fix: make Service Worker cache and removal outcomes truthful

SW-URL-01: canonicalize each generated root-relative manifest URL against the
registration scope once, re-check same-origin, and share that absolute identity
across install cache keys, fetch classification and cache lookup or delete.
Previously every verified asset fell through to the network.

SW-01: serve verified static requests only from the current release cache. A
CacheStorage-wide match could return a previous release's response for the same
URL while the delete targeted a cache that was never read. The worker scope
facade no longer exposes a wide match at all.

SW-02: cache reset deletes only names that parse as owned, so a foreign cache
sharing the ca-static-v1- prefix survives.

SW-03: unregister() resolving to false is a FAILED unregister, not UNREGISTERED.

SW-04: staged removal reports what happened - ABSENT, UNREGISTERED and PURGED
map to DISABLED, OWNERSHIP_MISMATCH to INCOMPATIBLE and FAILED to FAILED - so a
later release cannot delete the worker while a registration or owned cache is
still present.

SW-05: add the runtime-neutral service-worker-static-manifest codec that owns
exact row keys, the extension and content-type allowlist, the root-relative URL
rule and the length-prefixed canonical bytes. The generator and the build gate
hash those same bytes, and the build gate now decodes and recomputes the set
digest instead of type-casting the manifest.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/generate-service-worker-assets.ts

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+
+import { canonicalStaticManifestBytes } from "../src/contracts/service-worker-static-manifest.ts";
 import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 
@@ -74,32 +76,21 @@ export async function collectStaticAssets(
     throw new Error("Static asset set exceeds its byte bound.");
   }
 
-  // The set digest is a length-prefixed hash over the sorted asset identities,
-  // so a reordered directory listing cannot change it.
-  const hash = createHash("sha256");
-  hash.update("CA_STATIC_ASSET_SET_V1\0");
-  for (const asset of assets) {
-    hash.update(lengthPrefixed(asset.url));
-    hash.update(lengthPrefixed(asset.sha256));
-    hash.update(lengthPrefixed(String(asset.bytes)));
-    hash.update(lengthPrefixed(asset.contentType));
-  }
+  // SW-05. The canonical byte serialization lives in the shared runtime-neutral
+  // codec so the worker can recompute the identical digest with WebCrypto.
+  const setDigest: `sha256:${string}` = `sha256:${createHash("sha256")
+    .update(canonicalStaticManifestBytes(assets))
+    .digest("hex")}`;
 
   return {
     schemaVersion: 1,
     buildId,
     releaseId,
-    setDigest: `sha256:${hash.digest("hex")}`,
+    setDigest,
     assets,
   };
 }
 
-function lengthPrefixed(value: string): Buffer {
-  const bytes = Buffer.from(value, "utf8");
-  const prefix = Buffer.alloc(4);
-  prefix.writeUInt32BE(bytes.byteLength, 0);
-  return Buffer.concat([prefix, bytes]);
-}
 
 async function walk(root: string, current: string): Promise<string[]> {
   const entries = await readdir(current, { withFileTypes: true });

scripts/lib/service-worker-build-input.ts

@@ -1,3 +1,10 @@
+import { createHash } from "node:crypto";
+
+import {
+  canonicalStaticManifestBytes,
+  decodeStaticAssetManifest,
+} from "../../src/contracts/service-worker-static-manifest.ts";
+
 import type {
   InstalledServiceWorkerSelection,
   ServiceWorkerHandlerId,
@@ -79,19 +86,28 @@ export function resolveServiceWorkerBuildInput(input: Readonly<{
   });
 }
 
+/**
+ * SW-05. The build gate no longer type-casts the manifest. It decodes every row
+ * through the shared runtime-neutral codec and recomputes the set digest from
+ * the same canonical bytes the generator hashed, so a tampered row, a reordered
+ * set or a stale digest fails admission instead of shipping.
+ */
 function parseAssets(value: unknown): StaticAssetManifestV1 {
-  const candidate = record(value);
-  if (
-    candidate?.schemaVersion !== 1 ||
-    typeof candidate.buildId !== "string" ||
-    typeof candidate.releaseId !== "string" ||
-    typeof candidate.setDigest !== "string" ||
-    !DIGEST.test(candidate.setDigest) ||
-    !Array.isArray(candidate.assets)
-  ) {
-    throw new TypeError("Generated Service Worker asset manifest is invalid.");
+  const decoded = decodeStaticAssetManifest(value);
+  if (!decoded.ok) {
+    throw new TypeError(
+      `Generated Service Worker asset manifest is invalid: ${decoded.error.reason}`,
+    );
   }
-  return candidate as unknown as StaticAssetManifestV1;
+  const expected = `sha256:${createHash("sha256")
+    .update(canonicalStaticManifestBytes(decoded.manifest.assets))
+    .digest("hex")}`;
+  if (expected !== decoded.manifest.setDigest) {
+    throw new TypeError(
+      "Generated Service Worker asset manifest set digest does not match its assets.",
+    );
+  }
+  return decoded.manifest as unknown as StaticAssetManifestV1;
 }
 
 function record(value: unknown): Record<string, unknown> | null {