Picked isolated import helper — AGPL-3.0-only.
Node24/npm. Vendored artifacts and corresponding source: ../manifest.json and https://github.com/MercuryWorkshop/scramjet/tree/988923f530fb31e61c01cc014e7aa423f0b4900c.
Copy the five engine artifacts listed in manifest.json and Scramjet-LICENSE.txt into public/__import/vendor. Serve public/__import on a separate HTTPS origin. No app/auth API belongs on this origin.
The unmodified upstream build can be rebuilt by recursively cloning the pinned source commit and following its README (Rust/WASM and upstream build tooling).
Parent protocol: ready{nonce}; parent sends nonce,url and a MessagePort. Port resource{id,action:authorize|resource,url,cookie?}, reply{id,result|error}, snapshot{html,url,direct}, stop. Session/ticket stay in parent.