arcane-os 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.7.3
+
+- Correct public development serving for OPFS/DBOPFS and other browser APIs
+  requiring a secure context. `npm run dev -- --app <id> --public` now serves
+  HTTPS using a workspace-local development certificate pair, with explicit
+  `--cert`/`--key` paths and `--https` available for any selected app.
+- Add HTTPS transport to the shared development server and report the actual
+  protocol in local and network URLs. Preserve ordinary HTTP localhost,
+  selected source/runtime routes, refresh behavior, and owned cancellation.
+- Document certificate setup and Android CA installation. Keep TLS material
+  out of operation events and report missing certificates before binding.
+- Clarify the browser accelerator setup instruction to close and reopen the
+  browser after changing a flag, with that final step underlined and emphasized.
+
 ## 0.7.2
 
 - Keep both supported browser NPU and GPU flag address copy controls available

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.7.2` SDK contract. Applications pin one exact npm
+This checkout defines the `0.7.3` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 
@@ -35,7 +35,7 @@ Create one browser application, install its pinned SDK, and start its source
 server:
 
 ```bash
-npx arcane-os@0.7.2 new hello-speech --path ./hello-speech --target browser
+npx arcane-os@0.7.3 new hello-speech --path ./hello-speech --target browser
 cd hello-speech
 npm install
 npm run dev
@@ -49,12 +49,20 @@ npm run dev -- --app hello-speech --public
 ```
 
 Replace `hello-speech` with any app in the workspace. The server binds to
-`0.0.0.0` and prints network URLs to open on the other device. Plain `npm run dev`
-keeps its localhost default. An explicit `--host` overrides the public bind
-address, and `--port` selects the port. Network reachability depends on the
-machine's firewall and network; the command does not configure internet hosting
-or HTTPS. Browser features requiring a [secure context](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts)
-need HTTPS when opened through a LAN address.
+`0.0.0.0` and serves HTTPS using `.arcane/dev/server-cert.pem` and
+`.arcane/dev/server-key.pem` in the workspace. Supply a certificate covering the
+LAN address or hostname you will open, and trust its issuing development CA on
+each device. Keep these local files ignored by Git. The same certificate pair
+works for any selected app in that workspace. The command reports missing TLS
+files instead of starting an HTTP listener.
+
+Plain `npm run dev` keeps its HTTP localhost default. An explicit `--host`
+overrides the public bind address, and `--port` selects the port. Use `--https`
+for HTTPS on localhost, or `--cert <file> --key <file>` for an explicit PEM pair;
+relative paths resolve from the workspace. The server prints HTTPS network URLs
+for public mode. Network reachability depends on the machine's firewall and
+network. See the [development HTTPS setup](docs/reference/cli.md#development-https-setup)
+for device trust and DBOPFS's secure-context requirement.
 
 Open the URL printed by the server. The generated page owns its import map and
 Arcane theme; its application module is `apps/hello-speech/modules/App.js`.
@@ -378,7 +386,7 @@ uses the same controller for automatic memory extraction.
 Create a new repository-shaped Arcane application with the exact stable SDK:
 
 ```bash
-npx arcane-os@0.7.2 new my-app --path ./my-app --target portable --git
+npx arcane-os@0.7.3 new my-app --path ./my-app --target portable --git
 cd my-app
 npm install
 npm run dev
@@ -388,7 +396,7 @@ To enroll an existing repository, install the exact SDK and initialize only
 missing Arcane files:
 
 ```bash
-npm install --save-dev --save-exact arcane-os@0.7.2
+npm install --save-dev --save-exact arcane-os@0.7.3
 npm exec -- arcane init my-app --target portable
 ```
 
@@ -404,7 +412,7 @@ npm exec -- arcane-os targets
 No global SDK install or standalone Arcane CLI is required. The application
 repository's exact npm dependency and lockfile own the CLI and toolchain version.
 
-Use `npx arcane-os@0.7.2` for the initial bootstrap because it names this npm
+Use `npx arcane-os@0.7.3` for the initial bootstrap because it names this npm
 package explicitly; bare `npx arcane` outside an installed project could resolve
 a different package. Both installed commands invoke the same headless toolchain.
 Project-local npm scripts use the SDK pinned by that app's `package-lock.json`,
@@ -424,7 +432,7 @@ node ./bin/arcane.mjs new local-app --path ../local-app --target portable --git
 
 # From the generated app repository
 cd ../local-app
-npm install --save-dev --save-exact ../arcane-os-sdk/arcane-os-0.7.2.tgz
+npm install --save-dev --save-exact ../arcane-os-sdk/arcane-os-0.7.3.tgz
 npm ci
 ```
 
@@ -433,7 +441,7 @@ same location. The lockfile retains the selected package dependency while
 Arcane uses the installed package name and version. Local directory `file:` dependencies are not
 accepted because npm may install them as links; use a packed `.tgz`. A GitHub
 runner also needs that tarball at the locked path. After publication, replace
-the local declaration with the exact `arcane-os@0.7.2` registry package and
+the local declaration with the exact `arcane-os@0.7.3` registry package and
 commit the regenerated lock.
 
 Generated repositories use `npm ci --ignore-scripts` in CI. Run dependency
@@ -490,7 +498,7 @@ arcane new <id> [--path <directory>] [--display-name <name>] [--target <target>]
 arcane init [id] [--workspace <directory>] [--display-name <name>] [--target <target>]
 arcane doctor [--workspace <directory>] [--arcane-root <directory>]
 arcane import-map [--workspace <directory>] [--app <id>]
-arcane dev [--app <id>] [--public] [--host <address>] [--port 8000]
+arcane dev [--app <id>] [--public] [--https] [--cert <file> --key <file>] [--host <address>] [--port 8000]
 arcane test [--app <id>] [--scope app]
 arcane test --scope shared --test-file <repo-relative.test.mjs>
 arcane check [--app <id>] [--scope app] [--skip-tests]
@@ -572,7 +580,7 @@ package installation, or assertions.
 
 ## Current target support
 
-Version `0.7.2` exposes one browser target and five explicitly paired
+Version `0.7.3` exposes one browser target and five explicitly paired
 native development targets: a non-runnable portable directory, a
 Windows x64 unsigned-local-test EXE bundle, Linux x64 and Linux ARM64
 unsigned-local-test DEBs, and an Android development-signed APK. The

package/docs/architecture.md

@@ -116,6 +116,16 @@ files into `dist`, or restarting the server. Restarting is not a content
 synchronization step; when a refresh is stale, first verify the command, URL,
 workspace, selected app, and resolved source route.
 
+The shared dev server owns HTTP and HTTPS transport for the same selected
+routes. `arcane dev --public` selects HTTPS on the IPv4 wildcard address;
+explicit `--host` controls the bind address, while `--https` selects HTTPS
+without changing it. Public/HTTPS CLI startup reads one workspace-local PEM
+pair before binding. The certificate covers the device-facing address, and
+each client trusts its issuing CA through that platform's certificate setup.
+This supplies the secure origin required by OPFS/DBOPFS on LAN devices. The
+server does not install trust, generate certificates, or expose private TLS
+material through CLI events. Ordinary localhost development remains HTTP.
+
 Development is an intentionally fast feedback loop. Keep each increment small
 and independently understandable so its effect has one clear cause and a
 mistake can be isolated without untangling unrelated work. A development
@@ -279,7 +289,7 @@ paths are withheld from the native provider. The provider copies the complete
 selected release rather than accepting an unrelated source path. Verification
 is a separate explicit operation for a selected release artifact.
 
-The SDK `0.7.2` runtime requires Arcane `0.8.12` or newer. Compatibility
+The SDK `0.7.3` runtime requires Arcane `0.8.12` or newer. Compatibility
 is contractual rather than exact-version pinning: the prepared Core must meet
 the highest minimum declared by the runtime, selected app, and bundled app
 dependencies; keep each app's Arcane protocol generation; and provide every

package/docs/reference/ai/browser-speech.md

@@ -156,7 +156,8 @@ documents the **Enables WebNN API** flag and model/operator requirements.
 The **GPU performance** section shows a short adapter status and a **Copy GPU
 flag address** button on desktop Windows Chromium browsers. The button remains
 available for every adapter class, unavailable API, or detection failure. One
-shared instruction explains pasting, enabling, saving work, and relaunching. Identified
+shared instruction explains pasting, enabling, saving work, then closing the
+browser and reopening it, with the final step underlined and emphasized. Identified
 Chrome uses `chrome://flags/#force-high-performance-gpu`; other recognized
 Chromium browsers use their corresponding internal scheme. **Refresh**
 requests a new availability result; concurrent

package/docs/reference/cli.md

@@ -49,7 +49,9 @@ meaning and cardinality rules:
 | `--app` | app id | Workspace/app operations except shared scope and `verify-bundle`; also the exact `mail serve` caller id. |
 | `--arcane-root` | directory | `doctor`, native `build`/`run`, `native-doctor`, `native-prepare` |
 | `--host` / `--port` | host / integer 0–65535 | Browser `dev`/`run` default to `127.0.0.1:8000`; `mail serve` defaults to `127.0.0.1:8025` and admits numeric loopback only. |
-| `--public` | flag | `dev`; binds to `0.0.0.0` unless `--host` explicitly selects another address. |
+| `--public` | flag | `dev`; serves HTTPS and binds to `0.0.0.0` unless `--host` explicitly selects another address. |
+| `--https` | flag | `dev`; serves HTTPS with the configured or default workspace PEM pair. |
+| `--cert` / `--key` | PEM file paths | `dev`; supply both to select HTTPS with an explicit certificate chain and private key. Relative paths resolve from the workspace. |
 | `--target` | target id | `new`, `init`, native diagnostics, `build`, `run` |
 | `--format` / `--signing` | target-supported values | Native diagnostics, `build`, `run` |
 | `--output-root` | directory | Native `build` and `run` |
@@ -310,7 +312,7 @@ npm exec -- arcane upgrade --workspace . --app hello-world
 
 Starts one development server for one selected app and maps the exact
 workspace/runtime routes. It defaults to localhost; `--public` enables access
-from other devices on the network.
+from other devices on the network over HTTPS.
 
 For an external workspace, the server exposes the selected projected
 `arcane/` root, including `arcane/sdk` and `arcane/dependencies`, alongside the
@@ -319,7 +321,7 @@ The explicit live-source SDK mapping remains unchanged and does not replace the
 installed projection.
 
 ```text
-arcane dev [--app <id>] [--public] [--host <address>] [--port 8000]
+arcane dev [--app <id>] [--public] [--https] [--cert <file> --key <file>] [--host <address>] [--port 8000]
 ```
 
 ### Lifecycle
@@ -333,10 +335,43 @@ device, since `localhost` refers to that device and `0.0.0.0` is a bind address.
 Network URLs come from one interface snapshot at startup and do not establish
 remote reachability through the machine's firewall or network.
 
-This option changes the listener address. It does not configure a firewall,
-router forwarding, an internet tunnel, authentication, or HTTPS. Browser
-features that require a [secure context](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts)
-still require HTTPS when accessed through a LAN address.
+Public mode also selects HTTPS. Plain localhost development stays HTTP.
+`--https` selects HTTPS without changing the bind address; supplying both
+`--cert` and `--key` also selects HTTPS. The command does not configure a
+firewall, router forwarding, or an internet tunnel.
+
+### Development HTTPS setup
+
+Before starting public mode, place the development server's PEM certificate
+chain at `.arcane/dev/server-cert.pem` and its PEM private key at
+`.arcane/dev/server-key.pem`, relative to the workspace. Alternatively, pass
+`--cert <file> --key <file>` together. The certificate must cover the LAN IP
+address or hostname opened by each device. Certificate creation and renewal
+belong to the developer's certificate tooling; the server does not generate a
+CA or alter device trust stores. Keep `.arcane/dev/` ignored by Git and keep the
+private key on the development computer.
+
+The server reads the selected pair once asynchronously per startup, before
+binding. Missing files or certificate/key parse errors produce a startup error; public
+mode never silently falls back to HTTP. Certificate/key contents are not
+included in operation events or JSON/NDJSON output. Restart the server after
+replacing its certificate pair; ordinary app source edits still appear on
+refresh without restarting.
+
+DBOPFS uses [OPFS, which requires a secure context](https://developer.mozilla.org/en-US/docs/Web/API/StorageManager/getDirectory).
+HTTP localhost is a special case on the device running the server; a LAN HTTP
+address does not receive that exception. For HTTPS issued by a development CA,
+each accessing device must trust that CA and use an address covered by the
+server certificate.
+
+On Android Chrome, transfer only the public CA certificate to the phone. In
+Android Settings, open the security settings, then **Encryption & credentials
+> Install a certificate > CA certificate**, and select that public certificate.
+Samsung devices may label the entry **Install from device storage**. Menu names
+vary by device; Google's [Android CA installation instructions](https://support.google.com/device-usage-study-help/answer/15713321?co=GENIE.Platform%3DAndroid&hl=en)
+show these paths. Then open the printed HTTPS network URL in Chrome. The CA
+installation is a device action; server readiness does not prove Android trust
+or remote reachability.
 
 ### Example
 

package/docs/reference/runtime-components.md

@@ -165,7 +165,8 @@ receive a **Copy GPU flag address** button for the matching browser,
 including `chrome://flags/#force-high-performance-gpu` for identified Chrome.
 Both controls remain available regardless of API availability, adapter class,
 or detection failure. Each flag has one short explanation, followed by a shared
-paste, enable, save, and relaunch instruction.
+instruction: paste the address, enable the flag, save work, then close the
+browser and reopen it. The closing and reopening instruction is underlined and emphasized.
 Settings addresses use Copy controls and appear as selectable text if copying
 fails. The component does not attempt navigation to internal browser pages.
 
@@ -210,7 +211,7 @@ explicitly and invoke it from a user action. It returns a promise resolving to
 `true` only after clipboard success, or `false` for destruction, an unsupported
 target, or copy failure. The complete address remains selectable if clipboard
 access fails. On-screen instructions explain pasting it into the address bar,
-enabling WebNN, and relaunching.
+enabling WebNN, saving work, then closing the browser and reopening it.
 
 `destroy()` aborts owned listeners, disposes the event source, marks `ready`
 false, and suppresses UI updates from pending clipboard and adapter operations.

package/docs/reference/sdk-api.md

@@ -3461,17 +3461,30 @@ async startDevServer(options={})
 
 Import it from `arcane-os`. Source mode accepts
 `{workspaceRoot=process.cwd(), appId, mode='source', host='127.0.0.1', port=0,
-signal, onEvent}` and serves one validated workspace application plus its
-complete SDK or integrated runtime. Packaged mode uses
+https=false, certPath, keyPath, tls, signal, onEvent}` and serves one validated
+workspace application plus its complete SDK or integrated runtime. Packaged mode uses
 `{mode:'packaged', releaseRoot, host, port, signal, onEvent}` and serves the
 complete selected release files. `host` defaults to `127.0.0.1` and accepts an
 explicit network address or hostname. Use `0.0.0.0` for all IPv4 interfaces or
 `::` for the platform's IPv6 wildcard listener; port `0` asks the operating
 system for an available port.
 
+`https:true` reads `.arcane/dev/server-cert.pem` and
+`.arcane/dev/server-key.pem` relative to `workspaceRoot` unless explicit
+`certPath` and `keyPath` are supplied together. The path pair also selects
+HTTPS without `https:true`; relative paths resolve from the workspace. A
+direct `tls` object instead supplies Node HTTPS server options, including
+`cert` and `key`, without reading certificate files. Keep private material
+server-side. Missing PEM files and Node certificate/key parse errors reject
+startup without falling back to HTTP. Node owns TLS option handling and the
+handshake; browser trust and address matching are evaluated when a client
+connects. The CLI's `--public` selects HTTPS and the wildcard bind;
+the API's `host` option alone changes only the bind address.
+
 The promise settles after the listener is ready and resolves to
-`{server, mode, workspaceRoot, appId, host, port, origin, cleanUrl, url,
-networkUrls, close, closed, lifecycle}`. `server` is the raw Node HTTP server.
+`{server, protocol, mode, workspaceRoot, appId, host, port, origin, cleanUrl, url,
+networkUrls, close, closed, lifecycle}`. `server` is the raw Node HTTP or HTTPS
+server; `protocol` is `'http:'` or `'https:'`.
 `url` and `cleanUrl` are the same application URL. Wildcard listeners use
 `localhost` in that local URL; `host` retains the actual bound address.
 `networkUrls` lists application URLs for applicable non-loopback interface
@@ -3480,6 +3493,12 @@ not evidence of reachability from another device. The server adds no session
 capability or authentication. In packaged mode, `workspaceRoot` and `appId`
 are `null`.
 
+All returned application URLs use the selected transport's scheme. The server
+reads one PEM pair per startup and does not create certificates or modify trust
+stores. Each client must trust the issuing CA and open an address covered by the
+server certificate. Lifecycle events and CLI summaries exclude TLS options and
+private key contents. See [development HTTPS setup](cli.md#development-https-setup).
+
 Starting the server opens the selected listener and emits awaited,
 backpressured `server.starting` and `server.started` events. Request failures
 emit `server.request.failed`; shutdown emits `server.stopped` after owned
@@ -3881,6 +3900,11 @@ async function usedescribeTargets(...arguments_) {
 
 Starts one owned browser development server for the selected application.
 
+`https`, `certPath`, `keyPath`, and `tls` follow the
+[`startDevServer()` TLS contract](#startdevserver), alongside `host` and `port`.
+The operation refreshes the selected app's managed import maps once, then owns
+one source listener and returns its protocol, URLs, and shutdown lifecycle.
+
 ### Signature and result
 
 ```text

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/runtime/arcane/components/browser-ai-setup.html

@@ -61,7 +61,7 @@
             <p>“Force High Performance GPU” prefers your faster GPU.</p>
             <button id="copyGpuAddress" class="arcane-button arcane-button--secondary" type="button">Copy GPU flag address</button>
         </div>
-        <p>Paste a copied address into your browser's address bar. Enable the flag, save your work, and relaunch.</p>
+        <p>Paste a copied address into your browser's address bar. Enable the flag, save your work, <u><em>then close the browser and reopen it</em></u>.</p>
         <details>
             <summary>Setup help</summary>
             <p><a href="https://onnxruntime.ai/docs/tutorials/web/ep-webnn.html">WebNN setup documentation</a></p>

package/src/cli/main.mjs

@@ -18,6 +18,8 @@ const VALUE_OPTIONS=new Set([
     'arcane-root',
     'host',
     'port',
+    'cert',
+    'key',
     'target',
     'format',
     'signing',
@@ -36,6 +38,7 @@ const VALUE_OPTIONS=new Set([
 const FLAG_OPTIONS=new Set([
     'git',
     'public',
+    'https',
     'skip-tests',
     'dry-run',
     'require-local-ai',
@@ -61,7 +64,7 @@ Usage:
   ${CLI_NAME} upgrade [--workspace <directory>] [--app <id>]
   ${CLI_NAME} doctor [--workspace <directory>] [--arcane-root <directory>]
   ${CLI_NAME} import-map [--workspace <directory>] [--app <id>]
-  ${CLI_NAME} dev [--app <id>] [--public] [--host <address>] [--port 8000] [--sdk-runtime-source <sdk-root>]
+  ${CLI_NAME} dev [--app <id>] [--public] [--https] [--cert <pem>] [--key <pem>] [--host <address>] [--port 8000] [--sdk-runtime-source <sdk-root>]
   ${CLI_NAME} test [--app <id>] [--scope app]
   ${CLI_NAME} test --scope shared --test-file <repo-relative.test.mjs>
   ${CLI_NAME} check [--app <id>] [--scope app] [--skip-tests]
@@ -84,7 +87,9 @@ Usage:
   ${CLI_NAME} mail serve --profile <profile> --from <address> --app <id> --origin <origin> [--allow-to <addresses>] [--app-key-stdin] [--host 127.0.0.1] [--port 8025] [--request-timeout <ms>]
 
 Development:
-  --public                      Bind all IPv4 interfaces (0.0.0.0) and print network URLs.
+  --public                      Serve HTTPS on all IPv4 interfaces (0.0.0.0) and print network URLs.
+  --https                       Use HTTPS with .arcane/dev/server-cert.pem and server-key.pem.
+  --cert <pem> --key <pem>        Use an existing certificate pair; paths are relative to the workspace.
   --host <address>               Override the bind address; takes precedence over --public.
   --sdk-runtime-source <sdk-root>  Dev-only live SDK checkout; omitted preserves the workspace runtime mode.
 
@@ -451,6 +456,9 @@ function operationOptions(command,parsed,cwd){
     if(flags.has('public')&&command!=='dev'){
         usage('--public is supported only by dev.');
     }
+    if((flags.has('https')||values.cert!==undefined||values.key!==undefined)&&command!=='dev'){
+        usage('--https, --cert, and --key are supported only by dev.');
+    }
     if(flags.has('overwrite')&&command!=='bundle'){
         usage('--overwrite is supported only by bundle.');
     }
@@ -510,10 +518,18 @@ function operationOptions(command,parsed,cwd){
     }
     if(command==='dev'){
         noExtraPositionals(command,positionals);
+        if((values.cert===undefined)!==(values.key===undefined)){
+            usage('HTTPS development requires --cert and --key together.');
+        }
         return {
             ...common,
             host:values.host??(flags.has('public')?'0.0.0.0':'127.0.0.1'),
             port:readPort(values.port,8000),
+            https:flags.has('public')||flags.has('https')||values.cert!==undefined,
+            ...(values.cert===undefined?{}:{
+                certPath:path.resolve(workspaceRoot,values.cert),
+                keyPath:path.resolve(workspaceRoot,values.key)
+            }),
             ...(values['sdk-runtime-source']===undefined?{}:{
                 sdkRuntimeSourceRoot:path.resolve(cwd,values['sdk-runtime-source'])
             })
@@ -837,6 +853,7 @@ function serverSummary(result){
         host:result.host,
         port:result.port,
         url:result.url,
+        ...(result.protocol===undefined?{}:{protocol:result.protocol}),
         ...(result.networkUrls===undefined?{}:{networkUrls:result.networkUrls}),
         ...(result.callerAuthentication
             ?{callerAuthentication:result.callerAuthentication}

package/src/dev-server.mjs

@@ -2,6 +2,7 @@ import Is from 'strong-type';
 import {constants as FS_CONSTANTS} from 'node:fs';
 import {lstat,open,readFile,realpath} from 'node:fs/promises';
 import http from 'node:http';
+import https from 'node:https';
 import os from 'node:os';
 import path from 'node:path';
 import {resolveWorkspace} from './workspace.mjs';
@@ -494,7 +495,7 @@ function browserHostname(host){
     return host.includes(':')?`[${host}]`:host;
 }
 
-function networkUrlsForAddress(address,startPath){
+function networkUrlsForAddress(address,startPath,protocol){
     if(address.address==='127.0.0.1'||address.address==='::1')return [];
     const allIPv4=address.address==='0.0.0.0';
     const allInterfaces=address.address==='::';
@@ -507,12 +508,49 @@ function networkUrlsForAddress(address,startPath){
             if(entry.family==='IPv6'&&entry.scopeid)continue;
             if(allIPv4&&entry.family!=='IPv4')continue;
             if(!allIPv4&&!allInterfaces&&entry.address!==address.address)continue;
-            urls.add(`http://${browserHostname(entry.address)}:${address.port}${startPath}`);
+            urls.add(`${protocol}//${browserHostname(entry.address)}:${address.port}${startPath}`);
         }
     }
     return [...urls];
 }
 
+async function resolveDevelopmentTls({workspaceRoot,https:useHttps,tls,certPath,keyPath,signal}){
+    if(tls!==undefined&&tls!==null&&tls!==false){
+        if(!is.object(tls)||is.array(tls)){
+            fail('Development server tls must be a Node HTTPS options object.','ARCANE_USAGE');
+        }
+        return {options:tls};
+    }
+    if(certPath===undefined&&keyPath===undefined&&!useHttps)return undefined;
+    if((certPath===undefined)!==(keyPath===undefined)){
+        fail('HTTPS development requires both certPath and keyPath when either is supplied.','ARCANE_USAGE');
+    }
+    const certificatePath=path.resolve(workspaceRoot,certPath??'.arcane/dev/server-cert.pem');
+    const privateKeyPath=path.resolve(workspaceRoot,keyPath??'.arcane/dev/server-key.pem');
+    try{
+        const reads=await Promise.allSettled([
+            readFile(certificatePath,{signal}),
+            readFile(privateKeyPath,{signal})
+        ]);
+        for(const read of reads){
+            if(read.status==='rejected')throw read.reason;
+        }
+        return {
+            options:{cert:reads[0].value,key:reads[1].value},
+            privateKeyPath:await realpath(privateKeyPath)
+        };
+    }catch(error){
+        if(error.code==='ENOENT'){
+            fail(
+                `HTTPS development requires a certificate at ${certificatePath} and a key at ${privateKeyPath}. `
+                +'Provide that pair or select existing files with --cert and --key.',
+                'ARCANE_DEV_TLS_MISSING'
+            );
+        }
+        throw error;
+    }
+}
+
 async function startOwnedDevServer({
     workspaceRoot=process.cwd(),
     appId,
@@ -520,6 +558,10 @@ async function startOwnedDevServer({
     releaseRoot,
     host='127.0.0.1',
     port=0,
+    https:useHttps=false,
+    tls,
+    certPath,
+    keyPath,
     signal,
     sdkRuntimeSourceRoot
 }={},events,releaseSignal){
@@ -543,6 +585,11 @@ async function startOwnedDevServer({
         appId,
         ...(requestedRuntimeMode?{runtimeMode:requestedRuntimeMode}:{})
     });
+    const selectedTls=await resolveDevelopmentTls({
+        workspaceRoot,https:useHttps,tls,certPath,keyPath,signal
+    });
+    const protocol=selectedTls?'https:':'http:';
+    throwIfAborted(signal);
     const routeSet=mode==='source'
         ?await sourceRoutes(workspaceRoot,appId,{
             sdkRuntimeSourceRoot,
@@ -570,7 +617,7 @@ async function startOwnedDevServer({
     const resourcePaths=new Set([routeSet.startPath]);
     const requestTasks=new Set();
     const runFileWork=createFileWorkLimiter();
-    const server=http.createServer((request,response)=>{
+    function serveDevelopmentRequest(request,response){
         let task;
         task=(async()=>{
             if(request.method!=='GET'&&request.method!=='HEAD'){
@@ -595,6 +642,11 @@ async function startOwnedDevServer({
             await runFileWork(async()=>{
                 const opened=await openSafeFile(mapping.root,relative);
                 if(!opened){deny(response,404,'Not found.');return;}
+                if(selectedTls?.privateKeyPath
+                    &&canonicalLocationKey(opened.candidate)===canonicalLocationKey(selectedTls.privateKeyPath)){
+                    deny(response,404,'Not found.');
+                    return;
+                }
                 const extension=path.extname(opened.candidate).toLowerCase();
                 const html=extension==='.html'||extension==='.htm';
                 let managedDocument=false;
@@ -648,7 +700,10 @@ async function startOwnedDevServer({
             requestTasks.delete(task);
         });
         requestTasks.add(task);
-    });
+    }
+    const server=selectedTls
+        ?https.createServer(selectedTls.options,serveDevelopmentRequest)
+        :http.createServer(serveDevelopmentRequest);
     await listen(server,{host,port,signal});
     const address=server.address();
     if(!address||is.string(address)){
@@ -658,7 +713,7 @@ async function startOwnedDevServer({
     const visibleHost=address.address==='0.0.0.0'||address.address==='::'
         ?'localhost'
         :browserHostname(address.address);
-    const endpoint=new URL(`http://${visibleHost}:${address.port}`);
+    const endpoint=new URL(`${protocol}//${visibleHost}:${address.port}`);
     const origin=endpoint.origin;
     const cleanUrl=`${origin}${routeSet.startPath}`;
     const url=cleanUrl;
@@ -742,6 +797,7 @@ async function startOwnedDevServer({
     server.once('close',()=>{void finishLifecycle();});
     const result={
         server,
+        protocol,
         mode,
         workspaceRoot:routeSet.workspaceRoot,
         appId:routeSet.appId,
@@ -760,9 +816,10 @@ async function startOwnedDevServer({
         lifecycle
     };
     try{
-        result.networkUrls=networkUrlsForAddress(address,routeSet.startPath);
+        result.networkUrls=networkUrlsForAddress(address,routeSet.startPath,protocol);
         await events.send({
             type:'server.started',
+            protocol,
             mode,
             host:result.host,
             port:result.port,

package/src/toolchain.mjs

@@ -466,6 +466,10 @@ export async function developApplication(options={}){
         }),
         host:options.host,
         port:options.port,
+        https:options.https,
+        tls:options.tls,
+        certPath:options.certPath,
+        keyPath:options.keyPath,
         signal:options.signal,
         onEvent:options.onEvent
     });