Struct CspConfig 

pub struct CspConfig {
    pub connect_domains: DirectivePolicy,
    pub resource_domains: DirectivePolicy,
    pub frame_domains: DirectivePolicy,
    pub widgets: Vec<WidgetScoped>,
    pub domain: Option<String>,
}

Complete CSP configuration: three global directives plus widget overrides.

Fields

connect_domains: DirectivePolicy

resource_domains: DirectivePolicy

frame_domains: DirectivePolicy

widgets: Vec<WidgetScoped>

domain: Option<String>

Bare public host (no scheme) declared by the operator — feeds the openai/widgetDomain meta field and the proxy-URL injection into widget CSP. _meta.ui.domain is intentionally left untouched: Claude derives that value from the proxy URL itself and rejects any value supplied by an MCP layer. When None, the runtime falls back to the tunnel URL, and when no public origin is available at all (local-only dev) the injection is suppressed rather than polluting widget config with localhost.

Trait Implementations

impl Clone for CspConfig

fn clone(&self) -> CspConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CspConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CspConfig

fn default() -> Self

Defaults to permissive extend for connect and resource, and strict replace for frame. Frames default strict because nested iframes are rare in MCP widgets and the blast radius of an accidental allow is high.