@file-viewer/renderer-signature 3.0.0 → 3.0.1

package/README.en.md

@@ -60,7 +60,7 @@ The policy must accept only application-resolved, fixed package URLs. Never pass
 
 The OpenPGP backend uses permissively licensed rPGP `0.20.0` inside a dedicated, lazy Worker/WASM path. It does not use OpenPGP.js, GnuPG, or LGPL source. The narrow public boundary supports classification, bounded metadata inspection, and multi-signature verification for detached, cleartext, and unencrypted embedded/compressed messages; it does not expose rPGP internals or secret key material.
 
-The optimized artifact has hard release gates of 1,600,000 B raw / 450,000 B Brotli for WASM and 1,800,000 B for the npm tarball. The verifier performs two byte-for-byte reproducibility builds. Default limits are 32 MiB input, 16 MiB extracted output, 4,096 packets, 16 nesting levels, 128 user IDs, 128 subkeys, and 256 signatures.
+The optimized artifact has hard release gates of 1,900,000 B raw / 450,000 B Brotli for WASM and 1,800,000 B for the npm tarball. The raw budget reflects a WasmGC-free build so engines without GC (Node 18, older browsers) can parse the module. The verifier performs two byte-for-byte reproducibility builds. Default limits are 32 MiB input, 16 MiB extracted output, 4,096 packets, 16 nesting levels, 128 user IDs, 128 subkeys, and 256 signatures.
 
 Direct ASN.1 calls to `inspectSignatureContainer` and `inspectEvidenceRecord` also bound input, original content, node and nesting counts, algorithms, certificates, CRLs, signers, attributes, extracted bytes, timestamp chains, and hash-tree nodes. Per-call `options.limits` can only lower these absolute ceilings.
 

package/README.md

@@ -62,7 +62,7 @@ const signature = {
 
 OpenPGP 后端使用 MIT/Apache-2.0 的 rPGP `0.20.0`，在专用 Worker 中懒加载 WASM；不使用 OpenPGP.js、GnuPG 或 LGPL 源码。公开 API 只暴露分类、受限元数据检查，以及分离、cleartext、未加密内嵌/压缩消息的多签名验证，不暴露 rPGP 底层对象或私钥材料。
 
-当前优化产物的硬门禁为：WASM 不超过 1,600,000 B raw / 450,000 B Brotli，npm tarball 不超过 1,800,000 B。构建会做两次字节级可复现校验。默认解析上限为 32 MiB 输入、16 MiB 提取输出、4096 个包、16 层嵌套、128 个 user ID、128 个子密钥和 256 个签名。
+当前优化产物的硬门禁为：WASM 不超过 1,900,000 B raw / 450,000 B Brotli，npm tarball 不超过 1,800,000 B。raw 预算对应不启用 WasmGC 的兼容性构建，保证 Node 18 与无 GC 的浏览器可解析。构建会做两次字节级可复现校验。默认解析上限为 32 MiB 输入、16 MiB 提取输出、4096 个包、16 层嵌套、128 个 user ID、128 个子密钥和 256 个签名。
 
 直接调用 ASN.1 API 时，`inspectSignatureContainer` 和 `inspectEvidenceRecord` 还会限制输入、原文、节点、嵌套、摘要算法、证书、CRL、签名人、属性、提取内容、时间证据链和 hash-tree 数量；`options.limits` 只能调低，不能突破绝对上限。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@file-viewer/renderer-signature",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "private": false,
   "type": "module",
   "sideEffects": false,
@@ -79,7 +79,7 @@
     "THIRD_PARTY_LICENSES.json"
   ],
   "dependencies": {
-    "@file-viewer/core": "3.0.0",
+    "@file-viewer/core": "3.0.1",
     "jszip": "3.10.1"
   },
   "devDependencies": {