arcane-os 0.14.0 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.15.1
+
+- Use the published `node-http-server` public lifecycle for the mail gateway.
+  Pass original requests and responses through its raw-request hook to the
+  existing mail handler, preserving complete content, provider results,
+  cancellation, and the returned native listener. Retain the disabled socket
+  inactivity timeout and use the module's listener shutdown and malformed-client
+  response handling.
+
+## 0.15.0
+
+- Add explicit `arcane dev --http` and source API `http:true` for HTTP
+  development, including LAN device use. Reuse `node-http-server` and the same
+  application, PWA, source-mapping and conditional-response routes without
+  certificate setup. Report the actual HTTP endpoint and own one listener's
+  readiness, cancellation, errors and shutdown.
+- Preserve HTTPS and its HTTP `308` redirect as the default; packaged browser
+  previews continue using HTTPS. Browser settings, certificate validation,
+  application content and caching remain unchanged.
+
 ## 0.14.0
 
 - Add opt-in `toolText: {name, field}` and `onToolText(text, call, displayId)`

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.13.0` SDK contract. Applications pin one exact npm
+This checkout defines the `0.15.1` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 
@@ -73,7 +73,7 @@ each device. Keep these local files ignored by Git. The same certificate pair
 works for any selected app in that workspace. The command reports missing TLS
 files instead of starting an HTTP listener.
 
-Every Arcane app uses HTTPS for development and packaged browser previews.
+HTTPS is the default for development and required for packaged browser previews.
 Plain `npm run dev` binds to localhost with the same workspace certificate pair.
 An explicit `--host` overrides the bind address, and `--port` selects the HTTPS port.
 The paired HTTP listener returns 308 redirects and uses an OS-assigned port
@@ -84,6 +84,17 @@ for public mode. Network reachability depends on the machine's firewall and
 network. See the [development HTTPS setup](docs/reference/cli.md#development-https-setup)
 for device trust and DBOPFS's secure-context requirement.
 
+For explicit HTTP source development, including LAN device testing, use:
+
+```bash
+npm run dev -- --app hello-speech --public --http --port 8000
+```
+
+This selects one HTTP content listener and prints HTTP network URLs. It reads
+no certificate pair and serves the same application and generated PWA routes.
+PWA and storage availability still depend on the browser's secure-context
+rules; see [HTTP development](docs/reference/cli.md#explicit-http-development).
+
 Open the URL printed by the server. The generated page owns its import map and
 Arcane theme; its application module is `apps/hello-speech/modules/App.js`.
 `arcane/AI` is a managed **browser import**, not an npm-exported Node inference
@@ -518,7 +529,7 @@ arcane new <id> [--path <directory>] [--display-name <name>] [--target <target>]
 arcane init [id] [--workspace <directory>] [--display-name <name>] [--target <target>]
 arcane doctor [--workspace <directory>] [--arcane-root <directory>]
 arcane import-map [--workspace <directory>] [--app <id>]
-arcane dev [--app <id>] [--public] [--https] [--cert <file> --key <file>] [--host <address>] [--port 8000]
+arcane dev [--app <id>] [--public] [--http | --https] [--cert <file> --key <file>] [--host <address>] [--port 8000]
 arcane test [--app <id>] [--scope app]
 arcane test --scope shared --test-file <repo-relative.test.mjs>
 arcane check [--app <id>] [--scope app] [--skip-tests]

package/docs/architecture.md

@@ -136,8 +136,8 @@ selected source route and the last successful check when evaluating freshness.
 
 The shared dev server uses RIAEvangelist's `node-http-server` public interface
 for HTTPS and conditional responses on those selected routes. The SDK
-owns source selection and generated representations. Every Arcane development
-server and packaged browser preview serves content on HTTPS and redirects its
+owns source selection and generated representations. By default, source development
+and every packaged browser preview serve content on HTTPS and redirect their
 paired HTTP listener with status 308 through the public request hook.
 `arcane dev --public` selects the IPv4 wildcard address;
 explicit `--host` controls the bind address. CLI startup reads one workspace-local
@@ -151,6 +151,14 @@ redirect listener, defaulting to an OS-assigned port. Existing raw `tls` inputs
 retain their native HTTPS transport under the SDK, as described by the module's
 advanced TLS extension guidance; all content uses its public serving methods.
 
+Explicit `arcane dev --http` or source API `http:true` selects the module's
+single HTTP listener on `port`. It skips certificate resolution and serves the
+same selected source mappings, generated PWA routes, and conditional responses.
+No HTTPS listener or redirect is started in this mode. Listener readiness,
+failure, cancellation and shutdown retain the same operation owner; reported
+URLs use the actual HTTP protocol and bound port. Browser secure-context
+requirements remain browser-owned. Packaged previews retain HTTPS.
+
 Development is an intentionally fast feedback loop. Keep each increment small
 and independently understandable so its effect has one clear cause and a
 mistake can be isolated without untangling unrelated work. A development

package/docs/reference/cli.md

@@ -50,8 +50,9 @@ meaning and cardinality rules:
 | `--arcane-root` | directory | `doctor`, native `build`/`run`, `native-doctor`, `native-prepare` |
 | `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to HTTPS at `127.0.0.1:8000`; `mail serve` defaults to HTTP at `127.0.0.1:8025` and admits numeric loopback only. |
 | `--http-port` | integer 0–65535 | Browser `dev`/`run` HTTP redirect listener; defaults to `0`, which selects an available port. |
-| `--public` | flag | `dev`; serves HTTPS and binds to `0.0.0.0` unless `--host` explicitly selects another address. |
-| `--https` | flag | Browser `dev`/`run`; retained explicitly, while HTTPS is always enabled. |
+| `--public` | flag | `dev`; binds to `0.0.0.0` unless `--host` explicitly selects another address. |
+| `--http` | flag | `dev` only; serves source and PWA routes on one HTTP listener selected by `--port`, without TLS. |
+| `--https` | flag | Browser `dev`/`run`; explicitly selects the default HTTPS transport. |
 | `--cert` / `--key` | PEM file paths | Browser `dev`/`run`; supply both for an explicit certificate chain and private key. Relative paths resolve from the workspace. |
 | `--target` | target id | `new`, `init`, native diagnostics, `build`, `run` |
 | `--format` / `--signing` | target-supported values | Native diagnostics, `build`, `run` |
@@ -313,7 +314,7 @@ npm exec -- arcane upgrade --workspace . --app hello-world
 
 Starts one development server for one selected app and maps the exact
 workspace/runtime routes. It defaults to HTTPS on localhost; `--public` enables access
-from other devices on the network over HTTPS.
+from other devices on the network, using HTTPS by default.
 
 For an external workspace, the server exposes the selected projected
 `arcane/` root, including `arcane/sdk` and `arcane/dependencies`, alongside the
@@ -322,7 +323,7 @@ The explicit live-source SDK mapping remains unchanged and does not replace the
 installed projection.
 
 ```text
-arcane dev [--app <id>] [--public] [--https] [--cert <file> --key <file>] [--host <address>] [--port 8000] [--http-port 0]
+arcane dev [--app <id>] [--public] [--http | --https] [--cert <file> --key <file>] [--host <address>] [--port 8000] [--http-port 0]
 ```
 
 ### Lifecycle
@@ -344,7 +345,7 @@ device, since `localhost` refers to that device and `0.0.0.0` is a bind address.
 Network URLs come from one interface snapshot at startup and do not establish
 remote reachability through the machine's firewall or network.
 
-Every Arcane app uses HTTPS for development and packaged browser previews.
+HTTPS is the default for development and required for packaged browser previews.
 `--https` remains accepted but is no longer needed to select the transport.
 `--port` selects the HTTPS application port. A second HTTP listener returns
 `308` redirects to that HTTPS port, preserving the requested path and query.
@@ -357,9 +358,41 @@ the redirect endpoint.
 Supplying both `--cert` and `--key` selects an explicit PEM pair. The command
 does not configure a firewall, router forwarding, or an internet tunnel.
 
+### Explicit HTTP development
+
+`--http` selects source development over HTTP. Combine it with `--public` or
+`--host` to use a LAN address, and choose the content listener with `--port`:
+
+```bash
+npm run dev -- --app hello-world --public --http --port 8000
+```
+
+The command starts one HTTP listener through `node-http-server`, skips all TLS
+file reads, and serves the same selected source files, generated manifest,
+service worker and offline inventory. PWA configuration and caching are
+unchanged. Startup prints the actual HTTP local and network URLs. Structured
+results contain `protocol:'http:'`; `httpPort`, `httpOrigin`, and `httpUrl`
+identify that content listener and equal `port`, `origin`, and `url`.
+There is no separate redirect endpoint. Cancellation and listener failure
+close the owned HTTP listener and settle the same lifecycle.
+
+`--http` is supported only by `dev`. Combining it with `--https`, `--cert`,
+`--key`, or `--http-port` is a usage error. Omitting it preserves HTTPS;
+certificate errors never select HTTP automatically.
+
+A LAN HTTP origin does not receive the browser's localhost secure-context
+exception. For Chrome development, Chromium documents
+`chrome://flags/#unsafely-treat-insecure-origin-as-secure` with the exact HTTP
+origin, such as `http://192.0.2.10:8000`; see
+[Chromium's development guidance](https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins/).
+The developer owns that browser setting. The SDK does not change it, alter
+certificate validation, or claim a PWA is installable merely because its server
+started. HTTP and HTTPS are distinct origins with separate browser storage and
+registrations; existing HTTPS data is preserved.
+
 ### Development HTTPS setup
 
-Before starting `arcane dev` or a packaged browser preview, place the server's
+Before starting HTTPS `arcane dev` or a packaged browser preview, place the server's
 PEM certificate chain at `.arcane/dev/server-cert.pem` and its PEM private key at
 `.arcane/dev/server-key.pem`, relative to the workspace. Alternatively, pass
 `--cert <file> --key <file>` together. The certificate must cover localhost or the LAN IP

package/docs/reference/mail.md

@@ -283,6 +283,12 @@ Non-interactive structured output requires `--app-key-stdin` and redirected
 stdin. The server binds numeric loopback only; the default is
 `127.0.0.1:8025/v1/mail`.
 
+The gateway uses the published `node-http-server` instance lifecycle. Its raw
+request hook hands the original request and response directly to the mail
+handler before body parsing or static routing. Socket inactivity timeout remains
+disabled; caller-selected mail deadlines, cancellation, and complete responses
+remain owned by the mail handler.
+
 The gateway protects the provider credential by requiring:
 
 - its exact numeric-loopback `Host` authority and `/v1/mail` route;

package/docs/reference/pwa.md

@@ -112,9 +112,11 @@ For an enabled application, `arcane dev` serves the generated PWA files at the
 origin root and starts at the selected app page under `/apps/<id>/`. Use one
 selected app per development origin. The SDK uses `node-http-server` for source
 and packaged-preview serving, including conditional resource responses.
-Every Arcane development server and packaged browser preview serves HTTPS,
-including localhost. Configure the workspace certificate pair before starting
-the ordinary command; see [development HTTPS setup](cli.md#development-https-setup).
+Arcane development servers default to HTTPS, including localhost, and packaged
+browser previews require HTTPS. Configure the workspace certificate pair before
+starting the ordinary command; see [development HTTPS setup](cli.md#development-https-setup).
+Explicit source-only `arcane dev --http` serves the same generated PWA routes
+without loading certificates; see [explicit HTTP development](cli.md#explicit-http-development).
 `--public` selects the IPv4 wildcard bind address; it does not enable PWA
 configuration, change manifest metadata, or determine browser installability.
 
@@ -272,8 +274,11 @@ Keep actual icon dimensions in `sizes`. Browser diagnostics about missing
 and are separate from a usable installation icon.
 
 Browser installation requires HTTPS or the browser's localhost/loopback
-exception. A device-facing LAN address is not loopback. Arcane's development
-server still follows its own HTTPS serving contract above. Browser engagement,
+exception. A device-facing LAN address is not loopback. Selecting HTTP serving
+does not make that LAN origin a secure context. Chromium documents a separate
+[explicit developer origin setting](https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins/);
+the SDK does not configure that setting or claim that starting the server proves
+installation eligibility. Browser engagement,
 installation state and platform support also affect whether native promotion
 appears; worker cache readiness is not an installation UI prerequisite. See
 [browser installation requirements](https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Guides/Making_PWAs_installable).

package/docs/reference/sdk-api.md

@@ -3464,7 +3464,7 @@ async function useselectApp(...arguments_) {
 
 Starts one owned browser development server with exact runtime/app route mappings and a caller-selected bind address.
 
-HTTPS serving uses the published `node-http-server` module. The SDK
+HTTP and HTTPS serving use the published `node-http-server` module. The SDK
 selects source routes and supplies generated representations; the module owns
 static-file conditional GET/HEAD handling and response delivery. The SDK
 retains modification dates for its generated representations. Unchanged
@@ -3480,7 +3480,7 @@ async startDevServer(options={})
 ```
 
 Import it from `arcane-os`. Source mode accepts
-`{workspaceRoot=process.cwd(), appId, mode='source', host='127.0.0.1', port=0, httpPort=0,
+`{workspaceRoot=process.cwd(), appId, mode='source', host='127.0.0.1', port=0, httpPort=0, http=false,
 certPath, keyPath, tls, signal, onEvent}` and serves one validated
 workspace application plus its complete SDK or integrated runtime. Packaged mode uses
 `{mode:'packaged', releaseRoot, workspaceRoot, host, port, httpPort, certPath, keyPath, tls,
@@ -3494,9 +3494,9 @@ The SDK request hook returns `308` for HTTP with a `Location` pointing to the
 actual HTTPS port while preserving the original request path and query. Both listeners
 use the selected host.
 
-Every source server and packaged browser preview enforces HTTPS, including
-localhost. The legacy `https` option is accepted but cannot disable it.
-Startup reads `.arcane/dev/server-cert.pem` and
+Source servers default to HTTPS, including localhost; packaged browser previews
+require HTTPS. The legacy `https` option is accepted but `https:false` and
+`tls:false` alone do not disable HTTPS. HTTPS startup reads `.arcane/dev/server-cert.pem` and
 `.arcane/dev/server-key.pem` relative to `workspaceRoot` unless explicit
 `certPath` and `keyPath` are supplied together; relative paths resolve from the
 workspace. A direct `tls` object instead supplies Node HTTPS server options, including
@@ -3507,16 +3507,27 @@ handshake; browser trust and address matching are evaluated when a client
 connects. The CLI's `--public` selects the wildcard bind;
 the API's `host` option alone changes only the bind address.
 
-The promise settles after both listeners are ready and resolves to
+Explicit `http:true` selects one HTTP content listener in source mode and skips
+certificate loading. `port` selects that listener's port, including `0` for an
+available port. The same application, runtime and generated PWA routes are
+served. `http` must be boolean; `http:true` rejects packaged mode, `https:true`,
+explicit certificate/key paths, a `tls` value other than `undefined`, `null` or
+`false`, and a nonzero `httpPort`. Browser secure-context and installation
+requirements remain browser-owned; see [explicit HTTP development](cli.md#explicit-http-development).
+
+The promise settles after all selected listeners are ready and resolves to
 `{server, protocol, mode, workspaceRoot, appId, host, port, origin, cleanUrl, url,
-networkUrls, httpPort, httpOrigin, httpUrl, close, closed, lifecycle}`. `server` is the raw Node HTTPS
-server; `protocol` is `'https:'`.
+networkUrls, httpPort, httpOrigin, httpUrl, close, closed, lifecycle}`. `server` is the raw Node
+server for application content; `protocol` is `'https:'` by default or `'http:'`
+with explicit HTTP source mode.
 `url` and `cleanUrl` are the same application URL. Wildcard listeners use
 `localhost` in that local URL; `host` retains the actual bound address.
 `httpPort` is the actual HTTP listener port, `httpOrigin` is its HTTP origin,
 and `httpUrl` combines that origin with the application start path. These
-fields identify the redirect endpoint; `origin`, `url`, `cleanUrl`, and
-`networkUrls` identify HTTPS application endpoints.
+fields identify the redirect endpoint in HTTPS mode; `origin`, `url`, `cleanUrl`,
+and `networkUrls` identify application endpoints. In HTTP mode, `httpPort`,
+`httpOrigin`, and `httpUrl` equal `port`, `origin`, and `url`; they identify the
+single content listener, with no redirect listener.
 `networkUrls` lists application URLs for applicable non-loopback interface
 addresses discovered once at startup. These URLs are connection candidates,
 not evidence of reachability from another device. The server adds no session
@@ -3528,15 +3539,15 @@ certificates or modify trust stores. Each client must trust the issuing CA and o
 server certificate. Lifecycle events and CLI summaries exclude TLS options and
 private key contents. See [development HTTPS setup](cli.md#development-https-setup).
 
-Starting the server opens both selected listeners and emits awaited,
+Starting the server opens the selected listener or listeners and emits awaited,
 backpressured `server.starting` and `server.started` events. `server.started`
-includes `httpPort`, `httpOrigin`, and `httpUrl` alongside the HTTPS endpoint.
+includes the selected `protocol`, `httpPort`, `httpOrigin`, and `httpUrl` alongside the application endpoint.
 Request failures emit `server.request.failed`; shutdown emits `server.stopped` after owned
 requests and event delivery drain. Call `await result.close()` in a `finally`
 block, or abort `signal`; `close()` is idempotent and returns the
 same settlement represented by both `closed` and `lifecycle`. Closing the
-operation closes both listeners. An error from either listener or an
-event-callback failure closes both and rejects the lifecycle. Invalid
+operation closes every selected listener once. A listener error or an
+event-callback failure closes the operation and rejects the lifecycle. Invalid
 mode/host/port/httpPort, malformed workspace or release content, an occupied port,
 or an already-aborted signal rejects startup.
 
@@ -3931,14 +3942,15 @@ async function usedescribeTargets(...arguments_) {
 
 Starts one owned browser development server for the selected application.
 
-`https`, `certPath`, `keyPath`, and `tls` follow the
-[`startDevServer()` TLS contract](#startdevserver), alongside `host`, `port`, and
-`httpPort`. `port` selects HTTPS and `httpPort` selects the HTTP `308` redirect
-listener; each defaults to an available port.
+`http`, `https`, `certPath`, `keyPath`, and `tls` follow the
+[`startDevServer()` transport contract](#startdevserver), alongside `host`, `port`, and
+`httpPort`. By default, `port` selects HTTPS and `httpPort` selects the HTTP `308`
+redirect listener; each defaults to an available port. Explicit `http:true`
+selects one source HTTP content listener at `port`, without certificate loading.
 The operation refreshes the selected authored descriptor's `arcane-package.json`
 projection and managed import maps under one development-refresh lock, then
-releases that lock before opening the HTTPS source listener and its HTTP
-redirect listener. It returns both endpoints and their shared shutdown
+releases that lock before opening the selected source listener or listeners.
+It returns their application endpoints and shared shutdown
 lifecycle. Legacy package-only apps remain unchanged. The operation generates
 no packaged output; enabled PWA manifests
 are served directly from the selected source resources.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/cli/main.mjs

@@ -39,6 +39,7 @@ const VALUE_OPTIONS=new Set([
 const FLAG_OPTIONS=new Set([
     'git',
     'public',
+    'http',
     'https',
     'skip-tests',
     'dry-run',
@@ -65,7 +66,7 @@ Usage:
   ${CLI_NAME} upgrade [--workspace <directory>] [--app <id>]
   ${CLI_NAME} doctor [--workspace <directory>] [--arcane-root <directory>]
   ${CLI_NAME} import-map [--workspace <directory>] [--app <id>]
-  ${CLI_NAME} dev [--app <id>] [--public] [--https] [--cert <pem>] [--key <pem>] [--host <address>] [--port 8000] [--http-port 0] [--sdk-runtime-source <sdk-root>]
+  ${CLI_NAME} dev [--app <id>] [--public] [--http | --https] [--cert <pem>] [--key <pem>] [--host <address>] [--port 8000] [--http-port 0] [--sdk-runtime-source <sdk-root>]
   ${CLI_NAME} test [--app <id>] [--scope app]
   ${CLI_NAME} test --scope shared --test-file <repo-relative.test.mjs>
   ${CLI_NAME} check [--app <id>] [--scope app] [--skip-tests]
@@ -88,8 +89,9 @@ Usage:
   ${CLI_NAME} mail serve --profile <profile> --from <address> --app <id> --origin <origin> [--allow-to <addresses>] [--app-key-stdin] [--host 127.0.0.1] [--port 8025] [--request-timeout <ms>]
 
 Development:
-  --public                      Serve HTTPS on all IPv4 interfaces (0.0.0.0) and print network URLs.
-  --https                       Accepted for compatibility; Arcane browser serving always uses HTTPS.
+  --public                      Bind dev to all IPv4 interfaces (0.0.0.0) and print network URLs.
+  --http                        Dev-only HTTP content on --port; no TLS or HTTPS redirect listener.
+  --https                       Explicitly select the default HTTPS browser transport.
   --cert <pem> --key <pem>        Use an existing certificate pair; paths are relative to the workspace.
   --host <address>               Override the bind address; takes precedence over --public.
   --http-port <port>             Browser dev/run HTTP redirect port; 0 selects an available port (default).
@@ -458,6 +460,14 @@ function operationOptions(command,parsed,cwd){
     if(flags.has('public')&&command!=='dev'){
         usage('--public is supported only by dev.');
     }
+    const http = flags.has('http');
+    if (http && command !== 'dev') {
+        usage('--http is supported only by dev.');
+    }
+    if (http && (flags.has('https') || values.cert !== undefined
+        || values.key !== undefined || values['http-port'] !== undefined)) {
+        usage('--http cannot combine --https, --cert, --key, or --http-port; select its listener with --port.');
+    }
     const browserServing = command === 'dev'
         || (command === 'run' && (values.target ?? 'browser') === 'browser');
     if ((flags.has('https') || values.cert !== undefined || values.key !== undefined) && !browserServing) {
@@ -470,7 +480,7 @@ function operationOptions(command,parsed,cwd){
         usage('Arcane HTTPS serving requires --cert and --key together.');
     }
     const browserServerOptions = browserServing ? {
-        https: true,
+        ...(http ? {http: true} : {https: true}),
         httpPort: readPort(values['http-port'], 0),
         ...(values.cert === undefined ? {} : {
             certPath: path.resolve(workspaceRoot, values.cert),
@@ -882,7 +892,7 @@ function serverSummary(result){
 async function waitForServer(result,signal,reporter){
     const readyMessage=[
         `Development server ready at ${result.url}`,
-        ...(result.httpUrl ? [`HTTP redirect: ${result.httpUrl}`] : []),
+        ...(result.httpUrl && result.protocol !== 'http:' ? [`HTTP redirect: ${result.httpUrl}`] : []),
         ...(result.networkUrls??[]).map(function networkAddress(url){return `Network: ${url}`;})
     ].join('\n');
     reporter.emit('server.ready',serverSummary(result),readyMessage);

package/src/dev-server.mjs

@@ -718,7 +718,7 @@ function deployDevelopmentServer(fileServer, signal, {tlsServer, host, port}) {
                 if (!listeners.every(listener => ready.has(listener))) return;
                 settled = true;
                 cleanupDeployment();
-                resolve(tlsServer ?? fileServer.secureServer);
+                resolve(tlsServer ?? fileServer.secureServer ?? fileServer.server);
             }
             try {
                 throwIfAborted(signal);
@@ -804,6 +804,8 @@ async function startOwnedDevServer({
     host='127.0.0.1',
     port=0,
     httpPort=0,
+    http = false,
+    https: requestedHttps,
     tls,
     certPath,
     keyPath,
@@ -822,22 +824,33 @@ async function startOwnedDevServer({
     if (!is.integer(httpPort) || httpPort < 0 || httpPort > 65535) {
         fail('httpPort must be an integer from 0 through 65535.', 'ARCANE_USAGE');
     }
+    if (!is.boolean(http)) {
+        fail('http must be a boolean.', 'ARCANE_USAGE');
+    }
+    if (http && mode !== 'source') {
+        fail('HTTP serving is supported only in source development mode.', 'ARCANE_USAGE');
+    }
+    if (http && (requestedHttps === true || (tls !== undefined && tls !== null && tls !== false)
+        || certPath !== undefined || keyPath !== undefined || httpPort !== 0)) {
+        fail('HTTP development cannot combine TLS options or a separate httpPort; select its listener with port.', 'ARCANE_USAGE');
+    }
+    const protocol = http ? 'http:' : 'https:';
     const requestedRuntimeMode=mode==='source'&&sdkRuntimeSourceRoot!==undefined
         ?'sdk-source'
         :null;
     await events.send({
         type:'server.starting',
+        protocol,
         mode,
         host,
         port,
-        httpPort,
+        httpPort: http ? port : httpPort,
         appId,
         ...(requestedRuntimeMode?{runtimeMode:requestedRuntimeMode}:{})
     });
-    const selectedTls=await resolveDevelopmentTls({
-        workspaceRoot,tls,certPath,keyPath,signal
-    });
-    const protocol = 'https:';
+    const selectedTls = http ? null : await resolveDevelopmentTls(
+        {workspaceRoot, tls, certPath, keyPath, signal}
+    );
     throwIfAborted(signal);
     const routeSet=mode==='source'
         ?await sourceRoutes(workspaceRoot,appId,{
@@ -1093,7 +1106,7 @@ async function startOwnedDevServer({
     async function serveDevelopmentRequest(request, response) {
         let task;
         async function routeDevelopmentRequest() {
-            if (!request.socket.encrypted) {
+            if (!http && !request.socket.encrypted) {
                 const address = (tlsServer ?? fileServer.secureServer).address();
                 const authority = new URL(`http://${request.headers.host || browserHostname(host)}`);
                 authority.protocol = 'https:';
@@ -1262,16 +1275,18 @@ async function startOwnedDevServer({
         {
             root: mappings[0].root,
             host,
-            port: httpPort,
+            port: http ? port : httpPort,
             server: {noCache: false, timeout: 0},
-            https: {
-                only: false,
-                port,
-                ...(selectedTls.options ? {} : {
-                    privateKey: selectedTls.privateKeyPath,
-                    certificate: selectedTls.certificatePath
-                })
-            }
+            ...(http ? {} : {
+                https: {
+                    only: false,
+                    port,
+                    ...(selectedTls.options ? {} : {
+                        privateKey: selectedTls.privateKeyPath,
+                        certificate: selectedTls.certificatePath
+                    })
+                }
+            })
         }
     );
     fileServer.config.contentType = contentType;
@@ -1279,11 +1294,11 @@ async function startOwnedDevServer({
     // The module's public HTTPS configuration accepts PEM paths. Its HTTPS
     // guide leaves advanced TLS inputs to application code; preserve that
     // existing SDK input while the same public module methods serve all content.
-    const tlsServer = selectedTls.options
+    const tlsServer = selectedTls?.options
         ? https.createServer(selectedTls.options, serveDevelopmentRequest)
         : null;
     const server = await deployDevelopmentServer(fileServer, signal, {tlsServer, host, port});
-    const listeners = [fileServer.server, server];
+    const listeners = [...new Set([fileServer.server, server])];
     const address=server.address();
     if(!address||is.string(address)){
         await closeDevelopmentListeners(fileServer, tlsServer);

package/src/mail-server.mjs

@@ -1,6 +1,6 @@
 import Is from 'strong-type';
 import {createHash,randomUUID,timingSafeEqual} from 'node:crypto';
-import http from 'node:http';
+import {Server} from 'node-http-server';
 
 const is = new Is(false);
 
@@ -1283,40 +1283,16 @@ export function createResendMailRequestHandler(options={}){
     };
 }
 
-function listen(server,{host,port}){
+function deployMailServer(mailServer){
     return new Promise(function waitForMailListener(resolve,reject){
-        function cleanup(){
-            server.removeListener('error',onError);
-            server.removeListener('listening',onListening);
-        }
         function onError(error){
-            cleanup();
             reject(error);
         }
-        function onListening(){
-            cleanup();
-            resolve();
-        }
-        server.once('error',onError);
-        server.once('listening',onListening);
-        server.listen({exclusive:true,host,port});
-    });
-}
-
-function closeHttpServer(server){
-    return new Promise(function waitForHttpServerClose(resolve,reject){
-        if(!server.listening){
-            resolve();
-            return;
-        }
-        server.close(function finishHttpServerClose(error){
-            if(error){
-                reject(error);
-            }else{
-                resolve();
-            }
+        mailServer.deploy(function onListening(instance,server){
+            server.removeListener('error',onError);
+            resolve(server);
         });
-        server.closeIdleConnections?.();
+        mailServer.server.once('error',onError);
     });
 }
 
@@ -1325,29 +1301,27 @@ export async function startResendMailServer(options={}){
     if(configuration.signal?.aborted){
         throw configuration.signal.reason??new Error('Mail server start was cancelled.');
     }
-    const requestHandler=createResendMailRequestHandler(options);
-    const server=http.createServer(requestHandler.handle);
-    server.on('clientError',function rejectMalformedClient(error,socket){
-        if(!socket.writable){
-            return;
-        }
-        socket.end(
-            'HTTP/1.1 400 Bad Request\r\n'
-            +'Connection: close\r\n'
-            +'Content-Length: 0\r\n'
-            +'\r\n'
-        );
+    const mailServer=new Server({
+        host:configuration.host,
+        port:configuration.port,
+        server:{timeout:0}
     });
+    const requestHandler=createResendMailRequestHandler(options);
+    mailServer.onRawRequest=function handleMailRequest(request,response){
+        requestHandler.handle(request,response);
+        return true;
+    };
 
+    let server;
     try{
-        await listen(server,{host:configuration.host,port:configuration.port});
+        server=await deployMailServer(mailServer);
     }catch(error){
-        await requestHandler.close();
+        await Promise.allSettled([mailServer.close(),requestHandler.close()]);
         throw error;
     }
     const address=server.address();
     if(!address||is.string(address)||!isNumericLoopback(address.address)){
-        await Promise.allSettled([closeHttpServer(server),requestHandler.close()]);
+        await Promise.allSettled([mailServer.close(),requestHandler.close()]);
         throw configurationError('Mail server did not bind to a numeric loopback address.');
     }
     const displayHost=address.address.includes(':')?`[${address.address}]`:address.address;
@@ -1365,7 +1339,7 @@ export async function startResendMailServer(options={}){
         configuration.signal?.removeEventListener('abort',closeFromSignal);
         const handlerClosing=requestHandler.close();
         try{
-            await Promise.all([closeHttpServer(server),handlerClosing]);
+            await Promise.all([mailServer.close(),handlerClosing]);
             resolveLifecycle();
         }catch(error){
             rejectLifecycle(error);

package/src/toolchain.mjs

@@ -516,6 +516,7 @@ export async function developApplication(options = {}) {
         host:options.host,
         port:options.port,
         httpPort:options.httpPort,
+        http: options.http,
         https:options.https,
         tls:options.tls,
         certPath:options.certPath,