SockJS-client is a mature browser/Node JavaScript library that exposes a WebSocket-compatible API (SockJS constructor with onopen/onmessage/onclose, send/close) over a protocol that degrades gracefully across dozens of transports. In production it first tries native WebSockets, then falls back through xhr-streaming, xdr-streaming, eventsource, htmlfile, xhr-polling, xdr-polling, iframe-mediated variants, and jsonp-polling. The connection flow is: validate the URL against the HTML5 WebSocket constructor spec, fetch the server's /info endpoint to measure RTT and capability flags (cookie_needed, websocket support, base_url), compute a dynamic RFC 2988-style retransmission timeout, then walk an ordered transport list with per-transport round-trip timeouts until one opens. Incoming frames are type-prefixed ('o' open, 'h' heartbeat, 'a' batched messages, 'm' message, 'c' close); outgoing messages are JSON-array framed with aggressive Unicode escaping. Architecturally it is a modular CommonJS library bundled with browserify into a UMD global (dist/sockjs.js) plus a newer ESM build (dist/sockjs-esm.js) and handwritten TypeScript declarations. lib/main.js is the core state machine; each transport is split into senders (xhr-cors, xhr-local, xdr, jsonp) and receivers (incremental XHR streaming parser, eventsource, htmlfile, jsonp) composed by shared glue in lib/transport/lib (ajax-based, sender-receiver, buffered-sender, polling). A DOM2-style EventTarget/EventEmitter layer provides addEventListener and on* semantics. Browser versus Node differences are resolved via package.json 'browser' field remapping: faye-websocket <-> native WebSocket, eventsource package <-> global EventSource, Node crypto <-> window.crypto. Because the library must support IE6-9 era browsers, the source is deliberately ES5 with vendored es5-shim pieces. The engineering craftsmanship is genuine: the XHR receiver tracks a persistent buffer offset so streaming readyState=3 chunks are parsed incrementally without re-scanning; lib/utils/escape.js lazily unrolls a 65,536-character lookup table only when a message contains characters that browsers mangle on the wire; the JSONP receiver handles IE9's onerror/onreadystatechange race with a loadedOkay flag and the htmlFor/onclick script-execution trick; iframe transports enforce postMessage origin equality and window-ID correlation; unload/pagehide lifecycle hooks clean up sockets and iframes. The Node WebSocket transport propagates real backpressure (send() returning false plus a drain event) and the test suite proves it against an actual faye-websocket socket. Maintenance is low-velocity but real: the last commit is recent, CI runs Node 18/20/22, and the 1.6.x history is dominated by CVE-driven dependency bumps (url-parse, eventsource, minimist, faye-websocket) plus the 1.6.2 ESM/types addition. Drift is medium: the gulp+browserify build chain is dated, .nvmrc pins Node 12 while CI tests 18/20/22, lib/version.js lags package.json (1.6.1 vs 1.6.2), and several TODO comments remain. None of this affects the library's contract; it is still the de-facto SockJS client and remains safe to depend on.