# Image Studio · Experimental

Free4AllHub adaptation of miniPaint 4.14.3, upstream commit a79733eb803fc97084ef0ee4faa96b031e69e1c0. This is a free local-file layered editor, not a Photoshop-equivalence claim. Use disposable files. No browser editing acceptance is claimed.

## First practice
Download practice-card.json. Open image-studio.html in a current desktop browser. Use the host's Open a local file chooser and choose the practice card; review the replacement dialog. It contains three rectangle layers. Its schema was checked against the actual project validator, but it was not exported or reopened in a browser. Select Golden square in Layers, use Select object to move it, toggle its visibility, and change opacity. Try Undo then Redo one action at a time. Save As produces editable miniPaint JSON; Export produces PNG/JPEG/WebP. Click Download prepared file above the editor when offered. Check the file actually exists before closing. Open a fresh editor tab and reopen your saved JSON, verify all three layers, then make another change. This is a suggested acceptance exercise, not a browser-tested tutorial.

Opening editable JSON replaces the current document after review. Importing a PNG, JPEG or WebP adds an image layer; the first image sizes an empty canvas. Save current work first. Imports accept one PNG, JPEG, WebP or supported miniPaint 4.14.3 JSON at a time. Limits include 32 MB files, 8192 per dimension, 16 million canvas pixels, 128 layers, 32 million combined decoded image pixels, plus rendering complexity limits. PSD, GIF, TIFF, remote images/fonts and embedded user fonts are not supported. Existing system fonts can vary by device.

Image Studio JSON is NOT the simple image tool's project format and NOT a Free4AllHub project bundle. Use it only in Image Studio. Raster exports flatten layers and do not preserve editability. Refreshing/closing loses unsaved work and undo history; no persistent storage is provided. Browser download requests do not prove successful saves.

## Source and build
The complete preferred editor source is in src/, with images/, index.html, .babelrc, package.json, package-lock.json and webpack.config.js. host.js and standalone-template.html implement the portable shell. compiled/bundle.js preserves the successful unminified production bundle with three About-dialog display strings changed for the experimental release (see runtime-changes.json). Third-party terms are in MIT-LICENSE.txt, THIRD-PARTY-NOTICES.txt and notices/. Runtime libraries retain their own licenses. Imported artwork remains subject to its own rights.

To reproduce all seven served route files and the source ZIP after extraction, run from the extracted root (the folder containing image-studio/ and scripts/):
    python3 scripts/build-image-studio.py
Output: dist/tools/image-studio/. This deterministic packaging step needs only Python and the included files, no installation or network.

Repackage just the preserved bundle from the image-studio/ directory without installing dependencies:
    python3 package-standalone.py
Output: image-studio.html.

Recompile the preferred source with Node 24 and npm (dependency installation requires network):
    npm ci --ignore-scripts --no-audit --no-fund
    npm run build
    python3 package-standalone.py dist/bundle.js

The build uses production mode without minification, matching the preserved compiled runtime's build mode. Utilities resolves to this source directory's node_modules, not a private parent directory. Webpack module IDs/comments and output bytes can vary with paths or toolchain; this is not a byte-identical rebuild claim. The packager normalizes line endings and recalculates CSP hashes. The initial bundle was built with webpack 5.106.2. Size warnings are expected. The application has no runtime network dependencies.

Bounded source-method checks after npm ci (DOM/canvas/MessagePort doubles, not browser proof):
    node tests/bridge-invariants.cjs
    node tests/file-bridge.test.cjs
    node tests/export-errors.test.cjs

## Isolation and verification limits
The editor runs in an opaque-origin iframe with only allow-scripts and allow-downloads; no allow-same-origin, popups, forms, storage or device permissions. Hash-based CSP permits the exact script, inline styles and local data/blob images. A MessageChannel carries only explicitly chosen local files and prepared exports. No image upload endpoint or account is added.

Compilation and static/source-method checks do not verify browser startup, sandbox enforcement, image decoding or actual pixels, native pickers/downloads, multilayer fresh-session reopen, keyboard/assistive technology or mobile usability. Important edits should wait for real-browser acceptance. This experimental release makes no claim of fully tested tools, lossless image quality or Photoshop parity.