Target name.
Unix time in seconds.
Fragment HTML.
Optionalsig: string
Lowercase hex signature of the v2 message, if signed.
Optionalcss: string
Optional CSS text.
OptionalcssOptional CSS text; the engine never sets it.
The bound fragment HTML.
OptionalsigLowercase hex signature over message(), present for hmac and ed25519 signing.
The target name chosen when rendering.
Unix time in seconds when the envelope was rendered.
ReadonlyvWire-format version, always ENVELOPE_VERSION (2).
The exact bytes the signature covers (v2, length-prefixed fields), see signatureMessage.
The wire JSON: v first, sig and css omitted when undefined.
A rendered fragment on the wire (format v2), returned by Fragment.run, Stream.run and Engine.renderFragment.
JSON.stringify(envelope)gives compact JSON withvfirst andsig/cssomitted when undefined. The same JSON goes overfetch, as an SSEdata:line (formatEvent) or as a WebSocket text frame (formatPacket).Remarks
When signing is on, sig is the lowercase hex HMAC-SHA256 or Ed25519 signature of message(): the length-prefixed v2 message over
ts,slot,htmlandcss(see signatureMessage). Changing any of them breaks the signature.The Anza browser library does not apply or verify envelopes: your code puts
htmlinto the target, and a server or edge that relays envelopes checks them with verifyEnvelope.htmlis only escaped where the engine runs withescape: true.See the Engine Contract for the format shared by all engines.
Example