@zixcel/view-delivery 0.0.0-stage → 0.10.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-PREVIOUS

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hatter contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,4 @@
+
+delivery-server
+Copyright 2026 HAT Inc.
+See LICENSE for the selected terms. Prior grants and third-party licenses retain their respective terms.

package/README.md

@@ -1,3 +1,38 @@
-# Temporary Holding Version
+# @zixcel/view-delivery
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Serve reviewed view snapshots and trusted release assets from a configured display host.
+
+## What you can do
+
+- Deliver an initial view with exact source references.
+- Connect declared state updates and cancellation.
+
+## Current scope
+
+The current host is owner-local. Public HTTPS, authentication and placement require separate deployment validation.
+
+Package distribution is not activated by this documentation. Use the checked-in source and the declared dependency versions; published availability must be verified separately.
+
+## Getting started
+
+The source uses registry version declarations for the generic Zixcel and Crowsi dependencies. Initial publication is pending; the migration verifier installs reviewed archives together in an isolated consumer. Product consumers retain their current released names until the new registry artifacts are verified.
+
+Use the package manager matching the checked-in lockfile and the Node.js version declared in `package.json` or the development configuration. Run from this repository:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm test
+```
+
+## Documentation and source
+
+[Usage guide](docs/getting-started.md)
+
+[Implementation and public interfaces](src) · [Verification cases](test) · [Contributing](CONTRIBUTING.md) · [Security reporting](SECURITY.md) · [License](LICENSE) · [Attribution notices](NOTICE)
+
+## Product boundary
+
+The host requires an explicit owner, title, wire contract and allowed outcome
+owner list. Cookie and request-header names may be supplied by the product;
+defaults are generic. The Hatter browser UI remains in the product repository.
+This workspace owns only the host and delivery contracts.

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "@zixcel/view-delivery",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.10.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "description": "Bounded trusted document and asset delivery; existing Crowsi STATE transport only",
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "LICENSE-PREVIOUS"
+  ],
+  "exports": {
+    ".": {
+      "types": "./src/index.d.mts",
+      "import": "./src/index.mjs"
+    }
+  },
+  "dependencies": {
+    "@zixcel/view-delivery-contracts": "0.10.0",
+    "@crowsi/transport-foundation": "0.10.0",
+    "@crowsi/browser-security": "0.10.0",
+    "ws": "8.21.2",
+    "@types/node": "24.12.0",
+    "@zixcel/projection-contracts": "0.10.0"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "types": "./src/index.d.mts",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zixcel/view-delivery.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  }
+}

package/src/index.d.mts

@@ -0,0 +1,51 @@
+import type {Server} from 'node:http'
+import type {Asset,Delivery} from '@zixcel/view-delivery-contracts'
+import type {Json} from '@zixcel/projection-contracts/client'
+
+export interface RequestContext {readonly signal:AbortSignal}
+export interface DocumentContext extends RequestContext {readonly assets:readonly Asset[]}
+export interface CommandContext extends RequestContext {
+  readonly requestRef:string
+  observe(value:unknown):void
+}
+export interface DeliverySite {
+  document(url:URL,context:DocumentContext):Promise<{envelope:Delivery;bootstrap:Readonly<Record<string,Json>>}>|{envelope:Delivery;bootstrap:Readonly<Record<string,Json>>}
+  read(url:URL,context:RequestContext):unknown|Promise<unknown>
+  command(url:URL,value:unknown,context:CommandContext):unknown|Promise<unknown>
+  live(request:unknown):unknown|Promise<unknown>
+  close?():void|Promise<void>
+}
+export interface TrustedAsset {
+  readonly path:string
+  readonly bytes:Uint8Array
+  readonly bytesLength:number
+  readonly digest:string
+  readonly kind:'script'|'style'
+}
+export interface DeliveryServer {
+  readonly server:Server
+  notify():void
+  inspect():{readonly alive:boolean;readonly activeRequests:number;readonly transport:unknown}
+  listen():Promise<void>
+  close():Promise<void>
+}
+export interface DeliveryPolicy {
+  readonly owner:string
+  readonly title:string
+  readonly contract:string
+  readonly allowedOwners:readonly string[]
+  readonly cookieName?:string
+  readonly csrfHeader?:string
+  readonly nonceHeader?:string
+  readonly readinessHeader?:string
+}
+export interface DeliveryServerOptions {
+  readonly policy:DeliveryPolicy
+  readonly origin:string
+  readonly site:DeliverySite
+  readonly assets:readonly TrustedAsset[]
+  readonly readinessToken?:string|null
+  readonly onFailure?:((failure:unknown)=>void)|null
+  readonly onOutcome?:((outcome:unknown)=>void)|null
+}
+export function createDeliveryServer(options:DeliveryServerOptions):DeliveryServer

package/src/index.mjs

@@ -0,0 +1,225 @@
+// Caller-owned snapshot delivery. Crowsi owns framing/session/ACK/recovery mechanisms.
+import http from 'node:http'
+import {createHash,timingSafeEqual,randomUUID} from 'node:crypto'
+import {WebSocketServer} from 'ws'
+import {StateSocketServer} from '@crowsi/transport-foundation/state-socket'
+import {Budget,limitsFor} from '@crowsi/transport-foundation'
+import {SessionAuthority} from '@crowsi/browser-security/access'
+import {parseOwnerOrigin,assessRequestBoundary} from '@crowsi/browser-security/boundary'
+import {validateDelivery,bounds,requirement} from '@zixcel/view-delivery-contracts'
+
+const fail=code=>{throw Object.assign(Error(code),{code})}
+const defaultCookieName='view_delivery_session'
+const headers={
+ 'content-security-policy':"default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'self'",
+ 'referrer-policy':'no-referrer','x-content-type-options':'nosniff','x-frame-options':'DENY',
+ 'permissions-policy':'camera=(), microphone=(), geolocation=(), payment=()','cache-control':'no-store'
+}
+const encode=(value,maximum=bounds.documentBytes)=>{
+ // Site/owner outputs are already bounded data. Refuse expansion before sending.
+ let nodes=0,total=0
+ const add=bytes=>{total+=bytes;if(total>maximum)fail('DeliveryLimitExceeded')}
+ function check(v,depth){
+  if(++nodes>32768||depth>20)fail('DeliveryLimitExceeded')
+  if(typeof v==='string'){if(v.length>maximum)fail('DeliveryLimitExceeded');add(Buffer.byteLength(v)+2);return}
+  if(v===null||typeof v==='boolean'){add(5);return}
+  if(typeof v==='number'&&Number.isFinite(v)){add(24);return}
+  if(!v||typeof v!=='object'||!Array.isArray(v)&&Object.getPrototypeOf(v)!==Object.prototype)fail('InvalidDeliveryData')
+  const keys=Object.keys(v);if(keys.length>4096)fail('DeliveryLimitExceeded');add(keys.length+2)
+  for(const key of keys){const d=Object.getOwnPropertyDescriptor(v,key);if(d.get||d.set||key==='toJSON')fail('InvalidDeliveryData');add(Buffer.byteLength(key)+3);check(d.value,depth+1)}
+ }
+ check(value,0);const bytes=Buffer.from(JSON.stringify(value));if(bytes.length>maximum)fail('DeliveryLimitExceeded');return bytes
+}
+async function body(request,signal){
+ const h=request.headers,raw=h['content-length']
+ if(h['content-encoding']||h['transfer-encoding']||!/^application\/json(?:\s*;.*)?$/i.test(h['content-type']??'')||!(/^[1-9][0-9]{0,5}$/).test(raw??''))fail('InvalidInput')
+ const size=Number(raw);if(size>bounds.requestBytes)fail('DeliveryLimitExceeded')
+ const data=Buffer.alloc(size);let used=0
+ for await(const chunk of request){if(signal.aborted)fail('DeliveryCancelled');if(used+chunk.length>size)fail('DeliveryLimitExceeded');chunk.copy(data,used);used+=chunk.length}
+ if(used!==size)fail('InvalidInput')
+ try{return JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(data))}catch{fail('InvalidInput')}
+}
+function sessionId(request,cookieName){
+ const cookie=request.headers.cookie??'';if(cookie.length>8192)fail('SessionRejected')
+ const values=cookie.split(';').map(s=>s.trim()).filter(s=>s.startsWith(cookieName+'='))
+ if(values.length!==1)fail('SessionRejected');return values[0].slice(cookieName.length+1)
+}
+// Crowsi's access contract currently uses closed Error messages, not .code.
+// Recognize only those published constants; never expose arbitrary exception text.
+const accessCodes=new Set(['host-rejected','origin-rejected','origin-required','fetch-site-rejected','session-capacity-reached','session-rejected','session-expired','csrf-rejected',
+ 'request-nonce-invalid','request-replayed','request-nonce-capacity-reached'].map(c=>'crowsi-browser-security-'+c))
+const deliveryCodes=new Set(['SessionRejected','InvalidInput','DeliveryLimitExceeded','DeliveryCancelled','DeliveryTimedOut','InvalidDeliveryData',
+ 'InvalidAsset','NotFound','MethodNotAllowed','ProjectionCancelled','ProjectionRuntimeClosed','ProjectionQueueFull',
+ 'ProjectionStoreBusy','ProjectionStoreCorrupt','SourceUnavailable','SourceNotRetained','SourceRevisionMismatch',
+ 'ProjectionUnavailable','ProjectionLimitExceeded','ProjectionExecutionTimeout','StaleSceneAction','SceneUnavailable',
+ 'InteractionUnavailable','InvalidProjection','OriginRequired','SocketUnavailable'])
+function sourceFailure(error,operation,observation){
+ const access=accessCodes.has(error?.message),typed=error?.failure
+ let original
+ try{original=requirement({ref:typed.requirementRef,owner:typed.owner,state:'Unavailable',failure:typed,setup:null}).failure}catch{}
+ const code=original?.code??(access?error.message:deliveryCodes.has(error?.code)?error.code:
+  typeof typed?.code==='string'&&/^[a-z][a-z0-9-]{2,95}$/.test(typed.code)?typed.code:'UnhandledDeliveryFault')
+ return {code,canonical:{state:observation.receiptRef?'Committed':['DELIVERY_REJECTED','NOT_DISPATCHED'].includes(observation.stage)?'NotDispatched':observation.stage==='OWNER_REJECTED'?'Rejected':'Unknown',receiptRef:observation.receiptRef},ownerFailure:{owner:original?.owner??(access?'crowsi/browser-security':observation.owner),operation:original?.operation??observation.operation??operation,
+  code,requirementRef:original?.requirementRef??'delivery:server',outcomeStage:observation.stage,uncertain:observation.stage==='OUTCOME_UNCERTAIN',
+  requestRef:observation.requestRef,managementRequestRef:observation.managementRequestRef??null,receiptRef:observation.receiptRef,detail:original?.detail??null}}
+}
+function safeDocument(envelope,bootstrap,title){
+ const serialized=encode({envelope,bootstrap}).toString().replace(/</g,'\\u003c').replace(/>/g,'\\u003e').replace(/&/g,'\\u0026')
+ const styles=envelope.assets.filter(a=>a.kind==='style').map(a=>`<link rel="stylesheet" href="${a.path}">`).join('')
+ const scripts=envelope.assets.filter(a=>a.kind==='script').map(a=>`<script type="module" src="${a.path}"></script>`).join('')
+ return Buffer.from(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title>${styles}</head><body><main id="app" aria-busy="true"><p role="status">Loading exact state…</p></main><script id="delivery-state" type="application/json">${serialized}</script>${scripts}</body></html>`)
+}
+export function createDeliveryServer({origin,site,assets,readinessToken=null,onFailure=null,onOutcome=null,policy}){
+ if(!policy||typeof policy.owner!=='string'||!policy.owner||policy.owner.length>128||
+  typeof policy.contract!=='string'||!policy.contract||policy.contract.length>128||typeof policy.title!=='string'||!policy.title||policy.title.length>128||/[<>&]/.test(policy.title)||
+  !Array.isArray(policy.allowedOwners)||policy.allowedOwners.length>16||policy.allowedOwners.some(owner=>typeof owner!=='string'||!owner||owner.length>128))fail('InvalidDeliveryPolicy')
+ const headerPolicy={cookieName:policy.cookieName??defaultCookieName,csrfHeader:policy.csrfHeader??'x-delivery-csrf',nonceHeader:policy.nonceHeader??'x-delivery-request-nonce',readinessHeader:policy.readinessHeader??'x-delivery-readiness'}
+ if(Object.values(headerPolicy).some(value=>typeof value!=='string'||value.length>64||!/[a-z]/.test(value)||!/^[a-z0-9_-]+$/.test(value)))fail('InvalidDeliveryPolicy')
+ const ownerPolicy=Object.freeze({owner:policy.owner,title:policy.title,contract:policy.contract,allowedOwners:Object.freeze([...policy.allowedOwners]),...headerPolicy})
+ const boundary=parseOwnerOrigin(origin),authority=new SessionAuthority(),inflight=new Set(),controllers=new Set()
+ const budget=new Budget(limitsFor(bounds.documentBytes,{pendingMessages:bounds.requests})),assetMap=new Map()
+ for(const asset of assets){
+  const {bytes,...descriptor}=asset,content=Buffer.from(bytes)
+  if(content.length!==descriptor.bytesLength||content.length>bounds.assetBytes)fail('InvalidAsset')
+  const digest=createHash('sha256').update(content).digest('hex')
+  if(digest!==descriptor.digest||assetMap.has(descriptor.path)||!/^\/assets\/[a-zA-Z0-9._-]{1,100}$/.test(descriptor.path)||!['script','style'].includes(descriptor.kind))fail('InvalidAsset')
+  assetMap.set(descriptor.path,{content,descriptor:{path:descriptor.path,digest,bytes:content.length,kind:descriptor.kind}})
+ }
+ if(assetMap.size<1||assetMap.size>bounds.assets)fail('InvalidAsset')
+ let closing=false,closePromise=null
+ const authorize=request=>{
+  const reason=assessRequestBoundary(boundary,{method:request.method,host:request.headers.host,origin:request.headers.origin,fetchSite:request.headers['sec-fetch-site']})
+  if(reason)fail(reason)
+ }
+ const authenticate=request=>{const id=sessionId(request,ownerPolicy.cookieName);authority.authenticate(id);return id}
+ const connection=(request,response)=>{
+  let current
+  try{const id=authenticate(request);current={sessionId:id,...authority.authenticate(id)}}catch{current=authority.issue()}
+  response.setHeader('set-cookie',`${ownerPolicy.cookieName}=${current.sessionId}; Path=/; HttpOnly; SameSite=Strict; Max-Age=28800${boundary.protocol==='https:'?'; Secure':''}`)
+  return {csrf:current.csrfToken,expiresAtUnixMs:current.expiresAt}
+ }
+ const hub=new StateSocketServer({authorize:peer=>{authorize(peer.request);if(peer.request.headers.origin!==origin)fail('OriginRequired');return authenticate(peer.request)},read:request=>site.live(request)})
+ const sockets=new WebSocketServer({noServer:true,maxPayload:1048578,perMessageDeflate:false,clientTracking:true})
+ const send=(response,status,value)=>{const bytes=encode(value);response.writeHead(status,{'content-type':'application/json; charset=utf-8','content-length':bytes.length});response.end(bytes)}
+ async function handle(request,response,signal,observation){
+  for(const [key,value]of Object.entries(headers))response.setHeader(key,value)
+  authorize(request)
+  if(request.url.length>4096)fail('InvalidInput')
+  const url=new URL(request.url,origin),pathname=url.pathname
+  if(request.method==='GET'&&pathname==='/api/ready'){
+   const provided=Buffer.from(String(request.headers[ownerPolicy.readinessHeader]??'')),expected=Buffer.from(readinessToken??'')
+   if(!expected.length||provided.length!==expected.length||!timingSafeEqual(provided,expected))return send(response,404,{error:{code:'NotFound'}})
+   observation.stage='NOT_DISPATCHED';response.writeHead(204);response.end();return // liveness only, never ProductReady
+  }
+  if(request.method==='GET'&&assetMap.has(pathname)){
+   observation.stage='NOT_DISPATCHED'
+   const asset=assetMap.get(pathname);response.writeHead(200,{'content-type':asset.descriptor.kind==='script'?'text/javascript; charset=utf-8':'text/css; charset=utf-8','content-length':asset.content.length});response.end(asset.content);return
+  }
+  if(request.method==='POST'&&pathname==='/api/connection'){
+   const value=await body(request,signal);if(!value||Array.isArray(value)||Object.keys(value).length)fail('InvalidInput')
+   observation.stage='NOT_DISPATCHED';send(response,200,connection(request,response));return
+  }
+  if(request.method==='GET'&&!pathname.startsWith('/api/')){
+   observation.stage='NOT_DISPATCHED'
+   const csrf=connection(request,response)
+   const {envelope,bootstrap}=await site.document(url,{signal,assets:[...assetMap.values()].map(a=>a.descriptor)})
+   validateDelivery(envelope,ownerPolicy.contract)
+   if(JSON.stringify(envelope.assets)!==JSON.stringify([...assetMap.values()].map(a=>a.descriptor)))fail('InvalidAsset')
+   const document=safeDocument(envelope,{...bootstrap,...csrf},ownerPolicy.title)
+   if(document.length>bounds.documentBytes)fail('DeliveryLimitExceeded')
+   response.writeHead(200,{'content-type':'text/html; charset=utf-8','content-length':document.length});response.end(document);return
+  }
+  authenticate(request)
+  if(request.method==='GET'){observation.stage='NOT_DISPATCHED';send(response,200,await site.read(url,{signal}));return}
+  if(request.method!=='POST')return send(response,405,{error:{code:'MethodNotAllowed'}})
+  authority.authorizeMutation(sessionId(request,ownerPolicy.cookieName),request.headers[ownerPolicy.csrfHeader],request.headers[ownerPolicy.nonceHeader])
+  const value=await body(request,signal)
+  observation.stage='OUTCOME_UNCERTAIN'
+  // The site was entered, not proof of physical dispatch or canonical commit.
+  // Only exact owner evidence may refine this transient observation.
+  const observe=value=>{
+   // Trusted site supplies evidence only. Ignore malformed observations; never
+   // change execution branching, mint identity, or persist a competing receipt.
+   if(!value||!['NOT_DISPATCHED','OWNER_REJECTED','OUTCOME_UNCERTAIN','OWNER_COMMITTED','PUBLICATION_FAILED_AFTER_COMMIT'].includes(value.stage))return
+   if(typeof value.owner!=='string'||!ownerPolicy.allowedOwners.includes(value.owner))return
+   if(typeof value.operation!=='string'||!/^[a-z][a-z0-9]*(?:\/[a-z][a-zA-Z0-9]*)+$/.test(value.operation))return
+   if(value.receiptRef!==undefined&&value.receiptRef!==null&&!/^[a-f0-9]{64}$/.test(value.receiptRef))return
+   if(['OWNER_COMMITTED','PUBLICATION_FAILED_AFTER_COMMIT'].includes(value.stage)&&!value.receiptRef)return
+   if(observation.receiptRef&&value.receiptRef!==observation.receiptRef)return
+   if(value.managementRequestRef!==undefined&&value.managementRequestRef!==null&&(!Number.isSafeInteger(value.managementRequestRef)||value.managementRequestRef<1))return
+   Object.assign(observation,{stage:value.stage,owner:value.owner,operation:value.operation,receiptRef:value.receiptRef??null})
+   if(value.managementRequestRef!==undefined)observation.managementRequestRef=value.managementRequestRef
+  }
+  const result=await site.command(url,value,{signal,observe,requestRef:observation.requestRef})
+  const receipt=result?.canonical?.receiptRef
+  if(typeof receipt==='string'&&/^[a-f0-9]{64}$/.test(receipt)){
+   observation.receiptRef=receipt;observation.stage=result.projection?.state==='FailedTyped'?'PUBLICATION_FAILED_AFTER_COMMIT':'OWNER_COMMITTED'
+  }
+  if(!response.writableEnded&&!response.destroyed)send(response,200,result)
+ }
+ const server=http.createServer({maxHeaderSize:16384,headersTimeout:5000,requestTimeout:5000,keepAliveTimeout:2000},(request,response)=>{
+  if(closing){response.writeHead(503);response.end();return}
+  let release;try{release=budget.reserve(0)}catch{send(response,503,{error:{code:'DeliveryQueueFull'}});return}
+  const controller=new AbortController();controllers.add(controller)
+  const abort=()=>controller.abort();response.once('close',abort)
+  const observation={requestRef:randomUUID(),owner:ownerPolicy.owner,stage:'DELIVERY_REJECTED',receiptRef:null}
+  // Paths and query strings are caller input, not safe diagnostic labels.
+  const path=request.url?.split('?')[0],operation=['/api/subjects','/api/interactions','/api/site-actions','/api/setup','/api/connection','/api/document'].includes(path)?path:'delivery/request'
+  const recordFailure=error=>{
+   const failure=sourceFailure(error,operation,observation)
+   try{onFailure?.(failure)}catch{}
+   return failure
+  }
+  // Preserve the finite HTTP observer deadline, but send a truthful outcome
+  // rather than resetting a reused socket (browsers may retransmit that POST).
+  // This does not cancel an accepted owner action or renew its execution budget.
+  const timer=setTimeout(()=>{
+   if(!response.writableEnded&&!response.destroyed){
+    const failure=recordFailure(Object.assign(Error('DeliveryTimedOut'),{code:'DeliveryTimedOut'}))
+    send(response,504,{error:failure})
+   }
+   controller.abort()
+  },bounds.bodyMs)
+  const work=handle(request,response,controller.signal,observation).catch(error=>{
+   const failure=recordFailure(error)
+   // Read-only diagnostic callback: no inherited preload, payload, credentials or
+   // stack. A diagnostic consumer cannot alter the execution branch by throwing.
+   if(!response.headersSent&&!response.destroyed)send(response,400,{error:failure})
+   else if(!response.writableEnded&&!response.destroyed)response.destroy()
+  }).finally(()=>{
+   try{onOutcome?.({...observation,operation:observation.operation??operation,httpStatus:response.headersSent?response.statusCode:null})}catch{}
+   clearTimeout(timer);response.off('close',abort);release();controllers.delete(controller);inflight.delete(work)
+  });inflight.add(work)
+ })
+ server.maxConnections=32;server.maxRequestsPerSocket=128
+ server.on('upgrade',(request,socket,head)=>{
+  try{if(closing||request.url!=='/api/projection-live'||hub.inspect().connections>=8)fail('SocketUnavailable');authorize(request);authenticate(request);if(request.headers.origin!==origin)fail('OriginRequired')}
+  catch{socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return}
+  sockets.handleUpgrade(request,socket,head,websocket=>{
+   const peer={request,websocket,close:(code,reason)=>websocket.close(code,reason)}
+   websocket.on('message',data=>hub.message(peer,data));websocket.on('close',()=>hub.disconnect(peer));websocket.on('error',()=>hub.disconnect(peer));hub.open(peer)
+  })
+ })
+ return {server,notify:()=>hub.notify(),inspect:()=>({alive:server.listening,activeRequests:inflight.size,transport:hub.inspect()}),
+  async listen(){await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(Number(boundary.port),'127.0.0.1',resolve)})},
+  close(){
+   if(closePromise)return closePromise
+   closing=true
+   // Closing delivery revokes intake and releases transport, not physical work.
+   // Let the owning site close its resources BEFORE awaiting its pending calls:
+   // their completion may depend on that close. Join one lifecycle promise even
+   // for concurrent close callers, and preserve an owner cleanup failure.
+   closePromise=Promise.resolve().then(async()=>{
+    for(const c of controllers)c.abort()
+    hub.close();for(const ws of sockets.clients)ws.terminate()
+    const transportClosed=new Promise(resolve=>sockets.close(resolve))
+    const httpClosed=new Promise(resolve=>server.close(resolve))
+    server.closeIdleConnections();server.closeAllConnections()
+    const ownerClosed=Promise.resolve().then(()=>site.close?.())
+    const results=await Promise.allSettled([transportClosed,httpClosed,ownerClosed,...inflight])
+    const failures=results.filter(result=>result.status==='rejected').map(result=>result.reason)
+    if(failures.length)throw new AggregateError(failures,'Delivery shutdown failed')
+   })
+   return closePromise
+  }}
+}