Approved architecture for the JavaScript runtime layer:
- CoreDeno (Deno sidecar) as module loader, I/O fortress, and dev toolchain
- go-html as Web Component factory (manifest → custom elements)
- .core/view.yml convention for declarative app definitions
- Signed application loading with ed25519 verification
- gRPC/Unix socket bridge between Deno and Go
- Gradual Angular migration to vanilla Web Components
- HLCRF slot composition with Shadow DOM isolation
Open sections (polyfills, object store, config generators, marketplace)
pending dAppServer heritage code review.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Escape variant name in Responsive.Render HTML attribute (XSS fix)
- Rewrite StripTags to single-pass O(n) space collapsing
- Document Raw() security contract in WASM entry point
- Add TestAttr_NonElement coverage
- Fix Makefile WASM target to rebuild on source changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The 2.8MB raw binary exceeds the original 2MB target, but Go WASM has
a ~2MB runtime floor that cannot be reduced without tinygo. The gzip'd
transfer size is 823KB — well under 1MB.
Update the Makefile size check to measure both raw and gzip'd sizes:
- Gzip transfer limit: 1MB (hard fail — what users download)
- Raw binary limit: 3MB (warning — accounts for Go runtime floor)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sort attribute keys for deterministic HTML output (I-1).
Clone nested layouts before mutating path in Render (I-3),
preventing data races when the same tree is rendered concurrently.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements If, Unless, Entitled, Switch, and Each (generic) control flow
nodes. Entitled uses deny-by-default when no entitlement function is set,
rendering absent content rather than hidden content. Each uses Go generics
for type-safe iteration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduces textNode that renders through go-i18n's T() function with
automatic HTML escaping for safe-by-default output. Adds escapeHTML
utility, NewContextWithService for explicit service binding, and
Entitlements field on Context for upcoming conditional rendering.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduces the go-html module with a Node rendering interface, Raw and El
constructors, void element handling, and attribute escaping. Includes a
minimal Context stub and tests for all node types.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
