feat: publish Toolbox 0.9.0

2026-07-27 11:48:21 +02:00
14 changed files with 52 additions and 49 deletions
--- a/.env.example
+++ b/.env.example
@@ -4,5 +4,5 @@ TRAEFIK_NETWORK=internal
 TRAEFIK_CERT_RESOLVER=netcup

 # Keep these two values paired when deploying a newer published toolbox release.
-TOOLBOX_RELEASE_VERSION=0.8.0
-TOOLBOX_RELEASE_SHA256=b8691fef089612cc0c0658b473c3f7a8f62b3e60708f54186922afe4aea84b5e
+TOOLBOX_RELEASE_VERSION=0.9.0
+TOOLBOX_RELEASE_SHA256=fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c
--- a/Containerfile.release
+++ b/Containerfile.release
@@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3

 FROM ${NGINX_IMAGE} AS release

-ARG TOOLBOX_RELEASE_VERSION=0.8.0
-ARG TOOLBOX_RELEASE_SHA256=b8691fef089612cc0c0658b473c3f7a8f62b3e60708f54186922afe4aea84b5e
+ARG TOOLBOX_RELEASE_VERSION=0.9.0
+ARG TOOLBOX_RELEASE_SHA256=fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c
 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/zemion/toolbox-portal/releases/download

 RUN set -eu; \
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # add·ideas Toolbox Portal

 `toolbox-portal` is the static launcher and release assembler for the add·ideas
-browser toolbox. Version `0.2.7` reads one same-origin catalogue, shows each app
+browser toolbox. Version `0.2.8` reads one same-origin catalogue, shows each app
 as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
 visibility, and appearance in the current browser. Pinned tools have their own
 section; search, category, and clickable tag filters stay close to the tool
@@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
 ## Production deployment behind Traefik

 The committed `compose.yaml` is the shortest production path. Its release
-container downloads the immutable Toolbox 0.8.0 ZIP during the image build,
+container downloads the immutable Toolbox 0.9.0 ZIP during the image build,
 verifies SHA-256 before extracting it, and then copies only the verified static
 files into the pinned unprivileged nginx image. Node.js and a local portal
 assembly are not required on the deployment host.
@@ -121,9 +121,9 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.

-`release/toolbox.lock.json` is the reviewed v0.8.0 lock. Its URLs and checksums
-pin the published PDF Tools 0.4.3, XSLT Tools 0.4.2, OneNote Tools 0.3.3, and
-Audio & Video Tools 0.2.0 and Regex Tools 0.3.0 release bytes. Use
+`release/toolbox.lock.json` is the reviewed v0.9.0 lock. Its URLs and checksums
+pin the published PDF Tools 0.4.3, XSLT Tools 0.4.2, OneNote Tools 0.3.3,
+Audio & Video Tools 0.2.0, and Regex Tools 0.4.0 release bytes. Use
 `release/toolbox.lock.example.json` as the template for a future release and
 verify every downloaded asset before committing updated values. Artifacts may be:

@@ -144,7 +144,7 @@ npm run assemble -- \
  --lock release/toolbox.lock.json \
  --portal-dist dist \
  --output build/toolbox \
-  --archive build/add-ideas-toolbox-0.8.0.zip
+  --archive build/add-ideas-toolbox-0.9.0.zip
 ```

 Existing output is refused. Pass `--force` only when replacing those exact
@@ -166,8 +166,8 @@ build/toolbox/
    ├── av/
    └── regex/

-build/add-ideas-toolbox-0.8.0.zip
-build/add-ideas-toolbox-0.8.0.zip.sha256
+build/add-ideas-toolbox-0.9.0.zip
+build/add-ideas-toolbox-0.9.0.zip.sha256
 ```

 The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -188,7 +188,7 @@ directory separately:
 ```sh
 npm run package:static -- \
  --input build/toolbox \
-  --output artifacts/add-ideas-toolbox-0.8.0.zip
+  --output artifacts/add-ideas-toolbox-0.9.0.zip
 ```

 This also emits a `.sha256` sidecar.
@@ -206,9 +206,9 @@ normal local XML/XSLT transformations do not require that permission.

 ```sh
 podman build -f Containerfile \
-  -t git.add-ideas.de/zemion/toolbox:0.8.0 .
+  -t git.add-ideas.de/zemion/toolbox:0.9.0 .
 podman run --rm -p 8080:8080 \
-  git.add-ideas.de/zemion/toolbox:0.8.0
+  git.add-ideas.de/zemion/toolbox:0.9.0
 ```

 For a direct-port local deployment after assembly, use the separate example:
@@ -225,8 +225,8 @@ docker login git.add-ideas.de
 docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --file Containerfile.release \
-  --tag git.add-ideas.de/zemion/toolbox:0.8.0 \
-  --tag git.add-ideas.de/zemion/toolbox:0.8 \
+  --tag git.add-ideas.de/zemion/toolbox:0.9.0 \
+  --tag git.add-ideas.de/zemion/toolbox:0.9 \
  --push .
 ```

@@ -251,8 +251,8 @@ needs permission to push code, releases, and container packages to
   all five apps, switch between them, and confirm the encoded `toolbox`
   context.
 5. Verify the distribution with
-   `(cd build && sha256sum -c add-ideas-toolbox-0.8.0.zip.sha256)`.
-6. Commit the reviewed lock, tag the toolbox release (for example `v0.8.0`), and
+   `(cd build && sha256sum -c add-ideas-toolbox-0.9.0.zip.sha256)`.
+6. Commit the reviewed lock, tag the toolbox release (for example `v0.9.0`), and
   push the branch and tag to Gitea.
 7. In Gitea, open **Releases → New release**, select the tag, and upload the
   static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -268,12 +268,12 @@ must not re-resolve app versions or substitute a newer release.
 ## Existing tools

 | Tool                | State and boundary                                        | Principal workflows                                                                                                                                 | Important concrete scope                                                                                                                                                                                                                                                                                              | Critical considerations and integrations                                                                                                                                                                                                                                                 |
-| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **`pdf-tools`**     | Existing; dedicated repository                            | Merge, split, reorder, rotate and export PDF pages                                                                                                  | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                             | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                              |
 | **`xslt-tools`**    | Existing; dedicated repository                            | Develop, test and run XSLT transformations                                                                                                          | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                     | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                               |
 | **`onenote-tools`** | Existing rich-reader release; dedicated repository        | Open, browse, inspect and export OneNote sections and packages locally                                                                              | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                    | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                      |
 | **`av-tools`**      | Existing local-first v0.2.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser                                                                                     | Quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                                                                                 | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                           |
-| **`regex-tools`**   | Existing local-first v0.3.0 release; dedicated repository | Develop, explain, test and apply ECMAScript, PCRE2, Python and Java regular expressions | Deterministic syntax trees; engine-native matching, captures and replacement; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp, pinned PCRE2 10.47 WASM, CPython 3.14 `re` through self-hosted Pyodide 314.0.3, and TeaVM 0.15.0 `java.util.regex` in killable workers; explicit resource/presentation limits and engine-specific offset semantics |
+| **`regex-tools`**   | Current local-first v0.4.0 release; dedicated repository  | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |

 ## Planned tools

--- a/compose.example.yaml
+++ b/compose.example.yaml
@@ -3,7 +3,7 @@ services:
    build:
      context: .
      dockerfile: Containerfile
-    image: git.add-ideas.de/zemion/toolbox:0.8.0
+    image: git.add-ideas.de/zemion/toolbox:0.9.0
    restart: unless-stopped
    read_only: true
    ports:
--- a/compose.yaml
+++ b/compose.yaml
@@ -6,9 +6,9 @@ services:
      context: .
      dockerfile: Containerfile.release
      args:
-        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.8.0}"
-        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-b8691fef089612cc0c0658b473c3f7a8f62b3e60708f54186922afe4aea84b5e}"
-    image: "git.add-ideas.de/zemion/toolbox:${TOOLBOX_RELEASE_VERSION:-0.8.0}"
+        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.9.0}"
+        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-fa3c5b8a4148dbb360acc04fd505a6fa64e06c5c842cf1334af5c7d232208f3c}"
+    image: "git.add-ideas.de/zemion/toolbox:${TOOLBOX_RELEASE_VERSION:-0.9.0}"
    restart: unless-stopped
    read_only: true
    tmpfs:
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.7",
+  "version": "0.2.8",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@add-ideas/toolbox-portal",
-      "version": "0.2.7",
+      "version": "0.2.8",
      "license": "AGPL-3.0-only",
      "dependencies": {
        "@add-ideas/toolbox-contract": "^0.2.2",
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.7",
+  "version": "0.2.8",
  "license": "AGPL-3.0-only",
  "private": true,
  "type": "module",
--- a/public/SOURCE.md
+++ b/public/SOURCE.md
@@ -1,8 +1,8 @@
 # Corresponding source

-The source code corresponding to add·ideas Toolbox Portal 0.2.7 is available at:
+The source code corresponding to add·ideas Toolbox Portal 0.2.8 is available at:

-https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.8.0
+https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.0

 Each bundled application contains its own `SOURCE.md`, license, and third-party
 license materials. The application sources are also linked from the portal.
--- a/release/toolbox.lock.example.json
+++ b/release/toolbox.lock.example.json
@@ -1,8 +1,8 @@
 {
  "$schema": "./toolbox-release-lock.schema.json",
  "schemaVersion": 1,
-  "releaseVersion": "0.8.0",
-  "portalVersion": "0.2.7",
+  "releaseVersion": "0.9.0",
+  "portalVersion": "0.2.8",
  "catalogue": {
    "id": "de.add-ideas.toolbox",
    "name": "add·ideas Toolbox",
@@ -43,9 +43,9 @@
    },
    {
      "id": "de.add-ideas.regex-tools",
-      "version": "0.3.0",
-      "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.3.0/regex-tools-0.3.0.zip",
-      "sha256": "4f56550b0499405816038fc3474d68260c734ae75178ede11f67955ff0942300",
+      "version": "0.4.0",
+      "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.0/regex-tools-0.4.0.zip",
+      "sha256": "68505ed3e302627d889c45c651431d8fb9638056415cad72a28196fd33acd2b4",
      "target": "regex"
    }
  ]
--- a/release/toolbox.lock.json
+++ b/release/toolbox.lock.json
@@ -1,8 +1,8 @@
 {
  "$schema": "./toolbox-release-lock.schema.json",
  "schemaVersion": 1,
-  "releaseVersion": "0.8.0",
-  "portalVersion": "0.2.7",
+  "releaseVersion": "0.9.0",
+  "portalVersion": "0.2.8",
  "catalogue": {
    "id": "de.add-ideas.toolbox",
    "name": "add·ideas Toolbox",
@@ -43,9 +43,9 @@
    },
    {
      "id": "de.add-ideas.regex-tools",
-      "version": "0.3.0",
-      "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.3.0/regex-tools-0.3.0.zip",
-      "sha256": "4f56550b0499405816038fc3474d68260c734ae75178ede11f67955ff0942300",
+      "version": "0.4.0",
+      "artifact": "https://git.add-ideas.de/zemion/regex-tools/releases/download/v0.4.0/regex-tools-0.4.0.zip",
+      "sha256": "68505ed3e302627d889c45c651431d8fb9638056415cad72a28196fd33acd2b4",
      "target": "regex"
    }
  ]
--- a/scripts/assembler.test.ts
+++ b/scripts/assembler.test.ts
@@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) {
  return {
    schemaVersion: 1,
    releaseVersion: '0.1.0',
-    portalVersion: '0.2.7',
+    portalVersion: '0.2.8',
    catalogue: {
      id: 'de.add-ideas.toolbox',
      name: 'Test Toolbox',
--- a/scripts/deployment.test.ts
+++ b/scripts/deployment.test.ts
@@ -67,6 +67,9 @@ describe('production deployment', () => {

    expect(containerVersion).toBe(releaseLock.releaseVersion);
    expect(composeVersion).toBe(containerVersion);
+    expect(containerChecksum).toMatch(/^[a-f0-9]{64}$/u);
+    expect(composeChecksum).toMatch(/^[a-f0-9]{64}$/u);
+    expect(environmentChecksum).toMatch(/^[a-f0-9]{64}$/u);
    expect(composeChecksum).toBe(containerChecksum);
    expect(environmentVersion).toBe(containerVersion);
    expect(environmentChecksum).toBe(containerChecksum);
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -489,9 +489,9 @@ export default function App() {
            </span>
          </p>
          <span>
-            Portal v0.2.7 ·{' '}
+            Portal v0.2.8 ·{' '}
            <a
-              href="https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.8.0"
+              href="https://git.add-ideas.de/zemion/toolbox-portal/src/tag/v0.9.0"
              target="_blank"
              rel="noopener noreferrer"
            >
--- a/src/test/fixtures.ts
+++ b/src/test/fixtures.ts
@@ -69,7 +69,7 @@ export const regexManifest: ToolboxAppManifest = {
  ...pdfManifest,
  id: 'de.add-ideas.regex-tools',
  name: 'Regex Tools',
-  version: '0.3.0',
+  version: '0.4.0',
  description:
    'Develop, explain, test and apply regular expressions locally in the browser.',
  icon: './regex.svg',