fix: preserve dependency compatibility and standalone DICOM startup

[wybaby168]

Summary

• Preserve the unrelated verified updates from chore(deps): bump the npm-minor-and-patch group across 1 directory with 25 updates #331 and retain the working web-ifc 0.0.77 engine. The published 0.0.78 JS calls StreamMeshes with four arguments while its browser WASM expects three; this failure was reproduced directly on the original IFC file using the package's own JS/WASM.
• Enforce that the IFC importer and copied WASM resolve from the same physical package. Native IFC4 and IFC4.3 render, select, pick and release their actual Workers after the repair.
• Align the published DOCX 0.3.33 dependency with the core Worker cache version, release facts and documentation. Preserve the original Next 16.3.8 update and the independent security corrections from fix(deps): align security pins with the installed dependency graph #337.
• Use the coherent Cornerstone 5.10.11 core/loader/metadata cohort to preserve the verified Node 22 installation range. Record all 94 production packages, four native codec wrappers and their 32 official files; verify registry signatures, artifact/lockfile hashes and unchanged native license texts. The older releases publish no build attestations, which is explicitly disclosed.
• Fix a genuine cold-browser startup error: transitive xmlbuilder2 extends events.EventEmitter, but the standalone closure omitted browser events. The renderer now declares events@3.3.0, and a new standard regression packs and installs the actual library in a temporary consumer outside the workspace before checking native CT pixels and cleanup in Chromium/WebKit.
• Repair the DICOM public inspect entry in native Node ESM with the parser's actual default export; the original cold package fails on the valid CT fixture and the fixed cold package succeeds.
• Regenerate the BPMN styles and MapLibre Worker from their updated packages. Verify the MapLibre credit's text and safe href while allowing the upstream sanitizer to remove untrusted IDs; dangerous attributes, protocols and script execution remain prohibited.

Related issue

N/A: this is the verified continuation of dependency PR #331. No issue is automatically closed.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Actual local Node 24.20.0 and pnpm 11.0.9 checks on the repaired dependency closure:

Check	Result
pnpm build	Pass
pnpm type-check	Pass
pnpm test	Pass
pnpm exec vitest run	Pass: 30 files, 258 tests; 1 existing skip remains a skip
node --test .github/scripts/dependency-cohort.test.mjs	Pass: 9 checks, including actual importer/WASM ownership
pnpm verify:github-governance	Pass: 53 checks and formatting; 1 existing private publishing check skipped
pnpm audit --registry=https://registry.npmjs.org	Pass under the existing documented Vue 2 EOL exception; no new ignore added
pnpm install --frozen-lockfile --registry=https://registry.npmjs.org	Pass
pnpm docs:build and pnpm site:build	Pass
pnpm --filter @file-viewer/renderer-3d verify:ifc-browser /tmp/file-viewer-ifc-samples	Pass: native IFC4/IFC4.3, actual Workers and WebGL geometry
pnpm verify:renderer-sanitization	Pass with FILE_VIEWER_RTF_BROWSERS=chromium, matching Public CI
node apps/component-demo/scripts/verify-packed-issue-closure.mjs	Pass: actual cold React/Vue/Angular consumers, Angular ng serve and production /ui/ PPTX Worker
Remaining Public CI checks	Pass: all 25 extra command phases completed or reused only for unchanged scoped inputs; repaired IFC/component and final sanitization/smoke/slideshow phases rerun
bash .github/scripts/run-gitleaks.sh	Pass: full history, zero leaks
pnpm audit:renderer-deps, pnpm verify:dicom-license-ledger, signature verify:licenses	Pass: actual Security workflow license gates; 94 DICOM packages / 4 native components / 2 platform-optional packages
npm audit signatures on isolated official codecs	Pass: all 4 registry signatures verified; these older releases provide no build attestations, and no signed-build or independent-rebuild claim is made
DICOM native browser matrix	Pass: Chromium/WebKit real CT and compressed Part 10 pixels, Workers, interactions, host ownership and cleanup
pnpm test:dicom-packed-browser (also part of pnpm test)	Pass: actual source tars, isolated consumer outside the repository, no dependency aliases or app-level events fix, official audit zero, real Chromium/WebKit CT pixels and cleanup
True cold packed Node 22.16.0 npm and pnpm consumers	Pass: engine-strict install, physical core/loader/metadata 5.10.11 and DOMPurify 3.4.16, native 128×128 CT inspection and all four unsupported JPEG XL/HTJ2K header controls
True cold npm and pnpm native browser matrices	Pass: final package declarations, Chromium/WebKit compressed and uncompressed Part 10 pixels, actual Workers, interactions, host ownership, abort and cleanup
Cold official audit with documented application-root policies	Pass: zero vulnerabilities in both npm and pnpm consumers; internal source-core file mapping is disclosed separately
Default cold audit without the application policy	Fail: 10 vulnerability nodes (7 high, 3 moderate) from upstream pinned adm-zip/uuid/fflate and their owners; not counted as passing

The earlier native IFC ABI failure, MapLibre ID-based test failure and Mac Firefox profile startup failure remain recorded as failures. The final RTF scope is the explicit Chromium Public CI scope; no Firefox pass is claimed. The earlier pushed head 21f4f9a completed Public CI but Security correctly failed on stale DICOM provenance; that failure remains recorded. The intermediate Node 24 candidate df0cc19 passed Public CI and Security but was not accepted as a compatibility change. The final compatible head requires fresh complete CI. Both native Node ESM inspection and actual standalone packed-browser regression are now standard gates. The subsequent notice-only correction updates the generator and generated notice sentence to match the four-codec closure. Focused license/governance/pack checks were rerun; the new tar differs only in THIRD_PARTY_NOTICES.md, and runtime files, dependencies, metadata and native license bytes match the fully exercised bddfda5 baseline. That baseline is identified separately from the final source SHA and its new complete remote CI. The genuine initial cold-browser failure and earlier incomplete harness attempts remain recorded as failures.

Sample / fixture evidence

• Unmodified public buildingSMART certification IFC4/IFC4.3 originals, with repository-pinned SHA-256 checks in the fixture downloader.
• Repository fixtures: apps/viewer-demo/public/example/word.docx and apps/viewer-demo/public/example/en/sample-presentation.pptx.
• Original native files, before/after browser receipts and screenshots remain in the local evidence directory and are not committed.

Visual evidence

N/A: this dependency and asset repair makes no intentional UI change. Actual native geometry, visible charts, attribution and Worker lifecycle are verified above; no Microsoft Office pixel identity is claimed.

Risk and compatibility

• Affected packages/formats: optional DICOM source inspection, native codecs, distribution notices and the dependency group from chore(deps): bump the npm-minor-and-patch group across 1 directory with 25 updates #331, optional IFC import/rendering, DOCX Worker versioning, generated MapLibre/BPMN assets and documentation facts.
• Compatibility or migration risk: the opt-in DICOM cohort remains installable under the previously verified Node 22.16.0 range by choosing 5.10.11; its inherited dcmjs dependency requires Node >=22.13.0, and no Node 20 compatibility is claimed. Standard/full presets still exclude DICOM. The library's workspace overrides do not propagate to consumers: application roots must apply the documented scoped adm-zip 0.6.1 / uuid 11.1.1 / fflate 0.7.5 policies. The default consumer security audit still fails; this draft does not represent automatic consumer safety. JPEG XL/HTJ2K remain unsupported. Both npm and pnpm policies are exercised against final source tars, and pnpm 11 explicitly skips only core-js-pure's non-runtime donation banner. Retain exact web-ifc 0.0.77 until a matching upstream JS/WASM release passes the native files. Redeploy the DOCX 0.3.33 Worker assets together with the wrapper. The published 0.3.33 engine does not include the unpublished header/footer pagination repair in docxjs #14; that separate repair still requires maintainer publication and a subsequent verified wrapper update.
• Rollback: revert the curated dependency changes and generated assets together; preserve the independent security fixes. No default branch, tag or npm package is published by this draft.

Checklist

• Added the actual IFC dependency ownership regression, native Node inspection and standalone DICOM packed-browser gates; corrected the native MapLibre test's semantic locator and retained all security assertions.
• Verified the compatible DICOM closure and documented explicit consumer safety policies; default audit failure and absent upstream build attestations remain disclosed.
• Updated release facts, Worker provenance and documentation to the installed published DOCX version.
• Verified native IFC and the offline Workers, packed consumers, copied assets, browser smoke and slideshow checks.
• No secrets, private originals, generated caches or unrelated user work were committed; the original contributor commit remains in the branch history.

[wybaby168]

Closing as superseded. The compatible dependency updates and standalone DICOM runtime are covered by #350, #360, #361, #363 and #364.

Verified on main c4cbee1b42ef1a7357e08c222da7451bf0ef2c31: Public CI, Security, and CodeQL all passed. The accepted replacement source was checked after landing.