# Portal requirements

Regex Tools is a static nested-path-safe application.

Required delivery behavior:

- JavaScript workers use a JavaScript MIME type.
- `toolbox-app.json`, HTML and legal/source documents should remain
  revalidation/no-cache resources.
- Hashed Vite assets may use immutable long-term caching.
- CSP must allow `worker-src 'self' blob:`.
- `engines/pcre2/pcre2.wasm` and
  `engines/python/pyodide.asm.wasm` must use `application/wasm`.
- Engine `.mjs` files must use a JavaScript MIME type;
  `engines/python/python_stdlib.zip`, JSON, licence, notice and checksum files
  must be delivered without content transformation.
- `script-src` must permit self-hosted WebAssembly compilation, normally with
  `'wasm-unsafe-eval'`; broad `'unsafe-eval'` is neither needed nor recommended.
- `connect-src 'self'` must allow the Pyodide worker to fetch its own
  same-origin WebAssembly, standard-library and lock files.
- Every file below `engines/pcre2/`, `engines/python/` and `engines/java/`
  should use revalidation or a release-scoped immutable cache. These are not
  content-hashed filenames and must never drift under one release identity.

The Portal must consume the immutable release ZIP, verify its SHA-256, verify
manifest ID `de.add-ideas.regex-tools` and version `0.3.0`, and mount it at a
relative target such as `apps/regex/`.

The package, manifest, tag, artifact URL and checksum must all use the v0.3.0
identity. Historical artifact coordinates remain immutable and must not be
overwritten or reused.