htmx script injection from Chirp's frozen provisioning manifest.
Mirrors the Alpine injection path (src/chirp/server/alpine.py). When
AppConfig(htmx=True) Chirp injects the htmx core <script>before
</body> via StreamingHTMLInject, dedup-aware
ondata-chirp="htmx"so a document that already ships htmx (chirp-ui
shell.html/boost.html, the v2 scaffold) is left untouched.
CDN footgun (mirrors Alpine): the scriptsrcmust use the explicit
jsDelivr/dist/htmx.min.jspath. Managed injection, first-party layouts,
scaffolds, examples, and docs use that same minified browser bundle. Dedup still
matters when an application template ships its own marked tag.
The htmx core is an externalsrc=script, but it still accepts the live
per-request CSP nonce: under a strict nonce-onlyscript-src 'nonce-...'an
external<script src>without the nonce is blocked, so the snippet factory
threads the nonce onto the tag the same way the Alpine bootstrap does.
server.htmx
| Name | Type | Default | Description |
|---|---|---|---|
type
|
|
— | |
qualified_name
|
|
— | |
element_type
|
|
— | |
description
|
|
— | |
source_file
|
|
— | |
line_number
|
|
— | |
is_autodoc
|
|
— | |
autodoc_element
|
|
— | |
_autodoc_template
|
|
— | |
_autodoc_url_path
|
|
— | |
_autodoc_page_type
|
|
— | |
title
|
|
— | |
doc_content_hash
|
|
— |
Symbols on this page
Internal fail-loud boundary for response headers removed by htmx 4.
Reject removed timing headers only for a proven managed htmx 4 request.
Render an ordered managed bundle from a freeze-time manifest.
Build the managed htmx injection bundle for an exact version.
The script URL uses the explicit/dist/htmx.min.jspath — the framework's CDN convention (the…
HtmxTimingHeaderError
class
Internal fail-loud boundary for response headers removed by htmx 4.
enforce_htmx_response_compatibility
function
def enforce_htmx_response_compatibility(response: Any, *, manifest: HtmxProvisioningManifest | None, is_htmx_request: bool) -> AnyReject removed timing headers only for a proven managed htmx 4 request.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
response
|
Any
|
— | |
manifest
|
HtmxProvisioningManifest | None
|
— | |
is_htmx_request
|
bool
|
— |
htmx_manifest_snippet
function
def htmx_manifest_snippet(manifest: HtmxProvisioningManifest, *, nonce: str = '') -> strRender an ordered managed bundle from a freeze-time manifest.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
manifest
|
HtmxProvisioningManifest
|
— | |
nonce
|
str
|
''
|
htmx_snippet
function
def htmx_snippet(version: str, *, nonce: str = '') -> strBuild the managed htmx injection bundle for an exact version.
The script URL uses the explicit/dist/htmx.min.jspath — the framework's
CDN convention (the same explicit-/dist rule rules_alpine_cdnenforces
for Alpine). Unlike Alpine — whose bare jsDelivr path resolves to a CommonJS
module that throws in the browser — htmx's packagemainis browser-safe,
so for htmx this is a consistency/minification choice rather than a fix for a
hard failure; pinning/dist/htmx.min.jskeeps every framework CDN URL on
the explicit minified browser bundle.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
version
|
str
|
— | htmx version (e.g. "2.0.10"). |
nonce
|
str
|
''
|
When non-empty, the ``<script>`` carries a ``nonce="..."`` attribute so it survives a nonce-based CSP that no longer ships ``'unsafe-inline'`` / loads only nonced scripts. |
View source · /home/runner/work/chirp/chirp/site/../src/chirp/server/htmx.py:1