- Build and validate a JSON API response
- Encode an HTTP request: Basic auth, query string, safe HTML
- Parse an access log line into a JSON event
- Pagination with a Link header and an ETag
- Parse a Cookie header and a form body
- Resolve npm semver ranges
- WCAG contrast ratio of a button color
- srcset widths of a responsive image
- Token bucket rate limiter with Retry-After
- Decode and build a Snowflake id
Build and validate a JSON API response
An endpoint returns a list of products received from a form. The script builds the JSON response in memory, adds a generated UUID, and flags each item whose id is not a UUID or whose link is not a valid URL.
#1. Start the API response; json load "rx_api" "{\"status\": 200, \"data\": []}"; #2. Add two items received from a form; json iarray "rx_api" "/data" (concat "{\"id\": \"" (string uuid) "\", \"sku\": \"BLT-M8\", \"url\": \"https://shop.example.com/p/blt-m8\"}") OBJ; json iarray "rx_api" "/data" "{\"id\": \"42\", \"sku\": \"NUT-M8\", \"url\": \"shop/p/nut-m8\"}" OBJ; #3. Flag each item: a valid UUID and a valid URL; json iobject "rx_api" "/data[0]" "valid" (* (type is_uuid (json select "rx_api" "/data[0]/id")) (type is_url (json select "rx_api" "/data[0]/url"))) INT; json iobject "rx_api" "/data[1]" "valid" (* (type is_uuid (json select "rx_api" "/data[1]/id")) (type is_url (json select "rx_api" "/data[1]/url"))) INT; json iobject "rx_api" "/" "count" (json count "rx_api" "/data") INT; json doc "rx_api";
{
"data": [
{
"valid": 1,
"id": "9b03cbe3-50d0-41f8-9848-0f58edee91f7",
"sku": "BLT-M8",
"url": "https://shop.example.com/p/blt-m8"
},
{
"valid": 0,
"id": "42",
"sku": "NUT-M8",
"url": "shop/p/nut-m8"
}
],
"count": 2,
"status": 200
}- Loop on any number of items with
json parse_arrayinstead of the fixed indexes - Sort the items before returning them with
json sort
Encode an HTTP request: Basic auth, query string, safe HTML
A client calls a search API with Basic authentication and a query containing accents and an ampersand, then shows a user comment in a page. The script encodes the header in Base64, the query for the URL, and escapes the comment for HTML.
#1. Credentials and the query of the search; -> "[auth]" (concat "Basic " (string encode_b64 "api_user:s3cret!")); -> "[q]" (string url_encode "café & croissant"); #2. URL of the request; -> "[url]" (concat "https://api.example.com/v1/search?q=" [q] "&lang=fr"); #3. A user comment shown safely in HTML; -> "[html]" (concat "<p>" (string html_escape "<script>alert(\"x\")</script> 5 > 3") "</p>"); concat "Authorization: " [auth] [_n_] "GET " [url] [_n_] "Valid URL: " (type is_url [url]) [_n_] "Decoded: " (string url_decode [q]) [_n_] [html];
Authorization: Basic YXBpX3VzZXI6czNjcmV0IQ== GET https://api.example.com/v1/search?q=caf%C3%A9%20%26%20croissant&lang=fr Valid URL: 1 Decoded: café & croissant <p><script>alert("x")</script> 5 > 3</p>
- Embed a string in a JSON body safely with
string json_escape - Decode a Basic header received by your API with
string decode_b64
Parse an access log line into a JSON event
An HTTP access log line must become a structured event for monitoring. The script extracts the client IP, the method, the path without its query string, the order id and the status code with regular expressions, then flags the errors.
#1. One line of the access log; -> "[log]" "203.0.113.42 - - [01/Nov/2026:10:15:32 +0400] \"GET /api/v1/orders/1842?expand=lines HTTP/1.1\" 404 512 0.087"; #2. Extract the fields with regular expressions; -> "[ip]" (string regexp_extract [log] "^([0-9.]+)" 1); -> "[path]" (string regexp_extract [log] "\"[A-Z]+ ([^ ?]+)" 1); -> "[status]" (string regexp_extract [log] "\" ([0-9]{3}) " 1); -> "[order]" (string regexp_extract [path] "/orders/([0-9]+)" 1); #3. Build a JSON event; concat "{\"ip\": \"" [ip] "\", \"ipv4\": " (type is_ipv4 [ip]) ", \"method\": \"" (string regexp_extract [log] "\"([A-Z]+) " 1) "\", \"path\": \"" [path] "\", \"order_id\": " [order] ", \"status\": " [status] ", \"error\": " (>= [status] 400) "}";
{"ip": "203.0.113.42", "ipv4": 1, "method": "GET", "path": "/api/v1/orders/1842", "order_id": 1842, "status": 404, "error": 1}- Mask the IP for GDPR with
string regexp_replaceon the last octet - Count the 5xx in a block of lines with
string regexp_count
Pagination with a Link header and an ETag
A REST endpoint returns page 3 of a product search. The script computes the number of pages and the item range, builds the RFC 8288 Link header with the search text URL-encoded, a weak ETag of the body and the status of a conditional GET with If-None-Match.
#1. GET /api/products?q=café crème&page=3&per_page=20 on a catalogue of 137 matching products; -> "[base]" "https://shop.example.com/api/products"; -> "[q]" "café crème"; -> "[page]" 3; -> "[per]" 20; -> "[total]" 137; -> "[last]" (math ceil (/ [total] [per])); -> "[from]" (+ (* (- [page] 1) [per]) 1); -> "[to]" (math min (* [page] [per]) [total]); #2. Link header of RFC 8288, the search text URL-encoded; -> "[qs]" (concat "?q=" (string url_encode [q]) "&per_page=" [per] "&page="); -> "[link]" (concat "<" [base] [qs] 1 ">; rel=\"first\", <" [base] [qs] (- [page] 1) ">; rel=\"prev\", <" [base] [qs] (+ [page] 1) ">; rel=\"next\", <" [base] [qs] [last] ">; rel=\"last\""); #3. Body meta and a weak ETag on it for conditional GET; -> "[meta]" (concat "{\"page\": " [page] ", \"per_page\": " [per] ", \"total\": " [total] ", \"pages\": " [last] ", \"items\": \"" [from] "-" [to] "\"}"); -> "[etag]" (concat "W/\"" (string left (string md5 [meta]) 16) "\""); -> "[if_none_match]" [etag]; concat "Link: " [link] " | next url valid: " (type is_url (concat [base] [qs] (+ [page] 1))) " | " [meta] " | ETag: " [etag] " | status on revalidation: " (if (equal [if_none_match] [etag]) {304;} {200;})
Link: <https://shop.example.com/api/products?q=caf%C3%A9%20cr%C3%A8me&per_page=20&page=1>; rel="first", <https://shop.example.com/api/products?q=caf%C3%A9%20cr%C3%A8me&per_page=20&page=2>; rel="prev", <https://shop.example.com/api/products?q=caf%C3%A9%20cr%C3%A8me&per_page=20&page=4>; rel="next", <https://shop.example.com/api/products?q=caf%C3%A9%20cr%C3%A8me&per_page=20&page=7>; rel="last" | next url valid: 1 | {"page": 3, "per_page": 20, "total": 137, "pages": 7, "items": "41-60"} | ETag: W/"d112c25aa1ed2899" | status on revalidation: 304- Omit the prev link on page 1 and the next link on the last page
- Return 304 without a body when If-None-Match equals the ETag: the browser keeps its copy
Parse a Cookie header and a form body
A back end receives a raw Cookie header and an application/x-www-form-urlencoded body. The script splits the cookies and the fields, URL-decodes the values (plus means space in a form), reads the cart cookie as JSON, checks the email and escapes the message before showing it in HTML.
#1. Raw Cookie header and form body of a POST /contact received by the back end; -> "[cookie]" "sid=7f3a9c2e41; lang=fr-RE; cart=%5B%22A-100%22%2C%22B-310%22%5D; consent=analytics%3D0"; -> "[body]" "name=Ana%C3%AFs+Hoarau&email=anais.hoarau%40example.re&msg=Bonjour+%3Cb%3Eurgent%3C%2Fb%3E+%26+merci"; json load "rx_req" "{\"cookies\": {}, \"form\": {}}"; #2. Cookies: split on the semicolons, then on the first equal sign, values URL-decoded; json load "rx_c" (string split [cookie] "; *" -1); json parse_array "rx_c" "/" "[kv]" { json iobject "rx_req" "/cookies" (atom get [kv] 1 "=") (string url_decode (string mid [kv] (+ (string locate [kv] "=") 1))) STR; }; #3. Form fields: + means space in a form body, then URL-decode and escape for the HTML reply; json load "rx_f" (string split [body] "&" -1); json parse_array "rx_f" "/" "[kv]" { json iobject "rx_req" "/form" (atom get [kv] 1 "=") (string url_decode (string replace (atom get [kv] 2 "=") "+" " ")) STR; }; json load "rx_cart" (json select "rx_req" "/cookies/cart"); -> "[safe]" (string html_escape (json select "rx_req" "/form/msg")); -> "[out]" (concat (string regexp_replace (json doc "rx_req") "\n *" "") " | email ok: " (type is_email (json select "rx_req" "/form/email")) " | cart items: " (json count "rx_cart" "/") " | html: " [safe] " | back: " (string html_unescape [safe])); json unload "rx_req"; json unload "rx_c"; json unload "rx_f"; json unload "rx_cart"; [out]
{"form": {"msg": "Bonjour \u003cb\u003eurgent\u003c/b\u003e \u0026 merci","name": "Anaïs Hoarau","email": "anais.hoarau@example.re"},"cookies": {"lang": "fr-RE","consent": "analytics\u003d0","cart": "[\"A-100\",\"B-310\"]","sid": "7f3a9c2e41"}} | email ok: 1 | cart items: 2 | html: Bonjour <b>urgent</b> & merci | back: Bonjour <b>urgent</b> & mercijson docwrites < > & = as \u003c... escapes: the JSON stays valid and safe to embed in a page- Sign the cart cookie with
string hmac_sha256so a customer cannot change the prices
Resolve npm semver ranges
A build tool must pick the version of a dependency that matches ^1.4.0 and ~1.4.1 among the published versions. A text sort puts 1.10.0 before 1.9.3, so the script builds a numeric key from the three parts, sorts it, and resolves the caret range (same major) and the tilde range (same major.minor) to the highest match.
#1. Versions of a package published on the registry, the project requires ^1.4.0 and ~1.4.1; json load "rx_ver" "[\"1.4.10\", \"1.10.0\", \"1.4.2\", \"2.0.0\", \"1.3.9\", \"1.4.1\", \"1.9.3\"]"; json load "rx_key" "[]"; #2. Numeric sort key major x 1000000 + minor x 1000 + patch, 1.10.0 must come after 1.9.3; json parse_array "rx_ver" "/" "[v]" { json iarray "rx_key" "/" (math trunc (+ (+ (* (atom get [v] 1 ".") 1000000) (* (atom get [v] 2 ".") 1000)) (atom get [v] 3 "."))) INT; }; json load "rx_s" (math order_long (json doc "rx_key")); #3. Caret range: same major and at least 1.4.0, tilde range: same 1.4 and at least 1.4.1; -> "[sorted]" ""; -> "[caret]" ""; -> "[tilde]" ""; json parse_array "rx_s" "/" "[k]" { -> "[v]" (concat (math trunc (/ [k] 1000000)) "." (math trunc (/ (math mod [k] 1000000) 1000)) "." (math mod [k] 1000)); -> "[sorted]" (concat [sorted] [v] " "); if (and (== (atom get [v] 1 ".") 1) (>= [k] 1004000)) {-> "[caret]" [v];}; if (and (equal (atom before_includ [v] 2 ".") "1.4") (>= [k] 1004001)) {-> "[tilde]" [v];}; }; json unload "rx_ver"; json unload "rx_key"; json unload "rx_s"; concat "sorted: " (string trim [sorted]) " | ^1.4.0 resolves to " [caret] " | ~1.4.1 resolves to " [tilde]
sorted: 1.3.9 1.4.1 1.4.2 1.4.10 1.9.3 1.10.0 2.0.0 | ^1.4.0 resolves to 1.10.0 | ~1.4.1 resolves to 1.4.10
atom before_includ "1.4.10" 2 "."keeps the atoms up to the second one: 1.4- Pre-releases such as 2.0.0-beta.1 sort before 2.0.0: split on the dash first
WCAG contrast ratio of a button color
The front-end developer checks the brand blue against three possible backgrounds. The script converts each hex channel to a number, linearises the sRGB values, computes the relative luminance and the contrast ratio (L1 + 0.05) / (L2 + 0.05), and checks the AA levels 4.5 for normal text and 3 for large text.
#1. Brand text color and three candidate backgrounds of a button, CSS hex colors without the hash sign; -> "[fg]" "1F6FEB"; json load "rx_bg" "[\"FFFFFF\", \"0D1117\", \"E6EDF3\"]"; #2. Relative luminance of WCAG 2: each sRGB channel c/255 linearised, then 0.2126 R + 0.7152 G + 0.0722 B; -> "[w]" "[0.2126, 0.7152, 0.0722]"; json load "rx_w" [w]; -> "[col]" [fg]; -> "[L]" 0; for (-> "[i]" 0) (< [i] 3) (++ "[i]") { -> "[c]" (/ (string hex_to_int (string mid [col] (* [i] 2) (+ (* [i] 2) 2))) 255); -> "[lin]" (/ [c] 12.92); if (> [c] 0.04045) {-> "[lin]" (math power (/ (+ [c] 0.055) 1.055) 2.4);}; -> "[L]" (+ [L] (* (json select "rx_w" (concat "/[" [i] "]")) [lin])); }; -> "[Lfg]" [L]; -> "[out]" (concat "text " [fg] " L=" (math round [Lfg] 4) "; "); #3. Contrast ratio L1 + 0.05 / L2 + 0.05 with each background, AA needs 4.5 for normal text, 3 for large text; json parse_array "rx_bg" "/" "[col]" { -> "[L]" 0; for (-> "[i]" 0) (< [i] 3) (++ "[i]") { -> "[c]" (/ (string hex_to_int (string mid [col] (* [i] 2) (+ (* [i] 2) 2))) 255); -> "[lin]" (/ [c] 12.92); if (> [c] 0.04045) {-> "[lin]" (math power (/ (+ [c] 0.055) 1.055) 2.4);}; -> "[L]" (+ [L] (* (json select "rx_w" (concat "/[" [i] "]")) [lin])); }; -> "[cr]" (/ (+ (math max [L] [Lfg]) 0.05) (+ (math min [L] [Lfg]) 0.05)); -> "[out]" (concat [out] "on " [col] " " (math round [cr] 2) ":1 " (if (>= [cr] 4.5) {"AA";} {if (>= [cr] 3) {"AA large only";} {"fail";}}) "; "); }; json unload "rx_bg"; json unload "rx_w"; [out]
text 1F6FEB L=0.1766; on FFFFFF 4.63:1 AA; on 0D1117 4.08:1 AA large only; on E6EDF3 3.92:1 AA large only;
- The blue passes AA only on white: use a lighter blue on the dark theme
- AAA asks for 7:1, the same code checks it with another threshold
srcset widths of a responsive image
A hero image is displayed at 100vw on phones, 50vw on tablets and 720 px on desktop. For the device widths and pixel ratios of the audience, the script computes the image width each device needs, rounds it up to a 160 px step to limit the CDN variants, sorts and dedupes the widths and writes the srcset and sizes attributes.
#1. A hero image shown at 100vw on phones up to 767 px, 50vw on tablets, 720 px fixed from 1280 px, devices with DPR 1 to 3; json load "rx_dev" "[[360, 3], [390, 3], [414, 2], [768, 2], [1024, 2], [1280, 1], [1440, 2], [1920, 1]]"; json load "rx_need" "[]"; #2. Rendered CSS width x DPR, rounded up to a 160 px step so the CDN caches few variants; json parse_array "rx_dev" "/" "[d]" { json load "rx_d" [d]; -> "[vw]" (json select "rx_d" "/[0]"); -> "[css]" (if (< [vw] 768) {[vw];} {if (< [vw] 1280) {/ [vw] 2;} {720;}}); -> "[px]" (* (math ceil (/ (* [css] (json select "rx_d" "/[1]")) 160)) 160); json iarray "rx_need" "/" (math trunc [px]) INT; }; #3. Sorted widths without duplicates, then the srcset and sizes attributes of the img tag; json load "rx_w" (math order_int (json doc "rx_need")); -> "[srcset]" ""; -> "[prev]" 0; -> "[list]" ""; json parse_array "rx_w" "/" "[w]" { if (!= [w] [prev]) {-> "[srcset]" (concat [srcset] "hero-" [w] ".webp " [w] "w, "); -> "[list]" (concat [list] [w] " ");}; -> "[prev]" [w]; }; -> "[out]" (concat "widths needed " (string trim [list]) " | srcset=\"" (string regexp_replace [srcset] ", $" "") "\" sizes=\"(min-width: 1280px) 720px, (min-width: 768px) 50vw, 100vw\""); json unload "rx_dev"; json unload "rx_d"; json unload "rx_need"; json unload "rx_w"; [out]
widths needed 800 960 1120 1280 1440 | srcset="hero-800.webp 800w, hero-960.webp 960w, hero-1120.webp 1120w, hero-1280.webp 1280w, hero-1440.webp 1440w" sizes="(min-width: 1280px) 720px, (min-width: 768px) 50vw, 100vw"
- The browser chooses in srcset with sizes: the server never needs to know the device
- Generate the variants at the build with an image tool, one per width of the list
Token bucket rate limiter with Retry-After
An API limits each key to bursts of 5 requests and 0.5 request per second on average. The script replays the arrival times through a token bucket: refill since the last request (capped at the capacity), one token per request, else a 429 response with the Retry-After seconds, and the remaining tokens.
#1. Token bucket of an API key: capacity 5 requests, refill 0.5 token per second, arrival times in seconds; -> "[cap]" 5; -> "[rate]" 0.5; json load "rx_req" "[0.0, 0.2, 0.4, 0.5, 0.9, 1.1, 1.3, 3.0, 3.1, 7.6, 7.7, 7.8]"; -> "[tokens]" [cap]; -> "[last]" 0; -> "[log]" ""; -> "[ok]" 0; json parse_array "rx_req" "/" "[t]" { #2. Refill since the last request, never above the capacity; -> "[tokens]" (math min [cap] (+ [tokens] (* (- [t] [last]) [rate]))); -> "[last]" [t]; #3. One token per request, else 429 with Retry-After = seconds to get one token, rounded up; if (>= [tokens] 1) { -> "[tokens]" (- [tokens] 1); -> "[ok]" (+ [ok] 1); -> "[log]" (concat [log] [t] "s 200, "); } { -> "[log]" (concat [log] [t] "s 429 Retry-After " (math ceil (/ (- 1 [tokens]) [rate])) ", "); }; }; json unload "rx_req"; concat [log] "accepted " [ok] " of 12, X-RateLimit-Remaining " (math trunc [tokens])
0.0s 200, 0.2s 200, 0.4s 200, 0.5s 200, 0.9s 200, 1.1s 429 Retry-After 1, 1.3s 429 Retry-After 1, 3.0s 200, 3.1s 429 Retry-After 1, 7.6s 200, 7.7s 200, 7.8s 429 Retry-After 1, accepted 8 of 12, X-RateLimit-Remaining 0
- Store the tokens and the last time per key in a
jsonobject or a node to share them between requests - A sliding window counter is simpler but lets bursts of twice the limit pass at the window edges
Decode and build a Snowflake id
A support ticket gives a 64-bit Snowflake id. The script splits it exactly (19 digits do not fit a double): milliseconds since the epoch by an integer division by 2^22, worker id and sequence with bit masks, the creation date in UTC, and builds a new id with OR for another worker.
#1. A Snowflake id: 41 bits of milliseconds since the Twitter epoch 1288834974657, 10 bits of worker, 12 bits of sequence; -> "[id]" "1541815603606036480"; -> "[epoch]" 1288834974657; #2. Shifts are exact integer divisions by 2^22 and 2^12, masks keep the low bits; -> "[ms]" (bigdec round (bigdec div [id] 4194304 40) 0 DOWN); -> "[worker]" (math bit_and (bigdec round (bigdec div [id] 4096 40) 0 DOWN) 1023); -> "[seq]" (math bit_and [id] 4095); -> "[unix_ms]" (bd+ [ms] [epoch]); #3. Creation date in UTC, and a new id rebuilt with OR for worker 37, sequence 5 at the same millisecond; -> "[created]" (date to_utc (date from_epoch (bigdec round (bigdec div [unix_ms] 1000 40) 0 DOWN))); -> "[new]" (math bit_or (math bit_or (bd* [ms] 4194304) (* 37 4096)) 5); concat "ms since epoch " [ms] ", worker " [worker] ", sequence " [seq] ", created " [created] " UTC | new id " [new] " in hex " (string int_to_hex [new])
ms since epoch 367597485448, worker 378, sequence 0, created 2022-06-28 16:07:40 UTC | new id 1541815603604639749 in hex 1565a11f62025005
- Ids sort by creation time: a range of ids is a range of dates, without a date column
- Keep big ids as strings in JSON: JavaScript numbers lose the last digits above 2^53
