arcane-os 0.53.0 → 0.54.1

package/node_modules/event-pubsub/README.md

@@ -22,9 +22,11 @@
 [![Chrome function ranges](https://img.shields.io/endpoint?url=https://riaevangelist.github.io/event-pubsub/badges/chrome-functions.json)](https://riaevangelist.github.io/event-pubsub/reports/chrome/)
 [![Chrome executable lines](https://img.shields.io/endpoint?url=https://riaevangelist.github.io/event-pubsub/badges/chrome-lines.json)](https://riaevangelist.github.io/event-pubsub/reports/chrome/)
 
-Small, synchronous, extensible publish/subscribe events for modern Node.js and browsers.
+Small, synchronous, extensible publish/subscribe events for Node.js plus bundled and unbundled browsers.
 
-> **Release status:** `6.1.0` is the current npm release and the verified source on `main`. `6.0.0` remains the most recent separately tagged GitHub source release.
+**It works with bundlers and without a bundler.** Both paths execute the same native ESM source; direct browser use needs only a standard import map, not a build or transpilation step.
+
+> **Release status:** `6.1.1` is the current npm and GitHub release.
 
 ![event-pubsub signal fan-out](https://riaevangelist.github.io/event-pubsub/og.png)
 
@@ -44,6 +46,8 @@ events.on('ready', (payload) => {
 events.emit('ready', {fast: true});
 ```
 
+That bare import is also the bundler entry. In a native browser application with no bundler, keep the same import and add the complete [import map shown below](#browser-use-bundled-and-unbundled).
+
 The same source is available directly to CommonJS on Node.js 22.12 or newer:
 
 ```js
@@ -64,8 +68,8 @@ Bars show median nanoseconds per emit, whiskers show p25–p75, and dots show al
 - Subscriber arrays remain live during an emit: additions can run in that emit, and specifically removed handlers are skipped before their turn. Removing a whole bucket or resetting the registry detaches it from future lookup while an already-active array finishes.
 - Safe event names, including `__proto__`, `constructor`, and `toString`.
 - Isolated `list` snapshots that cannot mutate the live registry.
-- One native ESM source for browser imports plus Node.js `import` and `require()`, without transpilation or a duplicate CommonJS build.
-- One explicit production validator: `strong-type` 2.0.0, loaded through the original Node/browser relative shim.
+- One native ESM source for Node.js `import`/`require()`, bundled browser applications, and unbundled browser modules, without transpilation or a duplicate build.
+- One explicit production validator: `strong-type` 2.0.0, resolved through the package dependency boundary with an explicit browser entry and import map.
 
 ## API
 
@@ -96,15 +100,19 @@ The wildcard list entry is exposed at `Symbol.for('event-pubsub-all')`.
 
 Only the exact public string `*` maps to the internal wildcard Symbol. The ordinary string `Symbol(event-pubsub-all)` remains an exact typed event name and never aliases wildcard removal.
 
-### Browser import map
+### Browser use: bundled and unbundled
+
+The 6.1.1 package imports `strong-type` by package name. Bundlers may use its explicit `browser` entry; native browsers do not read npm package metadata, so the import map selects `index.js` directly.
 
-The 6.1.0 runtime imports `strong-type` 2.0.0 through `../strong-type/index.js`. This preserves the original package-shaped Node/browser layout: serve `event-pubsub` and `strong-type` as sibling package directories, then map only the public package name:
+- With a standards-compatible bundler, both package names resolve normally. The release gate bundles and executes a packed conflicting-dependency consumer with Rollup 4.62.5 and node-resolve 16.0.3, configured only for JavaScript.
+- Without a bundler, a modern browser runs the same files directly through native ESM. Put this import map before the first module script that starts the graph and serve the directory over HTTP(S):
 
 ```html
 <script type="importmap">
 {
   "imports": {
-    "event-pubsub": "./node_modules/event-pubsub/index.js"
+    "event-pubsub": "./node_modules/event-pubsub/index.js",
+    "strong-type": "./node_modules/strong-type/index.js"
   }
 }
 </script>
@@ -113,30 +121,57 @@ The 6.1.0 runtime imports `strong-type` 2.0.0 through `../strong-type/index.js`.
 </script>
 ```
 
+That example is non-bundled browser code: the browser fetches both files from the mapped URLs and executes them directly. The paths are relative to the HTML document, so the static server must expose the shown `node_modules` files. Open the application through HTTP(S), not `file://`.
+
+If the application uses a strict Content Security Policy, configure it to authorize the inline import-map and module scripts—for example, with an allowed nonce or hash.
+
+If the application intentionally installs an incompatible `strong-type` at its root, npm keeps event-pubsub's exact 2.0.0 dependency nested. Scope the validator mapping to the event-pubsub referrer so the browser preserves that same dependency boundary:
+
+```html
+<script type="importmap">
+{
+  "imports": {
+    "event-pubsub": "./node_modules/event-pubsub/index.js",
+    "strong-type": "./node_modules/strong-type/index.js"
+  },
+  "scopes": {
+    "./node_modules/event-pubsub/": {
+      "strong-type": "./node_modules/event-pubsub/node_modules/strong-type/index.js"
+    }
+  }
+}
+</script>
+```
+
+Adjust the URLs to the package layout exposed by your static server. The release gate installs the packed tarball twice and executes both maps in real Chrome; the conflict fixture poisons the root validator so the scoped nested mapping cannot pass accidentally.
+
 ## Complete verification summary
 
-The shared host-neutral registry contains **119 unique checks**. `vanilla-test` 2.1.1 executes the same inventory in Node and real Google Chrome.
+The shared host-neutral registry contains **131 unique checks**. `vanilla-test` 2.1.1 executes the same inventory in Node and real Google Chrome.
 
 | Suite | Cases | Focus |
 | --- | ---: | --- |
 | Unit | 16 | Exports, state, fluent identity, validation, and list shape |
 | Functional | 26 | Registration, dispatch, wildcard, once, removal, reset, and chaining |
 | Integration | 14 | Subclassing, routing, isolation, namespaces, lifecycle, and errors |
+| Behavioral | 12 | Given/When/Then workflows, lifecycle boundaries, routing, failures, async effects, and live membership |
 | Regression | 43 | Mutation, reentrancy, snapshots, safe names, throws, and registration-local once state |
 | Interface | 20 | Playground parsing, safe display, bounded state, benchmark evidence, units, and chart scaling |
-| **Total** | **119** | One registry used by direct tests and both coverage runtimes |
+| **Total** | **131** | One registry used by direct tests and both coverage runtimes |
 
 ### Runtime and CI matrix
 
 | Verification | Runtime | Hosts | Result requirement |
 | --- | --- | --- | --- |
-| Direct shared suite | Node 22.12.0 and Node 24 | Ubuntu, macOS, Windows | 119/119 on every matrix job |
-| Node coverage | Node 24.18.0 | Ubuntu | 119/119 and every native V8 gate at 100% |
-| Browser coverage | Google Chrome Stable | Ubuntu | 119/119 and every native V8 gate at 100% |
-| Packed consumer | Node 24 | Ubuntu | Exact tarball contents, ESM exports, behavior, and the sole `strong-type` dependency |
+| Direct shared suite | Node 22.12.0 and Node 24 | Ubuntu, macOS, Windows | 131/131 on every matrix job |
+| Node coverage | Node 24.18.0 | Ubuntu | 131/131 and every native V8 gate at 100% |
+| Browser coverage | Google Chrome Stable | Ubuntu | 131/131 and every native V8 gate at 100% |
+| Packed consumer | Node 24 | Ubuntu | Exact tarball contents plus ESM/CommonJS execution of nested `strong-type` 2.0.0 under a poisoned root conflict |
+| Packed unbundled browser | Chrome Stable | Ubuntu and local release host | Normal and scoped-conflict import maps execute the tarball directly over HTTP |
+| Packed bundled browser | Rollup 4.62.5 + Chrome Stable | Ubuntu and local release host | A bundle resolves nested `strong-type` 2.0.0 and runs representative behavior under a poisoned root conflict |
 | Shared-source package smoke | Node 22.12.0 | Ubuntu | The same packed `index.js` through ESM `import` and direct CommonJS `require()` |
 | Execution benchmark | Node 24.18.0 | Ubuntu | Eight validated scenarios with execution-only timing boundaries |
-| GitHub Pages | Node 24 | Ubuntu | 21 pages, both runtime reports, badges, benchmark JSON, scripts, links, and licenses |
+| GitHub Pages | Node 24 | Ubuntu | 22 pages, both runtime reports, badges, benchmark JSON, scripts, links, and licenses |
 
 ### Coverage gates
 
@@ -151,25 +186,27 @@ These are native V8 executable/block/function range and executable-line totals f
 
 | Command | Purpose |
 | --- | --- |
-| `npm test` | Stage the sibling packages and run all 119 checks in Node. |
+| `npm test` | Stage event-pubsub with its nested exact validator and run all 131 checks in Node. |
 | `npm run test:unit` | Run the 16 Unit cases. |
 | `npm run test:functional` | Run the 26 Functional cases. |
 | `npm run test:integration` | Run the 14 Integration cases. |
+| `npm run test:behavioral` | Run the 12 Behavioral scenarios. |
 | `npm run test:regression` | Run the 43 Regression cases. |
 | `npm run test:interface` | Run the 20 Interface cases. |
-| `npm run coverage` | Run all 119 checks independently in Node and real Chrome with 100% gates. |
+| `npm run coverage` | Run all 131 checks independently in Node and real Chrome with 100% gates. |
 | `npm run coverage:node` | Generate only the Node native V8 report. |
 | `npm run coverage:chrome` | Generate only the real-Chrome native V8 report. |
 | `npm run benchmark` | Record seven fixed-count latency samples for eight scenarios. |
 | `npm run benchmark:smoke` | Validate the benchmark quickly without replacing published results. |
 | `npm run test:package` | Pack, inspect, install, and exercise a clean consumer. |
+| `npm run test:browser-consumer` | Pack and execute normal-map, scoped-conflict-map, and Rollup browser consumers in real Chrome. |
 | `npm run site:check` | Validate all focused pages, exact test inventories, scripts, links, forms, and assets. |
 | `npm run verify` | Run the complete local release gate. |
 
 ### Published evidence
 
 - [Testing strategy and suite totals](https://riaevangelist.github.io/event-pubsub/testing.html)
-- [Live execution of all 119 checks](https://riaevangelist.github.io/event-pubsub/live.html)
+- [Live execution of all 131 checks](https://riaevangelist.github.io/event-pubsub/live.html)
 - [Node test-result JSON](https://riaevangelist.github.io/event-pubsub/reports/node/test-results.json)
 - [Chrome test-result JSON](https://riaevangelist.github.io/event-pubsub/reports/chrome/test-results.json)
 - [Node HTML coverage](https://riaevangelist.github.io/event-pubsub/reports/node/)
@@ -256,6 +293,24 @@ Every test name below is sourced from the shared registry. The focused Pages sit
 
 </details>
 
+<details>
+<summary><strong>Behavioral — 12 scenarios</strong></summary>
+
+1. given an audited order retry with one-time reservation and persistent projection, when the same order is published twice, then the audit leads both deliveries while reservation happens once
+2. given an order handler that publishes the next workflow stage, when an order is created, then the nested fulfillment stage completes before outer delivery continues
+3. given a one-time readiness gate that reenters its own topic, when the outer readiness signal arrives, then the gate is consumed before the nested signal
+4. given a mounted subscriber that observes application updates, when the subscriber unmounts, then later updates no longer reach it
+5. given listeners from an authenticated session, when logout resets the event hub and a new session starts, then only the new session observes later activity
+6. given a bridge that forwards only public topics to another hub, when private and public messages are published, then only public messages cross the boundary
+7. given a request carrying a reply callback, when a subscriber handles the request, then the caller receives the reply before publish returns
+8. given a wildcard normalizer and a typed consumer sharing a payload, when the payload is published, then the consumer and caller observe the normalized object
+9. given a one-time preflight followed by a failing persistent subscriber, when delivery is retried after the failure, then preflight stays consumed and the exact failure keeps reaching the publisher
+10. given an asynchronous side effect beside a synchronous projection, when the event is published, then publish returns after starting both without awaiting the side effect
+11. given subscriber membership that changes during a notification, when the current delivery adds one subscriber and removes another, then the added subscriber joins immediately and the removed one is skipped
+12. given two tenant hubs with the same topic names, when each tenant publishes an update, then each update stays within its originating tenant
+
+</details>
+
 <details>
 <summary><strong>Regression — 43 cases</strong></summary>
 
@@ -343,7 +398,7 @@ The benchmark reports median **execution latency**—nanoseconds per named opera
 - [Examples](https://riaevangelist.github.io/event-pubsub/examples.html)
 - [Event console playground](https://riaevangelist.github.io/event-pubsub/playground.html)
 - [Mutation playground scenarios](https://riaevangelist.github.io/event-pubsub/playground-scenarios.html)
-- [All 119 tests](https://riaevangelist.github.io/event-pubsub/testing.html)
+- [All 131 tests](https://riaevangelist.github.io/event-pubsub/testing.html)
 - [Node and Chrome coverage](https://riaevangelist.github.io/event-pubsub/coverage.html)
 - [Benchmark overview](https://riaevangelist.github.io/event-pubsub/benchmarks.html)
 - [Dispatch latency chart](https://riaevangelist.github.io/event-pubsub/benchmarks-dispatch.html)
@@ -356,7 +411,8 @@ The benchmark reports median **execution latency**—nanoseconds per named opera
 ## Runtime support
 
 - Node.js 22.12.0 or newer for production, development, and direct CommonJS `require()` of the native ESM source.
-- Modern browsers with native modules, private class fields, and `Symbol`. Unbundled use must serve the sibling `event-pubsub` and `strong-type` package directories.
+- Bundled browser applications; the bundler resolves `event-pubsub` and `strong-type` from package metadata normally.
+- Unbundled modern browsers with native modules, private class fields, `Symbol`, and import maps; no build step is required. Map both package names, with a scoped validator mapping when npm nests it.
 
 ## License
 

package/node_modules/event-pubsub/SECURITY.md

@@ -4,11 +4,11 @@
 
 | Version | Supported |
 | --- | --- |
-| 6.1.0 on npm | Current supported release |
-| 6.0.0 | Superseded GitHub source release |
+| 6.1.1 on npm and GitHub | Current supported release |
+| 6.0.0 through 6.1.0 | Superseded 6.x releases |
 | 5.x and older | No planned security fixes |
 
-Version 6.1.0 is the current npm release and requires Node.js 22.12 or newer. Version 6.0.0 remains available as the earlier GitHub source release, but users should install the latest available 6.x release.
+Version 6.1.1 is the current npm and GitHub release and requires Node.js 22.12 or newer. Earlier 6.x versions remain available for provenance, but users should install the latest available 6.x release.
 
 ## Reporting a vulnerability
 

package/node_modules/event-pubsub/index.js

@@ -1,5 +1,5 @@
-// Shim allowing the same module path to run in Node and an unbundled browser.
-import Is from '../strong-type/index.js';
+// Preserve the package manager's dependency boundary instead of reaching for a consumer-root sibling.
+import Is from 'strong-type';
 
 const is = new Is();
 const ALL_EVENTS = Symbol.for('event-pubsub-all');

package/node_modules/event-pubsub/package.json

@@ -1,9 +1,10 @@
 {
   "name": "event-pubsub",
-  "version": "6.1.0",
-  "description": "Small, synchronous, extensible publish/subscribe events for modern Node.js and browsers.",
+  "version": "6.1.1",
+  "description": "Small, synchronous publish/subscribe events for Node.js plus bundled and unbundled browsers.",
   "type": "module",
   "main": "./index.js",
+  "browser": "./index.js",
   "engines": {
     "node": ">=22.12.0"
   },
@@ -13,6 +14,7 @@
     "test:unit": "npm run stage && node ./test-runtime/event-pubsub/test/node.js unit",
     "test:functional": "npm run stage && node ./test-runtime/event-pubsub/test/node.js functional",
     "test:integration": "npm run stage && node ./test-runtime/event-pubsub/test/node.js integration",
+    "test:behavioral": "npm run stage && node ./test-runtime/event-pubsub/test/node.js behavioral",
     "test:regression": "npm run stage && node ./test-runtime/event-pubsub/test/node.js regression",
     "test:interface": "npm run stage && node ./test-runtime/event-pubsub/test/node.js interface",
     "coverage": "npm run stage && vanilla-test coverage all",
@@ -23,11 +25,12 @@
     "benchmark:chart": "node ./scripts/benchmark-chart.js",
     "benchmark:chart:check": "node ./scripts/benchmark-chart.js --check",
     "test:package": "node ./scripts/package-smoke.js",
+    "test:browser-consumer": "node ./scripts/browser-consumer-smoke.js",
     "site:check": "npm run stage && npm run benchmark:chart:check && node ./scripts/site-check.js",
     "site:assemble": "node ./scripts/assemble-site.js _site",
     "site:deployment-check": "node ./scripts/deployment-check.js _site",
     "start": "node ./scripts/serve.js",
-    "verify": "npm test && npm run coverage && npm run benchmark:smoke && npm run test:package && npm run site:check && npm run site:assemble && npm run site:deployment-check"
+    "verify": "npm test && npm run coverage && npm run benchmark:smoke && npm run test:package && npm run test:browser-consumer && npm run site:check && npm run site:assemble && npm run site:deployment-check"
   },
   "repository": {
     "type": "git",
@@ -46,7 +49,9 @@
     "event-emitter",
     "node",
     "browser",
-    "esm"
+    "esm",
+    "import-map",
+    "unbundled"
   ],
   "author": "Brandon Nozaki Miller",
   "license": "MIT",
@@ -54,6 +59,8 @@
     "strong-type": "2.0.0"
   },
   "devDependencies": {
+    "@rollup/plugin-node-resolve": "16.0.3",
+    "rollup": "4.62.5",
     "vanilla-test": "2.1.1"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.53.0",
+  "version": "0.54.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -13,6 +13,7 @@
     "./toolchain": "./src/toolchain.mjs",
     "./events": "./src/events.mjs",
     "./websocket": "./src/websocket.mjs",
+    "./websocket-client": "./browser-runtime/websocket-client.mjs",
     "./event-manager": "./src/event-manager.mjs",
     "./modules/*": "./runtime/arcane/modules/*",
     "./entities/*": "./runtime/arcane/entities/*",
@@ -38,6 +39,7 @@
     "./speech-playback": "./runtime/arcane/modules/SpeechPlayback.js",
     "./speech-text": "./browser-runtime/speech-text.mjs",
     "./ai/browser-wasm": "./browser-runtime/ai/browser-wasm.mjs",
+    "./ai/browser-decisions": "./browser-runtime/ai/browser-decisions.mjs",
     "./ai/tool-text-stream": "./browser-runtime/ai/tool-text-stream.mjs",
     "./ai/twin-cloud": "./browser-runtime/ai/twin-cloud.mjs",
     "./ai/browser-speech": "./browser-runtime/ai/browser-speech.mjs",
@@ -87,9 +89,9 @@
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
     "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/conversation-closing-report.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
-    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
+    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-decisions.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/native-module-packaging.test.mjs test/native-module-resource-references.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket-client-import-map.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/installed-package-runtime.test.mjs test/root-app-layout.test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-plan.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
-    "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
+    "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/html-import-packaged-script.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
     "check": "node tools/check-source.mjs && npm test",
     "check:release": "node tools/check-source.mjs --package-only && npm run test:release",
     "pack:local": "npm pack --ignore-scripts",
@@ -124,11 +126,12 @@
     "tag": "latest"
   },
   "dependencies": {
-    "event-pubsub": "6.1.0",
+    "event-pubsub": "6.1.1",
     "js-queue": "3.1.1",
     "node-http-server": "10.0.0",
     "strong-type": "2.0.1",
-    "vanilla-test": "2.1.3"
+    "vanilla-test": "2.1.3",
+    "ws-share": "3.1.0"
   },
   "bundleDependencies": [
     "event-pubsub",

package/runtime/arcane/modules/HTMLImport.js

@@ -6,6 +6,7 @@ import {
   createArcaneEventSource,
   projectArcaneDOMEvent
 } from 'arcane-os/event-manager';
+import { createHTMLImportScript } from './HTMLImportScript.js';
 
 const htmlImportHostRegistryKey=Symbol.for('arcane.html-import.hosts');
 const htmlImportHostRegistry=globalThis[htmlImportHostRegistryKey] instanceof Map
@@ -18,6 +19,47 @@ let htmlImportScriptId=0;
 
 const htmlImportModuleURL=new URL(import.meta.url);
 
+function appendPackagedScript(executable, signal) {
+    return new Promise(function waitForPackagedScript(resolve, reject) {
+        function removeListeners() {
+            executable.removeEventListener('load', loaded);
+            executable.removeEventListener('error', failed);
+            signal.removeEventListener('abort', cancelled);
+        }
+
+        function loaded() {
+            removeListeners();
+            resolve(true);
+        }
+
+        function failed() {
+            removeListeners();
+            reject(new Error(`HTML import packaged script failed to load: ${executable.src}`));
+        }
+
+        function cancelled() {
+            removeListeners();
+            executable.remove();
+            resolve(false);
+        }
+
+        executable.addEventListener('load', loaded, {once: true});
+        executable.addEventListener('error', failed, {once: true});
+        signal.addEventListener('abort', cancelled, {once: true});
+        if (signal.aborted) {
+            cancelled();
+            return;
+        }
+
+        try {
+            document.head.appendChild(executable);
+        } catch (error) {
+            removeListeners();
+            reject(error);
+        }
+    });
+}
+
 function cleanComponentResource(value,baseHref){
   if(!is.string(value)||!value||value.startsWith('#')){
     return value;
@@ -474,42 +516,55 @@ class HTMLImport extends HTMLElement {
     try{
       for(const script of scripts){
         if(!this.#isCurrentConnection(generation,controller))return;
-        let source=script.textContent||'';
-        let sourceBaseHref=contentBaseHref;
         const scriptSource=script.getAttribute('src');
-        if(scriptSource!==null){
-          const requestedScriptHref=cleanComponentResource(
-            new URL(scriptSource,contentBaseHref).href,
-            contentBaseHref
-          );
-          const response=await fetch(requestedScriptHref,{
-            cache:'default',
-            method:'GET',
-            signal:controller.signal
-          });
-          if(!response.ok){
-            throw new Error(`HTML import script request failed with status ${response.status}.`);
-          }
-          source=await response.text();
-          sourceBaseHref=response.url||requestedScriptHref;
-          if(!this.#isCurrentConnection(generation,controller))return;
-        }
-
-        const executableSource=resolveRelativeDynamicImports(
-          source,
-          sourceBaseHref
-        );
         const executable=document.createElement('script');
         const hostToken=`html-import-${Date.now()}-${htmlImportScriptId++}`;
+        const packaged=script.getAttribute('data-arcane-packaged-script')!==null;
+        const requestedScriptHref=scriptSource===null?null:cleanComponentResource(
+          new URL(scriptSource,contentBaseHref).href,
+          contentBaseHref
+        );
+
+        if(packaged){
+          if(requestedScriptHref===null){
+            throw new Error('The HTML import packaged script has no source URL.');
+          }
+          executable.src=requestedScriptHref;
+        }else{
+          let source=script.textContent||'';
+          let sourceBaseHref=contentBaseHref;
+          if(requestedScriptHref!==null){
+            const response=await fetch(requestedScriptHref,{
+              cache:'default',
+              method:'GET',
+              signal:controller.signal
+            });
+            if(!response.ok){
+              throw new Error(`HTML import script request failed with status ${response.status}.`);
+            }
+            source=await response.text();
+            sourceBaseHref=response.url||requestedScriptHref;
+            if(!this.#isCurrentConnection(generation,controller))return;
+          }
+          executable.textContent=createHTMLImportScript(resolveRelativeDynamicImports(
+            source,
+            sourceBaseHref
+          ));
+        }
 
         executable.dataset.arcaneHostToken=hostToken;
-        executable.textContent=`(()=>{const registry=globalThis[Symbol.for('arcane.html-import.hosts')];const token=document.currentScript&&document.currentScript.dataset.arcaneHostToken;const binding=registry instanceof Map&&token?registry.get(token):null;if(!binding?.host)throw new Error('HTML import host binding is unavailable.');binding.promise=(async function(){${executableSource}}).call(binding.host);})()`;
         script.parentNode.removeChild(script);
 
         const binding={host:this,promise:null};
         htmlImportHostRegistry.set(hostToken,binding);
         try{
-          document.head.appendChild(executable);
+          if(packaged){
+            const loaded=await appendPackagedScript(executable,controller.signal);
+            // A started initializer still owns completion and any late teardown.
+            if(!loaded&&!binding.promise)return;
+          }else{
+            document.head.appendChild(executable);
+          }
           if(!binding.promise||!is.function(binding.promise.then)){
             throw new Error('The HTML import script did not start.');
           }

package/runtime/arcane/modules/HTMLImportScript.js

@@ -0,0 +1,3 @@
+export function createHTMLImportScript(source) {
+    return `(()=>{const registry=globalThis[Symbol.for('arcane.html-import.hosts')];const token=document.currentScript&&document.currentScript.dataset.arcaneHostToken;const binding=registry instanceof Map&&token?registry.get(token):null;if(!binding?.host)throw new Error('HTML import host binding is unavailable.');binding.promise=(async function(){${source}\n}).call(binding.host);})()`;
+}