writeonce

shoney/writeonce

Fork 0

Commit graph

Author	SHA1	Message	Date
shoney.arickathil	ef37b8ffa2	feat(serve+view): file serving, downloads, supported systems; rename - rename the two libraries: writeonce-framework -> writeonce-serve (`use serve`), wo-html -> writeonce-view (`use view`). Names say the ROLE now; every sample, script, gate and live doc follows - stories/specs/plans keep the old names: they are dated records, and both library READMEs carry a "renamed 2026-08-25" note - serve/http/files.wo: StaticFiles { dir, max_bytes } — traversal refused not normalised, extension content types, attachment disposition for archives. Lifted out of the shop, which had said in a comment that it belonged in the framework - shop drops its private copy and mounts the framework's - site: /dl/*path over $WO_DIST (default ./dist), 16 MiB ceiling - /install gains supported systems — Linux x86-64, glibc >= 2.38, not musl — read off `file` and the binaries' GLIBC_ symbol versions, not off a wish list; plus GitHub release as primary, /dl as mirror, and the sha256 verify step - site-accept: 17 -> 21 checks (supported systems, gzip download with a binary-safe probe, checksum, /dl traversal 404) Verified on 192.168.0.165: the real 960,820-byte tarball downloads as application/gzip and its sha256 matches the published digest. Gates: oop-accept MET, site 21/0, web-app 46/0, fibers 10/0, db-actor 8/0; shop rebuilt and its /assets served by the framework. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-25 04:41:00 +02:00
shoney.arickathil	82713e4010	feat: framework v1 slice 2 — the remaining ledger, ten items - After seam: interface After + Aw + use_after; dispatch funnels every response (handler/short-circuit/404/405) through the after chain; the WS 101 sentinel skips it (never serialized) - http/secure.wo: SecurityHeaders (nosniff/DENY/referrer; HSTS stays at the TLS proxy), Cors (preflight 204 before + origin stamp after, one class both halves), HostAllow (421), client_ip (XFF parsing — peer VERIFY stays story 35) - http/nego.wo: accepts() (exact, type/, /; q stripped not ranked), etag_for (quoted base64 sha256), with_etag (If-None-Match -> 304) - router: rest wildcard (last segment, empty rest matches), Group (prefix + routes + group middleware) + Gmw prefix-scoped entries, App.mount; new App fields carry defaults so standing ctor literals keep compiling - Req grows ctx bag; parse rejects duplicate Content-Length (400, RFC 9112 §6.3) - web-app exercises all of it; gate grows 26 -> 38 checks (wildcards, group+ctx, etag+304, 406/200 negotiation, sec headers, 421, preflight+origin stamp, dup-CL 400) - ledger rows flipped; dep graph section 3 grown (slice-2 done nodes, crypto gate cleared, cookie/CSRF/session/webhook/JWT now ready) - merges: chat-ws-lifecycle (digests for ETag; WS + lifecycle ride along) + site-sample (second consumer gate); battery 13/13 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-23 06:45:51 +02:00

Author

SHA1

Message

Date

shoney.arickathil

ef37b8ffa2

feat(serve+view): file serving, downloads, supported systems; rename

- rename the two libraries: writeonce-framework -> writeonce-serve
  (`use serve`), wo-html -> writeonce-view (`use view`). Names say the
  ROLE now; every sample, script, gate and live doc follows
- stories/specs/plans keep the old names: they are dated records, and
  both library READMEs carry a "renamed 2026-08-25" note
- serve/http/files.wo: StaticFiles { dir, max_bytes } — traversal
  refused not normalised, extension content types, attachment
  disposition for archives. Lifted out of the shop, which had said in
  a comment that it belonged in the framework
- shop drops its private copy and mounts the framework's
- site: /dl/*path over $WO_DIST (default ./dist), 16 MiB ceiling
- /install gains supported systems — Linux x86-64, glibc >= 2.38,
  not musl — read off `file` and the binaries' GLIBC_ symbol
  versions, not off a wish list; plus GitHub release as primary,
  /dl as mirror, and the sha256 verify step
- site-accept: 17 -> 21 checks (supported systems, gzip download with
  a binary-safe probe, checksum, /dl traversal 404)

Verified on 192.168.0.165: the real 960,820-byte tarball downloads
as application/gzip and its sha256 matches the published digest.

Gates: oop-accept MET, site 21/0, web-app 46/0, fibers 10/0,
db-actor 8/0; shop rebuilt and its /assets served by the framework.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-25 04:41:00 +02:00

shoney.arickathil

82713e4010

feat: framework v1 slice 2 — the remaining ledger, ten items

- After seam: interface After + Aw + use_after; dispatch funnels every
  response (handler/short-circuit/404/405) through the after chain;
  the WS 101 sentinel skips it (never serialized)
- http/secure.wo: SecurityHeaders (nosniff/DENY/referrer; HSTS stays
  at the TLS proxy), Cors (preflight 204 before + origin stamp after,
  one class both halves), HostAllow (421), client_ip (XFF parsing —
  peer VERIFY stays story 35)
- http/nego.wo: accepts() (exact, type/*, */*; q stripped not ranked),
  etag_for (quoted base64 sha256), with_etag (If-None-Match -> 304)
- router: *rest wildcard (last segment, empty rest matches), Group
  (prefix + routes + group middleware) + Gmw prefix-scoped entries,
  App.mount; new App fields carry defaults so standing ctor literals
  keep compiling
- Req grows ctx bag; parse rejects duplicate Content-Length (400,
  RFC 9112 §6.3)
- web-app exercises all of it; gate grows 26 -> 38 checks (wildcards,
  group+ctx, etag+304, 406/200 negotiation, sec headers, 421,
  preflight+origin stamp, dup-CL 400)
- ledger rows flipped; dep graph section 3 grown (slice-2 done nodes,
  crypto gate cleared, cookie/CSRF/session/webhook/JWT now ready)
- merges: chat-ws-lifecycle (digests for ETag; WS + lifecycle ride
  along) + site-sample (second consumer gate); battery 13/13

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-23 06:45:51 +02:00

2 commits