Release Toolbox SDK 0.3.0

README.md

@@ -5,7 +5,7 @@ tools. An app always works by itself. When it receives a trusted same-origin
 catalog URL, the same app gains a toolbox home link and an app switcher without
 becoming coupled to a portal or client-side router.
 
-Version `0.2.3` contains three publish-ready packages:
+Version `0.3.0` contains three publish-ready packages:
 
 - `@add-ideas/toolbox-contract` — types, strict v1 runtime parsing, context
   discovery/loading, resolved URLs, and contextual link helpers.
@@ -57,6 +57,14 @@ Deploy `toolbox-app.json` beside the application entry. The canonical schema is
     "indexedDb": true,
     "crossOriginIsolated": false
   },
+  "io": {
+    "accepts": [{ "mediaType": "application/pdf", "extensions": [".pdf"] }],
+    "produces": [{ "mediaType": "application/pdf", "extensions": [".pdf"] }]
+  },
+  "capabilities": {
+    "required": ["workers"],
+    "optional": ["file-system-access"]
+  },
   "privacy": {
     "processing": "local",
     "fileUploads": false,
@@ -69,12 +77,21 @@ Deploy `toolbox-app.json` beside the application entry. The canonical schema is
 }
 ```
 
-`source`, `privacy.label`, `privacy.url`, `requirements.topLevelContext`,
-`actions`, and `assets` are optional v1 additions. `toolbox-check` verifies the
-entry, icon, and every declared asset. Runtime parsers validate every known
+`source`, `privacy.label`, `privacy.url`, `requirements.topLevelContext`, `io`,
+`capabilities`, `actions`, and `assets` are optional v1 additions. `io`
+advertises accepted and produced media types/extensions; `capabilities`
+describes required and progressive browser features. `toolbox-check` verifies
+the entry, icon, and every declared asset. Runtime parsers validate every known
 field, require `schemaVersion: 1`, and deliberately discard unknown fields so
 future optional additions do not break v1 consumers.
 
+When a manifest includes `capabilities`, worker declarations are cross-checked:
+`requirements.workers: true` means the app cannot run without workers and
+therefore requires `"workers"` in `capabilities.required`. Apps with a
+main-thread fallback set the requirement to `false` and may list `"workers"` in
+`capabilities.optional` instead. Legacy v1 manifests without a capability
+profile remain valid.
+
 For typed source definitions, use the literal-preserving identity helper:
 
 ```ts
@@ -88,6 +105,24 @@ export const manifest = defineToolboxApp({
 Use `parseToolboxApp(unknownValue)` at trust boundaries; `defineToolboxApp()` is
 compile-time only and does not replace runtime parsing.
 
+## Explicit local artifact handoff
+
+`createToolboxTransfer()` stores bounded `Blob` objects in same-origin IndexedDB
+using a cryptographic, short-lived token routed to one target app. Only that
+opaque token is added to the target URL by `createToolboxTransferUrl()`. The
+target calls `consumeToolboxTransfer()` and the record is atomically deleted.
+File bytes are neither uploaded nor placed in URLs, cross-origin destinations
+are rejected, and transfers expire after fifteen minutes by default. File
+descriptors, evidence, counts, names, sizes, and lifetimes are bounded before
+IndexedDB receives them.
+
+The target app id is a routing/integrity check in this API, not a browser access
+control boundary. IndexedDB is shared by the entire origin, so any script
+running on that origin can open the transfer database directly and read or
+delete its records. Deploy only mutually trusted, reviewed Toolbox apps on one
+origin; an untrusted app must use a separate origin and cannot participate in
+this same-origin handoff.
+
 ## Catalog v1
 
 The canonical schema is