Revision history for WebDyne 3.022 2026-08-25 * Hardened the helper script defaults for the built-in WebDyne indexer. webdyne.psgi, webdyne.pagi, and webdyne.apache now leave index handling disabled by default unless DOCUMENT_DEFAULT, a user option file, or an explicit --index option enables it. * Added WEBDYNE_INDEX_SOURCE_ENABLE and --view-source support for the helper scripts. The built-in index page source viewer is now disabled unless both index handling and source viewing are explicitly enabled, preserving the directory listing/debugging workflow without exposing page source by default. * Added PSGI and PAGI application builder support for wrapper-style initialization, including optional static handling and document-root .webdyne.conf.pl loading via the new constructor options. The helper scripts now opt in to this behaviour while direct WebDyne::PSGI->new(...)->to_app and WebDyne::PAGI->new(...)->to_app construction retains conservative defaults. * Fixed PSGI API fallback path traversal by rejecting dot path segments before route discovery and verifying discovered API files remain inside the document root using canonical relative-path checks. Added regression coverage for traversal attempts and normal API routing. * Restored end-of-string matching for WebDyne PSP filenames so files such as report.psp.pdf are not treated as executable PSP pages. This fixes a double-extension execution regression introduced when WEBDYNE_PSP_EXT became configurable. * Re-enabled CGI form value escaping by default and fixed the WebDyne::HTML::Tiny entity encoder override so WEBDYNE_CGI_AUTOESCAPE works as documented. Sticky text, password, and file form fields now escape request-derived values before rendering them into HTML attributes. * Applied automatic HTML escaping to request, environment, and method substitution operators (+{...}, *{...}, and ^{...}) when WEBDYNE_CGI_AUTOESCAPE is enabled. The raw ${...} substitution operator remains available for trusted, already-rendered values. * Added secure session cookie defaults and configuration constants for Secure, HttpOnly, and SameSite attributes. WebDyne sessions now emit Secure, HttpOnly, and SameSite=Lax cookies by default, with documented constants for deployments that need to adjust those attributes. * Preserved shortcut version overrides and added regression coverage for local-configuration isolation so tests are not affected by a developer's document-root .webdyne.conf.pl. * Updated the XML documentation, markdown sidecars, MANIFEST, and test suite for the new helper defaults, index source controls, escaping behaviour, PSP extension matching, PSGI/PAGI initialization, API traversal checks, and session cookie flags. 3.021 2026-08-24 * Extended wdlint to inspect inline Perl chunks, processing instructions, and substitution expressions in addition to __PERL__ sections. Each chunk is checked independently so later syntax errors are still reported after an earlier chunk fails. Added line-preserving regression coverage. * Added require and import attributes to , using the same dependency-loading and function-import behaviour as . Declared dependencies are loaded before normal, SSE, and WebSocket handlers are dispatched. * Passed CGI parameter hashes to PAGI SSE and WebSocket subroutines as their second argument, allowing async handlers to use request parameters explicitly across await points. * Fixed URL-encoded form POST handling under PAGI by asynchronously buffering request bodies before synchronous CGI::Simple parsing. Kept the cached body available to the WebDyne PAGI request adapter and avoided crossing localized environment scopes during await. Added repeated-request regression coverage for the former Future panic. * Added documentation and WebDyne authoring guidance for start_html dependencies, PAGI parameters, SSE/WebSocket handlers, HTMX fragments, and the required hx-vals="js:{ ... }" syntax when supplying values from PSP pages. * Added release-board and pizza-order SSE/HTMX demonstration pages, including WebDyne-rendered fragments, status refreshes, and PAGI handler examples. Kept these developer demos and scratch material out of distribution manifests. 3.020 2026-08-20 * Changed route pattern semantics so patterns are relative to the discovered API PSP file path. For example, api.psp owning /api/user/42 now uses pattern="/user/:id" rather than pattern="/api/user/:id". This is a breaking change for existing pages. * Updated PSGI and PAGI API fallback dispatch to strip the full API PSP mount path from PATH_INFO before passing requests to Router::Simple, keeping API route declarations independent of document-root location. * Updated API examples, release examples, tests, and local authoring guidance to use the new suffix-only convention. * Documented the WebDyne 3.020 pattern breaking change in the XML documentation and tag reference. 3.013 2026-08-16 * Normalized generated no_* wrapper options to numeric booleans so --dump_opt output is stable across Perl and Data::Dumper versions. * Made the webdyne.apache wrapper tests less sensitive to whitespace in Apache::TestRunPerl argument dumps and avoided macOS APXS probing by using a fake test apxs helper. * Improved PAGI smoke-test diagnostics by allowing PAGI::Test::Client application exceptions to surface in t/14-pagi.t instead of comparing only against a generic Internal Server Error response. * Added PAGI::Tools to the webdyne.pagi wrapper test prerequisite gate, matching the wrapper's runtime check and avoiding noisy failures on partial PAGI installations. 3.012 2026-08-10 * Disabled the redundant webdyne.apache ulimit probe, avoiding noisy stderr on restricted CPAN smoke hosts where raising the core-file ulimit is not permitted. * Guarded developer-only doc/example scans in the generated Makefile so CPAN install and smoke-test runs remain quiet when the documentation source tree is not shipped in the distribution tarball. 3.011 2026-08-07 * Extended wdrender --quiet/--silent to suppress advisory warnings about missing optional HTML::Tidy5 or syntax-highlighting modules while leaving rendering behaviour unchanged. * Updated wdrender regression coverage so --header output remains clean on machines without libtidy-devel and HTML::Tidy5 installed. * Made wdrender head-insert tests tolerant of harmless HTML/CSS whitespace differences while still checking that the default head insert is present or absent as requested. 3.010 2026-08-07 * Fixed duplicate response header emission when WebDyne handlers set headers through the request object, avoiding malformed HTTP response headers in PSGI and other runtimes. * Fixed wdrender --header output so response headers are included consistently regardless of colour, line-number, pretty-print, or tidy settings. * Added wdrender regression coverage for duplicate Content-Type headers and for --header behaviour with colour/tidy output enabled and disabled. * Added explicit filename override support for WebDyne::PSGI and WebDyne::PAGI helper applications, allowing tools such as wdrender to render a fixed source file while still exercising PSGI or PAGI request handling. * Documented that the WebDyne::PSGI and WebDyne::PAGI filename option is an application-level source-file override and always wins over normal request-path filename derivation. * Propagated wdrender --no-head-insert/--head-insert handling through PSGI, PAGI, and temporary Apache/mod_perl render paths. * Simplified wdrender test-file routing for PSGI and PAGI helper modes by passing an explicit filename override instead of depending on request path rewriting. 3.009 2026-08-06 * Added style_prepend/style_append and script_prepend/script_append pseudo attributes for , allowing pages to add resources around configured WEBDYNE_START_HTML_PARAM defaults without replacing them. * Clarified default-attribute override behaviour: page attributes replace matching WEBDYNE_START_HTML_PARAM values, while the new prepend/append variants preserve and extend configured style/script resources. * Documented resource ordering for linked styles versus include_style content, and external scripts versus include_script content. * Made PSGI and PAGI wrapper configuration loading consistent by loading DOCUMENT_ROOT/.webdyne.conf.pl when the app is built, including when webdyne.psgi or webdyne.pagi is loaded by an external server. * Clarified root .webdyne.conf.pl loading versus per-request directory .webdyne.conf.pl handling, where only WEBDYNE_DIR_CONFIG is read from PSP-directory config files. * Added regression coverage for style/script extension attributes and PSGI/PAGI external-loader root configuration loading. 3.008 2026-08-04 * Added REST-style route discovery and PATH_INFO mapping to WebDyne::PAGI, bringing PAGI API support in line with PSGI. * Added per-application API filename caches for PSGI and PAGI. API filename or route-structure changes may require a server restart. * Ensured PAGI emits a valid empty HTTP response when an API document produces no body, avoiding PAGI lint errors. * Clarified that Apache mod_perl does not provide automatic extensionless API route discovery without additional Apache rewrite or routing rules. * Added integration coverage for PSGI and PAGI API routing, caching, normal PSP requests, and 404 handling. * Fixed labelled rendering so label-wrapped text inputs retain the correct HTML input type. * Added default/defaults handling for grouped form controls and popup menus, aligning generated form state with the documented attributes. * Added labelled textfield render fixtures and included them in the distribution manifest. * Updated the XML and generated Markdown documentation for the latest API, form-control, and demo example behaviour. 3.005 2026-08-02 Major Version 3 release. * Added PAGI runtime support through WebDyne::PAGI and the webdyne.pagi wrapper, including HTTP, server-sent event, WebSocket, and lifespan request handling. * Added a common request abstraction for standalone, Apache/mod_perl, PSGI, and PAGI execution environments. * Refactored PSGI support into WebDyne::PSGI and expanded runtime handling for document roots, default documents, directory indexes, static files, and API routes. * Added webdyne.apache for temporary local Apache/mod_perl execution without requiring a permanent system Apache configuration. * Expanded wdapacheinit to support broader Apache installations, APXS discovery, installation and uninstall workflows, dry-run operation, and platform-specific configuration layouts. * Expanded wdrender to exercise multiple request backends, including fake, PSGI, PAGI, and mod_perl, with support for request methods, headers, parameters, response inspection, and comparison testing. * Added test-file modes to command-line compilation and rendering utilities. * Added a bundled default stylesheet for generated WebDyne pages and improved the appearance of default directory index output. * Added Docker runtime selection between PSGI and PAGI, with environment-variable tuning for server workers, timeouts, backlog, connection limits, and request body sizes. * Improved request and static-file safety, including path traversal, upload, multipart, error handling, and binary response coverage. * Reworked the documentation into a DocBook/MkDocs build with generated utility and module reference pages. * Added extensive examples and expanded automated test coverage for runtime backends, wrappers, static handling, APIs, SSE, WebSockets, and command-line utilities. * Removed the old WebDyne::CGI::PSGI adapter in favour of the new request and runtime abstraction. 2.021 2025-11-07 * Added multi-line attributes for scripts, styles, and related inclusions. * Prevented WebDyne substitution inside executable JavaScript blocks. * Added default viewport metadata and expanded head inclusion support, including array-valued includes. * Added Alpine/Vue attribute compatibility handling. 2.018 2025-10-29 * Added the tag for request-aware HTML fragment rendering. * Made directory indexes and static files available by default through the PSGI wrapper. * Improved HTML tree handling, constant importing, and error reporting. 2.017 2025-10-27 * Added the tag for lightweight JSON API responses using Router::Simple path matching. 2.015 2025-10-22 * Added the wdlint utility for checking Perl syntax in __PERL__ sections of PSP files. * Added the default PSGI directory index page and --index support. 2.014 2025-10-18 * Replaced the CGI.pm-based HTML generation path with CGI::Simple and WebDyne::HTML::Tiny. * Refactored compilation and evaluation handling around the new HTML generation backend. * Added the JSON tag, alternate div-based WebDyne syntax, application/perl script blocks, and expanded HTML5 tag handling. * Added PSGI/Plack support to the main WebDyne distribution, including command-line document-root and default-document selection. * Added exported WebDyne::html() and WebDyne::html_sr() functions for standalone PSP rendering. * Added WebDyne::Template to the core distribution and added PSGI static-file serving through --static. * Added WEBDYNE_HEAD_INSERT for injecting common content into generated document heads. * Added Docker build files and container-oriented development support, including automatic dependency installation from a mounted cpanfile.