@krauq/ufo-cli 1.10.2 → 4.0.0

package/NOTICE

@@ -55,10 +55,16 @@ web-engine/legal/component-inventory.tsv.
 
 Vendored asset notices live with the assets: viewer-core/src/main/resources/
 NOTICE.md records the modified Roboto derivatives and their exact byte
-identities, and the public domain LZMA SDK PPMd7 decoder port. The decoder
+identities, the public domain LZMA SDK PPMd7 decoder port, and the BSD-3-Clause
+OpenEXR PIZ algorithm adaptation. The decoder
 source provenance and version are in viewer-core/src/main/resources/
 component-inventory.tsv. The Android notice resource is app/src/main/res/raw/
-third_party_notices.txt.
+third_party_notices.txt. The Android app's Office fonts (Carlito, Caladea and
+Liberation, SIL Open Font License 1.1) are unmodified upstream files; their
+sources, versions and SHA-256 identities are in app/src/main/assets/
+office-fonts/fonts.json. The interface face on Android and Windows (UFO UI
+Text and Display, res/font/ui_*.ttf and desktop fonts/ui_*.ttf) is built from
+Google Sans Flex (SIL Open Font License 1.1) by tools/fonts/make_ui_fonts.py.
 
 Named obligations that survive redistribution, from the review rows above:
 
@@ -96,3 +102,178 @@ business use license in packaging/linux-cli/ENGINE-LICENSE.txt, and it ships
 the Apache License text and this NOTICE as the Apache License requires. The
 obligations named above stand as written for a source publication of the
 listed paths, which ships no third party binary.
+
+DrawingML preset geometry data
+------------------------------
+The drawingml/presets.tsv resource is generated from the ECMA-376 Part 1
+presetShapeDefinitions.xml distributed by Apache POI, an Apache Software
+Foundation project, under the Apache License, Version 2.0.
+Source: https://github.com/apache/poi/blob/trunk/poi/src/main/resources/org/apache/poi/sl/draw/geom/presetShapeDefinitions.xml
+Source SHA-256: 4a762444d8d85876881c02a5b1dedf6f73006fcd8acb7b4e393435615b37c780
+Changes: compacted to rendering guides and paths; the redundant fourth zero
+operand in eight upstream circular-arrow formulas is removed.
+Generator: tools/formats/generate_drawingml_presets.py
+The Apache licence applies to this data, not to UFO's proprietary engines.
+Licence: https://www.apache.org/licenses/LICENSE-2.0
+
+WordArt geometry and fallback outlines
+-------------------------------------
+The drawingml/text-warps.tsv resource is generated from ECMA-376 Part 1
+presetTextWarpDefinitions.xml distributed by Apache OpenOffice, an Apache
+Software Foundation project, under the Apache License, Version 2.0.
+Source: https://github.com/apache/openoffice/blob/trunk/main/oox/source/export/presetTextWarpDefinitions.xml
+Source SHA-256: 793434f6ba266822a8a931307af05ef4458fc70c67190cd7c76ac9b5cea68b45
+Changes: compacted to bounded adjustment guides and text paths.
+Generator: tools/formats/generate_drawingml_presets.py --text-warps
+
+The drawingml/wordart-fonts.tsv resource contains outlines and advances derived
+from the existing modified Roboto Medium and Bold fonts, copyright Google Inc.,
+under the Apache License, Version 2.0. The source font byte hashes are recorded
+in the resource header. Existing font modifications are documented in
+viewer-core/src/main/resources/NOTICE.md. The offline generator decomposes
+composite glyphs and emits quadratic outlines; no font library ships with it.
+Generator: tools/formats/generate_wordart_fonts.py
+These licences apply to the data, not to UFO's proprietary engines.
+Licence: https://www.apache.org/licenses/LICENSE-2.0
+
+Supplemental WordArt outlines
+-----------------------------
+The drawingml/wordart-fallback.tsv resource contains regular Latin, Hebrew consonants and
+heart/suit glyph outlines derived from the existing Liberation Sans 2.1.5
+Regular and Bold fonts. Source byte hashes are recorded in the resource.
+The derived resource is named UFO supplemental outline data. Reserved font
+names are used only to identify upstream sources. Its licence and copyright
+notice follow, also embedded in drawingml/wordart-OFL.txt.
+UFO supplemental outline data
+
+Digitized data copyright (c) 2010 Google Corporation with Reserved Font
+Names Arimo, Tinos and Cousine.
+Copyright (c) 2012 Red Hat, Inc. with Reserved Font Name Liberation.
+
+Derived from Liberation Sans 2.1.5. Reserved names identify the source fonts;
+this derived resource is named UFO supplemental outline data.
+
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
+
+OpenJPEG JPEG 2000 context and MQ state adaptation (BSD 2-Clause)
+--------------------------------------------------------------
+The shared Kotlin JPEG 2000 decoder adapts the Annex C MQ state table and
+Annex D context selection from OpenJPEG. It does not embed the native library.
+Reference: https://github.com/uclouvain/openjpeg/tree/v2.5.4/src/lib/openjp2
+
+Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
+Copyright (c) 2002-2014, Professor Benoit Macq
+Copyright (c) 2001-2003, David Janssens
+Copyright (c) 2002-2003, Yannick Verschueren
+Copyright (c) 2003-2007, Francois-Olivier Devaux
+Copyright (c) 2003-2014, Antonin Descampe
+Copyright (c) 2005, Herve Drolon, FreeImage Team
+Copyright (c) 2007, Callum Lerwick <seg@haxxed.com>
+Copyright (c) 2008, Jerome Fimes, Communications & Systemes <jerome.fimes@c-s.fr>
+Copyright (c) 2012, Carl Hetherington
+Copyright (c) 2017, IntoPIX SA <support@intopix.com>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS `AS IS'
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -6,19 +6,19 @@ change them without breaking them, and hand back clean copies. UFO runs
 locally as a CLI or stdio MCP server. Reports state what was inspected and
 what remains unknown; findings are advisory, not an antivirus verdict.
 
-This package installs the exact UFO 1.10.2 runtime. Direct
-[Linux downloads](https://github.com/krauqllc/ufo-cli/releases/tag/v1.10.2)
+This package installs the exact UFO 4.0.0 runtime. Direct
+[Linux downloads](https://github.com/krauqllc/ufo-cli/releases/tag/v4.0.0)
 are also available. Install and check your first file:
 
 ```sh
-npm install --global @krauq/ufo-cli@1.10.2 --allow-scripts=@krauq/ufo-cli
+npm install --global @krauq/ufo-cli@4.0.0 --allow-scripts=@krauq/ufo-cli
 ufo --version
 ufo doctor
 ufo inspect --json ./your-file
 ```
 
 On npm 12, the explicit script approval lets UFO's installer run. With npm 11
-or earlier, use `npm install --global @krauq/ufo-cli@1.10.2` with install scripts
+or earlier, use `npm install --global @krauq/ufo-cli@4.0.0` with install scripts
 enabled; omit `--allow-scripts`.
 
 Linux x86_64, glibc 2.35+, Node.js 18.17+ and GNU tar are required. Ubuntu
@@ -30,8 +30,8 @@ Your npm version may require a newer Node.js release than the wrapper does.
 For example, npm 12.2.0 requires Node.js 22.22.2 or later in 22.x, 24.15.0 or
 later in 24.x, or 26+. Use a Node.js version supported by your npm release.
 
-Installation downloads the pinned 202 MB release archive over HTTPS and checks
-its hash and complete runtime identity. npm install scripts must be enabled.
+Installation downloads the pinned release archive over HTTPS and checks
+its byte count, hash and complete runtime identity. npm install scripts must be enabled.
 Document processing sends no network requests or telemetry. A connected agent
 can send tool results to its model provider.
 
@@ -101,7 +101,7 @@ Use `npm uninstall --global @krauq/ufo-cli` to remove the wrapper and downloaded
 runtime. It leaves your documents and per-user license in place. The optional
 `ufo license remove` command removes that license separately.
 
-To reuse an existing matching 1.10.2 installation, set
+To reuse an existing matching 4.0.0 installation, set
 `UFO_CLI_SKIP_DOWNLOAD=1` and `UFO_CLI_BINARY` to its absolute `bin/ufo` path
 during installation. The resolved path is saved and reused on later launches
 and rebuilds. The wrapper rejects another version and its own launcher.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@krauq/ufo-cli",
-  "version": "1.10.2",
+  "version": "4.0.0",
   "private": false,
   "description": "Pinned local file inspection, extraction and guarded edits for CLI and MCP. Linux x86_64.",
   "mcpName": "io.github.krauqllc/ufo-cli",

package/release-pins.json

@@ -1,22 +1,22 @@
 {
-  "version": "1.10.2",
+  "version": "4.0.0",
   "provenance": {
-    "releaseUrl": "https://github.com/krauqllc/ufo-cli/releases/tag/v1.10.2",
-    "releaseId": 417997072,
-    "sourceCommit": "d19224080702193bd6dada8f7b122e40b370b308",
+    "releaseUrl": "https://github.com/krauqllc/ufo-cli/releases/tag/v4.0.0",
+    "releaseId": 431694866,
+    "sourceCommit": "037df4d4ab0feb83a617e2efbc2543c4231f0c34",
     "checksumSignatureNamespace": "ufo-cli-release-checksums-v1",
     "signerFingerprint": "SHA256:PaoFqFSErvcvmeZ+GAzWUSX/f2A3afw9RIvrs4wxt60",
-    "verifiedAt": "2026-10-20"
+    "verifiedAt": "2026-11-02"
   },
   "assets": {
     "linux-x64": {
-      "url": "https://github.com/krauqllc/ufo-cli/releases/download/v1.10.2/universal-file-opener-1.10.2-linux-x64.tar.gz",
-      "sha256": "69c1d5498ce5ddf1dc69ca7d67527b53a1929160e516fe04c18f1d5a2dcddc41",
-      "sizeBytes": 209084749,
-      "launcher": "universal-file-opener-1.10.2-linux-x64/bin/ufo",
-      "launcherSha256": "f7853d3846baf1eb7d22ce6c35ce67447b4a4c23f6ea2704abb7e59a46f891a4",
-      "treeSha256": "66bb46d56fadd1822f0d90904c14c33012f25e387dec6eca4f77be839c87d725",
-      "fileCount": 469
+      "url": "https://github.com/krauqllc/ufo-cli/releases/download/v4.0.0/universal-file-opener-4.0.0-linux-x64.tar.gz",
+      "sha256": "e2964a8fcfc288fbec9fac78d6cf269aa3b0989de19e8bce0b49506943e58313",
+      "sizeBytes": 247591668,
+      "launcher": "universal-file-opener-4.0.0-linux-x64/bin/ufo",
+      "launcherSha256": "1de7574eac74ad03566faf2ac914e4abc533871ac80c847d24e5ee3eacee9119",
+      "treeSha256": "c8dcf2d27b625bf77b37fc9bc576ff27940dd2c55f5db7a8c32bf1eeda8f058c",
+      "fileCount": 474
     }
   }
 }