chore(release): bundle Auth Tools 0.3.2 in Toolbox 0.20.6

.env.example

@@ -5,5 +5,5 @@ TRAEFIK_NETWORK=internal
 TRAEFIK_CERT_RESOLVER=netcup
 
 # Keep these two values paired when deploying a newer published toolbox release.
-TOOLBOX_RELEASE_VERSION=0.20.3
+TOOLBOX_RELEASE_VERSION=0.20.6
-TOOLBOX_RELEASE_SHA256=1e743fda8f6d1ca5c77798029351585bf6673a3410892d27e5ad17c9f6bcf0bf
+TOOLBOX_RELEASE_SHA256=37ccd887793d7a147ceb3b69933faa969a006c59d6b1fbec775d3622279cedac

Containerfile.release

@@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3
 
 FROM ${NGINX_IMAGE} AS release
 
-ARG TOOLBOX_RELEASE_VERSION=0.20.3
+ARG TOOLBOX_RELEASE_VERSION=0.20.6
-ARG TOOLBOX_RELEASE_SHA256=1e743fda8f6d1ca5c77798029351585bf6673a3410892d27e5ad17c9f6bcf0bf
+ARG TOOLBOX_RELEASE_SHA256=37ccd887793d7a147ceb3b69933faa969a006c59d6b1fbec775d3622279cedac
 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download
 
 RUN set -eu; \

README.md

@@ -1,7 +1,7 @@
 # add·ideas Toolbox Portal
 
 `toolbox-portal` is the static launcher and release assembler for the add·ideas
-browser toolbox. Version `0.2.23` reads one same-origin catalogue, shows each app
+browser toolbox. Version `0.2.24` reads one same-origin catalogue, shows each app
 as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
 visibility, and appearance in the current browser. Pinned tools have their own
 section; search, category, and clickable tag filters stay close to the tool
@@ -80,7 +80,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
 ## Production deployment behind Traefik
 
 The committed `compose.yaml` is the shortest production path. Its release
-container downloads the immutable Toolbox 0.20.0 ZIP during the image build,
+container downloads the immutable Toolbox 0.20.6 ZIP during the image build,
 verifies SHA-256 before extracting it, and then copies only the verified static
 files into the pinned unprivileged nginx image. Node.js and a local portal
 assembly are not required on the deployment host.
@@ -174,10 +174,10 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.
 
-`release/toolbox.lock.json` is the reviewed Toolbox v0.20.0 / Portal v0.2.23
+`release/toolbox.lock.json` is the reviewed Toolbox v0.20.6 / Portal v0.2.24
 lock. Its URLs and checksums pin PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote
 Tools 0.3.4, Audio & Video Tools 0.3.0, Regex Tools 0.4.2, OTP & Passkey Tools
-0.3.1, Sudoku Tools 0.2.1, and the coordinated 0.2.0 releases of SVG, Colour,
+0.3.2, Translator Tools 0.1.3, Sudoku Tools 0.2.1, and the coordinated 0.2.0 releases of SVG, Colour,
 Office, Image, File, EPUB, Archive, Privacy, Crypto, Barcode, Network, Geo,
 Helper, Random, Data, Diff, Time, Text, Unicode, Flow, Subtitle, MIDI, 3D,
 Query, Scan, Package, Label, Font, Fixture, Minimize, Format Lab, Repro, Schema,
@@ -385,6 +385,16 @@ the exact tag, install with `npm ci`, run the same verification/assembly command
 and upload only the already-created ZIP/checksum and OCI image. The workflow
 must not re-resolve app versions or substitute a newer release.
 
+## Toolbox 0.20.6 token QR display
+
+Toolbox 0.20.6 bundles OTP & Passkey Tools 0.3.2. Use **Show QR code** in
+the credential editor or beside an imported token to scan its enrollment code
+with another device. The large dialog preserves issuer, account, secret,
+algorithm, digits, period or HOTP counter, and provides a local SVG download.
+QR codes remain black on white in both themes. Rendering errors are visible,
+and Escape closes the display. The deployment defaults pin this release and
+its verified archive checksum; pull `main` and rebuild with Docker Compose.
+
 ## Toolbox 0.20.0 portfolio expansion
 
 Toolbox 0.20.0 publishes the coordinated multi-repository depth pass. It adds:
@@ -414,14 +424,14 @@ exact immutable app archives and checksums.
 ## Existing tools
 
 | Tool                 | State and boundary                                                                 | Principal workflows                                                                                                                                     | Important concrete scope                                                                                                                                                                                                                                                                                                                                                                                               | Critical considerations and integrations                                                                                                                                                                                                                                                                                                                                 |
-| -------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | **`pdf-tools`**      | Existing; dedicated repository                                                     | Merge, split, reorder, rotate and export PDF pages                                                                                                      | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                                                                                                                              | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                                                                                                              |
 | **`xslt-tools`**     | Existing; dedicated repository                                                     | Develop, test and run XSLT transformations                                                                                                              | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                                                                                                                      | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                                                                                                               |
 | **`onenote-tools`**  | Existing rich-reader release; dedicated repository                                 | Open, browse, inspect and export OneNote sections and packages locally                                                                                  | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                                                                                                                     | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                                                                                                      |
 | **`av-tools`**       | Existing local-first v0.3.0 release; dedicated repository                          | Convert and lightly edit audio and video locally in the browser                                                                                         | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                                                                                   | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                                                                                                           |
 | **`regex-tools`**    | Current local-first v0.4.2 release; dedicated repository                           | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions     | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence                                                             | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics                                                                                 |
 | **`svg-tools`**      | Current local-first v0.2.0 release; dedicated repository                           | Inspect and edit SVG source, structure, geometry, references and accessibility locally                                                                  | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; app-owned, validated opacity-animation preview; exact, sanitized, raster and project export                                                                                                                                                                                                                     | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository                                                                                                                          |
-| **`auth-tools`**     | Current local-first v0.3.1 release; dedicated repository                           | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally                                        | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation                                                                                                                                                         | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; v0.3.1 corrects source provenance and cross-timezone artifact reproducibility; no raw CTAP administration |
+| **`auth-tools`**     | Current local-first v0.3.2 release; dedicated repository                           | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally                                        | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; large per-token enrollment QR display with SVG download; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation                                                                                                | Authentication material remains memory-only unless explicitly exported; enrollment QR codes contain the token secret; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; no raw CTAP administration |
 | **`sudoku-tools`**   | Current local-first v0.2.1 release; dedicated repository                           | Set, play, generate, analyse and solve classic, Killer and rich variant Sudoku locally                                                                  | 4×4–16×16 grids; registry-backed constraint packs including cages, lines, dots, XV, inequalities, indexing and Fog of War; staged hints, candidate maintenance, advanced logical techniques, setter quality checks, mixed-variant generation, source-preserving f-puzzles/SudokuPad interoperability, autosave recovery and searchable local projects                                                                  | Worker-bounded solving, generation and quality analysis; strict inert imported-visual validation; fog-safe play assistance; IndexedDB history with memory fallback; stable workspace geometry, responsive zoom and pan, a 3×3 standard keypad, tap selection, patterned colours, accessibility controls and an offline-capable PWA shell                                 |
 | **`colour-tools`**   | Current local-first v0.2.0 release; dedicated repository                           | Convert, composite, interpolate, pick, sample, analyse and export colours locally                                                                       | General colour conversion; arbitrary RGBA compositing; multi-stop colour steps and gradient editing; large visual/native/EyeDropper pickers; local image sampling and palette extraction; contrast, gamut, Delta E and colour-vision analysis; harmonies; DTCG 2025.10 token import/export with local reference resolution; directional contrast matrices; CSS and recipe export                                       | Processing and image access remain local; colour spaces, encoded versus linear-light compositing, interpolation and gamut-mapping assumptions are explicit; mathematical conversion is distinguished from display simulation; integrates with SVG, image and token tools                                                                                                 |
 | **`office-tools`**   | Current local-first v0.2.0 read-only release; dedicated repository                 | Open, inspect and view word-processing documents, spreadsheets and presentations locally; download exact source copies and bounded ODF semantic exports | DOCX/DOCM/DOTX/DOTM, XLSX/XLSM/XLTX/XLTM and PPTX/PPTM/POTX/POTM/PPSX/PPSM plus ODT/ODS/ODP; search/navigation/zoom; text, tables, images, styles, metadata, cached formula values and notes; exact source-copy plus ODF text/CSV/outline/JSON export                                                                                                                                                                  | Bounded worker-based inert package and XML parsers never execute macros, scripts, formulas, active content or external resources; legacy binary DOC, XLS and PPT are unsupported; viewing is intentionally read-only and does not promise pixel-perfect Office-suite layout fidelity                                                                                     |

compose.example.yaml

@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: Containerfile
-    image: git.add-ideas.de/lotobo/toolbox:0.20.3
+    image: git.add-ideas.de/lotobo/toolbox:0.20.6
     restart: unless-stopped
     read_only: true
     ports:

compose.yaml

@@ -6,9 +6,9 @@ services:
       context: .
       dockerfile: Containerfile.release
       args:
-        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.20.3}"
+        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.20.6}"
-        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-66f02f95092ef80b9e49cda91c8401400e2ee1d2c640ab20a3a7810bf265c2c7}"
+        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-37ccd887793d7a147ceb3b69933faa969a006c59d6b1fbec775d3622279cedac}"
-    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.20.3}"
+    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.20.6}"
     restart: unless-stopped
     read_only: true
     tmpfs:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@add-ideas/toolbox-portal",
-      "version": "0.2.23",
+      "version": "0.2.24",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@add-ideas/toolbox-contract": "^0.3.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "license": "AGPL-3.0-only",
   "private": true,
   "type": "module",
@@ -20,7 +20,7 @@
     "assemble": "node scripts/assemble.mjs",
     "package:static": "node scripts/package-static.mjs",
     "release:update": "node scripts/update-release-lock.mjs",
-    "release": "scripts/release.sh"
+    "release": "./release.sh"
   },
   "dependencies": {
     "@add-ideas/toolbox-contract": "^0.3.0",

public/SOURCE.md

@@ -1,8 +1,8 @@
 # Corresponding source
 
-The source code corresponding to add·ideas Toolbox Portal 0.2.23 is available at:
+The source code corresponding to add·ideas Toolbox Portal 0.2.24 is available at:
 
-https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.20.0
+https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.20.6
 
 Each bundled application contains its own `SOURCE.md`, license, and third-party
 license materials. The application sources are also linked from the portal.

release.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+exec "${SCRIPT_DIR}/scripts/release.sh" "$@"

release/toolbox.lock.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.20.3",
+  "releaseVersion": "0.20.6",
-  "portalVersion": "0.2.23",
+  "portalVersion": "0.2.24",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
     "name": "add·ideas Toolbox",
@@ -57,9 +57,9 @@
     },
     {
       "id": "de.add-ideas.auth-tools",
-      "version": "0.3.1",
+      "version": "0.3.2",
-      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.3.1/auth-tools-0.3.1.zip",
+      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.3.2/auth-tools-0.3.2.zip",
-      "sha256": "60e90492fb50d2ce23298b3a3af84b1e3be02bbf5dea01d478f889d65eb66f3a",
+      "sha256": "55938731b79f6ac3ec1834b0d1cfa368c671f979a3dad6b01ccaa9498372b40e",
       "target": "auth"
     },
     {
@@ -190,9 +190,9 @@
     },
     {
       "id": "de.add-ideas.translator-tools",
-      "version": "0.1.2",
+      "version": "0.1.3",
-      "artifact": "https://git.add-ideas.de/lotobo/translator-tools/releases/download/v0.1.2/translator-tools-0.1.2.zip",
+      "artifact": "https://git.add-ideas.de/lotobo/translator-tools/releases/download/v0.1.3/translator-tools-0.1.3.zip",
-      "sha256": "2ff24f97e0c3893c4d31dc347bd760d91a0d4a565fb392ec1a1b22ba9835c34f",
+      "sha256": "75482910c8a58e9169845bf4a3699a0385bc5ccff95259eef60004bae6814e22",
       "target": "translator"
     },
     {

scripts/assembler.test.ts

@@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) {
   return {
     schemaVersion: 1,
     releaseVersion: '0.1.0',
-    portalVersion: '0.2.23',
+    portalVersion: '0.2.24',
     catalogue: {
       id: 'de.add-ideas.toolbox',
       name: 'Test Toolbox',

scripts/publish-release.mjs

@@ -111,19 +111,24 @@ async function giteaRequest(url, options, { allowNotFound = false } = {}) {
   }
 
   const text = await response.text();
-  const payload = text ? (() => {
+  const payload = text
+    ? (() => {
         try {
           return JSON.parse(text);
         } catch {
           return { raw: text };
         }
-  })() : null;
+      })()
+    : null;
 
   if (!response.ok) {
-    const detail = payload && typeof payload === 'object' && payload.error
+    const detail =
+      payload && typeof payload === 'object' && payload.error
         ? payload.error
-      : payload?.raw ?? text ?? '';
+        : (payload?.raw ?? text ?? '');
-    throw new Error(`Gitea API request failed (${response.status} ${response.statusText}): ${detail}`);
+    throw new Error(
+      `Gitea API request failed (${response.status} ${response.statusText}): ${detail}`
+    );
   }
 
   return payload;
@@ -148,7 +153,9 @@ async function run() {
   const lock = await readFile(options.lockFile, 'utf8');
   const lockJson = JSON.parse(lock);
   if (!SEMVER.test(lockJson.releaseVersion)) {
-    throw new Error(`Invalid releaseVersion in lock: ${lockJson.releaseVersion}`);
+    throw new Error(
+      `Invalid releaseVersion in lock: ${lockJson.releaseVersion}`
+    );
   }
 
   const releaseVersion = parseReleaseVersionFromLock(lockJson);
@@ -192,8 +199,12 @@ async function run() {
   }
 
   if (dryRun) {
-    console.log(`DRY-RUN: would ensure or create release ${releaseTag} on ${options.owner}/${options.repo}.`);
+    console.log(
-    console.log(`DRY-RUN: would upload assets ${path.basename(archive)} and ${path.basename(checksumFile)}.`);
+      `DRY-RUN: would ensure or create release ${releaseTag} on ${options.owner}/${options.repo}.`
+    );
+    console.log(
+      `DRY-RUN: would upload assets ${path.basename(archive)} and ${path.basename(checksumFile)}.`
+    );
     return;
   }
 
@@ -216,13 +227,15 @@ async function run() {
       target_commitish: options.target || 'main',
       name: options.name,
       body:
-        options.body
+        options.body ||
-        || `Automated release of add-ideas toolbox ${releaseTag} from lock release ${releaseVersion}.`,
+        `Automated release of add-ideas toolbox ${releaseTag} from lock release ${releaseVersion}.`,
       draft: false,
       prerelease: false,
     };
     if (dryRun) {
-      console.log(`DRY-RUN: would create release ${releaseTag} on ${options.owner}/${options.repo}`);
+      console.log(
+        `DRY-RUN: would create release ${releaseTag} on ${options.owner}/${options.repo}`
+      );
       release = { id: '<dry-run>', assets: [] };
     } else {
       release = await giteaRequest(`${releasePrefix}/releases`, {
@@ -238,14 +251,20 @@ async function run() {
   } else {
     release = tagLookup;
     if (dryRun) {
-      console.log(`DRY-RUN: would reuse existing release ${releaseTag} (${release?.id ?? 'unknown'})`);
+      console.log(
+        `DRY-RUN: would reuse existing release ${releaseTag} (${release?.id ?? 'unknown'})`
+      );
     } else {
       console.log(`Using existing release ${releaseTag} (${release.id})`);
     }
   }
 
   if (dryRun) {
-    console.log('DRY-RUN: would upload assets:', options.archive, options.checksum);
+    console.log(
+      'DRY-RUN: would upload assets:',
+      options.archive,
+      options.checksum
+    );
     return;
   }
 
@@ -258,7 +277,9 @@ async function run() {
   for (const asset of candidateAssets) {
     const duplicate = existingAssets.find((entry) => entry.name === asset.name);
     if (duplicate) {
-      console.log(`Deleting existing asset ${asset.name} from release ${releaseTag}`);
+      console.log(
+        `Deleting existing asset ${asset.name} from release ${releaseTag}`
+      );
       await giteaRequest(
         `${releasePrefix}/releases/assets/${duplicate.id}`,
         { method: 'DELETE', headers },
@@ -281,7 +302,9 @@ async function run() {
     );
   }
 
-  console.log(`Release ${releaseTag} published on ${options.owner}/${options.repo}`);
+  console.log(
+    `Release ${releaseTag} published on ${options.owner}/${options.repo}`
+  );
 }
 
 run().catch((error) => {

scripts/release.sh

@@ -199,6 +199,13 @@ if [ ! -s "$CHECKSUM_FILE" ]; then
   else
     sha256sum "$ZIP_FILE" > "$CHECKSUM_FILE"
   fi
+else
+  if [ "$DRY_RUN" -eq 1 ]; then
+    echo "DRY-RUN: would refresh ${CHECKSUM_FILE}"
+  else
+    # ensure checksum always matches the current archive state
+    sha256sum "$ZIP_FILE" > "$CHECKSUM_FILE"
+  fi
 fi
 
 if [ "$SKIP_TAG" -eq 0 ]; then

scripts/update-release-lock.mjs

@@ -87,7 +87,9 @@ async function sha256ForPath(filePath) {
 async function computeRemoteSha256(url) {
   const response = await fetch(url);
   if (!response.ok) {
-    throw new Error(`Unable to download artifact (${response.status} ${response.statusText}).`);
+    throw new Error(
+      `Unable to download artifact (${response.status} ${response.statusText}).`
+    );
   }
 
   if (!response.body) {
@@ -132,7 +134,9 @@ function command(cwd) {
       child.on('exit', (code) =>
         code === 0
           ? resolve(undefined)
-          : reject(new Error(`${name} ${args.join(' ')} failed with code ${code}`))
+          : reject(
+              new Error(`${name} ${args.join(' ')} failed with code ${code}`)
+            )
       );
     });
 }
@@ -150,7 +154,9 @@ async function run() {
 ${usage()}`);
   }
   if (!SEMVER.test(options.releaseVersion)) {
-    throw new Error(`--release-version must be semver: ${options.releaseVersion}`);
+    throw new Error(
+      `--release-version must be semver: ${options.releaseVersion}`
+    );
   }
   if (!SEMVER.test(options.appVersion)) {
     throw new Error(`--app-version must be semver: ${options.appVersion}`);
@@ -160,7 +166,8 @@ ${usage()}`);
   const lockDir = path.dirname(lockPath);
   const lockJson = JSON.parse(await readFile(lockPath, 'utf8'));
   const lock = parseReleaseLock(lockJson);
-  const nextReleaseVersion = options.releaseVersion ?? bumpPatch(lock.releaseVersion);
+  const nextReleaseVersion =
+    options.releaseVersion ?? bumpPatch(lock.releaseVersion);
   if (!SEMVER.test(nextReleaseVersion)) {
     throw new Error(`Invalid release version: ${nextReleaseVersion}`);
   }
@@ -199,13 +206,17 @@ ${usage()}`);
   };
   if (options.portalVersion) {
     if (!SEMVER.test(options.portalVersion))
-      throw new Error(`--portal-version must be semver: ${options.portalVersion}`);
+      throw new Error(
+        `--portal-version must be semver: ${options.portalVersion}`
+      );
     nextLock.portalVersion = options.portalVersion;
   }
 
   parseReleaseLock(nextLock);
   await writeFile(lockPath, `${JSON.stringify(nextLock, null, 2)}\n`, 'utf8');
-  console.log(`Updated ${path.relative(process.cwd(), lockPath)} (${options.appId})`);
+  console.log(
+    `Updated ${path.relative(process.cwd(), lockPath)} (${options.appId})`
+  );
 
   if (!options.assemble) return;
   const runCommand = command(process.cwd());
@@ -227,12 +238,14 @@ ${usage()}`);
   if (options.forceAssemble) assembleArgs.push('--force');
   await runCommand('npm', assembleArgs);
   console.log(`Assembled release -> ${archive}`);
-  const releaseChecksum = path.join(
+  const releaseChecksum = `${archive}.sha256`;
-    path.dirname(archive),
+  const releaseSha256 = await sha256ForPath(archive);
-    `${path.basename(archive)}.sha256`
+  await writeFile(
+    releaseChecksum,
+    `${releaseSha256} ${path.basename(archive)}\n`,
+    'utf8'
   );
-  const releaseSha256 = await sha256ForPath(releaseChecksum === undefined ? '' : releaseChecksum);
+  console.log(`Assembled release checksum: ${releaseSha256}`);
-  console.log(`Release checksum: ${releaseSha256}`);
 }
 
 run().catch((error) => {

src/App.tsx

@@ -489,9 +489,9 @@ export default function App() {
             </span>
           </p>
           <span>
-            Portal v0.2.23 ·{' '}
+            Portal v0.2.24 ·{' '}
             <a
-              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.20.0"
+              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.20.6"
               target="_blank"
               rel="noopener noreferrer"
             >