fix: bound the activation marker in bytes and give a click one observer

The marker read added a whole chunk to a running total and compared the
total afterwards, so a corrupt body could hand activation a 1 MiB chunk
against a 257-byte ceiling. It now reads at most the remaining allowance —
through a BYOB reader where the source offers one, and by refusing an
oversized chunk before copying it otherwise. A declared oversize cancels
the body it refuses instead of leaving the stream open, and the reader
lock is released on every path.

The build generator and the runtime decoder shared only the extension
table, not the path grammar. The generator happily emitted
`/assets/bad@name-abcdefgh.js`, which the decoder then refused — a correct
build failing at install time. Both now use one exported canonical path
predicate and the generator decodes its own output before returning it.

The notification click handler emitted its terminal record from inside
`process` and again from the `waitUntil` wrapper, so an ordinary click was
counted twice. Worse, a late rejection downgraded `MAYBE_APPLIED` to
`NOT_APPLIED` — telling operators the click had definitely not been
applied when nobody knew that — and the late observation ran outside
`waitUntil`, so a worker shutdown lost the evidence. There is one
observation authority per click now, certainty is monotone, only an
explicit null window confirms `NOT_APPLIED`, and the bounded tail is owned
by `waitUntil` without extending the public deadline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/adapters/service-worker/service-worker-lifecycle.ts

@@ -501,47 +501,119 @@ async function readBoundedMarkerText(
       return null;
     }
   }
-  const reader = response.body.getReader();
-  const chunks: Uint8Array[] = [];
+  // SW-01. The allowance is `limit + 1` bytes: one byte past the ceiling is
+  // enough to prove the marker is oversized, and nothing beyond it is ever
+  // retained. A BYOB reader asks the source for exactly the remaining
+  // allowance, so a corrupt body cannot answer a 1 MiB chunk to a 257-byte
+  // request. Without BYOB the first oversized chunk is refused outright rather
+  // than copied and then measured.
+  const allowance = ACTIVATION_MARKER_MAX_BYTES + 1;
+  const reader = byobReader(response.body) ?? response.body.getReader();
+  const byob = "read" in reader && isByobReader(reader);
+  const bytes = new Uint8Array(allowance);
   let total = 0;
   let timer: ReturnType<typeof setTimeout> | undefined;
+  let cancelled = false;
   const deadline = new Promise<"DEADLINE">((resolve) => {
-    timer = setTimeout(
-      () => resolve("DEADLINE"),
-      ACTIVATION_MARKER_READ_DEADLINE_MS,
-    );
-  });
-  try {
-    for (;;) {
-      const next = await Promise.race([reader.read(), deadline]);
-      if (next === "DEADLINE") return null;
-      if (next.done) break;
-      if (!next.value) continue;
-      total += next.value.byteLength;
-      if (total > ACTIVATION_MARKER_MAX_BYTES) return null;
-      chunks.push(next.value);
+    try {
+      timer = setTimeout(
+        () => resolve("DEADLINE"),
+        ACTIVATION_MARKER_READ_DEADLINE_MS,
+      );
+    } catch {
+      // An unschedulable deadline leaves the read unbounded, so it ends now.
+      resolve("DEADLINE");
     }
-  } catch {
-    return null;
-  } finally {
-    if (timer !== undefined) clearTimeout(timer);
+  });
+  const cancelOnce = (): void => {
+    if (cancelled) return;
+    cancelled = true;
     // Never awaited: cancelling a stream whose source ignores cancellation can
     // itself hang, and the marker read already has its answer.
-    void reader.cancel().catch(() => {});
-  }
-  const bytes = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
+    try {
+      void reader.cancel().catch(() => {});
+    } catch {
+      // A hostile reader cannot block the release below.
+    }
+  };
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    for (;;) {
+      const remaining = allowance - total;
+      if (remaining <= 0) {
+        // More than the ceiling has already arrived.
+        return null;
+      }
+      const pending = byob
+        ? (reader as ReadableStreamBYOBReader).read(
+            new Uint8Array(remaining),
+          )
+        : (reader as ReadableStreamDefaultReader<Uint8Array>).read();
+      const next = await Promise.race([pending, deadline]);
+      if (next === "DEADLINE") {
+        cancelOnce();
+        return null;
+      }
+      if (next.done) break;
+      const chunk = next.value;
+      if (!chunk) continue;
+      if (chunk.byteLength > remaining) {
+        // Refused before it is retained: the oversized chunk is not copied.
+        cancelOnce();
+        return null;
+      }
+      bytes.set(chunk, total);
+      total += chunk.byteLength;
+    }
+  } catch {
+    cancelOnce();
+    return null;
+  } finally {
+    if (timer !== undefined) {
+      try {
+        clearTimeout(timer);
+      } catch {
+        // Releasing the timer is best effort.
+      }
+    }
+    cancelOnce();
+    try {
+      reader.releaseLock();
+    } catch {
+      // A cancelled reader has already released its lock.
+    }
+  }
+  if (total > ACTIVATION_MARKER_MAX_BYTES) return null;
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(
+      bytes.subarray(0, total),
+    );
   } catch {
     return null;
   }
 }
 
+/** A byte stream can hand out a BYOB reader; a regular one cannot. */
+function byobReader(
+  body: ReadableStream<Uint8Array>,
+): ReadableStreamBYOBReader | null {
+  try {
+    return (
+      body as ReadableStream<Uint8Array> & {
+        getReader(options: { mode: "byob" }): ReadableStreamBYOBReader;
+      }
+    ).getReader({ mode: "byob" });
+  } catch {
+    return null;
+  }
+}
+
+function isByobReader(reader: unknown): reader is ReadableStreamBYOBReader {
+  return (
+    typeof ReadableStreamBYOBReader === "function" &&
+    reader instanceof ReadableStreamBYOBReader
+  );
+}
+
 async function readActivationMarker(
   cache: Cache,
   expectedCacheName: string,
@@ -555,6 +627,14 @@ async function readActivationMarker(
       (!/^\d+$/u.test(declaredLength) ||
         Number(declaredLength) > ACTIVATION_MARKER_MAX_BYTES)
     ) {
+      // SW-01. A declared oversize ends the read, but the body it declared is
+      // still an open stream: returning without cancelling it left the source
+      // holding the connection for the rest of the worker's life.
+      try {
+        void response.body?.cancel().catch(() => {});
+      } catch {
+        // Cancelling is best effort and cannot change the closed outcome.
+      }
       return null;
     }
     // SW-RR-01. A Content-Length is a claim, not a bound. Without one the

src/adapters/web-push/inbound/notification-click-adapter.ts

@@ -51,6 +51,18 @@ export type NotificationClickAdapter = Readonly<{
  */
 const ABORT_OWNED = Symbol("web-push-click-aborted");
 
+/**
+ * WP-01. Per-click observation state: the current native-effect certainty and
+ * the bounded tail tasks that observe an effect landing after the terminal
+ * result. `waitUntil` owns the tails so the worker cannot be terminated before
+ * the evidence lands, and the certainty is monotone from `NOT_APPLIED` through
+ * `MAYBE_APPLIED` to `CONFIRMED`.
+ */
+type ClickEffectState = {
+  certainty: WebPushNativeEffectCertainty;
+  tails: Promise<unknown>[];
+};
+
 async function raceAbort<Value>(
   operation: Promise<Value>,
   signal: AbortSignal,
@@ -103,8 +115,17 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
       const taskControl = createLinkedAbortController(
         dependencies.signal,
       );
+      // WP-01. One observation authority per click. The terminal record was
+      // emitted both inside `process` and again here, so an ordinary click was
+      // counted twice, and the native-effect evidence was detached from
+      // `waitUntil` entirely — a worker that shut down after the terminal
+      // result simply lost it.
+      const effect: ClickEffectState = {
+        certainty: "NOT_APPLIED",
+        tails: [],
+      };
       const processing = withAbortableDeadline(
-        (signal) => process(event.notification.data, signal),
+        (signal) => process(event.notification.data, signal, effect),
         {
           deadlineMs: handlerDeadlineMs,
           operation: "NOTIFICATION_CLICK",
@@ -114,12 +135,16 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
       ).finally(taskControl.dispose);
       try {
         event.waitUntil(
-          processing.then((result) => {
+          processing.then(async (result) => {
             observeWebPush(dependencies.observer, {
               event: "web_push_click_dispatched",
               outcome: result.ok ? "SUCCEEDED" : "FAILED",
               ...(result.ok ? {} : { reason: result.error.code }),
+              nativeEffect: effect.certainty,
             });
+            // The late-effect observation is this handler's own work, so the
+            // worker stays alive for it without extending the public deadline.
+            await Promise.allSettled(effect.tails);
           }),
         );
       } catch {
@@ -133,6 +158,7 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
   async function process(
     data: unknown,
     signal: AbortSignal,
+    effect: ClickEffectState,
   ): Promise<WebPushResult<void>> {
     const decoded = decodeNotificationClickData(data, now());
     if (!decoded.ok) return decoded;
@@ -186,33 +212,41 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
     // CONFIRMED on fulfilment. An effect that lands after this handler's
     // deadline is still observed exactly once — as evidence only, never as
     // authorization to retry.
-    let nativeEffect: WebPushNativeEffectCertainty = "NOT_APPLIED";
     const observeLateEffect = (
       pending: Promise<unknown>,
-      succeeded: (value: unknown) => boolean,
+      appliedWhen: (value: unknown) => boolean,
     ): void => {
       let observed = false;
-      void pending.then(
-        (value) => {
-          if (observed) return;
-          observed = true;
-          observeWebPush(dependencies.observer, {
-            event: "web_push_click_dispatched",
-            outcome: succeeded(value) ? "DEGRADED" : "FAILED",
-            reason: "ABORTED",
-            nativeEffect: succeeded(value) ? "CONFIRMED" : "NOT_APPLIED",
-          });
-        },
-        () => {
-          if (observed) return;
-          observed = true;
-          observeWebPush(dependencies.observer, {
-            event: "web_push_click_dispatched",
-            outcome: "FAILED",
-            reason: "ABORTED",
-            nativeEffect: "NOT_APPLIED",
-          });
-        },
+      // WP-01. The tail is tracked so `waitUntil` owns it. Certainty is
+      // monotone: once the native call has been made the effect can only be
+      // confirmed or stay uncertain. A rejection says the call did not report
+      // success, not that it never happened, so downgrading it to NOT_APPLIED
+      // told operators the click had definitely not been applied.
+      effect.tails.push(
+        pending.then(
+          (value) => {
+            if (observed) return;
+            observed = true;
+            const applied = appliedWhen(value);
+            effect.certainty = applied ? "CONFIRMED" : "NOT_APPLIED";
+            observeWebPush(dependencies.observer, {
+              event: "web_push_click_dispatched",
+              outcome: applied ? "DEGRADED" : "FAILED",
+              reason: "ABORTED",
+              nativeEffect: effect.certainty,
+            });
+          },
+          () => {
+            if (observed) return;
+            observed = true;
+            observeWebPush(dependencies.observer, {
+              event: "web_push_click_dispatched",
+              outcome: "DEGRADED",
+              reason: "ABORTED",
+              nativeEffect: "MAYBE_APPLIED",
+            });
+          },
+        ),
       );
     };
     try {
@@ -222,56 +256,38 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
       if (existing) {
         existing.postMessage(handoff);
         const focused = Promise.resolve(existing.focus());
-        nativeEffect = "MAYBE_APPLIED";
+        effect.certainty = "MAYBE_APPLIED";
         const raced = await raceAbort(focused, signal);
         if (raced === ABORT_OWNED) {
           observeLateEffect(focused, () => true);
           return webPushFailure("ABORTED", "NOTIFICATION_CLICK");
         }
-        nativeEffect = "CONFIRMED";
+        effect.certainty = "CONFIRMED";
       } else {
         const opening = Promise.resolve(
           dependencies.clients.openWindow(target),
         );
-        nativeEffect = "MAYBE_APPLIED";
+        effect.certainty = "MAYBE_APPLIED";
         const raced = await raceAbort(opening, signal);
         if (raced === ABORT_OWNED) {
           observeLateEffect(opening, (value) => value !== null);
           return webPushFailure("ABORTED", "NOTIFICATION_CLICK");
         }
         if (!raced) {
-          nativeEffect = "NOT_APPLIED";
-          observeWebPush(dependencies.observer, {
-            event: "web_push_click_dispatched",
-            outcome: "FAILED",
-            nativeEffect,
-          });
+          // An explicit null is the one answer that confirms no window opened.
+          effect.certainty = "NOT_APPLIED";
           return nativeFailure("NOTIFICATION_CLICK", true);
         }
-        nativeEffect = "CONFIRMED";
+        effect.certainty = "CONFIRMED";
       }
       if (signal.aborted) {
-        observeWebPush(dependencies.observer, {
-          event: "web_push_click_dispatched",
-          outcome: "DEGRADED",
-          reason: "ABORTED",
-          nativeEffect,
-        });
         return webPushFailure("ABORTED", "NOTIFICATION_CLICK");
       }
     } catch {
-      observeWebPush(dependencies.observer, {
-        event: "web_push_click_dispatched",
-        outcome: "FAILED",
-        nativeEffect,
-      });
+      // The native call threw, so it never reported success; whether it took
+      // effect is unknown rather than settled.
       return nativeFailure("NOTIFICATION_CLICK", true);
     }
-    observeWebPush(dependencies.observer, {
-      event: "web_push_click_dispatched",
-      outcome: "SUCCEEDED",
-      nativeEffect,
-    });
     return webPushSuccess(undefined);
   }
 

src/contracts/service-worker-static-manifest.ts

@@ -71,6 +71,22 @@ const IDENTITY = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
 /** Root-relative, hashed, no dot segments, no query and no fragment. */
 const ASSET_URL = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/u;
 
+/**
+ * SW-02. The one canonical asset-path predicate, shared by the build generator
+ * and this decoder. Sharing only the extension table left the two with
+ * different path grammars: the generator emitted a URL for a directory
+ * containing a space, an `@` or a percent-escape, and the decoder then refused
+ * the manifest it had just produced, failing the release build.
+ */
+export function isCanonicalStaticAssetUrl(url: string): boolean {
+  return (
+    typeof url === "string" &&
+    ASSET_URL.test(url) &&
+    !url.includes("/../") &&
+    !url.includes("/./")
+  );
+}
+
 export type StaticManifestDecodeFailure = Readonly<{
   reason: string;
 }>;
@@ -135,12 +151,9 @@ export function decodeStaticAssetManifest(
     const row = exactKeys(candidate, ASSET_ROW_KEYS);
     if (!row) return failure("asset row keys are not exact");
     const { url, sha256, bytes, contentType } = row;
-    if (typeof url !== "string" || !ASSET_URL.test(url)) {
+    if (typeof url !== "string" || !isCanonicalStaticAssetUrl(url)) {
       return failure("asset url must be root-relative without dot segments");
     }
-    if (url.includes("/../") || url.includes("/./")) {
-      return failure("asset url must not contain dot segments");
-    }
     if (seen.has(url)) return failure("asset urls must be unique");
     // A sorted set makes the canonical bytes independent of directory order.
     if (previousUrl !== null && url <= previousUrl) {