Publish npm package as @tnb1j/4js

[tnb1j]

Summary

• publish the npm package under the available scoped name @tnb1j/4js
• bump the preview version to 0.185.1-four.1
• update package specifiers across source, examples, docs, tests, import maps, and migration tooling
• retain the FOUR namespace, backward-compatible legacy entry points, MIT license, NOTICE, and upstream attribution
• document npm install @tnb1j/4js@preview plus fixed-version UNPKG/jsDelivr browser imports

The previously tagged v0.185.1-four.0 package was not published. npm rejected the unscoped fourjs name as too similar to the existing four-js package. The changelog records that outcome; the old Git tag is intentionally retained.

Verification

• npm run build
• npm run lint
• npm run test-rebranding
• npm run test-migrate
• npm run test-e2e-cov (coverage manifest only)
• npm run test-unit (1326 passed, 1 todo, 0 failed)
• npm run test-unit-addons (15 passed, 0 failed)
• npm run test-treeshake
• npm audit --omit=dev --audit-level=high (0 vulnerabilities)
• npm publish --dry-run --tag preview --access public
• clean tarball install and ESM/CommonJS/addon/WebGPU/TSL/legacy entry-point smoke tests
• migration CLI smoke test
• LICENSE and NOTICE included in the 1,226-file tarball
• README rebranding parity check after final documentation update

Known limitations

• Screenshot comparison E2E was not completed and is not claimed as passing.
• Existing CodeQL alerts remain open. No alert is dismissed or disabled by this change. If the mechanical package-specifier update causes CodeQL to label existing alerts as new, their IDs and unchanged flagged logic will be documented in this PR.
• The first npm release uses the preview distribution tag, not latest.

[github-actions]

📦 Bundle size

Full ESM build, minified and gzipped.

	Before	After	Diff
WebGL	365.64 86.89	365.64 86.89	+0 B +0 B
WebGPU	679.61 188.59	679.61 188.59	+0 B +0 B
WebGPU Nodes	677.65 188.27	677.65 188.27	+0 B +0 B

🌳 Bundle size after tree-shaking

Minimal build including a renderer, camera, empty scene, and dependencies.

	Before	After	Diff
WebGL	507.69 123.44	507.69 123.44	+0 B +0 B
WebGPU	747.13 201.45	747.13 201.45	+0 B +0 B
WebGPU Nodes	697.48 189.04	697.48 189.04	+0 B +0 B

[tnb1j]

CodeQL review

The separate CodeQL result reports seven annotations. These are existing open alerts from main, not newly introduced logic in this package-identity change.

Alert	File	Rule	Evidence
#5	examples/jsm/loaders/SVGLoader.js:771	js/prototype-polluting-assignment	Existing on main at a6ac092; branch only changes package import/doc strings in this file
#16	examples/jsm/loaders/IESLoader.js:213	js/polynomial-redos	Existing on main at a6ac092; branch only changes package import/doc strings in this file
#17	examples/jsm/loaders/PLYLoader.js:468	js/polynomial-redos	Existing on main at a6ac092; branch only changes package import/doc strings in this file
#18	examples/jsm/loaders/STLLoader.js:307	js/polynomial-redos	Existing on main at a6ac092; branch only changes package import/doc strings in this file
#19	examples/jsm/loaders/STLLoader.js:316	js/polynomial-redos	Existing on main at a6ac092; branch only changes package import/doc strings in this file
#20	examples/jsm/loaders/KTX2Loader.js:589	js/missing-origin-check	Existing on main at a6ac092; branch only changes package import/doc strings in this file
#45	editor/js/Viewport.js:151	js/unused-local-variable	Existing on main at a6ac092; branch only changes package import strings in this file

All seven alerts were created on August 7, 2026 at 14:34:10 UTC and remain open. No alert was dismissed or disabled. The required protected checks passed, including the Node 26 build/entry-point parity and the lint/unit/add-on/examples gate.