SoftN v0.0.26

SoftN v0.0.26

What's new

• Upgrading from v0.0.25: the engine is still ZIPP v0.0.29, so a FormLogic that installs this release keeps the server sandbox it built for v0.0.25, and nothing a browser loads changes. On the server two fixes below change what an app's backend may notice: a request whose transaction SQLite ends under it (INSERT OR ROLLBACK) writes nothing more, on every host, and the PHP host's softn.time.parseZoned reads a fixed offset past 14 hours. FormLogic's native-app tests pass on this release's runtime under Node and under softn-runner. New is softn-runner (the next entry), which the FormLogic runtime archive now carries in native-runtime/bin/ for Linux and Windows x86-64 (about 53 MB for the two) with its licences. A FormLogic from commit c3854f0d on starts it for native apps and needs no Node on the server for them (FORMLOGIC_NATIVE_RUNNER=node keeps Node); an older one, v0.1.12 among them, installs the archive as before, does not look in bin/, and runs runner.mjs under Node.
• An app's private server logic can run without Node. apps/softn-runner is one program that takes the request the PHP host's runtime/runner.mjs takes (the same stdin, environment and deadline) and gives the same answer and the same line in the operator's log, byte for byte on every case compared but one: softn.time.format of a time more than 262,000 years either side of year 0, which the README explains. The app's logic runs on ZIPP v0.0.29's safe-sandbox engine built for WebAssembly, behind the same preamble, inside a wasmtime instance that has the clock and randomness and nothing else: no file, no network, no environment, and one host call, db.query, whose every answer the runner decides. The rest is native, each part a port of the Node runner's file of the same job (the bundle and configuration checks, migrations, the rate limit, SQLite opened and guarded as node:sqlite is, softn.sql, softn.crypto, record events), and softn.time is the Rust host's own. A request is answered in about a fifth of the Node runner's time (about 40 ms where it takes 160 to 200, on Linux and on Windows), by one file of about 27 MB, static for Linux x86-64 and for Windows x86-64, where Node is 93 to 127 MB; its third-party licences go with it (SOFTN-RUNNER-THIRD-PARTY-LICENSES.txt, written from Cargo's record of what it compiles in). The Node runner's own suite runs on it in CI (SOFTN_TEST_RUNNER). It also stops what it can stop itself a quarter of a second before the deadline, the app's logic and any SQL statement of the request, so such a request is rolled back and answered where the Node runner's process was killed, and SQLite keeps its temporary data in memory, at most 1 GiB; apps/softn-runner/README.md lists what else differs. The FormLogic runtime archive carries both builds as native-runtime/bin/softn-runner-<platform>, recorded in native-runtime/provenance.json, so a FormLogic that knows to start it runs native apps with no Node on the server; one that does not runs runner.mjs under Node as before.
• A request whose transaction SQLite ends under it writes nothing more. An INSERT OR ROLLBACK that meets a conflict, or a column declared ON CONFLICT ROLLBACK, rolls the whole transaction back, and SQLite carries on in autocommit: on the PHP host and on the Rust host each statement the handler made after it was committed by itself, whatever the request answered. A handler that caught the failure and went on writing kept those writes although the request answered host_error, and one that asked for the rollback answered host_error too. Now no host call runs once the transaction has ended (the script is told Transaction rolled back), the request answers host_error, and a handler that asked for the rollback keeps its own answer. softn-runner does the same, where a write the soft deadline interrupted ends the transaction too. route-declarations.test.mjs holds both runners to it, and the Rust host has a test of its own.
• softn.time.parseZoned on the PHP host reads a fixed offset past 14 hours (+15:00, out to ±23:59, as format already did) as the Rust host does; it said the time did not exist during daylight saving. A zone's offsets today are all within 14 hours, so for any other zone it searches as before, and only when nothing within 14 hours matches does it look further.
• Dependencies: XDB's lock takes rustls 0.23.45 (GHSA-2mjx-qc3c-rqvc, moderate: TLS 1.3 handshake messages accepted across encryption levels), a crate no XDB build compiles but its lock named; softn-runner is built on wasmtime 45.0.3, past GHSA-4ch3-9j33-3pmj (moderate: WASI hard links past a directory's permissions), which a runner whose guest has no directory could not meet; its own toolchain is Rust 1.99.0, the guest's still ZIPP's 1.92.0. Every crate of every Cargo.lock in the repository was checked against GitHub's advisory database, and npm's audit finds nothing.

Downloads

Download	What it is	Pick it when
softn-website-v0.0.26-zipp-v0.0.29.zip	The complete softn.com website. The whole softn.com in one folder: the landing page, the app directory, the web runtime, Builder, Studio, the documentation and the directory API.	You want to run your own SoftN site: a directory people can publish apps to and play them from.
softn-app-static-v0.0.26.zip	One app on a page (static). The smallest way to host one SoftN app: a plain page with a loading spinner, a permission bar and your app, with no SoftN branding and no server code.	You have a .softn app and a web host, and you want the app on a page of your own site.
softn-app-static-with-backend-linux-x64-v0.0.26.zip	One app on a page, with an optional PHP server backend. The static single-app page above, plus a backend/ folder that lets the app run its own private server logic and SQLite database on an Apache/PHP host, with no service to keep running.	Your app has a private server part (server/ logic, SQL migrations, routes) and your host is Apache with PHP on Linux x86-64.
softn-app-private-v0.0.26.zip	One app served privately by PHP. The single-app page again, but PHP renders it and hands the app's files to the browser piece by piece behind a viewer cookie, so the .softn file itself is never at a URL.	You do not want visitors (or crawlers) to be able to download your app as one file.
softn-app-private-with-backend-linux-x64-v0.0.26.zip	One app served privately by PHP, with an optional server backend. The privately served page above together with the PHP server backend: three folders, webroot/, private/ and backend/. The app works at once without the backend; you enable the backend when the app needs it.	You want the .softn file kept off every URL and the app has a private server part.
softn-formlogic-runtime-v0.0.26.zip	The SoftN runtime for FormLogic. Everything FormLogic embeds from SoftN, already built: the sandboxed frame FormLogic runs an app in, Builder and Studio as editors inside FormLogic, the server-side runtime for native apps, and the starter adapter. FormLogic’s build downloads this from the latest SoftN release instead of building SoftN from source.	You run FormLogic and its build cannot reach GitHub; download this and point SOFTN_RELEASE_ARCHIVE at it.

Each archive unzips with a README.md at the top that explains it; RELEASE-GUIDE.md below compares them all.

The backend download targets Linux x86-64 with Apache/PHP and process execution enabled. It is a generic, unconfigured distribution: install your own public and private app bundles and preserve existing configuration, keys and databases when upgrading. Native XDB synchronization remains a Rust-host feature.

The complete website archive's name carries the tag of the zipp engine inside it. It ships no
example apps: the directory starts empty, and .softn files dropped on any
page of the site publish into it — one, or a folder at once, with the admin
key from data/config.json lifting the hourly limit for the site owner. The
example apps are published as .softn downloads with every
softn-Examples release.
The desktop loader and builder are not attached to releases; they build from
this tag's manifests with npm run tauri build in their apps. RELEASE-GUIDE.md
below compares every download and says which one to take.

The single-app archive includes a small counter example; replace it with your own bundle. It has no app download controls, but browser-delivered app bytes remain extractable. Required license notices are included in all archives.

Built with ZIPP v0.0.29 (its javascript-python-base engine, javascript engine and torch package; the release SHA256SUMS has sha256 d92c1d763caf703143a52291fee3723f2d486745640adc2db3aa3812f521f4a7).