HTTP demos

A tour of the web-app patterns you can build with the `contrib/http` stack. Each demo is one examples/http_*.mere file plus a small static HTML frontend.

All demos share the same build recipe:

./_build/default/bin/mere.exe -w examples/<name>.mere > /tmp/<name>.wat
wat2wasm --enable-tail-call /tmp/<name>.wat -o /tmp/<name>.wasm
node scripts/run_http_server.js /tmp/<name>.wasm
# open http://localhost:8080/ in a browser

The Node runner (scripts/run_http_server.js) provides the extern imports (fs, crypto, http, curl). Every demo listens on port 8080, so run one at a time. The outbound-only http_client_auth demo has no server component; it also runs cleanly under the plain scripts/run_wasm.js runner (they share the same http_fetch env).

The router API

The routing table is a declarative route_entry list fed to router routes not_found. Three entry constructors:

route         "GET"  "/"            home_h                 // exact
route_pattern "GET"  "/post/:slug"  post_h                 // :captures
route_prefix  "/admin"              admin_subtable         // mount subtree

• `route` — exact-path entry. Handler is str -> str (raw req → body).
• `route_pattern` — segments starting with : capture one URL

segment each. Handler is str list -> str -> str (captures in source order, then req). Arity must match: /post/:slug matches /post/hello but not /post/hello/extra.

• `route_prefix` — nests a whole route_entry list under a URL

prefix. Inner entries are declared relative to the mount point ("/" = mount root, "/login" = /login). If the inner table has no match, dispatch falls through to the next outer entry.

Query strings are stripped before matching (/search?q=hi matches /search), and the raw request line is still passed to handlers that need to peek at headers or the query.

Full API + rationale in `contrib/http/router.mere`. The `http_router_demo` example exercises all three variants (including two-capture /user/:name/pet/:pet).

The catalog

todo_app

Signup / login / logout with sha256-hashed passwords. Per-user persistent todos stored in a log-structured KV. Cookie session, brute-force throttle on the login endpoint (contrib/http/ratelimit). The whole contrib/http stack layered in one file: access_log → security_headers → cors → static → router.

• POST /api/signup — {user, pass}
• POST /api/login — sets session= cookie
• GET /api/todos, POST /api/todos, POST /api/todos/toggle, POST /api/todos/delete

Source: examples/http_todo_app.mere

feed_reader

The only demo that actively uses contrib/http/client.mere's outbound http_fetch. Users subscribe to feed URLs; a refresh call fetches each with curl (spawnSync), parses via contrib/xml + contrib/feed, and caches entries per user.

• POST /api/feeds {url}, POST /api/feeds/refresh
• GET /api/entries — cached entries across all subscriptions

Verified against real feeds: news.ycombinator.com/rss, blog.rust-lang.org/feed.xml. 40+ entries survive server restart.

Source: examples/http_feed_reader.mere

webhook_receiver

GitHub-style signed webhook ingress. POST /webhooks/github reads the X-Hub-Signature-256 header and verifies HMAC-SHA256 over the raw body. Passing events go to an audit log and optionally forward to a configured Slack URL.

• POST /webhooks/github — signed events
• GET /audit — recent deliveries
• POST /config/forward — set outbound target

Verified: unsigned / wrong-sig → 401, valid push/pull_request/issues events → 200 + forwarded downstream.

Source: examples/http_webhook_receiver.mere

ci_dashboard

Same ingress pattern as webhook_receiver but focused on GitHub workflow_run events. Extracts nested JSON fields (via a small scan-based finder) and maintains a per-(repo, branch, workflow) status board.

• POST /webhooks/github — signed workflow_run
• GET /api/jobs, GET / — auto-refresh HTML dashboard

Source: examples/http_ci_dashboard.mere

link_shortener

First demo with a dynamic route: GET / is not in the fixed route table; the not_found fallback validates the code as [A-Za-z0-9_-]+, looks it up in KV, and returns a 302 redirect while incrementing a per-code hit counter.