Release Unicode Tools 0.2.0

public/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.0 - 2026-09-02
+
+- Added lazy, pinned UTS #39 Identifier_Status/Identifier_Type evidence, skeleton comparison, restriction estimates, and structured confusable/invisible/control diagnostics.
+- Added detailed grapheme/emoji structure inspection and bounded presentation-selector, skin-tone and ZWJ construction with explicit non-RGI/font-support limits; added Toolbox I/O/capability metadata.
+
 ## 0.1.0 - 2026-09-01
 
 - Added the initial local-first Unicode Tools workbench.

public/LICENSES/npm-runtime-licenses.txt

@@ -1,5 +1,5 @@
 ==============================================================================
-@add-ideas/toolbox-contract@0.2.3
+@add-ideas/toolbox-contract@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---
@@ -198,7 +198,7 @@ Declared licence: Apache-2.0
 
 
 ==============================================================================
-@add-ideas/toolbox-helpers@0.1.0
+@add-ideas/toolbox-helpers@0.2.0
 Declared licence: GPL-3.0-or-later
 ==============================================================================
 --- LICENSE ---
@@ -879,7 +879,7 @@ Public License instead of this License.  But first, please read
 
 
 ==============================================================================
-@add-ideas/toolbox-shell-react@0.2.3
+@add-ideas/toolbox-shell-react@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---

public/README.md

@@ -4,26 +4,36 @@ Explore Unicode characters, scripts, emoji and text locally.
 
 Unicode Tools is a standalone local-first application in the [add·ideas Toolbox](https://git.add-ideas.de/lotobo/toolbox-portal). Inputs are processed in the browser and are not uploaded.
 
-## Version 0.1.0 scope
+## Version 0.2.0 scope
 
 - Search 159,866 assigned Unicode scalar records by official name, alias,
   literal character, or code point, with script, block and category filters.
+- Traverse any block or hexadecimal range in a 16-column virtualized code
+  chart with roving keyboard navigation and property cards. Only visible rows
+  are materialized, including when the entire U+0000–U+10FFFF space is open.
 - Browse and copy 3,952 fully-qualified emoji and components, inspect named
-  sequences, and open practical symbol collections.
+  sequences, open practical symbol collections, and construct bounded
+  presentation-selector, skin-tone and ZWJ variants without claiming RGI
+  validity or font support.
 - Inspect text as Unicode scalar values, UTF-16 positions, UTF-8 bytes,
-  JavaScript and HTML escapes, and browser-segmented grapheme clusters.
+  JavaScript and HTML escapes, and browser-segmented grapheme clusters with
+  emoji/ZWJ/variation/modifier/flag/keycap/tag evidence.
 - Decode lists of hexadecimal scalar values and compare NFC, NFD, NFKC and
   NFKD normalization without losing sight of the original value.
-- Compute a UTS #39 confusable skeleton, show applied mappings, and flag mixed
-  primary scripts as a review signal rather than a security verdict.
+- Compute UTS #39 confusable skeletons, compare skeleton collisions, display
+  pinned Identifier_Status/Identifier_Type evidence, and flag mixed scripts,
+  controls, default ignorables, combining repetition and non-NFC text as
+  review signals rather than security verdicts.
 - Inspect character properties and optionally load selected Unihan readings,
   definitions and radical/stroke fields for Han ideographs.
 - Download an auditable source-identity report for every pinned data input.
 
 The catalog is generated from checksum-pinned Unicode Consortium 17.0 data. It
 does not scrape or redistribute descriptions, artwork, or annotations from
-Symbl or another symbol website. Private-use code points and UTF-16 surrogates
-remain visible as ranges, but are not presented as assigned characters.
+Symbl or another symbol website. Unassigned scalars, private-use scalars,
+permanently reserved noncharacters and UTF-16 surrogate code units are labelled
+as distinct chart states; none is presented as an assigned character. Lone
+surrogate copy is disabled because a surrogate is not a Unicode scalar value.
 
 The application treats every input as untrusted, applies explicit resource
 limits, and never interprets text as active content. The checked-in catalog can
@@ -44,7 +54,7 @@ npm run test:browser
 
 ## Release
 
-`npm run release:artifact` creates a deterministic `release/unicode-tools-0.1.0.zip` and checksum sidecar.
+`npm run release:artifact` creates a deterministic `release/unicode-tools-0.2.0.zip` and checksum sidecar.
 
 ## Licence
 

public/SOURCE.md

@@ -1,8 +1,8 @@
 # Corresponding source
 
-The corresponding source for Unicode Tools 0.1.0 is available at:
+The corresponding source for Unicode Tools 0.2.0 is available at:
 
-https://git.add-ideas.de/lotobo/unicode-tools/src/tag/v0.1.0
+https://git.add-ideas.de/lotobo/unicode-tools/src/tag/v0.2.0
 
 Build with Node.js 22, npm 11, `npm ci`, and `npm run release:artifact`.
 The preferred source includes the generated JSON catalog in `public/data/` so

public/THIRD_PARTY_NOTICES.md

@@ -14,7 +14,7 @@ Inc.
 ## Runtime code
 
 Runtime dependency licences are reproduced in
-`LICENSES/npm-runtime-licenses.txt` in release artifacts. Toolbox SDK packages
-are Apache-2.0. The reusable Toolbox Helpers package is GPL-3.0-or-later.
+`LICENSES/npm-runtime-licenses.txt` in release artifacts. Toolbox SDK 0.3.0
+packages are Apache-2.0. Toolbox Helpers 0.2.0 is GPL-3.0-or-later.
 React and React DOM are MIT. The build-only `fflate` dependency is MIT and is
 used by the catalog generator, not shipped as runtime code.

public/data/manifest.json

@@ -13803,9 +13803,13 @@
       "value": "Inherited"
     }
   ],
+  "identifierStatusFile": "identifier-status.json",
+  "identifierTypeFile": "identifier-types.json",
   "emojiCount": 3952,
   "namedSequenceCount": 461,
   "confusableMappingCount": 6565,
+  "identifierStatusRangeCount": 1649,
+  "identifierTypeRangeCount": 5104,
   "unihanCount": 102998,
   "sourceIdentity": [
     {

public/docs/ARCHITECTURE.md

@@ -17,8 +17,21 @@ persistent search history.
 archives and text files into deterministic checked-in source data. It derives
 names, aliases, general categories, scripts, blocks, ages, bidi and case
 properties, emoji, named sequences, selected Unihan fields, and UTS #39
-confusable mappings. Private-use and surrogate ranges are not expanded into
-synthetic catalog records.
+confusable mappings. The code chart virtualizes complete Unicode block or
+custom-range traversal into fixed row windows, requesting at most 512 entries
+from the worker. Assigned records come from the pinned catalog; missing entries
+are classified explicitly as unassigned, private-use, surrogate, or
+noncharacter instead of being omitted. Private-use and surrogate ranges are not
+expanded into the checked-in catalog itself.
+
+The generated catalog also includes lazy worker shards for the checksum-pinned
+UTS #39 `IdentifierStatus.txt` and `IdentifierType.txt` ranges. Worker analysis
+loads them with the confusable table only when requested, applies those exact
+ranges per scalar, creates NFD skeletons, and emits structured diagnostics plus
+an intentionally conservative restriction-level estimate. `unicode/graphemes.ts` layers bounded structural
+inspection and small sequence-editing operations on the shared
+`Intl.Segmenter` wrapper; those operations construct code-point sequences but
+do not alter or validate the pinned RGI emoji catalog.
 
 Rendering, normalization and grapheme segmentation use the current browser and
 operating-system Unicode implementation, which can differ from the pinned

public/docs/PRIVACY-SECURITY.md

@@ -6,16 +6,26 @@ versioned static catalog files and never sends search terms or inspected text.
 Input is rendered as React text, not executable HTML.
 
 Text inspection is limited to 1,000,000 UTF-16 code units, scalar decoding to
-10,000 values, catalog results to 180, emoji results to 240, and displayed
-confusable mappings to 500. Large static datasets are held in a worker so the
-UI can remain responsive. Unihan data loads only on demand.
+10,000 values, catalog results to 180, emoji results to 240, displayed
+confusable mappings to 500, and each virtual code-chart worker request to 512
+entries. Large static datasets are held in a worker and chart rows are
+virtualized so the UI can remain responsive. Unihan data loads only on demand.
 
-UTS #39 skeleton equivalence and mixed-script detection are review signals.
-They are not proof of spoofing, maliciousness, safety, or identifier validity;
-applications still need a context-specific identifier profile and policy.
+UTS #39 skeleton equivalence, pinned identifier status/type, mixed-script
+detection, bidi/default-ignorable controls, repeated combining marks and the
+displayed restriction-level estimate are review signals. They are not proof of
+spoofing, maliciousness, safety, or identifier validity; applications still
+need a context-specific identifier profile and policy. The comparison field
+tests skeleton equivalence only and does not perform account or domain lookup.
 Character glyphs come from the user's fonts, so a missing or surprising glyph
 does not alter the underlying code point.
 
+Emoji editing removes or inserts specific variation selectors and skin-tone
+modifiers or joins 2–8 grapheme parts with ZWJ. It intentionally refuses
+ambiguous selector editing inside an existing ZWJ sequence, and it does not
+promise that constructed output is RGI, semantically appropriate, supported by
+the current font, or rendered as a single glyph.
+
 Developers can regenerate the catalog, but every upstream byte sequence must
 match a hard-coded SHA-256 before parsing. The public release performs no such
 download. Data source identities are inspectable and exportable from the app.

public/sw.js

@@ -1,5 +1,5 @@
 const CACHE_PREFIX = "unicode-tools-shell-";
-const CACHE_NAME = CACHE_PREFIX + "0.1.0";
+const CACHE_NAME = CACHE_PREFIX + "0.2.0";
 const CORE = ["./", "./manifest.webmanifest", "./favicon.svg"];
 self.addEventListener("install", (event) => {
   event.waitUntil(

public/toolbox-app.json

@@ -3,12 +3,22 @@
   "schemaVersion": 1,
   "id": "de.add-ideas.unicode-tools",
   "name": "Unicode Tools",
-  "version": "0.1.0",
-  "description": "Explore Unicode characters, scripts, emoji and text locally.",
+  "version": "0.2.0",
+  "description": "Explore Unicode, emoji, graphemes and text security locally.",
   "entry": "./",
   "icon": "./favicon.svg",
   "categories": ["unicode", "text", "developer"],
-  "tags": ["unicode", "emoji", "character", "codepoint", "script", "block"],
+  "tags": [
+    "unicode",
+    "emoji",
+    "grapheme",
+    "confusable",
+    "security",
+    "character",
+    "codepoint",
+    "script",
+    "block"
+  ],
   "integration": {
     "contextVersion": 1,
     "launchModes": ["navigate", "new-tab"],
@@ -21,6 +31,20 @@
     "crossOriginIsolated": false,
     "topLevelContext": false
   },
+  "io": {
+    "accepts": [],
+    "produces": [
+      {
+        "mediaType": "application/json",
+        "extensions": [".json"],
+        "label": "Pinned data identity report"
+      }
+    ]
+  },
+  "capabilities": {
+    "required": ["workers"],
+    "optional": ["clipboard-write", "intl-segmenter"]
+  },
   "privacy": {
     "processing": "local",
     "fileUploads": false,