 as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
 visibility, and appearance in the current browser. Pinned tools have their own
 section; search, category, and clickable tag filters stay close to the tool
@@ -37,7 +37,12 @@ the SDK and portal together.
 Vite uses `base: './'`, so the built portal works at `/` or a nested static path.
 The development catalogue at `public/toolbox.catalog.json` points to assembled
 paths (`./apps/pdf/`, `./apps/xslt/`, `./apps/onenote/`, `./apps/av/`,
-`./apps/regex/`, `./apps/svg/`, `./apps/auth/`, and `./apps/sudoku/`).
+`./apps/regex/`, `./apps/svg/`, `./apps/auth/`, `./apps/sudoku/`,
+`./apps/colour/`, `./apps/office/`, `./apps/image/`, `./apps/file/`,
+`./apps/epub/`, `./apps/archive/`, `./apps/privacy/`, `./apps/crypto/`,
+`./apps/barcode/`, `./apps/network/`, `./apps/geo/`, `./apps/helper/`,
+`./apps/rand/`, `./apps/data/`, `./apps/diff/`, `./apps/time/`,
+`./apps/text/`, and `./apps/unicode/`).
 Those manifests will correctly appear as unavailable until an assembled release
 is being served.
 
@@ -69,7 +74,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
 ## Production deployment behind Traefik
 
 The committed `compose.yaml` is the shortest production path. Its release
-container downloads the immutable Toolbox 0.14.0 ZIP during the image build,
+container downloads the immutable Toolbox 0.18.0 ZIP during the image build,
 verifies SHA-256 before extracting it, and then copies only the verified static
 files into the pinned unprivileged nginx image. Node.js and a local portal
 assembly are not required on the deployment host.
@@ -133,10 +138,14 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.
 
-`release/toolbox.lock.json` is the reviewed v0.14.0 lock. Its URLs and checksums
+`release/toolbox.lock.json` is the reviewed Toolbox v0.18.0 / Portal v0.2.20
-pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4,
+lock. Its URLs and checksums pin the published PDF Tools 0.4.4, XSLT Tools
+0.4.3, OneNote Tools 0.3.4,
 Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, OTP & Passkey
-Tools 0.3.0, and Sudoku Tools 0.1.0 release bytes. Use
+Tools 0.3.0, Sudoku Tools 0.2.1, Colour Tools 0.1.0, Office Tools 0.1.0,
+and the initial 0.1.0 releases of Image, File, EPUB, Archive, Privacy, Crypto,
+Barcode, Network, Geo, Helper, Random, Data, Diff, Time, Text, and Unicode Tools.
+Use
 `release/toolbox.lock.example.json` as the template for a future release and
 verify every downloaded asset before committing updated values. Artifacts may be:
 
@@ -157,7 +166,7 @@ npm run assemble -- \
   --lock release/toolbox.lock.json \
   --portal-dist dist \
   --output build/toolbox \
-  --archive build/add-ideas-toolbox-0.14.0.zip
+  --archive build/add-ideas-toolbox-0.18.0.zip
 ```
 
 Existing output is refused. Pass `--force` only when replacing those exact
@@ -180,10 +189,28 @@ build/toolbox/
     ├── regex/
     ├── svg/
     ├── auth/
-    └── sudoku/
+    ├── sudoku/
+    ├── colour/
+    ├── office/
+    ├── image/
+    ├── file/
+    ├── epub/
+    ├── archive/
+    ├── privacy/
+    ├── crypto/
+    ├── barcode/
+    ├── network/
+    ├── geo/
+    ├── helper/
+    ├── rand/
+    ├── data/
+    ├── diff/
+    ├── time/
+    ├── text/
+    └── unicode/
 
-build/add-ideas-toolbox-0.14.0.zip
+build/add-ideas-toolbox-0.18.0.zip
-build/add-ideas-toolbox-0.14.0.zip.sha256
+build/add-ideas-toolbox-0.18.0.zip.sha256
 ```
 
 The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -204,7 +231,7 @@ directory separately:
 ```sh
 npm run package:static -- \
   --input build/toolbox \
-  --output artifacts/add-ideas-toolbox-0.14.0.zip
+  --output artifacts/add-ideas-toolbox-0.18.0.zip
 ```
 
 This also emits a `.sha256` sidecar.
@@ -217,24 +244,26 @@ immutable caching only for Vite-hashed assets and narrowly matched
 semver-versioned FFmpeg core files, and revalidation for all other files. The
 opaque-origin SVG preview iframe loads its packaged controller with a URI-exact
 CORS and cross-origin resource-policy exception; all other files retain the
-same-origin policy and every normal security header. Camera access is denied on
+same-origin policy and every normal security header. Camera access is denied by
-the shared Toolbox host and granted only to the dedicated
+default. It is granted to the dedicated `auth.toolbox.add-ideas.de` origin and,
-`auth.toolbox.add-ideas.de` origin, where Auth Tools still requests it only
+on the shared Toolbox host, only to `/apps/barcode/`; both apps still request it
-after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update the
+only after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update
-exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host at
+the exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host
-the same time; the default-deny fallback deliberately does not infer camera
+at the same time. Random Tools is the only app whose path-specific CSP permits
-grants from request paths.
+an external connection, and only to `https://www.random.org`; the app requires
-Assemble first, then:
+explicit per-session consent before making that optional request.
 
 The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's
 `ixsl:eval()` extension is therefore unsupported in this deployment profile;
 normal local XML/XSLT transformations do not require that permission.
 
+Assemble first, then:
+
 ```sh
 podman build -f Containerfile \
-  -t git.add-ideas.de/lotobo/toolbox:0.14.0 .
+  -t git.add-ideas.de/lotobo/toolbox:0.18.0 .
 podman run --rm -p 8080:8080 \
-  git.add-ideas.de/lotobo/toolbox:0.14.0
+  git.add-ideas.de/lotobo/toolbox:0.18.0
 ```
 
 For a direct-port local deployment after assembly, use the separate example:
@@ -251,8 +280,8 @@ docker login git.add-ideas.de
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
   --file Containerfile.release \
-  --tag git.add-ideas.de/lotobo/toolbox:0.14.0 \
+  --tag git.add-ideas.de/lotobo/toolbox:0.18.0 \
-  --tag git.add-ideas.de/lotobo/toolbox:0.14 \
+  --tag git.add-ideas.de/lotobo/toolbox:0.18 \
   --push .
 ```
 
@@ -274,11 +303,11 @@ needs permission to push code, releases, and container packages to
 3. Verify downloaded app assets with `sha256sum -c <asset>.sha256`; copy those
    exact values into a reviewed toolbox lock.
 4. Run the assembler and serve `build/toolbox` from a nested test path. Open
-   all eight apps, switch between them, and confirm the encoded `toolbox`
+   all 26 apps, switch between them, and confirm the encoded `toolbox`
    context.
 5. Verify the distribution with
-   `(cd build && sha256sum -c add-ideas-toolbox-0.14.0.zip.sha256)`.
+   `(cd build && sha256sum -c add-ideas-toolbox-0.18.0.zip.sha256)`.
-6. Commit the reviewed lock, tag the toolbox release (for example `v0.14.0`), and
+6. Commit the reviewed lock, tag the toolbox release (for example `v0.18.0`), and
    push the branch and tag to Gitea.
 7. In Gitea, open **Releases → New release**, select the tag, and upload the
    static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -294,7 +323,7 @@ must not re-resolve app versions or substitute a newer release.
 ## Existing tools
 
 | Tool                | State and boundary                                                  | Principal workflows                                                                                                                                 | Important concrete scope                                                                                                                                                                                                                                                                                                                                   | Critical considerations and integrations                                                                                                                                                                                                                                                                                                 |
-| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **`pdf-tools`**     | Existing; dedicated repository                                      | Merge, split, reorder, rotate and export PDF pages                                                                                                  | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                                                                  | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                                                                              |
 | **`xslt-tools`**    | Existing; dedicated repository                                      | Develop, test and run XSLT transformations                                                                                                          | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                                                          | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                                                                               |
 | **`onenote-tools`** | Existing rich-reader release; dedicated repository                  | Open, browse, inspect and export OneNote sections and packages locally                                                                              | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                                                         | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                                                                      |
@@ -302,27 +331,37 @@ must not re-resolve app versions or substitute a newer release.
 | **`regex-tools`**   | Current local-first v0.4.2 release; dedicated repository            | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics                                                 |
 | **`svg-tools`**     | Initial local-first v0.1.0 release; dedicated repository            | Inspect and edit SVG source, structure, geometry, references and accessibility locally                                                              | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export                                                                                                                                                                                  | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository                                                                                          |
 | **`auth-tools`**    | Current local-first v0.3.0 release; dedicated repository            | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally                                    | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation                                                                                             | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; no raw CTAP administration               |
-| **`sudoku-tools`**  | Initial local-first v0.1.0 release; dedicated repository  | Set, play, generate, analyse and solve classic, Killer and common variant Sudoku locally                                                            | 4×4–16×16 grids; givens and custom regions; cages, diagonals, thermos, arrows, Kropki, XV, inequalities, renban and palindrome lines; notes, colours, history, timer, exact uniqueness checks, explained logic, focused calculators, local projects and bounded import/export                                                                              | Worker-bounded solving and generation; IndexedDB with memory fallback; self-contained links and supported f-puzzles fields stay local; unsupported foreign rules stop explicitly instead of being silently discarded                                                                                                       |
+| **`sudoku-tools`**  | Current local-first v0.2.1 release; dedicated repository            | Set, play, generate, analyse and solve classic, Killer and rich variant Sudoku locally                                                              | 4×4–16×16 grids; registry-backed constraint packs including cages, lines, dots, XV, inequalities, indexing and Fog of War; staged hints, candidate maintenance, advanced logical techniques, setter quality checks, mixed-variant generation, source-preserving f-puzzles/SudokuPad interoperability, autosave recovery and searchable local projects      | Worker-bounded solving, generation and quality analysis; strict inert imported-visual validation; fog-safe play assistance; IndexedDB history with memory fallback; stable workspace geometry, responsive zoom and pan, a 3×3 standard keypad, tap selection, patterned colours, accessibility controls and an offline-capable PWA shell |
+| **`colour-tools`**  | Initial local-first v0.1.0 release; dedicated repository            | Convert, composite, interpolate, pick, sample, analyse and export colours locally                                                                   | General colour conversion; arbitrary RGBA compositing; multi-stop colour steps; large visual and native pickers; local image sampling and palette extraction; contrast, gamut and colour-vision-deficiency analysis; harmonies and design-token export                                                                                                     | Processing and image access remain local; colour spaces, encoded versus linear-light compositing, interpolation and gamut-mapping assumptions are explicit; mathematical conversion is distinguished from display simulation; integrates with SVG, image and token tools                                                                 |
+| **`office-tools`**  | Initial local-first v0.1.0 read-only release; dedicated repository  | Open and view word-processing documents, spreadsheets and presentations locally                                                                     | DOCX, XLSX and PPTX plus ODT, ODS and ODP; document, sheet and slide views with search, outline or thumbnail navigation and zoom; text, tables, images, styles, metadata, cached formula values and presentation notes                                                                                                                                     | Bounded worker-based inert package and XML parsers never execute macros, scripts, formulas, active content or external resources; legacy binary DOC, XLS and PPT are unsupported; viewing is intentionally read-only and does not promise pixel-perfect Office-suite layout fidelity                                                     |
+| **`image-tools`**   | Initial local-first v0.1.0 release; dedicated repository            | Inspect, crop, rotate, resize, compare and batch-convert raster images locally                                                                      | Static JPEG, PNG and WebP; bounded queues; aspect presets; fit/fill/exact resize; PNG/JPEG/WebP export; per-result operation reports                                                                                                                                                                                                                       | Animated and multi-picture inputs are inspect-only; canvas re-encoding does not preserve arbitrary metadata, ICC profiles, HDR precision or byte identity                                                                                                                                                                                |
+| **`file-tools`**    | Initial local-first v0.1.0 release; dedicated repository            | Identify, inspect, hash and inventory local files                                                                                                   | Signature and claimed-MIME comparison; paged hex/ASCII and string views; SHA-256/SHA-512; deterministic JSON/CSV manifests; duplicate candidates                                                                                                                                                                                                           | Detection and entropy are heuristics rather than validation or malware analysis; v0.1 intentionally does not mutate, split, join or rename files                                                                                                                                                                                         |
+| **`epub-tools`**    | Initial local-first v0.1.0 release; dedicated repository            | Read, inspect, validate and repair EPUB 2/3 publications                                                                                            | Package, metadata, spine, EPUB 3 nav and EPUB 2 NCX views; sandboxed reading; link checks; metadata and cover editing; text/chapter/report export; normalized rebuilds                                                                                                                                                                                     | Strict bounded ZIP and XML handling; active and external content are blocked; DRM is detected but never bypassed; focused preflight is not a complete EPUBCheck implementation                                                                                                                                                           |
+| **`archive-tools`** | Initial local-first v0.1.0 release; dedicated repository            | Inspect, create, compare and safely extract archive content                                                                                         | ZIP/ZIP64, TAR/USTAR/PAX, gzip and tar.gz; inert previews; deterministic ZIP/TAR output; cross-format inventory comparison; selected-file repackaging                                                                                                                                                                                                      | Path, entry-count, expanded-size and compression-ratio limits; no direct filesystem restoration, nested expansion, encrypted or multipart ZIP support; links and special entries are blocked                                                                                                                                             |
+| **`privacy-tools`** | Initial local-first v0.1.0 release; dedicated repository            | Inspect image metadata and make independently verified sharing copies                                                                               | Deep JPEG, PNG and WebP scans for EXIF/IPTC/XMP/profiles/previews/provenance and trailing data; orientation-normalized pixel re-encoding; source/output hashes; JSON and ZIP reports                                                                                                                                                                       | Not an anonymity guarantee; static supported images only; re-encoding can change pixels and remove colour, resolution and authenticity information; reports can themselves contain sensitive metadata                                                                                                                                    |
+| **`crypto-tools`**  | Initial local-first v0.1.0 inspection release; dedicated repository | Inspect certificate, request, revocation-list, key and JWK material                                                                                 | Bounded PEM/DER X.509, CSR and CRL inspection; public/private key identification; JWK/JWKS warnings and RFC 7638 thumbprints; explicit issuer-signature links; DNS SAN hostname checks                                                                                                                                                                     | No browser/OS trust implication, complete RFC 5280 path validation, revocation service, issuance, key generation, private-key decryption or general signature verification                                                                                                                                                               |
+| **`barcode-tools`** | Initial local-first v0.1.0 release; dedicated repository            | Generate and decode QR codes and common barcodes                                                                                                    | SVG QR, Data Matrix, PDF417, Aztec and selected linear formats; bounded image or opt-in camera decode; structured QR payloads; CSV batch ZIP; GTIN and quiet-zone assistance                                                                                                                                                                               | Decoded payloads remain inert text and are never opened automatically; camera is path-scoped and user initiated; generated output, GS1 allocation and print quality still require applicable interoperability checks                                                                                                                     |
+| **`network-tools`** | Initial offline v0.1.0 release; dedicated repository                | Calculate IP networks and construct or inspect common network values                                                                                | IPv4/IPv6 canonicalization and CIDR ranges; URL/query parsing without navigation; DNS-record construction; response-header inspection; CSP builder; MIME reference                                                                                                                                                                                         | Performs no DNS, URL, HTTP or scanning request; pasted values remain bounded and inert; results are construction and calculation aids rather than live network observations                                                                                                                                                              |
+| **`geo-tools`**     | Initial local-first v0.1.0 release; dedicated repository            | Inspect, convert, simplify and analyse geospatial files                                                                                             | GeoJSON, GPX, KML and coordinate CSV; WGS 84 bounds, distance and elevation; Douglas–Peucker simplification; decimal/DMS conversion; coordinate-only sketch                                                                                                                                                                                                | Small Point/LineString/Polygon model with scalar properties; conversion losses are explicit; no CRS transformation, basemap request or survey-grade claim                                                                                                                                                                                |
+| **`helper-tools`**  | Initial v0.1.0 app and reusable package release                     | Encode, convert, inspect and calculate with shared bounded primitives                                                                               | Base/byte/text/URL conversion; Unicode and line transforms; exact number and unit conversion; hashes; CIDR; timestamps; hardened JSON/CSV; secure and seeded random primitives; deep-linked calculator workspaces                                                                                                                                          | Framework-free `@add-ideas/toolbox-helpers` package is consumed directly by eleven v0.1 apps; operations disclose strictness, limits and non-cryptographic seeded boundaries                                                                                                                                                             |
+| **`rand-tools`**    | Initial local-first v0.1.0 release; dedicated repository            | Generate secure or reproducible random values through focused workspaces                                                                            | Unbiased WebCrypto integers/strings; seeded reproducible generation; UUIDv4/v7 and ULID; dice; sampling, shuffle, passphrases and normal distribution; optional RANDOM.ORG integers                                                                                                                                                                        | Secure local generation never falls back; deterministic output is not secret; the one remote source requires explicit per-session consent and a path-specific CSP and may still be unavailable through CORS or service limits                                                                                                            |
+| **`data-tools`**    | Initial local-first v0.1.0 release; dedicated repository            | Inspect, format, query, flatten and convert structured data                                                                                         | JSON, YAML 1.2, TOML, XML, CSV, TSV and NDJSON; exact JSON numbers; bounded tree/table/leaf views; JSON Pointer and safe path queries; all-format conversion with loss/coercion reports; spreadsheet-formula neutralization                                                                                                                                | Disposable bounded parser worker; rejects active XML constructs and unsafe object keys; conversions surface information loss and round-trip instability                                                                                                                                                                                  |
+| **`diff-tools`**    | Initial local-first v0.1.0 release; dedicated repository            | Compare text, JSON, XML and delimited data semantically                                                                                             | Line/word/code-point/grapheme text diff; exact newline state; object-aware exact-number JSON and RFC 6902; namespace-aware XML rules; keyed CSV/TSV; unified/side-by-side views and portable reports                                                                                                                                                       | Normalization settings and ignored distinctions remain visible; bounded disposable worker; v0.1 intentionally excludes images, binary documents, directories and archives                                                                                                                                                                |
+| **`time-tools`**    | Initial local-first v0.1.0 release; dedicated repository            | Convert timestamps and explore zones, arithmetic and recurrence                                                                                     | Exact signed nanosecond epochs; IANA-zone comparisons and DST ambiguity; wall-clock versus elapsed arithmetic; bounded cron and RRULE previews; business days; escaped UTC ICS export                                                                                                                                                                      | Uses the browser's IANA data and does not model leap seconds; regional holidays are never inferred; recurrence and skipped/ambiguous local-time choices are explicit                                                                                                                                                                     |
+| **`text-tools`**    | Initial local-first v0.1.0 release; dedicated repository            | Build ordered, inspectable plain-text transformation pipelines                                                                                      | Line endings, trimming, whitespace, sort/deduplicate, locale case, Unicode normalization, transliteration, escapes, wrapping, columns, explicit file decoding and versioned recipes                                                                                                                                                                        | Exact source/result and per-step changes stay visible; compatibility normalization, transliteration, narrow encodings and selected transforms warn when they may be lossy                                                                                                                                                                |
+| **`unicode-tools`** | Initial local-first v0.1.0 release; dedicated repository            | Search and inspect Unicode characters, emoji, scripts, text and confusables                                                                         | Checksum-pinned Unicode 17.0 catalogue; character/alias/code-point search; emoji and named sequences; UTF-8/UTF-16/escape inspection; grapheme segmentation; normalization; UTS #39 skeleton; selected Unihan fields; symbol collections                                                                                                                   | Official Unicode data is redistributed under Unicode-3.0 and is not scraped from symbol sites; private-use and surrogate ranges are not misrepresented as assigned characters; confusable and mixed-script results are review signals, not security verdicts                                                                             |
 
 ## Planned tools
 
 | Tool                 | State and boundary                         | Principal workflows                                                                                                                                                   | Important concrete scope                                                                                                                                    | Critical considerations and integrations                                                                                                                |
-| -------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **`flow-tools`**     | Later platform layer                       | Compose local processing operations across tools                                                                                                                      | Example: CSV → filter → QR generation → SVG template → PDF → ZIP; reusable recipes; typed inputs and outputs; progress and cancellation                     | Do not load complete React applications into one runtime; expose separate worker-safe operation packages only after several apps have stable operations |
-| **`file-tools`**     | High priority; dedicated repository           | Identify, inspect and organize local files                                                                                                                               | Magic-byte detection; hex view; decoded strings; checksums; directory manifests; split/join; duplicate detection; trailing-data detection; batch-rename preview                | All inputs are untrusted; format inspectors require strict size and nesting limits; natural entry point to archive, privacy, crypto and package tools                                                             |
-| **`image-tools`**    | High priority; dedicated repository           | Edit and batch-process raster images                                                                                                                                     | Crop, resize, rotate, compress, convert, contact sheets, sprites, responsive sets, favicon generation, metadata removal and visual quality comparison                          | Use workers and off-main-thread rendering; preserve or deliberately remove colour profiles; integrate with colour, SVG, PDF and privacy tools                                                                     |
 | **`subtitle-tools`** | Medium priority; dedicated repository      | Edit, validate and synchronize captions                                                                                                                               | SRT, WebVTT and ASS; timing shifts; stretching; frame-rate conversion; overlap and reading-speed checks; waveform synchronization; revision comparison      | Direct integration with `av-tools`; preserve style information when supported and disclose conversion losses                                            |
 | **`midi-tools`**     | Medium specialist app                      | MIDI event inspection and editing; transpose, quantize, tempo maps and controller data; device access should remain optional                                          |                                                                                                                                                             |
 | **`3d-tools`**       | Large specialist app                       | Inspect STL, OBJ and glTF; dimensions, bounding boxes, mesh simplification and common geometry defects; worker/GPU use and file limits                                |                                                                                                                                                             |
 | **`query-tools`**    | High-value but large; dedicated repository | Analyse local tabular and relational data with SQL                                                                                                                    | CSV, JSON, NDJSON, Parquet and SQLite; schema inference; joins; aggregation; pivots; charts; export to common data formats                                  | WASM memory and streaming; distinguish this analytical product from document-oriented `data-tools`; query work must remain local                        |
-| **`epub-tools`**     | Medium app                                    | EPUB inspection, metadata and cover editing, link validation, chapter extraction and structural repair; sanitize embedded HTML and SVG                                   |                                                                                                                                                                                |
 | **`scan-tools`**     | Large app                                  | Camera/document correction; crop, deskew and threshold; page assembly; local OCR; PDF output; model downloads and memory use must be explicit                         |                                                                                                                                                             |
-| **`office-tools`**   | Medium-to-large app                           | Inspect rather than reproduce an office suite: package structure, relationships, metadata, comments, embedded images and basic repairs                                   |                                                                                                                                                                                |
 | **`package-tools`**  | Medium priority                            | Inspect compound and package-based formats                                                                                                                            | EPUB; DOCX/XLSX/PPTX; ODF; JAR; APK; browser extensions; package trees; manifests; relationships; embedded media; signatures; orphaned parts                | Generic container inspector with format adapters; complements rather than replaces `onenote-tools`, `epub-tools` and `office-tools`                     |
-| **`archive-tools`**  | Medium-to-high priority; dedicated repository | Inspect, create, compare and extract archives                                                                                                                            | ZIP, TAR, gzip and selected additional formats; selective extraction; content preview; deterministic archives; timestamp normalization; archive comparison                     | Expansion-ratio, entry-count and total-size limits; traversal-safe extraction; never execute extracted files                                                                                                      |
-| **`privacy-tools`**  | High priority; dedicated repository           | Inspect and remove metadata before sharing                                                                                                                               | EXIF and GPS; document author/comments; embedded thumbnails; PDF metadata and attachments; hidden package entries; AV tags; personal filenames; structured safe-sharing report | Never promise absolute anonymity; explicitly state inspected, removed, preserved and unsupported structures; integrate with most file-oriented apps                                                               |
-| **`crypto-tools`**   | Planned; dedicated repository                 | Inspect keys, certificates and signatures; validate chains                                                                                                               | X.509 PEM/DER, CSR, CRL, PKCS #8, encrypted PKCS #8, PKCS #12/PFX, JWK/JWKS; key/certificate matching; path construction; hostname, purpose and time checks; CMS/JWS later     | Inspection-first; explicit trust anchors; no implication that browser/OS trust stores are used; no private-key persistence; offline revocation first; network checks opt-in; restrictive CSP and worker isolation |
-| **`barcode-tools`**  | Planned; dedicated repository                 | Generate, inspect and decode QR and barcodes                                                                                                                             | QR, common one- and two-dimensional codes; camera/image decoding; GS1 assistance; CSV batch generation; quiet-zone and print-size checks; structured payload builders          | Treat decoded payloads as untrusted; never open links automatically; camera permission must be optional; integrate with `label-tools`, `contact-tools` and `crypto-tools`                                         |
 | **`label-tools`**    | Medium priority; dedicated repository      | Generate labels and badges from templates and data                                                                                                                    | CSV/JSON merge into SVG templates; QR/barcode fields; serial numbers; A4 label sheets; badges; asset tags; cut marks; calibration                           | Strong suite demonstration linking data, SVG, barcode, random and PDF capabilities; print dimensions must be explicit and testable                      |
 | **`font-tools`**     | Medium priority; dedicated repository      | Inspect, preview and prepare fonts                                                                                                                                    | Glyph coverage; variable axes; metadata; fallback comparison; subsetting; CSS generation; arbitrary-text previews                                           | Font licensing and embedding restrictions must be visible; use untrusted-font isolation and strict parser limits                                        |
 | **`fixture-tools`**  | Medium priority                            | Generate deterministic test data                                                                                                                                      | JSON Schema, XSD, SQL DDL, CSV headings or interactive models to JSON, CSV, XML, SQL and NDJSON; foreign keys; distributions; boundary and invalid cases    | Seeded reproducibility; uniqueness constraints; privacy-safe synthetic data; natural extension of `rand-tools`                                          |
@@ -331,32 +370,16 @@ must not re-resolve app versions or substitute a newer release.
 | **`repro-tools`**    | Medium-to-later                            | Create manifests and provenance records                                                                                                                               | File hashes; directory manifests; operation history; tool/version/parameter records; deterministic package creation; verification reports                   | Useful foundation for reproducible workflows and signed manifests; integrates with crypto, archive and flow tools                                       |
 | **`schema-tools`**   | Dedicated specialist app                   | Validate, inspect and generate examples for JSON Schema, XSD, Relax NG, Schematron and OpenAPI; visualize references and incompatibilities                            |                                                                                                                                                             |
 | **`log-tools`**      | Dedicated app                              | Stream and filter large logs; parse common formats; correlate records; build timelines; extract fields; anonymize values; avoid loading the complete file into memory |                                                                                                                                                             |
-| **`network-tools`**  | Helper family or small app                    | IPv4/IPv6 subnetting; CIDR ranges; URL and query parsing; DNS-record construction; HTTP headers; CSP generation; MIME lookup; avoid turning it into an intrusive scanner |                                                                                                                                                                                |
 | **`binary-tools`**   | Dedicated specialist app                   | Base64, hexadecimal, CBOR, MessagePack, ASN.1 and Protocol Buffers; schema-assisted decoding; byte-range highlighting; strict depth and size limits                   |                                                                                                                                                             |
 | **`git-tools`**      | Small-to-medium app                        | Patch inspection and editing; `.gitignore` testing; semantic-version comparison; conventional commits; changelog normalization; no repository-hosting dependency      |                                                                                                                                                             |
 | **`api-tools`**      | Medium app                                 | OpenAPI validation; request and response examples; curl and client-command generation; saved HTTP-exchange inspection; direct browser requests remain subject to CORS |                                                                                                                                                             |
 | **`mail-tools`**     | Medium app                                 | EML and MIME inspection; header analysis; attachment extraction; body-part comparison; HTML mail must be heavily sandboxed                                            |                                                                                                                                                             |
 | **`calendar-tools`** | Small-to-medium app                        | ICS inspection, merging, deduplication, repair, recurrence visualization and timezone diagnostics                                                                     |                                                                                                                                                             |
 | **`contact-tools`**  | Small-to-medium app                        | vCard inspection and editing; CSV mapping; deduplication; contact QR generation; treat all contact data as sensitive                                                  |                                                                                                                                                             |
-| **`geo-tools`**      | Medium app                                    | GeoJSON, GPX, KML and coordinate CSV; format conversion; track simplification; distance/elevation analysis; coordinate-reference assumptions must be explicit            |                                                                                                                                                                                |
 | **`diagram-tools`**  | Medium app                                 | Code and visual editing for Mermaid, Graphviz and related representations; renderers require sanitization and sandboxing                                              |                                                                                                                                                             |
 | **`token-tools`**    | Small-to-medium app                        | Design-token editing and conversion between JSON, CSS custom properties, Sass, Android and iOS forms; integrate with colour and SVG tools                             |                                                                                                                                                             |
 | **`device-tools`**   | Specialist app                             | Serial terminal, sensor logger, microcontroller console and controlled firmware installation; explicit permission and browser-capability checks                       |                                                                                                                                                             |
 
-## Planned helpers
-
-Helpers export funcionality for other tools to use. They may also present a tool surface to be used directly
-
-| Tool                | State and boundary                                           | Principal workflows                                                                                                                                                                       | Important concrete scope                                                                                                                                                          | Critical considerations and integrations                                                                                                       |
-| ------------------- | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`helpers-tools`** | One shared artifact with deep links                          | Stateless Base64, URL encoding, case conversion, number bases, Unicode code points, unit conversion, small checksums, subnet and timestamp calculators; avoid a repository per calculator |                                                                                                                                                                                   |
-| **`colour-tools`**  | Planned; small-to-medium dedicated repository                | Colour conversion, calculation and palette work                                                                                                                                           | sRGB, Display P3, Lab, LCH, OKLab and OKLCH; gamut mapping; contrast; colour-vision simulation; gradients; palette extraction; design-token export                                | Make colour-space assumptions explicit; distinguish mathematical conversion from display simulation; integrate with SVG, image and token tools |
-| **`rand-tools`**    | Planned; small dedicated repository                          | Generate random numbers, strings, identifiers and samples                                                                                                                                 | Cryptographically secure generation; deterministic seeded generation; UUIDs, ULIDs, passphrases, dice notation, distributions, weighted selection and shuffling                   | Clearly separate secure randomness from reproducible pseudorandomness; no misleading “strength” claims; natural foundation for `fixture-tools` |
-| **`data-tools`**    | High priority; dedicated repository                          | Inspect, edit, validate, query and convert structured data                                                                                                                                | JSON, YAML, TOML, XML, CSV and NDJSON; tree/table/source views; schema inference; flattening; filtering; field mapping; JSONPath-style queries; conversion recipes                | Every conversion should disclose information loss, coercion and round-trip instability; XML-specialist workflows hand off to `xslt-tools`      |
-| **`diff-tools`**    | High priority; dedicated repository or shared engine plus UI | Compare documents and files semantically                                                                                                                                                  | Text; JSON object-aware comparison; XML normalization; CSV keyed comparison; images with overlay/heatmap; archives and directories; PDF pages; optional audio waveform comparison | Normalization and ignored properties must be visible; produce portable reports and standard patch formats where possible                       |
-| **`text-tools`**    | Medium priority; one app with deep-linked panels             | Transform and normalize plain text                                                                                                                                                        | Unicode normalization; line-ending conversion; encoding; sorting; deduplication; case changes; transliteration; escaping; column operations; transformation pipelines             | Preserve exact input/output visibility; warn about lossy encodings and Unicode confusables; integrate regex operations                         |
-| **`time-tools`**    | Medium priority; small dedicated app or helper family        | Work with dates, timestamps, time zones and recurrences                                                                                                                                   | Unix timestamps; date arithmetic; durations; ISO 8601; timezone comparison; cron; RRULE; ICS generation; business days; DST-transition visualization                              | Visualize actual recurrence instances and ambiguous/skipped local times; do not rely on simplified fixed-offset calculations                   |
-
 ## Licensing
 
 Portal source is `AGPL-3.0-only`; see `LICENSE`. The contract is Apache-2.0, and

compose.example.yaml

@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: Containerfile
-    image: git.add-ideas.de/lotobo/toolbox:0.14.0
+    image: git.add-ideas.de/lotobo/toolbox:0.18.0
     restart: unless-stopped
     read_only: true
     ports:

compose.yaml

@@ -6,9 +6,9 @@ services:
       context: .
       dockerfile: Containerfile.release
       args:
-        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.14.0}"
+        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.18.0}"
-        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-e79f4aadfce3222855a3829805e72ebe399ce863df5e2b57ea0bd606139c2d6d}"
+        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c}"
-    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.14.0}"
+    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.18.0}"
     restart: unless-stopped
     read_only: true
     tmpfs:

deploy/nginx.conf

@@ -14,9 +14,15 @@ map $uri $toolbox_access_control_allow_origin {
   "/apps/svg/canvas-frame-controller.js" "*";
 }
 
-map $host $toolbox_permissions_policy {
+map "$host:$uri" $toolbox_permissions_policy {
   default "camera=(), microphone=(), geolocation=(), payment=(), usb=()";
-  "auth.toolbox.add-ideas.de" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()";
+  "~^auth\.toolbox\.add-ideas\.de:" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()";
+  "~^[^:]+:/apps/barcode(?:/|$)" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()";
+}
+
+map $uri $toolbox_connect_sources {
+  default "'self'";
+  "~^/apps/rand(?:/|$)" "'self' https://www.random.org";
 }
 
 server {
@@ -37,7 +43,7 @@ server {
   add_header Cross-Origin-Resource-Policy $toolbox_resource_policy always;
   add_header Access-Control-Allow-Origin $toolbox_access_control_allow_origin always;
   add_header Permissions-Policy $toolbox_permissions_policy always;
-  add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'" always;
+  add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src $toolbox_connect_sources; worker-src 'self' blob:; manifest-src 'self'" always;
   add_header Cache-Control $toolbox_cache_control always;
 
   gzip on;

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.16",
+  "version": "0.2.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@add-ideas/toolbox-portal",
-      "version": "0.2.16",
+      "version": "0.2.20",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@add-ideas/toolbox-contract": "^0.2.3",
@@ -2031,9 +2031,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
+      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3432,9 +3432,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
+      "version": "3.3.18",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
@@ -3609,9 +3609,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.20",
+      "version": "8.5.26",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.20.tgz",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
-      "integrity": "sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
       "dev": true,
       "funding": [
         {
@@ -3629,7 +3629,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.16",
+        "nanoid": "^3.3.17",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -4166,9 +4166,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.28.0",
+      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
-      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
       "dev": true,
       "license": "MIT",
       "engines": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.16",
+  "version": "0.2.20",
   "license": "AGPL-3.0-only",
   "private": true,
   "type": "module",

public/SOURCE.md

@@ -1,8 +1,8 @@
 # Corresponding source
 
-The source code corresponding to add·ideas Toolbox Portal 0.2.16 is available at:
+The source code corresponding to add·ideas Toolbox Portal 0.2.20 is available at:
 
-https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.14.0
+https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.18.0
 
 Each bundled application contains its own `SOURCE.md`, license, and third-party
 license materials. The application sources are also linked from the portal.

public/toolbox.catalog.json

@@ -40,6 +40,78 @@
     {
       "manifest": "./apps/sudoku/toolbox-app.json",
       "enabled": true
+    },
+    {
+      "manifest": "./apps/colour/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/office/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/image/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/file/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/epub/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/archive/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/privacy/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/crypto/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/barcode/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/network/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/geo/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/helper/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/rand/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/data/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/diff/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/time/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/text/toolbox-app.json",
+      "enabled": true
+    },
+    {
+      "manifest": "./apps/unicode/toolbox-app.json",
+      "enabled": true
     }
   ]
 }

release/toolbox.lock.example.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.14.0",
+  "releaseVersion": "0.18.0",
-  "portalVersion": "0.2.16",
+  "portalVersion": "0.2.20",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
     "name": "add·ideas Toolbox",
@@ -64,10 +64,136 @@
     },
     {
       "id": "de.add-ideas.sudoku-tools",
-      "version": "0.1.0",
+      "version": "0.2.1",
-      "artifact": "https://git.add-ideas.de/lotobo/sudoku-tools/releases/download/v0.1.0/sudoku-tools-0.1.0.zip",
+      "artifact": "https://git.add-ideas.de/lotobo/sudoku-tools/releases/download/v0.2.1/sudoku-tools-0.2.1.zip",
-      "sha256": "bc277791dc50d5fdb39f5abd098d81ea7d84b8a9bc43ca86214de7ee335abf61",
+      "sha256": "3987813a3bcd24056b9ca9607ba5d74a094d54c15b0e8a7966df7373e87df67a",
       "target": "sudoku"
+    },
+    {
+      "id": "de.add-ideas.colour-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/colour-tools/releases/download/v0.1.0/colour-tools-0.1.0.zip",
+      "sha256": "c933f506362709a031a5cd830657604510b8e4ccb1800be77d40d0eee256490b",
+      "target": "colour"
+    },
+    {
+      "id": "de.add-ideas.office-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/office-tools/releases/download/v0.1.0/office-tools-0.1.0.zip",
+      "sha256": "3f950a413c74bae3b8f190954272fd91c9b141aab4fa50c936d5ad3741539aaf",
+      "target": "office"
+    },
+    {
+      "id": "de.add-ideas.image-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/image-tools/releases/download/v0.1.0/image-tools-0.1.0.zip",
+      "sha256": "8aa67d0c3cfd1060c261e9be108fb443384aaec95f82d3c1b96b63b2d07963e1",
+      "target": "image"
+    },
+    {
+      "id": "de.add-ideas.file-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/file-tools/releases/download/v0.1.0/file-tools-0.1.0.zip",
+      "sha256": "9225ff60c639d563bb514ac390b5b2cbad4b8030a070e6398e7c200763c5f89e",
+      "target": "file"
+    },
+    {
+      "id": "de.add-ideas.epub-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/epub-tools/releases/download/v0.1.0/epub-tools-0.1.0.zip",
+      "sha256": "834512494bbfba9918a9d8131efd512a09619a150823591e2d13ea385ced00e9",
+      "target": "epub"
+    },
+    {
+      "id": "de.add-ideas.archive-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/archive-tools/releases/download/v0.1.0/archive-tools-0.1.0.zip",
+      "sha256": "88a8efb39129bb813c97fb4d80257ee339bbfcec2a73b080a0a89dc76cdd2958",
+      "target": "archive"
+    },
+    {
+      "id": "de.add-ideas.privacy-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/privacy-tools/releases/download/v0.1.0/privacy-tools-0.1.0.zip",
+      "sha256": "0d6c071837b8ce705e456d44888378f3a7f9427a352f0bd4b60512f6c41465d4",
+      "target": "privacy"
+    },
+    {
+      "id": "de.add-ideas.crypto-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/crypto-tools/releases/download/v0.1.0/crypto-tools-0.1.0.zip",
+      "sha256": "bfced32f44918214ffd31c5d4730aee7bffd75e7952e9a6d16b6eb7eb68fed35",
+      "target": "crypto"
+    },
+    {
+      "id": "de.add-ideas.barcode-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/barcode-tools/releases/download/v0.1.0/barcode-tools-0.1.0.zip",
+      "sha256": "22cede58d279f15419b342862bf6545cace831d1e02c0634fbd01aeab3bd3e63",
+      "target": "barcode"
+    },
+    {
+      "id": "de.add-ideas.network-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/network-tools/releases/download/v0.1.0/network-tools-0.1.0.zip",
+      "sha256": "7e493a0aed643c712c38057bcd67c360bc6712d5d31ea82c222bf780464ff4a1",
+      "target": "network"
+    },
+    {
+      "id": "de.add-ideas.geo-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/geo-tools/releases/download/v0.1.0/geo-tools-0.1.0.zip",
+      "sha256": "88a46a56f3d3b5b61dc9bbb8795764b59aae1635da95120a0e499e33ef652e8f",
+      "target": "geo"
+    },
+    {
+      "id": "de.add-ideas.helper-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/helper-tools/releases/download/v0.1.0/helper-tools-0.1.0.zip",
+      "sha256": "bcdbd2ffc721ed1a2e9432eea1f90d7b4526d86934c3b5de6f522fd8bd58fd77",
+      "target": "helper"
+    },
+    {
+      "id": "de.add-ideas.rand-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.0/rand-tools-0.1.0.zip",
+      "sha256": "1dff2cf2165b04f171b12cb2303fe6b005eedf59c58ae839b77c40cc46c4bf25",
+      "target": "rand"
+    },
+    {
+      "id": "de.add-ideas.data-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/data-tools/releases/download/v0.1.0/data-tools-0.1.0.zip",
+      "sha256": "83ab02c9827d122c83b05c230e62c0ee87b330604acfff4990c58310f7956a1f",
+      "target": "data"
+    },
+    {
+      "id": "de.add-ideas.diff-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/diff-tools/releases/download/v0.1.0/diff-tools-0.1.0.zip",
+      "sha256": "023311343152aac11bfc00d58029b24ef0efe5ee4113aeb2a9d000ebe2460d72",
+      "target": "diff"
+    },
+    {
+      "id": "de.add-ideas.time-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/time-tools/releases/download/v0.1.0/time-tools-0.1.0.zip",
+      "sha256": "9a5545a3e684a207d7b2d6663d42a117cb5bb3303f35dc889a2651b67bfcf08f",
+      "target": "time"
+    },
+    {
+      "id": "de.add-ideas.text-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/text-tools/releases/download/v0.1.0/text-tools-0.1.0.zip",
+      "sha256": "242eb15005a18e0f13ba03544c633834416707e2629585868bfcd6f0c1cc5aec",
+      "target": "text"
+    },
+    {
+      "id": "de.add-ideas.unicode-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/unicode-tools/releases/download/v0.1.0/unicode-tools-0.1.0.zip",
+      "sha256": "1cf557d3ace9a41c7fa72cb5c1b149e669203a682174939f2e3aa376e1c6f22a",
+      "target": "unicode"
     }
   ]
 }

release/toolbox.lock.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.14.0",
+  "releaseVersion": "0.18.0",
-  "portalVersion": "0.2.16",
+  "portalVersion": "0.2.20",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
     "name": "add·ideas Toolbox",
@@ -64,10 +64,136 @@
     },
     {
       "id": "de.add-ideas.sudoku-tools",
-      "version": "0.1.0",
+      "version": "0.2.1",
-      "artifact": "https://git.add-ideas.de/lotobo/sudoku-tools/releases/download/v0.1.0/sudoku-tools-0.1.0.zip",
+      "artifact": "https://git.add-ideas.de/lotobo/sudoku-tools/releases/download/v0.2.1/sudoku-tools-0.2.1.zip",
-      "sha256": "bc277791dc50d5fdb39f5abd098d81ea7d84b8a9bc43ca86214de7ee335abf61",
+      "sha256": "3987813a3bcd24056b9ca9607ba5d74a094d54c15b0e8a7966df7373e87df67a",
       "target": "sudoku"
+    },
+    {
+      "id": "de.add-ideas.colour-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/colour-tools/releases/download/v0.1.0/colour-tools-0.1.0.zip",
+      "sha256": "c933f506362709a031a5cd830657604510b8e4ccb1800be77d40d0eee256490b",
+      "target": "colour"
+    },
+    {
+      "id": "de.add-ideas.office-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/office-tools/releases/download/v0.1.0/office-tools-0.1.0.zip",
+      "sha256": "3f950a413c74bae3b8f190954272fd91c9b141aab4fa50c936d5ad3741539aaf",
+      "target": "office"
+    },
+    {
+      "id": "de.add-ideas.image-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/image-tools/releases/download/v0.1.0/image-tools-0.1.0.zip",
+      "sha256": "8aa67d0c3cfd1060c261e9be108fb443384aaec95f82d3c1b96b63b2d07963e1",
+      "target": "image"
+    },
+    {
+      "id": "de.add-ideas.file-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/file-tools/releases/download/v0.1.0/file-tools-0.1.0.zip",
+      "sha256": "9225ff60c639d563bb514ac390b5b2cbad4b8030a070e6398e7c200763c5f89e",
+      "target": "file"
+    },
+    {
+      "id": "de.add-ideas.epub-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/epub-tools/releases/download/v0.1.0/epub-tools-0.1.0.zip",
+      "sha256": "834512494bbfba9918a9d8131efd512a09619a150823591e2d13ea385ced00e9",
+      "target": "epub"
+    },
+    {
+      "id": "de.add-ideas.archive-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/archive-tools/releases/download/v0.1.0/archive-tools-0.1.0.zip",
+      "sha256": "88a8efb39129bb813c97fb4d80257ee339bbfcec2a73b080a0a89dc76cdd2958",
+      "target": "archive"
+    },
+    {
+      "id": "de.add-ideas.privacy-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/privacy-tools/releases/download/v0.1.0/privacy-tools-0.1.0.zip",
+      "sha256": "0d6c071837b8ce705e456d44888378f3a7f9427a352f0bd4b60512f6c41465d4",
+      "target": "privacy"
+    },
+    {
+      "id": "de.add-ideas.crypto-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/crypto-tools/releases/download/v0.1.0/crypto-tools-0.1.0.zip",
+      "sha256": "bfced32f44918214ffd31c5d4730aee7bffd75e7952e9a6d16b6eb7eb68fed35",
+      "target": "crypto"
+    },
+    {
+      "id": "de.add-ideas.barcode-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/barcode-tools/releases/download/v0.1.0/barcode-tools-0.1.0.zip",
+      "sha256": "22cede58d279f15419b342862bf6545cace831d1e02c0634fbd01aeab3bd3e63",
+      "target": "barcode"
+    },
+    {
+      "id": "de.add-ideas.network-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/network-tools/releases/download/v0.1.0/network-tools-0.1.0.zip",
+      "sha256": "7e493a0aed643c712c38057bcd67c360bc6712d5d31ea82c222bf780464ff4a1",
+      "target": "network"
+    },
+    {
+      "id": "de.add-ideas.geo-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/geo-tools/releases/download/v0.1.0/geo-tools-0.1.0.zip",
+      "sha256": "88a46a56f3d3b5b61dc9bbb8795764b59aae1635da95120a0e499e33ef652e8f",
+      "target": "geo"
+    },
+    {
+      "id": "de.add-ideas.helper-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/helper-tools/releases/download/v0.1.0/helper-tools-0.1.0.zip",
+      "sha256": "bcdbd2ffc721ed1a2e9432eea1f90d7b4526d86934c3b5de6f522fd8bd58fd77",
+      "target": "helper"
+    },
+    {
+      "id": "de.add-ideas.rand-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.0/rand-tools-0.1.0.zip",
+      "sha256": "1dff2cf2165b04f171b12cb2303fe6b005eedf59c58ae839b77c40cc46c4bf25",
+      "target": "rand"
+    },
+    {
+      "id": "de.add-ideas.data-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/data-tools/releases/download/v0.1.0/data-tools-0.1.0.zip",
+      "sha256": "83ab02c9827d122c83b05c230e62c0ee87b330604acfff4990c58310f7956a1f",
+      "target": "data"
+    },
+    {
+      "id": "de.add-ideas.diff-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/diff-tools/releases/download/v0.1.0/diff-tools-0.1.0.zip",
+      "sha256": "023311343152aac11bfc00d58029b24ef0efe5ee4113aeb2a9d000ebe2460d72",
+      "target": "diff"
+    },
+    {
+      "id": "de.add-ideas.time-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/time-tools/releases/download/v0.1.0/time-tools-0.1.0.zip",
+      "sha256": "9a5545a3e684a207d7b2d6663d42a117cb5bb3303f35dc889a2651b67bfcf08f",
+      "target": "time"
+    },
+    {
+      "id": "de.add-ideas.text-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/text-tools/releases/download/v0.1.0/text-tools-0.1.0.zip",
+      "sha256": "242eb15005a18e0f13ba03544c633834416707e2629585868bfcd6f0c1cc5aec",
+      "target": "text"
+    },
+    {
+      "id": "de.add-ideas.unicode-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/unicode-tools/releases/download/v0.1.0/unicode-tools-0.1.0.zip",
+      "sha256": "1cf557d3ace9a41c7fa72cb5c1b149e669203a682174939f2e3aa376e1c6f22a",
+      "target": "unicode"
     }
   ]
 }

scripts/assembler.test.ts

@@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) {
   return {
     schemaVersion: 1,
     releaseVersion: '0.1.0',
-    portalVersion: '0.2.16',
+    portalVersion: '0.2.20',
     catalogue: {
       id: 'de.add-ideas.toolbox',
       name: 'Test Toolbox',

scripts/deployment.test.ts

@@ -22,7 +22,39 @@ const nginxConfig = readFileSync(
 );
 const releaseLock = JSON.parse(
   readFileSync(path.join(projectRoot, 'release', 'toolbox.lock.json'), 'utf8')
-) as { releaseVersion: string };
+) as { releaseVersion: string; apps: Array<{ target: string }> };
+const developmentCatalogue = JSON.parse(
+  readFileSync(path.join(projectRoot, 'public', 'toolbox.catalog.json'), 'utf8')
+) as { apps: Array<{ manifest: string; enabled: boolean }> };
+
+const expectedAppTargets = [
+  'pdf',
+  'xslt',
+  'onenote',
+  'av',
+  'regex',
+  'svg',
+  'auth',
+  'sudoku',
+  'colour',
+  'office',
+  'image',
+  'file',
+  'epub',
+  'archive',
+  'privacy',
+  'crypto',
+  'barcode',
+  'network',
+  'geo',
+  'helper',
+  'rand',
+  'data',
+  'diff',
+  'time',
+  'text',
+  'unicode',
+] as const;
 
 const immutableCacheControl = 'public, max-age=31536000, immutable';
 const immutableUriPatterns = Array.from(
@@ -85,16 +117,7 @@ describe('production deployment', () => {
     expect(containerfile).toContain(
       'COPY --from=release --chown=101:101 /tmp/toolbox/'
     );
-    for (const app of [
+    for (const app of expectedAppTargets) {
-      'pdf',
-      'xslt',
-      'onenote',
-      'av',
-      'regex',
-      'svg',
-      'auth',
-      'sudoku',
-    ]) {
       expect(containerfile).toContain(
         `test -f /tmp/toolbox/apps/${app}/toolbox-app.json`
       );
@@ -102,6 +125,18 @@ describe('production deployment', () => {
     expect(containerfile).toMatch(/\nUSER 101:101\nEXPOSE 8080\n/u);
   });
 
+  it('keeps the development catalogue aligned with all release targets', () => {
+    expect(releaseLock.apps.map(({ target }) => target)).toEqual(
+      expectedAppTargets
+    );
+    expect(developmentCatalogue.apps).toEqual(
+      expectedAppTargets.map((target) => ({
+        manifest: `./apps/${target}/toolbox-app.json`,
+        enabled: true,
+      }))
+    );
+  });
+
   it('uses only the requested external Traefik network and redirects HTTP to HTTPS', () => {
     expect(compose).toContain('dockerfile: Containerfile.release');
     expect(compose).toContain('traefik.enable: "true"');
@@ -167,9 +202,9 @@ describe('production deployment', () => {
     expect(compose).not.toContain('addideas-auth-stripprefix');
   });
 
-  it('grants camera capture only to the isolated authentication hostname', () => {
+  it('grants camera only to the isolated authentication host and barcode path', () => {
     expect(nginxConfig).toMatch(
-      /map \$host \$toolbox_permissions_policy\s*\{\s*default "camera=\(\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"auth\.toolbox\.add-ideas\.de" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*\}/mu
+      /map "\$host:\$uri" \$toolbox_permissions_policy\s*\{\s*default "camera=\(\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"~\^auth\\\.toolbox\\\.add-ideas\\\.de:" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"~\^\[\^:\]\+:\/apps\/barcode\(\?:\/\|\$\)" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*\}/mu
     );
     expect(nginxConfig).toContain(
       'add_header Permissions-Policy $toolbox_permissions_policy always;'
@@ -179,6 +214,16 @@ describe('production deployment', () => {
     ).toHaveLength(1);
   });
 
+  it('allows RANDOM.ORG only for the explicitly opt-in Random Tools path', () => {
+    expect(nginxConfig).toMatch(
+      /map \$uri \$toolbox_connect_sources\s*\{\s*default "'self'";\s*"~\^\/apps\/rand\(\?:\/\|\$\)" "'self' https:\/\/www\.random\.org";\s*\}/mu
+    );
+    expect(nginxConfig).toMatch(
+      /^\s*add_header Content-Security-Policy "[^"]*connect-src \$toolbox_connect_sources;[^"]*" always;$/mu
+    );
+    expect(nginxConfig.match(/https:\/\/www\.random\.org/gu)).toHaveLength(1);
+  });
+
   it('quotes nginx regular expressions that contain brace quantifiers', () => {
     expect(nginxConfig).toContain(
       '"~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\\.[^/]+$"'

src/App.test.tsx

@@ -48,6 +48,12 @@ describe('portal UI', () => {
     expect(
       screen.getByTestId('app-card-de.add-ideas.auth-tools')
     ).toHaveTextContent('OTP & Passkeys');
+    expect(
+      screen.getByTestId('app-card-de.add-ideas.colour-tools')
+    ).toHaveTextContent('Colour');
+    expect(
+      screen.getByTestId('app-card-de.add-ideas.office-tools')
+    ).toHaveTextContent('Office');
     expect(
       screen.queryByText(
         'Page-level PDF operations performed locally in the browser.'
@@ -416,6 +422,8 @@ describe('portal UI', () => {
             'de.add-ideas.svg-tools',
             'de.add-ideas.auth-tools',
             'de.add-ideas.sudoku-tools',
+            'de.add-ideas.colour-tools',
+            'de.add-ideas.office-tools',
           ],
           hidden: [],
           theme: 'light',
@@ -436,6 +444,8 @@ describe('portal UI', () => {
       screen.getByTestId('app-card-de.add-ideas.svg-tools'),
       screen.getByTestId('app-card-de.add-ideas.auth-tools'),
       screen.getByTestId('app-card-de.add-ideas.sudoku-tools'),
+      screen.getByTestId('app-card-de.add-ideas.colour-tools'),
+      screen.getByTestId('app-card-de.add-ideas.office-tools'),
     ];
     cards.forEach((card, index) => {
       const rect = {
@@ -466,7 +476,16 @@ describe('portal UI', () => {
         within(tools)
           .getAllByRole('heading', { level: 3 })
           .map((heading) => heading.textContent)
-      ).toEqual(['XSLT', 'PDF', 'OneNote', 'SVG', 'OTP & Passkeys', 'Sudoku']);
+      ).toEqual([
+        'XSLT',
+        'PDF',
+        'OneNote',
+        'SVG',
+        'OTP & Passkeys',
+        'Sudoku',
+        'Colour',
+        'Office',
+      ]);
     });
     expect(
       JSON.parse(localStorage.getItem(PREFERENCES_KEY) ?? '{}').order
@@ -477,6 +496,8 @@ describe('portal UI', () => {
       'de.add-ideas.svg-tools',
       'de.add-ideas.auth-tools',
       'de.add-ideas.sudoku-tools',
+      'de.add-ideas.colour-tools',
+      'de.add-ideas.office-tools',
     ]);
   });
 

src/App.tsx

@@ -489,9 +489,9 @@ export default function App() {
             </span>
           </p>
           <span>
-            Portal v0.2.16 ·{' '}
+            Portal v0.2.20 ·{' '}
             <a
-              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.14.0"
+              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.18.0"
               target="_blank"
               rel="noopener noreferrer"
             >

src/catalogue.test.ts

@@ -10,7 +10,7 @@ describe('catalogue loading', () => {
     const loaded = await loadCatalogue('/toolbox.catalog.json');
     expect(loaded.catalogue.name).toBe('add·ideas Toolbox');
     expect(loaded.homeUrl).toBe('http://localhost:3000/');
-    expect(loaded.apps).toHaveLength(6);
+    expect(loaded.apps).toHaveLength(8);
     expect(loaded.apps[0]).toMatchObject({
       id: 'de.add-ideas.pdf-tools',
       name: 'PDF Workbench',
@@ -43,6 +43,8 @@ describe('catalogue loading', () => {
       'de.add-ideas.svg-tools',
       'de.add-ideas.auth-tools',
       'de.add-ideas.sudoku-tools',
+      'de.add-ideas.colour-tools',
+      'de.add-ideas.office-tools',
     ]);
     expect(loaded.unavailable).toHaveLength(1);
     expect(loaded.unavailable[0]?.reason).toMatch(/HTTP 404/);

src/test/fixtures.ts

@@ -202,6 +202,76 @@ export const sudokuManifest: ToolboxAppManifest = {
   ],
 };
 
+export const colourManifest: ToolboxAppManifest = {
+  ...sudokuManifest,
+  id: 'de.add-ideas.colour-tools',
+  name: 'Colour Tools',
+  version: '0.1.0',
+  description:
+    'Convert, composite, compare and build colours locally in the browser.',
+  categories: ['graphics', 'design', 'developer'],
+  tags: ['colour', 'rgba', 'oklch', 'palette', 'gradient', 'contrast'],
+  requirements: {
+    secureContext: false,
+    workers: true,
+    indexedDb: false,
+    crossOriginIsolated: false,
+    topLevelContext: false,
+  },
+  privacy: {
+    processing: 'local',
+    fileUploads: false,
+    telemetry: false,
+    label: 'Colours and images stay in this browser; nothing is uploaded.',
+  },
+  source: {
+    repository: 'https://git.add-ideas.de/lotobo/colour-tools',
+    license: 'GPL-3.0-or-later',
+  },
+  actions: [
+    {
+      id: 'source',
+      label: 'Source',
+      url: 'https://git.add-ideas.de/lotobo/colour-tools',
+    },
+  ],
+};
+
+export const officeManifest: ToolboxAppManifest = {
+  ...sudokuManifest,
+  id: 'de.add-ideas.office-tools',
+  name: 'Office Tools',
+  version: '0.1.0',
+  description:
+    'Open and inspect documents, spreadsheets and presentations locally in the browser.',
+  categories: ['documents', 'office', 'productivity'],
+  tags: ['document', 'spreadsheet', 'presentation', 'docx', 'xlsx', 'pptx'],
+  requirements: {
+    secureContext: false,
+    workers: true,
+    indexedDb: false,
+    crossOriginIsolated: false,
+    topLevelContext: false,
+  },
+  privacy: {
+    processing: 'local',
+    fileUploads: false,
+    telemetry: false,
+    label: 'Office files stay in this browser; nothing is uploaded.',
+  },
+  source: {
+    repository: 'https://git.add-ideas.de/lotobo/office-tools',
+    license: 'GPL-3.0-or-later',
+  },
+  actions: [
+    {
+      id: 'source',
+      label: 'Source',
+      url: 'https://git.add-ideas.de/lotobo/office-tools',
+    },
+  ],
+};
+
 export const catalogue: ToolboxCatalog = {
   schemaVersion: 1,
   id: 'de.add-ideas.toolbox',
@@ -215,6 +285,8 @@ export const catalogue: ToolboxCatalog = {
     { manifest: './apps/svg/toolbox-app.json', enabled: true },
     { manifest: './apps/auth/toolbox-app.json', enabled: true },
     { manifest: './apps/sudoku/toolbox-app.json', enabled: true },
+    { manifest: './apps/colour/toolbox-app.json', enabled: true },
+    { manifest: './apps/office/toolbox-app.json', enabled: true },
   ],
 };
 
@@ -242,6 +314,10 @@ export function catalogueFetch(overrides: Record<string, Response> = {}) {
       return Response.json(authManifest);
     if (url.pathname.endsWith('/apps/sudoku/toolbox-app.json'))
       return Response.json(sudokuManifest);
+    if (url.pathname.endsWith('/apps/colour/toolbox-app.json'))
+      return Response.json(colourManifest);
+    if (url.pathname.endsWith('/apps/office/toolbox-app.json'))
+      return Response.json(officeManifest);
     return new Response('Not found', { status: 404 });
   };
 }

src/toolPresentation.test.ts

@@ -63,4 +63,28 @@ describe('compact tool presentation', () => {
     expect(shortToolTitle(sudoku)).toBe('Sudoku');
     expect(shortToolDescription(sudoku)).toBe('Set, play and solve locally.');
   });
+
+  it('uses the compact Colour tile copy', () => {
+    const colour = app(
+      'de.add-ideas.colour-tools',
+      'Colour Tools',
+      'Convert, composite, compare and build colours locally in the browser.'
+    );
+
+    expect(shortToolTitle(colour)).toBe('Colour');
+    expect(shortToolDescription(colour)).toBe(
+      'Convert and build colours locally.'
+    );
+  });
+
+  it('uses the compact Office tile copy', () => {
+    const office = app(
+      'de.add-ideas.office-tools',
+      'Office Tools',
+      'Open and inspect documents, spreadsheets and presentations locally in the browser.'
+    );
+
+    expect(shortToolTitle(office)).toBe('Office');
+    expect(shortToolDescription(office)).toBe('Open office files locally.');
+  });
 });

src/toolPresentation.ts

@@ -33,6 +33,14 @@ const PRESENTATION: Record<string, { title: string; description: string }> = {
     title: 'Sudoku',
     description: 'Set, play and solve locally.',
   },
+  'de.add-ideas.colour-tools': {
+    title: 'Colour',
+    description: 'Convert and build colours locally.',
+  },
+  'de.add-ideas.office-tools': {
+    title: 'Office',
+    description: 'Open office files locally.',
+  },
 };
 
 export function shortToolTitle(app: ResolvedApp): string {