Crate forma_server 

Typed server rendering and explicit browser shells for Forma.

Load the build’s validated manifest and modules, bind every SSR route to its derived handler, then call Pages::finalize before opening the listener. PageHandle::render returns a PageResponse or a coded RenderError; it never substitutes a browser shell for a failure.

use forma_ir::PageProps;
use forma_server::{assets, load_ir_modules, PageHandle, RenderCtx};
#[derive(PageProps)]
struct HomeProps { title: String }
fn start<A: rust_embed::Embed + 'static>() -> Result<PageHandle<HomeProps>, String> {
    let manifest = assets::load_manifest::<A>()?;
    let pages = load_ir_modules::<A>(&manifest).map_err(|e| format!("{e:?}"))?;
    let home = pages.bind("home").map_err(|e| format!("{e:?}"))?;
    pages.finalize().map_err(|e| format!("{e:?}"))?;
    Ok(home) // the application may now open its listener
}
fn home(page: &PageHandle<HomeProps>) -> Result<forma_server::PageResponse, forma_server::RenderError> {
    page.render(&HomeProps { title:"Hello".into() }, &RenderCtx::new())
}

The response keeps HTML, its fresh nonce, enforced CSP and no-store headers together. Per-request RenderCtx carries typed policy/head/preload settings, escaped JSON, branding CSS and an explicit RawHtml prefix, never a nonce or executable handler script. render_browser_shell accepts only a route explicitly declared Browser. Unreviewed content belongs in frame.

In debug builds a corrupt edit keeps the previous module/asset snapshot; changed schemas are rebound, while changed route names or modes require a restart and fresh finalization. Release builds use their embedded snapshot. The old raw SSR entry, tuple loader, PageOutput and caller nonce API are gone.

Re-exports

pub use csp::build_csp_header;

pub use csp::generate_csp_nonce;

pub use csp::CspNonce;

pub use csp::InvalidNonce;

pub use csp::NonceError;

pub use csp::PolicyError;

pub use csp::PolicyExtensions;

pub use frame::FrameError;

pub use frame::PreviewFrame;

pub use frame::FRAME_RUNTIME_ASSET;

pub use head::HeadLink;

pub use head::HeadLinkError;

pub use head::ModulePreloads;

pub use ir::load_ir_modules;

pub use ir::IrLoadError;

pub use pages::PageHandle;

pub use pages::Pages;

pub use raw::RawHtml;

pub use render::render_browser_shell;

pub use render::RenderCtx;

pub use render::RenderError;

pub use response::PageParts;

pub use response::PageResponse;

pub use response::RenderCounts;

pub use types::*;

Modules

assets

Serving content-hashed files out of the embedded dist directory.

csp

Content-Security-Policy construction and nonce generation. CSP nonce generation and policy construction: the enforced policy, its typed extensions, and enforced Trusted Types with a named route relaxation.

frame

The preview frame: a document with an opaque origin, for content nobody reviewed.

head

Typed homes for the page’s head: manifest preloads and head links. Typed homes for what applications put in body_prefix that is not their own markup: the route’s modulepreload links, read from the build’s manifest and nonced here, and the page’s head links.

ir

Loading and version-checking the per-route .ir modules at startup.

pages

Bound page contracts and checked handler rendering. Startup binding between declared TypeScript page props and a derived Rust handler.

raw

Raw HTML: the one named type for markup written unescaped. The named raw HTML boundary. A RawHtml is reviewed application markup, not sanitized data. Each constructor belongs on the application’s SR8 allowlist with an owner. PageConfig::body_prefix accepts this type directly.

render

Request context, errors and the explicit browser shell. Checked document rendering and per-request metadata. Server rendering is entered only through a finalized bound page handle.

response

The page response: HTML that never leaves without its policy. The page response: HTML that never leaves without its policy.

sw

The service worker: opt-in, per application, and retired everywhere else.

template

The HTML page template and the SSR render entry points.

types

Document metadata, manifest and declared route modes.

Structs

Bytes

Re-exported because it appears in assets::asset_bytes’s signature. A cheaply cloneable and sliceable chunk of contiguous memory.

Limits

Limits inherited by a bound page, with optional per-request overrides. Resource budgets for a single walk.

PropsError

A bind or checked-value refusal. Diagnostics identify the route, declared path and both declarations whenever both sides have a field at that path.

PropsSource

A source declaration on either side of a binding diagnostic.

PropsWarning

An extra Rust field is visible at bind as a warning, and never encoded.

WalkLimits

Re-exported: RenderCtx::with_limits takes it. Resource budgets for a single walk.

Enums

IrError

Parser errors and their authoritative code() method. Errors that can occur when parsing FMIR binary data.

Traits

PageProps

Derive and trait for declared handler props. A named struct or unit enum declared with #[derive(PageProps)]. The trait and derive share their public name in Rust’s separate namespaces.

Derive Macros

PageProps

Derive and trait for declared handler props. Derive a named props struct or unit enum. Derive a named props struct or unit enum from the supported closed type set.