space-data-module-sdk 0.8.7 → 0.8.8

package/docs/browser-wasmedge-isomorphic.md

@@ -146,7 +146,7 @@ The supported browser/WasmEdge entry points are:
 
 - browser entry bundle: [`src/browser.js`](/Users/tj/software/space-data-module-sdk/src/browser.js)
 - isomorphic loader: [`src/host/isomorphicLoader.js`](/Users/tj/software/space-data-module-sdk/src/host/isomorphicLoader.js)
-- browser harness: [`src/testing/browserModuleHarness.js`](/Users/tj/software/space-data-module-sdk/src/testing/browserModuleHarness.js)
+- browser harness: [`src/host/browserModuleHarness.js`](../src/host/browserModuleHarness.js)
 - browser WASI shim: [`src/host/wasiShim.js`](/Users/tj/software/space-data-module-sdk/src/host/wasiShim.js)
 - browser edge shims: [`src/host/browserEdgeShims.js`](/Users/tj/software/space-data-module-sdk/src/host/browserEdgeShims.js)
 - browser host adapter: [`src/host/browserHost.js`](/Users/tj/software/space-data-module-sdk/src/host/browserHost.js)

package/docs/language-runtime-matrix.md

@@ -17,9 +17,9 @@ Framing: **hosts** embed a runtime to execute SDN `.wasm` modules; **guests** ar
 | Host environment / language | Module runtime used | WasmEdge native? | Status in this codebase | Evidence |
 |---|---|---|---|---|
 | **Go node (`sdn-server`)** — Go | WasmEdge embedded in-process via CGO (`second-state/WasmEdge-go v0.14.0`) | **YES** (in-process, production) | **In use** — the production module runtime | `sdn-server/go.mod:27`; `internal/wasmrt/runtime.go:12,117-130` (`wasmedge.NewVMWithConfig`, THREADS/EXCEPTION_HANDLING/WASI); `internal/modulert/module.go:167-175` |
-| **Browser** — JS/TS (sdn-js UI, OrbPro) | Plain `WebAssembly.instantiate` + pure-JS WASI shim + the `space_data_module_host` hostcall bridge (**the JS harness**) | **NO** — WasmEdge does not exist in browsers | **In use** — `createBrowserModuleHarness`, `createWorkerModuleHarness`, `createFlowRuntimeHost` | `sdn-js/src/ui/runtime/live-delivery.ts:2,204`; SDK `src/host/wasiShim.js:33`, `src/host/abi.js:10` (`DEFAULT_HOSTCALL_IMPORT_MODULE = "space_data_module_host"`, matching Go `internal/modulert/hostbridge.go:28`), `src/testing/browserModuleHarness.js:263,310,353`, `src/flow/flowRuntimeHost.js:36` |
+| **Browser** — JS/TS (sdn-js UI, OrbPro) | Plain `WebAssembly.instantiate` + pure-JS WASI shim + the `space_data_module_host` hostcall bridge (**the JS harness**) | **NO** — WasmEdge does not exist in browsers | **In use** — `createBrowserModuleHarness`, `createWorkerModuleHarness`, `createFlowRuntimeHost` | `sdn-js/src/ui/runtime/live-delivery.ts:2,204`; SDK `src/host/wasiShim.js:33`, `src/host/abi.js:10` (`DEFAULT_HOSTCALL_IMPORT_MODULE = "space_data_module_host"`, matching Go `internal/modulert/hostbridge.go:28`), `src/host/browserModuleHarness.js`, `src/flow/flowRuntimeHost.js:36` |
 | **Node.js — JS/TS, subprocess path** | WasmEdge **out-of-process**: `spawn("wasmedge", ...)` CLI, invoke request over stdin/stdout | Yes, but only as an external binary | **In use** (Node harness default for standalone artifacts) | SDK `src/host/isomorphicLoader.js:89,112`; `src/testing/processInvoke.js:111,131` |
-| **Node.js — JS/TS, pure-JS path** | Plain V8 `WebAssembly` + the same browser harness (wasiShim + hostcall bridge) | NO | **In use** (vitest, isomorphic artifacts, no-wasmedge-binary environments) | `wasiShim.js:1-12` ("same .wasm that runs in WasmEdge … instantiated directly"); `browserModuleHarness.js:186,310` |
+| **Node.js — JS/TS, pure-JS path** | Plain V8 `WebAssembly` + the same browser harness (wasiShim + hostcall bridge) | NO | **In use** (vitest, isomorphic artifacts, no-wasmedge-binary environments) | `wasiShim.js:1-12` ("same .wasm that runs in WasmEdge … instantiated directly"); `src/host/browserModuleHarness.js` |
 | **C** — native test runner | WasmEdge embedded via the C API (`wasmedge/wasmedge.h`) | **YES** (in-process, test-only) | **In use** (pthread module test runner only) | SDK `src/testing/native/wasmedge_emscripten_pthread_runner.c:9`; `src/testing/buildWasmEdgeRunner.js` |
 | **C/C++** — as guest language | n/a (compiles to the wasm modules themselves) | n/a | **In use** — the *only* guest language | All module families (`propagator/*`, `foundation/*`, `comms/*`, closed-modules `*.cpp`); compiler supports exactly `.cpp → em++` / else `emcc` |
 | **Rust** | WasmEdge Rust SDK (`wasmedge-sdk`) exists upstream | Would be native | **N/A — not used** (only vendored emsdk test fixtures contain `.rs`) | Zero `Cargo.toml` outside `deps/emsdk/.../test/rust/` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "space-data-module-sdk",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "description": "Module SDK for building, validating, signing, and deploying WebAssembly modules on the Space Data Network.",
   "type": "module",
   "types": "./src/index.d.ts",
@@ -50,14 +50,22 @@
     "./http": "./src/http/index.js",
     "./host/browser-edge-shims": "./src/host/browserEdgeShims.js",
     "./host/wasi-shim": "./src/host/wasiShim.js",
-    "./host/isomorphic": "./src/host/isomorphicLoader.js",
-    "./testing/browser": "./src/testing/browserModuleHarness.js",
+    "./host/isomorphic": {
+      "browser": "./src/host/isomorphicLoaderBrowser.js",
+      "default": "./src/host/isomorphicLoader.js"
+    },
+    "./host/browser-module": "./src/host/browserModuleHarness.js",
+    "./host/worker-module": "./src/host/workerModuleHarness.js",
+    "./testing/browser": "./src/testing/browser.js",
     "./testing/module-flatbuffer-stream-pump": {
       "types": "./src/index.d.ts",
-      "default": "./src/testing/moduleFlatbufferStreamPump.js"
+      "default": "./src/host/moduleFlatbufferStreamPump.js"
     },
     "./testing": "./src/testing/index.js",
-    "./standards": "./src/standards/index.js",
+    "./standards": {
+      "browser": "./src/standards/browser.js",
+      "default": "./src/standards/index.js"
+    },
     "./utils/wasm-crypto": "./src/utils/wasmCrypto.js",
     "./schemas/*": "./schemas/*",
     "./compat": "./src/compat/index.js"

package/src/browser.js

@@ -16,7 +16,17 @@ export * from "./host/sabHostcallChannel.js";
 export * from "./host/timerDriver.js";
 export * from "./flow/index.js";
 export * from "./compat/index.js";
-export * from "./host/isomorphicLoader.js";
-export { createBrowserModuleHarness, detectArtifactProfile } from "./testing/browserModuleHarness.js";
-export { createWorkerModuleHarness } from "./testing/workerModuleHarness.js";
-export { createModuleFlatBufferStreamPump } from "./testing/moduleFlatbufferStreamPump.js";
+// The browser leg of `./host/isomorphic`. NEVER isomorphicLoader.js: that is
+// the Node leg, and a bundler resolves its node:* branches even though a
+// browser can never take them.
+export * from "./host/isomorphicLoaderBrowser.js";
+// Browser module hosts. These are runtime surface and live in src/host/;
+// nothing under src/testing/ is reachable from this entry.
+export {
+  createBrowserModuleHarness,
+  detectArtifactProfile,
+  zeroWasmBytes,
+  isSharedArrayBufferLike,
+} from "./host/browserModuleHarness.js";
+export { createWorkerModuleHarness } from "./host/workerModuleHarness.js";
+export { createModuleFlatBufferStreamPump } from "./host/moduleFlatbufferStreamPump.js";

package/src/bundle/artifactBytes.js

@@ -0,0 +1,44 @@
+/**
+ * Artifact byte reduction — runtime surface, not test-harness surface.
+ *
+ * A published module artifact is `module.wasm` plus an appended publication
+ * record collection (MBL bundle: the sds.signature entry, PNM/REC trailers).
+ * EVERY runtime that loads a module — browser, native WasmEdge, Docker
+ * WasmEdge — must reduce the artifact to the same canonical payload before it
+ * reaches a wasm engine, because every engine rejects the trailing bytes
+ * ("unknown section code" / "malformed section id"). Same input bytes in,
+ * byte-identical payload out, in all three runtimes.
+ *
+ * That makes this an ARTIFACT concern and it belongs beside signing and
+ * verification, on `space-data-module-sdk/bundle`. It previously lived in
+ * `src/testing/browserModuleHarness.js`, which forced production delivery code
+ * (OrbPro's SDN module decryptor) to import a TEST-harness subpath to get it —
+ * the import that dragged the Node harnesses into a browser bundle and blanked
+ * all 275 gallery demos (`orbpro-engine-bundle-ships-node-builtins`).
+ */
+
+import { extractPublicationRecordCollection } from "../transport/records.js";
+import { ModuleSignatureError } from "./signing.js";
+
+/**
+ * Reduce a module artifact to the bytes a wasm engine can compile.
+ *
+ * ENC-protected payloads cannot be reduced here — decryption is a host
+ * concern, and the caller must decrypt before loading.
+ *
+ * @param {Uint8Array} bytes - raw artifact bytes
+ * @returns {Uint8Array} compilable wasm bytes
+ */
+export function toLoadableWasmBytes(bytes) {
+  const publication = extractPublicationRecordCollection(bytes);
+  if (!publication) {
+    return bytes;
+  }
+  if (publication.enc) {
+    throw new ModuleSignatureError(
+      "encrypted_artifact",
+      "Module artifact payload is ENC-protected; decrypt it before loading.",
+    );
+  }
+  return publication.payloadBytes;
+}

package/src/bundle/index.js

@@ -1,6 +1,7 @@
 export * from "./constants.js";
 export * from "./codec.js";
 export * from "./wasm.js";
+export * from "./artifactBytes.js";
 export * from "./signing.js";
 // Re-exported under explicit names rather than `export *`: sigdomain's own
 // names (`statement`, `domains`, `describe`, `registered`) are deliberately

package/src/flow/isomorphicFlowHost.js

@@ -5,7 +5,7 @@ import {
 } from "../bundle/signing.js";
 import { getWasmCustomSections } from "../bundle/wasm.js";
 import { decodePlgManifest } from "../manifest/plgCodec.js";
-import { createBrowserModuleHarness } from "../testing/browserModuleHarness.js";
+import { createBrowserModuleHarness } from "../host/browserModuleHarness.js";
 import { extractPublicationRecordCollection } from "../transport/records.js";
 import { sha256Bytes } from "../utils/crypto.js";
 import { bytesToHex } from "../utils/encoding.js";

package/src/{testing → host}/browserModuleHarness.js

@@ -1,9 +1,17 @@
 /**
- * Browser-side module harness.
+ * Browser module host — the browser leg of the tri-runtime contract.
  *
- * Loads the same standalone WASI .wasm artifact that WasmEdge runs,
- * instantiating it in the browser with the WASI shim + optional space_data_module_host
- * bridge. Matches the createModuleHarness() API surface.
+ * Loads the same standalone WASI .wasm artifact that native WasmEdge and the
+ * Docker WasmEdge container run, instantiating it in the browser with the WASI
+ * shim + optional space_data_module_host bridge. Matches the
+ * createModuleHarness() API surface.
+ *
+ * This is PRODUCTION runtime surface, published as
+ * `space-data-module-sdk/host/browser-module`. It lived under `src/testing/`
+ * until 2026-08-07, which made every browser consumer import a test-harness
+ * subpath to load a module and let the Node harnesses next door reach a browser
+ * bundle (`orbpro-engine-bundle-ships-node-builtins`). Nothing browser-facing
+ * lives under `src/testing/` any more.
  *
  * Supports two invoke paths:
  *   1. "direct" — call plugin_invoke_stream(ptr, len, &outLen) and read
@@ -12,19 +20,19 @@
  *      stdout for the response bytes.
  */
 
-import { createBrowserWasiShim, WasiExitError } from "../host/wasiShim.js";
+import { createBrowserWasiShim, WasiExitError } from "./wasiShim.js";
 import {
   createWasiThreadSpawn,
   isWasiThreadsModule,
-} from "../host/wasiThreadHost.js";
-import { createBrowserHost } from "../host/browserHost.js";
+} from "./wasiThreadHost.js";
+import { createBrowserHost } from "./browserHost.js";
 import { getWasmWallet } from "../utils/wasmCrypto.js";
 import {
   createHostcallBridge,
   createAsyncHostDispatcher,
   createHostSyncDispatcher,
   DEFAULT_HOSTCALL_IMPORT_MODULE,
-} from "../host/abi.js";
+} from "./abi.js";
 import {
   DefaultInvokeExports,
   DefaultManifestExports,
@@ -41,33 +49,12 @@ import {
   resolveModuleSignaturePolicy,
   verifyModuleArtifact,
 } from "../bundle/signing.js";
-import { extractPublicationRecordCollection } from "../transport/records.js";
+// Artifact byte reduction is an ARTIFACT concern shared by all three runtimes,
+// so it lives on `space-data-module-sdk/bundle`. Re-exported here because a
+// caller loading a module in the browser needs it in the same breath.
+import { toLoadableWasmBytes } from "../bundle/artifactBytes.js";
 
-/**
- * Reduce a module artifact to the bytes a wasm engine can compile.
- *
- * Signed/published artifacts carry an appended publication record collection
- * (MBL bundle with the sds.signature entry, PNM/REC trailers). Wasm engines
- * reject those trailing bytes ("unknown section code"), so the canonical
- * module payload must be extracted before compile. ENC-protected payloads
- * cannot be loaded here — decryption is a host concern.
- *
- * @param {Uint8Array} bytes - raw artifact bytes
- * @returns {Uint8Array} compilable wasm bytes
- */
-export function toLoadableWasmBytes(bytes) {
-  const publication = extractPublicationRecordCollection(bytes);
-  if (!publication) {
-    return bytes;
-  }
-  if (publication.enc) {
-    throw new ModuleSignatureError(
-      "encrypted_artifact",
-      "Module artifact payload is ENC-protected; decrypt it before loading.",
-    );
-  }
-  return publication.payloadBytes;
-}
+export { toLoadableWasmBytes };
 
 const STANDALONE_SHARED_MEMORY_ENV_STUBS = Object.freeze({
   _emscripten_init_main_thread_js: () => 0,

package/src/host/isomorphicLoader.js

@@ -1,43 +1,39 @@
 /**
- * Isomorphic module loader.
+ * Isomorphic module loader — NODE/WasmEdge leg (the `default` condition).
  *
  * Unified entry point that detects the runtime environment and artifact
  * profile, then loads the module through the appropriate path:
- *   - Browser: createBrowserModuleHarness (WASI shim + optional space_data_module_host)
- *   - Node/WasmEdge: createModuleHarness (subprocess)
+ *   - Browser (jsdom/embedded window under Node): createBrowserModuleHarness
+ *   - Node/WasmEdge: createModuleHarness (subprocess) or the WasmEdge command
+ *     harness below
  *
- * The same compiled .wasm artifact works in both environments.
+ * The same compiled .wasm artifact works in every environment; only HOW it is
+ * launched differs, and that difference is absorbed here — never in a guest.
+ *
+ * A browser resolves `./host/isomorphic` to `isomorphicLoaderBrowser.js`
+ * instead, via the package's `browser` export condition. The two legs share
+ * `isomorphicLoaderCore.js` so the runtime-independent half cannot drift. The
+ * split is what keeps a browser bundle from statically resolving the
+ * node:child_process/os/path/fs imports below
+ * (`module-sdk-browser-entry-node-builtins`).
  */
 
 import {
   createBrowserModuleHarness,
-  detectArtifactProfile,
   toLoadableWasmBytes,
-} from "../testing/browserModuleHarness.js";
-import { createAsyncHostDispatcher } from "./abi.js";
+} from "./browserModuleHarness.js";
 import {
   resolveModuleSignaturePolicy,
   verifyModuleArtifact,
 } from "../bundle/signing.js";
+import { attachHostDispatch, inspectModule } from "./isomorphicLoaderCore.js";
+
+export { inspectModule, attachHostDispatch };
 
 const isBrowser =
   typeof globalThis.window !== "undefined" &&
   typeof globalThis.document !== "undefined";
 
-function attachHostDispatch(harness, host) {
-  if (!host || typeof host !== "object") {
-    return harness;
-  }
-  const dispatchHost = createAsyncHostDispatcher(host);
-  return {
-    ...harness,
-    host,
-    async callHost(operation, params = {}) {
-      return dispatchHost(operation, params);
-    },
-  };
-}
-
 async function createWasmEdgeCommandHarness(options = {}) {
   const [
     { spawn },
@@ -269,27 +265,3 @@ export async function loadModule(options = {}) {
     options.host ?? null,
   );
 }
-
-/**
- * Inspect a WASM module's artifact profile without instantiating it.
- *
- * @param {Uint8Array|ArrayBuffer|WebAssembly.Module} source
- * @returns {Promise<{profile: string, exports: string[], imports: Array}>}
- */
-export async function inspectModule(source) {
-  let wasmModule;
-  if (source instanceof WebAssembly.Module) {
-    wasmModule = source;
-  } else {
-    const bytes =
-      source instanceof ArrayBuffer ? new Uint8Array(source) : source;
-    // Tolerate signed/published artifacts (appended publication records).
-    wasmModule = await WebAssembly.compile(toLoadableWasmBytes(bytes));
-  }
-
-  const profile = detectArtifactProfile(wasmModule);
-  const exports = WebAssembly.Module.exports(wasmModule).map((e) => e.name);
-  const imports = WebAssembly.Module.imports(wasmModule);
-
-  return { profile, exports, imports };
-}

package/src/host/isomorphicLoaderBrowser.js

@@ -0,0 +1,47 @@
+/**
+ * Isomorphic module loader — BROWSER leg.
+ *
+ * The target of the `browser` export condition on
+ * `space-data-module-sdk/host/isomorphic`, and the loader re-exported by the
+ * package's own `browser` entry (`src/browser.js`).
+ *
+ * Same public surface as the Node leg — `loadModule` and `inspectModule` — and
+ * for a browser it does EXACTLY what the Node leg's `isBrowser` branch did
+ * before the split: hand the artifact to `createBrowserModuleHarness`. What it
+ * does not carry is the WasmEdge subprocess path, because a browser can never
+ * take it and a bundler resolves it anyway.
+ *
+ * Asking this leg for a server runtime is a defect, not a fallback: it throws.
+ * A caller that legitimately needs both is running under Node and resolves the
+ * Node leg through the same subpath.
+ */
+
+import { createBrowserModuleHarness } from "./browserModuleHarness.js";
+import { resolveModuleSignaturePolicy } from "../bundle/signing.js";
+import { attachHostDispatch, inspectModule } from "./isomorphicLoaderCore.js";
+
+export { inspectModule, attachHostDispatch };
+
+/**
+ * Load a WASM module in the browser.
+ *
+ * @param {Object} options - see the Node leg for the full option list; the
+ *   browser leg accepts the same object and honours the browser-relevant keys.
+ * @returns {Promise<Object>} Harness with invoke(), readManifest(), destroy().
+ */
+export async function loadModule(options = {}) {
+  // Resolved for the same reason the Node leg resolves it: an invalid policy is
+  // a caller error that must surface identically in every runtime, before any
+  // artifact work happens.
+  resolveModuleSignaturePolicy(options);
+
+  const runtimeKind = options.runtimeKind;
+  if (typeof runtimeKind === "string" && runtimeKind !== "browser") {
+    throw new Error(
+      `The browser isomorphic loader cannot run runtimeKind "${runtimeKind}"; ` +
+        "that artifact must be loaded from a Node/WasmEdge host.",
+    );
+  }
+
+  return createBrowserModuleHarness(options);
+}

package/src/host/isomorphicLoaderCore.js

@@ -0,0 +1,58 @@
+/**
+ * Isomorphic loader — the runtime-independent half.
+ *
+ * Everything here is byte-identical work that every runtime does: reduce the
+ * artifact, compile it, read its profile/exports/imports, attach the host
+ * dispatcher. `isomorphicLoader.js` (Node/WasmEdge) and
+ * `isomorphicLoaderBrowser.js` (browser) both build on this, so the two legs of
+ * `./host/isomorphic` cannot drift apart on the parts that must not differ.
+ *
+ * The split exists because a browser BUNDLER resolves every branch statically:
+ * one file holding both legs put node:child_process/os/path/fs into every
+ * browser bundle of the SDK's own `browser` export condition
+ * (`module-sdk-browser-entry-node-builtins`). The runtime difference is now
+ * absorbed by the package's export conditions — a host-shim concern — instead
+ * of by a runtime check inside one file.
+ */
+
+import { detectArtifactProfile } from "./browserModuleHarness.js";
+import { createAsyncHostDispatcher } from "./abi.js";
+import { toLoadableWasmBytes } from "../bundle/artifactBytes.js";
+
+export function attachHostDispatch(harness, host) {
+  if (!host || typeof host !== "object") {
+    return harness;
+  }
+  const dispatchHost = createAsyncHostDispatcher(host);
+  return {
+    ...harness,
+    host,
+    async callHost(operation, params = {}) {
+      return dispatchHost(operation, params);
+    },
+  };
+}
+
+/**
+ * Inspect a WASM module's artifact profile without instantiating it.
+ *
+ * @param {Uint8Array|ArrayBuffer|WebAssembly.Module} source
+ * @returns {Promise<{profile: string, exports: string[], imports: Array}>}
+ */
+export async function inspectModule(source) {
+  let wasmModule;
+  if (source instanceof WebAssembly.Module) {
+    wasmModule = source;
+  } else {
+    const bytes =
+      source instanceof ArrayBuffer ? new Uint8Array(source) : source;
+    // Tolerate signed/published artifacts (appended publication records).
+    wasmModule = await WebAssembly.compile(toLoadableWasmBytes(bytes));
+  }
+
+  const profile = detectArtifactProfile(wasmModule);
+  const exports = WebAssembly.Module.exports(wasmModule).map((e) => e.name);
+  const imports = WebAssembly.Module.imports(wasmModule);
+
+  return { profile, exports, imports };
+}

package/src/host/nodeBuiltinSpecifier.js

@@ -0,0 +1,43 @@
+/**
+ * Opaque Node builtin specifiers for isomorphic host shims.
+ *
+ * A host shim that serves BOTH runtimes needs a Node-only branch that is dead
+ * in a browser. Writing that branch as a literal `import("node:worker_threads")`
+ * does not work: esbuild/vite/rollup resolve dynamic imports STATICALLY, so a
+ * branch that can never run still fails — or, worse, is emitted as an external
+ * `node:` specifier that the browser then tries to FETCH, which is how the
+ * whole OrbPro gallery went dark (`orbpro-engine-bundle-ships-node-builtins`).
+ *
+ * Assembling the specifier at runtime keeps it opaque to the bundler. This is
+ * host-shim code absorbing a runtime difference, which is the only place the
+ * tri-runtime contract allows a difference to be absorbed; no guest module ever
+ * gains a runtime check.
+ *
+ * Use it ONLY behind a runtime check that is false in a browser, and only in
+ * `src/host/**` — a module that needs a Node builtin unconditionally belongs on
+ * a Node-only subpath instead.
+ */
+
+// Split so no bundler's `node:`-prefix scanner sees a literal here either.
+const NODE_BUILTIN_PREFIX = "no" + "de:";
+
+/**
+ * @param {string} name - builtin name without the `node:` prefix
+ * @returns {string} the specifier, assembled at runtime
+ */
+export function nodeBuiltinSpecifier(name) {
+  return NODE_BUILTIN_PREFIX + name;
+}
+
+/**
+ * Import a Node builtin from an isomorphic host shim.
+ *
+ * @param {string} name - builtin name without the `node:` prefix
+ * @returns {Promise<any>} the builtin's module namespace
+ */
+export async function importNodeBuiltin(name) {
+  const specifier = nodeBuiltinSpecifier(name);
+  return import(/* @vite-ignore */ /* webpackIgnore: true */ specifier);
+}
+
+export { NODE_BUILTIN_PREFIX };

package/src/host/sabHostcallChannel.js

@@ -21,7 +21,7 @@
  * `createHostcallBridge({ dispatch })` (src/host/abi.js) — the existing
  * envelope/error machinery is reused unchanged. `Atomics.wait` is illegal on
  * the main thread, so the guest MUST run in a Worker (see
- * src/testing/workerModuleHarness.js).
+ * src/host/workerModuleHarness.js).
  *
  * Payloads cross the channel as hostcall value envelopes (hostcallWire.js),
  * so binary leaves (Uint8Array) survive without base64/JSON round-trips.

package/src/host/wasiThreadHost.js

@@ -32,14 +32,13 @@
 //
 // See docs/isomorphic-pthreads.md and docs/browser-wasmedge-isomorphic.md.
 
+import { NODE_BUILTIN_PREFIX } from "./nodeBuiltinSpecifier.js";
+
 const IS_NODE =
   typeof process !== "undefined" &&
   !!process.release &&
   process.release.name === "node";
 
-// Split so no bundler can constant-fold it back into a literal `node:` import.
-const NODE_BUILTIN_PREFIX = "no" + "de:";
-
 const BROWSER_WORKER_URL = new URL(
   "./wasiThreadBrowserWorker.mjs",
   import.meta.url,

package/src/{testing → host}/workerModuleHarness.js

@@ -18,14 +18,15 @@
  * cross-origin isolated (COOP+COEP). In Node, worker_threads is used.
  */
 
-import { createBrowserHost } from "../host/browserHost.js";
-import { createAsyncHostDispatcher } from "../host/abi.js";
+import { createBrowserHost } from "./browserHost.js";
+import { createAsyncHostDispatcher } from "./abi.js";
 import {
   createSabHostcallBuffer,
   createSabHostcallServer,
   DEFAULT_SAB_HOSTCALL_RESPONSE_BYTES,
-} from "../host/sabHostcallChannel.js";
-import { WASI_THREAD_HOSTCALL_MESSAGE } from "../host/wasiThreadWorkerRuntime.js";
+} from "./sabHostcallChannel.js";
+import { WASI_THREAD_HOSTCALL_MESSAGE } from "./wasiThreadWorkerRuntime.js";
+import { importNodeBuiltin } from "./nodeBuiltinSpecifier.js";
 
 const WORKER_URL = new URL("./workerModuleHarnessWorker.js", import.meta.url);
 
@@ -51,7 +52,10 @@ function isNodeRuntime() {
 
 async function spawnWorker(workerUrl) {
   if (isNodeRuntime()) {
-    const { Worker: NodeWorker } = await import("node:worker_threads");
+    // Specifier assembled at runtime on purpose — see nodeBuiltinSpecifier.js.
+    // A literal here is statically resolved by every browser bundler even
+    // though this branch is dead in a browser.
+    const { Worker: NodeWorker } = await importNodeBuiltin("worker_threads");
     const worker = new NodeWorker(workerUrl);
     return {
       post: (message) => worker.postMessage(message),

package/src/{testing → host}/workerModuleHarnessWorker.js

@@ -10,7 +10,7 @@
  */
 
 import { createBrowserModuleHarness } from "./browserModuleHarness.js";
-import { createSabHostcallClientDispatch } from "../host/sabHostcallChannel.js";
+import { createSabHostcallClientDispatch } from "./sabHostcallChannel.js";
 
 async function resolvePort() {
   if (

package/src/standards/browser.js

@@ -0,0 +1,95 @@
+/**
+ * Standards catalog — BROWSER leg (the `browser` condition of `./standards`).
+ *
+ * Same catalog, same validation verdicts as the Node leg; only acquisition
+ * differs, and that difference is absorbed here rather than by a runtime check
+ * inside shared code. A browser has no `require.resolve` and no readFile, so
+ * the manifest must be handed in or fetched:
+ *
+ *   loadStandardsCatalog({ manifest })     // already-parsed manifest.json
+ *   loadStandardsCatalog({ manifestUrl })  // fetched, then parsed
+ *
+ * Neither one supplied is a caller defect, not a fallback: it throws. Silently
+ * returning an empty catalog would let a browser "validate" a manifest against
+ * nothing and agree with a Node run that actually checked it — exactly the kind
+ * of quiet divergence the tri-runtime contract exists to forbid.
+ */
+
+import {
+  buildStandardsCatalog,
+  validateManifestAgainstCatalog,
+  withSharedModuleCatalog,
+} from "./catalogCore.js";
+
+export {
+  buildStandardsCatalog,
+  resolveStandardsTypeRef,
+  validateManifestAgainstCatalog,
+  withSharedModuleCatalog,
+} from "./catalogCore.js";
+
+const standardsCatalogPromises = new Map();
+const knownTypeCatalogPromises = new Map();
+
+function catalogCacheKey(options) {
+  if (typeof options?.manifestUrl === "string" && options.manifestUrl) {
+    return `url:${options.manifestUrl}`;
+  }
+  return null;
+}
+
+async function readManifest(options) {
+  if (options?.manifest && typeof options.manifest === "object") {
+    return options.manifest;
+  }
+  if (typeof options?.manifestUrl === "string" && options.manifestUrl) {
+    const response = await fetch(options.manifestUrl);
+    if (!response.ok) {
+      throw new Error(
+        `Failed to fetch the spacedatastandards.org manifest from ${options.manifestUrl}: ${response.status}`,
+      );
+    }
+    return response.json();
+  }
+  throw new Error(
+    "The browser standards catalog needs the spacedatastandards.org manifest: " +
+      "pass { manifest } (already parsed) or { manifestUrl } (fetched). " +
+      "There is no on-disk manifest to read in a browser.",
+  );
+}
+
+export async function loadStandardsCatalog(options = {}) {
+  const key = catalogCacheKey(options);
+  if (key === null) {
+    return buildStandardsCatalog(await readManifest(options));
+  }
+  if (!standardsCatalogPromises.has(key)) {
+    standardsCatalogPromises.set(
+      key,
+      (async () => buildStandardsCatalog(await readManifest(options)))(),
+    );
+  }
+  return standardsCatalogPromises.get(key);
+}
+
+export async function loadKnownTypeCatalog(options = {}) {
+  const key = catalogCacheKey(options);
+  if (key === null) {
+    return withSharedModuleCatalog(await loadStandardsCatalog(options));
+  }
+  if (!knownTypeCatalogPromises.has(key)) {
+    knownTypeCatalogPromises.set(
+      key,
+      loadStandardsCatalog(options).then(withSharedModuleCatalog),
+    );
+  }
+  return knownTypeCatalogPromises.get(key);
+}
+
+export async function validateManifestAgainstStandardsCatalog(
+  manifest,
+  options = {},
+) {
+  const catalog = options.catalog ?? (await loadKnownTypeCatalog(options));
+  return validateManifestAgainstCatalog(catalog, manifest, options);
+}