@agentcontextdistributionprotocol/acdp-wasm 0.14.4 → 0.15.0

package/README.md

@@ -1,6 +1,6 @@
 # acdp-wasm — ACDP WebAssembly verification core
 
-The **browser / edge / WASI** member of the ACDP binding family
+The **browser / edge** member of the ACDP binding family
 (`bindings/acdp-py`, `bindings/acdp-node`). A pure, **offline**
 cryptographic verifier: it lets a consumer render an ACDP context and
 independently reach a real verification **verdict** — the producer
@@ -15,7 +15,12 @@ verdicts consume.
 It is a standalone Cargo package (its own `[workspace]`) that depends on
 the umbrella `acdp` crate with `default-features = false`, so
 `reqwest` / `tokio` / `rustls` never enter the `.wasm` binary. See
-`docs/research/wasm-target.md` for the design rationale.
+`docs/research/wasm-target.md` for the (historical) design rationale. The
+package is released at the same version as the `acdp` crate; which protocol
+lines each release implements is recorded in the spec's
+[version matrix](https://github.com/agentcontextdistributionprotocol/agentcontextdistributionprotocol/blob/main/docs/version-matrix.md).
+Only `wasm32-unknown-unknown` (browser / bundler / Node via wasm-pack) is
+built and tested; WASI targets are untested.
 
 ## Design (same rules as the Python / Node bindings)
 
@@ -170,27 +175,31 @@ wasm-pack test --node
 need **no `getrandom` backend** on any wasm target. That holds at
 *runtime* — no exported verification (nor the deterministic Ed25519
 witness mint) draws randomness. It does **not** hold at *compile time*
-for `wasm32-unknown-unknown`: the core crates pull two randomness sources
-**unconditionally**, and each emits a hard `compile_error!` on that
-target unless a backend is wired:
-
-1. **`getrandom 0.2`** via `rand_core 0.6` / `OsRng` (a non-optional
-   dependency of `acdp-crypto`) → enabled with the getrandom **`js`
-   feature**.
-2. **`getrandom 0.4`** via **`uuid` v4** (a non-optional dependency of
-   `acdp-primitives`) → enabled with the getrandom **`wasm_js` feature**
-   *plus* `--cfg getrandom_backend="wasm_js"` (set in
-   `.cargo/config.toml`). `uuid` additionally needs its own **`js`
-   feature** for its v4 RNG shim.
-
-All three are wired here, **target-gated to `wasm32` only** (see
+for `wasm32-unknown-unknown`: the core crates pull **`getrandom 0.4`**
+**unconditionally**, from two places, and it emits a hard
+`compile_error!` on that target unless a backend is wired:
+
+- `acdp-crypto` key generation (`getrandom::SysRng`, used with
+  `rand_core` 0.10, which has no `OsRng`); and
+- **`uuid` v4** (a non-optional dependency of `acdp-primitives`).
+
+The backend is the getrandom **`wasm_js` feature** (on the
+`getrandom_wasm` alias in `Cargo.toml`), plus
+`--cfg getrandom_backend="wasm_js"` in `.cargo/config.toml`, which is
+inert at 0.4.3 and kept for forward compatibility. `uuid` additionally
+needs its own **`js` feature** for its v4 RNG shim. (An older direct
+`getrandom 0.2` dependency with the `js` feature, for the former
+`rand_core 0.6` / `OsRng` path, has been removed; nothing in this
+binding's graph uses 0.2 any more.)
+
+Both are wired here, **target-gated to `wasm32` only** (see
 `Cargo.toml` and `.cargo/config.toml`), so a native `cargo test` is
-untouched. `crypto.getRandomValues` (the `js` backend) is the CSPRNG
+untouched. `crypto.getRandomValues` (the `wasm_js` backend) is the CSPRNG
 RFC-ACDP-0001 §5.10 names for the browser, so the choice is spec-blessed
 — but it is never invoked on the verify path; it is present only to link.
 
 A future `producer` feature (reserved, not yet wired) would expose fresh
-key generation (`SigningKey::generate`, the only `OsRng` caller) and is
+key generation (`SigningKey::generate`, the only `SysRng` caller) and is
 where a runtime randomness draw would actually occur.
 
 ## Security notes

package/package.json

@@ -2,7 +2,7 @@
   "name": "@agentcontextdistributionprotocol/acdp-wasm",
   "type": "module",
   "description": "Agent Context Distribution Protocol — WebAssembly verification core",
-  "version": "0.14.4",
+  "version": "0.15.0",
   "license": "MIT OR Apache-2.0",
   "files": [
     "acdp_wasm_bg.wasm",