arcane-os 0.66.0 → 0.67.0

package/docs/reference/local-image-generation.md

@@ -199,14 +199,16 @@ ordered `Blob` or `File` members after its resumable download. Range support
 allows concurrent transfer within a member; those transfer parts remain the
 store's concern. Use `offline: true` to require an already complete stored model.
 The store does not select or run the image engine. In source development,
-load the development Core bootstrap described
-in [Local AI through Core](local-ai.md#development) before constructing the
-accessor. Native hosts install their Core client through the existing host path.
+use the development Core bootstrap described
+in [Local AI through Core](local-ai.md#development). The accessor can be
+constructed before that client is installed; perform model operations once
+the service is available. Native hosts install their Core client through the
+existing host path.
 An ordinary browser without Core reports local image generation as unavailable.
 
 | Member | Contract |
 |---|---|
-| `createCoreImageRuntime({client?, signal?, onEvent?})` | Uses the installed Core client by default, subscribes to lifecycle events and asynchronously reads one initial status snapshot. It returns immediately. |
+| `createCoreImageRuntime({client?, signal?, onEvent?})` | Follows Core installation and lifecycle events by default, asynchronously reading status for each client. An explicit `client`, including `null`, remains caller-owned. It returns immediately. |
 | `load({model, context?, assetProjectionId?, resourcePaths?, signal?})` | Loads the selected model and returns authoritative service state after native completion. `context` supplies native context options. |
 | `generate({model, prompt, parameters?, assetProjectionId?, resourcePaths?, signal?, onProgress?})` | Returns the complete result with `images: [{blob, mediaType, width, height}]`. Additional runtime result metadata remains present. |
 | `unload({signal?})` | Explicitly unloads the shared selected native context and returns its resulting state. |
@@ -229,6 +231,15 @@ model definitions, including their resource metadata before engine preparation
 finishes. Installed files do not imply a loaded model. A late status
 response never overwrites a newer lifecycle event.
 
+With `client` omitted, the accessor consumes the shared
+[`subscribeCoreClient`](core-client.md) installation stream. A late installation
+attaches the service listener and reads current status; it never installs an
+engine or loads a model. Retirement or replacement synchronously clears
+readiness and transient `Thinking`, cancels owned requests and detaches the
+retired service listener. Old state, progress and results cannot update the
+replacement connection. `close()` also removes the installation subscription;
+it does not claim that the shared native model was unloaded.
+
 Prompts and parameters pass unchanged to the native runtime. Native option
 names, supported model operations and defaults belong to that runtime and the
 selected model definition. A prompt containing U+0000 or an unpaired UTF-16

package/docs/reference/model-assets.md

@@ -1,6 +1,6 @@
-# Native working files from stored model assets
+# Native working files from model assets
 
-These public APIs were first published in `arcane-os@0.61.0`. Browser
+Browser preparation and native retain/release ownership were first published in `arcane-os@0.61.0`. Browser
 preparation is exported by `arcane-os/ai/core-model-assets`, and the native
 service by `arcane-os/core/model-assets`. The image example below uses
 `arcane-os/ai/core-image`, published in the same release.
@@ -87,6 +87,53 @@ cleanup failures remain observable.
 
 ## Native ownership
 
+Native services can prepare explicitly selected upstream members without a
+renderer or browser store. Obtain the registered shared service through
+`await context.getService('model-assets')`, then use its native preparation API:
+
+```javascript
+const modelAssets = await context.getService('model-assets');
+const projection = await modelAssets.prepare({
+    id: selectedOperationId,
+    workingDirectory: selectedWorkingDirectory,
+    members: selectedMembers, // [{path: 'onnx/model.onnx', url: selectedURL}, ...]
+    signal,
+    onProgress: renderPreparationProgress
+});
+const use = modelAssets.retain(projection.id);
+await modelAssets.release(projection.id);
+try {
+    await ownNativeModelLifetime(use.members);
+} finally {
+    // Join actual native unload/worker exit before releasing these files.
+    await use.release();
+}
+```
+
+`prepare({id,workingDirectory,members,signal,onProgress})` performs standard
+fetches only when explicitly called. Every member has its original relative
+`path` and selected `url`; the caller supplies the complete companion-file set.
+Independent members download concurrently. Each complete response stream is
+written directly through the existing ordered native file owner, without a
+whole-model buffer or base64 conversion. No model or runtime is selected or
+downloaded by service startup. The result is the ready projection snapshot with
+ordered `members: [{path,nativePath}]`.
+
+Progress uses `open`, `download`, `complete` and `ready` phases, with
+`completed`, `total` and `unit:'files'`; member progress additionally includes
+`memberIndex` and `path`. Progress callbacks may return a promise, which the
+preparation observes. They must not await cleanup of the preparation currently
+calling them. Callback failures remain preparation failures. HTTP failures
+retain `url`, `status` and the complete response text in `response`.
+
+`release(id)` relinquishes preparation ownership without a request signal.
+For active native downloads, release or disposal aborts their fetches and joins
+the transfer tasks and native writes before deleting only their owned child
+directory. Preparation cancellation and failure follow that same cleanup path;
+the original failures and cleanup failures remain observable. A native retain
+handle continues to protect completed files through actual engine release.
+Native preparation leaves browser DBOPFS originals and unrelated files alone.
+
 ```javascript
 import {createModelAssetService} from 'arcane-os/core/model-assets';
 
@@ -103,7 +150,7 @@ try {
 ```
 
 `createModelAssetService({appRoot})` returns a Core service with `current()`,
-`retain(id)` and `dispose()`. `retain()` accepts only a completed projection
+`prepare(options)`, `retain(id)`, `release(id)` and `dispose()`. `retain()` accepts only a completed projection
 and returns `{id,directory,members,release}`. A native engine takes this handle
 before loading and releases it after actual unload, failed-load cleanup or
 worker exit. A rejected inference/load promise alone does not establish native

package/docs/reference/native-decisions.md

@@ -0,0 +1,181 @@
+# Native Laya typed decisions
+
+`arcane-os/local-ai/decisions` and `arcane-os/core/decisions` run the selected
+Laya FP32 graph through the SDK's existing native ONNX owner. Tokenization runs
+in its own Node Worker. A Core service can load and evaluate decisions without
+a renderer, browser session, WebGPU browser context or chat provider.
+
+The application owns the model selection, original state text, questions,
+options and interpretation. The SDK owns model preparation, token framing,
+inference and cleanup. This is option scoring, not a conversational LLM, a
+replacement for a configured chat model or the cloud System One API.
+
+## Compose with existing Core services
+
+Register a decision service alongside the selected local-AI and model-assets
+services in the application's existing Core runtime:
+
+```js
+import {createNativeDecisionService} from 'arcane-os/core/decisions';
+
+const decisions = createNativeDecisionService({
+    model: 'onnx-community/laya-typed-decisions-ONNX',
+    dtype: 'fp32',
+    workingDirectory: '.models/laya'
+}, {appRoot});
+
+// Include decisions in the existing createCoreRuntime({services}) selection.
+// That runtime already owns local-ai with ONNX selected and model-assets.
+await runtime.getService('decisions');
+await decisions.load(); // Explicit activation; no model download at registration.
+try {
+    const result = await decisions.evaluate([{
+        state: 'The moon chef has one kettle and seventeen impatient dragons.',
+        question: 'What should the chef prepare?',
+        options: ['Tea', 'An inflatable castle']
+    }]);
+    console.log(result.decisions[0].value);
+} finally {
+    await decisions.unload();
+}
+```
+
+Here `runtime` and `appRoot` are the application's existing Core runtime and
+root. Add the service before starting that runtime; the example does not create
+a second Core host or engine. Development and packaged native compositions
+already register one model-assets service when ONNX is selected. The decision
+service obtains those exact owners with `context.getService('local-ai')`,
+`localAI.getONNXRuntime()` and `context.getService('model-assets')` on explicit
+load. It reacquires the current ONNX owner after a later runtime recovery.
+See [Core composition](core-runtime.md#native-service-composition) and
+[native service owners](local-ai.md#native-service-owners).
+
+`createNativeDecisionService(configuration, {appRoot})` defaults its service
+name to `decisions`. It exposes `load`, `evaluate`, `classify` (an alias for
+`evaluate`), `current`, `subscribe`, `unload` and `dispose`, plus Core lifecycle
+`start(context)`. Its RPC methods are:
+
+| Method | Parameters and result |
+| --- | --- |
+| `decisions.status` | Current lifecycle snapshot; does not load anything. |
+| `decisions.load` | Explicit activation; returns the ready lifecycle snapshot. The request signal cancels activation. |
+| `decisions.evaluate` | `{rows, runOptions?}`; returns `{decisions, outputs}`. The request signal cancels the active model operation. |
+| `decisions.unload` | Releases the activation. Service-lifetime cleanup continues after the caller disconnects. |
+
+RPC evaluation uses the SDK's existing complete JSON tensor encoding for
+`outputs` at the transport boundary. Direct native evaluation returns native
+typed tensor records. Service notifications use `decisions.state`; direct
+`subscribe(listener, {emitCurrent:true, signal})` replays current state by
+default and returns an unsubscribe function. Startup stores the service
+context only: importing or registering this service starts no tokenizer,
+model download or inference.
+
+## Direct native model
+
+`createNativeDecisionModel(options)` from `arcane-os/local-ai/decisions` returns
+`{load, evaluate, classify, current, status, subscribe, unload, dispose}`.
+`status` aliases `current`; `classify` aliases `evaluate`. Supply the existing
+native `onnx` owner, plus either the existing `modelAssets` owner and selected
+`workingDirectory`, or caller-owned native files:
+
+```js
+import {createNativeDecisionModel} from 'arcane-os/local-ai/decisions';
+
+const decisions = createNativeDecisionModel({
+    onnx: localAI.getONNXRuntime(),
+    paths: {
+        model: selectedGraphPath,
+        tokenizer: selectedTokenizerPath,
+        tokenizerConfig: selectedTokenizerConfigPath
+    }
+});
+```
+
+These direct paths are native filesystem paths. Keep the graph's external data
+beside it under the exact filename required by the graph. The Core service
+resolves configured `paths` relative to `appRoot`; it does not copy or remove
+caller-owned files. For SDK-prepared files, the default selected upstream is
+`onnx-community/laya-typed-decisions-ONNX`, revision `main`, with exactly:
+
+- `onnx/model.onnx` and `onnx/model.onnx_data`;
+- `tokenizer.json` and `tokenizer_config.json`.
+
+`model` selects the upstream Hugging Face repository and `revision` its
+revision. Native preparation performs normal upstream fetches only during
+explicit `load()`. It streams complete members through the existing working
+file owner; it neither vendors the weights nor creates a second persistent
+model store. The approved `@huggingface/tokenizers@0.2.0` dependency reads the
+selected tokenizer files in its Worker. No Transformers or second ONNX runtime
+is loaded by this API.
+
+This graph selection requires `dtype:'fp32'`, which is also the default; another
+dtype reports the incompatible selection rather than substituting a graph.
+`sessionOptions` and `runOptions` pass to the existing native ONNX API unchanged.
+`executionPreference` defaults to `gpu` here: actual advertised native GPU
+provider creation is attempted, followed by an honest CPU fallback. Explicit
+`sessionOptions.executionProviders` takes precedence. The underlying generic
+ONNX factory continues to default to CPU. Accepted provider configuration is
+not evidence that GPU nodes executed. Full provider-attempt diagnostics remain
+in `execution`; see [native ONNX sessions](local-ai.md#native-onnx-sessions).
+
+## Complete inputs and outputs
+
+`evaluate(rows, {signal, runOptions})` requires an explicitly loaded or loading
+activation; it does not silently load an inactive model. Rows retain their
+caller order, complete `state`, `question` and string-array `options`, plus
+optional `type` (`choice`, `score` or `noul`). Additional row fields remain in
+the returned row. Strings are not trimmed, rewritten or clipped. The shared
+browser/native encoding owner constructs only the model's necessary token
+framing; repeated identical state is tokenized once per batch. Tokenization
+and ONNX execution run outside Core's foreground thread.
+
+The result is `{decisions, outputs}`. Each decision contains its original
+`row`, complete option `logits`, unrounded raw-softmax `probabilities`,
+`answerIndex` and `value`. `choice` returns the selected complete option;
+`score` returns the probability-weighted zero-based option index; `noul`
+requires `[falseOption, trueOption]` and returns the probability of option 1.
+When the graph actually supplies `act_logits`, action logits, probabilities
+and `actProbability` are also returned. Every named graph output is retained
+as `{type, dims, data}`, including extra tensors and padding. Raw model scores
+are not claimed calibrated confidence. Results do not enter chat history,
+memory extraction or DBOPFS automatically.
+
+The model's real graph/context limits still apply. There is no SDK token cap,
+silent chunking or fabricated result aggregation. Native/browser token-ID or
+numerical parity requires execution evidence for the selected tokenizer and
+runtime; sharing the encoding implementation alone does not establish it.
+
+## Lifetime and cancellation
+
+`current()` returns `{family, model, revision, dtype, state, loaded, busy,
+activeRequests, progress, error, execution}`. States include `unloaded`,
+`loading`, `ready`, `unloading`, `disposing`, `disposed` and `error`. Semantic
+progress includes model preparation, tokenization and evaluation; downloaded
+members report files, not byte progress. Complete technical errors belong in
+developer diagnostics, while the application owns its user-facing status.
+
+Concurrent callers share one explicit activation. Cancelling a load or
+evaluation cancels that activation and its outstanding operations, because the
+native session and tokenizer have one owner. Use separately owned models when
+independent cancellation is required. The construction `signal` governs the
+whole model lifetime. `unload()` permits another explicit load after successful
+cleanup; `dispose()` is terminal. Readiness is revoked as disposal begins.
+
+Retained model files remain owned until the ONNX and tokenizer Workers really
+exit. A rejected load, inference or termination request alone does not permit
+file deletion. Cleanup joins active operations and native output delivery,
+preserves cleanup errors, then releases only its working projection. It never
+deletes supplied `paths`. A failed ordinary row does not destroy a healthy
+loaded session or cancel sibling evaluations. The ONNX owner's `stopping:true`
+retires decision readiness immediately on terminal Worker failure or shutdown,
+even while its physical `loaded` state remains true pending actual exit. Cancelled or
+retired operations cannot return a successful late result.
+
+Shared Node/Worker/filesystem code is portable across Windows, Linux and macOS;
+the selected ONNX Runtime build and provider determine actual platform/device
+availability. Android requires the host's supported native adaptation. Static
+source review and synthetic authored fixtures are not model execution or a
+claim of tested platform, precision or accelerator behavior.
+
+Upstream selection: [Laya FP32 model files](https://huggingface.co/onnx-community/laya-typed-decisions-ONNX/tree/main),
+[Tokenizer package](https://www.npmjs.com/package/@huggingface/tokenizers).

package/docs/reference/sdk-api.md

@@ -108,7 +108,7 @@ runtime layouts.
 | `arcane-os/pwa` | Nonblocking PWA registration, worker updates, native installation state and a dismissible installation component. |
 | `arcane-os/ai/browser-wasm` | Caller-selected browser-local Wllama inference, complete DBOPFS model storage, streaming, cancellation, and structural tool-call results. |
 | `arcane-os/ai/core-local` | Browser llama.cpp provider through an available Core connection; browser-local Wllama and ONNX remain independently available. |
-| `arcane-os/ai/browser-decisions` | Explicit-load Laya FP16 and Julia-1 FP32 typed decisions through the shared Transformers.js Worker owner. |
+| `arcane-os/ai/browser-decisions` | Explicit-load Laya and Julia-1 typed decisions with caller-selected precision through the shared Transformers.js Worker owner. |
 | `arcane-os/ai/tool-text-stream` | Shared selected tool-argument text observer for provider integration. |
 | `arcane-os/ai/twin-cloud` | Stateless chat, System One state/questions and image generation with explicit key/model, complete results and operation-specific retry/cancellation. |
 | `arcane-os/ai/browser-speech` | Caller-selected Whisper/Kokoro, native browser recognition/synthesis, cloud TTS, upstream assets, role lifecycle and cancellation. |
@@ -3742,11 +3742,19 @@ Runs one fast-forward-only pull after proving the selected repository worktree i
 ### Signature and result
 
 ```text
-async repositoryPull({ workspaceRoot=process.cwd(), signal, onEvent, run=runProcess }={})
+async repositoryPull({ workspaceRoot=process.cwd(), target, signal, onEvent, run=runProcess }={})
 ```
 
 Import it from `arcane-os`. The signature above states whether settlement is synchronous or promise-based. The overview and owning group define result authority, side effects, callbacks, events, cancellation, and lifecycle.
 
+Optional `target:{remote,ref}` captures exact nonempty native-representable
+strings before any wait and selects `git pull --ff-only -- <remote> <ref>:`.
+The current clean branch receives a fast-forward-only integration; the SDK
+never switches branches, resets or changes configuration. Without a target,
+the existing configured pull and result remain unchanged. Targeted results
+add `target`, complete `stdout` and `stderr` to the existing pull result.
+See [checkout configuration and selected targets](core-repositories.md#existing-checkout-configuration-and-selected-targets).
+
 ### Availability and normalization
 
 **Node; network-assisted Git.** SDK-normalized inputs, errors, events, and documented result. Deep protocol: [Node ESM](protocols.md).
@@ -3770,7 +3778,7 @@ Pushes the selected attached branch through the repository's configured remote a
 ### Signature, parameters, and result
 
 ```text
-async repositoryPush({ workspaceRoot=process.cwd(), signal, onEvent, run=runProcess }={})
+async repositoryPush({ workspaceRoot=process.cwd(), target, signal, onEvent, run=runProcess }={})
 ```
 
 Import it from `arcane-os`. `workspaceRoot` selects the Git worktree. `signal`
@@ -3781,10 +3789,16 @@ should keep the default.
 
 Before pushing, the SDK runs `git rev-parse --show-toplevel`,
 `git branch --show-current`, and `git status --short --branch` in order. It rejects a
-detached HEAD, then runs plain `git push`; the repository's current branch,
+detached HEAD, then, without `target`, runs plain `git push`; the repository's current branch,
 configured upstream/remote, Git credentials, hooks, and server policy remain
 authoritative. Unlike `repositoryPull()`, this function does **not** require a
-clean worktree. It does not create a commit or select a remote/refspec for you.
+clean worktree. It does not create a commit or choose an application destination.
+Optional `target:{remote,ref}` captures the original nonempty
+native-representable strings before any wait and runs
+`git push --no-follow-tags -- <remote> HEAD:<ref>`. This publishes current HEAD
+to the caller-selected ref without force or implicit configured tag following.
+It changes no branch or Git configuration; credentials, URL interpretation,
+hooks and remote rejection remain Git-owned.
 
 The promise resolves to
 `{action:'push', repositoryRoot, branch, output}`. `output` is trimmed stdout,
@@ -3792,6 +3806,9 @@ or trimmed stderr when stdout is empty. A missing Git executable, failed status
 probe, rejected/nonzero push, cancellation, or event-callback failure rejects
 with the normalized process error. Cancellation stops the local process tree;
 it cannot prove that a remote accepted no objects before the interruption.
+Targeted results also contain the captured `target` and complete
+`stdout`/`stderr`; omitting the target preserves the existing result shape.
+See [checkout configuration and selected targets](core-repositories.md#existing-checkout-configuration-and-selected-targets).
 
 ### Availability and normalization
 
@@ -7894,8 +7911,8 @@ explicit existing path. The application owns the remote, branch and Core API.
 createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run=runProcess}={})
 ```
 
-Returns `{directory,open,status,pull,push,write,close,drain,dispose}`. Construction does
-no I/O. Operations accept `{signal}`; a missing or empty destination clones once,
+Returns `{directory,open,status,configuration,pull,push,write,close,drain,dispose}`. Construction does
+no I/O. Preparing operations accept `{signal}`; a missing or empty destination clones once,
 while existing checkout files, branches, remotes and local changes remain intact.
 Same-directory calls are ordered within the process. Shutdown drains accepted
 work and preserves the checkout. No CLI cwd, launch state, preference, snapshot
@@ -7908,7 +7925,25 @@ Selected author fields override inherited child author/committer fields;
 omitted fields remain inherited. Username remains a credential hint, with
 authentication owned by ordinary Git and its configured helper.
 
-`write({files:[{path,content}],message,signal})` snapshots the exact selected
+`configuration({signal})` observes an existing working root without clone,
+initialization or fetch. It returns `{repositoryRoot,headRef,origin,upstream}`:
+full symbolic HEAD (including unborn, null when detached), origin URL/pushURL
+arrays and current branch remote/merge/URL/pushURL arrays. Unset, empty and
+repeated configuration values remain distinct. These are ordinary configured
+values, not authentication or endpoint proof, and are not atomic with later
+operations. Raw stdout is decoded without replacement; unrepresentable text
+reports `ARCANE_GIT_CONFIGURATION_NOT_TEXT` with full diagnostics.
+
+`pull({target,signal})`, `push({target,signal})` and
+`write({files:[{path,content}],message,target,signal})` accept optional
+`target:{remote,ref}`, captured as original strings at acceptance. The target
+selects a fast-forward-only pull into the current branch or a non-force push
+of current HEAD to the selected ref, without switching branches or changing
+configuration. It is independent of initial-clone `remote`/`branch`; omission
+preserves ordinary configured behavior. See the [complete configuration and
+target contract](core-repositories.md#existing-checkout-configuration-and-selected-targets).
+
+`write` snapshots the exact selected
 strings, writes those repository-relative files, commits only their literal
 paths and performs an ordinary non-force push. It retains unrelated staged
 paths and existing Git filters/hooks. Results and causal failures distinguish
@@ -9075,14 +9110,19 @@ native installation eligibility and URL-bar promotion.
 
 ### Overview
 
-Creates an explicitly loaded browser model for Laya typed decisions in FP16 or
-Julia-1 in FP32. The shared Worker owns Transformers.js loading, full-input
+Creates an explicitly loaded browser model for Laya typed decisions or
+Julia-1. Laya defaults to FP16 and Julia to FP32; callers may select `dtype`
+explicitly. The shared Worker owns Transformers.js loading, full-input
 encoding, batched inference, complete results, cancellation and resource lifetime.
 Applications own model selection, questions, option meanings and decision policy.
 Existing chat and speech providers are unchanged.
 
 ### Signature and result
 
+```text
+createBrowserDecisionModel({family,model,revision,device,dtype,runtime}={})
+```
+
 ```js
 import {createBrowserDecisionModel} from 'arcane-os/ai/browser-decisions';
 
@@ -9107,8 +9147,11 @@ precision, tokenization, output meanings, lifecycle and model limitations.
 ### Availability and normalization
 
 Browser module Workers plus the selected Transformers.js backend are required
-on explicit use. Import and construction do not activate a model. Laya fixes
-`dtype: 'fp16'`; Julia fixes `dtype: 'fp32'`; there is no precision fallback.
+on explicit use. Import and construction do not activate a model. The optional
+nonempty `dtype` string defaults to `fp16` for Laya and `fp32` for Julia. An
+explicit value is forwarded unchanged to the upstream loader; unsupported
+selections report its failure without precision fallback. For Laya FP32, pass
+`dtype: 'fp32'`.
 Cancellation terminates that client's Worker and rejects its in-flight work.
 No decisions are inserted into chat history or durable storage.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.66.0",
+  "version": "0.67.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -69,6 +69,7 @@
     "./core/preferences": "./src/core/services/preferences.mjs",
     "./core/diarization": "./src/diarization/service.mjs",
     "./core/local-ai": "./src/core/services/local-ai.mjs",
+    "./core/decisions": "./src/core/services/decisions.mjs",
     "./core/image": "./src/core/services/image.mjs",
     "./core/speech": "./src/core/services/speech.mjs",
     "./core/model-assets": "./src/core/services/model-assets.mjs",
@@ -76,6 +77,7 @@
     "./diarization/build": "./src/diarization/build.mjs",
     "./local-ai": "./src/local-ai/install.mjs",
     "./local-ai/onnx": "./src/local-ai/onnx.mjs",
+    "./local-ai/decisions": "./src/local-ai/decisions.mjs",
     "./local-ai/image": "./src/local-ai/image-runtime.mjs",
     "./local-ai/whisper": "./src/local-ai/whisper/index.mjs",
     "./local-ai/whisper/build": "./src/local-ai/whisper/build.mjs",
@@ -121,7 +123,7 @@
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
     "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/conversation-closing-report.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/native-windows-icon.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
-    "test:functional": "node ./bin/arcane-test.mjs test/ai-ollama-readiness.test.mjs test/core-ollama-lifecycle.test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-decisions.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/codex-app-server.test.mjs test/mcp-stdio-server.test.mjs test/core-classic-source.test.mjs test/core-client.test.mjs test/core-client-installation.test.mjs test/core-development.test.mjs test/core-host.test.mjs test/core-packaged-web.test.mjs test/core-runtime.test.mjs test/core-stdio.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/local-image-editing.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/native-module-packaging.test.mjs test/native-module-resource-references.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket-client-import-map.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
+    "test:functional": "node ./bin/arcane-test.mjs test/ai-ollama-readiness.test.mjs test/core-ollama-lifecycle.test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-decisions.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/codex-app-server.test.mjs test/mcp-stdio-server.test.mjs test/core-classic-source.test.mjs test/core-client.test.mjs test/core-client-installation.test.mjs test/core-ai-installation.test.mjs test/core-llama-lifecycle.test.mjs test/core-development.test.mjs test/core-host.test.mjs test/core-model-assets.test.mjs test/core-native-services.test.mjs test/core-packaged-web.test.mjs test/core-runtime.test.mjs test/core-stdio.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/local-image-editing.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/native-decisions.test.mjs test/native-onnx.test.mjs test/native-module-packaging.test.mjs test/native-module-resource-references.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket-client-import-map.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/installed-package-runtime.test.mjs test/root-app-layout.test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-macos-provider.test.mjs test/native-plan.test.mjs test/native-portable-provider.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
     "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/html-import-packaged-script.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
     "check": "node tools/check-source.mjs && npm test",
@@ -158,6 +160,7 @@
     "tag": "latest"
   },
   "dependencies": {
+    "@huggingface/tokenizers": "0.2.0",
     "event-pubsub": "6.1.1",
     "js-queue": "3.1.1",
     "node-http-server": "10.0.0",

package/src/core/repositories.mjs

@@ -4,7 +4,8 @@ import path from 'node:path';
 import Is from 'strong-type';
 import {ArcaneError, throwIfAborted} from '../errors.mjs';
 import {runProcess} from '../process.mjs';
-import {repositoryPull, repositoryPush, repositoryStatus} from '../repository.mjs';
+import {captureRepositoryTarget, repositoryConfiguration, repositoryPull, repositoryPush,
+    repositoryPushArguments, repositoryStatus} from '../repository.mjs';
 import {createGitIdentityRunner} from '../git-identity.mjs';
 
 export {readGitIdentity} from '../git-identity.mjs';
@@ -152,29 +153,46 @@ export function createRepositoryWorkspace(
         );
     }
 
-    function pull({signal} = {}) {
+    function configuration({signal} = {}) {
+        return accept(
+            function readRepositoryConfiguration() {
+                return repositoryConfiguration({workspaceRoot: repositoryDirectory, signal, onEvent, run: execute});
+            },
+            signal
+        );
+    }
+
+    function pull({target, signal} = {}) {
+        let selectedTarget;
+        try { selectedTarget = captureRepositoryTarget(target); }
+        catch (error) { return Promise.reject(error); }
         return accept(
             async function pullRepository() {
                 await prepare(signal);
-                return repositoryPull({workspaceRoot: repositoryDirectory, signal, onEvent, run: execute});
+                return repositoryPull({workspaceRoot: repositoryDirectory, target: selectedTarget, signal, onEvent, run: execute});
             },
             signal
         );
     }
 
-    function push({signal} = {}) {
+    function push({target, signal} = {}) {
+        let selectedTarget;
+        try { selectedTarget = captureRepositoryTarget(target); }
+        catch (error) { return Promise.reject(error); }
         return accept(
             async function pushRepository() {
                 await prepare(signal);
-                return repositoryPush({workspaceRoot: repositoryDirectory, signal, onEvent, run: execute});
+                return repositoryPush({workspaceRoot: repositoryDirectory, target: selectedTarget, signal, onEvent, run: execute});
             },
             signal
         );
     }
 
-    function write({files, message, signal} = {}) {
+    function write({files, message, target, signal} = {}) {
         let selectedFiles;
+        let selectedTarget;
         try {
+            selectedTarget = captureRepositoryTarget(target);
             requireString(message, 'message');
             if (!message.isWellFormed()) throw new TypeError('message cannot be represented completely as UTF-8 text.');
             if (!is.array(files) || files.length === 0) {
@@ -210,6 +228,7 @@ export function createRepositoryWorkspace(
             async function writeRepositoryFiles() {
                 const outcome = {
                     directory: repositoryDirectory,
+                    ...(selectedTarget === undefined ? {} : {target: {...selectedTarget}}),
                     state: 'local',
                     stage: 'prepare',
                     paths: selectedFiles.map(function selectedPath(file) { return file.path; }),
@@ -321,7 +340,7 @@ export function createRepositoryWorkspace(
                         ['--literal-pathspecs', 'commit', '--only', '--cleanup=verbatim', '--file', '-', '--', ...outcome.paths],
                         commitMessage()
                     );
-                    await executeGit('push', ['push']);
+                    await executeGit('push', repositoryPushArguments(selectedTarget));
                     outcome.stage = 'complete';
                     return outcome;
                 } catch (cause) {
@@ -357,7 +376,7 @@ export function createRepositoryWorkspace(
         return closing;
     }
 
-    return {directory: repositoryDirectory, open, status, pull, push, write, close, drain: close, dispose: close};
+    return {directory: repositoryDirectory, open, status, configuration, pull, push, write, close, drain: close, dispose: close};
 }
 
 function requireString(value, name) {

package/src/core/runtime.mjs

@@ -150,11 +150,22 @@ class CoreRuntime {
         };
     }
 
+    async getService(name) {
+        if (this.#closing) throw failure('CORE_CLOSING', 'Core is closing.');
+        const service = this.#services.get(name);
+        if (!service) throw failure('CORE_SERVICE_UNAVAILABLE', `Core service ${String(name)} is not registered.`);
+        await this.#startService(service);
+        return service.definition;
+    }
+
     #serviceContext(service) {
         const runtime = this;
         return {
             application: this.#application,
             service: service.name,
+            getService(name) {
+                return runtime.getService(name);
+            },
             emit(event, data) {
                 return runtime.emit(event, data);
             }