Live Framework API Reference

This page is the technical reference for the implemented 0x0 Live framework

surface. Beginner task workflows live in site/live-how-to.html.

Endpoint

The endpoint surface owns host, port, TLS profile, static assets, request id,

compression, health, HTTP dispatch, Live dispatch, and WebSocket dispatch.

Evidence:

• frameworks/live/endpoint-policy.tsv
• frameworks/live/routes.tsv
• tools/live-endpoint-check.py
• make live-endpoint-check

Router

Routes are source-owned rows with method, path, kind, module, action, pipeline,

and status. Duplicate routes, missing routes, bad middleware order, 404, and

405 behavior are checked by the endpoint gate.

Templates

Checked *.html.0x0 templates are parsed by

tools/html-template-source.py. The parser emits element, control, slot, text,

comment, interpolation, assignment, event, and source-span data.

Formatter and lowering evidence:

• make live-template-parser-check
• make live-template-formatter-check
• make live-template-lowering-check

Components

Components declare attributes, defaults, required values, events, slots, and

accessibility behavior. Component boundary checks reject missing required

attributes, unknown slots, duplicate attribute names, and invalid event names.

Gate: make live-component-boundary-check

Layouts And Navigation

Navigation surfaces cover route continuity, layout slots, static assets,

session-aware navigation, and route metadata.

Gate: make live-navigation-check

CSS And JavaScript

Colocated CSS extraction and JavaScript hooks are source-owned. Production

assets require deterministic extraction, manifest entries, and integrity

evidence.

Gates:

make live-css-extraction-check
make live-js-hooks-check

Session, Wire Protocol, Transport, And Diff

Live sessions own identity, assigns, lifecycle, reconnect, heartbeat, and

failure state. The wire protocol and WebSocket transport own encoding,

decoding, connect, join, events, replies, heartbeats, close, replay, and

backpressure. The diff engine owns deterministic patch generation.

Gates:

make live-session-state-check
make live-wire-protocol-check
make live-websocket-transport-check
make live-diff-engine-check

Browser Client

The browser client bridge owns mount, reconnect, event dispatch, patch

application, upload hooks, streams, and fallback polling.

Gate: make live-browser-client-check

Forms

Forms own change, submit, validation, nested params, error state, redirect, and

CSRF behavior.

Gate: make live-form-check

Uploads

Uploads own accepted types, size limits, chunking, scan hooks, progress,

cancel, cleanup, and failure mapping.

Gate: make live-uploads-check

Streams

Streams own append, prepend, replace, delete, reset, empty state, ordering, and

bounded patch size.

Gate: make live-streams-check

Async, PubSub, And Scopes

Async tasks own lifecycle, cancellation, timeout, and failure mapping. PubSub

owns scoped topics, presence, replay, and cleanup. Scopes own tenant,

workspace, user, session, system, and capability boundaries.

Gates:

make live-async-check
make live-pubsub-check
make live-scope-check

Auth

Auth owns magic links, optional password verification, recent-auth windows,

CSRF, origin policy, session renewal, logout-all, token rotation, remember-me,

and local-only development mailboxes.

Gate: make live-auth-check

Generators And Dev Server

Generators emit editable source, tests, docs, package metadata, and release

evidence. The dev server owns reload events, error overlays, browser reload

messages, and resource caps.

Gates:

make live-generator-check
make live-dev-server-check

Testing

Live tests cover disconnected render, connected render, click, submit, change,

upload, patch, redirect, assert HTML, assert patch, assert push event,

reconnect, auth scope, and browser behavior.

Gate: make live-test-framework-check

Security

Security evidence covers CSP, asset integrity, XSS denial, origin policy, host

policy, body limits, upload scanning, rate limits, capability denial, session

secret rotation, and key custody.

Gate: make live-security-check

Observability And Performance

Observability evidence covers logs, metrics, traces, correlation, patch size,

queue depth, reconnect count, error classes, debug annotations, and secret

redaction. Performance evidence covers initial render, connect, event latency,

patch size, reconnect, streams, uploads, concurrent sessions, memory, CPU,

compression, and regression thresholds.

Gates:

make live-observability-check
make live-performance-check

Persistence

Persistence adapters cover scoped file, database, object store, search, email,

job queue, transaction, idempotency, rollback, and service error mapping.

Gate: make live-persistence-check