Struct RenderOptions 

pub struct RenderOptions<'a> {
    pub entry_id: &'a str,
    pub request_path: &'a str,
    pub nonce: Option<&'a str>,
    pub head_inject: Option<&'a str>,
    pub body_inject: Option<&'a str>,
}

Options controlling how the handler renders a protocol.

The handler performs server-side route matching: matched routes are rendered visible with content; non-matched routes are rendered hidden and empty.

Fields

entry_id: &'a str

The fragment ID to start rendering from (e.g., "index.html").

request_path: &'a str

The URL path to match routes against (e.g., "/contacts/42").

nonce: Option<&'a str>

Optional CSP nonce for inline <script> tags. When set, all inline scripts include nonce="VALUE" and a <meta name="webui-nonce"> tag is emitted for the client router.

head_inject: Option<&'a str>

Optional HTML to emit immediately before the document’s </head> close. Used for per-request <link rel="preload"> hints, CSP <meta> tags beyond the built-in nonce, etc. Inserted at the structural head_end boundary identified by the parser — never matched against a byte pattern, so cannot be tricked by </head> literals appearing in HTML comments, srcdoc attributes, or inline scripts.

body_inject: Option<&'a str>

Optional HTML to emit immediately before the document’s </body> close. Used for dev livereload <script>, analytics snippets, OpenTelemetry trace IDs, etc. Same structural-boundary guarantee as head_inject.

Implementations

impl<'a> RenderOptions<'a>

pub fn new(entry_id: &'a str, request_path: &'a str) -> Self

Create render options for the given entry fragment and request path.

pub fn with_nonce(self, nonce: &'a str) -> Self

Set the CSP nonce for inline scripts. Pass an empty string to disable (None semantics) — empty <meta name="webui-nonce" content=""> would be browser-ignored noise.

pub fn with_head_inject(self, html: &'a str) -> Self

Set HTML to emit immediately before </head>. Pass an empty string to disable (None semantics).

Safety (XSS warning)

The provided HTML is written verbatim — no HTML escaping is performed. Callers MUST ensure the content is fully trusted (typically a &'static str or build-time-derived bytes such as dev livereload script, image preload <link> tags, or A/B test markers). Passing user-controlled or attacker-influenced content here is a direct cross-site scripting vulnerability. If your caller path may include untrusted data, escape with the host’s HTML escaper (e.g. webui_handler::encode_safe) before calling this builder.

pub fn with_body_inject(self, html: &'a str) -> Self

Set HTML to emit immediately before </body>. Pass an empty string to disable (None semantics).

Safety (XSS warning)

Same contract as with_head_inject: the HTML is written verbatim with no escaping, so callers MUST ensure the content is fully trusted. Untrusted content is a direct XSS vector.