47 lines
2.4 KiB
Markdown
47 lines
2.4 KiB
Markdown
# Portal requirements
|
|
|
|
Regex Tools is a static nested-path-safe application. All engine resources are
|
|
self-hosted below the mounted release path; no runtime CDN fallback is allowed.
|
|
|
|
Required delivery behavior:
|
|
|
|
- JavaScript, module and worker files (`.js` and `.mjs`) use a JavaScript MIME
|
|
type.
|
|
- Every `.wasm` file below `engines/` uses `application/wasm`. This includes
|
|
standalone PCRE2, PHP, Perl, Python, Ruby, C++, Go, Rust and every .NET
|
|
`_framework` WebAssembly file.
|
|
- `toolbox-app.json`, HTML and legal/source documents remain
|
|
revalidation/no-cache resources. Hashed Vite assets may use immutable
|
|
long-term caching.
|
|
- CSP permits `worker-src 'self' blob:`. The legacy Perl profile starts one
|
|
nested same-origin classic worker inside its supervised module worker.
|
|
- CSP permits self-hosted WebAssembly compilation in `script-src`, normally
|
|
through `'wasm-unsafe-eval'`. Broad `'unsafe-eval'` must not be enabled to
|
|
accommodate a runtime. Ruby cold startup and the fixed legacy Perl path pass
|
|
the release's strict-CSP browser gate without broad eval. WebPerl retains a
|
|
dormant optional interoperability `eval` site in upstream `emperl.js`, but
|
|
the fixed bridge does not load it.
|
|
- `connect-src 'self'` permits workers/runtimes to fetch their own same-origin
|
|
WebAssembly, Python standard-library, Perl data, .NET framework and metadata
|
|
resources.
|
|
- Binary/data assets such as `python_stdlib.zip`, `emperl.data`, metadata JSON,
|
|
checksum files, licences and notices are delivered without content
|
|
transformation.
|
|
- Range support is not required, but servers and proxies must not rewrite
|
|
engine bytes or apply HTML fallbacks to missing asset paths.
|
|
- Every directory below `engines/` uses revalidation or a release-scoped
|
|
immutable cache. Most engine filenames are not content-addressed and must
|
|
never drift under one release identity.
|
|
|
|
A suitable CSP is documented in [`SECURITY.md`](SECURITY.md). Deployments
|
|
should test both a direct root mount and a nested mount such as
|
|
`/apps/regex/`, including cold loading of all twelve profiles.
|
|
|
|
The Portal must consume the immutable release ZIP, verify its SHA-256, verify
|
|
manifest ID `de.add-ideas.regex-tools` and version `0.4.0`, and mount it at a
|
|
relative target such as `apps/regex/`.
|
|
|
|
The package, manifest, tag, artifact URL and checksum must all use the v0.4.0
|
|
identity. Historical artifact coordinates remain immutable and must not be
|
|
overwritten or reused.
|