arcane-os 0.52.1 → 0.54.0

package/docs/reference/websocket-client.md

@@ -0,0 +1,132 @@
+# Shared WebSocket clients
+
+`arcane-os/websocket-client` exposes the published `ws-share` constructor as
+both `default` and `WS`. Node also exports the same `WS` binding from
+`arcane-os`. Browser modules use the focused entry through the generated SDK
+import map. These entries reuse the upstream implementation rather than
+creating another pool or event bus.
+
+```javascript
+import WS from 'arcane-os/websocket-client';
+
+const airlock=new WS('wss://moon.example/airlock',['moon-control']);
+const oxygenPanel=new WS('wss://moon.example/airlock',['moon-control']);
+console.log(airlock===oxygenPanel); // true while connecting or open
+
+function showAirlockMessage(event){
+    console.log(event.data);
+}
+airlock.addEventListener('message',showAirlockMessage);
+
+// When this panel goes away, release only its listener.
+function disposePanel(){
+    airlock.removeEventListener('message',showAirlockMessage);
+}
+```
+
+Replace the example URL with your application's WebSocket endpoint. The exact
+URI string and ordered protocol list select a shared connection. Repeated
+construction reuses a connecting or open socket. A closing or closed socket
+gets a new physical connection and a new ID; the predecessor's eventual close
+cannot remove its replacement.
+
+The returned object is the native `WebSocket`, with its native `send`,
+`close`, `binaryType`, properties and per-socket events. Complete messages pass
+through unchanged. Upstream `on`/`off` and `addListener`/`removeListener`
+aliases retain native listener semantics, rather than Node EventEmitter
+semantics. Importing the SDK entry starts no connection and does not replace
+`globalThis.WebSocket`.
+
+## Observe all managed connections
+
+`await WS.observe()` returns one lazy `event-pubsub` observer per loaded
+implementation. Repeated or concurrent calls return that same observer.
+Enabling observation opens no socket. Register handlers after the await, then
+read `WS.getConnections()` synchronously without another await between them.
+
+```javascript
+import {WS} from 'arcane-os/websocket-client';
+
+const events=await WS.observe();
+const liveConnections=new Map();
+
+function trackConnection(type,connection){
+    if(type==='close')liveConnections.delete(connection.id);
+    else liveConnections.set(connection.id,connection);
+    console.log(type,connection.id,connection.url,connection.readyState);
+}
+
+events.on('*',trackConnection);
+for(const connection of WS.getConnections()){
+    liveConnections.set(connection.id,connection);
+}
+
+function disposeConnectionPanel(){
+    events.off('*',trackConnection);
+}
+```
+
+The typed events `created`, `open`, `error` and `close` each receive one record.
+The wildcard handler receives `(type,record)`. Each record contains:
+
+| Field | Meaning |
+| --- | --- |
+| `id` | Numeric physical-connection identity within this loaded implementation. |
+| `socket` | The exact native socket. |
+| `url` | The native socket's URL. |
+| `protocols` | A fresh copy of the requested, normalized protocol list. |
+| `readyState` | Native state when the record is produced. |
+| `event` | Original native event; `created` has `undefined`. |
+
+`WS.getConnections()` returns fresh records with the first five fields. It
+includes tracked sockets until their native close event, including a closing
+predecessor after its replacement exists. Records are snapshots; the `socket`
+remains live. Read a new snapshot when current state is needed.
+
+`created` is queued in a microtask only when observation was enabled at
+construction. Reusing a connection emits no second `created` event. A snapshot
+can include a connection before its queued `created` notification arrives, so
+reconcile by `id` rather than appending duplicates. Native close removes the
+connection and its internal lifecycle listeners before global close handlers
+run. Applications may still use native socket listeners alongside the global
+observer; there is no second per-socket event bus.
+
+## Ownership and lifetime
+
+Every caller shares the same socket, including changes to `binaryType`, a
+property handler, or a call to `close()`. A component that only owns a listener
+removes that exact listener. The application decides when the shared socket
+should close; construction does not acquire an independent reference-counted
+lifetime. Remove only your own observer handlers instead of resetting the
+shared observer. Observe asynchronous handler failures at their owning caller.
+
+All modules that should share connections use the same SDK module URL in
+their realm. Separate package copies, browser realms, Workers, processes, and
+upstream classic-script versus ESM loads have separate pools. The observer
+reports actual native lifecycle events; it provides no closed-event history
+or delivery after the realm/process ends. It adds no automatic reconnect,
+heartbeat, message envelope, storage, or application routing.
+
+## Runtime and package delivery
+
+The SDK's Node baseline supplies native `WebSocket`; browsers need their native
+WebSocket capability. The focused entry is portable JavaScript, with the host
+owning networking and native errors. Browser Workers need module resolution
+provided by their host because document import maps do not apply to Workers.
+
+The SDK selects `ws-share@3.1.0` and `event-pubsub@6.1.1`. npm resolves the
+latter's `strong-type@2.0.0`, while the SDK's own direct `strong-type@2.0.1`
+remains unchanged. The canonical browser projection generator copies the
+installed public runtime files unchanged. Managed maps resolve the shared
+constructor and event package to one URL each, and a dependency scope selects
+the event package's own strong-type version. Physical, direct-installed,
+packaged-document and managed test maps preserve that scope. Applications
+regenerate their managed maps/runtime through the ordinary public SDK flow;
+they do not copy the upstream implementation into application source.
+
+`acceptWebSocket` remains the separate Node server-side API at
+`arcane-os/websocket`. It owns accepted server connections, not this client
+pool. Existing native clients and server Upgrade handling remain available.
+
+Upstream details: [ws-share 3.1.0 release](https://github.com/RIAEvangelist/ws-share/releases/tag/3.1.0)
+and [observer documentation](https://riaevangelist.github.io/ws-share/#observe).

package/node_modules/event-pubsub/CHANGELOG.md

@@ -1,8 +1,19 @@
 # Changelog
 
+## 6.1.1 — 2026-08-23
+
+- Replaced the consumer-root-relative `../strong-type/index.js` import with the bare `strong-type` package name so Node selects event-pubsub's declared nested exact dependency under a root version conflict.
+- Declared the shared `index.js` source as the explicit browser entry and made bundled plus no-build unbundled support explicit, including normal and conflict-scoped import maps.
+- Added a packed-consumer regression that installs `strong-type` 1.1.0 at the consumer root, poisons that copy, instruments event-pubsub's nested 2.0.0, and proves both ESM and CommonJS execute the nested validator.
+- Added packed real-Chrome consumers for the normal and conflict-scoped import maps plus a Rollup 4.62.5/node-resolve 16.0.3 bundle of the poisoned conflict layout.
+- Staged the exact validator beneath event-pubsub and made the shared Chrome suite and live playgrounds resolve the bare `event-pubsub` and `strong-type` names through explicit maps.
+- Added a 12-scenario Behavioral suite with Given/When/Then consumer workflows for audited delivery, nested events, lifecycle teardown, routing, synchronous replies, shared payloads, failure propagation, asynchronous side effects, live subscriber changes, and hub isolation.
+- Expanded the shared host-neutral Node/Chrome registry to 131 checks and added the focused `npm run test:behavioral` command.
+- Added a focused Behavioral inventory page and carried the 131-check total through CI, coverage, status, and deployment validation.
+
 ## 6.1.0 — 2026-08-21
 
-Published to npm as the current registry release from the verified `main` source. No separate 6.1.0 GitHub tag or release was created.
+Published to npm and GitHub from the same verified source commit.
 
 - Added direct CommonJS `require('event-pubsub')` support while keeping one native ESM implementation for both module systems.
 

package/node_modules/event-pubsub/MIGRATION.md

@@ -1,6 +1,6 @@
 # Migrating from event-pubsub 5.x to 6.x
 
-Version 6 preserves the public method names and synchronous wildcard-first model while formalizing previously inconsistent edge behavior. The 6.1.0 npm release restores the original delegated validation and package layout while adding shared-source CommonJS consumption.
+Version 6 preserves the public method names and synchronous wildcard-first model while formalizing previously inconsistent edge behavior. The 6.1.0 npm release restored delegated validation and shared-source CommonJS consumption. The 6.1.1 correction makes Node resolve that validator through event-pubsub's declared dependency boundary.
 
 ## Requirements
 
@@ -23,7 +23,7 @@ Version 6 preserves the public method names and synchronous wildcard-first model
 
 ### Package layout
 
-The package keeps its historical ESM entry at `event-pubsub/index.js` without a restrictive export map. Applications should normally import `event-pubsub`; repository-only paths are not part of the supported API.
+The package keeps its historical ESM entry at `event-pubsub/index.js` without a restrictive export map and declares that same source as its browser entry. Applications should normally import `event-pubsub`; repository-only paths are not part of the supported API.
 
 ## Behavior to review
 
@@ -53,15 +53,18 @@ Public argument checks again come from `strong-type` 2.0.0. Invalid inputs still
 
 Each `list` access creates a null-prototype object with copied handler arrays. Mutating or deleting snapshot values no longer mutates the live registry. Use `Object.hasOwn(snapshot, type)` instead of calling `snapshot.hasOwnProperty(...)`. The wildcard entry remains available through `Symbol.for('event-pubsub-all')`.
 
-### Browser package imports
+### Package dependency resolution
 
-The 6.1.0 release restores `strong-type` 2.0.0 as the sole production dependency and preserves the deliberate `../strong-type/index.js` include shim. Node installs both packages as siblings. For an unbundled browser, serve the same sibling directories and map the public `event-pubsub` name to its `index.js`; the relative validator import then resolves without a second package-name mapping.
+The 6.1.0 entry reached `strong-type` through `../strong-type/index.js`. In a consumer with an incompatible root validator and event-pubsub's exact 2.0.0 nested beneath it, that relative path could execute the root package. The 6.1.1 entry uses the bare `strong-type` name, so Node and bundlers resolve from event-pubsub outward and select its nested declared dependency first.
+
+Browser support is explicit in both modes: bundlers resolve both package names normally, while unbundled native ESM runs the same source directly with an import map and no build step. Native browsers do not read the npm `browser` field. Put the map before the first module script, serve the app over HTTP(S), and map both `event-pubsub` and `strong-type`. When npm nests event-pubsub's validator because the root version conflicts, add an import-map scope for `./node_modules/event-pubsub/` that maps `strong-type` to `./node_modules/event-pubsub/node_modules/strong-type/index.js`. The README contains complete hoisted and conflicting-layout examples, both exercised from a packed install in real Chrome.
 
 ## Tooling cleanup
 
 - `vanilla-test` is now pinned exactly at 2.1.1.
+- Rollup 4.62.5 with node-resolve 16.0.3 is exact-pinned and configured only for JavaScript as the bundled-browser conformance probe.
 - Native Node and Chrome coverage replaces c8.
-- The old `copyfiles` dependency is gone; a dependency-free staging script now verifies the package-shaped Node/browser layout.
+- The old `copyfiles` dependency is gone; a dependency-free staging script now verifies the nested exact dependency in Node and maps that same copy for browser coverage.
 - `copyfiles`, `c8`, and the test-only `node-http-server` dependency are removed.
 - Production installs contain exactly one dependency: `strong-type` 2.0.0. They do not install `copyfiles` or the development-only `vanilla-test`.
 

package/node_modules/event-pubsub/README.md

@@ -22,9 +22,11 @@
 [![Chrome function ranges](https://img.shields.io/endpoint?url=https://riaevangelist.github.io/event-pubsub/badges/chrome-functions.json)](https://riaevangelist.github.io/event-pubsub/reports/chrome/)
 [![Chrome executable lines](https://img.shields.io/endpoint?url=https://riaevangelist.github.io/event-pubsub/badges/chrome-lines.json)](https://riaevangelist.github.io/event-pubsub/reports/chrome/)
 
-Small, synchronous, extensible publish/subscribe events for modern Node.js and browsers.
+Small, synchronous, extensible publish/subscribe events for Node.js plus bundled and unbundled browsers.
 
-> **Release status:** `6.1.0` is the current npm release and the verified source on `main`. `6.0.0` remains the most recent separately tagged GitHub source release.
+**It works with bundlers and without a bundler.** Both paths execute the same native ESM source; direct browser use needs only a standard import map, not a build or transpilation step.
+
+> **Release status:** `6.1.1` is the current npm and GitHub release.
 
 ![event-pubsub signal fan-out](https://riaevangelist.github.io/event-pubsub/og.png)
 
@@ -44,6 +46,8 @@ events.on('ready', (payload) => {
 events.emit('ready', {fast: true});
 ```
 
+That bare import is also the bundler entry. In a native browser application with no bundler, keep the same import and add the complete [import map shown below](#browser-use-bundled-and-unbundled).
+
 The same source is available directly to CommonJS on Node.js 22.12 or newer:
 
 ```js
@@ -64,8 +68,8 @@ Bars show median nanoseconds per emit, whiskers show p25–p75, and dots show al
 - Subscriber arrays remain live during an emit: additions can run in that emit, and specifically removed handlers are skipped before their turn. Removing a whole bucket or resetting the registry detaches it from future lookup while an already-active array finishes.
 - Safe event names, including `__proto__`, `constructor`, and `toString`.
 - Isolated `list` snapshots that cannot mutate the live registry.
-- One native ESM source for browser imports plus Node.js `import` and `require()`, without transpilation or a duplicate CommonJS build.
-- One explicit production validator: `strong-type` 2.0.0, loaded through the original Node/browser relative shim.
+- One native ESM source for Node.js `import`/`require()`, bundled browser applications, and unbundled browser modules, without transpilation or a duplicate build.
+- One explicit production validator: `strong-type` 2.0.0, resolved through the package dependency boundary with an explicit browser entry and import map.
 
 ## API
 
@@ -96,15 +100,19 @@ The wildcard list entry is exposed at `Symbol.for('event-pubsub-all')`.
 
 Only the exact public string `*` maps to the internal wildcard Symbol. The ordinary string `Symbol(event-pubsub-all)` remains an exact typed event name and never aliases wildcard removal.
 
-### Browser import map
+### Browser use: bundled and unbundled
+
+The 6.1.1 package imports `strong-type` by package name. Bundlers may use its explicit `browser` entry; native browsers do not read npm package metadata, so the import map selects `index.js` directly.
 
-The 6.1.0 runtime imports `strong-type` 2.0.0 through `../strong-type/index.js`. This preserves the original package-shaped Node/browser layout: serve `event-pubsub` and `strong-type` as sibling package directories, then map only the public package name:
+- With a standards-compatible bundler, both package names resolve normally. The release gate bundles and executes a packed conflicting-dependency consumer with Rollup 4.62.5 and node-resolve 16.0.3, configured only for JavaScript.
+- Without a bundler, a modern browser runs the same files directly through native ESM. Put this import map before the first module script that starts the graph and serve the directory over HTTP(S):
 
 ```html
 <script type="importmap">
 {
   "imports": {
-    "event-pubsub": "./node_modules/event-pubsub/index.js"
+    "event-pubsub": "./node_modules/event-pubsub/index.js",
+    "strong-type": "./node_modules/strong-type/index.js"
   }
 }
 </script>
@@ -113,30 +121,57 @@ The 6.1.0 runtime imports `strong-type` 2.0.0 through `../strong-type/index.js`.
 </script>
 ```
 
+That example is non-bundled browser code: the browser fetches both files from the mapped URLs and executes them directly. The paths are relative to the HTML document, so the static server must expose the shown `node_modules` files. Open the application through HTTP(S), not `file://`.
+
+If the application uses a strict Content Security Policy, configure it to authorize the inline import-map and module scripts—for example, with an allowed nonce or hash.
+
+If the application intentionally installs an incompatible `strong-type` at its root, npm keeps event-pubsub's exact 2.0.0 dependency nested. Scope the validator mapping to the event-pubsub referrer so the browser preserves that same dependency boundary:
+
+```html
+<script type="importmap">
+{
+  "imports": {
+    "event-pubsub": "./node_modules/event-pubsub/index.js",
+    "strong-type": "./node_modules/strong-type/index.js"
+  },
+  "scopes": {
+    "./node_modules/event-pubsub/": {
+      "strong-type": "./node_modules/event-pubsub/node_modules/strong-type/index.js"
+    }
+  }
+}
+</script>
+```
+
+Adjust the URLs to the package layout exposed by your static server. The release gate installs the packed tarball twice and executes both maps in real Chrome; the conflict fixture poisons the root validator so the scoped nested mapping cannot pass accidentally.
+
 ## Complete verification summary
 
-The shared host-neutral registry contains **119 unique checks**. `vanilla-test` 2.1.1 executes the same inventory in Node and real Google Chrome.
+The shared host-neutral registry contains **131 unique checks**. `vanilla-test` 2.1.1 executes the same inventory in Node and real Google Chrome.
 
 | Suite | Cases | Focus |
 | --- | ---: | --- |
 | Unit | 16 | Exports, state, fluent identity, validation, and list shape |
 | Functional | 26 | Registration, dispatch, wildcard, once, removal, reset, and chaining |
 | Integration | 14 | Subclassing, routing, isolation, namespaces, lifecycle, and errors |
+| Behavioral | 12 | Given/When/Then workflows, lifecycle boundaries, routing, failures, async effects, and live membership |
 | Regression | 43 | Mutation, reentrancy, snapshots, safe names, throws, and registration-local once state |
 | Interface | 20 | Playground parsing, safe display, bounded state, benchmark evidence, units, and chart scaling |
-| **Total** | **119** | One registry used by direct tests and both coverage runtimes |
+| **Total** | **131** | One registry used by direct tests and both coverage runtimes |
 
 ### Runtime and CI matrix
 
 | Verification | Runtime | Hosts | Result requirement |
 | --- | --- | --- | --- |
-| Direct shared suite | Node 22.12.0 and Node 24 | Ubuntu, macOS, Windows | 119/119 on every matrix job |
-| Node coverage | Node 24.18.0 | Ubuntu | 119/119 and every native V8 gate at 100% |
-| Browser coverage | Google Chrome Stable | Ubuntu | 119/119 and every native V8 gate at 100% |
-| Packed consumer | Node 24 | Ubuntu | Exact tarball contents, ESM exports, behavior, and the sole `strong-type` dependency |
+| Direct shared suite | Node 22.12.0 and Node 24 | Ubuntu, macOS, Windows | 131/131 on every matrix job |
+| Node coverage | Node 24.18.0 | Ubuntu | 131/131 and every native V8 gate at 100% |
+| Browser coverage | Google Chrome Stable | Ubuntu | 131/131 and every native V8 gate at 100% |
+| Packed consumer | Node 24 | Ubuntu | Exact tarball contents plus ESM/CommonJS execution of nested `strong-type` 2.0.0 under a poisoned root conflict |
+| Packed unbundled browser | Chrome Stable | Ubuntu and local release host | Normal and scoped-conflict import maps execute the tarball directly over HTTP |
+| Packed bundled browser | Rollup 4.62.5 + Chrome Stable | Ubuntu and local release host | A bundle resolves nested `strong-type` 2.0.0 and runs representative behavior under a poisoned root conflict |
 | Shared-source package smoke | Node 22.12.0 | Ubuntu | The same packed `index.js` through ESM `import` and direct CommonJS `require()` |
 | Execution benchmark | Node 24.18.0 | Ubuntu | Eight validated scenarios with execution-only timing boundaries |
-| GitHub Pages | Node 24 | Ubuntu | 21 pages, both runtime reports, badges, benchmark JSON, scripts, links, and licenses |
+| GitHub Pages | Node 24 | Ubuntu | 22 pages, both runtime reports, badges, benchmark JSON, scripts, links, and licenses |
 
 ### Coverage gates
 
@@ -151,25 +186,27 @@ These are native V8 executable/block/function range and executable-line totals f
 
 | Command | Purpose |
 | --- | --- |
-| `npm test` | Stage the sibling packages and run all 119 checks in Node. |
+| `npm test` | Stage event-pubsub with its nested exact validator and run all 131 checks in Node. |
 | `npm run test:unit` | Run the 16 Unit cases. |
 | `npm run test:functional` | Run the 26 Functional cases. |
 | `npm run test:integration` | Run the 14 Integration cases. |
+| `npm run test:behavioral` | Run the 12 Behavioral scenarios. |
 | `npm run test:regression` | Run the 43 Regression cases. |
 | `npm run test:interface` | Run the 20 Interface cases. |
-| `npm run coverage` | Run all 119 checks independently in Node and real Chrome with 100% gates. |
+| `npm run coverage` | Run all 131 checks independently in Node and real Chrome with 100% gates. |
 | `npm run coverage:node` | Generate only the Node native V8 report. |
 | `npm run coverage:chrome` | Generate only the real-Chrome native V8 report. |
 | `npm run benchmark` | Record seven fixed-count latency samples for eight scenarios. |
 | `npm run benchmark:smoke` | Validate the benchmark quickly without replacing published results. |
 | `npm run test:package` | Pack, inspect, install, and exercise a clean consumer. |
+| `npm run test:browser-consumer` | Pack and execute normal-map, scoped-conflict-map, and Rollup browser consumers in real Chrome. |
 | `npm run site:check` | Validate all focused pages, exact test inventories, scripts, links, forms, and assets. |
 | `npm run verify` | Run the complete local release gate. |
 
 ### Published evidence
 
 - [Testing strategy and suite totals](https://riaevangelist.github.io/event-pubsub/testing.html)
-- [Live execution of all 119 checks](https://riaevangelist.github.io/event-pubsub/live.html)
+- [Live execution of all 131 checks](https://riaevangelist.github.io/event-pubsub/live.html)
 - [Node test-result JSON](https://riaevangelist.github.io/event-pubsub/reports/node/test-results.json)
 - [Chrome test-result JSON](https://riaevangelist.github.io/event-pubsub/reports/chrome/test-results.json)
 - [Node HTML coverage](https://riaevangelist.github.io/event-pubsub/reports/node/)
@@ -256,6 +293,24 @@ Every test name below is sourced from the shared registry. The focused Pages sit
 
 </details>
 
+<details>
+<summary><strong>Behavioral — 12 scenarios</strong></summary>
+
+1. given an audited order retry with one-time reservation and persistent projection, when the same order is published twice, then the audit leads both deliveries while reservation happens once
+2. given an order handler that publishes the next workflow stage, when an order is created, then the nested fulfillment stage completes before outer delivery continues
+3. given a one-time readiness gate that reenters its own topic, when the outer readiness signal arrives, then the gate is consumed before the nested signal
+4. given a mounted subscriber that observes application updates, when the subscriber unmounts, then later updates no longer reach it
+5. given listeners from an authenticated session, when logout resets the event hub and a new session starts, then only the new session observes later activity
+6. given a bridge that forwards only public topics to another hub, when private and public messages are published, then only public messages cross the boundary
+7. given a request carrying a reply callback, when a subscriber handles the request, then the caller receives the reply before publish returns
+8. given a wildcard normalizer and a typed consumer sharing a payload, when the payload is published, then the consumer and caller observe the normalized object
+9. given a one-time preflight followed by a failing persistent subscriber, when delivery is retried after the failure, then preflight stays consumed and the exact failure keeps reaching the publisher
+10. given an asynchronous side effect beside a synchronous projection, when the event is published, then publish returns after starting both without awaiting the side effect
+11. given subscriber membership that changes during a notification, when the current delivery adds one subscriber and removes another, then the added subscriber joins immediately and the removed one is skipped
+12. given two tenant hubs with the same topic names, when each tenant publishes an update, then each update stays within its originating tenant
+
+</details>
+
 <details>
 <summary><strong>Regression — 43 cases</strong></summary>
 
@@ -343,7 +398,7 @@ The benchmark reports median **execution latency**—nanoseconds per named opera
 - [Examples](https://riaevangelist.github.io/event-pubsub/examples.html)
 - [Event console playground](https://riaevangelist.github.io/event-pubsub/playground.html)
 - [Mutation playground scenarios](https://riaevangelist.github.io/event-pubsub/playground-scenarios.html)
-- [All 119 tests](https://riaevangelist.github.io/event-pubsub/testing.html)
+- [All 131 tests](https://riaevangelist.github.io/event-pubsub/testing.html)
 - [Node and Chrome coverage](https://riaevangelist.github.io/event-pubsub/coverage.html)
 - [Benchmark overview](https://riaevangelist.github.io/event-pubsub/benchmarks.html)
 - [Dispatch latency chart](https://riaevangelist.github.io/event-pubsub/benchmarks-dispatch.html)
@@ -356,7 +411,8 @@ The benchmark reports median **execution latency**—nanoseconds per named opera
 ## Runtime support
 
 - Node.js 22.12.0 or newer for production, development, and direct CommonJS `require()` of the native ESM source.
-- Modern browsers with native modules, private class fields, and `Symbol`. Unbundled use must serve the sibling `event-pubsub` and `strong-type` package directories.
+- Bundled browser applications; the bundler resolves `event-pubsub` and `strong-type` from package metadata normally.
+- Unbundled modern browsers with native modules, private class fields, `Symbol`, and import maps; no build step is required. Map both package names, with a scoped validator mapping when npm nests it.
 
 ## License
 

package/node_modules/event-pubsub/SECURITY.md

@@ -4,11 +4,11 @@
 
 | Version | Supported |
 | --- | --- |
-| 6.1.0 on npm | Current supported release |
-| 6.0.0 | Superseded GitHub source release |
+| 6.1.1 on npm and GitHub | Current supported release |
+| 6.0.0 through 6.1.0 | Superseded 6.x releases |
 | 5.x and older | No planned security fixes |
 
-Version 6.1.0 is the current npm release and requires Node.js 22.12 or newer. Version 6.0.0 remains available as the earlier GitHub source release, but users should install the latest available 6.x release.
+Version 6.1.1 is the current npm and GitHub release and requires Node.js 22.12 or newer. Earlier 6.x versions remain available for provenance, but users should install the latest available 6.x release.
 
 ## Reporting a vulnerability
 

package/node_modules/event-pubsub/index.js

@@ -1,5 +1,5 @@
-// Shim allowing the same module path to run in Node and an unbundled browser.
-import Is from '../strong-type/index.js';
+// Preserve the package manager's dependency boundary instead of reaching for a consumer-root sibling.
+import Is from 'strong-type';
 
 const is = new Is();
 const ALL_EVENTS = Symbol.for('event-pubsub-all');

package/node_modules/event-pubsub/package.json

@@ -1,9 +1,10 @@
 {
   "name": "event-pubsub",
-  "version": "6.1.0",
-  "description": "Small, synchronous, extensible publish/subscribe events for modern Node.js and browsers.",
+  "version": "6.1.1",
+  "description": "Small, synchronous publish/subscribe events for Node.js plus bundled and unbundled browsers.",
   "type": "module",
   "main": "./index.js",
+  "browser": "./index.js",
   "engines": {
     "node": ">=22.12.0"
   },
@@ -13,6 +14,7 @@
     "test:unit": "npm run stage && node ./test-runtime/event-pubsub/test/node.js unit",
     "test:functional": "npm run stage && node ./test-runtime/event-pubsub/test/node.js functional",
     "test:integration": "npm run stage && node ./test-runtime/event-pubsub/test/node.js integration",
+    "test:behavioral": "npm run stage && node ./test-runtime/event-pubsub/test/node.js behavioral",
     "test:regression": "npm run stage && node ./test-runtime/event-pubsub/test/node.js regression",
     "test:interface": "npm run stage && node ./test-runtime/event-pubsub/test/node.js interface",
     "coverage": "npm run stage && vanilla-test coverage all",
@@ -23,11 +25,12 @@
     "benchmark:chart": "node ./scripts/benchmark-chart.js",
     "benchmark:chart:check": "node ./scripts/benchmark-chart.js --check",
     "test:package": "node ./scripts/package-smoke.js",
+    "test:browser-consumer": "node ./scripts/browser-consumer-smoke.js",
     "site:check": "npm run stage && npm run benchmark:chart:check && node ./scripts/site-check.js",
     "site:assemble": "node ./scripts/assemble-site.js _site",
     "site:deployment-check": "node ./scripts/deployment-check.js _site",
     "start": "node ./scripts/serve.js",
-    "verify": "npm test && npm run coverage && npm run benchmark:smoke && npm run test:package && npm run site:check && npm run site:assemble && npm run site:deployment-check"
+    "verify": "npm test && npm run coverage && npm run benchmark:smoke && npm run test:package && npm run test:browser-consumer && npm run site:check && npm run site:assemble && npm run site:deployment-check"
   },
   "repository": {
     "type": "git",
@@ -46,7 +49,9 @@
     "event-emitter",
     "node",
     "browser",
-    "esm"
+    "esm",
+    "import-map",
+    "unbundled"
   ],
   "author": "Brandon Nozaki Miller",
   "license": "MIT",
@@ -54,6 +59,8 @@
     "strong-type": "2.0.0"
   },
   "devDependencies": {
+    "@rollup/plugin-node-resolve": "16.0.3",
+    "rollup": "4.62.5",
     "vanilla-test": "2.1.1"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.52.1",
+  "version": "0.54.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -12,6 +12,8 @@
     ".": "./src/index.mjs",
     "./toolchain": "./src/toolchain.mjs",
     "./events": "./src/events.mjs",
+    "./websocket": "./src/websocket.mjs",
+    "./websocket-client": "./browser-runtime/websocket-client.mjs",
     "./event-manager": "./src/event-manager.mjs",
     "./modules/*": "./runtime/arcane/modules/*",
     "./entities/*": "./runtime/arcane/entities/*",
@@ -37,6 +39,7 @@
     "./speech-playback": "./runtime/arcane/modules/SpeechPlayback.js",
     "./speech-text": "./browser-runtime/speech-text.mjs",
     "./ai/browser-wasm": "./browser-runtime/ai/browser-wasm.mjs",
+    "./ai/browser-decisions": "./browser-runtime/ai/browser-decisions.mjs",
     "./ai/tool-text-stream": "./browser-runtime/ai/tool-text-stream.mjs",
     "./ai/twin-cloud": "./browser-runtime/ai/twin-cloud.mjs",
     "./ai/browser-speech": "./browser-runtime/ai/browser-speech.mjs",
@@ -86,9 +89,9 @@
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
     "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/conversation-closing-report.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
-    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
+    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-decisions.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/native-module-packaging.test.mjs test/native-module-resource-references.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket-client-import-map.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/installed-package-runtime.test.mjs test/root-app-layout.test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-plan.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
-    "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
+    "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/html-import-packaged-script.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
     "check": "node tools/check-source.mjs && npm test",
     "check:release": "node tools/check-source.mjs --package-only && npm run test:release",
     "pack:local": "npm pack --ignore-scripts",
@@ -123,11 +126,12 @@
     "tag": "latest"
   },
   "dependencies": {
-    "event-pubsub": "6.1.0",
+    "event-pubsub": "6.1.1",
     "js-queue": "3.1.1",
     "node-http-server": "10.0.0",
     "strong-type": "2.0.1",
-    "vanilla-test": "2.1.3"
+    "vanilla-test": "2.1.3",
+    "ws-share": "3.1.0"
   },
   "bundleDependencies": [
     "event-pubsub",