Release Package Tools 0.2.0

README.md

@@ -6,7 +6,7 @@ bounded, format-aware interpretation for EPUB, OOXML (`.docx`, `.xlsx`,
 `.pptx`), OpenDocument (`.odt`, `.ods`, `.odp`), JAR, APK, and Chrome/Firefox
 extension packages.
 
-Version 0.1.0 can:
+Version 0.2.0 can:
 
 - inventory paths, sizes, compression, CRC-32, ZIP64 and encryption state;
 - reject traversal, ambiguous, colliding and special-entry paths;
@@ -14,12 +14,21 @@ Version 0.1.0 can:
 - interpret OOXML content types and internal/external relationships;
 - inspect EPUB container/package metadata and manifest/spine consistency;
 - inspect ODF manifests, JAR manifests and WebExtension manifests;
-- inventory known signature-material files without asserting validity or trust;
+- inventory signature-material pairs and declared digest algorithms without
+  asserting validity or trust;
+- extract bounded dependency declarations from package.json, Python requirements,
+  Maven metadata and JAR Class-Path, plus conventional licence-file evidence;
 - flag missing relationship/manifest targets and unreferenced embedded media;
 - preview bounded text, raster images, audio and video, and download a strictly
   re-read entry;
-- compare two package inventories by path, kind, size, compressed size and CRC;
+- compare two packages using bounded, on-demand SHA-256 of verified
+  decompressed entries; matching metadata/CRC alone remains explicitly
+  unverified;
+- summarize safe bounded JSON, XML, manifest and text differences without
+  rendering or executing package content;
 - export an inert JSON inventory report.
+- explicitly hand a verified entry to the browser/OS share surface where
+  supported, with verified download-and-reopen as the local-only fallback.
 
 All processing happens in the browser. The app has no telemetry, remote parser,
 CDN assets or automatic network lookups.
@@ -42,11 +51,14 @@ for the complete verification suite.
 Package Tools is an inspection aid, not a renderer for office/ebook content,
 an APK resource decoder, a Java class analyser, an extension sandbox, or a
 signature verifier. It never establishes authenticity or publisher trust.
+Dependency declarations are not resolved or vulnerability-checked, and licence
+evidence is not a legal interpretation. A chosen OS share target can upload a
+file even though Package Tools itself never does.
 Encrypted entries, split archives, unsafe paths, unsupported compression, and
 entries beyond the configured byte budgets remain inventory-only.
 
 APK v2/v3/v4 signing blocks live outside normal ZIP entries and are not decoded
-in v0.1. Chrome CRX wrapper headers are not a guaranteed input format; use an
+in v0.2. Chrome CRX wrapper headers are not a guaranteed input format; use an
 unpacked ZIP-form extension package when needed.
 
 ## Licence