feat: add SVG Tools to Toolbox 0.10.0

.env.example

@@ -4,5 +4,5 @@ TRAEFIK_NETWORK=internal
 TRAEFIK_CERT_RESOLVER=netcup
 
 # Keep these two values paired when deploying a newer published toolbox release.
-TOOLBOX_RELEASE_VERSION=0.9.2
-TOOLBOX_RELEASE_SHA256=60e4bd533d7e0087c627cb35f50fd97ca3a298fbcb71ae7bcb7045cae6a1f340
+TOOLBOX_RELEASE_VERSION=0.10.0
+TOOLBOX_RELEASE_SHA256=de6f1afc3f0ec08ee1a8afd80d874832cbf905d0d50f62060e6985be9f5e0019

Containerfile.release

@@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3
 
 FROM ${NGINX_IMAGE} AS release
 
-ARG TOOLBOX_RELEASE_VERSION=0.9.2
-ARG TOOLBOX_RELEASE_SHA256=60e4bd533d7e0087c627cb35f50fd97ca3a298fbcb71ae7bcb7045cae6a1f340
+ARG TOOLBOX_RELEASE_VERSION=0.10.0
+ARG TOOLBOX_RELEASE_SHA256=de6f1afc3f0ec08ee1a8afd80d874832cbf905d0d50f62060e6985be9f5e0019
 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download
 
 RUN set -eu; \
@@ -23,6 +23,7 @@ RUN set -eu; \
     test -f /tmp/toolbox/apps/onenote/toolbox-app.json; \
     test -f /tmp/toolbox/apps/av/toolbox-app.json; \
     test -f /tmp/toolbox/apps/regex/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/svg/toolbox-app.json; \
     rm "/tmp/${archive}"
 
 FROM ${NGINX_IMAGE}

README.md

@@ -1,7 +1,7 @@
 # add·ideas Toolbox Portal
 
 `toolbox-portal` is the static launcher and release assembler for the add·ideas
-browser toolbox. Version `0.2.10` reads one same-origin catalogue, shows each app
+browser toolbox. Version `0.2.12` reads one same-origin catalogue, shows each app
 as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
 visibility, and appearance in the current browser. Pinned tools have their own
 section; search, category, and clickable tag filters stay close to the tool
@@ -36,8 +36,8 @@ the SDK and portal together.
 
 Vite uses `base: './'`, so the built portal works at `/` or a nested static path.
 The development catalogue at `public/toolbox.catalog.json` points to assembled
-paths (`./apps/pdf/`, `./apps/xslt/`, `./apps/onenote/`, `./apps/av/`, and
-`./apps/regex/`).
+paths (`./apps/pdf/`, `./apps/xslt/`, `./apps/onenote/`, `./apps/av/`,
+`./apps/regex/`, and `./apps/svg/`).
 Those manifests will correctly appear as unavailable until an assembled release
 is being served.
 
@@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
 ## Production deployment behind Traefik
 
 The committed `compose.yaml` is the shortest production path. Its release
-container downloads the immutable Toolbox 0.9.2 ZIP during the image build,
+container downloads the immutable Toolbox 0.10.0 ZIP during the image build,
 verifies SHA-256 before extracting it, and then copies only the verified static
 files into the pinned unprivileged nginx image. Node.js and a local portal
 assembly are not required on the deployment host.
@@ -121,9 +121,9 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.
 
-`release/toolbox.lock.json` is the reviewed v0.9.2 lock. Its URLs and checksums
+`release/toolbox.lock.json` is the reviewed v0.10.0 lock. Its URLs and checksums
 pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4,
-Audio & Video Tools 0.2.1, and Regex Tools 0.4.2 release bytes. Use
+Audio & Video Tools 0.3.0, Regex Tools 0.4.2, and SVG Tools 0.1.0 release bytes. Use
 `release/toolbox.lock.example.json` as the template for a future release and
 verify every downloaded asset before committing updated values. Artifacts may be:
 
@@ -144,7 +144,7 @@ npm run assemble -- \
   --lock release/toolbox.lock.json \
   --portal-dist dist \
   --output build/toolbox \
-  --archive build/add-ideas-toolbox-0.9.2.zip
+  --archive build/add-ideas-toolbox-0.10.0.zip
 ```
 
 Existing output is refused. Pass `--force` only when replacing those exact
@@ -164,10 +164,11 @@ build/toolbox/
     ├── xslt/
     ├── onenote/
     ├── av/
-    └── regex/
+    ├── regex/
+    └── svg/
 
-build/add-ideas-toolbox-0.9.2.zip
-build/add-ideas-toolbox-0.9.2.zip.sha256
+build/add-ideas-toolbox-0.10.0.zip
+build/add-ideas-toolbox-0.10.0.zip.sha256
 ```
 
 The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -188,7 +189,7 @@ directory separately:
 ```sh
 npm run package:static -- \
   --input build/toolbox \
-  --output artifacts/add-ideas-toolbox-0.9.2.zip
+  --output artifacts/add-ideas-toolbox-0.10.0.zip
 ```
 
 This also emits a `.sha256` sidecar.
@@ -197,9 +198,11 @@ This also emits a `.sha256` sidecar.
 
 `Containerfile` serves only the assembled files with unprivileged nginx on port 8080. It adds restrictive browser headers, same-origin isolation, explicit
 `application/javascript` for `.mjs` engine modules and `application/wasm`,
-immutable caching only for Vite-hashed assets and narrowly
-matched semver-versioned FFmpeg core files, and revalidation for all other
-files. Assemble first, then:
+immutable caching only for Vite-hashed assets and narrowly matched
+semver-versioned FFmpeg core files, and revalidation for all other files. The
+opaque-origin SVG preview iframe loads its packaged controller with a URI-exact
+CORS and cross-origin resource-policy exception; all other files retain the
+same-origin policy and every normal security header. Assemble first, then:
 
 The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's
 `ixsl:eval()` extension is therefore unsupported in this deployment profile;
@@ -207,9 +210,9 @@ normal local XML/XSLT transformations do not require that permission.
 
 ```sh
 podman build -f Containerfile \
-  -t git.add-ideas.de/lotobo/toolbox:0.9.2 .
+  -t git.add-ideas.de/lotobo/toolbox:0.10.0 .
 podman run --rm -p 8080:8080 \
-  git.add-ideas.de/lotobo/toolbox:0.9.2
+  git.add-ideas.de/lotobo/toolbox:0.10.0
 ```
 
 For a direct-port local deployment after assembly, use the separate example:
@@ -226,8 +229,8 @@ docker login git.add-ideas.de
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
   --file Containerfile.release \
-  --tag git.add-ideas.de/lotobo/toolbox:0.9.2 \
-  --tag git.add-ideas.de/lotobo/toolbox:0.9 \
+  --tag git.add-ideas.de/lotobo/toolbox:0.10.0 \
+  --tag git.add-ideas.de/lotobo/toolbox:0.10 \
   --push .
 ```
 
@@ -249,11 +252,11 @@ needs permission to push code, releases, and container packages to
 3. Verify downloaded app assets with `sha256sum -c <asset>.sha256`; copy those
    exact values into a reviewed toolbox lock.
 4. Run the assembler and serve `build/toolbox` from a nested test path. Open
-   all five apps, switch between them, and confirm the encoded `toolbox`
+   all six apps, switch between them, and confirm the encoded `toolbox`
    context.
 5. Verify the distribution with
-   `(cd build && sha256sum -c add-ideas-toolbox-0.9.2.zip.sha256)`.
-6. Commit the reviewed lock, tag the toolbox release (for example `v0.9.2`), and
+   `(cd build && sha256sum -c add-ideas-toolbox-0.10.0.zip.sha256)`.
+6. Commit the reviewed lock, tag the toolbox release (for example `v0.10.0`), and
    push the branch and tag to Gitea.
 7. In Gitea, open **Releases → New release**, select the tag, and upload the
    static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -273,8 +276,9 @@ must not re-resolve app versions or substitute a newer release.
 | **`pdf-tools`**     | Existing; dedicated repository                            | Merge, split, reorder, rotate and export PDF pages                                                                                                  | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                                                                  | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                              |
 | **`xslt-tools`**    | Existing; dedicated repository                            | Develop, test and run XSLT transformations                                                                                                          | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                                                          | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                               |
 | **`onenote-tools`** | Existing rich-reader release; dedicated repository        | Open, browse, inspect and export OneNote sections and packages locally                                                                              | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                                                         | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                      |
-| **`av-tools`**      | Existing local-first v0.2.1 release; dedicated repository | Convert and lightly edit audio and video locally in the browser                                                                                     | Quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                                                                                                                      | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                           |
+| **`av-tools`**      | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser                                                                                     | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                       | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                           |
 | **`regex-tools`**   | Current local-first v0.4.2 release; dedicated repository  | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
+| **`svg-tools`**     | Initial local-first v0.1.0 release; dedicated repository  | Inspect and edit SVG source, structure, geometry, references and accessibility locally                                                              | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export                                                                                                                                                                                  | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository                                          |
 
 ## Planned tools
 
@@ -282,7 +286,6 @@ must not re-resolve app versions or substitute a newer release.
 | -------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **`flow-tools`**     | Later platform layer                          | Compose local processing operations across tools                                                                                                                         | Example: CSV → filter → QR generation → SVG template → PDF → ZIP; reusable recipes; typed inputs and outputs; progress and cancellation                                        | Do not load complete React applications into one runtime; expose separate worker-safe operation packages only after several apps have stable operations                                                           |
 | **`file-tools`**     | High priority; dedicated repository           | Identify, inspect and organize local files                                                                                                                               | Magic-byte detection; hex view; decoded strings; checksums; directory manifests; split/join; duplicate detection; trailing-data detection; batch-rename preview                | All inputs are untrusted; format inspectors require strict size and nesting limits; natural entry point to archive, privacy, crypto and package tools                                                             |
-| **`svg-tools`**      | Planned; dedicated repository                 | Source and visual SVG editing                                                                                                                                            | Synchronized DOM tree, code and canvas; optimization; path simplification; symbols; accessibility; animation; sanitization                                                     | SVG is potentially active content; previews require sanitization or sandboxing; integrate with `colour-tools`, `token-tools`, `image-tools` and `label-tools`                                                     |
 | **`image-tools`**    | High priority; dedicated repository           | Edit and batch-process raster images                                                                                                                                     | Crop, resize, rotate, compress, convert, contact sheets, sprites, responsive sets, favicon generation, metadata removal and visual quality comparison                          | Use workers and off-main-thread rendering; preserve or deliberately remove colour profiles; integrate with colour, SVG, PDF and privacy tools                                                                     |
 | **`subtitle-tools`** | Medium priority; dedicated repository         | Edit, validate and synchronize captions                                                                                                                                  | SRT, WebVTT and ASS; timing shifts; stretching; frame-rate conversion; overlap and reading-speed checks; waveform synchronization; revision comparison                         | Direct integration with `av-tools`; preserve style information when supported and disclose conversion losses                                                                                                      |
 | **`midi-tools`**     | Medium specialist app                         | MIDI event inspection and editing; transpose, quantize, tempo maps and controller data; device access should remain optional                                             |                                                                                                                                                                                |

compose.example.yaml

@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: Containerfile
-    image: git.add-ideas.de/lotobo/toolbox:0.9.2
+    image: git.add-ideas.de/lotobo/toolbox:0.10.0
     restart: unless-stopped
     read_only: true
     ports:

compose.yaml

@@ -6,9 +6,9 @@ services:
       context: .
       dockerfile: Containerfile.release
       args:
-        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.9.2}"
-        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-60e4bd533d7e0087c627cb35f50fd97ca3a298fbcb71ae7bcb7045cae6a1f340}"
-    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.9.2}"
+        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.10.0}"
+        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-de6f1afc3f0ec08ee1a8afd80d874832cbf905d0d50f62060e6985be9f5e0019}"
+    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.10.0}"
     restart: unless-stopped
     read_only: true
     tmpfs:

deploy/nginx.conf

@@ -4,6 +4,16 @@ map $uri $toolbox_cache_control {
   "~^/apps/[a-z0-9][a-z0-9-]*/vendor/ffmpeg/(?:(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)|0\.12\.10-reviewed-stack5m\.1)/(?:version\.json|(?:st|mt)/ffmpeg-core\.(?:js|wasm)|mt/ffmpeg-core\.worker\.js)$" "public, max-age=31536000, immutable";
 }
 
+map $uri $toolbox_resource_policy {
+  default "same-origin";
+  "/apps/svg/canvas-frame-controller.js" "cross-origin";
+}
+
+map $uri $toolbox_access_control_allow_origin {
+  default "";
+  "/apps/svg/canvas-frame-controller.js" "*";
+}
+
 server {
   listen 8080;
   listen [::]:8080;
@@ -19,7 +29,8 @@ server {
   add_header X-Frame-Options "DENY" always;
   add_header Cross-Origin-Opener-Policy "same-origin" always;
   add_header Cross-Origin-Embedder-Policy "require-corp" always;
-  add_header Cross-Origin-Resource-Policy "same-origin" always;
+  add_header Cross-Origin-Resource-Policy $toolbox_resource_policy always;
+  add_header Access-Control-Allow-Origin $toolbox_access_control_allow_origin always;
   add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
   add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'" always;
   add_header Cache-Control $toolbox_cache_control always;

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@add-ideas/toolbox-portal",
-      "version": "0.2.10",
+      "version": "0.2.12",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@add-ideas/toolbox-contract": "^0.2.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "license": "AGPL-3.0-only",
   "private": true,
   "type": "module",

public/SOURCE.md

@@ -1,8 +1,8 @@
 # Corresponding source
 
-The source code corresponding to add·ideas Toolbox Portal 0.2.10 is available at:
+The source code corresponding to add·ideas Toolbox Portal 0.2.12 is available at:
 
-https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.9.2
+https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.10.0
 
 Each bundled application contains its own `SOURCE.md`, license, and third-party
 license materials. The application sources are also linked from the portal.

public/toolbox.catalog.json

@@ -28,6 +28,10 @@
     {
       "manifest": "./apps/regex/toolbox-app.json",
       "enabled": true
+    },
+    {
+      "manifest": "./apps/svg/toolbox-app.json",
+      "enabled": true
     }
   ]
 }

release/toolbox.lock.example.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.9.2",
-  "portalVersion": "0.2.10",
+  "releaseVersion": "0.10.0",
+  "portalVersion": "0.2.12",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
     "name": "add·ideas Toolbox",
@@ -36,9 +36,9 @@
     },
     {
       "id": "de.add-ideas.av-tools",
-      "version": "0.2.1",
-      "artifact": "https://git.add-ideas.de/lotobo/av-tools/releases/download/v0.2.1/av-tools-0.2.1.zip",
-      "sha256": "e9b7a8c387bffbf73c688fa8e88efe96cc6662e985b2a8446b4b6c7a8c490888",
+      "version": "0.3.0",
+      "artifact": "https://git.add-ideas.de/lotobo/av-tools/releases/download/v0.3.0/av-tools-0.3.0.zip",
+      "sha256": "3476c5d43ae43ce66b5aeebe8c11334f7cd4d153586348b72f10bfbdbada9be7",
       "target": "av"
     },
     {
@@ -47,6 +47,13 @@
       "artifact": "https://git.add-ideas.de/lotobo/regex-tools/releases/download/v0.4.2/regex-tools-0.4.2.zip",
       "sha256": "a3e7342d1f0746aa9c88e6568e7fbc04ab429c94604ba5fb1094ffdb096a54fe",
       "target": "regex"
+    },
+    {
+      "id": "de.add-ideas.svg-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/svg-tools/releases/download/v0.1.0/svg-tools-0.1.0.zip",
+      "sha256": "364f14c88c4934d9c847bf76de70b89dcf564a405afd58c6703363a95fbfb6ae",
+      "target": "svg"
     }
   ]
 }

release/toolbox.lock.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.9.2",
-  "portalVersion": "0.2.10",
+  "releaseVersion": "0.10.0",
+  "portalVersion": "0.2.12",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
     "name": "add·ideas Toolbox",
@@ -36,9 +36,9 @@
     },
     {
       "id": "de.add-ideas.av-tools",
-      "version": "0.2.1",
-      "artifact": "https://git.add-ideas.de/lotobo/av-tools/releases/download/v0.2.1/av-tools-0.2.1.zip",
-      "sha256": "e9b7a8c387bffbf73c688fa8e88efe96cc6662e985b2a8446b4b6c7a8c490888",
+      "version": "0.3.0",
+      "artifact": "https://git.add-ideas.de/lotobo/av-tools/releases/download/v0.3.0/av-tools-0.3.0.zip",
+      "sha256": "3476c5d43ae43ce66b5aeebe8c11334f7cd4d153586348b72f10bfbdbada9be7",
       "target": "av"
     },
     {
@@ -47,6 +47,13 @@
       "artifact": "https://git.add-ideas.de/lotobo/regex-tools/releases/download/v0.4.2/regex-tools-0.4.2.zip",
       "sha256": "a3e7342d1f0746aa9c88e6568e7fbc04ab429c94604ba5fb1094ffdb096a54fe",
       "target": "regex"
+    },
+    {
+      "id": "de.add-ideas.svg-tools",
+      "version": "0.1.0",
+      "artifact": "https://git.add-ideas.de/lotobo/svg-tools/releases/download/v0.1.0/svg-tools-0.1.0.zip",
+      "sha256": "364f14c88c4934d9c847bf76de70b89dcf564a405afd58c6703363a95fbfb6ae",
+      "target": "svg"
     }
   ]
 }

scripts/assembler.test.ts

@@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) {
   return {
     schemaVersion: 1,
     releaseVersion: '0.1.0',
-    portalVersion: '0.2.10',
+    portalVersion: '0.2.12',
     catalogue: {
       id: 'de.add-ideas.toolbox',
       name: 'Test Toolbox',

scripts/deployment.test.ts

@@ -85,7 +85,7 @@ describe('production deployment', () => {
     expect(containerfile).toContain(
       'COPY --from=release --chown=101:101 /tmp/toolbox/'
     );
-    for (const app of ['pdf', 'xslt', 'onenote', 'av', 'regex']) {
+    for (const app of ['pdf', 'xslt', 'onenote', 'av', 'regex', 'svg']) {
       expect(containerfile).toContain(
         `test -f /tmp/toolbox/apps/${app}/toolbox-app.json`
       );
@@ -214,4 +214,28 @@ describe('production deployment', () => {
     expect(nginxConfig).toContain("media-src 'self' blob:");
     expect(nginxConfig).not.toContain("'unsafe-eval'");
   });
+
+  it('grants only the sandboxed SVG canvas controller cross-origin loading headers', () => {
+    expect(nginxConfig).toMatch(
+      /map \$uri \$toolbox_resource_policy\s*\{\s*default "same-origin";\s*"\/apps\/svg\/canvas-frame-controller\.js" "cross-origin";\s*\}/mu
+    );
+    expect(nginxConfig).toMatch(
+      /map \$uri \$toolbox_access_control_allow_origin\s*\{\s*default "";\s*"\/apps\/svg\/canvas-frame-controller\.js" "\*";\s*\}/mu
+    );
+    expect(nginxConfig).toContain(
+      'add_header Cross-Origin-Resource-Policy $toolbox_resource_policy always;'
+    );
+    expect(nginxConfig).toContain(
+      'add_header Access-Control-Allow-Origin $toolbox_access_control_allow_origin always;'
+    );
+    expect(nginxConfig).not.toMatch(
+      /location[^\n{]*canvas-frame-controller[^\n{]*\{/u
+    );
+    expect(
+      nginxConfig.match(/^\s*add_header X-Content-Type-Options /gmu)
+    ).toHaveLength(1);
+    expect(
+      nginxConfig.match(/^\s*add_header Content-Security-Policy /gmu)
+    ).toHaveLength(1);
+  });
 });

src/App.test.tsx

@@ -42,6 +42,9 @@ describe('portal UI', () => {
     expect(
       screen.getByTestId('app-card-de.add-ideas.onenote-tools')
     ).toHaveTextContent('OneNote');
+    expect(
+      screen.getByTestId('app-card-de.add-ideas.svg-tools')
+    ).toHaveTextContent('SVG');
     expect(
       screen.queryByText(
         'Page-level PDF operations performed locally in the browser.'
@@ -407,6 +410,7 @@ describe('portal UI', () => {
             'de.add-ideas.pdf-tools',
             'de.add-ideas.xslt-tools',
             'de.add-ideas.onenote-tools',
+            'de.add-ideas.svg-tools',
           ],
           hidden: [],
           theme: 'light',
@@ -424,6 +428,7 @@ describe('portal UI', () => {
       screen.getByTestId('app-card-de.add-ideas.pdf-tools'),
       screen.getByTestId('app-card-de.add-ideas.xslt-tools'),
       screen.getByTestId('app-card-de.add-ideas.onenote-tools'),
+      screen.getByTestId('app-card-de.add-ideas.svg-tools'),
     ];
     cards.forEach((card, index) => {
       const rect = {
@@ -454,7 +459,7 @@ describe('portal UI', () => {
         within(tools)
           .getAllByRole('heading', { level: 3 })
           .map((heading) => heading.textContent)
-      ).toEqual(['XSLT', 'PDF', 'OneNote']);
+      ).toEqual(['XSLT', 'PDF', 'OneNote', 'SVG']);
     });
     expect(
       JSON.parse(localStorage.getItem(PREFERENCES_KEY) ?? '{}').order
@@ -462,6 +467,7 @@ describe('portal UI', () => {
       'de.add-ideas.xslt-tools',
       'de.add-ideas.pdf-tools',
       'de.add-ideas.onenote-tools',
+      'de.add-ideas.svg-tools',
     ]);
   });
 

src/App.tsx

@@ -489,9 +489,9 @@ export default function App() {
             </span>
           </p>
           <span>
-            Portal v0.2.10 ·{' '}
+            Portal v0.2.12 ·{' '}
             <a
-              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.9.2"
+              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.10.0"
               target="_blank"
               rel="noopener noreferrer"
             >

src/catalogue.test.ts

@@ -10,7 +10,7 @@ describe('catalogue loading', () => {
     const loaded = await loadCatalogue('/toolbox.catalog.json');
     expect(loaded.catalogue.name).toBe('add·ideas Toolbox');
     expect(loaded.homeUrl).toBe('http://localhost:3000/');
-    expect(loaded.apps).toHaveLength(3);
+    expect(loaded.apps).toHaveLength(4);
     expect(loaded.apps[0]).toMatchObject({
       id: 'de.add-ideas.pdf-tools',
       name: 'PDF Workbench',
@@ -40,6 +40,7 @@ describe('catalogue loading', () => {
       'de.add-ideas.pdf-tools',
       'de.add-ideas.xslt-tools',
       'de.add-ideas.onenote-tools',
+      'de.add-ideas.svg-tools',
     ]);
     expect(loaded.unavailable).toHaveLength(1);
     expect(loaded.unavailable[0]?.reason).toMatch(/HTTP 404/);

src/test/fixtures.ts

@@ -87,6 +87,38 @@ export const regexManifest: ToolboxAppManifest = {
   },
 };
 
+export const svgManifest: ToolboxAppManifest = {
+  ...pdfManifest,
+  id: 'de.add-ideas.svg-tools',
+  name: 'SVG Tools',
+  version: '0.1.0',
+  description:
+    'Inspect, edit, optimize and transform SVG documents locally in the browser.',
+  icon: './favicon.svg',
+  categories: ['graphics', 'design', 'developer'],
+  tags: [
+    'svg',
+    'vector',
+    'path',
+    'xml',
+    'transform',
+    'optimize',
+    'accessibility',
+  ],
+  requirements: {
+    secureContext: false,
+    workers: true,
+    indexedDb: false,
+    crossOriginIsolated: false,
+    topLevelContext: false,
+  },
+  source: {
+    repository: 'https://git.add-ideas.de/lotobo/svg-tools',
+    license: 'GPL-3.0-or-later',
+  },
+  assets: ['./canvas-frame-controller.js'],
+};
+
 export const catalogue: ToolboxCatalog = {
   schemaVersion: 1,
   id: 'de.add-ideas.toolbox',
@@ -97,6 +129,7 @@ export const catalogue: ToolboxCatalog = {
     { manifest: './apps/pdf/toolbox-app.json', enabled: true },
     { manifest: './apps/xslt/toolbox-app.json', enabled: true },
     { manifest: './apps/onenote/toolbox-app.json', enabled: true },
+    { manifest: './apps/svg/toolbox-app.json', enabled: true },
   ],
 };
 
@@ -118,6 +151,8 @@ export function catalogueFetch(overrides: Record<string, Response> = {}) {
       return Response.json(onenoteManifest);
     if (url.pathname.endsWith('/apps/regex/toolbox-app.json'))
       return Response.json(regexManifest);
+    if (url.pathname.endsWith('/apps/svg/toolbox-app.json'))
+      return Response.json(svgManifest);
     return new Response('Not found', { status: 404 });
   };
 }

src/toolPresentation.test.ts

@@ -28,4 +28,15 @@ describe('compact tool presentation', () => {
     expect(shortToolTitle(regex)).toBe('Regex');
     expect(shortToolDescription(regex)).toBe('Explain and test locally.');
   });
+
+  it('uses the compact SVG tile copy', () => {
+    const svg = app(
+      'de.add-ideas.svg-tools',
+      'SVG Tools',
+      'Inspect, edit, optimize and transform SVG documents locally in the browser.'
+    );
+
+    expect(shortToolTitle(svg)).toBe('SVG');
+    expect(shortToolDescription(svg)).toBe('Inspect and edit vectors locally.');
+  });
 });

src/toolPresentation.ts

@@ -21,6 +21,10 @@ const PRESENTATION: Record<string, { title: string; description: string }> = {
     title: 'Regex',
     description: 'Explain and test locally.',
   },
+  'de.add-ideas.svg-tools': {
+    title: 'SVG',
+    description: 'Inspect and edit vectors locally.',
+  },
 };
 
 export function shortToolTitle(app: ResolvedApp): string {