arcane-os 0.1.2 → 0.2.0

package/src/dev-server.mjs

@@ -17,6 +17,7 @@ import {verifyRuntime} from './runtime.mjs';
 import {verifySdkBrowserRuntime} from './sdk-browser-runtime.mjs';
 import {resolveWorkspace} from './workspace.mjs';
 import {createEventQueue} from './event-queue.mjs';
+import {SDK_NAME,SDK_VERSION} from './constants.mjs';
 
 const MIME_TYPES=new Map([
     ['.css','text/css; charset=utf-8'],
@@ -44,6 +45,17 @@ const SESSION_COOKIE='Arcane-Dev-Session';
 const PRIVATE_SOURCE_SEGMENTS=new Set([
     'arcane-app.json','arcane-package.json','test','tests','scripts','node_modules','dist','local'
 ]);
+const SDK_RUNTIME_SOURCE_PROTOCOL='arcane-sdk-runtime-source/1';
+const SDK_RUNTIME_SOURCE_ARCANE_ROOTS=new Set([
+    'components','css','entities','img','modules','security'
+]);
+const SDK_RUNTIME_SOURCE_PRIVATE_SEGMENTS=new Set([
+    'node_modules','.git','.hg','.svn','cvs'
+]);
+const SDK_RUNTIME_SOURCE_PRIVATE_MANIFESTS=new Set([
+    'arcane-app.json','arcane-package.json','arcane.lock.json',
+    'arcane_app_release.json','arcane_runtime_release.json','arcane_sdk_browser_release.json'
+]);
 
 // This server is a loopback-only development host, not a production policy
 // boundary. The bundled runtime currently needs inline component execution,
@@ -139,6 +151,173 @@ function inventoryKey(value){
     return process.platform==='win32'?value.toLowerCase():value;
 }
 
+function canonicalLocationKey(value){
+    return inventoryKey(path.resolve(value));
+}
+
+function pathIsWithin(root,candidate){
+    const relative=path.relative(root,candidate);
+    return relative===''||(!path.isAbsolute(relative)&&relative!=='..'
+        &&!relative.startsWith(`..${path.sep}`));
+}
+
+function pathsOverlap(left,right){
+    return pathIsWithin(left,right)||pathIsWithin(right,left);
+}
+
+async function canonicalRealDirectory(requested,label){
+    let info;
+    try{
+        info=await lstat(requested);
+    }catch{
+        fail(`${label} must be an existing real directory.`,'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    if(info.isSymbolicLink()||!info.isDirectory()){
+        fail(`${label} must be an existing real directory.`,'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    let canonical;
+    try{
+        canonical=await realpath(requested);
+    }catch{
+        fail(`${label} could not be resolved as a real directory.`,'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    if(canonicalLocationKey(canonical)!==canonicalLocationKey(requested)){
+        fail(`${label} must not contain a symlink or reparse-point escape.`,'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    return canonical;
+}
+
+function sdkRuntimeSourcePathAllowed(relative,{arcaneRoot=false}={}){
+    if(relative.length===0)return false;
+    const normalized=relative.map(function normalizeRuntimeSourceSegment(segment){
+        return segment.normalize('NFC').toLowerCase();
+    });
+    if(normalized.some(function runtimeSourceSegmentIsPrivate(segment){
+        return segment.startsWith('.')||SDK_RUNTIME_SOURCE_PRIVATE_SEGMENTS.has(segment)
+            ||SDK_RUNTIME_SOURCE_PRIVATE_MANIFESTS.has(segment);
+    }))return false;
+    return !arcaneRoot||SDK_RUNTIME_SOURCE_ARCANE_ROOTS.has(normalized[0]);
+}
+
+function sdkArcaneSourcePathAllowed(relative){
+    return sdkRuntimeSourcePathAllowed(relative,{arcaneRoot:true});
+}
+
+function sdkDependencySourcePathAllowed(relative){
+    return sdkRuntimeSourcePathAllowed(relative);
+}
+
+function sdkBrowserSourcePathAllowed(relative){
+    return sdkRuntimeSourcePathAllowed(relative);
+}
+
+async function emitRuntimeSourceEvent(onEvent,event){
+    if(typeof onEvent==='function')await onEvent(event);
+}
+
+async function verifySdkRuntimeSourceRoot(sourceRoot,workspaceRoot,appId,{signal,onEvent}={}){
+    throwIfAborted(signal);
+    if(typeof sourceRoot!=='string'||!sourceRoot.trim()){
+        fail('sdkRuntimeSourceRoot must name an Arcane SDK directory.',
+            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    const requestedRoot=path.resolve(sourceRoot);
+    await emitRuntimeSourceEvent(onEvent,{
+        type:'runtime.source.mount.started',
+        appId,
+        requestedRoot,
+        target:'browser'
+    });
+    const canonicalRoot=await canonicalRealDirectory(requestedRoot,'SDK runtime source root');
+    const canonicalWorkspaceRoot=await realpath(workspaceRoot);
+    if(pathsOverlap(canonicalRoot,canonicalWorkspaceRoot)){
+        fail('SDK runtime source root must not overlap the application workspace.',
+            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+
+    let packageFile;
+    try{
+        packageFile=await openSafeFile(canonicalRoot,['package.json']);
+    }catch{
+        fail('SDK runtime source package.json must be a readable bounded real file.',
+            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    if(!packageFile){
+        fail('SDK runtime source root must contain a real package.json.',
+            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    let packageDocument;
+    try{
+        packageDocument=JSON.parse(packageFile.bytes.toString('utf8'));
+    }catch{
+        fail('SDK runtime source package.json must be valid JSON.',
+            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    if(!packageDocument||Array.isArray(packageDocument)||packageDocument.name!==SDK_NAME){
+        fail(`SDK runtime source package name must be exactly ${SDK_NAME}.`,
+            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+    }
+    if(packageDocument.version!==SDK_VERSION){
+        fail(
+            `SDK runtime source version must exactly match the executing SDK (${SDK_VERSION}).`,
+            'ARCANE_DEV_RUNTIME_VERSION_MISMATCH'
+        );
+    }
+
+    const roots=[
+        {
+            path:'runtime/arcane',
+            prefix:['arcane'],
+            allow:sdkArcaneSourcePathAllowed
+        },
+        {
+            path:'runtime/strong-type',
+            prefix:['arcane','dependencies','strong-type'],
+            allow:sdkDependencySourcePathAllowed
+        },
+        {
+            path:'browser-runtime',
+            prefix:['arcane','sdk'],
+            allow:sdkBrowserSourcePathAllowed
+        }
+    ];
+    const mappings=[];
+    for(let index=0;index<roots.length;index+=1){
+        throwIfAborted(signal);
+        const root=roots[index];
+        const requested=path.join(canonicalRoot,...root.path.split('/'));
+        const canonical=await canonicalRealDirectory(requested,`SDK runtime source ${root.path}`);
+        if(!pathIsWithin(canonicalRoot,canonical)){
+            fail(`SDK runtime source ${root.path} must remain inside the SDK root.`,
+                'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
+        }
+        mappings.push({prefix:root.prefix,root:canonical,allow:root.allow});
+        await emitRuntimeSourceEvent(onEvent,{
+            type:'runtime.source.mount.progress',
+            current:index+1,
+            total:roots.length,
+            path:root.path
+        });
+    }
+    const runtime=Object.freeze({
+        mode:'sdk-source',
+        protocol:SDK_RUNTIME_SOURCE_PROTOCOL,
+        sdkVersion:SDK_VERSION,
+        mutable:true,
+        distributionAuthority:false,
+        sourceRoot:canonicalRoot
+    });
+    await emitRuntimeSourceEvent(onEvent,{
+        type:'runtime.source.mount.ready',
+        appId,
+        canonicalRoot,
+        sdkVersion:SDK_VERSION,
+        protocol:SDK_RUNTIME_SOURCE_PROTOCOL,
+        routeCount:mappings.length
+    });
+    return {mappings,runtime};
+}
+
 function identityMap(identities,prefix=''){
     const normalizedPrefix=prefix?`${prefix}/`:'';
     const result=new Map();
@@ -346,8 +525,34 @@ function sharedPathAllowed(relative,route){
     });
 }
 
-async function sourceRoutes(workspaceRoot,appId,{workspaceRuntimeReceipt,signal}){
+async function sourceRoutes(workspaceRoot,appId,{
+    workspaceRuntimeReceipt,
+    sdkRuntimeSourceRoot,
+    signal,
+    onEvent
+}){
     const resolved=await resolveWorkspace({workspaceRoot,appId});
+    const appMapping={
+        prefix:['apps',resolved.appId],
+        root:resolved.appRoot,
+        allow:relative=>sourcePathAllowed(relative,resolved.app.manifest)
+    };
+    if(sdkRuntimeSourceRoot!==undefined){
+        const sdkSource=await verifySdkRuntimeSourceRoot(
+            sdkRuntimeSourceRoot,
+            resolved.workspaceRoot,
+            resolved.appId,
+            {signal,onEvent}
+        );
+        return {
+            workspaceRoot:resolved.workspaceRoot,
+            workspaceMode:resolved.config.workspaceMode,
+            appId:resolved.appId,
+            startPath:`/apps/${resolved.appId}/${resolved.app.manifest.entry}`,
+            runtime:sdkSource.runtime,
+            mappings:[appMapping,...sdkSource.mappings]
+        };
+    }
     if(resolved.config.workspaceMode==='integrated'){
         return {
             workspaceRoot:resolved.workspaceRoot,
@@ -355,11 +560,7 @@ async function sourceRoutes(workspaceRoot,appId,{workspaceRuntimeReceipt,signal}
             appId:resolved.appId,
             startPath:`/apps/${resolved.appId}/${resolved.app.manifest.entry}`,
             mappings:[
-                {
-                    prefix:['apps',resolved.appId],
-                    root:resolved.appRoot,
-                    allow:relative=>sourcePathAllowed(relative,resolved.app.manifest)
-                },
+                appMapping,
                 ...resolved.config.sharedPayloads['browser-runtime'].map(route=>({
                     prefix:route.destination.split('/'),
                     root:path.join(resolved.workspaceRoot,...route.source.split('/')),
@@ -411,11 +612,7 @@ async function sourceRoutes(workspaceRoot,appId,{workspaceRuntimeReceipt,signal}
         appId:resolved.appId,
         startPath:`/apps/${resolved.appId}/${resolved.app.manifest.entry}`,
         mappings:[
-            {
-                prefix:['apps',resolved.appId],
-                root:resolved.appRoot,
-                allow:relative=>sourcePathAllowed(relative,resolved.app.manifest)
-            },
+            appMapping,
             {
                 prefix:['arcane'],
                 root:runtimeRoot,
@@ -506,18 +703,33 @@ async function startOwnedDevServer({
     port=0,
     signal,
     workspaceRuntimeReceipt,
+    sdkRuntimeSourceRoot,
     releaseReceipt
 }={},events,releaseSignal){
     throwIfAborted(signal);
     if(mode!=='source'&&mode!=='packaged')fail(`Unsupported server mode: ${String(mode)}.`,'ARCANE_USAGE');
+    if(sdkRuntimeSourceRoot!==undefined&&mode!=='source'){
+        fail('sdkRuntimeSourceRoot is supported only in source development mode.','ARCANE_USAGE');
+    }
     if(host!=='127.0.0.1'&&host!=='::1'){
         fail('Development server host must be a numeric loopback address (127.0.0.1 or ::1).','ARCANE_POLICY_DENIED');
     }
     if(!Number.isInteger(port)||port<0||port>65535)fail('port must be an integer from 0 through 65535.','ARCANE_USAGE');
-    await events.send({type:'server.starting',mode,host,port,appId});
+    const requestedRuntimeMode=mode==='source'&&sdkRuntimeSourceRoot!==undefined
+        ?'sdk-source'
+        :null;
+    await events.send({
+        type:'server.starting',
+        mode,
+        host,
+        port,
+        appId,
+        ...(requestedRuntimeMode?{runtimeMode:requestedRuntimeMode}:{})
+    });
     const routeSet=mode==='source'
         ?await sourceRoutes(workspaceRoot,appId,{
             workspaceRuntimeReceipt,
+            sdkRuntimeSourceRoot,
             signal,
             onEvent:event=>events.send(event)
         })
@@ -647,6 +859,17 @@ async function startOwnedDevServer({
             while(requestTasks.size>0){
                 await Promise.allSettled([...requestTasks]);
             }
+            if(routeSet.runtime?.mode==='sdk-source'){
+                await events.send({
+                    type:'runtime.source.mount.stopped',
+                    appId:routeSet.appId,
+                    reason:events.error||operationalError
+                        ?'failed'
+                        :signal?.aborted
+                            ?'cancelled'
+                            :'closed'
+                });
+            }
             await events.send({
                 type:'server.stopped',
                 host:address.address,
@@ -695,6 +918,10 @@ async function startOwnedDevServer({
         mode,
         workspaceRoot:routeSet.workspaceRoot,
         appId:routeSet.appId,
+        ...(routeSet.runtime?{
+            runtimeMode:routeSet.runtime.mode,
+            runtime:routeSet.runtime
+        }:{}),
         host:address.address,
         port:address.port,
         origin,
@@ -711,7 +938,11 @@ async function startOwnedDevServer({
             host:result.host,
             port:result.port,
             url,
-            appId:result.appId
+            appId:result.appId,
+            ...(routeSet.runtime?{
+                runtimeMode:routeSet.runtime.mode,
+                runtime:routeSet.runtime
+            }:{})
         });
         throwIfAborted(signal);
     }catch(error){

package/src/import-map.mjs

@@ -14,15 +14,26 @@ export const MANAGED_IMPORT_MAP_ATTRIBUTE='data-arcane-import-map';
 const JAVASCRIPT_EXTENSION=/\.(?:js|mjs)$/u;
 const NODE_ONLY_MODULE='modules/CaseEvidenceIndexer.js';
 const RUNTIME_STRONG_TYPE_IMPORT='../../node_modules/strong-type/index.js';
+const PERSISTENT_CHAT_IMPORT='#arcane/persistent-ai-chat-session';
+const PERSISTENT_CHAT_MODULE='modules/PersistentAIChatSession.js';
 const SDK_BROWSER_ENTRY='sdk/event-manager.mjs';
 const SDK_BROWSER_AI_ENTRY='sdk/ai/browser-wasm.mjs';
+const SDK_BROWSER_SPEECH_ENTRY='sdk/ai/browser-speech.mjs';
+const SDK_BROWSER_SPEECH_WORKER_RUNTIME='sdk/ai/speech-worker-runtime.mjs';
 const SDK_BROWSER_FILES=Object.freeze([
     'sdk/ai/ARCANE_AI_BROWSER_WASM_COMPONENTS.json',
+    'sdk/ai/browser-kokoro-worker.mjs',
+    'sdk/ai/browser-speech-artifacts.mjs',
+    'sdk/ai/browser-speech-providers.mjs',
+    SDK_BROWSER_SPEECH_ENTRY,
     'sdk/ai/browser-wasm-llm-provider.mjs',
     SDK_BROWSER_AI_ENTRY,
+    'sdk/ai/browser-whisper-worker.mjs',
     'sdk/ai/browser-wllama-runtime.mjs',
     'sdk/ai/internal/sha256.mjs',
     'sdk/ai/model-controller.mjs',
+    'sdk/ai/speech-worker-client.mjs',
+    SDK_BROWSER_SPEECH_WORKER_RUNTIME,
     'sdk/ai/wllama/LICENCE',
     'sdk/ai/wllama/index.mjs',
     'sdk/ai/wllama/llama.cpp-LICENSE',
@@ -719,6 +730,14 @@ function nonliteralDynamic(importer,offset){
     );
 }
 
+function isAuthorizedSpeechRuntimeImport(tokens,index,close,importer){
+    if(importer!==SDK_BROWSER_SPEECH_WORKER_RUNTIME||close!==index+5)return false;
+    const [entry,dot,moduleUrl]=tokens.slice(index+2,close);
+    return entry?.type==='identifier'&&entry.value==='entry'
+        &&dot?.value==='.'
+        &&moduleUrl?.type==='identifier'&&moduleUrl.value==='moduleUrl';
+}
+
 export function scanModuleImports(source,{importer='<module>'}={}){
     if(typeof source!=='string')throw new TypeError('scanModuleImports source must be a string.');
     const tokens=tokenize(source);
@@ -745,6 +764,11 @@ export function scanModuleImports(source,{importer='<module>'}={}){
                     ||commas.length>2
                     ||(commas.length===2
                         &&(commas[1]!==close-1||commas[1]===commas[0]+1))){
+                    if(isAuthorizedSpeechRuntimeImport(tokens,index,close,importer)){
+                        hasModuleSyntax=true;
+                        index=close;
+                        continue;
+                    }
                     nonliteralDynamic(importer,current.start);
                 }
                 hasModuleSyntax=true;
@@ -811,6 +835,20 @@ function unresolved(importer,specifier,normalizedTarget,reason='is not in the sh
 }
 
 function resolveImport(importer,specifier,files){
+    if(specifier===PERSISTENT_CHAT_IMPORT){
+        if(!files.has(PERSISTENT_CHAT_MODULE)){
+            unresolved(importer,specifier,PERSISTENT_CHAT_MODULE);
+        }
+        return {target:PERSISTENT_CHAT_MODULE,persistentChat:true};
+    }
+    if(specifier.startsWith(PERSISTENT_CHAT_IMPORT)){
+        unresolved(
+            importer,
+            specifier,
+            PERSISTENT_CHAT_MODULE,
+            'does not match the exact browser import-map key'
+        );
+    }
     const reachableSpecifier=stripQueryAndHash(specifier);
     if(!reachableSpecifier)unresolved(importer,specifier,'<empty>');
     if(reachableSpecifier.includes('%')){
@@ -966,9 +1004,13 @@ export async function buildImportMap({files,readFile,signal}={}){
     }
     const hasSdkBrowserGraph=inventory.has(SDK_BROWSER_ENTRY);
     const hasSdkAiGraph=inventory.has(SDK_BROWSER_AI_ENTRY);
+    const hasSdkSpeechGraph=inventory.has(SDK_BROWSER_SPEECH_ENTRY);
     if(hasSdkAiGraph&&!hasSdkBrowserGraph){
         unresolved(SDK_BROWSER_AI_ENTRY,'<authenticated SDK browser closure>',SDK_BROWSER_ENTRY);
     }
+    if(hasSdkSpeechGraph&&!hasSdkAiGraph){
+        unresolved(SDK_BROWSER_SPEECH_ENTRY,'<authenticated SDK browser closure>',SDK_BROWSER_AI_ENTRY);
+    }
     if(hasSdkBrowserGraph){
         for(const required of SDK_BROWSER_FILES){
             if(!inventory.has(required)){
@@ -1016,11 +1058,20 @@ export async function buildImportMap({files,readFile,signal}={}){
                 'arcane-os/ai/browser-wasm',
                 './arcane/sdk/ai/browser-wasm.mjs'
             );
+            registerSpecifier(
+                namedRegistry,
+                'arcane-os/ai/browser-speech',
+                './arcane/sdk/ai/browser-speech.mjs'
+            );
         }
     }
 
     const sdkRoots=hasSdkBrowserGraph
-        ?[SDK_BROWSER_ENTRY,...(hasSdkAiGraph?[SDK_BROWSER_AI_ENTRY]:[])]:[];
+        ?[
+            SDK_BROWSER_ENTRY,
+            ...(hasSdkAiGraph?[SDK_BROWSER_AI_ENTRY]:[]),
+            ...(hasSdkSpeechGraph?[SDK_BROWSER_SPEECH_ENTRY]:[]),
+        ]:[];
     const queue=[...roots,...sdkRoots];
     const reached=new Set();
     const entities=new Set();
@@ -1036,6 +1087,13 @@ export async function buildImportMap({files,readFile,signal}={}){
             const resolution=resolveImport(importer,imported.specifier,inventory);
             if(resolution.runtimeStrongType)usesRuntimeStrongType=true;
             if(resolution.eventPubSub)usesEventPubSub=true;
+            if(resolution.persistentChat){
+                registerSpecifier(
+                    namedRegistry,
+                    PERSISTENT_CHAT_IMPORT,
+                    './arcane/modules/PersistentAIChatSession.js'
+                );
+            }
             if(resolution.target.startsWith('entities/'))entities.add(resolution.target);
             if(!reached.has(resolution.target))queue.push(resolution.target);
         }

package/src/packager/core.mjs

@@ -1036,7 +1036,7 @@ function packagedRuntimeAuthorities(receipt){
         ||!Number.isSafeInteger(receipt.fileCount)||receipt.fileCount<1
         ||!Number.isSafeInteger(receipt.totalBytes)||receipt.totalBytes<1
         ||!SHA256_PATTERN.test(receipt.contentSha256??'')
-        ||!isPlainObject(arcane)||arcane.authority!=='arcane-os-upstream'
+        ||!isPlainObject(arcane)||arcane.authority!=='arcane-os-sdk'
         ||!SHA256_PATTERN.test(arcane.manifestSha256??'')
         ||!SHA256_PATTERN.test(arcane.contentSha256??'')
         ||!isPlainObject(arcane.source)
@@ -1158,7 +1158,7 @@ async function authenticatePackageRuntimeVerificationState(context,state,{signal
     });
     const workspaceReceipt=snapshot.workspaceRuntimeReceipt;
     const expectedArcaneSource={
-        authority:'arcane-os-upstream',
+        authority:'arcane-os-sdk',
         location:snapshot.runtimeReceipt.canonicalLocation,
         manifestSha256:snapshot.runtimeReceipt.manifestSha256,
         contentSha256:snapshot.runtimeReceipt.contentSha256,

package/src/runtime.mjs

@@ -7,6 +7,8 @@ import {SDK_VERSION} from './constants.mjs';
 
 export const RUNTIME_MANIFEST_NAME='ARCANE_RUNTIME_RELEASE.json';
 const SHA256_PATTERN=/^[a-f0-9]{64}$/;
+const SDK_RUNTIME_REPOSITORY='https://github.com/TheWizardNexus/arcane-os-sdk.git';
+const LEGACY_ARCANE_REPOSITORY='https://github.com/TheWizardNexus/ARCANE-OS.git';
 const READ_ONLY_NO_FOLLOW=FS_CONSTANTS.O_RDONLY|(FS_CONSTANTS.O_NOFOLLOW??0);
 const MAX_VERIFIED_RUNTIME_FILE_BYTES=64*1024*1024;
 const sdkRoot=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
@@ -59,10 +61,18 @@ function validateRelease(value){
     }
     if(value.sdkVersion!==SDK_VERSION)fail('Runtime manifest sdkVersion is incompatible with this SDK.');
     if(!value.source||typeof value.source!=='object'
-        ||Object.keys(value.source).sort(compareText).join('\0')!=='bundleVersion\0commit\0protocol\0repository'
-        ||value.source.repository!=='https://github.com/TheWizardNexus/ARCANE-OS.git'
-        ||typeof value.source.commit!=='string'||!/^[a-f0-9]{40}$/.test(value.source.commit)
-        ||value.source.bundleVersion!=='0.8.12'||value.source.protocol!=='arcane/1'){
+        ||Object.keys(value.source).sort(compareText).join('\0')!=='authority\0legacyProjection\0path\0protocol\0repository'
+        ||value.source.authority!=='sdk-canonical'
+        ||value.source.repository!==SDK_RUNTIME_REPOSITORY
+        ||value.source.path!=='runtime/arcane'
+        ||value.source.protocol!=='arcane/1'
+        ||!value.source.legacyProjection
+        ||typeof value.source.legacyProjection!=='object'
+        ||Object.keys(value.source.legacyProjection).sort(compareText).join('\0')!=='bundleVersion\0commit\0repository'
+        ||value.source.legacyProjection.repository!==LEGACY_ARCANE_REPOSITORY
+        ||typeof value.source.legacyProjection.commit!=='string'
+        ||!/^[a-f0-9]{40}$/.test(value.source.legacyProjection.commit)
+        ||value.source.legacyProjection.bundleVersion!=='0.8.12'){
         fail('Runtime manifest source identity is invalid.');
     }
     if(!Array.isArray(value.files)||!Number.isSafeInteger(value.fileCount)

package/src/sdk-browser-runtime.mjs

@@ -1,6 +1,6 @@
 import {createHash} from 'node:crypto';
 import {constants as FS_CONSTANTS} from 'node:fs';
-import {lstat,open,readdir,realpath} from 'node:fs/promises';
+import {lstat,open,readFile,readdir,realpath} from 'node:fs/promises';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import {SDK_VERSION} from './constants.mjs';
@@ -8,96 +8,49 @@ import {SDK_VERSION} from './constants.mjs';
 const MANIFEST_NAME='ARCANE_SDK_BROWSER_RELEASE.json';
 const BUILDER='arcane-sdk-browser-runtime-v1';
 const PROTOCOL='arcane-sdk-browser-runtime/1';
-export const SDK_BROWSER_RUNTIME_MANIFEST_SHA256=
-    '88395493b411fd5461fbb2bb065ae2b745f6d1672f796583fd248ec97f71f4f7';
-export const SDK_BROWSER_RUNTIME_CONTENT_SHA256=
-    '5e03f45a732db51cb5a2b2193cc79ecda34501d07a9b2e82e794e5fa37d55d00';
 const REPOSITORY='https://github.com/TheWizardNexus/arcane-os-sdk.git';
 const SHA256_PATTERN=/^[a-f0-9]{64}$/u;
 const READ_ONLY_NO_FOLLOW=FS_CONSTANTS.O_RDONLY|(FS_CONSTANTS.O_NOFOLLOW??0);
 const MAX_VERIFIED_FILE_BYTES=64*1024*1024;
 const packageRoot=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const defaultRoot=path.join(packageRoot,'browser-runtime');
+const canonicalManifestBytes=await readFile(path.join(defaultRoot,MANIFEST_NAME));
+const canonicalRelease=JSON.parse(canonicalManifestBytes.toString('utf8'));
+if(
+    canonicalRelease?.schemaVersion!==1
+    ||canonicalRelease.builder!==BUILDER
+    ||canonicalRelease.sdkVersion!==SDK_VERSION
+    ||!SHA256_PATTERN.test(canonicalRelease.contentSha256)
+){
+    throw new Error('The canonical SDK browser runtime receipt is invalid.');
+}
+export const SDK_BROWSER_RUNTIME_MANIFEST_SHA256=
+    createHash('sha256').update(canonicalManifestBytes).digest('hex');
+export const SDK_BROWSER_RUNTIME_CONTENT_SHA256=canonicalRelease.contentSha256;
 const issuedReceipts=new WeakSet();
-const expectedAiComponents=Object.freeze({
-    schemaVersion:1,
-    kind:'arcane-ai-browser-wasm-components',
-    protocol:'arcane-ai-browser-wasm/1',
-    packageExport:'arcane-os/ai/browser-wasm',
-    browserEntry:'ai/browser-wasm.mjs',
-    runtimePolicy:{
-        modelAuthorities:'caller-supplied-exact-bytes-and-sha256',
-        modelWeightsPacked:false,
-        remoteModelHelpers:false,
-        compatibilityRuntime:false,
-        toolCalls:'structural-only-never-executed'
-    },
-    components:[
-        {
-            name:'@wllama/wllama',
-            version:'3.6.0',
-            licenseSpdx:'MIT',
-            sourceRepository:'https://github.com/ngxson/wllama.git',
-            sourceRevision:'f16050d8d51a00602c6a2a6b8ac9c09f490eea7f',
-            npm:{
-                resolved:'https://registry.npmjs.org/@wllama/wllama/-/wllama-3.6.0.tgz',
-                integrity:'sha512-NN3ZBXqaaUwGXTQubkNvsCaLPjN2XVa0bVS40OYCE8zquYmRc2W3oHYEgwvuSWWDB8aUqTLyMioySCXNkcnD1w==',
-                tarballBytes:5671369,
-                tarballSha256:'137c35ceccb4911a9b0ce9b427889f75991654ec6a6d1dd8fabd879b14b07a1b'
-            },
-            files:[
-                {
-                    role:'runtime-module',
-                    path:'ai/wllama/index.mjs',
-                    sourcePath:'node_modules/@wllama/wllama/esm/index.js',
-                    bytes:373519,
-                    sha256:'4637e42d636010493a9b274fbbe70bfd8120365da726b1d9e589d85ca84a00d6'
-                },
-                {
-                    role:'runtime-wasm',
-                    path:'ai/wllama/wllama.wasm',
-                    sourcePath:'node_modules/@wllama/wllama/esm/wasm/wllama.wasm',
-                    bytes:8524865,
-                    sha256:'95c6ff9ef2a03ff2c63bc91db132f0126a0bd0456b272cd8ae2e0f592fb059f6'
-                },
-                {
-                    role:'license',
-                    path:'ai/wllama/LICENCE',
-                    sourcePath:'node_modules/@wllama/wllama/LICENCE',
-                    bytes:1071,
-                    sha256:'5866e3bd7e3cbd3f7c8bea6efd8a1e7fa7cc8de68c30f428aff7c6584a0fb720'
-                }
-            ]
-        },
-        {
-            name:'llama.cpp',
-            version:'b10454',
-            licenseSpdx:'MIT',
-            sourceRepository:'https://github.com/ggerganov/llama.cpp.git',
-            sourceRevision:'4df29be4f4c3673f428170fda944a5b19f743bb8',
-            embeddedBy:'@wllama/wllama@3.6.0',
-            files:[
-                {
-                    role:'license',
-                    path:'ai/wllama/llama.cpp-LICENSE',
-                    sourceUrl:'https://raw.githubusercontent.com/ggerganov/llama.cpp/4df29be4f4c3673f428170fda944a5b19f743bb8/LICENSE',
-                    bytes:1078,
-                    sha256:'94f29bbed6a22c35b992c5c6ebf0e7c92f13b836b90f36f461c9cf2f0f1d010d'
-                }
-            ]
-        }
-    ]
-});
+const canonicalAiComponentsBytes=await readFile(
+    path.join(defaultRoot,'ai','ARCANE_AI_BROWSER_WASM_COMPONENTS.json')
+);
+const expectedAiComponents=Object.freeze(
+    JSON.parse(canonicalAiComponentsBytes.toString('utf8'))
+);
 
 const expectedFiles=Object.freeze([
     ['ai/ARCANE_AI_BROWSER_WASM_COMPONENTS.json','browser-runtime/ai/ARCANE_AI_BROWSER_WASM_COMPONENTS.json','sdk-source-identity'],
+    ['ai/browser-kokoro-worker.mjs','browser-runtime/ai/browser-kokoro-worker.mjs','sdk-source-identity'],
+    ['ai/browser-speech-artifacts.mjs','browser-runtime/ai/browser-speech-artifacts.mjs','sdk-source-identity'],
+    ['ai/browser-speech-providers.mjs','browser-runtime/ai/browser-speech-providers.mjs','sdk-source-identity'],
+    ['ai/browser-speech.mjs','browser-runtime/ai/browser-speech.mjs','sdk-source-identity'],
     ['ai/browser-wasm-llm-provider.mjs','browser-runtime/ai/browser-wasm-llm-provider.mjs','sdk-source-identity'],
     ['ai/browser-wasm.mjs','browser-runtime/ai/browser-wasm.mjs','sdk-source-identity'],
+    ['ai/browser-whisper-worker.mjs','browser-runtime/ai/browser-whisper-worker.mjs','sdk-source-identity'],
     ['ai/browser-wllama-runtime.mjs','browser-runtime/ai/browser-wllama-runtime.mjs','sdk-source-identity'],
     ['ai/internal/sha256.mjs','browser-runtime/ai/internal/sha256.mjs','sdk-source-identity'],
     ['ai/model-controller.mjs','browser-runtime/ai/model-controller.mjs','sdk-source-identity'],
+    ['ai/speech-worker-client.mjs','browser-runtime/ai/speech-worker-client.mjs','sdk-source-identity'],
+    ['ai/speech-worker-runtime.mjs','browser-runtime/ai/speech-worker-runtime.mjs','sdk-source-identity'],
     ['ai/wllama/LICENCE','node_modules/@wllama/wllama/LICENCE','vendor-package-identity'],
-    ['ai/wllama/index.mjs','node_modules/@wllama/wllama/esm/index.js','vendor-package-identity'],
+    ['ai/wllama/index.mjs','browser-runtime/ai/wllama/index.mjs','deterministic-derived-vendor'],
     ['ai/wllama/llama.cpp-LICENSE','browser-runtime/ai/wllama/llama.cpp-LICENSE','vendor-source-identity'],
     ['ai/wllama/wllama.wasm','node_modules/@wllama/wllama/esm/wasm/wllama.wasm','vendor-package-identity'],
     ['dependencies/event-pubsub/index.js','node_modules/event-pubsub/index.js','vendor-package-identity'],

package/src/templates/workspace-template.mjs

@@ -47,7 +47,7 @@ export function workspaceTemplate({
     const name=displayName||`Arcane ${titleCase(appId)}`;
     const packageName=`arcane-${appId}`;
     const runtimeContentSha256=runtimeRelease?.contentSha256;
-    const upstreamCommit=runtimeRelease?.source?.commit;
+    const upstreamCommit=runtimeRelease?.source?.legacyProjection?.commit;
     const browserManifestSha256=sdkBrowserRuntimeRelease?.manifestSha256;
     const browserContentSha256=sdkBrowserRuntimeRelease?.contentSha256;
     const browserSource=sdkBrowserRuntimeRelease?.source;
@@ -153,15 +153,15 @@ appropriate.
     files.set('AGENTS.md',`# ${name} development instructions
 
 - Use plain JavaScript, HTML, and CSS; do not introduce TypeScript or TSX.
-- Keep reusable mechanisms in Arcane OS and app-specific behavior under \`apps/${appId}/\`.
+- Keep reusable portable mechanisms in the Arcane SDK and app-specific behavior under \`apps/${appId}/\`.
 - Keep \`arcane/css/theme.css\` before app styles and import \`arcane/ThemeBootstrap\` before app code runs.
 - Use \`rgb(...)\` or \`rgba(...)\` for new CSS colors.
 - Build one named app and one explicit target at a time. Native targets may be unavailable until their adapters are installed.
-- Run \`npm run check\` before committing.
+- Run tests and checks only when the user explicitly selects verification or a distribution artifact requires it.
 `);
     files.set('README.md',`# ${name}
 
-This repository contains the Arcane OS application \`${appId}\`. Its source stays outside the Arcane OS repository and uses the \`${SDK_NAME}\` toolchain.
+This repository contains the portable Arcane application \`${appId}\`. It embeds immutable SDK runtime bytes for distribution and has no runtime dependency on an Arcane OS source checkout.
 
 ## Start