# Portal requirements

Regex Tools is a static nested-path-safe application. All engine resources are
self-hosted below the mounted release path; no runtime CDN fallback is allowed.

Required delivery behavior:

- JavaScript, module and worker files (`.js` and `.mjs`) use a JavaScript MIME
  type.
- Every `.wasm` file below `engines/` uses `application/wasm`. This includes
  standalone PCRE2, PHP, Perl, Python, Ruby, C++, Go, Rust and every .NET
  `_framework` WebAssembly file.
- `toolbox-app.json`, HTML and legal/source documents remain
  revalidation/no-cache resources. Hashed Vite assets may use immutable
  long-term caching.
- CSP permits `worker-src 'self' blob:`. The legacy Perl profile starts one
  nested same-origin classic worker inside its supervised module worker.
- CSP permits self-hosted WebAssembly compilation in `script-src`, normally
  through `'wasm-unsafe-eval'`. Broad `'unsafe-eval'` must not be enabled to
  accommodate a runtime. Ruby cold startup and the fixed legacy Perl path pass
  the release's strict-CSP browser gate without broad eval. WebPerl retains a
  dormant optional interoperability `eval` site in upstream `emperl.js`, but
  the fixed bridge does not load it.
- `connect-src 'self'` permits workers/runtimes to fetch their own same-origin
  WebAssembly, Python standard-library, Perl data, .NET framework and metadata
  resources.
- Binary/data assets such as `python_stdlib.zip`, `emperl.data`, metadata JSON,
  checksum files, licences and notices are delivered without content
  transformation.
- Range support is not required, but servers and proxies must not rewrite
  engine bytes or apply HTML fallbacks to missing asset paths.
- Every directory below `engines/` uses revalidation or a release-scoped
  immutable cache. Most engine filenames are not content-addressed and must
  never drift under one release identity.

A suitable CSP is documented in [`SECURITY.md`](SECURITY.md). Deployments
should test both a direct root mount and a nested mount such as
`/apps/regex/`, including cold loading of all twelve profiles.

The Portal must consume the immutable release ZIP, verify its SHA-256, verify
manifest ID `de.add-ideas.regex-tools` and version `0.4.0`, and mount it at a
relative target such as `apps/regex/`.

The package, manifest, tag, artifact URL and checksum must all use the v0.4.0
identity. Historical artifact coordinates remain immutable and must not be
overwritten or reused.