chore: release DeckOps v1.1.1 with lightweight default installation

Author: iguangfei

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## @deckflow/deckops 1.1.1 — 2026-09-07
+
+- Upgrade to `pdf-lite-parse@0.2.1`, which embeds a fixed, allowlisted PDF.js runtime and resources instead of declaring a runtime `pdfjs-dist` dependency.
+- Ordinary npm installations no longer pull in canvas for PDF parsing. Keep DeckProbe's independent optional platform CLI packages unchanged; `--omit=optional` remains available for a strict no-native installation.
+- Add default-install PDF smoke tests and enforce smaller installed-size budgets plus absence of separate PDF.js/canvas packages.
+
 ## @deckflow/deckops 1.1.0 — 2026-09-07
 
 - Upgrade the exact `pdf-lite-parse` dependency to 0.2.0. Local PDF parsing exports embedded images by default without expensive composite-figure rasterization; extractable overlay text and fidelity warnings remain visible.

README.md

@@ -24,15 +24,15 @@ npm install -g @deckflow/deckops
 
 The CLI and Node.js entry require Node.js 22.18 or newer. Frontend applications use the separate cloud-only [browser entry](#use-it-in-the-browser).
 
-Local PDF parsing uses `pdf-lite-parse@0.2.0` and exports embedded images without expensive composite-figure rasterization. Extractable overlay text is retained separately; visual fidelity losses are reported in `quality`. `--no-images` (SDK: `includeImages: false`) skips image export entirely.
+Local PDF parsing uses `pdf-lite-parse@0.2.1` and exports embedded images without expensive composite-figure rasterization. Extractable overlay text is retained separately; visual fidelity losses are reported in `quality`. `--no-images` (SDK: `includeImages: false`) skips image export entirely.
 
-The default npm install may still include `pdfjs-dist`'s optional `@napi-rs/canvas` platform binary, even though DeckOps does not request composite cropping. For a smaller, strict no-native install use:
+Ordinary `npm install @deckflow/deckops` is now lightweight for PDF parsing: the parser embeds a pinned subset of PDF.js and its portable resources, with no separately installed `pdfjs-dist` or automatic canvas dependency. DeckProbe's independent optional platform CLI packages are unchanged. To omit those as well and use the strict no-native installation:
 
 ```bash
 npm install --omit=optional @deckflow/deckops
 ```
 
-Embedded-image PDF parsing remains usable without canvas. Use the cloud engine explicitly when full figure fidelity is needed.
+Embedded-image PDF parsing works in both installation modes without canvas. Use the cloud engine explicitly when full figure fidelity is needed. Applications calling `pdf-lite-parse` directly can explicitly install canvas for its opt-in composite mode; DeckOps does not enable it automatically.
 
 ## Two verbs, deliberately
 

THIRD_PARTY_NOTICES

@@ -7,8 +7,10 @@ https://github.com/deckflow/pdf-lite-parse
 PDF.js / pdfjs-dist
 Copyright Mozilla Foundation and contributors. Licensed under the Apache License 2.0.
 https://github.com/mozilla/pdf.js
+An allowlisted runtime and resource subset is embedded in pdf-lite-parse.
+See its dist/vendor/pdfjs/PROVENANCE.json, LICENSE, and resource license notices.
 
-@napi-rs/canvas (optional, installed through pdfjs-dist on supported platforms)
+@napi-rs/canvas (only if explicitly installed by a consumer; not a dependency)
 Copyright its contributors. Licensed under the MIT License.
 https://github.com/Brooooooklyn/canvas
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deckflow/deckops",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Parse any document into an agent-operable representation. Parse once, convert repeatedly: PDF, PPTX, DOCX, Keynote and URLs into durable IR artifacts and Markdown.",
   "type": "module",
   "main": "./dist/index.js",
@@ -79,7 +79,7 @@
     "open": "^10.1.0",
     "p-limit": "^5.0.0",
     "parse5": "^7.3.0",
-    "pdf-lite-parse": "0.2.0",
+    "pdf-lite-parse": "0.2.1",
     "saxes": "^6.0.0",
     "axios": "1.19.0",
     "eventsource-parser": "1.1.2"

pnpm-lock.yaml

@@ -19,7 +19,7 @@ try {
   fs.writeFileSync(path.join(strictDir, 'package.json'), '{"private":true}');
   execFileSync('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-online', '--omit=dev', '--omit=optional', tarball], { cwd: strictDir, stdio: 'inherit' });
   const installedBytes = sizeOf(path.join(strictDir, 'node_modules'));
-  if (installedBytes > 55 * MiB) throw new Error(`Strict production install is ${(installedBytes / MiB).toFixed(2)} MiB; limit is 55 MiB.`);
+  if (installedBytes > 24 * MiB) throw new Error(`Strict production install is ${(installedBytes / MiB).toFixed(2)} MiB; limit is 24 MiB.`);
   const native = filesUnder(path.join(strictDir, 'node_modules')).filter((file) => file.endsWith('.node'));
   if (native.length) throw new Error(`Strict production install contains native binaries:\n${native.join('\n')}`);
   const installScripts = filesUnder(path.join(strictDir, 'node_modules')).filter((file) => file.endsWith('package.json')).flatMap((file) => {
@@ -44,7 +44,23 @@ try {
   fs.writeFileSync(path.join(defaultDir, 'package.json'), '{"private":true}');
   execFileSync('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-online', '--omit=dev', tarball], { cwd: defaultDir, stdio: 'inherit' });
   const defaultBytes = sizeOf(path.join(defaultDir, 'node_modules'));
+  if (defaultBytes > 30 * MiB) throw new Error(`Default production install is ${(defaultBytes / MiB).toFixed(2)} MiB; limit is 30 MiB.`);
   const defaultNative = filesUnder(path.join(defaultDir, 'node_modules')).filter((file) => file.endsWith('.node')).length;
+  if (defaultNative) throw new Error('Default installation must not pull in native canvas extensions.');
+  for (const directory of [strictDir, defaultDir]) {
+    const files = filesUnder(path.join(directory, 'node_modules'));
+    if (files.some(file => /node_modules[\\/](@napi-rs[\\/]|pdfjs-dist[\\/])/.test(file))) {
+      throw new Error('PDF parsing must use the embedded runtime, without a separate canvas/PDF.js dependency.');
+    }
+  }
+  const defaultCli = path.join(defaultDir, 'node_modules', '.bin', 'deckops');
+  const defaultOutput = path.join(workspace, 'default-pdf-smoke');
+  const defaultSmoke = JSON.parse(execFileSync(defaultCli, ['parse', path.join(root, 'tests/generated/test.pdf'),
+    '--engine', 'local', '--preflight', 'off', '--output', defaultOutput, '--json'], {encoding:'utf8'}));
+  if (!defaultSmoke.ok || defaultSmoke.engine !== 'local') throw new Error('Default production install failed the local PDF smoke test.');
+  const ir = JSON.parse(fs.readFileSync(path.join(defaultOutput, 'ir.json'), 'utf8'));
+  const parserVersion = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).dependencies['pdf-lite-parse'];
+  if (ir.producer.version !== parserVersion) throw new Error('Installed PDF parser version does not match the dependency pin.');
   process.stdout.write(`tarball ${(item.size / MiB).toFixed(2)} MiB; strict install ${(installedBytes / MiB).toFixed(2)} MiB; default install ${(defaultBytes / MiB).toFixed(2)} MiB (${defaultNative} native binaries); cold-start P95 ${p95.toFixed(0)} ms; PDF RSS ${(measured.maxRssBytes / MiB).toFixed(2)} MiB; files >1 MiB ${large.length}\n`);
 } finally {
   if (tarball) fs.rmSync(tarball, { force: true });

scripts/check-package-size.mjs

@@ -8,6 +8,7 @@ import { resolveInput } from '../../src/core/input.js';
 import { runParse } from '../../src/core/parse-op.js';
 import { validateDeckIR } from '../../src/ir/validate.js';
 import { createClient } from '../../src/index.js';
+import { PDF_PARSER_VERSION } from '../../src/version.js';
 
 const tmp = (): string => fs.mkdtempSync(path.join(os.tmpdir(), 'deckops-local-'));
 
@@ -62,13 +63,13 @@ describe('local community engine', () => {
       await runParse(options);
       const manifestFile = path.join(out, 'manifest.json');
       const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf-8'));
-      expect(manifest.parse.parser.version).toBe('0.2.0');
+      expect(manifest.parse.parser.version).toBe(PDF_PARSER_VERSION);
       manifest.parse.parser.version = '0.1.2';
       fs.writeFileSync(manifestFile, JSON.stringify(manifest));
       expect(await runParse(options)).toMatchObject({ engine: 'local', reusedParse: false });
       expect(await runParse(options)).toMatchObject({ engine: 'artifact-cache', reusedParse: true });
       const current = await readManifest(out);
-      expect(current).toMatchObject({ parse: { parser: { version: '0.2.0' } } });
+      expect(current).toMatchObject({ parse: { parser: { version: PDF_PARSER_VERSION } } });
     } finally { fs.rmSync(root, { recursive: true, force: true }); }
   }, 30_000);