BF-015-BF-023: Standardize tool actions and JSON/JWT/HTTP flows

docs/specs/design-system.md

@@ -56,6 +56,18 @@ Large tools should split orchestration, pure logic, browser effects, samples, ty
 - Errors should be specific and local to the affected input or output area.
 - Toasts are useful for command confirmation, but validation errors should not rely on toast-only feedback.
 
+## Tool Action Semantics
+
+Shared tool actions should appear in this order: Sample, Import or Upload, Clear, Reset, Preview, Run or task-specific primary actions, Copy, Download or Export, Share, then Send to.
+
+- Sample loads safe example input and expected example settings without persisting user data.
+- Clear removes current input, output, transient errors, selected files, and sensitive fields; it should not unexpectedly change durable settings unless the tool documents that behavior.
+- Reset restores documented defaults and may also clear current input/output when returning the tool to its initial state.
+- Run, Format, Minify, Validate, Convert, Generate, Decode, Encode, and Hash create or refresh output and should be disabled with a reason when required input is missing.
+- Copy, Download, and Export operate only on current valid output, provide visible feedback, and remain disabled with an accessible reason when output is empty, stale, or invalid.
+- Share and Send to must not include sensitive payloads unless the flow explicitly uses the approved sensitive handoff or share preview.
+- Destructive Clear and Reset actions use destructive styling in the shared action bar.
+
 ## Accessibility
 
 - Preserve semantic HTML before adding custom roles.

src/core/i18n/translations/de.json

@@ -108,6 +108,10 @@
     "barcode_generated": "Barcode wurde erstellt",
     "csv_downloaded": "Prognose-CSV heruntergeladen",
     "downloaded_file": "{filename} heruntergeladen",
+    "action_disabled_no_output": "Führen Sie das Tool zuerst aus, um eine Ausgabe zu erzeugen.",
+    "action_disabled_input_required": "Fügen Sie zuerst eine Eingabe hinzu.",
+    "action_disabled_preview_required": "Zeigen Sie das externe Asset vor dem Download in der Vorschau an.",
+    "action_disabled_unavailable": "Diese Aktion ist derzeit nicht verfügbar.",
     "direct_download_blocked_opened_new_tab": "Direkter Download wurde vom Remote-Host blockiert. Medien wurden in einem neuen Tab geöffnet.",
     "all_families": "Alle Familien",
     "filter_by_family": "Nach Familie filtern",
@@ -460,6 +464,8 @@
       "import_file": "Datei importieren",
       "file_imported": "Datei importiert.",
       "file_import_failed": "Dateiimport fehlgeschlagen.",
+      "download_json": "JSON herunterladen",
+      "download_disabled_invalid": "Korrigieren Sie ungültiges JSON vor dem Download.",
       "drag_drop_import_hint": "Text/JSON-Datei hier ablegen oder eine Datei zum Import auswaehlen.",
       "handoff_json_to_typescript": "Zu JSON->TS",
       "tree_edit_value_title": "JSON-Wert bearbeiten",
@@ -723,6 +729,8 @@
       "payload_label": "Nutzdaten",
       "header_copied": "Header kopiert",
       "payload_copied": "Nutzdaten kopiert",
+      "copy_claim_value": "{claim}-Claim-Wert kopieren",
+      "claim_copied": "{claim}-Claim kopiert",
       "claims_summary_title": "Claims und Zeitsemantik",
       "claim_time_note": "Zeit-Claims sind Unix-Sekunden. UTC ist massgeblich; lokale Zeit dient nur der Lesbarkeit.",
       "algorithm_label": "Algorithmus",
@@ -777,7 +785,7 @@
       "md5_quick_link": "MD5-Schnellseite",
       "sha224_quick_link": "SHA-224-Schnellseite",
       "sha384_quick_link": "SHA-384-Schnellseite",
-      "hmac_secret_hint": "HMAC-Geheimnisse bleiben nur im Arbeitsspeicher und werden nicht gespeichert.",
+      "hmac_secret_hint": "HMAC-Geheimnisse bleiben nur im Arbeitsspeicher und werden nicht gespeichert. Teilen Sie keine Screenshots oder Support-Tickets, die echte Produktionsgeheimnisse zeigen.",
       "show_secret": "HMAC-Geheimnis anzeigen",
       "hide_secret": "HMAC-Geheimnis ausblenden",
       "file_processing": "Datei-Hash wird lokal berechnet...",
@@ -1277,6 +1285,8 @@
     "http_request_builder": {
       "title": "HTTP-Anfrage-Builder",
       "description": "HTTP-Anfragen visuell erstellen und cURL-, JavaScript-Fetch- oder Python-Code generieren.",
+      "no_send_title": "Nur Codegenerierung",
+      "no_send_desc": "Das Bearbeiten dieses Builders sendet keine Anfrage. Netzwerkzugriff entsteht nur, wenn Sie das Snippet kopieren und außerhalb von byteflow.tools selbst ausführen.",
       "url_label": "Anfrage-URL",
       "headers": "Header",
       "add_header": "Header hinzufügen",

src/core/i18n/translations/en.json

@@ -108,6 +108,10 @@
     "barcode_generated": "Barcode generated",
     "csv_downloaded": "Forecast CSV downloaded",
     "downloaded_file": "Downloaded {filename}",
+    "action_disabled_no_output": "Run the tool first to create output.",
+    "action_disabled_input_required": "Add input before running this action.",
+    "action_disabled_preview_required": "Preview the external asset before downloading.",
+    "action_disabled_unavailable": "This action is unavailable right now.",
     "direct_download_blocked_opened_new_tab": "Direct download was blocked by the remote host. Opened media in a new tab instead.",
     "all_families": "All families",
     "filter_by_family": "Filter by family",
@@ -480,6 +484,8 @@
       "import_file": "Import File",
       "file_imported": "File imported.",
       "file_import_failed": "Failed to import file.",
+      "download_json": "Download JSON",
+      "download_disabled_invalid": "Fix invalid JSON before downloading.",
       "drag_drop_import_hint": "Drag and drop a text/JSON file here, or choose a file to import.",
       "handoff_json_to_typescript": "To JSON->TS",
       "tree_edit_value_title": "Edit JSON Value",
@@ -751,6 +757,8 @@
       "payload_label": "Payload",
       "header_copied": "Header copied",
       "payload_copied": "Payload copied",
+      "copy_claim_value": "Copy {claim} claim value",
+      "claim_copied": "{claim} claim copied",
       "claims_summary_title": "Claims and time semantics",
       "claim_time_note": "Time claims are Unix seconds. UTC is authoritative; local time is shown only as a convenience.",
       "algorithm_label": "Algorithm",
@@ -805,7 +813,7 @@
       "md5_quick_link": "MD5 Quick Page",
       "sha224_quick_link": "SHA-224 Quick Page",
       "sha384_quick_link": "SHA-384 Quick Page",
-      "hmac_secret_hint": "HMAC secrets stay in memory only and are not saved.",
+      "hmac_secret_hint": "HMAC secrets stay in memory only and are not saved. Avoid sharing screenshots or support tickets that show real production secrets.",
       "show_secret": "Show HMAC secret",
       "hide_secret": "Hide HMAC secret",
       "file_processing": "Hashing file locally...",
@@ -1305,6 +1313,8 @@
     "http_request_builder": {
       "title": "HTTP Request Builder",
       "description": "Build HTTP requests visually and generate cURL, JavaScript fetch, or Python code.",
+      "no_send_title": "Code generation only",
+      "no_send_desc": "Editing this builder does not send the request. Network access happens only if you copy the snippet and run it yourself outside byteflow.tools.",
       "url_label": "Request URL",
       "headers": "Headers",
       "add_header": "Add Header",

src/core/i18n/translations/fr.json

@@ -112,6 +112,10 @@
     "barcode_generated": "Code-barres généré",
     "csv_downloaded": "CSV de prévision téléchargé",
     "downloaded_file": "{filename} téléchargé",
+    "action_disabled_no_output": "Exécutez d'abord l'outil pour générer une sortie.",
+    "action_disabled_input_required": "Ajoutez une entrée avant d'exécuter cette action.",
+    "action_disabled_preview_required": "Prévisualisez la ressource externe avant de la télécharger.",
+    "action_disabled_unavailable": "Cette action est indisponible pour le moment.",
     "direct_download_blocked_opened_new_tab": "Le téléchargement direct a été bloqué par l'hôte distant. Le média a été ouvert dans un nouvel onglet.",
     "all_families": "Toutes les familles",
     "filter_by_family": "Filtrer par famille",
@@ -460,6 +464,8 @@
       "import_file": "Importer un fichier",
       "file_imported": "Fichier importe.",
       "file_import_failed": "Échec de l'import du fichier.",
+      "download_json": "Télécharger JSON",
+      "download_disabled_invalid": "Corrigez le JSON invalide avant de télécharger.",
       "drag_drop_import_hint": "Glissez-déposez un fichier texte/JSON ici, ou sélectionnez un fichier à importer.",
       "handoff_json_to_typescript": "Vers JSON->TS",
       "tree_edit_value_title": "Modifier la valeur JSON",
@@ -723,6 +729,8 @@
       "payload_label": "Charge utile",
       "header_copied": "En-tête copié",
       "payload_copied": "Charge utile copiée",
+      "copy_claim_value": "Copier la valeur du claim {claim}",
+      "claim_copied": "Claim {claim} copié",
       "claims_summary_title": "Claims et semantique temporelle",
       "claim_time_note": "Les claims de temps sont en secondes Unix. UTC fait reference ; l'heure locale est seulement une aide de lecture.",
       "algorithm_label": "Algorithme",
@@ -777,7 +785,7 @@
       "md5_quick_link": "Page rapide MD5",
       "sha224_quick_link": "Page rapide SHA-224",
       "sha384_quick_link": "Page rapide SHA-384",
-      "hmac_secret_hint": "Les secrets HMAC restent uniquement en memoire et ne sont pas enregistres.",
+      "hmac_secret_hint": "Les secrets HMAC restent uniquement en mémoire et ne sont pas enregistrés. Évitez de partager des captures d'écran ou tickets de support montrant de vrais secrets de production.",
       "show_secret": "Afficher le secret HMAC",
       "hide_secret": "Masquer le secret HMAC",
       "file_processing": "Calcul local du hash du fichier...",
@@ -1277,6 +1285,8 @@
     "http_request_builder": {
       "title": "Constructeur de requêtes HTTP",
       "description": "Construisez visuellement des requêtes HTTP et générez du code cURL, JavaScript fetch ou Python.",
+      "no_send_title": "Génération de code uniquement",
+      "no_send_desc": "Modifier ce constructeur n'envoie pas la requête. L'accès réseau n'a lieu que si vous copiez l'extrait et l'exécutez vous-même hors de byteflow.tools.",
       "url_label": "URL de requête",
       "headers": "En-têtes",
       "add_header": "Ajouter un en-tête",

src/core/i18n/translations/ja.json

@@ -108,6 +108,10 @@
     "barcode_generated": "バーコードを生成しました",
     "csv_downloaded": "予測CSVをダウンロードしました",
     "downloaded_file": "{filename} をダウンロードしました",
+    "action_disabled_no_output": "先にツールを実行して出力を生成してください。",
+    "action_disabled_input_required": "この操作を実行する前に入力を追加してください。",
+    "action_disabled_preview_required": "ダウンロードする前に外部アセットをプレビューしてください。",
+    "action_disabled_unavailable": "この操作は現在利用できません。",
     "direct_download_blocked_opened_new_tab": "リモートホストにより直接ダウンロードがブロックされました。新しいタブでメディアを開きました。",
     "all_families": "すべてのファミリー",
     "filter_by_family": "ファミリーで絞り込み",
@@ -460,6 +464,8 @@
       "import_file": "ファイルをインポート",
       "file_imported": "ファイルをインポートしました。",
       "file_import_failed": "ファイルのインポートに失敗しました。",
+      "download_json": "JSON をダウンロード",
+      "download_disabled_invalid": "無効な JSON を修正してからダウンロードしてください。",
       "drag_drop_import_hint": "テキスト/JSONファイルをここにドラッグ＆ドロップするか、ファイルを選択してインポートしてください。",
       "handoff_json_to_typescript": "JSON->TS へ",
       "tree_edit_value_title": "JSON 値を編集",
@@ -723,6 +729,8 @@
       "payload_label": "ペイロード",
       "header_copied": "ヘッダーをコピーしました",
       "payload_copied": "ペイロードをコピーしました",
+      "copy_claim_value": "{claim} クレーム値をコピー",
+      "claim_copied": "{claim} クレームをコピーしました",
       "claims_summary_title": "クレームと時間の意味",
       "claim_time_note": "時間クレームは Unix 秒です。UTC が基準で、ローカル時刻は読みやすさのためだけに表示します。",
       "algorithm_label": "アルゴリズム",
@@ -777,7 +785,7 @@
       "md5_quick_link": "MD5 クイックページ",
       "sha224_quick_link": "SHA-224 クイックページ",
       "sha384_quick_link": "SHA-384 クイックページ",
-      "hmac_secret_hint": "HMAC シークレットはメモリ内のみで扱い、保存しません。",
+      "hmac_secret_hint": "HMAC シークレットはメモリ内のみで扱い、保存しません。実際の本番シークレットが写るスクリーンショットやサポートチケットは共有しないでください。",
       "show_secret": "HMAC シークレットを表示",
       "hide_secret": "HMAC シークレットを非表示",
       "file_processing": "ファイルのハッシュをローカルで計算しています...",
@@ -1277,6 +1285,8 @@
     "http_request_builder": {
       "title": "HTTPリクエストビルダー",
       "description": "HTTPリクエストをビジュアルに構築し、cURL、JavaScript fetch、Pythonコードを生成。",
+      "no_send_title": "コード生成のみ",
+      "no_send_desc": "このビルダーを編集してもリクエストは送信されません。ネットワークアクセスは、スニペットをコピーして byteflow.tools の外で自分で実行した場合にのみ発生します。",
       "url_label": "リクエスト URL",
       "headers": "ヘッダー",
       "add_header": "ヘッダーを追加",

src/core/i18n/translations/ko.json

@@ -108,6 +108,10 @@
     "barcode_generated": "바코드를 생성했습니다",
     "csv_downloaded": "예측 CSV를 다운로드했습니다",
     "downloaded_file": "{filename} 다운로드 완료",
+    "action_disabled_no_output": "먼저 도구를 실행해 출력을 생성하세요.",
+    "action_disabled_input_required": "이 작업을 실행하기 전에 입력을 추가하세요.",
+    "action_disabled_preview_required": "다운로드하기 전에 외부 자산을 미리 보세요.",
+    "action_disabled_unavailable": "이 작업은 현재 사용할 수 없습니다.",
     "direct_download_blocked_opened_new_tab": "원격 호스트에서 직접 다운로드를 차단했습니다. 새 탭에서 미디어를 열었습니다.",
     "all_families": "모든 패밀리",
     "filter_by_family": "패밀리로 필터",
@@ -460,6 +464,8 @@
       "import_file": "파일 가져오기",
       "file_imported": "파일을 가져왔습니다.",
       "file_import_failed": "파일 가져오기에 실패했습니다.",
+      "download_json": "JSON 다운로드",
+      "download_disabled_invalid": "잘못된 JSON을 수정한 뒤 다운로드하세요.",
       "drag_drop_import_hint": "텍스트/JSON 파일을 여기에 끌어다 놓거나 파일을 선택해 가져오세요.",
       "handoff_json_to_typescript": "JSON->TS로 이동",
       "tree_edit_value_title": "JSON 값 편집",
@@ -723,6 +729,8 @@
       "payload_label": "페이로드",
       "header_copied": "헤더 복사됨",
       "payload_copied": "페이로드 복사됨",
+      "copy_claim_value": "{claim} 클레임 값 복사",
+      "claim_copied": "{claim} 클레임을 복사했습니다",
       "claims_summary_title": "클레임 및 시간 의미",
       "claim_time_note": "시간 클레임은 Unix 초입니다. UTC가 기준이며 로컬 시간은 읽기 편의를 위해서만 표시됩니다.",
       "algorithm_label": "알고리즘",
@@ -777,7 +785,7 @@
       "md5_quick_link": "MD5 빠른 페이지",
       "sha224_quick_link": "SHA-224 빠른 페이지",
       "sha384_quick_link": "SHA-384 빠른 페이지",
-      "hmac_secret_hint": "HMAC 비밀값은 메모리에만 머물며 저장되지 않습니다.",
+      "hmac_secret_hint": "HMAC 비밀값은 메모리에만 머물며 저장되지 않습니다. 실제 운영 비밀값이 보이는 스크린샷이나 지원 티켓은 공유하지 마세요.",
       "show_secret": "HMAC 비밀값 표시",
       "hide_secret": "HMAC 비밀값 숨기기",
       "file_processing": "파일 해시를 로컬에서 계산 중...",
@@ -1277,6 +1285,8 @@
     "http_request_builder": {
       "title": "HTTP 요청 빌더",
       "description": "시각적으로 HTTP 요청을 구성하고 cURL, JavaScript fetch 또는 Python 코드를 생성합니다.",
+      "no_send_title": "코드 생성 전용",
+      "no_send_desc": "이 빌더를 편집해도 요청은 전송되지 않습니다. 네트워크 접근은 스니펫을 복사해 byteflow.tools 외부에서 직접 실행할 때만 발생합니다.",
       "url_label": "요청 URL",
       "headers": "헤더",
       "add_header": "헤더 추가",

src/core/i18n/translations/zh-CN.json

@@ -108,6 +108,10 @@
     "barcode_generated": "条码已生成",
     "csv_downloaded": "预测 CSV 已下载",
     "downloaded_file": "已下载 {filename}",
+    "action_disabled_no_output": "请先运行工具生成输出。",
+    "action_disabled_input_required": "请先添加输入再执行此操作。",
+    "action_disabled_preview_required": "请先预览外部资源再下载。",
+    "action_disabled_unavailable": "此操作当前不可用。",
     "direct_download_blocked_opened_new_tab": "目标站点阻止了直接下载，已在新标签页打开媒体。",
     "all_families": "全部细分",
     "filter_by_family": "按细分筛选",
@@ -460,6 +464,8 @@
       "import_file": "导入文件",
       "file_imported": "文件已导入。",
       "file_import_failed": "导入文件失败。",
+      "download_json": "下载 JSON",
+      "download_disabled_invalid": "请先修复无效 JSON 再下载。",
       "drag_drop_import_hint": "将文本/JSON 文件拖放到这里，或选择文件导入。",
       "handoff_json_to_typescript": "转到 JSON→TS",
       "tree_edit_value_title": "编辑 JSON 值",
@@ -723,6 +729,8 @@
       "payload_label": "载荷",
       "header_copied": "头部已复制",
       "payload_copied": "载荷已复制",
+      "copy_claim_value": "复制 {claim} 声明值",
+      "claim_copied": "{claim} 声明已复制",
       "claims_summary_title": "Claims 与时间语义",
       "claim_time_note": "时间 claim 使用 Unix 秒。UTC 是权威时间，本地时间仅供阅读参考。",
       "algorithm_label": "算法",
@@ -777,7 +785,7 @@
       "md5_quick_link": "MD5 快速页面",
       "sha224_quick_link": "SHA-224 快速页面",
       "sha384_quick_link": "SHA-384 快速页面",
-      "hmac_secret_hint": "HMAC 密钥只保存在内存中，不会被保存。",
+      "hmac_secret_hint": "HMAC 密钥只保存在内存中，不会被保存。避免在截图或支持工单中展示真实生产密钥。",
       "show_secret": "显示 HMAC 密钥",
       "hide_secret": "隐藏 HMAC 密钥",
       "file_processing": "正在本地计算文件哈希...",
@@ -1277,6 +1285,8 @@
     "http_request_builder": {
       "title": "HTTP 请求构建器",
       "description": "可视化构建 HTTP 请求，生成 cURL、JavaScript fetch 或 Python 代码。",
+      "no_send_title": "仅生成代码",
+      "no_send_desc": "编辑此构建器不会发送请求。只有在你复制代码并在 byteflow.tools 之外自行运行时才会发生网络访问。",
       "url_label": "请求 URL",
       "headers": "请求头",
       "add_header": "添加请求头",