ReadonlycspThe source a content security policy has to allow.
ReadonlyrpcTyped request/response and events over the raw message channel. Types do not perform runtime payload validation at the webview boundary.
Rewrites an extension-relative path into a uri the content may load.
Subscribes to raw, untrusted messages from the page. The caller owns the returned registration. For request/response, prefer ManagedWebview.rpc.
Sends a raw message accepted by the platform's webview serialization boundary. For request/response, use ManagedWebview.rpc. Resolves false when the platform reports that the content is no longer live.
Replaces the rendered HTML. The caller owns the complete document and its CSP; this method performs no sanitization.
Renders a template file shipped with the extension.
Placeholders:
{{name}} — the value, HTML-escaped{{raw:name}} — the value verbatim, which is an injection vector unless
you produced the value yourself{{webviewUri:media/app.js}} — a uri the content may actually loadOptionalvariables: Readonly<Record<string, string>>
A webview the framework manages: HTML, a typed RPC channel, and cleanup that happens once however the content goes away.