@zixcel/view-delivery 0.10.2 → 0.10.5

package/README.md

@@ -40,3 +40,9 @@ This workspace owns only the host and delivery contracts.
 ## Release provenance
 
 Starting with 0.10.1, releases use GitHub Actions OIDC trusted publishing from `zixcel/view-delivery` (`publish-npm.yml`), without a stored npm publishing token. The workflow verifies reviewed archive hashes and requires npm provenance metadata. Check the published version on npm and verify registry signatures and provenance with `npm audit signatures` in an installed consumer project. Package runtime behavior and API contracts are unchanged by this release.
+
+## Node.js security baseline
+
+Use a supported Node.js security release for Node-based build, delivery and consumer processes: at least 22.23.4, 24.22.1 or 26.12.1. The renderer runs in the browser and does not bundle Node. Updating an npm library does not update the caller's Node executable. The October 21, 2026 security fixes include TLS, DNS, HTTP and Brotli handling; operator-managed runtimes must be updated independently. GitHub Actions pins select the shell/build runtime, not the GitHub-managed runtime of JavaScript Actions.
+
+Official advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@zixcel/view-delivery",
-  "version": "0.10.2",
+  "version": "0.10.5",
   "type": "module",
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
+  },
   "license": "Apache-2.0",
   "description": "Bounded trusted document and asset delivery; existing Crowsi STATE transport only",
   "files": [
@@ -18,15 +21,12 @@
     }
   },
   "dependencies": {
-    "@zixcel/view-delivery-contracts": "0.10.2",
-    "@crowsi/transport-foundation": "0.10.0",
     "@crowsi/browser-security": "0.10.0",
-    "ws": "8.21.2",
+    "@crowsi/transport-foundation": "0.10.0",
     "@types/node": "24.12.0",
-    "@zixcel/projection-contracts": "0.10.3"
-  },
-  "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "@zixcel/projection-contracts": "0.10.4",
+    "@zixcel/view-delivery-contracts": "0.10.4",
+    "ws": "8.22.0"
   },
   "types": "./src/index.d.mts",
   "repository": {
@@ -37,5 +37,19 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
+  },
+  "keywords": [
+    "data-presentation",
+    "artifact-distribution",
+    "api-server",
+    "typescript"
+  ],
+  "devDependencies": {
+    "typescript": "7.0.2"
+  },
+  "scripts": {
+    "test": "node --test --test-concurrency=1 test/*.test.mts",
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.build.json --noEmit"
   }
-}
+}

package/src/failure.d.mts

@@ -0,0 +1,2 @@
+import type { Observation, DeliveryFailure } from './types.mjs';
+export declare function sourceFailure(value: unknown, operation: string, observation: Observation): DeliveryFailure;

package/src/failure.mjs

@@ -0,0 +1,32 @@
+import { requirement } from '@zixcel/view-delivery-contracts';
+import { record } from './wire.mjs';
+const accessCodes = new Set(['host-rejected', 'origin-rejected', 'origin-required', 'fetch-site-rejected', 'session-capacity-reached', 'session-rejected', 'session-expired', 'csrf-rejected',
+    'request-nonce-invalid', 'request-replayed', 'request-nonce-capacity-reached'].map(c => 'crowsi-browser-security-' + c));
+const deliveryCodes = new Set(['SessionRejected', 'InvalidInput', 'DeliveryLimitExceeded', 'DeliveryCancelled', 'DeliveryTimedOut', 'InvalidDeliveryData',
+    'InvalidAsset', 'NotFound', 'MethodNotAllowed', 'ProjectionCancelled', 'ProjectionRuntimeClosed', 'ProjectionQueueFull',
+    'ProjectionStoreBusy', 'ProjectionStoreCorrupt', 'SourceUnavailable', 'SourceNotRetained', 'SourceRevisionMismatch',
+    'ProjectionUnavailable', 'ProjectionLimitExceeded', 'ProjectionExecutionTimeout', 'StaleSceneAction', 'SceneUnavailable',
+    'InteractionUnavailable', 'InvalidProjection', 'OriginRequired', 'SocketUnavailable']);
+function classifyFailure(value, operation, observation) {
+    const error = record(value);
+    const message = error.message, errorCode = error.code, typed = record(error.failure), typedCode = typed.code;
+    const access = typeof message === 'string' && accessCodes.has(message);
+    let original = null;
+    try {
+        original = requirement({ ref: typed.requirementRef, owner: typed.owner, state: 'Unavailable', failure: typed, setup: null }).failure;
+    }
+    catch { }
+    const code = original?.code ?? (access ? String(message) : typeof errorCode === 'string' && deliveryCodes.has(errorCode) ? errorCode :
+        typeof typedCode === 'string' && /^[a-z][a-z0-9-]{2,95}$/.test(typedCode) ? typedCode : 'UnhandledDeliveryFault');
+    return { code, canonical: { state: observation.receiptRef ? 'Committed' : ['DELIVERY_REJECTED', 'NOT_DISPATCHED'].includes(observation.stage) ? 'NotDispatched' : observation.stage === 'OWNER_REJECTED' ? 'Rejected' : 'Unknown', receiptRef: observation.receiptRef }, ownerFailure: { owner: original?.owner ?? (access ? 'crowsi/browser-security' : observation.owner), operation: original?.operation ?? observation.operation ?? operation,
+            code, requirementRef: original?.requirementRef ?? 'delivery:server', outcomeStage: observation.stage, uncertain: observation.stage === 'OUTCOME_UNCERTAIN',
+            requestRef: observation.requestRef, managementRequestRef: observation.managementRequestRef ?? null, receiptRef: observation.receiptRef, detail: original?.detail ?? null } };
+}
+export function sourceFailure(value, operation, observation) {
+    try {
+        return classifyFailure(value, operation, observation);
+    }
+    catch {
+        return classifyFailure(undefined, operation, observation);
+    }
+}

package/src/handler.d.mts

@@ -0,0 +1,8 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeliveryServerOptions, Observation } from './types.mjs';
+import type { Prepared } from './prepare.mjs';
+export declare function createHandler(options: DeliveryServerOptions, prepared: Prepared): {
+    authorize: (request: IncomingMessage) => void;
+    authenticate: (request: IncomingMessage) => string;
+    handle: (request: IncomingMessage, response: ServerResponse, signal: AbortSignal, observation: Observation) => Promise<void>;
+};

package/src/handler.mjs

@@ -0,0 +1,121 @@
+import { timingSafeEqual } from 'node:crypto';
+import { assessRequestBoundary } from '@crowsi/browser-security/boundary';
+import { bounds, validateDelivery } from '@zixcel/view-delivery-contracts';
+import { body, headers, header, record, sessionId, safeDocument, send, fail } from './wire.mjs';
+export function createHandler(options, prepared) {
+    const { origin, site, readinessToken } = options, { ownerPolicy, boundary, authority, assetMap } = prepared;
+    const authorize = (request) => {
+        const reason = assessRequestBoundary(boundary, { method: request.method ?? '', host: header(request, 'host'), origin: header(request, 'origin') || undefined, fetchSite: header(request, 'sec-fetch-site') || undefined });
+        if (reason)
+            fail(reason);
+    };
+    const authenticate = (request) => { const id = sessionId(request, ownerPolicy.cookieName); authority.authenticate(id); return id; };
+    const connection = (request, response) => {
+        let current;
+        try {
+            const id = authenticate(request);
+            current = { sessionId: id, ...authority.authenticate(id) };
+        }
+        catch {
+            current = authority.issue();
+        }
+        response.setHeader('set-cookie', `${ownerPolicy.cookieName}=${current.sessionId}; Path=/; HttpOnly; SameSite=Strict; Max-Age=28800${boundary.protocol === 'https:' ? '; Secure' : ''}`);
+        return { csrf: current.csrfToken, expiresAtUnixMs: current.expiresAt };
+    };
+    async function handle(request, response, signal, observation) {
+        for (const [key, value] of Object.entries(headers))
+            response.setHeader(key, value);
+        authorize(request);
+        if (typeof request.url !== 'string' || request.url.length > 4096)
+            fail('InvalidInput');
+        const url = new URL(request.url, origin), pathname = url.pathname;
+        if (request.method === 'GET' && pathname === '/api/ready') {
+            const provided = Buffer.from(String(request.headers[ownerPolicy.readinessHeader] ?? '')), expected = Buffer.from(readinessToken ?? '');
+            if (!expected.length || provided.length !== expected.length || !timingSafeEqual(provided, expected))
+                return send(response, 404, { error: { code: 'NotFound' } });
+            observation.stage = 'NOT_DISPATCHED';
+            response.writeHead(204);
+            response.end();
+            return; // liveness only, never ProductReady
+        }
+        if (request.method === 'GET' && assetMap.has(pathname)) {
+            observation.stage = 'NOT_DISPATCHED';
+            const asset = assetMap.get(pathname);
+            response.writeHead(200, { 'content-type': asset.descriptor.kind === 'script' ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8', 'content-length': asset.content.length });
+            response.end(asset.content);
+            return;
+        }
+        if (request.method === 'POST' && pathname === '/api/connection') {
+            const value = await body(request, signal);
+            if (!value || Array.isArray(value) || Object.keys(value).length)
+                fail('InvalidInput');
+            observation.stage = 'NOT_DISPATCHED';
+            send(response, 200, connection(request, response));
+            return;
+        }
+        if (request.method === 'GET' && !pathname.startsWith('/api/')) {
+            observation.stage = 'NOT_DISPATCHED';
+            const csrf = connection(request, response);
+            if (!site.document)
+                fail('SourceUnavailable');
+            const { envelope, bootstrap } = await site.document(url, { signal, assets: [...assetMap.values()].map(a => a.descriptor) });
+            validateDelivery(envelope, ownerPolicy.contract);
+            if (JSON.stringify(envelope.assets) !== JSON.stringify([...assetMap.values()].map(a => a.descriptor)))
+                fail('InvalidAsset');
+            const document = safeDocument(envelope, { ...bootstrap, ...csrf }, ownerPolicy.title);
+            if (document.length > bounds.documentBytes)
+                fail('DeliveryLimitExceeded');
+            response.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'content-length': document.length });
+            response.end(document);
+            return;
+        }
+        authenticate(request);
+        if (request.method === 'GET') {
+            if (!site.read)
+                fail('SourceUnavailable');
+            observation.stage = 'NOT_DISPATCHED';
+            send(response, 200, await site.read(url, { signal }));
+            return;
+        }
+        if (request.method !== 'POST')
+            return send(response, 405, { error: { code: 'MethodNotAllowed' } });
+        authority.authorizeMutation(sessionId(request, ownerPolicy.cookieName), header(request, ownerPolicy.csrfHeader), header(request, ownerPolicy.nonceHeader));
+        const value = await body(request, signal);
+        observation.stage = 'OUTCOME_UNCERTAIN';
+        // The site was entered, not proof of physical dispatch or canonical commit.
+        // Only exact owner evidence may refine this transient observation.
+        const observe = (input) => {
+            const value = record(input);
+            // Trusted site supplies evidence only. Ignore malformed observations; never
+            // change execution branching, mint identity, or persist a competing receipt.
+            if (typeof value.stage !== 'string' || !['NOT_DISPATCHED', 'OWNER_REJECTED', 'OUTCOME_UNCERTAIN', 'OWNER_COMMITTED', 'PUBLICATION_FAILED_AFTER_COMMIT'].includes(value.stage))
+                return;
+            if (typeof value.owner !== 'string' || !ownerPolicy.allowedOwners.includes(value.owner))
+                return;
+            if (typeof value.operation !== 'string' || !/^[a-z][a-z0-9]*(?:\/[a-z][a-zA-Z0-9]*)+$/.test(value.operation))
+                return;
+            if (value.receiptRef !== undefined && value.receiptRef !== null && (typeof value.receiptRef !== 'string' || !/^[a-f0-9]{64}$/.test(value.receiptRef)))
+                return;
+            if (['OWNER_COMMITTED', 'PUBLICATION_FAILED_AFTER_COMMIT'].includes(value.stage) && !value.receiptRef)
+                return;
+            if (observation.receiptRef && value.receiptRef !== observation.receiptRef)
+                return;
+            if (value.managementRequestRef !== undefined && value.managementRequestRef !== null && (typeof value.managementRequestRef !== 'number' || !Number.isSafeInteger(value.managementRequestRef) || value.managementRequestRef < 1))
+                return;
+            Object.assign(observation, { stage: value.stage, owner: value.owner, operation: value.operation, receiptRef: value.receiptRef ?? null });
+            if (value.managementRequestRef !== undefined)
+                observation.managementRequestRef = value.managementRequestRef;
+        };
+        if (!site.command)
+            fail('SourceUnavailable');
+        const result = await site.command(url, value, { signal, observe, requestRef: observation.requestRef });
+        const receipt = record(record(result).canonical).receiptRef;
+        if (typeof receipt === 'string' && /^[a-f0-9]{64}$/.test(receipt)) {
+            observation.receiptRef = receipt;
+            observation.stage = record(record(result).projection).state === 'FailedTyped' ? 'PUBLICATION_FAILED_AFTER_COMMIT' : 'OWNER_COMMITTED';
+        }
+        if (!response.writableEnded && !response.destroyed)
+            send(response, 200, result);
+    }
+    return { authorize, authenticate, handle };
+}

package/src/index.d.mts

@@ -1,51 +1,3 @@
-import type {Server} from 'node:http'
-import type {Asset,Delivery} from '@zixcel/view-delivery-contracts'
-import type {Json} from '@zixcel/projection-contracts/client'
-
-export interface RequestContext {readonly signal:AbortSignal}
-export interface DocumentContext extends RequestContext {readonly assets:readonly Asset[]}
-export interface CommandContext extends RequestContext {
-  readonly requestRef:string
-  observe(value:unknown):void
-}
-export interface DeliverySite {
-  document(url:URL,context:DocumentContext):Promise<{envelope:Delivery;bootstrap:Readonly<Record<string,Json>>}>|{envelope:Delivery;bootstrap:Readonly<Record<string,Json>>}
-  read(url:URL,context:RequestContext):unknown|Promise<unknown>
-  command(url:URL,value:unknown,context:CommandContext):unknown|Promise<unknown>
-  live(request:unknown):unknown|Promise<unknown>
-  close?():void|Promise<void>
-}
-export interface TrustedAsset {
-  readonly path:string
-  readonly bytes:Uint8Array
-  readonly bytesLength:number
-  readonly digest:string
-  readonly kind:'script'|'style'
-}
-export interface DeliveryServer {
-  readonly server:Server
-  notify():void
-  inspect():{readonly alive:boolean;readonly activeRequests:number;readonly transport:unknown}
-  listen():Promise<void>
-  close():Promise<void>
-}
-export interface DeliveryPolicy {
-  readonly owner:string
-  readonly title:string
-  readonly contract:string
-  readonly allowedOwners:readonly string[]
-  readonly cookieName?:string
-  readonly csrfHeader?:string
-  readonly nonceHeader?:string
-  readonly readinessHeader?:string
-}
-export interface DeliveryServerOptions {
-  readonly policy:DeliveryPolicy
-  readonly origin:string
-  readonly site:DeliverySite
-  readonly assets:readonly TrustedAsset[]
-  readonly readinessToken?:string|null
-  readonly onFailure?:((failure:unknown)=>void)|null
-  readonly onOutcome?:((outcome:unknown)=>void)|null
-}
-export function createDeliveryServer(options:DeliveryServerOptions):DeliveryServer
+import type { DeliveryServerOptions, DeliveryServer } from './types.mjs';
+export type * from './types.mjs';
+export declare function createDeliveryServer(options: DeliveryServerOptions): DeliveryServer;

package/src/index.mjs

@@ -1,225 +1,144 @@
-// Caller-owned snapshot delivery. Crowsi owns framing/session/ACK/recovery mechanisms.
-import http from 'node:http'
-import {createHash,timingSafeEqual,randomUUID} from 'node:crypto'
-import {WebSocketServer} from 'ws'
-import {StateSocketServer} from '@crowsi/transport-foundation/state-socket'
-import {Budget,limitsFor} from '@crowsi/transport-foundation'
-import {SessionAuthority} from '@crowsi/browser-security/access'
-import {parseOwnerOrigin,assessRequestBoundary} from '@crowsi/browser-security/boundary'
-import {validateDelivery,bounds,requirement} from '@zixcel/view-delivery-contracts'
-
-const fail=code=>{throw Object.assign(Error(code),{code})}
-const defaultCookieName='view_delivery_session'
-const headers={
- 'content-security-policy':"default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'self'",
- 'referrer-policy':'no-referrer','x-content-type-options':'nosniff','x-frame-options':'DENY',
- 'permissions-policy':'camera=(), microphone=(), geolocation=(), payment=()','cache-control':'no-store'
-}
-const encode=(value,maximum=bounds.documentBytes)=>{
- // Site/owner outputs are already bounded data. Refuse expansion before sending.
- let nodes=0,total=0
- const add=bytes=>{total+=bytes;if(total>maximum)fail('DeliveryLimitExceeded')}
- function check(v,depth){
-  if(++nodes>32768||depth>20)fail('DeliveryLimitExceeded')
-  if(typeof v==='string'){if(v.length>maximum)fail('DeliveryLimitExceeded');add(Buffer.byteLength(v)+2);return}
-  if(v===null||typeof v==='boolean'){add(5);return}
-  if(typeof v==='number'&&Number.isFinite(v)){add(24);return}
-  if(!v||typeof v!=='object'||!Array.isArray(v)&&Object.getPrototypeOf(v)!==Object.prototype)fail('InvalidDeliveryData')
-  const keys=Object.keys(v);if(keys.length>4096)fail('DeliveryLimitExceeded');add(keys.length+2)
-  for(const key of keys){const d=Object.getOwnPropertyDescriptor(v,key);if(d.get||d.set||key==='toJSON')fail('InvalidDeliveryData');add(Buffer.byteLength(key)+3);check(d.value,depth+1)}
- }
- check(value,0);const bytes=Buffer.from(JSON.stringify(value));if(bytes.length>maximum)fail('DeliveryLimitExceeded');return bytes
-}
-async function body(request,signal){
- const h=request.headers,raw=h['content-length']
- if(h['content-encoding']||h['transfer-encoding']||!/^application\/json(?:\s*;.*)?$/i.test(h['content-type']??'')||!(/^[1-9][0-9]{0,5}$/).test(raw??''))fail('InvalidInput')
- const size=Number(raw);if(size>bounds.requestBytes)fail('DeliveryLimitExceeded')
- const data=Buffer.alloc(size);let used=0
- for await(const chunk of request){if(signal.aborted)fail('DeliveryCancelled');if(used+chunk.length>size)fail('DeliveryLimitExceeded');chunk.copy(data,used);used+=chunk.length}
- if(used!==size)fail('InvalidInput')
- try{return JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(data))}catch{fail('InvalidInput')}
-}
-function sessionId(request,cookieName){
- const cookie=request.headers.cookie??'';if(cookie.length>8192)fail('SessionRejected')
- const values=cookie.split(';').map(s=>s.trim()).filter(s=>s.startsWith(cookieName+'='))
- if(values.length!==1)fail('SessionRejected');return values[0].slice(cookieName.length+1)
-}
-// Crowsi's access contract currently uses closed Error messages, not .code.
-// Recognize only those published constants; never expose arbitrary exception text.
-const accessCodes=new Set(['host-rejected','origin-rejected','origin-required','fetch-site-rejected','session-capacity-reached','session-rejected','session-expired','csrf-rejected',
- 'request-nonce-invalid','request-replayed','request-nonce-capacity-reached'].map(c=>'crowsi-browser-security-'+c))
-const deliveryCodes=new Set(['SessionRejected','InvalidInput','DeliveryLimitExceeded','DeliveryCancelled','DeliveryTimedOut','InvalidDeliveryData',
- 'InvalidAsset','NotFound','MethodNotAllowed','ProjectionCancelled','ProjectionRuntimeClosed','ProjectionQueueFull',
- 'ProjectionStoreBusy','ProjectionStoreCorrupt','SourceUnavailable','SourceNotRetained','SourceRevisionMismatch',
- 'ProjectionUnavailable','ProjectionLimitExceeded','ProjectionExecutionTimeout','StaleSceneAction','SceneUnavailable',
- 'InteractionUnavailable','InvalidProjection','OriginRequired','SocketUnavailable'])
-function sourceFailure(error,operation,observation){
- const access=accessCodes.has(error?.message),typed=error?.failure
- let original
- try{original=requirement({ref:typed.requirementRef,owner:typed.owner,state:'Unavailable',failure:typed,setup:null}).failure}catch{}
- const code=original?.code??(access?error.message:deliveryCodes.has(error?.code)?error.code:
-  typeof typed?.code==='string'&&/^[a-z][a-z0-9-]{2,95}$/.test(typed.code)?typed.code:'UnhandledDeliveryFault')
- return {code,canonical:{state:observation.receiptRef?'Committed':['DELIVERY_REJECTED','NOT_DISPATCHED'].includes(observation.stage)?'NotDispatched':observation.stage==='OWNER_REJECTED'?'Rejected':'Unknown',receiptRef:observation.receiptRef},ownerFailure:{owner:original?.owner??(access?'crowsi/browser-security':observation.owner),operation:original?.operation??observation.operation??operation,
-  code,requirementRef:original?.requirementRef??'delivery:server',outcomeStage:observation.stage,uncertain:observation.stage==='OUTCOME_UNCERTAIN',
-  requestRef:observation.requestRef,managementRequestRef:observation.managementRequestRef??null,receiptRef:observation.receiptRef,detail:original?.detail??null}}
-}
-function safeDocument(envelope,bootstrap,title){
- const serialized=encode({envelope,bootstrap}).toString().replace(/</g,'\\u003c').replace(/>/g,'\\u003e').replace(/&/g,'\\u0026')
- const styles=envelope.assets.filter(a=>a.kind==='style').map(a=>`<link rel="stylesheet" href="${a.path}">`).join('')
- const scripts=envelope.assets.filter(a=>a.kind==='script').map(a=>`<script type="module" src="${a.path}"></script>`).join('')
- return Buffer.from(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title>${styles}</head><body><main id="app" aria-busy="true"><p role="status">Loading exact state…</p></main><script id="delivery-state" type="application/json">${serialized}</script>${scripts}</body></html>`)
-}
-export function createDeliveryServer({origin,site,assets,readinessToken=null,onFailure=null,onOutcome=null,policy}){
- if(!policy||typeof policy.owner!=='string'||!policy.owner||policy.owner.length>128||
-  typeof policy.contract!=='string'||!policy.contract||policy.contract.length>128||typeof policy.title!=='string'||!policy.title||policy.title.length>128||/[<>&]/.test(policy.title)||
-  !Array.isArray(policy.allowedOwners)||policy.allowedOwners.length>16||policy.allowedOwners.some(owner=>typeof owner!=='string'||!owner||owner.length>128))fail('InvalidDeliveryPolicy')
- const headerPolicy={cookieName:policy.cookieName??defaultCookieName,csrfHeader:policy.csrfHeader??'x-delivery-csrf',nonceHeader:policy.nonceHeader??'x-delivery-request-nonce',readinessHeader:policy.readinessHeader??'x-delivery-readiness'}
- if(Object.values(headerPolicy).some(value=>typeof value!=='string'||value.length>64||!/[a-z]/.test(value)||!/^[a-z0-9_-]+$/.test(value)))fail('InvalidDeliveryPolicy')
- const ownerPolicy=Object.freeze({owner:policy.owner,title:policy.title,contract:policy.contract,allowedOwners:Object.freeze([...policy.allowedOwners]),...headerPolicy})
- const boundary=parseOwnerOrigin(origin),authority=new SessionAuthority(),inflight=new Set(),controllers=new Set()
- const budget=new Budget(limitsFor(bounds.documentBytes,{pendingMessages:bounds.requests})),assetMap=new Map()
- for(const asset of assets){
-  const {bytes,...descriptor}=asset,content=Buffer.from(bytes)
-  if(content.length!==descriptor.bytesLength||content.length>bounds.assetBytes)fail('InvalidAsset')
-  const digest=createHash('sha256').update(content).digest('hex')
-  if(digest!==descriptor.digest||assetMap.has(descriptor.path)||!/^\/assets\/[a-zA-Z0-9._-]{1,100}$/.test(descriptor.path)||!['script','style'].includes(descriptor.kind))fail('InvalidAsset')
-  assetMap.set(descriptor.path,{content,descriptor:{path:descriptor.path,digest,bytes:content.length,kind:descriptor.kind}})
- }
- if(assetMap.size<1||assetMap.size>bounds.assets)fail('InvalidAsset')
- let closing=false,closePromise=null
- const authorize=request=>{
-  const reason=assessRequestBoundary(boundary,{method:request.method,host:request.headers.host,origin:request.headers.origin,fetchSite:request.headers['sec-fetch-site']})
-  if(reason)fail(reason)
- }
- const authenticate=request=>{const id=sessionId(request,ownerPolicy.cookieName);authority.authenticate(id);return id}
- const connection=(request,response)=>{
-  let current
-  try{const id=authenticate(request);current={sessionId:id,...authority.authenticate(id)}}catch{current=authority.issue()}
-  response.setHeader('set-cookie',`${ownerPolicy.cookieName}=${current.sessionId}; Path=/; HttpOnly; SameSite=Strict; Max-Age=28800${boundary.protocol==='https:'?'; Secure':''}`)
-  return {csrf:current.csrfToken,expiresAtUnixMs:current.expiresAt}
- }
- const hub=new StateSocketServer({authorize:peer=>{authorize(peer.request);if(peer.request.headers.origin!==origin)fail('OriginRequired');return authenticate(peer.request)},read:request=>site.live(request)})
- const sockets=new WebSocketServer({noServer:true,maxPayload:1048578,perMessageDeflate:false,clientTracking:true})
- const send=(response,status,value)=>{const bytes=encode(value);response.writeHead(status,{'content-type':'application/json; charset=utf-8','content-length':bytes.length});response.end(bytes)}
- async function handle(request,response,signal,observation){
-  for(const [key,value]of Object.entries(headers))response.setHeader(key,value)
-  authorize(request)
-  if(request.url.length>4096)fail('InvalidInput')
-  const url=new URL(request.url,origin),pathname=url.pathname
-  if(request.method==='GET'&&pathname==='/api/ready'){
-   const provided=Buffer.from(String(request.headers[ownerPolicy.readinessHeader]??'')),expected=Buffer.from(readinessToken??'')
-   if(!expected.length||provided.length!==expected.length||!timingSafeEqual(provided,expected))return send(response,404,{error:{code:'NotFound'}})
-   observation.stage='NOT_DISPATCHED';response.writeHead(204);response.end();return // liveness only, never ProductReady
-  }
-  if(request.method==='GET'&&assetMap.has(pathname)){
-   observation.stage='NOT_DISPATCHED'
-   const asset=assetMap.get(pathname);response.writeHead(200,{'content-type':asset.descriptor.kind==='script'?'text/javascript; charset=utf-8':'text/css; charset=utf-8','content-length':asset.content.length});response.end(asset.content);return
-  }
-  if(request.method==='POST'&&pathname==='/api/connection'){
-   const value=await body(request,signal);if(!value||Array.isArray(value)||Object.keys(value).length)fail('InvalidInput')
-   observation.stage='NOT_DISPATCHED';send(response,200,connection(request,response));return
-  }
-  if(request.method==='GET'&&!pathname.startsWith('/api/')){
-   observation.stage='NOT_DISPATCHED'
-   const csrf=connection(request,response)
-   const {envelope,bootstrap}=await site.document(url,{signal,assets:[...assetMap.values()].map(a=>a.descriptor)})
-   validateDelivery(envelope,ownerPolicy.contract)
-   if(JSON.stringify(envelope.assets)!==JSON.stringify([...assetMap.values()].map(a=>a.descriptor)))fail('InvalidAsset')
-   const document=safeDocument(envelope,{...bootstrap,...csrf},ownerPolicy.title)
-   if(document.length>bounds.documentBytes)fail('DeliveryLimitExceeded')
-   response.writeHead(200,{'content-type':'text/html; charset=utf-8','content-length':document.length});response.end(document);return
-  }
-  authenticate(request)
-  if(request.method==='GET'){observation.stage='NOT_DISPATCHED';send(response,200,await site.read(url,{signal}));return}
-  if(request.method!=='POST')return send(response,405,{error:{code:'MethodNotAllowed'}})
-  authority.authorizeMutation(sessionId(request,ownerPolicy.cookieName),request.headers[ownerPolicy.csrfHeader],request.headers[ownerPolicy.nonceHeader])
-  const value=await body(request,signal)
-  observation.stage='OUTCOME_UNCERTAIN'
-  // The site was entered, not proof of physical dispatch or canonical commit.
-  // Only exact owner evidence may refine this transient observation.
-  const observe=value=>{
-   // Trusted site supplies evidence only. Ignore malformed observations; never
-   // change execution branching, mint identity, or persist a competing receipt.
-   if(!value||!['NOT_DISPATCHED','OWNER_REJECTED','OUTCOME_UNCERTAIN','OWNER_COMMITTED','PUBLICATION_FAILED_AFTER_COMMIT'].includes(value.stage))return
-   if(typeof value.owner!=='string'||!ownerPolicy.allowedOwners.includes(value.owner))return
-   if(typeof value.operation!=='string'||!/^[a-z][a-z0-9]*(?:\/[a-z][a-zA-Z0-9]*)+$/.test(value.operation))return
-   if(value.receiptRef!==undefined&&value.receiptRef!==null&&!/^[a-f0-9]{64}$/.test(value.receiptRef))return
-   if(['OWNER_COMMITTED','PUBLICATION_FAILED_AFTER_COMMIT'].includes(value.stage)&&!value.receiptRef)return
-   if(observation.receiptRef&&value.receiptRef!==observation.receiptRef)return
-   if(value.managementRequestRef!==undefined&&value.managementRequestRef!==null&&(!Number.isSafeInteger(value.managementRequestRef)||value.managementRequestRef<1))return
-   Object.assign(observation,{stage:value.stage,owner:value.owner,operation:value.operation,receiptRef:value.receiptRef??null})
-   if(value.managementRequestRef!==undefined)observation.managementRequestRef=value.managementRequestRef
-  }
-  const result=await site.command(url,value,{signal,observe,requestRef:observation.requestRef})
-  const receipt=result?.canonical?.receiptRef
-  if(typeof receipt==='string'&&/^[a-f0-9]{64}$/.test(receipt)){
-   observation.receiptRef=receipt;observation.stage=result.projection?.state==='FailedTyped'?'PUBLICATION_FAILED_AFTER_COMMIT':'OWNER_COMMITTED'
-  }
-  if(!response.writableEnded&&!response.destroyed)send(response,200,result)
- }
- const server=http.createServer({maxHeaderSize:16384,headersTimeout:5000,requestTimeout:5000,keepAliveTimeout:2000},(request,response)=>{
-  if(closing){response.writeHead(503);response.end();return}
-  let release;try{release=budget.reserve(0)}catch{send(response,503,{error:{code:'DeliveryQueueFull'}});return}
-  const controller=new AbortController();controllers.add(controller)
-  const abort=()=>controller.abort();response.once('close',abort)
-  const observation={requestRef:randomUUID(),owner:ownerPolicy.owner,stage:'DELIVERY_REJECTED',receiptRef:null}
-  // Paths and query strings are caller input, not safe diagnostic labels.
-  const path=request.url?.split('?')[0],operation=['/api/subjects','/api/interactions','/api/site-actions','/api/setup','/api/connection','/api/document'].includes(path)?path:'delivery/request'
-  const recordFailure=error=>{
-   const failure=sourceFailure(error,operation,observation)
-   try{onFailure?.(failure)}catch{}
-   return failure
-  }
-  // Preserve the finite HTTP observer deadline, but send a truthful outcome
-  // rather than resetting a reused socket (browsers may retransmit that POST).
-  // This does not cancel an accepted owner action or renew its execution budget.
-  const timer=setTimeout(()=>{
-   if(!response.writableEnded&&!response.destroyed){
-    const failure=recordFailure(Object.assign(Error('DeliveryTimedOut'),{code:'DeliveryTimedOut'}))
-    send(response,504,{error:failure})
-   }
-   controller.abort()
-  },bounds.bodyMs)
-  const work=handle(request,response,controller.signal,observation).catch(error=>{
-   const failure=recordFailure(error)
-   // Read-only diagnostic callback: no inherited preload, payload, credentials or
-   // stack. A diagnostic consumer cannot alter the execution branch by throwing.
-   if(!response.headersSent&&!response.destroyed)send(response,400,{error:failure})
-   else if(!response.writableEnded&&!response.destroyed)response.destroy()
-  }).finally(()=>{
-   try{onOutcome?.({...observation,operation:observation.operation??operation,httpStatus:response.headersSent?response.statusCode:null})}catch{}
-   clearTimeout(timer);response.off('close',abort);release();controllers.delete(controller);inflight.delete(work)
-  });inflight.add(work)
- })
- server.maxConnections=32;server.maxRequestsPerSocket=128
- server.on('upgrade',(request,socket,head)=>{
-  try{if(closing||request.url!=='/api/projection-live'||hub.inspect().connections>=8)fail('SocketUnavailable');authorize(request);authenticate(request);if(request.headers.origin!==origin)fail('OriginRequired')}
-  catch{socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return}
-  sockets.handleUpgrade(request,socket,head,websocket=>{
-   const peer={request,websocket,close:(code,reason)=>websocket.close(code,reason)}
-   websocket.on('message',data=>hub.message(peer,data));websocket.on('close',()=>hub.disconnect(peer));websocket.on('error',()=>hub.disconnect(peer));hub.open(peer)
-  })
- })
- return {server,notify:()=>hub.notify(),inspect:()=>({alive:server.listening,activeRequests:inflight.size,transport:hub.inspect()}),
-  async listen(){await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(Number(boundary.port),'127.0.0.1',resolve)})},
-  close(){
-   if(closePromise)return closePromise
-   closing=true
-   // Closing delivery revokes intake and releases transport, not physical work.
-   // Let the owning site close its resources BEFORE awaiting its pending calls:
-   // their completion may depend on that close. Join one lifecycle promise even
-   // for concurrent close callers, and preserve an owner cleanup failure.
-   closePromise=Promise.resolve().then(async()=>{
-    for(const c of controllers)c.abort()
-    hub.close();for(const ws of sockets.clients)ws.terminate()
-    const transportClosed=new Promise(resolve=>sockets.close(resolve))
-    const httpClosed=new Promise(resolve=>server.close(resolve))
-    server.closeIdleConnections();server.closeAllConnections()
-    const ownerClosed=Promise.resolve().then(()=>site.close?.())
-    const results=await Promise.allSettled([transportClosed,httpClosed,ownerClosed,...inflight])
-    const failures=results.filter(result=>result.status==='rejected').map(result=>result.reason)
-    if(failures.length)throw new AggregateError(failures,'Delivery shutdown failed')
-   })
-   return closePromise
-  }}
+// Caller-owned delivery and lifecycle. Crowsi retains transport/session/ACK/recovery.
+import http from 'node:http';
+import { randomUUID } from 'node:crypto';
+import { WebSocketServer } from 'ws';
+import { StateSocketServer } from '@crowsi/transport-foundation/state-socket';
+import { bounds } from '@zixcel/view-delivery-contracts';
+import { prepareDelivery } from './prepare.mjs';
+import { createHandler } from './handler.mjs';
+import { send, fail, record } from './wire.mjs';
+import { sourceFailure } from './failure.mjs';
+export function createDeliveryServer(options) {
+    const { site, origin, onFailure, onOutcome } = options;
+    const prepared = prepareDelivery(options), { ownerPolicy, boundary, budget } = prepared;
+    const { handle, authorize, authenticate } = createHandler(options, prepared);
+    const inflight = new Set(), controllers = new Set(), requests = new WeakMap();
+    let closing = false, closePromise = null;
+    const hub = new StateSocketServer({ authorize: peer => { const request = requests.get(peer); if (!request)
+            fail('SessionRejected'); authorize(request); if (request.headers.origin !== origin)
+            fail('OriginRequired'); return authenticate(request); }, read: async (request) => {
+            if (!site.live)
+                fail('SourceUnavailable');
+            const value = record(await site.live(request));
+            if (value.kind === 'RecoveryUnavailable')
+                return { kind: 'RecoveryUnavailable', detail: value.detail };
+            if (value.kind === 'NoChange' && typeof value.revision === 'string')
+                return { kind: 'NoChange', revision: value.revision };
+            if (value.kind === 'Snapshot' && typeof value.revision === 'string' && value.payload instanceof Uint8Array)
+                return { kind: 'Snapshot', revision: value.revision, payload: value.payload };
+            return fail('InvalidDeliveryData');
+        } });
+    const sockets = new WebSocketServer({ noServer: true, maxPayload: 1048578, perMessageDeflate: false, clientTracking: true });
+    const server = http.createServer({ maxHeaderSize: 16384, headersTimeout: 5000, requestTimeout: 5000, keepAliveTimeout: 2000 }, (request, response) => {
+        if (closing) {
+            response.writeHead(503);
+            response.end();
+            return;
+        }
+        let release;
+        try {
+            release = budget.reserve(0);
+        }
+        catch {
+            send(response, 503, { error: { code: 'DeliveryQueueFull' } });
+            return;
+        }
+        const controller = new AbortController();
+        controllers.add(controller);
+        const abort = () => controller.abort();
+        response.once('close', abort);
+        const observation = { requestRef: randomUUID(), owner: ownerPolicy.owner, stage: 'DELIVERY_REJECTED', receiptRef: null };
+        // Paths and query strings are caller input, not safe diagnostic labels.
+        const path = request.url?.split('?')[0], operation = ['/api/subjects', '/api/interactions', '/api/site-actions', '/api/setup', '/api/connection', '/api/document'].includes(path ?? '') ? path : 'delivery/request';
+        const recordFailure = (error) => {
+            const failure = sourceFailure(error, operation, observation);
+            try {
+                Promise.resolve(onFailure?.(failure)).catch(() => { });
+            }
+            catch { }
+            return failure;
+        };
+        // Preserve the finite HTTP observer deadline, but send a truthful outcome
+        // rather than resetting a reused socket (browsers may retransmit that POST).
+        // This does not cancel an accepted owner action or renew its execution budget.
+        const timer = setTimeout(() => {
+            if (!response.writableEnded && !response.destroyed) {
+                const failure = recordFailure(Object.assign(Error('DeliveryTimedOut'), { code: 'DeliveryTimedOut' }));
+                send(response, 504, { error: failure });
+            }
+            controller.abort();
+        }, bounds.bodyMs);
+        const work = handle(request, response, controller.signal, observation).catch(error => {
+            const failure = recordFailure(error);
+            // Read-only diagnostic callback: no inherited preload, payload, credentials or
+            // stack. A diagnostic consumer cannot alter the execution branch by throwing.
+            if (!response.headersSent && !response.destroyed)
+                send(response, 400, { error: failure });
+            else if (!response.writableEnded && !response.destroyed)
+                response.destroy();
+        }).finally(() => {
+            try {
+                Promise.resolve(onOutcome?.({ ...observation, operation: observation.operation ?? operation, httpStatus: response.headersSent ? response.statusCode : null })).catch(() => { });
+            }
+            catch { }
+            clearTimeout(timer);
+            response.off('close', abort);
+            release();
+            controllers.delete(controller);
+            inflight.delete(work);
+        });
+        inflight.add(work);
+    });
+    server.maxConnections = 32;
+    server.maxRequestsPerSocket = 128;
+    server.on('upgrade', (request, socket, head) => {
+        try {
+            if (closing || request.url !== '/api/projection-live' || hub.inspect().connections >= 8)
+                fail('SocketUnavailable');
+            authorize(request);
+            authenticate(request);
+            if (request.headers.origin !== origin)
+                fail('OriginRequired');
+        }
+        catch {
+            socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+            return;
+        }
+        sockets.handleUpgrade(request, socket, head, websocket => {
+            const peer = { request: { headers: new Headers() }, websocket, close: (code, reason) => websocket.close(code, reason) };
+            requests.set(peer, request);
+            websocket.on('message', data => hub.message(peer, Array.isArray(data) ? Buffer.concat(data) : data));
+            websocket.on('close', () => hub.disconnect(peer));
+            websocket.on('error', () => hub.disconnect(peer));
+            hub.open(peer);
+        });
+    });
+    return { server, notify: () => hub.notify(), inspect: () => ({ alive: server.listening, activeRequests: inflight.size, transport: hub.inspect() }),
+        async listen() { await new Promise((resolve, reject) => { server.once('error', reject); server.listen(Number(boundary.port), '127.0.0.1', resolve); }); },
+        close() {
+            if (closePromise)
+                return closePromise;
+            closing = true;
+            // Closing delivery revokes intake and releases transport, not physical work.
+            // Let the owning site close its resources BEFORE awaiting its pending calls:
+            // their completion may depend on that close. Join one lifecycle promise even
+            // for concurrent close callers, and preserve an owner cleanup failure.
+            closePromise = Promise.resolve().then(async () => {
+                for (const c of controllers)
+                    c.abort();
+                hub.close();
+                for (const ws of sockets.clients)
+                    ws.terminate();
+                const transportClosed = new Promise(resolve => sockets.close(() => resolve()));
+                const httpClosed = new Promise(resolve => server.close(() => resolve()));
+                server.closeIdleConnections();
+                server.closeAllConnections();
+                const ownerClosed = Promise.resolve().then(() => site.close?.());
+                const results = await Promise.allSettled([transportClosed, httpClosed, ownerClosed, ...inflight]);
+                const failures = results.filter(result => result.status === 'rejected').map(result => result.reason);
+                if (failures.length)
+                    throw new AggregateError(failures, 'Delivery shutdown failed');
+            });
+            return closePromise;
+        } };
 }

package/src/prepare.d.mts

@@ -0,0 +1,24 @@
+import { Budget } from '@crowsi/transport-foundation';
+import { SessionAuthority } from '@crowsi/browser-security/access';
+import type { Asset } from '@zixcel/view-delivery-contracts';
+import type { DeliveryServerOptions } from './types.mjs';
+export declare function prepareDelivery({ origin, assets, policy }: DeliveryServerOptions): {
+    boundary: Readonly<import("@crowsi/browser-security/boundary").OwnerOrigin>;
+    authority: SessionAuthority;
+    budget: Budget;
+    assetMap: Map<string, {
+        content: Buffer;
+        descriptor: Asset;
+    }>;
+    ownerPolicy: Readonly<{
+        cookieName: string;
+        csrfHeader: string;
+        nonceHeader: string;
+        readinessHeader: string;
+        owner: string;
+        title: string;
+        contract: string;
+        allowedOwners: readonly any[];
+    }>;
+};
+export type Prepared = ReturnType<typeof prepareDelivery>;

package/src/prepare.mjs

@@ -0,0 +1,31 @@
+import { createHash } from 'node:crypto';
+import { Budget, limitsFor } from '@crowsi/transport-foundation';
+import { SessionAuthority } from '@crowsi/browser-security/access';
+import { parseOwnerOrigin } from '@crowsi/browser-security/boundary';
+import { bounds } from '@zixcel/view-delivery-contracts';
+import { fail } from './wire.mjs';
+const defaultCookieName = 'view_delivery_session';
+export function prepareDelivery({ origin, assets, policy }) {
+    if (!policy || typeof policy.owner !== 'string' || !policy.owner || policy.owner.length > 128 ||
+        typeof policy.contract !== 'string' || !policy.contract || policy.contract.length > 128 || typeof policy.title !== 'string' || !policy.title || policy.title.length > 128 || /[<>&]/.test(policy.title) ||
+        !Array.isArray(policy.allowedOwners) || policy.allowedOwners.length > 16 || policy.allowedOwners.some(owner => typeof owner !== 'string' || !owner || owner.length > 128))
+        fail('InvalidDeliveryPolicy');
+    const headerPolicy = { cookieName: policy.cookieName ?? defaultCookieName, csrfHeader: policy.csrfHeader ?? 'x-delivery-csrf', nonceHeader: policy.nonceHeader ?? 'x-delivery-request-nonce', readinessHeader: policy.readinessHeader ?? 'x-delivery-readiness' };
+    if (Object.values(headerPolicy).some(value => typeof value !== 'string' || value.length > 64 || !/[a-z]/.test(value) || !/^[a-z0-9_-]+$/.test(value)))
+        fail('InvalidDeliveryPolicy');
+    const ownerPolicy = Object.freeze({ owner: policy.owner, title: policy.title, contract: policy.contract, allowedOwners: Object.freeze([...policy.allowedOwners]), ...headerPolicy });
+    const boundary = parseOwnerOrigin(origin), authority = new SessionAuthority();
+    const budget = new Budget(limitsFor(bounds.documentBytes, { pendingMessages: bounds.requests })), assetMap = new Map();
+    for (const asset of assets) {
+        const { bytes, ...descriptor } = asset, content = Buffer.from(bytes);
+        if (content.length !== descriptor.bytesLength || content.length > bounds.assetBytes)
+            fail('InvalidAsset');
+        const digest = createHash('sha256').update(content).digest('hex');
+        if (digest !== descriptor.digest || assetMap.has(descriptor.path) || !/^\/assets\/[a-zA-Z0-9._-]{1,100}$/.test(descriptor.path) || !['script', 'style'].includes(descriptor.kind))
+            fail('InvalidAsset');
+        assetMap.set(descriptor.path, { content, descriptor: { path: descriptor.path, digest, bytes: content.length, kind: descriptor.kind } });
+    }
+    if (assetMap.size < 1 || assetMap.size > bounds.assets)
+        fail('InvalidAsset');
+    return { boundary, authority, budget, assetMap, ownerPolicy };
+}

package/src/types.d.mts

@@ -0,0 +1,101 @@
+import type { StateReadRequest } from '@crowsi/transport-foundation/state-socket';
+import type { Server } from 'node:http';
+import type { Asset, Delivery } from '@zixcel/view-delivery-contracts';
+import type { Json } from '@zixcel/projection-contracts/client';
+export interface RequestContext {
+    readonly signal: AbortSignal;
+}
+export interface DocumentContext extends RequestContext {
+    readonly assets: readonly Asset[];
+}
+export interface CommandContext extends RequestContext {
+    readonly requestRef: string;
+    observe(value: unknown): void;
+}
+export interface DeliverySite {
+    document?(url: URL, context: DocumentContext): Promise<{
+        envelope: Delivery;
+        bootstrap: Readonly<Record<string, Json>>;
+    }> | {
+        envelope: Delivery;
+        bootstrap: Readonly<Record<string, Json>>;
+    };
+    read?(url: URL, context: RequestContext): unknown | Promise<unknown>;
+    command?(url: URL, value: unknown, context: CommandContext): unknown | Promise<unknown>;
+    live?(request: StateReadRequest): unknown | Promise<unknown>;
+    close?(): void | Promise<void>;
+}
+export interface TrustedAsset {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    readonly bytesLength: number;
+    readonly digest: string;
+    readonly kind: 'script' | 'style';
+}
+export interface DeliveryServer {
+    readonly server: Server;
+    notify(): void;
+    inspect(): {
+        readonly alive: boolean;
+        readonly activeRequests: number;
+        readonly transport: {
+            connections: number;
+            sessions: number;
+            subscriptions: number;
+            pendingBytes: number;
+        };
+    };
+    listen(): Promise<void>;
+    close(): Promise<void>;
+}
+export interface DeliveryPolicy {
+    readonly owner: string;
+    readonly title: string;
+    readonly contract: string;
+    readonly allowedOwners: readonly string[];
+    readonly cookieName?: string;
+    readonly csrfHeader?: string;
+    readonly nonceHeader?: string;
+    readonly readinessHeader?: string;
+}
+export interface DeliveryServerOptions {
+    readonly policy: DeliveryPolicy;
+    readonly origin: string;
+    readonly site: DeliverySite;
+    readonly assets: readonly TrustedAsset[];
+    readonly readinessToken?: string | null;
+    readonly onFailure?: ((failure: DeliveryFailure) => void) | null;
+    readonly onOutcome?: ((outcome: DeliveryOutcome) => void) | null;
+}
+export type OutcomeStage = 'DELIVERY_REJECTED' | 'NOT_DISPATCHED' | 'OWNER_REJECTED' | 'OUTCOME_UNCERTAIN' | 'OWNER_COMMITTED' | 'PUBLICATION_FAILED_AFTER_COMMIT';
+export interface Observation {
+    requestRef: string;
+    owner: string;
+    stage: OutcomeStage;
+    receiptRef: string | null;
+    operation?: string;
+    managementRequestRef?: number | null;
+}
+export interface DeliveryOutcome extends Observation {
+    operation: string;
+    httpStatus: number | null;
+}
+export interface DeliveryFailure {
+    code: string;
+    canonical: {
+        state: string;
+        receiptRef: string | null;
+    };
+    ownerFailure: {
+        owner: string;
+        operation: string;
+        code: string;
+        requirementRef: string;
+        outcomeStage: OutcomeStage;
+        uncertain: boolean;
+        requestRef: string;
+        managementRequestRef: number | null;
+        receiptRef: string | null;
+        detail: Json;
+    };
+}

package/src/types.mjs

@@ -0,0 +1 @@
+export {};

package/src/wire.d.mts

@@ -0,0 +1,18 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Delivery } from '@zixcel/view-delivery-contracts';
+export declare function fail(code: string): never;
+export declare const record: (v: unknown) => Record<string, unknown>;
+export declare function header(request: IncomingMessage, name: string): string;
+export declare const headers: {
+    'content-security-policy': string;
+    'referrer-policy': string;
+    'x-content-type-options': string;
+    'x-frame-options': string;
+    'permissions-policy': string;
+    'cache-control': string;
+};
+export declare const encode: (value: unknown, maximum?: number) => Buffer<ArrayBuffer>;
+export declare function body(request: IncomingMessage, signal: AbortSignal): Promise<unknown>;
+export declare function sessionId(request: IncomingMessage, cookieName: string): string;
+export declare function safeDocument(envelope: Delivery, bootstrap: unknown, title: string): Buffer<ArrayBuffer>;
+export declare function send(response: ServerResponse, status: number, value: unknown): void;

package/src/wire.mjs

@@ -0,0 +1,100 @@
+import { bounds } from '@zixcel/view-delivery-contracts';
+export function fail(code) { throw Object.assign(Error(code), { code }); }
+export const record = (v) => v !== null && typeof v === 'object' ? v : {};
+export function header(request, name) { const v = request.headers[name]; if (v !== undefined && typeof v !== 'string')
+    fail('InvalidInput'); return v ?? ''; }
+export const headers = {
+    'content-security-policy': "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'self'",
+    'referrer-policy': 'no-referrer', 'x-content-type-options': 'nosniff', 'x-frame-options': 'DENY',
+    'permissions-policy': 'camera=(), microphone=(), geolocation=(), payment=()', 'cache-control': 'no-store'
+};
+export const encode = (value, maximum = bounds.documentBytes) => {
+    // Site/owner outputs are already bounded data. Refuse expansion before sending.
+    let nodes = 0, total = 0;
+    const add = (bytes) => { total += bytes; if (total > maximum)
+        fail('DeliveryLimitExceeded'); };
+    function check(v, depth) {
+        if (++nodes > 32768 || depth > 20)
+            fail('DeliveryLimitExceeded');
+        if (typeof v === 'string') {
+            if (v.length > maximum)
+                fail('DeliveryLimitExceeded');
+            add(Buffer.byteLength(v) + 2);
+            return;
+        }
+        if (v === null || typeof v === 'boolean') {
+            add(5);
+            return;
+        }
+        if (typeof v === 'number' && Number.isFinite(v)) {
+            add(24);
+            return;
+        }
+        if (!v || typeof v !== 'object' || Object.getPrototypeOf(v) !== (Array.isArray(v) ? Array.prototype : Object.prototype) || Object.hasOwn(v, 'toJSON'))
+            fail('InvalidDeliveryData');
+        if (Array.isArray(v) && v.length > 4096)
+            fail('DeliveryLimitExceeded');
+        const keys = Object.keys(v);
+        if (Array.isArray(v) && (keys.length !== v.length || keys.some((key, index) => key !== String(index))))
+            fail('InvalidDeliveryData');
+        if (keys.length > 4096)
+            fail('DeliveryLimitExceeded');
+        add(keys.length + 2);
+        for (const key of keys) {
+            const d = Object.getOwnPropertyDescriptor(v, key);
+            if (!d || d.get || d.set || key === 'toJSON')
+                fail('InvalidDeliveryData');
+            add(Buffer.byteLength(key) + 3);
+            check(d.value, depth + 1);
+        }
+    }
+    check(value, 0);
+    const bytes = Buffer.from(JSON.stringify(value));
+    if (bytes.length > maximum)
+        fail('DeliveryLimitExceeded');
+    return bytes;
+};
+export async function body(request, signal) {
+    const h = request.headers, raw = h['content-length'];
+    if (h['content-encoding'] || h['transfer-encoding'] || !/^application\/json(?:\s*;.*)?$/i.test(h['content-type'] ?? '') || !(/^[1-9][0-9]{0,5}$/).test(raw ?? ''))
+        fail('InvalidInput');
+    const size = Number(raw);
+    if (size > bounds.requestBytes)
+        fail('DeliveryLimitExceeded');
+    const data = Buffer.alloc(size);
+    let used = 0;
+    for await (const chunk of request) {
+        if (!Buffer.isBuffer(chunk))
+            fail('InvalidInput');
+        if (signal.aborted)
+            fail('DeliveryCancelled');
+        if (used + chunk.length > size)
+            fail('DeliveryLimitExceeded');
+        chunk.copy(data, used);
+        used += chunk.length;
+    }
+    if (used !== size)
+        fail('InvalidInput');
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(data));
+    }
+    catch {
+        fail('InvalidInput');
+    }
+}
+export function sessionId(request, cookieName) {
+    const cookie = request.headers.cookie ?? '';
+    if (cookie.length > 8192)
+        fail('SessionRejected');
+    const values = cookie.split(';').map(s => s.trim()).filter(s => s.startsWith(cookieName + '='));
+    if (values.length !== 1)
+        fail('SessionRejected');
+    return values[0].slice(cookieName.length + 1);
+}
+export function safeDocument(envelope, bootstrap, title) {
+    const serialized = encode({ envelope, bootstrap }).toString().replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
+    const styles = envelope.assets.filter(a => a.kind === 'style').map(a => `<link rel="stylesheet" href="${a.path}">`).join('');
+    const scripts = envelope.assets.filter(a => a.kind === 'script').map(a => `<script type="module" src="${a.path}"></script>`).join('');
+    return Buffer.from(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title>${styles}</head><body><main id="app" aria-busy="true"><p role="status">Loading exact state…</p></main><script id="delivery-state" type="application/json">${serialized}</script>${scripts}</body></html>`);
+}
+export function send(response, status, value) { const bytes = encode(value); response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'content-length': bytes.length }); response.end(bytes); }