arcane-os 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.18.0
+
+- Adopt published `node-http-server` 10.0.0. PEM-backed development and
+  packaged-preview HTTPS now negotiate HTTP/2 or HTTP/1.1 on the same port
+  through the existing module integration, with no new runtime dependency.
+- Document the returned `Http2SecureServer` for PEM-backed HTTPS. Preserve
+  raw `tls` options on native `https.Server`, explicit HTTP development, the
+  HTTP mail gateway, paired HTTP `308` redirects, source/PWA routes, complete
+  responses, conditional caching, and owned listener shutdown.
+- Adapt the shared synthetic TLS fixture to both native TLS constructors while
+  retaining option capture and cleanup. The fixture models routing and option
+  delegation; it does not establish a real TLS handshake or protocol negotiation.
+- Report an occupied mail listener port clearly while retaining native
+  `EADDRINUSE` details, the original cause, and the existing startup cleanup.
+
 ## 0.17.0
 
 - Add neutral `modal.configure({dismissible})` configuration, defaulting to

package/NOTICE

@@ -8,7 +8,7 @@ informational notice and is not itself a grant of commercial rights.
 Third-party material retains its own terms:
 
 - event-pubsub 6.1.0: MIT License; see its installed `licence` file.
-- node-http-server 9.1.1: MIT License; see its installed `licence` file.
+- node-http-server 10.0.0: MIT License; see its installed `licence` file.
 - strong-type 2.0.1: MIT License; see its installed `licence` file.
 - vanilla-test 2.1.3: MIT License; see its installed `licence` file.
 - ansi-colors-es6 5.0.0: MIT License; see its installed `LICENSE` file.

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.16.2` SDK contract. Applications pin one exact npm
+This checkout defines the `0.18.0` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 

package/docs/architecture.md

@@ -134,8 +134,10 @@ expiration. The timestamp advances only after the whole resource check succeeds.
 Restarting is not a content synchronization step; inspect the
 selected source route and the last successful check when evaluating freshness.
 
-The shared dev server uses RIAEvangelist's `node-http-server` public interface
-for HTTPS and conditional responses on those selected routes. The SDK
+The shared dev server uses RIAEvangelist's published `node-http-server` 10.0.0
+public interface for HTTPS and conditional responses on those selected routes.
+PEM-backed HTTPS uses Node's `Http2SecureServer` with HTTP/1.1 compatibility;
+clients negotiate either protocol on the same HTTPS port. The SDK
 owns source selection and generated representations. By default, source development
 and every packaged browser preview serve content on HTTPS and redirect their
 paired HTTP listener with status 308 through the public request hook.

package/docs/reference/cli.md

@@ -345,6 +345,9 @@ Network URLs come from one interface snapshot at startup and do not establish
 remote reachability through the machine's firewall or network.
 
 HTTPS is the default for development and required for packaged browser previews.
+The published `node-http-server` 10.0.0 integration negotiates HTTP/2 or HTTP/1.1
+on the same HTTPS port using the configured PEM pair. Source routes, generated
+PWA resources, and conditional responses use the same serving pipeline.
 `--https` remains accepted but is no longer needed to select the transport.
 `--port` selects the HTTPS application port. A second HTTP listener returns
 `308` redirects to that HTTPS port, preserving the requested path and query.

package/docs/reference/mail.md

@@ -320,6 +320,13 @@ address and port. The server can serve callers from multiple domains on the
 same machine. Route the page's `/v1/mail` to this listener, or configure an
 explicit shared endpoint in the caller.
 
+If the selected port is occupied, startup reports
+`Mail port <port> is already taken, possibly by another mail server.`
+The CLI exits with status 1. Programmatic callers receive the same message,
+with native `EADDRINUSE` metadata and the original error retained as `cause`.
+The existing listener remains running; this launch does not retry or select
+another port.
+
 `--app` is an optional server event label and does not restrict incoming
 application names. `--from` is an optional shared sender override; omit it to
 preserve each report's sender or its provider template's default.

package/docs/reference/sdk-api.md

@@ -3464,14 +3464,15 @@ async function useselectApp(...arguments_) {
 
 Starts one owned browser development server with exact runtime/app route mappings and a caller-selected bind address.
 
-HTTP and HTTPS serving use the published `node-http-server` module. The SDK
+HTTP and HTTPS serving use published `node-http-server` 10.0.0. The SDK
 selects source routes and supplies generated representations; the module owns
 static-file conditional GET/HEAD handling and response delivery. The SDK
 retains modification dates for its generated representations. Unchanged
 resources can return `304` with no body while changed resources return their
-complete current representation. PEM-path listeners use module deployment;
-explicit raw `tls` options retain native HTTPS transport with the same module
-response and static-file operations.
+complete current representation. PEM-path listeners use module deployment and
+negotiate HTTP/2 or HTTP/1.1 on the same HTTPS port. Explicit raw `tls` options
+retain native HTTPS transport with the same module response and static-file
+operations.
 
 ### Signature, modes, and result
 
@@ -3518,8 +3519,12 @@ requirements remain browser-owned; see [explicit HTTP development](cli.md#explic
 The promise settles after all selected listeners are ready and resolves to
 `{server, protocol, mode, workspaceRoot, appId, host, port, origin, cleanUrl, url,
 networkUrls, httpPort, httpOrigin, httpUrl, close, closed, lifecycle}`. `server` is the raw Node
-server for application content; `protocol` is `'https:'` by default or `'http:'`
-with explicit HTTP source mode.
+server for application content: `Http2SecureServer` for PEM-backed HTTPS,
+`https.Server` for explicit raw `tls` options, or `http.Server` for explicit
+HTTP source mode. HTTP/2 uses Node's compatibility request/response APIs;
+callers accessing the raw server must account for its native type.
+`protocol` describes the URL scheme: `'https:'` for either negotiated HTTPS
+protocol or `'http:'` with explicit HTTP source mode.
 `url` and `cleanUrl` are the same application URL. Wildcard listeners use
 `localhost` in that local URL; `host` retains the actual bound address.
 `httpPort` is the actual HTTP listener port, `httpOrigin` is its HTTP origin,

package/docs/reviews/mail-server-purpose-review.md

@@ -159,6 +159,7 @@ The upstream listener and public lifecycle follow.
 | `deployMailServer` | Adapts published `deploy(callback)` into listener startup promise. | Y/Y/N — Keep. | Startup must return the actual bound address or an actual bind error. Current name: `listenForMailRequests`. |
 | `waitForMailListener` | Owns the startup promise. | Y/Y/N — Keep. | Required callback-to-promise adapter at the upstream owner. Name is clear. |
 | Listener `onError` | Rejects startup when binding fails. | Y/Y/N — Keep. | Do not claim listening before this boundary. Current callback name remains `onError`, local to the listener promise. |
+| Occupied-port startup message | `startResendMailServer` handles the actual native `EADDRINUSE` after closing its failed launch resources. | Y/Y/N — Keep. | Identifies the selected mail port and says another mail server may own it. The existing CLI failure path exits with status 1; native error metadata and the complete original cause remain available. One failure-only branch replaces the generic bind message, with no port probe, retry, process control, or work on successful requests. Source and diff reviewed; this follow-up was not exercised locally. |
 | `onListening` | Removes startup error listener and resolves actual raw server. | Y/Y/N — Keep. | Retain upstream callback semantics. Current callback name remains `onListening`; its `(instance, server)` positions follow the upstream callback. |
 | `startResendMailServer` | Constructs upstream server and mail handler, then exposes lifecycle. | Y/Y/Y — Keep entry point; remove duplicate configuration/loopback gate. | Use configured host/domain; keep selected upstream public interface and no implicit socket deadline. Preserve public name. |
 | `handleMailRequest` assigned to `onRawRequest` | Hands original Node request/response to mail handler and returns true. | Y/Y/N — Keep. | `true` prevents upstream body/static processing of an already-owned mail request. Current name: `routeRawMailRequest`, distinct from the actual request handler. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -106,7 +106,7 @@
   },
   "dependencies": {
     "event-pubsub": "6.1.0",
-    "node-http-server": "9.1.1",
+    "node-http-server": "10.0.0",
     "strong-type": "2.0.1",
     "vanilla-test": "2.1.3"
   },

package/src/mail-server.mjs

@@ -1033,6 +1033,15 @@ export async function startResendMailServer(options={}){
         server=await listenForMailRequests(mailServer);
     }catch(error){
         await Promise.allSettled([mailServer.close(),requestHandler.close()]);
+        if (error?.code === 'EADDRINUSE') {
+            throw Object.assign(
+                new Error(
+                    `Mail port ${configuration.port} is already taken, possibly by another mail server.`,
+                    {cause:error}
+                ),
+                error
+            );
+        }
         throw error;
     }
     const address=server.address();