Documentation
¶
Overview ¶
Package htmlx assembles complete, self-contained MCP Apps HTML documents: inline stylesheet, widget shell markup, JSON data islands, and the inline runtime bundle. The output satisfies the spec's default locked-down CSP (default-src 'none' with inline script/style allowances) — it references nothing external.
Index ¶
Constants ¶
const ( // ConfigIslandID holds the widget's static spec (columns, fields, // action bindings). ConfigIslandID = "gomu-config" // DataIslandID optionally holds a baked structuredContent snapshot for // instant first paint before any tool-result notification arrives. DataIslandID = "gomu-data" )
Island element IDs the TypeScript runtime looks up on boot.
Variables ¶
This section is empty.
Functions ¶
func Data ¶
Data returns a data-gomu-* attribute, the hook the runtime's event delegation dispatches on.
func JSONIsland ¶
JSONIsland renders v as a <script type="application/json" id=...> data island. encoding/json's default HTML-safe encoding escapes '<', '>', '&' (to < etc.) and U+2028/U+2029, which prevents </script> breakout and JS line-terminator issues by construction.
func RawCSS ¶
RawCSS wraps trusted CSS (the built stylesheet, a validated theme block) in a <style> element. It refuses content that could close the element or open an HTML comment, as a backstop against injection through upstream bugs — legitimate stylesheet content never contains these sequences.
func RawJS ¶
RawJS wraps the trusted runtime bundle in a <script> element, with the same backstop rules as RawCSS.
func RawSVG ¶
RawSVG wraps a trusted inline SVG logo as markup. The caller supplies it at registration time (it is author input, the same trust level as RawCSS and RawJS), so this is a backstop, not a sanitizer: it requires a single <svg> root and refuses script-bearing or resource-loading constructs.
Types ¶
type DocConfig ¶
type DocConfig struct {
Title string
Lang string // defaults to "en"
CSS string // base stylesheet (assets.StylesCSS)
ThemeCSS string // optional theme override block, emitted after CSS
// Body is the SSR'd widget shell, rooted at an element carrying
// class="gomu-root" and data-gomu-widget="<kind>".
Body g.Node
// Config is serialized into the #gomu-config island (required by the
// runtime to mount a behavior).
Config any
// Data, when non-nil, is serialized into the optional #gomu-data
// island as a baked structuredContent snapshot.
Data any
RuntimeJS string // runtime bundle (assets.RuntimeJS)
}
DocConfig describes one widget document.
Source Files