arcane-os 0.16.3 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.18.0
+
+- Adopt published `node-http-server` 10.0.0. PEM-backed development and
+  packaged-preview HTTPS now negotiate HTTP/2 or HTTP/1.1 on the same port
+  through the existing module integration, with no new runtime dependency.
+- Document the returned `Http2SecureServer` for PEM-backed HTTPS. Preserve
+  raw `tls` options on native `https.Server`, explicit HTTP development, the
+  HTTP mail gateway, paired HTTP `308` redirects, source/PWA routes, complete
+  responses, conditional caching, and owned listener shutdown.
+- Adapt the shared synthetic TLS fixture to both native TLS constructors while
+  retaining option capture and cleanup. The fixture models routing and option
+  delegation; it does not establish a real TLS handshake or protocol negotiation.
+- Report an occupied mail listener port clearly while retaining native
+  `EADDRINUSE` details, the original cause, and the existing startup cleanup.
+
+## 0.17.0
+
+- Add neutral `modal.configure({dismissible})` configuration, defaulting to
+  `true`. Setting it to `false` hides the close button and prevents Escape,
+  backdrop and close-button dismissal while preserving the owner's existing
+  programmatic close/destroy lifecycle and running-task behavior.
+- Retain the configuration through population, open/close cycles and task
+  completion. Keep focus within useful content when hiding a focused close
+  control, and preserve default modal behavior for existing consumers.
+
 ## 0.16.3
 
 - Remember browser-reported PWA installation in app-scoped DBOPFS and suppress

package/NOTICE

@@ -8,7 +8,7 @@ informational notice and is not itself a grant of commercial rights.
 Third-party material retains its own terms:
 
 - event-pubsub 6.1.0: MIT License; see its installed `licence` file.
-- node-http-server 9.1.1: MIT License; see its installed `licence` file.
+- node-http-server 10.0.0: MIT License; see its installed `licence` file.
 - strong-type 2.0.1: MIT License; see its installed `licence` file.
 - vanilla-test 2.1.3: MIT License; see its installed `licence` file.
 - ansi-colors-es6 5.0.0: MIT License; see its installed `LICENSE` file.

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.16.2` SDK contract. Applications pin one exact npm
+This checkout defines the `0.18.0` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 

package/docs/architecture.md

@@ -134,8 +134,10 @@ expiration. The timestamp advances only after the whole resource check succeeds.
 Restarting is not a content synchronization step; inspect the
 selected source route and the last successful check when evaluating freshness.
 
-The shared dev server uses RIAEvangelist's `node-http-server` public interface
-for HTTPS and conditional responses on those selected routes. The SDK
+The shared dev server uses RIAEvangelist's published `node-http-server` 10.0.0
+public interface for HTTPS and conditional responses on those selected routes.
+PEM-backed HTTPS uses Node's `Http2SecureServer` with HTTP/1.1 compatibility;
+clients negotiate either protocol on the same HTTPS port. The SDK
 owns source selection and generated representations. By default, source development
 and every packaged browser preview serve content on HTTPS and redirect their
 paired HTTP listener with status 308 through the public request hook.

package/docs/reference/cli.md

@@ -345,6 +345,9 @@ Network URLs come from one interface snapshot at startup and do not establish
 remote reachability through the machine's firewall or network.
 
 HTTPS is the default for development and required for packaged browser previews.
+The published `node-http-server` 10.0.0 integration negotiates HTTP/2 or HTTP/1.1
+on the same HTTPS port using the configured PEM pair. Source routes, generated
+PWA resources, and conditional responses use the same serving pipeline.
 `--https` remains accepted but is no longer needed to select the transport.
 `--port` selects the HTTPS application port. A second HTTP listener returns
 `308` redirects to that HTTPS port, preserving the requested path and query.

package/docs/reference/mail.md

@@ -320,6 +320,13 @@ address and port. The server can serve callers from multiple domains on the
 same machine. Route the page's `/v1/mail` to this listener, or configure an
 explicit shared endpoint in the caller.
 
+If the selected port is occupied, startup reports
+`Mail port <port> is already taken, possibly by another mail server.`
+The CLI exits with status 1. Programmatic callers receive the same message,
+with native `EADDRINUSE` metadata and the original error retained as `cause`.
+The existing listener remains running; this launch does not retry or select
+another port.
+
 `--app` is an optional server event label and does not restrict incoming
 application names. `--from` is an optional shared sender override; omit it to
 preserve each report's sender or its provider template's default.

package/docs/reference/runtime-components.md

@@ -79,7 +79,7 @@ appropriate.
 | [`markdown-document.html`](#markdown-documenthtml) | Renders and navigates a complete Markdown document with focusable fragments. | `configure()`<br>`load()`<br>`render()`<br>`clear()`<br>`fail()`<br>`focus()`<br>`focusFragment()`<br>`destroy()` | `markdown-document-ready`<br>`markdown-document-state`<br>`markdown-document-loading`<br>`markdown-document-rendered`<br>`markdown-document-empty`<br>`markdown-document-error`<br>`markdown-document-navigate` | Complete Markdown/state normalized; malformed input and Marked/DOM failures remain visible |
 | [`markdown-editor.html`](#markdown-editorhtml) | Configurable Markdown authoring, toolbar, preview, title, and save surface. | `configure()`<br>`focus()`<br>`clear()`<br>`saveEntry()`<br>`destroy()` | `markdown-editor-ready`<br>`markdown-editor-change`<br>`markdown-editor-saved` | Editor values normalized; injected save result mixed |
 | [`media-embed.html`](#media-embedhtml) | Loads a parsed YouTube video or playlist embed with ordinary hosting by default, optional privacy enhancement, and an external-platform action. | `configure()`<br>`load()`<br>`destroy()` | `media-embed-ready`<br>`media-load`<br>`media-error`<br>`media-open-platform` | URL/error normalized; iframe/platform behavior native |
-| [`modal.html`](#modalhtml) | Generic modal with population, open/close, actions, and sequential task execution. | `populate()`<br>`open()`<br>`close()`<br>`runTasks()`<br>`destroy()` | `modal-ready`<br>`modal-opened`<br>`modal-closed`<br>`modal-action` | Modal state normalized; injected task results mixed |
+| [`modal.html`](#modalhtml) | Generic modal with population, configurable user dismissal, actions, and concurrent task execution. | `configure()`<br>`populate()`<br>`open()`<br>`close()`<br>`runTasks()`<br>`destroy()`<br>`running`<br>`opened` | `modal-ready`<br>`modal-opened`<br>`modal-closed`<br>`modal-action` | Modal state normalized; injected task results mixed |
 | [`output-panel.html`](#output-panelhtml) | Presents status, output, body, coverage, actions, pending, error, and cleared states. | `configure()`<br>`setOutput()`<br>`setBody()`<br>`setCoverage()`<br>`setActions()`<br>`setPending()`<br>`setStatus()`<br>`setError()`<br>`clear()`<br>`destroy()` | `output-panel-ready`<br>`output-panel-state`<br>`output-panel-change`<br>`output-panel-action`<br>`output-panel-error`<br>`output-panel-cleared` | DOM-normalized |
 | [`preferences-form.html`](#preferences-formhtml) | Builds a schema-driven preferences form with submit, reset, busy, and status behavior. | `configure()`<br>`getValues()`<br>`setValues()`<br>`setBusy()`<br>`setStatus()`<br>`destroy()` | `preferences-form-ready`<br>`preferences-change`<br>`preferences-submit`<br>`preferences-reset` | Normalized form values |
 | [`pwa-install.html`](#pwa-installhtml) | Presents a dismissible browser installation action with floating or inline placement. | `configure()`<br>`install()`<br>`dismiss()`<br>`destroy()`<br>`state`<br>`ready` | `pwa-install-ready`<br>`pwa-install-change`<br>`pwa-install-dismissed` | Browser install availability and outcome supplied by the shared PWA owner |
@@ -944,11 +944,28 @@ Shared dependencies: [`YouTubeMedia.js`](runtime-modules.md#youtubemediajs).
 
 ### Overview
 
-Generic modal with population, open/close, actions, and sequential task execution.
+Generic modal with population, configurable user dismissal, actions, and concurrent task execution.
 
 ### Public surface
 
-Methods/properties: `populate()`, `open()`, `close()`, `runTasks()`, `destroy()`.
+Methods/properties: `configure()`, `populate()`, `open()`, `close()`, `runTasks()`,
+`destroy()`, `running`, `opened`.
+
+`configure({dismissible})` synchronously returns the current `{dismissible}`
+configuration, or `false` after destruction. `dismissible` starts as `true`;
+omitting it preserves the current choice. A supplied value must be a boolean.
+Setting it to `false` hides the close button and prevents user dismissal through
+Escape, backdrop clicks and the close button. Setting it back to `true` restores
+normal user dismissal. The choice persists across population, open/close cycles
+and task completion. If the close button held focus when disabled, focus moves
+to a content control or the focusable modal body.
+
+This option does not prevent the owning application from calling `close()` or
+`destroy()`. The existing running-task behavior remains: `close()` leaves a
+running modal open unless called with its existing second `force` argument set
+to `true`; `destroy()` releases the component. Product-specific conditions for
+closing a modal belong to the application. Content, actions and task results
+are preserved, and `runTasks()` continues to execute independent jobs concurrently.
 
 Events: `modal-ready`, `modal-opened`, `modal-closed`, `modal-action`.
 

package/docs/reference/sdk-api.md

@@ -3464,14 +3464,15 @@ async function useselectApp(...arguments_) {
 
 Starts one owned browser development server with exact runtime/app route mappings and a caller-selected bind address.
 
-HTTP and HTTPS serving use the published `node-http-server` module. The SDK
+HTTP and HTTPS serving use published `node-http-server` 10.0.0. The SDK
 selects source routes and supplies generated representations; the module owns
 static-file conditional GET/HEAD handling and response delivery. The SDK
 retains modification dates for its generated representations. Unchanged
 resources can return `304` with no body while changed resources return their
-complete current representation. PEM-path listeners use module deployment;
-explicit raw `tls` options retain native HTTPS transport with the same module
-response and static-file operations.
+complete current representation. PEM-path listeners use module deployment and
+negotiate HTTP/2 or HTTP/1.1 on the same HTTPS port. Explicit raw `tls` options
+retain native HTTPS transport with the same module response and static-file
+operations.
 
 ### Signature, modes, and result
 
@@ -3518,8 +3519,12 @@ requirements remain browser-owned; see [explicit HTTP development](cli.md#explic
 The promise settles after all selected listeners are ready and resolves to
 `{server, protocol, mode, workspaceRoot, appId, host, port, origin, cleanUrl, url,
 networkUrls, httpPort, httpOrigin, httpUrl, close, closed, lifecycle}`. `server` is the raw Node
-server for application content; `protocol` is `'https:'` by default or `'http:'`
-with explicit HTTP source mode.
+server for application content: `Http2SecureServer` for PEM-backed HTTPS,
+`https.Server` for explicit raw `tls` options, or `http.Server` for explicit
+HTTP source mode. HTTP/2 uses Node's compatibility request/response APIs;
+callers accessing the raw server must account for its native type.
+`protocol` describes the URL scheme: `'https:'` for either negotiated HTTPS
+protocol or `'http:'` with explicit HTTP source mode.
 `url` and `cleanUrl` are the same application URL. Wildcard listeners use
 `localhost` in that local URL; `host` retains the actual bound address.
 `httpPort` is the actual HTTP listener port, `httpOrigin` is its HTTP origin,

package/docs/reviews/mail-server-purpose-review.md

@@ -159,6 +159,7 @@ The upstream listener and public lifecycle follow.
 | `deployMailServer` | Adapts published `deploy(callback)` into listener startup promise. | Y/Y/N — Keep. | Startup must return the actual bound address or an actual bind error. Current name: `listenForMailRequests`. |
 | `waitForMailListener` | Owns the startup promise. | Y/Y/N — Keep. | Required callback-to-promise adapter at the upstream owner. Name is clear. |
 | Listener `onError` | Rejects startup when binding fails. | Y/Y/N — Keep. | Do not claim listening before this boundary. Current callback name remains `onError`, local to the listener promise. |
+| Occupied-port startup message | `startResendMailServer` handles the actual native `EADDRINUSE` after closing its failed launch resources. | Y/Y/N — Keep. | Identifies the selected mail port and says another mail server may own it. The existing CLI failure path exits with status 1; native error metadata and the complete original cause remain available. One failure-only branch replaces the generic bind message, with no port probe, retry, process control, or work on successful requests. Source and diff reviewed; this follow-up was not exercised locally. |
 | `onListening` | Removes startup error listener and resolves actual raw server. | Y/Y/N — Keep. | Retain upstream callback semantics. Current callback name remains `onListening`; its `(instance, server)` positions follow the upstream callback. |
 | `startResendMailServer` | Constructs upstream server and mail handler, then exposes lifecycle. | Y/Y/Y — Keep entry point; remove duplicate configuration/loopback gate. | Use configured host/domain; keep selected upstream public interface and no implicit socket deadline. Preserve public name. |
 | `handleMailRequest` assigned to `onRawRequest` | Hands original Node request/response to mail handler and returns true. | Y/Y/N — Keep. | `true` prevents upstream body/static processing of an already-owned mail request. Current name: `routeRawMailRequest`, distinct from the actual request handler. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.16.3",
+  "version": "0.18.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -68,7 +68,7 @@
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
     "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
-    "test:functional": "node ./bin/arcane-test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/cli.test.mjs test/dbopfs-document-library.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/update-check.test.mjs",
+    "test:functional": "node ./bin/arcane-test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/cli.test.mjs test/dbopfs-document-library.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/modal.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/update-check.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-plan.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
     "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
     "check": "node tools/check-source.mjs && npm test",
@@ -106,7 +106,7 @@
   },
   "dependencies": {
     "event-pubsub": "6.1.0",
-    "node-http-server": "9.1.1",
+    "node-http-server": "10.0.0",
     "strong-type": "2.0.1",
     "vanilla-test": "2.1.3"
   },

package/runtime/arcane/components/modal.html

@@ -150,7 +150,7 @@
         <button id="close" class="modal-button" part="close" type="button" aria-label="Close" title="Close">&#10005;</button>
         <header id="modal-header" class="modal-header" part="header" hidden><slot id="header-slot" name="header"></slot></header>
         <input type="search" id="modal-search" class="modal-search hidden" part="search" placeholder="Search..." aria-label="Search modal content">
-        <div id="modal-content" class="modal-content" part="body"><slot name="body"></slot></div>
+        <div id="modal-content" class="modal-content" part="body" tabindex="-1"><slot name="body"></slot></div>
         <footer id="modal-footer" class="modal-footer" part="footer" hidden><slot id="footer-slot" name="footer"></slot></footer>
     </div>
 </dialog>
@@ -174,11 +174,13 @@
     const modalStack=window.modalStack=window.modalStack||[];
 
     let running=false;
+    let dismissible = true;
     let disposed=false;
     let activeRun=Promise.resolve([]);
     let returnFocus=null;
 
     host.ready=false;
+    host.configure = configure;
     host.populate=populate;
     host.open=open;
     host.close=close;
@@ -195,13 +197,18 @@
         opened:{get:function getOpenedState(){return dialog.open;}}
     });
 
-    dialog.addEventListener('cancel',function preventRunningDialogCancellation(event){
-        event.preventDefault();
-        close(event);
-    });
+    dialog.addEventListener(
+        'cancel',
+        function handleDialogCancellation(event) {
+            event.preventDefault();
+            if (dismissible) {
+                close(event);
+            }
+        }
+    );
 
     dialog.addEventListener('click',function closeFromDialogBackdrop(event){
-        if(event.target!==dialog||running){
+        if (event.target !== dialog || running || !dismissible) {
             return;
         }
         const bounds=dialog.getBoundingClientRect();
@@ -214,9 +221,45 @@
         }
     });
 
-    closeButton.addEventListener('click',function closeFromButton(event){
-        close(event);
-    });
+    closeButton.addEventListener(
+        'click',
+        function closeFromButton(event) {
+            if (dismissible) {
+                close(event);
+            }
+        }
+    );
+
+    function configure(input = {}) {
+        if (disposed) return false;
+        if (input === null || !is.object(input) || is.array(input)) {
+            throw new TypeError('Modal configuration must be an object.');
+        }
+        if (input.dismissible !== undefined) {
+            if (!is.boolean(input.dismissible)) {
+                throw new TypeError('Modal dismissible must be a boolean.');
+            }
+            dismissible = input.dismissible;
+        }
+        const closeButtonFocused = shadowRoot.activeElement === closeButton;
+        updateCloseButton();
+        if (dialog.open && !dismissible && closeButtonFocused) {
+            focusOpenedModal();
+        }
+        return {dismissible};
+    }
+
+    function updateCloseButton() {
+        closeButton.classList.toggle('hidden', running || !dismissible);
+    }
+
+    function focusOpenedModal() {
+        const focusTarget = modalContent.querySelector('[autofocus],input:not([disabled]),select:not([disabled]),textarea:not([disabled]),button:not([disabled]),a[href]')
+            || (running || !dismissible ? modalContent : closeButton);
+        focusTarget.focus(
+            {preventScroll: true}
+        );
+    }
 
     for(const slot of [headerSlot,footerSlot]){
         const region=slot.parentElement;
@@ -253,10 +296,7 @@
                 ?document.activeElement
                 :null;
             dialog.showModal();
-            queueMicrotask(function focusOpenedModal(){
-                const focusTarget=modalContent.querySelector('[autofocus],input:not([disabled]),select:not([disabled]),textarea:not([disabled]),button:not([disabled]),a[href]')||closeButton;
-                focusTarget?.focus({preventScroll:true});
-            });
+            queueMicrotask(focusOpenedModal);
             emit('modal-opened',{}, {opened:true});
         }
         return true;
@@ -274,7 +314,7 @@
         if(wasOpen){
             dialog.close();
         }
-        closeButton.classList.remove('hidden');
+        updateCloseButton();
 
         const stackIndex=modalStack.indexOf(host);
         if(stackIndex>-1){
@@ -317,7 +357,7 @@
     }
 
     async function populate(content='<p>Content goes here</p>',search=false){
-        closeButton.classList.remove('hidden');
+        updateCloseButton();
         modalSearch.classList.toggle('hidden',!search);
         if(content instanceof Node){
             modalContent.replaceChildren(content);
@@ -349,7 +389,7 @@
         }
 
         running=true;
-        closeButton.classList.add('hidden');
+        updateCloseButton();
         modalSearch.classList.add('hidden');
         modalContent.replaceChildren();
 
@@ -399,16 +439,20 @@
             return result.status==='rejected';
         });
         running=false;
-        closeButton.classList.remove('hidden');
+        updateCloseButton();
 
         if(failed){
             heading.innerText='Some Tasks Could Not Be Completed';
-            message.innerText='You may close this message and try again.';
+            message.innerText = dismissible
+                ? 'You may close this message and try again.'
+                : 'Review the failed tasks and try again.';
             return results;
         }
 
         heading.innerText='All Tasks Complete';
-        message.innerText='Every task completed. You may close this message.';
+        message.innerText = dismissible
+            ? 'Every task completed. You may close this message.'
+            : 'Every task completed.';
         return results;
     }
 

package/src/mail-server.mjs

@@ -1033,6 +1033,15 @@ export async function startResendMailServer(options={}){
         server=await listenForMailRequests(mailServer);
     }catch(error){
         await Promise.allSettled([mailServer.close(),requestHandler.close()]);
+        if (error?.code === 'EADDRINUSE') {
+            throw Object.assign(
+                new Error(
+                    `Mail port ${configuration.port} is already taken, possibly by another mail server.`,
+                    {cause:error}
+                ),
+                error
+            );
+        }
         throw error;
     }
     const address=server.address();