arcane-os 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.21.0
+
+- Serve mail over HTTPS with HTTP/2 through the published `node-http-server`
+  PEM API, with HTTP/1.1 fallback on the same selected port, default 8025.
+  Preserve the friendly occupied-port failure and owned listener lifecycle.
+- Read `MAIL_TLS_CERT_PATH` and `MAIL_TLS_KEY_PATH` with the provider profile
+  from `.env.json` in one startup read. Resolve relative PEM paths from that
+  file's directory and report missing TLS settings before binding. Keep file
+  and TLS handling portable across Windows, Linux and macOS.
+- Use native HTTP/2 headers and authority for the mail and CORS contracts,
+  preserving exact report content, subscription verification, provider
+  outcomes, existing credential injection and cancellation.
+- Extend the mail reference and purpose-gate report with TLS ownership and
+  configuration; add focused protocol and configuration test source.
+
+## 0.20.0
+
+- Restore repository-shaped application packages: selected app files remain
+  under `apps/<id>/`, alongside shared `arcane/` and configured runtime routes.
+  Authored document bases, import maps, module-relative imports and application
+  resource paths retain their development layout without rewriting product
+  documents or application code to relocate them.
+- Restore deployment-relative `ARCANE_APP_RELEASE.app.start` and a root
+  `index.html` launcher while preserving the app-relative `app.entry` identity.
+  Package consumers use `app.start` for navigation. SDK packaged previews honor
+  that field and retain support for earlier flat packages through `app.entry`.
+- Keep generated PWA files at the deployment root, resolve manifest metadata
+  against the packaged app directory, and preserve app-relative offline
+  selections alongside shared runtime paths. Source import-map inspection keeps
+  app-relative document paths and separately reports emitted package paths.
+- Align packaging references with the current public return values and explicit
+  source import-map generation. Add package-layout and nested-deployment test
+  source while retaining complete authored-content coverage.
+
 ## 0.19.0
 
 - Read mail credentials from `.env.json` in the invocation directory through

package/README.md

@@ -19,12 +19,13 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.19.0` SDK contract. Applications pin one exact npm
+This checkout defines the `0.21.0` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 
-The [mail gateway](docs/reference/mail.md) serves the configured host and defaults
-browser mail to `/v1/mail` on the current domain. Multiple applications can share
+The [mail gateway](docs/reference/mail.md) serves HTTPS with HTTP/2 on port 8025,
+using certificate paths from `.env.json`, and defaults browser mail to
+`/v1/mail` on the current domain. Multiple applications can share
 one server with explicit allowed origins. Subscription verification is disabled
 until a `verifySubscription` callback is configured; that callback receives the
 application name and bearer subscription key before each provider attempt.

package/docs/architecture.md

@@ -199,9 +199,27 @@ URLs and release schema:
 apps/<id>/arcane-app.json
 apps/<id>/arcane-package.json
 apps/<id>/index.html
+dist/<id>/index.html
+dist/<id>/apps/<id>/index.html
 dist/<id>/ARCANE_APP_RELEASE.json
 ```
 
+Packaging places each selected app file beneath `apps/<id>/` in the release
+and preserves every shared route destination. When no selected shared payload
+supplies a root `index.html`, the SDK generates one that opens the selected app
+entry. Authored document bases, app URLs, relative module imports, and shared
+runtime paths therefore resolve through the same layout in
+source development and packaged delivery. Packaging consumes the saved source
+and managed import maps; use `arcane import-map` to refresh those maps, or the
+ordinary `arcane dev` startup that performs that refresh.
+
+The release manifest keeps `app.entry` relative to the app directory and records
+the package launch URL in `app.start`, such as
+`./apps/hello-world/index.html`. Its complete `files` inventory includes the
+root `index.html` and the prefixed app files. Packaged browser serving opens
+`app.start`; a previously generated flat release without `app.start` retains
+its `app.entry` launch path.
+
 The authored schema-2 descriptor is canonical for new apps and projects an
 exact schema-1 `arcane-package.json` for current consumers. Existing Arcane
 apps synthesize that descriptor from their schema-1 package plus the current

package/docs/reference/cli.md

@@ -48,7 +48,7 @@ meaning and cardinality rules:
 | `--workspace` | directory | Commands that select an external or integrated workspace; defaults to `.`. |
 | `--app` | app id or label | Workspace/app operations except shared scope and `verify-bundle`; optional diagnostic label for `mail serve`. |
 | `--arcane-root` | directory | `doctor`, native `build`/`run`, `native-doctor`, `native-prepare` |
-| `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to HTTPS at `127.0.0.1:8000`; `mail serve` defaults to HTTP at `0.0.0.0:8025` and accepts an explicit bind host. |
+| `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to HTTPS at `127.0.0.1:8000`; `mail serve` defaults to HTTPS with HTTP/2 at `0.0.0.0:8025` and accepts an explicit bind host. |
 | `--http-port` | integer 0–65535 | Browser `dev`/`run` HTTP redirect listener; defaults to `0`, which selects an available port. |
 | `--public` | flag | `dev`; binds to `0.0.0.0` unless `--host` explicitly selects another address. |
 | `--http` | flag | `dev` only; serves source and PWA routes on one HTTP listener selected by `--port`, without TLS. |
@@ -195,8 +195,8 @@ Wrong or duplicate explicit app identity fails. The renderer then requires one
 path-correct base for every selected document. Included HTML files with neither
 the identity marker nor an active base are component fragments: they remain
 package files and are not rewritten with a document-level import map.
-Packaging and development use the same discovery owner, so directly navigable
-source pages and packaged pages receive the same complete managed import-map JSON.
+Packaging and development use the same discovery owner. Packaging consumes
+the saved managed import maps in directly navigable source pages.
 
 ```text
 arcane import-map [--workspace <directory>] [--app <id>]
@@ -254,19 +254,12 @@ together. A post-commit observer failure preserves delivery with
 `eventDelivery.status === 'degraded'` and `ARCANE_EVENT_DELIVERY_FAILED`; it
 does not roll back complete application content.
 
-An external package also publishes `/ARCANE_RUNTIME_PROJECTION.json`. The JSON
-is `{schemaVersion:1,kind:'arcane-app-runtime-projection',sdkVersion,
-pathPrefix:'arcane/',files:[{path}]}` and lists the complete packaged runtime.
-The development server exposes the same public route from its workspace
-projection. The private `/ARCANE_APP_RELEASE.json` record is not served to
-application code. Malformed projection data fails
-`ARCANE_RUNTIME_PROJECTION_INVALID`.
-
 `new` and `init` generate the map during scaffolding. `dev` refreshes all
-selected documents once before binding; non-dry-run `package` refreshes them
-once, then collects the complete release. Packaging does not run tests or
-checks automatically. Browser `build` and paired native packaging reuse the
-package flow. Explicit `test` and `check` operations read the existing map without regenerating it;
+selected documents once before binding. `package` consumes the saved source
+and maps; use `import-map` to refresh them explicitly before selecting output
+that needs updated maps. Packaging does not run tests or checks automatically.
+Browser `build` and paired native packaging reuse the package flow.
+Explicit `test` and `check` operations read the existing map without regenerating it;
 `verify`, `bundle`, and browser `run` do not regenerate it. There is no
 watcher, polling, scheduled refresh, download, or self-update behavior.
 
@@ -504,9 +497,12 @@ npm exec -- arcane check --app hello-world
 ### Overview
 
 Creates one complete browser release beneath `dist/<id>/`, preserving the prior
-output until the replacement is complete. It refreshes the selected document
-map once, then assembles `dist`. Packaging does not run tests or checks
-automatically.
+output until the replacement is complete. It consumes saved source and managed
+import maps, places app files beneath `apps/<id>/`, and retains the configured
+shared route destinations. When selected shared content supplies no root
+`index.html`, the SDK generates one that opens the selected app entry.
+Source document bases and resource URLs therefore retain their development
+layout. Packaging does not run tests or checks automatically.
 
 ```text
 arcane package [--app <id>] [--dry-run]
@@ -515,6 +511,9 @@ arcane package [--app <id>] [--dry-run]
 ### Result
 
 The result includes the release root, manifest, and complete selected inventory.
+`ARCANE_APP_RELEASE.json` keeps the authored app-relative `app.entry` and records
+the package launch URL in `app.start`, such as `./apps/hello-world/index.html`.
+The file inventory includes that app tree and the root `index.html`.
 `--dry-run` plans the package without refreshing source, running tests, or
 replacing output.
 
@@ -672,6 +671,8 @@ npm exec -- arcane build \
 
 For `--target browser`, starts the existing current `dist/<app>` release; it
 does not package, rebuild, test, check, or verify that release automatically.
+It opens the release manifest's `app.start` URL. Older flat releases without
+that field continue to open their `app.entry` path.
 The preview always uses HTTPS with the workspace certificate pair. Supply
 `--cert <file> --key <file>` together to use another pair; see
 [development HTTPS setup](#development-https-setup).
@@ -905,7 +906,7 @@ loss after the attempt begins is ambiguous because Resend may have accepted it.
 
 ### Mail gateway
 
-`mail serve` starts one owned Node HTTP gateway:
+`mail serve` starts one owned HTTPS gateway with HTTP/2:
 
 ```text
 arcane mail serve [--profile <profile>] [--from <verified-sender>] [--app <label>] [--origin <exact-origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 8025] [--request-timeout <ms>]
@@ -913,6 +914,30 @@ arcane mail serve [--profile <profile>] [--from <verified-sender>] [--app <label
 
 The selected `.env.json` profile supplies only the server-side Resend API key;
 omitting `--profile` selects `mail`.
+
+Add the listener's certificate configuration at the top level of the same file:
+
+```json
+{
+  "RESEND_API_KEY": "",
+  "MAIL_TLS_CERT_PATH": ".arcane/mail/fullchain.pem",
+  "MAIL_TLS_KEY_PATH": ".arcane/mail/private-key.pem"
+}
+```
+
+Supply an existing PEM certificate chain and its private key. Paths resolve
+relative to `.env.json`, or may be absolute. They are shared across provider
+profiles. Missing TLS settings name the fields to fill in before a listener
+opens; the TLS owner reports PEM file errors. Keep private-key material outside
+tracked source. The SDK repository already ignores `.arcane/` and `.env.json`.
+
+The selected `node-http-server` module negotiates HTTP/2 with HTTP/1.1 fallback
+on the same HTTPS port, default `8025`, with no plain-HTTP listener. Callers use
+a hostname covered by the certificate, such as
+`https://mail.example.com:8025/v1/mail`; `0.0.0.0` identifies the bind address.
+Restart the gateway after replacing renewed certificate files. Certificate
+issuance and renewal remain with the deployment's certificate owner.
+
 The CLI does not read a browser app key. Its optional `--app` value labels the
 server; the incoming request's `X-Mail-App` identifies the application for
 subscription verification. The HTTP authentication contract pairs that

package/docs/reference/mail.md

@@ -273,11 +273,13 @@ committed acceptance result.
 ## Operate the CLI and gateway
 
 Create `.env.json` in the directory from which the mail command runs, then fill
-in the provider key:
+in the provider key and the HTTPS certificate paths:
 
 ```json
 {
-  "RESEND_API_KEY": ""
+  "RESEND_API_KEY": "",
+  "MAIL_TLS_CERT_PATH": "",
+  "MAIL_TLS_KEY_PATH": ""
 }
 ```
 
@@ -370,6 +372,34 @@ address and port. The server can serve callers from multiple domains on the
 same machine. Route the page's `/v1/mail` to this listener, or configure an
 explicit shared endpoint in the caller.
 
+`mail serve` uses HTTPS with HTTP/2 on that selected port. The published
+`node-http-server` PEM API owns TLS and negotiates HTTP/2 or HTTP/1.1 on the
+same listener. It creates no additional plain-HTTP listener. The returned URL
+uses `https://`; `0.0.0.0` is the bind address, so callers use the deployed
+domain, for example `https://mail.example.com:8025/v1/mail`.
+
+Set `MAIL_TLS_CERT_PATH` to the PEM certificate chain and `MAIL_TLS_KEY_PATH`
+to its PEM private-key file. These top-level settings belong to the listener
+and apply regardless of the selected provider profile. Relative paths resolve
+from the directory containing `.env.json`; absolute paths are also accepted.
+The certificate must cover the hostname callers use. One certificate may
+cover multiple names; the gateway does not require one certificate per calling
+application. Keep private-key files outside tracked source, such as in the
+already-ignored `.arcane/` directory or an existing host certificate directory.
+
+Startup reads the JSON configuration once, reports missing TLS settings before
+binding, and lets the TLS owner report unreadable or unusable PEM files. It
+does not generate certificates, modify system trust, or add a renewal watcher.
+Restart the gateway after the configured certificate files are renewed.
+The same Node file and TLS APIs are used on Windows, Linux, and macOS; Android
+requires a compatible Node host and accessible configuration and certificate
+paths. These platform contracts are separate from actual platform execution.
+
+The public `createToolchain().mail({action: 'serve', ...options})` operation
+uses the same JSON certificate pair. Internally, `startResendMailServer` accepts
+`certPath` and `keyPath` and retains its existing HTTP behavior when neither
+is supplied. That internal function is not an npm package export.
+
 If the selected port is occupied, startup reports
 `Mail port <port> is already taken, possibly by another mail server.`
 The CLI exits with status 1. Programmatic callers receive the same message,
@@ -383,7 +413,8 @@ preserve each report's sender or its provider template's default.
 `--origin` selects an exact allowed caller origin; the
 programmatic `origin` option also accepts an array for multiple origins. With
 no origins configured, the gateway accepts an Origin matching its request
-Host using HTTP or HTTPS. Requests without Origin continue normally.
+authority (`:authority` for HTTP/2, `Host` for HTTP/1.1) using HTTP or HTTPS.
+Requests without Origin continue normally.
 Cross-origin preflight permits `Content-Type`, `Idempotency-Key`, `X-Mail-App`,
 and `Authorization`. This is origin configuration, not a loopback policy.
 
@@ -423,7 +454,7 @@ POST request before any provider attempt; results are not cached.
 
 | Configured-verifier outcome | Gateway response |
 | --- | --- |
-| Missing, empty, or repeated `X-Mail-App` | `400 mail_invalid_headers` |
+| Missing or empty `X-Mail-App` | `400 mail_invalid_headers` |
 | Missing or malformed Bearer credential | `401 mail_subscription_required` |
 | Callback returns anything except `true` | `401 mail_subscription_invalid` |
 | Callback throws | `503 mail_subscription_verification_failed`, retryable with the configured `retryableDelayMs` |
@@ -435,6 +466,11 @@ result. The SDK supplies no default verification URL or built-in Stripe
 endpoint adapter. Connecting the actual subscription endpoint is a separate
 hosting integration.
 
+The gateway uses Node's native header representations. HTTP/1.1 uses
+`headersDistinct`, retaining its repeated-field detection. HTTP/2 uses the
+compatibility request's `headers` object; Node owns duplicate joining or
+discarding for each field. The SDK does not split a native header value again.
+
 CLI startup output says `Subscription verification: disabled` or
 `Subscription verification: configured`. Structured `server.ready` output
 includes the corresponding `callerAuthentication` value.

package/docs/reference/pwa.md

@@ -39,13 +39,20 @@ display preference, routes and descriptions. Use real app icons; the SDK does
 not invent branding or claim that a browser has installed the app.
 
 Manifest URL fields are relative to the application directory. Source delivery
-and packaged delivery resolve those fields into their respective layouts.
-Absolute URL fields retain their authored destination.
+and packaged delivery retain the app tree at `apps/<id>/`. For packaged output,
+the default `start_url` is `./apps/<id>/<entry>`, resolved from the generated
+root manifest. The default `id` and `scope` remain `./`, preserving the existing
+deployment-root installation identity. Authored relative URL fields, including
+explicit `id` and `scope` values, resolve against `./apps/<id>/`; an icon such
+as `img/library.png` therefore remains beneath the app directory. Absolute URL
+fields retain their authored destination.
 
 `offline.include` and `offline.exclude` select literal paths or directory
 prefixes from the selected emitted inventory. An omitted or empty include list
 selects that inventory; exclusions subtract from it. App files use app-relative
 paths and shared runtime files use paths such as `arcane/sdk/pwa.mjs`.
+For example, selecting `modules` matches packaged
+`apps/<id>/modules/...`; emitted offline URLs keep the `apps/<id>/` prefix.
 The application entry and generated PWA shell records are retained. Select the
 resources needed by every offline page, including its shared modules and styles.
 The worker script itself is never an application cache entry.
@@ -67,6 +74,13 @@ Browser packaging emits these files at the selected deployment root:
 | `arcane-sw.js` | Stable worker URL with the selected offline manifest embedded in its source. |
 | `arcane-pwa.mjs` | Independent registration and installation-component bootstrap importing the SDK client. |
 
+The selected app files remain under `apps/<id>/`, with shared runtime routes
+alongside them. The SDK supplies a root `index.html` launcher when selected
+shared content has no root page. The generated PWA files stay at the deployment
+root so their worker can serve the selected app and shared resources. The
+worker is registered for the deployment root independently of any app-authored
+manifest scope.
+
 Each packaged output gets one deployment revision shared by its offline
 manifest and worker. It distinguishes separately generated outputs even when
 their app and SDK versions match. It is not a content measurement.

package/docs/reference/sdk-api.md

@@ -719,6 +719,12 @@ matching `meta[name="arcane-app-id"]`; unmarked pages with an active `base`
 remain selected for patch compatibility. Included HTML with neither signal is
 retained as a package fragment rather than rewritten as a document.
 
+`entry` and each app browser document's `path` stay relative to the app
+directory. Each browser document also reports `packagePath`, the emitted path
+such as `apps/hello-world/index.html`. The complete `files` inventory uses
+package-relative paths and includes the root `index.html`. Shared
+files retain their configured route destinations.
+
 ### Availability and normalization
 
 **Node.** Normalized SDK validation with complete canonical archive and release content. Deep protocol: [SDK packager and deterministic bundle contract](protocols.md).
@@ -772,27 +778,22 @@ when explicitly requested or when required for this selected release output.
 async packageApp(options)
 ```
 
-Import it from `arcane-os` or `arcane-os/packager`. Packaging refreshes the
-managed map once and preserves the complete selected source and browser
-document inventory. It rejects malformed configuration, descriptors,
-and the malformed selected release archive while preserving the previously
-selected output on failure. Each selected browser document receives the same
-deterministic map. The package root also contains the public
-`ARCANE_RUNTIME_PROJECTION.json` inventory:
-
-```javascript
-{
-  schemaVersion: 1,
-  kind: 'arcane-app-runtime-projection',
-  sdkVersion: '0.5.18',
-  pathPrefix: 'arcane/',
-  files: [{path}]
-}
-```
+Import it from `arcane-os` or `arcane-os/packager`. Packaging consumes the saved
+source and managed import maps. Refresh maps through `arcane import-map` or
+ordinary `arcane dev` startup before selecting output that needs updated maps.
+The package preserves the complete selected content, applying the documented
+asset-version and enabled browser-PWA transformations to resource references.
+Malformed configuration or descriptors fail while preserving the prior output.
 
-The projection is an inventory, not an ordinary execution gate. Malformed or
-internally inconsistent selected projection data rejects with
-`ARCANE_RUNTIME_PROJECTION_INVALID`.
+Selected app files are emitted beneath `apps/<id>/`; shared files retain their
+configured route destinations. When selected shared content supplies no root
+`index.html`, the SDK generates one that opens the selected app page. The result
+contains `outputRoot`, `manifest`, and the complete `files` inventory.
+`manifest.app.entry` stays app-relative, while `manifest.app.start`
+is the package launch URL, such as `./apps/hello-world/index.html`. Release
+schema `1`, kind `arcane-app-release`, and packager identity
+`arcane-app-packager-v1` remain unchanged. A dry run returns the planned output
+and file inventory without writing source or output.
 
 ### Availability and normalization
 
@@ -808,7 +809,7 @@ const packaged = await packageApp({
     appId: 'hello-world'
 });
 
-console.log(packaged.importMap.documentPaths);
+console.log(packaged.manifest.app.start, packaged.files);
 ```
 
 ## PACKAGER_VERSION
@@ -4038,17 +4039,19 @@ console.log(result.importMap.documentPaths, result.importMap.documentCount);
 ### Overview
 
 Runs the high-level package operation for one selected application. It reads
-the installed SDK/runtime selection, injects one deterministic
-managed import map into every directly navigable included `.html`/`.htm`
-browser document while preserving component fragments as package files, and
-then packages the complete selected content without automatically running tests
-or checks. Verification occurs only when explicitly requested or when required
-for the selected release output. A failure leaves the previously accepted
-distribution untouched. Success returns the low-level package result and
-complete import-map document inventory. External
-packages publish `ARCANE_RUNTIME_PROJECTION.json`; private
-`ARCANE_APP_RELEASE.json` remains an internal verification authority rather
-than an application route.
+the installed SDK/runtime selection and packages the saved source and managed
+import maps through `packageApp()`. Map generation remains the explicit
+`arcane import-map` operation and the ordinary `arcane dev` startup refresh.
+Selected app files retain their `apps/<id>/` paths alongside the shared routes
+and root launcher described by `packageApp()`.
+
+Packaging does not automatically run tests or checks. Verification occurs only
+when explicitly requested or when required for the selected release output.
+A failure leaves the prior distribution untouched. Success returns the selected
+workspace and app identity plus `release`, containing the low-level package
+result, manifest, and complete file inventory. `ARCANE_APP_RELEASE.json` records
+that inventory and the distinct app-relative `app.entry` and package-relative
+`app.start`; it remains package metadata rather than an application route.
 
 ### Signature and result
 
@@ -4072,7 +4075,7 @@ const result = await packageApplication({
     appId: 'hello-world'
 });
 
-console.log(result.release.importMap.documentPaths);
+console.log(result.release.manifest.app.start, result.release.files);
 ```
 
 ## planApplication()

package/docs/reviews/mail-server-purpose-review.md

@@ -391,3 +391,35 @@ review does not claim execution on those platforms or an actual provider send.
 The updated test source covers disposable JSON storage, exact named selection,
 preservation of other settings, missing settings, credential-free error output,
 cancellation before writes, and CLI defaults. Local tests and checks were not run.
+
+## HTTPS and HTTP/2 follow-up
+
+The user explicitly selected HTTPS with HTTP/2. The mail listener remains on
+its dedicated configured port, default 8025, with the published
+`node-http-server` module owning TLS, protocol negotiation and listener/session
+shutdown. This increment preserves the provider attempt, report content,
+subscription callback, sender selection, recipient configuration and cancellation.
+
+| Method or action | Gates | Decision, callers, and concrete purpose |
+| --- | --- | --- |
+| `readMailServerSettings` | Y/Y/N | Read the same `.env.json` once for server startup, select the existing provider profile and resolve the two shared PEM path settings relative to that file. This avoids a second configuration read and platform-specific credential or certificate processes. |
+| `readMailProviderKey` and `serveMailGateway` | Y/Y/N | Preserve the existing credential-injection interface and missing-provider error while consuming the already-read startup key. Require the selected TLS pair before binding; forward only the paths to the listener. Direct provider sending and key CRUD remain unchanged. |
+| `MAIL_TLS_CERT_PATH` and `MAIL_TLS_KEY_PATH` | Y/Y/N | Clear top-level names identify certificate and private-key file paths for one listener, independently of any provider profile or calling application. Missing settings and unusable JSON values name the field without printing its content. |
+| `startResendMailServer` TLS options | Y/Y/N | Add `certPath` and `keyPath` through the module's published PEM API. HTTPS-only mode creates one listener with HTTP/2 and HTTP/1.1 negotiation on the selected port. This internal source integration retains its existing HTTP behavior when neither path is supplied; it is not an npm package export. The public toolchain mail operation requires the JSON pair. |
+| `listenForMailRequests` and returned URL | Y/Y/N | Observe the actual secure listener for bind errors and advertise HTTPS when selected. Preserve the friendly occupied-port failure, native cause, cancellation and owned shutdown. |
+| Native mail header access and current-domain comparison | Y/Y/Y | Remove the HTTP/1-only assumption that every request has `headersDistinct` and `Host`. HTTP/2 supplies native `headers` and `authority`; consume those directly without rebuilding or splitting headers. Node owns its HTTP/2 duplicate-field behavior. |
+| Certificate generation, platform trust changes, renewal watchers, duplicate PEM reads and a development-server import | N/N/Y | Add none. The operator supplies an existing certificate pair; the HTTP server module owns PEM loading. The development resolver has development-specific defaults and errors, so importing or extracting it adds no useful shared behavior for these two path resolutions. |
+
+Ordinary startup performs one JSON read, two path resolutions and one listener
+launch. Certificate file reads occur once at the module's transport owner.
+There are no new per-request file reads, provider requests, polling loops or
+certificate processes. These are source observations, not measured speedups.
+The JSON and Node TLS paths are portable across Windows, Linux and macOS;
+Android needs a compatible Node host and readable configuration/certificate files.
+
+Focused test source covers TLS option selection, the secure listener's occupied
+port, HTTP/2 header/authority handling, provider and subscription forwarding,
+JSON paths and missing TLS settings. Synthetic TLS selection is not evidence of
+an encrypted handshake. No local tests, checks, server launch, real TLS
+negotiation or provider send were performed for this follow-up review. Selected
+package and publication results belong to the delivery record.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/cli/main.mjs

@@ -86,6 +86,7 @@ Usage:
   ${CLI_NAME} mail key delete [profile]
   ${CLI_NAME} mail send [--profile <profile>] [--from <address>] --report-key <id> --report-stdin [--request-timeout <ms>]
   ${CLI_NAME} mail serve [--profile <profile>] [--from <address>] [--app <label>] [--origin <origin>] [--allow-to <addresses>] [--host 0.0.0.0] [--port 8025] [--request-timeout <ms>]
+    HTTPS/HTTP2; .env.json supplies RESEND_API_KEY, MAIL_TLS_CERT_PATH, and MAIL_TLS_KEY_PATH.
 
 Development:
   --public                      Bind dev to all IPv4 interfaces (0.0.0.0) and print network URLs.

package/src/dev-server.mjs

@@ -516,15 +516,19 @@ async function packagedRoutes(releaseRoot){
     const canonical=await canonicalRealDirectory(requested,'Packaged release root');
     let pwa = false;
     let startPath = '/index.html';
+    try {
+        const release = JSON.parse(
+            await readFile(path.join(canonical, 'ARCANE_APP_RELEASE.json'), 'utf8')
+        );
+        const start = release.app.start ?? release.app.entry;
+        const startUrl = new URL(start, 'http://arcane.invalid/');
+        startPath = `${startUrl.pathname}${startUrl.search}${startUrl.hash}`;
+    } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+    }
     try {
         const manifest = JSON.parse(await readFile(path.join(canonical, 'arcane-offline.json'), 'utf8'));
         pwa = manifest.schemaVersion === 1;
-        if (pwa) {
-            const release = JSON.parse(
-                await readFile(path.join(canonical, 'ARCANE_APP_RELEASE.json'), 'utf8')
-            );
-            startPath = `/${release.app.entry}`;
-        }
     } catch (error) {
         if (error.code !== 'ENOENT') throw error;
     }

package/src/mail-credentials.mjs

@@ -111,6 +111,32 @@ export async function readMailCredential(options={}){
     return configuredMailKey(settings,location);
 }
 
+export async function readMailServerSettings(options = {}) {
+    const location = mailCredentialLocation(options);
+    const settings = await readMailSettings(location.filePath, options.signal);
+    const serverSettings = (options.readCredential ?? null) === null
+        ? {apiKey: configuredMailKey(settings, location)}
+        : {};
+    const tlsSettings = {
+        MAIL_TLS_CERT_PATH: 'certPath',
+        MAIL_TLS_KEY_PATH: 'keyPath'
+    };
+    for (const [setting, option] of Object.entries(tlsSettings)) {
+        const value = settings[setting];
+        if (value === undefined || value === null || value === '') {
+            continue;
+        }
+        if (!is.string(value)) {
+            throw new ArcaneError(
+                ERROR_CODES.usage,
+                `${setting} in ${location.filePath} must be a PEM file path string.`
+            );
+        }
+        serverSettings[option] = path.resolve(path.dirname(location.filePath), value);
+    }
+    return serverSettings;
+}
+
 export async function getMailCredentialStatus(options={}){
     const location=mailCredentialLocation(options);
     const settings=await readMailSettings(location.filePath,options.signal);

package/src/mail-server.mjs

@@ -134,20 +134,33 @@ function createRequestId(factory){
     return randomUUID();
 }
 
-function requireRequestHeader(request,headerName){
-    const headerValues=request.headersDistinct[headerName]??[];
-    if(headerValues.length!==1||!headerValues[0]){
-        throw new MailGatewayFault('mail_invalid_headers',{statusCode:400});
+function readRequestHeader(request, headerName) {
+    const distinctHeaders = request.headersDistinct;
+    if (distinctHeaders) {
+        const headerValues = distinctHeaders[headerName] ?? [];
+        return headerValues.length === 1 ? headerValues[0] : undefined;
+    }
+    // HTTP/2 owns header normalization and does not expose headersDistinct.
+    return request.headers[headerName];
+}
+
+function requireRequestHeader(request, headerName) {
+    const headerValue = readRequestHeader(request, headerName);
+    if (!headerValue) {
+        throw new MailGatewayFault(
+            'mail_invalid_headers',
+            {statusCode: 400}
+        );
     }
-    return headerValues[0];
+    return headerValue;
 }
 
 async function verifyMailSubscription(request,configuration,signal){
     const appName=requireRequestHeader(request,'x-mail-app');
-    const authorizationHeaders=request.headersDistinct.authorization??[];
-    const subscriptionKey=authorizationHeaders.length===1
-        ?/^Bearer (.+)$/iu.exec(authorizationHeaders[0])?.[1]
-        :undefined;
+    const authorization = readRequestHeader(request, 'authorization');
+    const subscriptionKey = authorization
+        ? /^Bearer (.+)$/iu.exec(authorization)?.[1]
+        : undefined;
     if(!subscriptionKey){
         throw new MailGatewayFault('mail_subscription_required',{statusCode:401});
     }
@@ -869,10 +882,11 @@ function createConfiguredMailHandler(configuration){
             }
             const requestOrigin=request.headers.origin;
             if(requestOrigin){
+                const requestAuthority = request.authority || request.headers.host;
                 const originAllowed=configuration.allowedOrigins.size>0
                     ?configuration.allowedOrigins.has(requestOrigin)
-                    :requestOrigin===`https://${request.headers.host}`
-                        ||requestOrigin===`http://${request.headers.host}`;
+                    :requestOrigin===`https://${requestAuthority}`
+                        ||requestOrigin===`http://${requestAuthority}`;
                 if(!originAllowed){
                     throw new MailGatewayFault('mail_origin_not_allowed',{statusCode:403});
                 }
@@ -1008,7 +1022,8 @@ function listenForMailRequests(mailServer){
             server.removeListener('error',onError);
             resolve(server);
         });
-        mailServer.server.once('error',onError);
+        const listener = mailServer.secureServer ?? mailServer.server;
+        listener.once('error', onError);
     });
 }
 
@@ -1017,11 +1032,24 @@ export async function startResendMailServer(options={}){
     if(configuration.signal?.aborted){
         throw configuration.signal.reason??new Error('Mail server start was cancelled.');
     }
-    const mailServer=new Server({
-        host:configuration.host,
-        port:configuration.port,
-        server:{timeout:0}
-    });
+    if ((options.certPath === undefined) !== (options.keyPath === undefined)) {
+        throw configurationError('Mail HTTPS requires both certPath and keyPath when either is supplied.');
+    }
+    const httpsSelected = options.certPath !== undefined;
+    const mailServer = new Server(
+        {
+            host: configuration.host,
+            port: configuration.port,
+            server: {timeout: 0},
+            https: httpsSelected ? {
+                certificate: options.certPath,
+                privateKey: options.keyPath,
+                port: configuration.port,
+                only: true,
+                http2: true
+            } : {}
+        }
+    );
     const requestHandler=createConfiguredMailHandler(configuration);
     mailServer.onRawRequest=function routeRawMailRequest(request,response){
         requestHandler.handle(request,response);
@@ -1050,7 +1078,7 @@ export async function startResendMailServer(options={}){
         throw configurationError('Mail server has no TCP listener address.');
     }
     const displayHost=address.address.includes(':')?`[${address.address}]`:address.address;
-    const origin=`http://${displayHost}:${String(address.port)}`;
+    const origin = `${httpsSelected ? 'https' : 'http'}://${displayHost}:${String(address.port)}`;
     let closePromise=null;
     let resolveLifecycle;
     let rejectLifecycle;

package/src/mail.mjs

@@ -5,6 +5,7 @@ import {
     getMailCredentialStatus,
     mailCredentialLocation,
     readMailCredential,
+    readMailServerSettings,
     setMailCredential
 } from './mail-credentials.mjs';
 import {sendResendMail,startResendMailServer} from './mail-server.mjs';
@@ -125,10 +126,11 @@ async function sendMailFromReport(options){
     }
 }
 
-async function readMailProviderKey(options){
-    const readCredential=resolveMailCommandDependency(options,'readCredential',readMailCredential);
+async function readMailProviderKey(options, serverSettings){
     const credentialOptions=mailCredentialOptions(options);
-    const apiKey=await readCredential(credentialOptions);
+    const apiKey = serverSettings !== undefined && (options.readCredential ?? null) === null
+        ? serverSettings.apiKey
+        : await resolveMailCommandDependency(options, 'readCredential', readMailCredential)(credentialOptions);
     if(apiKey===null){
         const location=mailCredentialLocation(credentialOptions);
         throw new ArcaneError(
@@ -147,10 +149,25 @@ async function readMailProviderKey(options){
 
 async function serveMailGateway(options){
     const startServer=resolveMailCommandDependency(options,'startServer',startResendMailServer);
+    const readServerSettings = resolveMailCommandDependency(options, 'readServerSettings', readMailServerSettings);
     throwIfAborted(options.signal);
-    let apiKey=await readMailProviderKey(options);
+    const serverSettings = await readServerSettings(
+        {...mailCredentialOptions(options), readCredential: options.readCredential}
+    );
+    throwIfAborted(options.signal);
+    let apiKey=await readMailProviderKey(options, serverSettings);
     try{
         throwIfAborted(options.signal);
+        const missingSettings = [];
+        if (!serverSettings.certPath) missingSettings.push('MAIL_TLS_CERT_PATH');
+        if (!serverSettings.keyPath) missingSettings.push('MAIL_TLS_KEY_PATH');
+        if (missingSettings.length) {
+            const location = mailCredentialLocation(options);
+            throw new ArcaneError(
+                ERROR_CODES.prerequisiteMissing,
+                `Missing ${missingSettings.join(', ')} in ${location.filePath}. Mail HTTPS requires a certificate and private key.`
+            );
+        }
         const recipientAllowlist=mailRecipientOptions(options.allowTo,'allowTo');
         const errorRecipients=options.errorTo===undefined
             ? recipientAllowlist
@@ -162,10 +179,12 @@ async function serveMailGateway(options){
                 ?[]
                 :is.array(options.origin)?[...options.origin]:[options.origin],
             bodyTimeoutMs:options.bodyTimeoutMs,
+            certPath:serverSettings.certPath,
             errorRecipients,
             fetchImpl:options.fetchImpl,
             from:options.from,
             host:options.host??'0.0.0.0',
+            keyPath:serverSettings.keyPath,
             onEvent:options.onEvent,
             port:options.port,
             providerTimeoutMs:options.requestTimeout,

package/src/packager/core.mjs

@@ -424,6 +424,15 @@ function destinationJoin(root,relative){
     return root==='.'?relative:`${root}/${relative}`;
 }
 
+function appPackagePath(context, relative) {
+    return `apps/${context.appId}/${relative}`;
+}
+
+function packageResourceUrl(relative) {
+    const segments = relative.split('/');
+    return `./${segments.map(encodeURIComponent).join('/')}`;
+}
+
 async function collectSelectedPath({
     sourceRoot,
     selected,
@@ -483,7 +492,7 @@ async function collectPackageRecords(context,{signal}={}){
         await collectSelectedPath({
             sourceRoot:context.appRoot,
             selected,
-            destination:selected,
+            destination:appPackagePath(context, selected),
             excludes:context.config.exclude,
             reject:isAppSourceForbidden,
             records,
@@ -512,23 +521,25 @@ async function collectPackageRecords(context,{signal}={}){
         }
     }
     records.sort((left,right)=>compareText(left.destination,right.destination));
-    if(!records.some(record=>pathKey(record.destination)===pathKey(context.config.entry))){
+    if(!records.some(record=>pathKey(record.destination)===pathKey(appPackagePath(context, context.config.entry)))){
         fail(`Package entry is missing from the selected files: ${context.config.entry}.`);
     }
     return records;
 }
 
-async function browserDocuments(records,entry){
+async function browserDocuments(records,entry,appPrefix){
     let entryDocument=null;
     const documents=[];
     for(const record of records){
         const extension=path.posix.extname(record.destination).toLocaleLowerCase('en-US');
         if(extension!=='.html'&&extension!=='.htm')continue;
+        const documentPath=record.destination.startsWith(appPrefix)
+            ?record.destination.slice(appPrefix.length):record.destination;
         const inspected=inspectImportMapHtml(await readFile(record.source,'utf8'),{
-            documentPath:record.destination
+            documentPath
         });
-        const document={path:record.destination,...copyJson(inspected)};
-        if(record.destination===entry){
+        const document={path:documentPath,packagePath:record.destination,...copyJson(inspected)};
+        if(record.destination===`${appPrefix}${entry}`){
             entryDocument=document;
         }else if(inspected.bases.length>0){
             documents.push(document);
@@ -567,8 +578,8 @@ async function inspectContext(context,{signal}={}){
         }),
         ...(context.config.adapter===undefined?{}:{adapter:context.config.adapter}),
         descriptor:await optionalDescriptor(context),
-        browserDocuments:await browserDocuments(records,context.config.entry),
-        files:records.map(record=>record.destination),
+        browserDocuments:await browserDocuments(records,context.config.entry,appPackagePath(context,'')),
+        files:[...new Set(['index.html',...records.map(record=>record.destination)])].sort(compareText),
         output:path.relative(context.workspaceRoot,context.outputRoot).split(path.sep).join('/')
     };
 }
@@ -611,6 +622,28 @@ async function copyRecords(records,stagingRoot,{signal,onEvent}={}){
     }
 }
 
+async function writePackageLauncher(context, stagingRoot) {
+    function escapeHtml(value) {
+        return value.replaceAll('&', '&').replaceAll('"', '"')
+            .replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+    }
+    const start = escapeHtml(packageResourceUrl(appPackagePath(context, context.config.entry)));
+    const title = escapeHtml(context.config.displayName);
+    const content = `<!doctype html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta http-equiv="refresh" content="0; url=${start}">
+    <title>${title}</title>
+</head>
+<body>
+    <a href="${start}">Open ${title}</a>
+</body>
+</html>
+`;
+    await writeFile(path.join(stagingRoot, 'index.html'), content, 'utf8');
+}
+
 async function listOutputFiles(root,{signal}={}){
     const files=[];
     async function visit(directory,relativeRoot=''){
@@ -652,6 +685,7 @@ function releaseManifest(context,files,pwaArtifacts){
             displayName:context.config.displayName,
             version:context.config.version,
             entry:context.config.entry,
+            start:packageResourceUrl(appPackagePath(context, context.config.entry)),
             strategy:context.config.strategy,
             shared:[...context.config.shared],
             ...(pwaArtifacts?{pwa:{
@@ -695,6 +729,8 @@ async function replaceDirectory(stagingRoot,outputRoot){
 async function packageWithContext(context,options={}){
     const {signal,onEvent,browserPwa=true}=options;
     const pwaEnabled=browserPwa&&context.config.pwa?.enabled===true;
+    const appPath=`apps/${context.appId}`;
+    const entryPath=appPackagePath(context,context.config.entry);
     const inspected=await inspectContext(context,{signal});
     if(options.dryRun){
         return {
@@ -724,7 +760,14 @@ async function packageWithContext(context,options={}){
     let promoted=false;
     try{
         const records=await collectPackageRecords(context,{signal});
-        const copyBase=()=>copyRecords(records,stagingRoot,{signal,onEvent});
+        async function copyBase() {
+            await copyRecords(records,stagingRoot,{signal,onEvent});
+            if (!records.some(function selectedRootIndex(record) {
+                return record.destination === 'index.html';
+            })) {
+                await writePackageLauncher(context, stagingRoot);
+            }
+        }
         const adapter=await loadAdapter(context);
         if(adapter){
             await adapter.buildArcanePackage({
@@ -745,21 +788,22 @@ async function packageWithContext(context,options={}){
         const assetVersion=await readWorkspaceAssetVersion(context.workspaceRoot);
         const version=pwaEnabled?null:assetVersion;
         const inventory=new Set(files);
-        const offlineInventory=pwaEnabled?new Set(selectPwaFiles(files,context.config.pwa)):null;
+        const offlineInventory=pwaEnabled?new Set(selectPwaFiles(files,context.config.pwa,appPath)):null;
         const offlineReferences=new Set();
-        const entryUrl=new URL(context.config.entry,'http://arcane.invalid/');
+        const entryUrl=new URL(packageResourceUrl(entryPath),'http://arcane.invalid/');
         const pwaDocumentSources=new Map();
         if(pwaEnabled){
-            const documentPaths=new Set([context.config.entry]);
+            const documentPaths=new Set([entryPath]);
             for(const selected of context.config.include){
-                if(/\.html?$/iu.test(selected)&&inventory.has(selected))documentPaths.add(selected);
+                const selectedPath=appPackagePath(context,selected);
+                if(/\.html?$/iu.test(selected)&&inventory.has(selectedPath))documentPaths.add(selectedPath);
             }
             for(const document of inspected.browserDocuments){
                 const appDocument=context.config.include.some(function includesAppDocument(selected){
                     return sameOrDescendant(document.path,selected);
                 });
-                if(appDocument&&document.managedMaps.length>0&&inventory.has(document.path)){
-                    documentPaths.add(document.path);
+                if(appDocument&&document.managedMaps.length>0&&inventory.has(document.packagePath)){
+                    documentPaths.add(document.packagePath);
                 }
             }
             await Promise.all(
@@ -777,13 +821,13 @@ async function packageWithContext(context,options={}){
                 )
             );
         }
-        const entryDocument=pwaEnabled?pwaDocumentSources.get(context.config.entry).inspected
+        const entryDocument=pwaEnabled?pwaDocumentSources.get(entryPath).inspected
             :inspected.browserDocuments.find(function matchingEntryDocument(document){
                 return document.path===context.config.entry;
             });
         const documentUrl=entryDocument?.bases[0]?.href
             ?new URL(entryDocument.bases[0].href,entryUrl):entryUrl;
-        const pending=[{file:context.config.entry,documentUrl}];
+        const pending=[{file:entryPath,documentUrl}];
         for(const file of files){
             if(/^arcane\/(?:modules|entities|components|css|sdk|dependencies)\//u.test(file)
                 &&/\.(?:m?js|html?|css)$/iu.test(file))pending.push({file,documentUrl});
@@ -792,15 +836,15 @@ async function packageWithContext(context,options={}){
             }
         }
         for(const document of inspected.browserDocuments){
-            if(document.managedMaps.length>0&&!pwaDocumentSources.has(document.path)){
-                const url=new URL(document.path,entryUrl.origin);
-                pending.push({file:document.path,documentUrl:document.bases[0]?.href
+            if(document.managedMaps.length>0&&!pwaDocumentSources.has(document.packagePath)){
+                const url=new URL(packageResourceUrl(document.packagePath),entryUrl.origin);
+                pending.push({file:document.packagePath,documentUrl:document.bases[0]?.href
                     ?new URL(document.bases[0].href,url):url});
             }
         }
         for(const [file,document] of pwaDocumentSources){
-            if(file===context.config.entry)continue;
-            const url=new URL(file,entryUrl.origin);
+            if(file===entryPath)continue;
+            const url=new URL(packageResourceUrl(file),entryUrl.origin);
             pending.push({file,documentUrl:document.inspected.bases[0]?.href
                 ?new URL(document.inspected.bases[0].href,url):url});
         }
@@ -832,7 +876,7 @@ async function packageWithContext(context,options={}){
                 if(!pwaEnabled&&!traversable)continue;
                 if(kind==='import'&&!/^(?:\.{1,2}\/|\/)/u.test(url))continue;
                 try{
-                    const ownerUrl=new URL(relative,entryUrl.origin);
+                    const ownerUrl=new URL(packageResourceUrl(relative),entryUrl.origin);
                     const base=baseHref?new URL(baseHref,ownerUrl)
                         :baseKind==='document'||path.posix.basename(relative)==='arcane.importmap.json'
                             ?current.documentUrl:ownerUrl;
@@ -854,7 +898,7 @@ async function packageWithContext(context,options={}){
         if(files.some(file=>pathKey(file)===pathKey(RELEASE_MANIFEST_NAME))){
             fail(`Package content must not author ${RELEASE_MANIFEST_NAME}.`);
         }
-        if(!files.some(file=>pathKey(file)===pathKey(context.config.entry))){
+        if(!files.some(file=>pathKey(file)===pathKey(entryPath))){
             fail(`Package output is missing its entry file: ${context.config.entry}.`);
         }
         const pwaArtifacts=pwaEnabled?createPwaArtifacts({
@@ -862,8 +906,9 @@ async function packageWithContext(context,options={}){
                 id:context.appId,
                 displayName:context.config.displayName,
                 version:context.config.version,
-                entry:context.config.entry
+                entry:packageResourceUrl(entryPath)
             },
+            appPath,
             sdkVersion:assetVersion,
             pwa:context.config.pwa,
             files,
@@ -878,7 +923,7 @@ async function packageWithContext(context,options={}){
                 files.push(artifact.path);
             }
             for(const [documentPath,document] of pwaDocumentSources){
-                const documentUrl=new URL(documentPath,entryUrl.origin);
+                const documentUrl=new URL(packageResourceUrl(documentPath),entryUrl.origin);
                 const outputBase=document.inspected.bases[0]?.href
                     ?new URL(document.inspected.bases[0].href,documentUrl):documentUrl;
                 const outputDirectory=new URL('./',outputBase).pathname;

package/src/pwa.mjs

@@ -72,17 +72,20 @@ function selectedPath(file, selection) {
     return file === selection || file.startsWith(prefix);
 }
 
-export function selectPwaFiles(files, pwa) {
+export function selectPwaFiles(files, pwa, appPath = '') {
     const config = normalizePwaConfig(pwa);
     const include = config?.offline.include ?? [];
     const exclude = config?.offline.exclude ?? [];
+    const appPrefix = appPath ? `${appPath}/` : '';
     return files.filter(
         function selectedOfflineFile(file) {
+            const relative = appPrefix && file.startsWith(appPrefix)
+                ? file.slice(appPrefix.length) : file;
             function includedPath(selection) {
-                return selectedPath(file, selection);
+                return selectedPath(relative, selection);
             }
             function excludedPath(selection) {
-                return selectedPath(file, selection);
+                return selectedPath(relative, selection);
             }
             return (include.length === 0 || include.some(includedPath))
                 && !exclude.some(excludedPath);
@@ -199,6 +202,7 @@ export function createPwaArtifacts(
         mode = 'release',
         runtimeBase = './arcane/sdk/',
         appBase,
+        appPath = '',
         navigationAliases,
         revision
     } = {}
@@ -209,20 +213,19 @@ export function createPwaArtifacts(
         throw new TypeError('PWA mode must be release or development.');
     }
     const entryUrl = new URL(app.entry, 'https://arcane.invalid/');
-    const applicationBase = appBase ?? (mode === 'development'
-        ? new URL('./', entryUrl).pathname : './');
-    const manifest = applicationManifest(
-        {
-            id: applicationBase,
-            name: app.displayName,
-            short_name: app.displayName,
-            start_url: app.entry,
-            scope: applicationBase,
-            display: 'standalone',
-            ...config.manifest
-        },
-        applicationBase
-    );
+    const applicationBase = appBase ?? (appPath ? `./${appPath}/`
+        : mode === 'development' ? new URL('./', entryUrl).pathname : './');
+    // Relocating app files must not change an existing installed app's default identity.
+    const installationBase = appBase ?? (mode === 'development' ? applicationBase : './');
+    const manifest = {
+        id: installationBase,
+        name: app.displayName,
+        short_name: app.displayName,
+        start_url: manifestUrl(app.entry, appPath ? basePath : applicationBase),
+        scope: installationBase,
+        display: 'standalone',
+        ...applicationManifest(config.manifest, applicationBase)
+    };
     const generatedAssets = [
         PWA_MANIFEST_NAME,
         PWA_OFFLINE_MANIFEST_NAME,
@@ -232,7 +235,7 @@ export function createPwaArtifacts(
             return resourceUrl(basePath, file);
         }
     );
-    const selectedFiles = selectPwaFiles(files, config);
+    const selectedFiles = selectPwaFiles(files, config, appPath);
     const selectedAssets = [
         ...selectedFiles.map(
             function packagedResource(file) {