v0.1.1 — published to npm

Now installable:

npm install @libxa/echo

No functional change from v0.1.0 — the client behaves identically. This release exists because v0.1.0 was never published to npm, and the two commits since it are a documentation pass and the publish workflow itself.

• Documentation no longer names another framework anywhere.
• Publishing runs on tag, with a guard that the tag and package.json version agree and a skip if that version is already on the registry.

What the package does is unchanged: the standard Pusher client with the defaults that a self-hosted server needs already filled in — including namespace: false, without which a correct-looking client subscribes successfully and then receives nothing at all, with no error and no warning.

v0.1.0 — the browser client for LibxaSocket

feat: the browser client for LibxaSocket

The standard Pusher client libraries, configured for a self-hosted
server, so that reaching for a client named after somebody else's
framework is not a step in anyone's setup. Deliberately thin: everything
the underlying client can do, it can do, because it is that client.

npm install @libxa/echo

const echo = createEcho({ key: import.meta.env.VITE_SOCKET_APP_KEY });
echo.join('room.1').here(users => …).listen('MessagePosted', e => …);

The value is the defaults. pusher-js is built to talk to Pusher's own
infrastructure, and several of its defaults are quietly wrong when the
server is your own:

• namespace: false. The client prefixes App.Events onto every name
  given to .listen(). LibxaSocket publishes broadcastAs() unprefixed,
  so with the default a correctly written client waits for an event
  that is never sent — no error, no warning, silence. This is the one
  that costs an afternoon.

• disableStats: true. pusher-js reports connection statistics to
  Pusher's servers. Against your own server that is an unrelated third
  party being told when your users connect.

• enabledTransports pinned. Left alone, pusher-js long-polls Pusher's
  endpoints when the socket fails, so a broken local server produces
  requests to a company you have no account with.

• cluster, which pusher-js will not construct without; forceTLS
  following the page, because an HTTPS page refuses ws:// outright;
  and the authEndpoint LibxaSocket actually registers.

Two things it deliberately does not do. It does not re-implement CSRF
handling: the underlying client already checks a page global, then its
own option, then the meta tag, and writes the header itself. An earlier
draft set the header too and offered csrfToken: null to suppress it,
which could not work — the client finds the meta tag afterwards
regardless. An option that silently does nothing is the exact bug class
this ecosystem has been clearing out, so it was removed rather than
documented around.

And it does not assign window.Pusher. The constructor is handed over
explicitly, so nothing global is mutated and it works where there is no
window.

Passing a 64-character hex value as the key throws: a key is 32
characters and a secret is 64, and pasting the wrong one ships the
secret to every browser.

28 unit tests, plus an integration script that starts a real LibxaSocket
server and a real authorization endpoint, connects, subscribes to a
private channel, publishes and checks the event arrives. It imports
dist/, so a broken build fails there rather than in an application.