@doccloak/core 0.12.1 → 0.13.0

package/dist/pipeline.js

@@ -45,13 +45,19 @@ function runRule(rule, segment, out) {
             rule.pattern.lastIndex++;
             continue;
         }
-        if (rule.validate && !rule.validate(match[0]))
+        // A class that admits whitespace (IBAN, phone) can end the match on a
+        // space before the next word; the replacement would then swallow it.
+        const lead = match[0].length - match[0].trimStart().length;
+        const value = match[0].trim();
+        if (value.length === 0)
+            continue;
+        if (rule.validate && !rule.validate(value))
             continue;
         out.push({
             type: rule.type,
-            value: match[0],
-            start: segment.offset + match.index,
-            end: segment.offset + match.index + match[0].length,
+            value,
+            start: segment.offset + match.index + lead,
+            end: segment.offset + match.index + lead + value.length,
             confidence: rule.confidence,
             detector: rule.detector,
         });
@@ -99,13 +105,56 @@ export function resolveOverlaps(entities) {
         return b.confidence - a.confidence;
     });
     const resolved = [];
+    const remainders = [];
     for (const entity of sorted) {
-        const overlaps = resolved.some((existing) => entity.start < existing.end && entity.end > existing.start);
-        if (!overlaps) {
+        let coveredTo = -1;
+        for (const existing of resolved) {
+            if (entity.start < existing.end && entity.end > existing.start)
+                coveredTo = Math.max(coveredTo, existing.end);
+        }
+        if (coveredTo < 0) {
             resolved.push(entity);
+            continue;
+        }
+        // The entity loses to the spans it overlaps, but what it covers past them may still be a value:
+        // keep it (remainderFrom) so it is not left in clear (T233). A PDF exported from a spreadsheet
+        // glued a clipped cell to the next one ("31-147 Krakók.wisniewska@firma.pl"): the model took
+        // "31-147 Krakók", the e-mail rule the whole token, and dropping the e-mail left
+        // ".wisniewska@firma.pl" in the output.
+        remainders.push(...remainderFrom(entity, coveredTo));
+    }
+    // Each remainder is strictly shorter than its entity, so this terminates.
+    return remainders.length > 0 ? resolveOverlaps([...resolved, ...remainders]) : resolved;
+}
+const REMAINDER_LEAD = /^[\s.,;:!?\-–—/()[\]{}"'«»“”‘’„]+/u;
+const REMAINDER_TRAIL = /[\s,.;:!?)\]}"'»”’]+$/u;
+const HAS_TEXT = /[\p{L}\p{N}]/u;
+/**
+ * What `entity` covers from `from` on, as entities. A regex match only means something whole
+ * ("00 before 2025" is a date because "00" reads as a day), so its rule runs again on the rest and
+ * only what it matches there survives ("wisniewska@firma.pl" does, "before 2025" does not). A model
+ * span has no rule to re-run: its rest is kept without the punctuation at its edges ("ith" of a
+ * "Smith" the winner cut at "Sm").
+ */
+function remainderFrom(entity, from) {
+    if (from >= entity.end)
+        return [];
+    const raw = entity.value.slice(from - entity.start);
+    if (entity.detector.startsWith('regex:')) {
+        const rule = ALL_REGEX_RULES.find((r) => r.detector === entity.detector);
+        if (rule) {
+            const out = [];
+            runRule(rule, { text: raw, offset: from }, out);
+            return out;
         }
     }
-    return resolved;
+    const lead = REMAINDER_LEAD.exec(raw)?.[0].length ?? 0;
+    const trail = REMAINDER_TRAIL.exec(raw.slice(lead))?.[0].length ?? 0;
+    const value = raw.slice(lead, raw.length - trail);
+    if (!HAS_TEXT.test(value))
+        return [];
+    const start = from + lead;
+    return [{ ...entity, value, start, end: start + value.length }];
 }
 // ── trimSpanPunctuation ────────────────────────────────────
 const LEADING_PUNCT = /^[\s(\[{"'«“‘„]+/u;
@@ -316,12 +365,78 @@ export function propagateEntities(text, entities) {
     return propagated;
 }
 // ── detectEntities ─────────────────────────────────────────
+// ── splitCatchAlls ─────────────────────────────────────────
+/**
+ * Regex rules at or below this confidence are catch-alls (`universal:
+ * long_number`): they exist to cover digit runs no specific rule knows.
+ */
+const CATCH_ALL_CONFIDENCE = 0.5;
+/** Detections (ML or regex) a catch-all yields to when they overlap it. */
+const SPECIFIC_CONFIDENCE = 0.8;
+/**
+ * T230: a catch-all regex span yields to the specific detections it
+ * overlaps. `long_number` admits whitespace, so a PESEL cell followed by a
+ * phone cell ("90050598761 512 987 654") is one 23-character span that
+ * resolveOverlaps prefers (same start, longer) over PESEL 0.9 + PHONE 0.8:
+ * the row came out as one [SSN] and the phone "was not detected".
+ *
+ * Every catch-all that overlaps a specific span is replaced by its
+ * leftovers: the uncovered slices are re-run through the same rule, so an
+ * unknown long number next to a phone is still caught, and the specific
+ * spans then win. Catch-alls nothing specific overlaps are untouched, and
+ * so is everything else (the leak-averse "earlier start, longer span" order
+ * stays for all other overlaps).
+ */
+export function splitCatchAlls(text, entities) {
+    const specific = entities.filter((e) => e.confidence >= SPECIFIC_CONFIDENCE);
+    if (specific.length === 0)
+        return entities;
+    const out = [];
+    for (const entity of entities) {
+        const catchAll = entity.detector.startsWith('regex:') && entity.confidence <= CATCH_ALL_CONFIDENCE;
+        if (!catchAll) {
+            out.push(entity);
+            continue;
+        }
+        const covering = specific
+            .filter((s) => s.start < entity.end && s.end > entity.start)
+            .sort((a, b) => a.start - b.start);
+        if (covering.length === 0) {
+            out.push(entity);
+            continue;
+        }
+        const rule = ALL_REGEX_RULES.find((r) => r.detector === entity.detector);
+        let cursor = entity.start;
+        const gaps = [];
+        for (const s of covering) {
+            if (s.start > cursor)
+                gaps.push([cursor, s.start]);
+            cursor = Math.max(cursor, s.end);
+        }
+        if (cursor < entity.end)
+            gaps.push([cursor, entity.end]);
+        for (const [start, end] of gaps) {
+            if (rule) {
+                runRule(rule, { text: text.slice(start, end), offset: start }, out);
+            }
+            else {
+                const slice = text.slice(start, end);
+                const lead = slice.length - slice.trimStart().length;
+                const value = slice.trim();
+                if (value.length > 0) {
+                    out.push({ ...entity, value, start: start + lead, end: start + lead + value.length });
+                }
+            }
+        }
+    }
+    return out;
+}
 export function detectEntities(text, mlEntities, regexEntities) {
     if (!text.trim())
         return [];
     const mlResults = filterFalsePositives(trimSpanPunctuation(mlEntities));
     const regexResults = regexEntities;
-    const initial = resolveOverlaps([...mlResults, ...regexResults]);
+    const initial = resolveOverlaps(splitCatchAlls(text, [...mlResults, ...regexResults]));
     const propagated = propagateEntities(text, initial);
     return resolveOverlaps([...initial, ...propagated]);
 }

package/dist/providers/bardsai.d.ts

@@ -50,7 +50,7 @@ export declare class BardsaiProvider implements DetectionProvider {
     getThreshold(): number;
     load(): Promise<void>;
     release(): void;
-    detect(text: string, onProgress?: (progress: number) => void): Promise<DetectedEntity[]>;
+    detect(text: string, onProgress?: (progress: number) => void, signal?: AbortSignal): Promise<DetectedEntity[]>;
     private inferChunk;
     private emitEntity;
     private deduplicateSpans;

package/dist/providers/bardsai.js

@@ -14,6 +14,7 @@
 // wasm fallback, asyncify binary). The bare entry resolves the deprecated JSEP
 // bundle whose wasm exceeds Cloudflare Pages' 25 MiB per-file limit.
 import * as ort from 'onnxruntime-web/webgpu';
+import { throwIfAborted } from "../types.js";
 import { evictModelFromCache, fetchModelBlob, loadPinnedTokenizer } from "../model-loader.js";
 // ── Model config ──────────────────────────────────────────
 // Supply-chain pinning (T116): the model is fetched from an immutable
@@ -238,7 +239,8 @@ export class BardsaiProvider {
         this.loading = false;
         this.loadError = null;
     }
-    async detect(text, onProgress) {
+    async detect(text, onProgress, signal) {
+        throwIfAborted(signal);
         if (!this.isLoaded())
             await this.load();
         if (!this.session || !this.tokenizer)
@@ -305,6 +307,8 @@ export class BardsaiProvider {
         let chunksDone = 0;
         onProgress?.(0.1); // tokenization done
         while (i < words.length) {
+            // T222: a cancelled run stops here, before the next inference.
+            throwIfAborted(signal);
             let subtokenSum = 0;
             let end = i;
             while (end < words.length && subtokenSum + subtokenCounts[end] <= maxSubtokens) {

package/dist/providers/gliner-base.d.ts

@@ -93,7 +93,7 @@ export declare class GlinerBaseProvider implements DetectionProvider {
     restoreCustomLabels(): Promise<void>;
     load(): Promise<void>;
     release(): void;
-    detect(text: string, onProgress?: (progress: number) => void): Promise<DetectedEntity[]>;
+    detect(text: string, onProgress?: (progress: number) => void, signal?: AbortSignal): Promise<DetectedEntity[]>;
     private buildPromptTokens;
     private inferChunk;
 }

package/dist/providers/gliner-base.js

@@ -19,6 +19,7 @@
 // wasm fallback, asyncify binary). The bare entry resolves the deprecated JSEP
 // bundle whose wasm exceeds Cloudflare Pages' 25 MiB per-file limit.
 import * as ort from 'onnxruntime-web/webgpu';
+import { throwIfAborted } from "../types.js";
 import { fetchModelBlob, loadPinnedTokenizer } from "../model-loader.js";
 import { DEFAULT_PII_LABELS, greedySelect, mapLabelToEntityType, sigmoid, splitWords, } from "./gliner.js";
 // ── Model config ──────────────────────────────────────────
@@ -265,7 +266,8 @@ export class GlinerBaseProvider {
         this.loading = false;
         this.loadError = null;
     }
-    async detect(text, onProgress) {
+    async detect(text, onProgress, signal) {
+        throwIfAborted(signal);
         if (!this.isLoaded())
             await this.load();
         if (!this.session || !this.tokenizer)
@@ -298,6 +300,8 @@ export class GlinerBaseProvider {
             // Multiple overlapping chunks
             let chunksDone = 0;
             for (let chunkStart = 0; chunkStart < words.length; chunkStart += chunkSize - overlap) {
+                // T222: a cancelled run stops here, before the next inference.
+                throwIfAborted(signal);
                 const chunkEnd = Math.min(chunkStart + chunkSize, words.length);
                 const chunkWords = words.slice(chunkStart, chunkEnd);
                 const chunkStarts = starts.slice(chunkStart, chunkEnd);

package/dist/providers/gliner.d.ts

@@ -81,7 +81,7 @@ export declare class GlinerProvider implements DetectionProvider {
     restoreCustomLabels(): Promise<void>;
     load(): Promise<void>;
     release(): void;
-    detect(text: string, onProgress?: (progress: number) => void): Promise<DetectedEntity[]>;
+    detect(text: string, onProgress?: (progress: number) => void, signal?: AbortSignal): Promise<DetectedEntity[]>;
     private buildPromptTokens;
     private inferChunk;
 }

package/dist/providers/gliner.js

@@ -10,6 +10,7 @@
 // wasm fallback, asyncify binary). The bare entry resolves the deprecated JSEP
 // bundle whose wasm exceeds Cloudflare Pages' 25 MiB per-file limit.
 import * as ort from 'onnxruntime-web/webgpu';
+import { throwIfAborted } from "../types.js";
 import { evictModelFromCache, fetchModelBlob, loadPinnedTokenizer } from "../model-loader.js";
 // ── Model config ──────────────────────────────────────────
 // Supply-chain pinning (T116): the model is fetched from an immutable
@@ -293,7 +294,8 @@ export class GlinerProvider {
         this.loading = false;
         this.loadError = null;
     }
-    async detect(text, onProgress) {
+    async detect(text, onProgress, signal) {
+        throwIfAborted(signal);
         if (!this.isLoaded())
             await this.load();
         if (!this.session || !this.tokenizer)
@@ -326,6 +328,8 @@ export class GlinerProvider {
             // Multiple overlapping chunks
             let chunksDone = 0;
             for (let chunkStart = 0; chunkStart < words.length; chunkStart += chunkSize - overlap) {
+                // T222: a cancelled run stops here, before the next inference.
+                throwIfAborted(signal);
                 const chunkEnd = Math.min(chunkStart + chunkSize, words.length);
                 const chunkWords = words.slice(chunkStart, chunkEnd);
                 const chunkStarts = starts.slice(chunkStart, chunkEnd);

package/dist/regex/rules.data.js

@@ -36,7 +36,7 @@ export const RULES_DATA = [
             {
                 "id": "regex:universal:iban",
                 "entityType": "IBAN",
-                "pattern": "\\b[A-Z]{2}\\s?\\d{2}[\\s]?[A-Z\\d\\s]{10,30}\\b",
+                "pattern": "\\b[A-Z]{2}\\s?\\d{2}\\s?[A-Z\\d\\s]{9,29}[A-Z\\d]\\b",
                 "flags": "g",
                 "confidence": 0.9,
                 "domains": [
@@ -263,18 +263,19 @@ export const RULES_DATA = [
             {
                 "id": "regex:universal:postal_city",
                 "entityType": "ADDRESS",
-                "pattern": "\\b\\d{2,5}[-\\s]?\\d{2,4}\\s+[\\p{L}][\\p{L}]+(?![\\p{L}\\p{N}])",
+                "pattern": "(?:^|\\s)(?!\\d{4}-(?:\\d{2}|\\d{4})\\s)\\d{2,5}[-\\s]?\\d{2,4}\\s+[\\p{Lu}][\\p{L}]+(?![\\p{L}\\p{N}])",
                 "flags": "gu",
                 "confidence": 0.65,
                 "domains": [
                     "contact"
                 ],
-                "description": "Postal/zip code followed by city name (various country formats)",
+                "description": "Postal/zip code followed by a capitalised city name (various country formats); the code must not be glued to a preceding digit, slash, dot or hyphen",
                 "examples": [
                     "00-950 Warszawa",
-                    "75008 Paris"
+                    "75008 Paris",
+                    "1010 Wien"
                 ],
-                "falsePositiveNotes": "May match non-address number+word sequences"
+                "falsePositiveNotes": "May match non-address number+word sequences (a number followed by a capitalised word)"
             },
             {
                 "id": "regex:universal:aws_access_key",
@@ -761,17 +762,21 @@ export const RULES_DATA = [
             {
                 "id": "regex:pl:phone",
                 "entityType": "PHONE",
-                "pattern": "\\b(?:\\+?48[\\s-]?)?\\d{3}[\\s-]?\\d{3}[\\s-]?\\d{3}\\b",
+                "pattern": "(?:\\+?48[\\s-]?)?(?:\\(\\d{2}\\)|\\b\\d{2})[\\s-]?\\d{3}[\\s-]?\\d{2}[\\s-]?\\d{2}\\b|(?:\\+?48[\\s-]?)?\\b\\d{3}[\\s-]?\\d{3}[\\s-]?\\d{3}\\b",
                 "flags": "g",
                 "confidence": 0.8,
                 "domains": [
                     "contact"
                 ],
-                "description": "Polish phone number (9 digits, optionally with +48 prefix)",
+                "description": "Polish phone number: 9 digits as mobile 3-3-3 or landline 2-3-2-2 (area code optionally in brackets), optionally with +48 prefix",
                 "examples": [
                     "+48 600 123 456",
                     "600-123-456",
-                    "48 600123456"
+                    "48 600123456",
+                    "22 555 01 02",
+                    "(22) 555-01-02",
+                    "+48 22 555 01 02",
+                    "22 5550102"
                 ]
             },
             {

package/dist/types.d.ts

@@ -8,6 +8,16 @@ export interface DetectedEntity {
     detector: string;
 }
 export type ProgressCallback = (downloaded: number, total: number) => void;
+/**
+ * A detect call was cancelled through its AbortSignal (T222). Providers throw
+ * it between chunks, the engine before and after the ML pass, and the worker
+ * protocol client when the host acknowledges a `cancelDetect`.
+ */
+export declare class DetectionAbortedError extends Error {
+    constructor(message?: string);
+}
+/** Throw DetectionAbortedError when `signal` has been aborted. */
+export declare function throwIfAborted(signal: AbortSignal | undefined): void;
 /**
  * Interface for detection providers.
  * Implement this to add a new model/detection backend.
@@ -24,8 +34,13 @@ export interface DetectionProvider {
     isLoading(): boolean;
     /** Register a callback for download progress updates */
     onProgress(callback: ProgressCallback): void;
-    /** Run detection on the given text. Optional progress callback (0-1). */
-    detect(text: string, onProgress?: (progress: number) => void): Promise<DetectedEntity[]>;
+    /**
+     * Run detection on the given text. Optional progress callback (0-1).
+     * `signal` (T222) is checked between inference chunks: an aborted signal
+     * makes the provider stop at the next chunk boundary and reject with
+     * DetectionAbortedError (work already done is discarded).
+     */
+    detect(text: string, onProgress?: (progress: number) => void, signal?: AbortSignal): Promise<DetectedEntity[]>;
     /** Set detection confidence threshold */
     setThreshold(value: number): void;
     /** Get current detection confidence threshold */

package/dist/types.js

@@ -1,3 +1,20 @@
+/**
+ * A detect call was cancelled through its AbortSignal (T222). Providers throw
+ * it between chunks, the engine before and after the ML pass, and the worker
+ * protocol client when the host acknowledges a `cancelDetect`.
+ */
+export class DetectionAbortedError extends Error {
+    constructor(message = 'Detection aborted') {
+        super(message);
+        this.name = 'DetectionAbortedError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Throw DetectionAbortedError when `signal` has been aborted. */
+export function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw new DetectionAbortedError();
+}
 export const ENTITY_COLORS = {
     PERSON: '#7B2FF7',
     EMAIL: '#2563EB',

package/dist/worker-protocol.d.ts

@@ -7,6 +7,7 @@
  *
  *   init / switchProvider  -> loaded | loadError   (+ downloadProgress events)
  *   detect                 -> detected | detectError (+ detectionProgress events)
+ *   cancelDetect           -> detectError { aborted: true } on the cancelled requestId (T222)
  *   releaseModel           -> released
  *   setThreshold / setCustomLabels / setRegex / setRegexRegion  (fire and forget)
  *
@@ -39,6 +40,15 @@ export type EngineRequest = {
     type: 'detect';
     requestId: number;
     text: string;
+}
+/**
+ * T222: stop the detect call with this requestId at its next chunk
+ * boundary. Unknown or already finished ids are ignored; the cancelled
+ * call answers with detectError { aborted: true }.
+ */
+ | {
+    type: 'cancelDetect';
+    requestId: number;
 } | {
     type: 'switchProvider';
     requestId?: number;
@@ -79,6 +89,7 @@ export type EngineResponse = {
     type: 'detectError';
     requestId: number;
     error: string;
+    aborted?: boolean;
 } | {
     type: 'detectionProgress';
     requestId: number;

package/dist/worker-protocol.js

@@ -7,6 +7,7 @@
  *
  *   init / switchProvider  -> loaded | loadError   (+ downloadProgress events)
  *   detect                 -> detected | detectError (+ detectionProgress events)
+ *   cancelDetect           -> detectError { aborted: true } on the cancelled requestId (T222)
  *   releaseModel           -> released
  *   setThreshold / setCustomLabels / setRegex / setRegexRegion  (fire and forget)
  *
@@ -19,6 +20,7 @@
  * is the client side: a DocCloakEngine that forwards over the port (web
  * main thread, extension side panel / service worker).
  */
+import { DetectionAbortedError } from "./types.js";
 import { PROVIDERS, clampThreshold, defaultThresholdFor } from "./engine.js";
 import { REGEX_REGIONS } from "./regex/index.js";
 function errorMessage(err) {
@@ -26,7 +28,7 @@ function errorMessage(err) {
 }
 // ── Message validation (R12) ───────────────────────────────
 const REQUEST_TYPES = new Set([
-    'init', 'detect', 'switchProvider', 'setThreshold', 'setCustomLabels', 'setRegex', 'setRegexRegion', 'releaseModel',
+    'init', 'detect', 'cancelDetect', 'switchProvider', 'setThreshold', 'setCustomLabels', 'setRegex', 'setRegexRegion', 'releaseModel',
 ]);
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
@@ -68,6 +70,10 @@ function requestProblem(msg) {
             if (typeof msg.text !== 'string')
                 return 'text must be a string';
             return null;
+        case 'cancelDetect':
+            if (!isFiniteNumber(msg.requestId))
+                return 'requestId must be a number';
+            return null;
         case 'switchProvider':
             if (!isProviderId(msg.providerId))
                 return 'providerId must be a known provider id';
@@ -109,6 +115,8 @@ export function serveEngine(engine, port) {
     function post(msg) {
         port.postMessage(msg);
     }
+    /** In-flight detect calls by requestId, so cancelDetect can abort them (T222). */
+    const inflight = new Map();
     async function handleLoad(requestId, run) {
         try {
             await run();
@@ -177,17 +185,30 @@ export function serveEngine(engine, port) {
                 break;
             }
             case 'detect': {
+                // A repeated requestId supersedes the earlier call's controller;
+                // the earlier call keeps running to completion on its own signal.
+                const controller = new AbortController();
+                inflight.set(msg.requestId, controller);
                 try {
-                    const entities = await engine.detect(msg.text, undefined, (progress) => {
+                    const entities = await engine.detect(msg.text, controller.signal, (progress) => {
                         post({ type: 'detectionProgress', requestId: msg.requestId, progress });
                     });
                     post({ type: 'detected', requestId: msg.requestId, entities });
                 }
                 catch (err) {
-                    post({ type: 'detectError', requestId: msg.requestId, error: errorMessage(err) });
+                    const aborted = err instanceof DetectionAbortedError || controller.signal.aborted;
+                    post({ type: 'detectError', requestId: msg.requestId, error: errorMessage(err), aborted });
+                }
+                finally {
+                    if (inflight.get(msg.requestId) === controller)
+                        inflight.delete(msg.requestId);
                 }
                 break;
             }
+            case 'cancelDetect': {
+                inflight.get(msg.requestId)?.abort();
+                break;
+            }
             case 'setThreshold': {
                 await handleSetting(() => engine.updateSettings({ threshold: msg.value }));
                 break;
@@ -316,7 +337,7 @@ export function connectEngine(port, initial) {
                 break;
             }
             case 'detectError': {
-                takePending(msg.requestId)?.reject(new Error(msg.error));
+                takePending(msg.requestId)?.reject(msg.aborted ? new DetectionAbortedError(msg.error) : new Error(msg.error));
                 break;
             }
             case 'released': {
@@ -386,15 +407,27 @@ export function connectEngine(port, initial) {
             await switchProvider(patch.providerId);
         }
     }
+    /**
+     * Detect over the port. An aborted `signal` sends cancelDetect to the host
+     * and the promise rejects with DetectionAbortedError once the host has
+     * acknowledged (its detectError { aborted: true }), so a resolved rejection
+     * means the worker is idle again; a host that never answers is the
+     * caller's watchdog's business (the web app terminates it after a grace
+     * period). A signal aborted before the call rejects at once.
+     */
     function detect(text, signal, onProgress) {
         if (signal?.aborted)
-            return Promise.reject(new Error('Detection aborted'));
+            return Promise.reject(new DetectionAbortedError());
         const promise = request('detect', { type: 'detect', text }, onProgress);
         if (signal) {
             const requestId = nextRequestId;
-            signal.addEventListener('abort', () => {
-                takePending(requestId)?.reject(new Error('Detection aborted'));
-            }, { once: true });
+            const onAbort = () => {
+                if (closed || !pending.has(requestId))
+                    return;
+                port.postMessage({ type: 'cancelDetect', requestId });
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            promise.finally(() => signal.removeEventListener('abort', onAbort)).catch(() => { });
         }
         return promise;
     }

package/fonts/liberation/LICENSE

@@ -0,0 +1,102 @@
+Digitized data copyright (c) 2010 Google Corporation
+	with Reserved Font Arimo, Tinos and Cousine.
+Copyright (c) 2012 Red Hat, Inc.
+	with Reserved Font Name Liberation.
+
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+
+PREAMBLE The goals of the Open Font License (OFL) are to stimulate
+worldwide development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to provide
+a free and open framework in which fonts may be shared and improved in
+partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves.
+The fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works.  The fonts and derivatives,
+however, cannot be released under any other type of license.  The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+ 
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such.
+This may include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components
+as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting ? in part or in whole ?
+any of the components of the Original Version, by changing formats or
+by porting the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical writer
+or other person who contributed to the Font Software.
+
+
+PERMISSION & CONDITIONS
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,in
+   Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+   redistributed and/or sold with any software, provided that each copy
+   contains the above copyright notice and this license. These can be
+   included either as stand-alone text files, human-readable headers or
+   in the appropriate machine-readable metadata fields within text or
+   binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+   Name(s) unless explicit written permission is granted by the
+   corresponding Copyright Holder. This restriction only applies to the
+   primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+   Software shall not be used to promote, endorse or advertise any
+   Modified Version, except to acknowledge the contribution(s) of the
+   Copyright Holder(s) and the Author(s) or with their explicit written
+   permission.
+
+5) The Font Software, modified or unmodified, in part or in whole, must
+   be distributed entirely under this license, and must not be distributed
+   under any other license. The requirement for fonts to remain under
+   this license does not apply to any document created using the Font
+   Software.
+
+
+ 
+TERMINATION
+This license becomes null and void if any of the above conditions are not met.
+
+ 
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT.  IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
+DEALINGS IN THE FONT SOFTWARE.
+