v1.0.0

New Signals

• Added richer package ecosystem identification: Android/Alpine APK, npm, Cargo crate, Ruby gem, Debian package, NuGet, VSIX, IPA, conda, egg, Arch/FreeBSD/macOS pkg.
• Added .deb identity features: package, version, architecture, maintainer, dependencies, installed size.
• Added .gem identity features: name, version, platform, homepage, authors, licenses, runtime/development dependency counts.
• Added more PE malware-relevant metrics, such as CLR managed resource count, max entropy, max size.

Better Evidence Anchoring

• ELF dynamic imports now include offsets into .dynstr.
• Mach-O dylib references and code signatures now include offsets.
• Source member symbols now include byte offsets.

Detection Quality

• Improved package disambiguation, especially Android vs Alpine .apk, npm .tgz, Arch/FreeBSD/macOS .pkg.
• Better AppleScript and pacman/AUR install-scriptlet detection.
• Reduced false positives by classifying unsupported OCaml, Vim, Lisp, SQL, Smali, patches/diffs, CSS-like files, and TS baselines as text
  instead of weakly guessing JS/Kotlin/Batch.

Robustness For Large Corpora

• Hardened Tree-sitter extraction against panics, deep ASTs, huge query output, and scanner-risk cases.
• Added metrics such as ast.depth_capped, source.query_limited.*, and source.ast_unavailable so skipped/truncated AST extraction is explicit.
• Binary string extraction reuses existing PE/ELF/Mach-O parses, reducing duplicate parsing work.

Breaking/Schema Notes

• FileType::Pkg became specific variants like PkgMacos, PkgFreebsd, and PkgArch.
• Symbol::Member now has optional offset.
• New source error stages: SourceParse, SourceExtract, SourceAstWalk.
• pe.cert_table_size moved from values to metrics.