arcane-os 0.90.0 → 0.91.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.91.0
+
+- Persist complete native `modelAssets.prepare()` acquisitions across release,
+  unload, service disposal and process restart. Reuse the complete ordered
+  source selection from its selected store, with independent caller lifetimes,
+  cancellation and progress. Explicit `refresh: true` acquires a new complete
+  set while preserving earlier completed acquisitions and retained uses.
+- Add `packageApp({browserDecisions: true})` to acquire the upstream browser
+  decision distribution inside the package stage beside the actual selected
+  SDK module, including installed aliases and relocated routes. Both module
+  formats retain complete executables and licenses; default and dry-run
+  behavior stay unchanged. Existing workspace materialization remains supported.
+- Reuse the retained Windows host, Whisper and ONNX runtime archives; this
+  release changes shared JavaScript acquisition and packaging, not those native
+  binaries. Application adoption and native model acceptance remain separately
+  owned.
+
 ## 0.90.0
 
 - Add optional `remoteBase` to repository workspaces, Git text snapshots and

package/README.md

@@ -25,7 +25,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.88.1` SDK contract. Development applications declare
+This checkout defines the `0.91.0` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/ai/browser-decisions.md

@@ -95,14 +95,18 @@ pipeline. Existing Wllama, cloud, speech and chat APIs are unchanged.
 
 ## Extension-local executables (Manifest V3)
 
-During the application's ordinary SDK materialization, opt into the upstream
-browser distribution through the public Node API:
+When packaging the application, opt into the upstream browser distribution
+through the public Node API:
 
 ```js
-import {materializeInstalledSdkRuntime} from 'arcane-os';
+import {packageApp} from 'arcane-os';
 
-await materializeInstalledSdkRuntime({
+const release = await packageApp({
     workspaceRoot: process.cwd(),
+    appId: 'moon-dashboard',
+    outputDirectory: 'dist/extension/app',
+    moduleFormat: 'native',
+    browserPwa: false,
     browserDecisions: true
 });
 ```
@@ -111,30 +115,50 @@ This acquires the official bundled Transformers.js `4.3.0`
 `transformers.min.js`, matching ONNX Runtime
 `1.31.0-dev.20260914-8d85527a0` `ort-wasm-simd-threaded.asyncify.mjs` and
 `ort-wasm-simd-threaded.asyncify.wasm`, plus `TRANSFORMERS-LICENSE` and
-`ONNX-RUNTIME-LICENSE`. The five complete files are staged under
-`arcane/sdk/ai/decisions-runtime/` before replacing the projected runtime.
-Retain the supplied licenses with the distribution. No bundler, Node engine
-dependency tree, model graph or tokenizer is installed by this option.
-Repeat `browserDecisions: true` on each materialization that should retain
-this closure; whole-tree replacement removes files absent from a later selection.
-
-The result's `workspaceRuntime.browserDecisions` contains `directory`,
-`transformersVersion`, `onnxRuntimeVersion` and `files`. The lower-level
+`ONNX-RUNTIME-LICENSE`. The five complete files are acquired only into the
+package stage, under `decisions-runtime/` beside the selected SDK
+`ai/browser-decisions.mjs`. Installed-package routes retain their actual
+dependency path, including npm aliases: for example,
+`node_modules/arcane-os/browser-runtime/ai/decisions-runtime/` inside
+`release.outputRoot`. The installed dependency and application source remain
+unchanged; this route creates no workspace-root `arcane/` projection.
+
+Acquisition follows SDK module/asset rewriting, preserving complete upstream
+executable content and licenses unchanged. It works with both
+`moduleFormat: 'native'` and the default `'import-map'`. The returned `files`
+and release manifest include the distribution; when browser PWA generation
+is enabled, its ordinary offline include/exclude selection applies too.
+Retain the supplied licenses with the deployment. No bundler, Node engine
+dependency tree, model graph or tokenizer is installed by this option. Select
+`browserDecisions: true` on each package build that should acquire the closure.
+The default `false` and `dryRun: true` perform no optional acquisition; dry runs
+report selected input files rather than downloaded distribution files.
+
+Existing physical workspace projections retain
+`materializeInstalledSdkRuntime({workspaceRoot, browserDecisions: true})`.
+That operation stages these files under `arcane/sdk/ai/decisions-runtime/`
+before replacing the projection, returning `directory`, `transformersVersion`,
+`onnxRuntimeVersion` and `files` under `workspaceRuntime.browserDecisions`.
 `materializeWorkspaceRuntimeContent()` accepts the same option and returns
-that record directly as `result.browserDecisions`. Omission performs no
-optional network acquisition. The fixed distribution files are acquired
-concurrently, once each per selected materialization. Events
+that record as `result.browserDecisions`. Repeat the option on each projection
+refresh that should retain the closure. Installed-package applications use
+`packageApp()` above, because their routes read from the installed dependency
+rather than this separate projection.
+
+Both operations share one distribution owner. Its fixed files are acquired
+concurrently, once each per operation. Events
 `workspace.decisions.started` and `workspace.decisions.progress` expose
 `completed`/`total` file counts; each progress event also has `file` and `url`.
 Cancellation and HTTP or observer failure abort/join pending acquisition and
-preserve the prior runtime. An HTTP failure retains the complete response as
+preserve the prior package output or physical runtime. An HTTP failure retains
+the complete response as
 `error.response` (`url`, `status`, `statusText`, `headers`, `content`), including
 inside `AggregateError.errors` when several operations fail.
 
 Load from an extension-owned module script, using the deployed SDK path:
 
 ```js
-import {createBrowserDecisionModel} from './arcane/sdk/ai/browser-decisions.mjs';
+import {createBrowserDecisionModel} from './node_modules/arcane-os/browser-runtime/ai/browser-decisions.mjs';
 
 const decisions = createBrowserDecisionModel({
     family: 'laya',
@@ -147,6 +171,9 @@ const decisions = createBrowserDecisionModel({
 await decisions.load();
 ```
 
+Use the actual deployed alias path when the dependency has another name;
+physical projections instead use `./arcane/sdk/ai/browser-decisions.mjs`.
+
 For Julia-1, change the family/model to `julia` /
 `SupersonicLabs/Julia-1-ONNX` and select `dtype: 'fp32'`. Model and tokenizer
 data remain upstream resources served through the same store, preserving its

package/docs/reference/inventory/package-api.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.89.0",
+  "sdkVersion": "0.90.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
@@ -441,10 +441,10 @@
       "entrypoints": ["arcane-os/core/model-assets"],
       "primaryImport": "arcane-os/core/model-assets",
       "group": "Core model assets",
-      "summary": "Owns selected native working-file projections and engine retain handles while original stored model files remain unchanged.",
+      "summary": "Owns persistent native model acquisitions, temporary browser projections and actual engine retain lifetimes.",
       "availability": "Node Core with an application-selected working directory",
       "protocol": "arcane/1 modelAssets.open/write/complete/release/status and modelAssets.state",
-      "normalization": "Returns current/prepare/retain/release/dispose and Core service lifecycle. Explicit prepare({id,workingDirectory,members:[{path,url}],signal,onProgress}) streams complete upstream members through the existing file owner and reports file/phase progress. release(id) relinquishes preparation ownership; cancellation and cleanup join fetches/writes. Native retains survive until actual engine release before deleting only the owned working projection. Startup downloads nothing."
+      "normalization": "Returns current/prepare/retain/release/dispose and Core service lifecycle. Explicit prepare({id,workingDirectory,members:[{path,url}],signal,onProgress,refresh=false}) reuses complete exact ordered source selections stored beneath workingDirectory/model-assets or streams every selected upstream member concurrently. Complete acquisitions survive release, disposal and restart. refresh:true acquires a separate complete set without overwriting retained originals; ordinary reuse makes no network freshness claim. Matching same-process callers share acquisition with independent callbacks/cancellation, and the final interested cancellation joins unfinished I/O before removing only that attempt. Separate processes may fetch independently. release(id) relinquishes live preparation ownership; actual native retain lifetimes remain. Browser open/write/complete projections retain temporary cleanup after final native use. Startup downloads nothing; no migration, eviction or partial-transfer resumption."
     },
     {
       "id": "core-model-assets-service:default",
@@ -654,7 +654,7 @@
       "summary": "Explicit-load Laya and Julia-1 decisions with caller-selected precision, complete inputs and graph results.",
       "availability": "Browser module Workers and the selected Transformers.js backend; import/construction starts no model load",
       "protocol": "Caller-owned state/question/options rows; five-input decision graph; native Worker request/result lifecycle",
-      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged. Optional existing SDK store routes actual loader resources through fetchResource outside cloned Worker configuration. By default stored activation also materializes the unchanged runtime entry as a JavaScript object URL, retains its configured URL for later loads and revokes the object URL after Worker termination. Explicit runtime.local:true instead imports same-deployment moduleUrl and wasmPaths.mjs/wasm directly, defaulting to ai/decisions-runtime installed by browserDecisions:true materialization; only those exact executable URLs bypass the model store. It disables upstream executable WASM caching/proxy and selects one WASM thread, preserving the requested inference backend. Stored mode disables competing model caches, preserves complete HTTP responses and joins resource cleanup before outstanding calls settle. Default runtime-entry HTTP failures retain error.response; custom stored entries must support an object URL and changed import.meta.url. Omission retains existing browser behavior; no decision-result persistence or precision fallback"
+      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged. Optional existing SDK store routes actual loader resources through fetchResource outside cloned Worker configuration. By default stored activation also materializes the unchanged runtime entry as a JavaScript object URL, retains its configured URL for later loads and revokes the object URL after Worker termination. Explicit runtime.local:true instead imports same-deployment moduleUrl and wasmPaths.mjs/wasm directly, defaulting to adjacent ai/decisions-runtime acquired by packageApp({browserDecisions:true}) for installed-package routes or by the existing physical materializer option; only those exact executable URLs bypass the model store. It disables upstream executable WASM caching/proxy and selects one WASM thread, preserving the requested inference backend. Stored mode disables competing model caches, preserves complete HTTP responses and joins resource cleanup before outstanding calls settle. Default runtime-entry HTTP failures retain error.response; custom stored entries must support an object URL and changed import.meta.url. Omission retains existing browser behavior; no decision-result persistence or precision fallback"
     },
     {
       "id": "root:acceptWebSocket",
@@ -1858,7 +1858,7 @@
       "summary": "Builds one complete app release with browser selection by default. Nonbrowser targets add explicit nativeResources through a late complete-content copy and separate native input output; moduleFormat is independent. Adapters receive actual target and effective browserPwa. Explicit operation outputDirectory wins; staged replacement preserves source and unrelated outputs. No tests or checks run automatically.",
       "availability": "Node",
       "protocol": "SDK packager and deterministic bundle contract",
-      "normalization": "Normalized SDK validation with complete canonical archive and release content"
+      "normalization": "Complete selected release content. Optional browserDecisions:true acquires bundled Transformers.js 4.3.0 and matched ONNX Runtime 1.31.0-dev.20260914-8d85527a0 asyncify module/WASM plus licenses beside the selected SDK browser-decisions module in staging only, following installed routes and aliases. Acquisition follows native-module and asset rewriting, preserves complete upstream content, and joins the final release inventory and enabled PWA offline selection. Default false and dryRun perform no optional acquisition. Existing workspace.decisions started/progress events, cancellation, full HTTP errors and joined failure cleanup are preserved; prior output, source and installed dependencies remain unchanged on acquisition failure. Repeat the option per selected package build."
     },
     {
       "id": "root:packageApplication",

package/docs/reference/model-assets.md

@@ -1,4 +1,4 @@
-# Native working files from model assets
+# Native model acquisitions and working projections
 
 Browser preparation and native retain/release ownership were first published in `arcane-os@0.61.0`. Browser
 preparation is exported by `arcane-os/ai/core-model-assets`, and the native
@@ -110,29 +110,65 @@ try {
 }
 ```
 
-`prepare({id,workingDirectory,members,signal,onProgress})` performs standard
-fetches only when explicitly called. Every member has its original relative
-`path` and selected `url`; the caller supplies the complete companion-file set.
-Independent members download concurrently. Each complete response stream is
-written directly through the existing ordered native file owner, without a
-whole-model buffer or base64 conversion. No model or runtime is selected or
-downloaded by service startup. The result is the ready projection snapshot with
-ordered `members: [{path,nativePath}]`.
+`prepare({id,workingDirectory,members,signal,onProgress,refresh=false})` reuses
+a complete native acquisition or fetches the explicitly selected members.
+Every member has its original relative `path` and selected `url`; the caller
+supplies the complete companion-file set. Independent members download
+concurrently. Each complete response stream is written directly to its native
+file, without a whole-model buffer or base64 conversion. No model or runtime
+is selected or downloaded by service startup. The result remains the ready
+projection snapshot with ordered `members: [{path,nativePath}]`.
 
-Progress uses `open`, `download`, `complete` and `ready` phases, with
+Complete acquisitions persist under `workingDirectory/model-assets/` across
+release, native unload, service disposal and process restart. Relative working
+directories resolve from `appRoot`. Reuse matches the entire ordered
+`[{path,url}]` selection in that actual store; the operation `id` is a separate
+live lifetime, not the stored selection. Different URLs, relative paths, member
+order or stores select separate acquisitions. Original member names and content
+stay unchanged, and native engines use those files directly. Model, revision,
+precision and device choices remain with their existing owners.
+
+Ordinary preparation performs no network freshness check for a completed
+selection. To acquire a mutable source again, explicitly pass `refresh:true` to
+this native `prepare` method. Refresh fetches a new complete set in its own
+directory and keeps earlier complete acquisitions and retained engine uses
+untouched. Later ordinary preparations reuse the newer completed selection.
+A failed refresh leaves the earlier completed acquisition available. Refresh
+does not change the selected URLs or imply upstream revision discovery.
+
+Progress uses `open`, `download`, `complete`, `reuse` and `ready` phases, with
 `completed`, `total` and `unit:'files'`; member progress additionally includes
 `memberIndex` and `path`. Progress callbacks may return a promise, which the
-preparation observes. They must not await cleanup of the preparation currently
-calling them. Callback failures remain preparation failures. HTTP failures
+preparation observes in order. Each caller owns its callbacks; a slow or failed
+callback does not hold another caller's transfer or result. Callbacks must not
+await cleanup of the preparation currently calling them. Callback failures
+reject that caller's preparation. HTTP failures
 retain `url`, `status` and the complete response text in `response`.
 
 `release(id)` relinquishes preparation ownership without a request signal.
-For active native downloads, release or disposal aborts their fetches and joins
-the transfer tasks and native writes before deleting only their owned child
-directory. Preparation cancellation and failure follow that same cleanup path;
-the original failures and cleanup failures remain observable. A native retain
-handle continues to protect completed files through actual engine release.
-Native preparation leaves browser DBOPFS originals and unrelated files alone.
+Same-process callers sharing the actual store, complete source selection and
+refresh mode share an acquisition, including across service instances. They
+keep independent operation IDs, retain handles, cancellation and callbacks.
+Cancelling, releasing or disposing one interested caller leaves the others
+running. The final interested caller aborts the acquisition and joins its
+streams, writes and closes before removing only its unfinished attempt. Original
+failures and cleanup failures remain observable. A completed acquisition stays
+available even if a caller cancels or its callback fails after completion.
+
+The service records completion only after every selected response and file
+close finishes. That record is ordinary cache state describing the selected
+sources and completed acquisition. A missing original member requires another
+complete acquisition. Failed attempts are removed after their owned I/O drains;
+there is no partial-transfer resumption. An abruptly interrupted process can
+leave an unfinished directory, which later calls ignore without sweeping it.
+There is no automatic migration, eviction or removal of completed acquisitions.
+
+Independent processes use disjoint attempt directories and may fetch the same
+selection concurrently. They do not overwrite each other's files or coordinate
+a cross-process acquisition lock. Concurrent completions can produce multiple
+reusable sets; either complete result may be selected when their completion
+order ties. Applications may retain their existing shared Core owner without
+introducing an additional host or application-local cache copy.
 
 ```javascript
 import {createModelAssetService} from 'arcane-os/core/model-assets';
@@ -158,15 +194,18 @@ release. Multiple contexts can retain one prepared set, and repeated inference
 on a retained context reuses its files.
 
 The browser's `projection.release()` relinquishes preparation ownership. It
-does not delete files retained by a native engine. Deletion follows the final
-native release and removes only that operation's working directory. Core closes
-independent services concurrently, so the model-assets service waits for all
-native retain handles during disposal instead of assuming service order.
-Owners must release their handles after joining their actual engine lifetime.
+does not delete files retained by a native engine. For browser `open`/`write`/
+`complete` projections, deletion follows the final native release and removes
+only that operation's temporary working directory; DBOPFS originals remain
+untouched. Native `prepare` acquisitions remain stored after their final use.
+Core closes independent services concurrently, so the model-assets service
+waits for all native retain handles during disposal instead of assuming service
+order. Owners must release their handles after joining their actual engine
+lifetime.
 
 Closing a browser accessor does not by itself establish native unload.
 Explicitly release unused prepared projections. Core disposal also releases
-preparation ownership and cleans up after retained engine uses end.
+preparation ownership and ends the live records after retained engine uses end.
 
 ### Native Laya decisions
 

package/docs/reference/native-decisions.md

@@ -179,10 +179,25 @@ create a fresh projection from the stored originals before loading again.
 ## Existing upstream preparation
 
 `model` selects the upstream Hugging Face repository and `revision` its
-revision. Native preparation performs normal upstream fetches only during
-explicit `load()`. It streams complete members through the existing working
-file owner; it neither vendors the weights nor creates a second persistent
-model store. The approved `@huggingface/tokenizers@0.2.0` dependency reads the
+revision. On explicit `load()`, the existing model-assets owner reuses complete
+native acquisitions under the selected `workingDirectory/model-assets/`, or
+fetches the complete selected members concurrently when absent. Complete
+acquisitions survive unload, disposal and application restart. Reuse matches
+the entire ordered original path/URL selection; it never substitutes another
+model, revision, precision or device. Supplied projections and caller-owned
+`paths` retain their existing precedence and lifecycle.
+
+Ordinary preparation reuses the selected URLs without checking whether mutable
+upstream content changed. Explicit reacquisition is available through native
+[`modelAssets.prepare({refresh:true,...})`](model-assets.md#native-ownership),
+whose ready projection can be supplied through the existing
+`assetProjectionId`/`resourcePaths` contract. It preserves earlier complete
+acquisitions and active native retains. Incomplete attempts are not reused or
+resumed; separate processes may perform duplicate acquisitions in disjoint
+directories. The shared model-assets owner handles storage without an
+application-local cache copy or a second model store.
+
+The approved `@huggingface/tokenizers@0.2.0` dependency reads the
 selected tokenizer files in its Worker. No Transformers or second ONNX runtime
 is loaded by this API.
 

package/docs/reference/sdk-api.md

@@ -1044,6 +1044,25 @@ ordinary browser output remain unchanged. See
 [native-module package output](protocols.md#native-module-package-output)
 for resource handling and the static transformation boundary.
 
+`browserDecisions` defaults to `false`. Explicit `browserDecisions: true`
+acquires the bundled Transformers.js 4.3.0 entry, matching ONNX Runtime
+1.31.0-dev.20260914-8d85527a0 asyncify module/WASM and both licenses into
+the package stage beside the selected SDK `ai/browser-decisions.mjs`, under
+`decisions-runtime/`. Installed-package routes retain their configured
+dependency path, including aliases; source and installed dependencies remain
+unchanged, with no workspace-root `arcane/` projection. The selected SDK decision
+module must be included in the package. Acquisition happens after native-module
+and asset rewriting, preserving upstream content unchanged in both module
+formats. The distribution joins the returned and release-manifest inventories
+and any enabled PWA's ordinary offline selection. The default and dry runs
+perform no optional acquisition; dry runs report selected inputs. Repeat this
+option on each package build that should acquire the closure. Cancellation and
+HTTP or observer failures abort/join acquisition before stage cleanup and
+preserve previous output. The existing `workspace.decisions.started` and
+`workspace.decisions.progress` events report file progress. See the
+[extension-local decision guide](ai/browser-decisions.md#extension-local-executables-manifest-v3)
+for `runtime.local: true`, upstream versions and complete error details.
+
 An operation may override `outputDirectory` without changing the saved app
 configuration. For example, package a complete application beneath an
 application-owned extension manifest and launcher:
@@ -1875,6 +1894,11 @@ module/WASM and license files from their upstream distributions into
 `transformersVersion`, `onnxRuntimeVersion` and `files` under
 `workspaceRuntime.browserDecisions`. The default `false` performs no optional
 acquisition. Select this option on each refresh that should retain those files.
+For applications with installed-package routes, use
+`packageApp({workspaceRoot, appId, browserDecisions: true})` to place the
+distribution beside the actual deployed SDK module. This physical materializer
+continues to own only the separate `arcane/` projection; it does not populate or
+modify `node_modules`.
 The [extension-local decision guide](ai/browser-decisions.md#extension-local-executables-manifest-v3)
 describes `runtime.local: true`, complete resource ownership and MV3 usage.
 
@@ -9012,14 +9036,22 @@ directory and complete member files.
 
 `current()` returns `{closing,projections}`. `retain(id)` accepts a completed
 projection and returns `{id,directory,members,release}` for a native owner.
-Native `prepare({id,workingDirectory,members,signal,onProgress})` accepts
-ordered `{path,url}` members and returns their ready projection. Explicit calls
-stream complete upstream responses through the same file owner; startup
-downloads nothing. Independent members transfer concurrently and progress
-reports phases and completed files. `release(id)` relinquishes preparation
-ownership; cancellation, release and disposal join fetches and writes before
-cleanup. Native retain handles keep completed files alive until actual engine
-release. See [native preparation](model-assets.md#native-ownership).
+Native `prepare({id,workingDirectory,members,signal,onProgress,refresh=false})`
+accepts ordered `{path,url}` members and returns their ready projection.
+Complete native acquisitions persist beneath `workingDirectory/model-assets/`
+through unload, disposal and restart; ordinary calls reuse the exact complete
+ordered source selection without a network freshness check. Explicit
+`refresh:true` acquires a separate complete set without replacing active files.
+Independent members transfer concurrently and progress reports phases and
+completed files. Matching same-process preparations share acquisition with
+independent callbacks and cancellation; the last interested cancellation joins
+unfinished I/O and removes only that attempt. Separate processes may acquire
+the same selection independently. Startup downloads nothing.
+`release(id)` relinquishes live preparation ownership. Native retains continue
+through actual engine release; completed native acquisitions remain stored.
+Browser `open/write/complete` projections retain their temporary lifetime and
+are removed only after all native uses end. See
+[native preparation](model-assets.md#native-ownership).
 `dispose()` releases preparation ownership and joins file writes, closes and
 all native retain lifetimes before cleanup. The native owner releases its
 handle only after its actual context/worker use ends. Original stored model
@@ -10146,7 +10178,9 @@ Cancellation terminates that client's Worker and rejects its in-flight work.
 No decisions are inserted into chat history or durable storage.
 
 For explicitly selected extension-local execution, supply `runtime: {local:
-true}` after materializing with `browserDecisions: true`. The SDK directly
+true}` after `packageApp({workspaceRoot, appId, browserDecisions: true})` for
+installed-package routes, or after opting into the existing physical runtime
+materializer. The SDK directly
 imports its deployment-local `decisions-runtime/transformers.min.js` and
 matched asyncify module/WASM. Explicit `runtime.moduleUrl` and
 `runtime.wasmPaths: {mjs, wasm}` may select other compatible files in that same

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.90.0",
+  "version": "0.91.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/browser-decisions-distribution.mjs

@@ -0,0 +1,95 @@
+import Is from 'strong-type';
+import {mkdir, writeFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const is = new Is(false);
+
+function throwIfAborted(signal) {
+    if (!signal?.aborted) return;
+    const error = signal.reason instanceof Error ? signal.reason : new Error('Operation cancelled.');
+    error.code = error.code || 'ARCANE_CANCELLED';
+    throw error;
+}
+
+async function emit(onEvent, event) {
+    if (is.function(onEvent)) await onEvent(event);
+}
+
+export async function materializeBrowserDecisions(destination, signal, onEvent) {
+    const transformers = 'https://cdn.jsdelivr.net/npm/@huggingface/transformers@4.3.0/';
+    const onnx = 'https://cdn.jsdelivr.net/npm/onnxruntime-web@1.31.0-dev.20260914-8d85527a0/';
+    const files = [
+        {name: 'transformers.min.js', url: `${transformers}dist/transformers.min.js`},
+        {name: 'ort-wasm-simd-threaded.asyncify.mjs', url: `${onnx}dist/ort-wasm-simd-threaded.asyncify.mjs`},
+        {name: 'ort-wasm-simd-threaded.asyncify.wasm', url: `${onnx}dist/ort-wasm-simd-threaded.asyncify.wasm`},
+        {name: 'TRANSFORMERS-LICENSE', url: `${transformers}LICENSE`},
+        {name: 'ONNX-RUNTIME-LICENSE', url: `${onnx}LICENSE`}
+    ];
+    const controller = new AbortController();
+    function cancelDistribution() {
+        controller.abort(signal.reason);
+    }
+    signal?.addEventListener('abort', cancelDistribution, {once: true});
+    if (signal?.aborted) cancelDistribution();
+    let completed = 0;
+    try {
+        throwIfAborted(controller.signal);
+        await emit(
+            onEvent,
+            {type: 'workspace.decisions.started', completed, total: files.length}
+        );
+        throwIfAborted(controller.signal);
+        await mkdir(destination, {recursive: true});
+        async function acquireDistributionFile(file) {
+            try {
+                throwIfAborted(controller.signal);
+                const response = await fetch(file.url, {signal: controller.signal});
+                const content = new Uint8Array(await response.arrayBuffer());
+                if (!response.ok) {
+                    const error = new Error(`Browser decision distribution returned HTTP ${response.status} ${response.statusText}.`);
+                    error.code = 'ARCANE_DECISION_DISTRIBUTION_DOWNLOAD_FAILED';
+                    error.response = {
+                        url: response.url,
+                        status: response.status,
+                        statusText: response.statusText,
+                        headers: [...response.headers],
+                        content
+                    };
+                    throw error;
+                }
+                throwIfAborted(controller.signal);
+                // Upstream distribution content is opaque, including its own
+                // imports and license text. No SDK source rewriting applies.
+                await writeFile(path.join(destination, file.name), content);
+                throwIfAborted(controller.signal);
+                completed += 1;
+                await emit(
+                    onEvent,
+                    {type: 'workspace.decisions.progress', file: file.name, url: file.url, completed, total: files.length}
+                );
+            } catch (error) {
+                controller.abort(error);
+                throw error;
+            }
+        }
+        // One fixed distribution, acquired once for the selected projection or
+        // package; no model/app/architecture multiplier or installation script.
+        const outcomes = await Promise.allSettled(files.map(acquireDistributionFile));
+        const failures = new Set();
+        for (const outcome of outcomes) {
+            if (outcome.status === 'rejected') failures.add(outcome.reason);
+        }
+        if (failures.size === 1) throw [...failures][0];
+        if (failures.size > 1) {
+            throw new AggregateError([...failures], 'Browser decision distribution acquisition failed.');
+        }
+        throwIfAborted(controller.signal);
+    } finally {
+        signal?.removeEventListener('abort', cancelDistribution);
+    }
+    return {
+        transformersVersion: '4.3.0',
+        onnxRuntimeVersion: '1.31.0-dev.20260914-8d85527a0',
+        files: files.map(function distributionFilename(file) { return file.name; })
+    };
+}

package/src/core/services/model-assets.mjs

@@ -1,16 +1,231 @@
-import {mkdir, mkdtemp, open, rm} from 'node:fs/promises';
+import {mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, writeFile} from 'node:fs/promises';
 import {Buffer} from 'node:buffer';
 import path from 'node:path';
 import Is from 'strong-type';
 import {CoreError, serializeCoreError} from '../../../browser-runtime/core/contracts.mjs';
 
 const is = new Is(false);
+const nativeAcquisitions = new Map();
+let nativeAcquisitionOrder = 0;
 
 function failure(code, message) {
     return new CoreError({code, message});
 }
 
-/** Working files for native engines. Caller-selected source assets stay authoritative. */
+function memberLocation(directory, member) {
+    const nativePath = path.resolve(directory, member.path);
+    const relative = path.relative(directory, nativePath);
+    if (path.isAbsolute(member.path) || !relative || relative === '..'
+        || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new TypeError('Model asset member paths must be relative files within their projection.');
+    }
+    return {path: member.path, nativePath};
+}
+
+function sameMembers(left, right) {
+    return is.array(left) && left.length === right.length
+        && left.every(function sameMember(member, index) {
+            return member.path === right[index].path && member.url === right[index].url;
+        });
+}
+
+async function storedAcquisition(directory, members, signal) {
+    let latest;
+    for (const entry of await readdir(directory, {withFileTypes: true})) {
+        signal.throwIfAborted();
+        if (!entry.isDirectory() || !entry.name.startsWith('acquisition-')) continue;
+        const root = path.join(directory, entry.name);
+        let selected;
+        try { selected = JSON.parse(await readFile(path.join(root, 'acquisition.json'), {encoding: 'utf8', signal})); }
+        catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+        if (!sameMembers(selected.members, members)) continue;
+        nativeAcquisitionOrder = Math.max(nativeAcquisitionOrder, selected.order);
+        const files = path.join(root, 'files');
+        const locations = members.map(function originalLocation(member) { return memberLocation(files, member); });
+        let available = true;
+        for (const member of locations) {
+            signal.throwIfAborted();
+            try { if (!(await stat(member.nativePath)).isFile()) available = false; }
+            catch (error) { if (error.code !== 'ENOENT') throw error; available = false; }
+        }
+        if (available && (!latest || selected.order > latest.order
+            || (selected.order === latest.order && entry.name > latest.name))) {
+            latest = {name: entry.name, order: selected.order, directory: files, members: locations};
+        }
+    }
+    return latest ? {directory: latest.directory, members: latest.members} : null;
+}
+
+async function acquireNativeMembers(entry) {
+    const {directory, members, controller} = entry;
+    const {signal} = controller;
+    let attempt;
+    let completed = 0;
+    let committed = false;
+    let firstFailure;
+    function progress(phase, memberIndex) {
+        entry.publish({phase, completed, total: members.length, unit: 'files',
+            ...(memberIndex === undefined ? {} : {memberIndex, path: members[memberIndex].path})});
+    }
+    try {
+        signal.throwIfAborted();
+        const stored = await storedAcquisition(directory, members, signal);
+        if (stored && !entry.refresh) {
+            entry.location = stored;
+            completed = members.length;
+            progress('reuse');
+            progress('ready');
+            return stored;
+        }
+        signal.throwIfAborted();
+        attempt = await mkdtemp(path.join(directory, 'acquisition-'));
+        const files = path.join(attempt, 'files');
+        await mkdir(files);
+        entry.location = {directory: files, members: members.map(function selectedMember(member) { return memberLocation(files, member); })};
+        progress('open');
+        const results = await Promise.allSettled(members.map(async function downloadMember(member, memberIndex) {
+            let handle;
+            let response;
+            let downloadError;
+            const failures = [];
+            let bodyOwned = false;
+            try {
+                signal.throwIfAborted();
+                const nativePath = entry.location.members[memberIndex].nativePath;
+                await mkdir(path.dirname(nativePath), {recursive: true});
+                handle = await open(nativePath, 'wx');
+                signal.throwIfAborted();
+                progress('download', memberIndex);
+                response = await fetch(member.url, {signal});
+                if (!response.ok) {
+                    const error = failure('MODEL_ASSET_DOWNLOAD_FAILED', `Model asset request failed: ${response.status} ${response.statusText}`);
+                    error.url = member.url;
+                    error.status = response.status;
+                    error.response = await response.text();
+                    throw error;
+                }
+                if (!response.body) throw failure('MODEL_ASSET_DOWNLOAD_FAILED', `Model asset response has no content stream: ${member.url}`);
+                bodyOwned = true;
+                for await (const content of response.body) {
+                    signal.throwIfAborted();
+                    await handle.appendFile(content);
+                    progress('download', memberIndex);
+                }
+                signal.throwIfAborted();
+            } catch (error) {
+                downloadError = error;
+                failures.push(error);
+                firstFailure ??= error;
+                controller.abort(error);
+            }
+            if (response?.body && !bodyOwned && !response.bodyUsed && !response.body.locked) {
+                try { await response.body.cancel(downloadError); } catch (error) { if (error !== downloadError) failures.push(error); }
+            }
+            if (handle) {
+                try { await handle.close(); } catch (error) { failures.push(error); }
+            }
+            if (failures.length) {
+                const error = failures.length === 1 ? failures[0] : new AggregateError(failures, 'Downloading a model member and closing its resources failed.');
+                firstFailure ??= error;
+                controller.abort(error);
+                throw error;
+            }
+            completed += 1;
+            progress('download', memberIndex);
+        }));
+        const failures = results.filter(function rejected(result) { return result.status === 'rejected'; })
+            .map(function reason(result) { return result.reason; });
+        if (failures.length > 1) throw new AggregateError(failures, 'Downloading model asset members failed.', {cause: firstFailure});
+        if (failures.length) throw failures[0];
+        signal.throwIfAborted();
+        progress('complete');
+        // The record describes a completed acquisition, not content identity.
+        // Publish it after every stream and file close, leaving older entries alone.
+        const pending = path.join(attempt, 'acquisition.pending.json');
+        await writeFile(pending, JSON.stringify({members, order: ++nativeAcquisitionOrder}), {encoding: 'utf8', flag: 'wx', signal});
+        signal.throwIfAborted();
+        await rename(pending, path.join(attempt, 'acquisition.json'));
+        committed = true;
+        progress('ready');
+        return entry.location;
+    } catch (error) {
+        if (attempt && !committed) {
+            try { await rm(attempt, {recursive: true}); }
+            catch (cleanupError) { throw new AggregateError([error, cleanupError], 'Preparing native model assets failed and cleanup failed.'); }
+        }
+        throw error;
+    }
+}
+
+function shareNativeAcquisition({directory, members, refresh, signal, onProgress}) {
+    signal.throwIfAborted();
+    const key = JSON.stringify([directory, members, refresh]);
+    let entry = nativeAcquisitions.get(key);
+    if (entry?.controller.signal.aborted) {
+        return entry.task.catch(function observeRetiringAcquisition() {}).then(function acquireAfterDrain() {
+            return shareNativeAcquisition({directory, members, refresh, signal, onProgress});
+        });
+    }
+    if (!entry) {
+        entry = {directory, members, refresh, controller: new AbortController(), consumers: new Set(), task: null, location: null, progress: null};
+        nativeAcquisitions.set(key, entry);
+        entry.publish = function publishProgress(progress) {
+            entry.progress = progress;
+            for (const consumer of entry.consumers) consumer.progress(progress);
+        };
+    }
+    const acquisition = entry;
+    return new Promise(function observeAcquisition(resolve, reject) {
+        let settled = false;
+        let cancelled;
+        let observer = Promise.resolve();
+        const consumer = {progress};
+        function finish(failed, error, location) {
+            if (settled) return;
+            settled = true;
+            signal.removeEventListener('abort', abort);
+            acquisition.consumers.delete(consumer);
+            if (consumer.cancelled && failed && error !== cancelled) {
+                reject(new AggregateError([cancelled, error], 'Native model acquisition cancellation and cleanup failed.', {cause: cancelled}));
+            } else if (consumer.cancelled) reject(cancelled);
+            else if (failed) reject(error);
+            else resolve(location);
+        }
+        function cancel(error) {
+            if (settled || consumer.cancelled) return;
+            cancelled = error;
+            consumer.cancelled = true;
+            const others = [...acquisition.consumers].some(function interested(other) { return other !== consumer && !other.cancelled; });
+            if (others) observer.then(function cancelledObserverSettled() { finish(true, error); });
+            else acquisition.controller.abort(error);
+        }
+        function abort() { cancel(signal.reason); }
+        function progress(value) {
+            const notification = {...value};
+            // Each subscriber owns its ordered observers. A slow or failing
+            // observer never holds another subscriber's transfer or result.
+            observer = observer.then(async function observeProgress() {
+                if (!consumer.cancelled && !settled) await onProgress?.(notification, acquisition.location);
+            }).catch(cancel);
+        }
+        acquisition.consumers.add(consumer);
+        signal.addEventListener('abort', abort, {once: true});
+        if (acquisition.progress) progress(acquisition.progress);
+        if (signal.aborted) abort();
+        if (!acquisition.task) {
+            acquisition.task = Promise.resolve().then(function acquireSelectedMembers() { return acquireNativeMembers(acquisition); });
+            function releaseAcquisition() { if (nativeAcquisitions.get(key) === acquisition) nativeAcquisitions.delete(key); }
+            acquisition.task.then(releaseAcquisition, releaseAcquisition);
+        }
+        acquisition.task.then(function completed(location) {
+            observer.then(function observersCompleted() { finish(false, null, location); });
+        }, function failed(error) {
+            observer.then(function observersCompleted() { finish(true, error); });
+        });
+    });
+}
+
+/** Temporary browser projections and persistent selected native acquisitions. */
 export function createModelAssetService({appRoot = process.cwd()} = {}) {
     const projections = new Map();
     let context;
@@ -66,7 +281,7 @@ export function createModelAssetService({appRoot = process.cwd()} = {}) {
             try { await record.downloading; } catch (error) { record.error ??= error; }
             try { await record.finishing; } catch (error) { record.error ??= error; }
             try { await closeMembers(record); filesClosed = true; } catch (error) { errors.push(error); }
-            if (record.directory && filesClosed) {
+            if (record.directory && filesClosed && !record.persistent) {
                 try { await rm(record.directory, {recursive: true}); }
                 catch (error) { if (error.code !== 'ENOENT') errors.push(error); }
             }
@@ -107,8 +322,8 @@ export function createModelAssetService({appRoot = process.cwd()} = {}) {
         throw error;
     }
 
-    async function openProjection({id, workingDirectory, members}, request) {
-        request.signal.throwIfAborted();
+    function beginProjection({id, workingDirectory, members}, signal) {
+        signal.throwIfAborted();
         if (closing) throw failure('MODEL_ASSETS_CLOSING', 'Model asset preparation is closing.');
         if (!is.string(id) || !id) throw new TypeError('A model asset projection needs an operation id.');
         if (!is.string(workingDirectory) || !workingDirectory) {
@@ -126,21 +341,20 @@ export function createModelAssetService({appRoot = process.cwd()} = {}) {
         });
         record.released.catch(function observeReleaseFailure() {});
         projections.set(id, record);
+        return record;
+    }
+
+    async function openProjection({id, workingDirectory, members}, request) {
+        const record = beginProjection({id, workingDirectory, members}, request.signal);
         record.opening = Promise.resolve().then(async function createWorkingFiles() {
             const selectedDirectory = path.resolve(appRoot, workingDirectory);
             await mkdir(selectedDirectory, {recursive: true});
             request.signal.throwIfAborted();
             record.directory = await mkdtemp(path.join(selectedDirectory, 'arcane-model-'));
             record.members = members.map(function memberRecord(member) {
-                const nativePath = path.resolve(record.directory, member.path);
-                const relative = path.relative(record.directory, nativePath);
                 // A projection consists of files under its one owned directory.
                 // Absolute or escaping members cannot participate in that lifetime.
-                if (path.isAbsolute(member.path) || !relative || relative === '..'
-                    || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-                    throw new TypeError('Model asset member paths must be relative files within their projection.');
-                }
-                return {path: member.path, nativePath, handle: null, tail: Promise.resolve()};
+                return {...memberLocation(record.directory, member), handle: null, tail: Promise.resolve()};
             });
             const results = await Promise.allSettled(record.members.map(async function createMember(member) {
                 request.signal.throwIfAborted();
@@ -189,78 +403,44 @@ export function createModelAssetService({appRoot = process.cwd()} = {}) {
         return task;
     }
 
-    async function prepare({id, workingDirectory, members, signal, onProgress} = {}) {
+    async function prepare({id, workingDirectory, members, signal, onProgress, refresh = false} = {}) {
         const controller = new AbortController();
         const operationSignal = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
-        const request = {signal: operationSignal};
-        let record;
-        let completed = 0;
-        let firstFailure;
-
-        async function progress(phase, memberIndex) {
+        const record = beginProjection({id, workingDirectory, members}, operationSignal);
+        let selectedMembers;
+        try { selectedMembers = members.map(function selectedMember(member) { return {path: member.path, url: member.url}; }); }
+        catch (error) { return failedOperation(record, error); }
+        record.persistent = true;
+        record.downloadController = controller;
+        // This task owns only acquisition. Failure cleanup may join it without
+        // recursively waiting for the preparation promise that requests cleanup.
+        record.downloading = Promise.resolve().then(async function prepareNativeFiles() {
             operationSignal.throwIfAborted();
-            await onProgress?.({
-                phase, completed, total: members.length, unit: 'files',
-                ...(memberIndex === undefined ? {} : {memberIndex, path: members[memberIndex].path})
-            });
+            const selectedDirectory = path.join(path.resolve(appRoot, workingDirectory), 'model-assets');
+            await mkdir(selectedDirectory, {recursive: true});
+            const directory = await realpath(selectedDirectory);
             operationSignal.throwIfAborted();
-        }
-
-        async function downloadMember(member, memberIndex) {
-            try {
-                await progress('download', memberIndex);
-                const response = await fetch(member.url, {signal: operationSignal});
-                if (!response.ok) {
-                    const error = failure('MODEL_ASSET_DOWNLOAD_FAILED', `Model asset request failed: ${response.status} ${response.statusText}`);
-                    error.url = member.url;
-                    error.status = response.status;
-                    error.response = await response.text();
-                    throw error;
-                }
-                if (!response.body) throw failure('MODEL_ASSET_DOWNLOAD_FAILED', `Model asset response has no content stream: ${member.url}`);
-                for await (const content of response.body) {
-                    operationSignal.throwIfAborted();
-                    await appendMemberContent(record, record.members[memberIndex], content, operationSignal);
-                    await progress('download', memberIndex);
-                }
-                completed += 1;
-                await progress('download', memberIndex);
-            } catch (error) {
-                firstFailure ??= error;
-                controller.abort(error);
-                throw error;
-            }
-        }
-
+            return shareNativeAcquisition({directory, members: selectedMembers, refresh: refresh === true, signal: operationSignal,
+                async onProgress(value, location) {
+                    if (location) {
+                        record.directory = location.directory;
+                        record.members = location.members;
+                    }
+                    await onProgress?.(value);
+                }});
+        });
+        publish(record);
         try {
-            await openProjection({id, workingDirectory, members}, request);
-            record = requireProjection(id);
+            const location = await record.downloading;
             operationSignal.throwIfAborted();
-            if (!record.preparationOwned || closing) {
-                throw failure('MODEL_ASSET_PROJECTION_RELEASED', 'Model asset preparation was released.');
-            }
-            record.downloadController = controller;
-            // Cleanup joins this transfer-only task. Its rejection handler below
-            // may release preparation without waiting on itself.
-            record.downloading = Promise.resolve().then(async function downloadMembers() {
-                await progress('open');
-                const results = await Promise.allSettled(members.map(downloadMember));
-                const errors = results.filter(function rejected(result) { return result.status === 'rejected'; })
-                    .map(function reason(result) { return result.reason; });
-                if (errors.length > 1) {
-                    throw new AggregateError(errors, 'Downloading model asset members failed.', {cause: firstFailure});
-                }
-                if (errors.length) throw errors[0];
-            });
-            await record.downloading;
-            await progress('complete');
-            const projection = await completeProjection({id}, request);
-            await progress('ready');
-            return projection;
+            record.directory = location.directory;
+            record.members = location.members;
+            record.state = 'ready';
+            publish(record);
+            return snapshot(record);
         } catch (error) {
             controller.abort(error);
-            if (record) return failedOperation(record, error);
-            throw error;
+            return failedOperation(record, error);
         }
     }
 

package/src/packager/core.mjs

@@ -13,6 +13,7 @@ import {
 import path from 'node:path';
 import {pathToFileURL} from 'node:url';
 import {appRelativeRoot,resolveAppRoot,resolvePackageOutputRoot} from '../app-layout.mjs';
+import {materializeBrowserDecisions} from '../browser-decisions-distribution.mjs';
 import {TARGET_IDS} from '../constants.mjs';
 import {normalizeLocalAIConfig} from '../local-ai/config.mjs';
 import {readInstalledSdkLayout} from '../sdk-runtime-layout.mjs';
@@ -904,7 +905,8 @@ async function replaceDirectory(stagingRoot,outputRoot){
 }
 
 async function packageWithContext(context,options={}){
-    const {signal,onEvent,moduleFormat='import-map',browserPwa:requestedBrowserPwa=true}=options;
+    const {signal,onEvent,moduleFormat='import-map',browserPwa:requestedBrowserPwa=true,browserDecisions=false}=options;
+    if (!is.boolean(browserDecisions)) throw new TypeError('packageApp browserDecisions must be a boolean.');
     const browserPwa=context.target==='browser'&&requestedBrowserPwa;
     if(!['import-map','native'].includes(moduleFormat)){
         throw new TypeError('packageApp moduleFormat must be "import-map" or "native".');
@@ -1151,7 +1153,32 @@ async function packageWithContext(context,options={}){
         if(!files.some(file=>pathKey(file)===pathKey(entryPath))){
             fail(`Package output is missing its entry file: ${context.config.entry}.`);
         }
-        const installed=pwaEnabled?await readInstalledSdkLayout(context.workspaceRoot,context.rootConfig):null;
+        const installed=pwaEnabled||browserDecisions
+            ?await readInstalledSdkLayout(context.workspaceRoot,context.rootConfig):null;
+        if (browserDecisions) {
+            const moduleSource = installed
+                ? path.join(installed.packageRoot, 'browser-runtime', 'ai', 'browser-decisions.mjs')
+                : path.join(context.workspaceRoot, 'arcane', 'sdk', 'ai', 'browser-decisions.mjs');
+            const moduleRecord = browserRecords.find(
+                function selectedDecisionModule(record) { return record.source === moduleSource; }
+            );
+            if (!moduleRecord || !inventory.has(moduleRecord.destination)) {
+                fail('packageApp browserDecisions requires the selected SDK browser-decisions module in the package.');
+            }
+            const distributionPath = path.posix.join(path.posix.dirname(moduleRecord.destination), 'decisions-runtime');
+            // Acquire after native module and asset rewriting. The upstream
+            // distribution stays opaque and joins the final PWA/release inventory.
+            const distribution = await materializeBrowserDecisions(
+                path.join(stagingRoot, ...distributionPath.split('/')),
+                signal,
+                onEvent
+            );
+            for (const file of distribution.files) {
+                const relative = `${distributionPath}/${file}`;
+                if (!inventory.has(relative)) files.push(relative);
+                inventory.add(relative);
+            }
+        }
         const pwaArtifacts=pwaEnabled?createPwaArtifacts({
             app:{
                 id:context.appId,

package/src/workspace-runtime.mjs

@@ -2,6 +2,7 @@ import Is from 'strong-type';
 import {randomUUID} from 'node:crypto';
 import {copyFile,lstat,mkdir,readFile,readdir,realpath,rename,rm,writeFile} from 'node:fs/promises';
 import path from 'node:path';
+import {materializeBrowserDecisions} from './browser-decisions-distribution.mjs';
 import {SDK_VERSION} from './constants.mjs';
 import {rewriteAssetReferences} from './import-map.mjs';
 import {getSdkRoot} from './runtime.mjs';
@@ -85,85 +86,6 @@ async function removeTemporaryTree(location){
     await rm(location,{recursive:true,force:true}).catch(()=>{});
 }
 
-async function materializeBrowserDecisions(destination, signal, onEvent) {
-    const transformers = 'https://cdn.jsdelivr.net/npm/@huggingface/transformers@4.3.0/';
-    const onnx = 'https://cdn.jsdelivr.net/npm/onnxruntime-web@1.31.0-dev.20260914-8d85527a0/';
-    const files = [
-        {name: 'transformers.min.js', url: `${transformers}dist/transformers.min.js`},
-        {name: 'ort-wasm-simd-threaded.asyncify.mjs', url: `${onnx}dist/ort-wasm-simd-threaded.asyncify.mjs`},
-        {name: 'ort-wasm-simd-threaded.asyncify.wasm', url: `${onnx}dist/ort-wasm-simd-threaded.asyncify.wasm`},
-        {name: 'TRANSFORMERS-LICENSE', url: `${transformers}LICENSE`},
-        {name: 'ONNX-RUNTIME-LICENSE', url: `${onnx}LICENSE`}
-    ];
-    const controller = new AbortController();
-    function cancelDistribution() {
-        controller.abort(signal.reason);
-    }
-    signal?.addEventListener('abort', cancelDistribution, {once: true});
-    if (signal?.aborted) cancelDistribution();
-    let completed = 0;
-    try {
-        throwIfAborted(controller.signal);
-        await emit(
-            onEvent,
-            {type: 'workspace.decisions.started', completed, total: files.length}
-        );
-        throwIfAborted(controller.signal);
-        await mkdir(destination, {recursive: true});
-        async function acquireDistributionFile(file) {
-            try {
-                throwIfAborted(controller.signal);
-                const response = await fetch(file.url, {signal: controller.signal});
-                const content = new Uint8Array(await response.arrayBuffer());
-                if (!response.ok) {
-                    const error = new Error(`Browser decision distribution returned HTTP ${response.status} ${response.statusText}.`);
-                    error.code = 'ARCANE_DECISION_DISTRIBUTION_DOWNLOAD_FAILED';
-                    error.response = {
-                        url: response.url,
-                        status: response.status,
-                        statusText: response.statusText,
-                        headers: [...response.headers],
-                        content
-                    };
-                    throw error;
-                }
-                throwIfAborted(controller.signal);
-                // Upstream distribution content is opaque, including its own
-                // imports and license text. No SDK source rewriting applies.
-                await writeFile(path.join(destination, file.name), content);
-                throwIfAborted(controller.signal);
-                completed += 1;
-                await emit(
-                    onEvent,
-                    {type: 'workspace.decisions.progress', file: file.name, url: file.url, completed, total: files.length}
-                );
-            } catch (error) {
-                controller.abort(error);
-                throw error;
-            }
-        }
-        // One fixed distribution, acquired once for the selected projection;
-        // no model/app/architecture multiplier or installation script.
-        const outcomes = await Promise.allSettled(files.map(acquireDistributionFile));
-        const failures = new Set();
-        for (const outcome of outcomes) {
-            if (outcome.status === 'rejected') failures.add(outcome.reason);
-        }
-        if (failures.size === 1) throw [...failures][0];
-        if (failures.size > 1) {
-            throw new AggregateError([...failures], 'Browser decision distribution acquisition failed.');
-        }
-        throwIfAborted(controller.signal);
-    } finally {
-        signal?.removeEventListener('abort', cancelDistribution);
-    }
-    return {
-        transformersVersion: '4.3.0',
-        onnxRuntimeVersion: '1.31.0-dev.20260914-8d85527a0',
-        files: files.map(function distributionFilename(file) { return file.name; })
-    };
-}
-
 export async function materializeWorkspaceRuntimeContent({
     workspaceRoot,
     runtimeRoot=path.join(getSdkRoot(),'runtime'),