lotobo/regex-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity
Files
7f3a91ad3789cf0f70be0c3d665d67b2e05491e9
regex-tools/docs/PORTAL_REQUIREMENTS.md

2.4 KiB
Raw Blame History

Portal requirements

Regex Tools is a static nested-path-safe application. All engine resources are self-hosted below the mounted release path; no runtime CDN fallback is allowed.

Required delivery behavior:

  • JavaScript, module and worker files (.js and .mjs) use a JavaScript MIME type.
  • Every .wasm file below engines/ uses application/wasm. This includes standalone PCRE2, PHP, Perl, Python, Ruby, C++, Go, Rust and every .NET _framework WebAssembly file.
  • toolbox-app.json, HTML and legal/source documents remain revalidation/no-cache resources. Hashed Vite assets may use immutable long-term caching.
  • CSP permits worker-src 'self' blob:. The legacy Perl profile starts one nested same-origin classic worker inside its supervised module worker.
  • CSP permits self-hosted WebAssembly compilation in script-src, normally through 'wasm-unsafe-eval'. Broad 'unsafe-eval' must not be enabled to accommodate a runtime. Ruby cold startup and the fixed legacy Perl path pass the release's strict-CSP browser gate without broad eval. WebPerl retains a dormant optional interoperability eval site in upstream emperl.js, but the fixed bridge does not load it.
  • connect-src 'self' permits workers/runtimes to fetch their own same-origin WebAssembly, Python standard-library, Perl data, .NET framework and metadata resources.
  • Binary/data assets such as python_stdlib.zip, emperl.data, metadata JSON, checksum files, licences and notices are delivered without content transformation.
  • Range support is not required, but servers and proxies must not rewrite engine bytes or apply HTML fallbacks to missing asset paths.
  • Every directory below engines/ uses revalidation or a release-scoped immutable cache. Most engine filenames are not content-addressed and must never drift under one release identity.

A suitable CSP is documented in SECURITY.md. Deployments should test both a direct root mount and a nested mount such as /apps/regex/, including cold loading of all twelve profiles.

The Portal must consume the immutable release ZIP, verify its SHA-256, verify manifest ID de.add-ideas.regex-tools and version 0.4.0, and mount it at a relative target such as apps/regex/.

The package, manifest, tag, artifact URL and checksum must all use the v0.4.0 identity. Historical artifact coordinates remain immutable and must not be overwritten or reused.