2026-09-08 - v0.5.0

Summary

Converted the practice application into a deployable static browser application and added a minimal, read-only Go server for secure Raspberry Pi Zero W hosting. The browser now performs linting, SQLite execution, table viewing, and database persistence locally; the server only distributes static assets.

changed

• Moved the deployable application into github-static/, separating it from the retained Flask development application.
• Replaced browser calls to Flask endpoints with local JavaScript modules for linting, SQL execution, table inspection, and syntax-reference rendering.
• Changed the static build to use relative asset paths so the generated site can be served from a custom domain root or a GitHub Pages project path.
• Removed the Google Fonts dependency and updated the static CSP so all production application assets are locally served.
• Changed database controls to select the safest workflow for the detected browser: Chromium-style File System Access browsers show Open, Save As, and Export, while other browsers show Import and Export.
• Reworked DatabaseManager connection access to use an RLock and per-operation cursors, preventing shared-cursor interference between concurrent Flask requests.

Added

• Added a local sql.js WebAssembly runtime and browser SQLite engine with quote-aware script splitting, transactions, rollback, table listing, safe table reads, byte export, and Cambridge CREATE DATABASE validated-only handling.
• Added a browser implementation of the Cambridge 9618 SQL linter and a static syntax-reference module.
• Added local-file persistence controls: new database, open, save as, export, and import. Chromium browsers can autosave to a user-selected file; other browsers retain explicit import/export support.
• Added persistence state reporting for in-memory, unsaved, saving, saved, imported, and failed-save states.
• Added Vitest coverage for browser linting, SQL execution, transactions, table access, executor behavior, persistence, and write-plus-SELECT autosave behavior.
• Added Playwright coverage for executing SQL without API requests, updating the table viewer, exporting a database, and rendering the syntax reference without an API request.
• Added a dependency-free Go server that embeds the built static site, serves only GET and HEAD, rejects all write methods with 405 Method Not Allowed, restricts paths to known static files, and applies response timeouts and header-size limits.
• Added CSP, MIME-sniffing, frame, referrer, permissions, COOP, and CORP security headers to the Go server.
• Added Cloudflare-oriented cache headers: cacheable HTML with shared-cache revalidation and one-year immutable caching for versioned assets.
• Added docs/PI_ZERO_DEPLOY.md with Pi Zero W ARMv6 cross-compilation, unprivileged runtime, reverse-proxy, Cloudflare Cache Rule, and verification instructions.
• Added Go server tests covering allowed methods, cache/security headers, traversal rejection, and unknown paths.

Fixed

• Fixed static WASM tests to load the checked-in runtime asset rather than assuming a package-local node_modules layout.
• Fixed browser autosave so a script that writes data and finishes with SELECT still persists the changed database.
• Fixed the Open Database workflow so the selected file handle remains connected and receives later live-save writes.
• Fixed writable file-save failure handling so an open writable stream is aborted when writing fails.