composing-html
Produce single-file HTML artifacts without hand-writing the page chrome. The composer supplies <!DOCTYPE>, <head>, inlined CSS, base.js, design tokens, masthead, and colophon. You supply a title and the body content.
The product is the chrome and inventory below — primitives you can drop into any artifact without re-deriving what a card, badge, or eyebrow looks like. Templates are shortcuts on top of this, useful when the same artifact shape repeats; see [Templates](#templates-shortcuts-for-repeat-structure) near the end.
Default workflow: freeform
freeform gives you the whole chrome with one content slot — body_html — for the page body. Reach for it first. Reach for a template only when the structure repeats across artifacts (see [Templates](#templates-shortcuts-for-repeat-structure) near the end).
There are two ways to invoke it. Use the --set flow for anything with a substantial body — it sidesteps the JSON-string escaping that bites heredoc-style spec writing (newlines, quotes, </& inside multi-line HTML).
Recommended: HTML in a file, metadata via --set
1. Write the body to a .html file directly (no JSON, no escaping).
2. python scripts/build.py build freeform \
--set title='My Page' \
--set subtitle='Optional subhead' \
--set [email protected] \
--out artifact.html
--set KEY=VALUE assigns a literal string; --set KEY=@FILE loads the file contents verbatim into that spec field. Repeat for any field. Works for bodyhtml, extracss, extrajs, eyebrow, pageclass, and the same *html fields in any other template (summaryhtml, introhtml, detailshtml, …).
Spec-file workflow (best for structured templates)
1. python scripts/build.py describe <template> # required keys + skeleton
2. write spec.json
3. python scripts/build.py build <template> --spec spec.json --out artifact.html
For templates with typed slots (prreview.findings[], slidedeck.slides[], status_report.metrics[]), the spec file is the right shape — the template reasons over the structure. For freeform, the spec is mostly a thin config wrapper around one HTML string; the --set flow above is usually less friction.
You can mix both: small spec.json for metadata, --set [email protected] for the heavy bit. --set overrides any matching field from --spec.
Pitfall: don't inline multi-line HTML into a JSON heredoc
cat > spec.json <<EOF { "body_html": "<multi\nline>\n..." } EOF does not produce valid JSON — JSON strings can't contain raw newlines or unescaped quotes. Either:
- use
--set [email protected] (recommended), or
- assemble the spec in Python with
json.dump(spec, f) so escaping is automatic.
Inventory
Everything in this section is loaded into every artifact via inlined CSS and base.js. Use these tokens and classes inside bodyhtml (or any template's *html field) without re-declaring them.
Color tokens
| Token |
Hex |
Use |
--ivory |
#FAF9F5 |
Page background |
--paper |
#FFFFFF |
Card background |
--slate |
#141413 |
Headings, inverted background |
--clay |
#D97757 |
Brand accent (lines, primary actions) |
--clay-d |
#B85C3E |
Hover/dark variant |
--oat |
#E3DACC |
Soft contrast surface |
--olive |
#788C5D |
Success, secondary accent |
--rust |
#B04A3F |
Errors, destructive |
--moss |
#4A6B3A |
Success text |
--g100 … --g700 |
grays |
Surfaces, borders, body text |
Semantic aliases: --ok, --warn, --err, --info.
Type stacks
--serif — display headings (h1, h2, big numerics).--sans — body text (default).--mono — code, eyebrows, badges, captions.
Geometry
--radius-sm (6px) · --radius (10px) · --radius-lg (16px) · --border · --border-soft · --shadow-card · --shadow-pop.
Layout primitives
.page — main column (1080px max). Variants: .page--wide (1280px),
.page--narrow (720px). Set via the page_class spec key.
.masthead — header strip with .eyebrow + <h1> + .subtitle
(auto-rendered from title/subtitle/eyebrow unless show_masthead is false).
.grid .grid--2|3|4|auto — responsive CSS grid..stack, .row — vertical / horizontal flex..card, .card--soft, .card--elev — content containers..rule — <hr> underline below <h2>..colophon — optional footer strip; pass colophon="text" to page() to
show it (off by default).
Components
- Eyebrow:
<div class="eyebrow">SECTION</div> — small all-caps label
with a leading clay rule.
- Badge:
<span class="badge badge--ok|warn|err|info|clay">v1.0</span>.
- Kbd:
<span class="kbd">⌘K</span>.
- Bullets:
<ul class="bullets"><li>…</li></ul> — clay dots.
- Code: inline
<code> and block <pre><code>. Block code gets a
copy button automatically via base.js.
- Details: native
<details><summary>…</summary>…</details> styled.
Tabs
<div class="tabgroup">
<div class="tabs">
<button data-target="a">Tab A</button>
<button data-target="b">Tab B</button>
</div>
<div class="tab-panel" data-id="a">…</div>
<div class="tab-panel" data-id="b">…</div>
</div>
base.js wires this automatically and selects the first tab by default.
Drag-to-reorder
<div data-sortable="true">
<div draggable="true">…</div>
<div draggable="true">…</div>
</div>
Optional cross-zone drops: add data-zone="<id>" to each container.
Live parameter bindings
<input type="range" data-bind="size" min="0" max="100" value="50" data-format="number" data-unit="px">
<span data-out="size"></span>
<style>.box { width: var(--bind-size, 50px); }</style>
The CSS custom property --bind-<name> is updated on every input event, and any [data-out="<name>"] element receives the formatted value.
Output rules
Spend output tokens on content, not chrome:
- Never write
<html>, <head>, <style>, <script>, or <link>. The
composer adds all of them. If you find yourself writing a complete page, you missed the skill. <!-- rule:chrome-leak -->
- Don't restate design tokens. Reuse the inventory above —
var(--clay),
.card, .badge--warn, .bullets, etc. are already loaded. Don't hardcode hex/rgb() colours, inline font-family/font-size, or reference tokens that aren't in the palette. <!-- rule:hardcoded-color rule:inline-typography rule:undefined-token -->
body_html is HTML, not a JSON dialect. Write <section>, <h2>,
<ul class="bullets"> directly. No translation layer.
- Anything in an
_html field is inserted verbatim — escape any
user-supplied content yourself. All other string values are HTML-escaped automatically.
- One artifact per build. Browser tabs are free.
Checking output
After building, lint the artifact before presenting it:
python scripts/build.py check artifact.html
The checker is deterministic — no model call, stdlib only. It doesn't grade taste (the fixed chrome already prevents the usual AI tells); it flags content that breaks out of the design system or wires base.js hooks to nothing — the failure modes the chrome can't prevent on its own:
| rule |
catches |
severity |
chrome-leak |
<html>/<head>/<link> (and top-level <style>/<script>) in body_html |
error |
undefined-token |
var(--typo) — a token not in the palette or declared here |
error |
broken-tabs |
data-target with no matching .tab-panel[data-id] |
error |
hardcoded-color |
#hex / rgb() literals instead of palette tokens |
warn |
inline-typography |
font-family / font-size overriding the type stacks |
warn |
undefined-token for --bind-* |
(allowed — created by data-bind) |
— |
nested-card |
.card inside .card |
warn |
broken-bind |
data-bind with no consumer, or orphan data-out |
warn |
broken-sortable |
data-sortable with no draggable children |
warn |
heading-skip |
heading levels that jump (h1 → h3) |
warn |
img-no-alt |
<img> without an alt attribute |
warn |
Exit code is non-zero when any error-severity rule fires. The output rules above carry <!-- rule:ID --> anchors tying each guidance line to its check, so the teaching and the enforcement stay in sync. Full-artifact vs body fragment is auto-detected; force with --full / --fragment. --json emits machine-readable findings. Contrast ratios are intentionally not checked — the token pairs are pre-vetted and regex can't judge author-introduced pairs without false positives.
Iteration
Edit the spec, re-run build, open in a browser. If a layout pattern repeats across multiple artifacts, that's when a template earns its keep — otherwise stay in freeform.
Templates: shortcuts for repeat structure
When the same artifact shape recurs (status reports week after week, PR reviews across many PRs, slide decks with consistent navigation), a template's fixed slot map is worth the translation cost. It enforces cross-artifact consistency and skips the layout decisions you'd otherwise re-derive each time.
Use a template only when:
- You're producing the same artifact shape repeatedly.
- The repeat structure justifies a fixed slot map.
- Cross-artifact consistency matters more than per-artifact flexibility.
Otherwise: freeform.
1. python scripts/build.py list # all templates, one-line summaries
2. python scripts/build.py describe <template> # required keys + JSON skeleton
3. write spec.json # only your content + parameters
4. python scripts/build.py build <template> --spec spec.json --out artifact.html
describe prints a valid-JSON starter skeleton you can edit in place. For worked examples, see references/templates.md — but only after picking a template; reading it cold wastes context.
For templates with prose-heavy *html slots (e.g. summaryhtml, introhtml, detailshtml), the same --set KEY=@FILE mechanism from the freeform workflow applies — load the prose from a .html file rather than escaping it into the JSON spec.
There are 21 templates, grouped into 9 categories plus freeform:
report.* — statusreport, incidentreportreview.* — prreview, codewalkthrough, module_mapeditor.* — triageboard, flageditor, prompt_tunerdeck.* — slide_deck (arrow-key + space navigation)design.* — designsystem, componentvariantsexploration.* — comparisongrid, designdirections, implementation_planresearch.* — featureexplainer, conceptexplainerdiagram.* — svgfiguresheet, flowchartprototype.* — animationsandbox, clickflow
Some templates with prose-heavy slots take raw HTML in keys ending with html (e.g. summaryhtml, introhtml, detailshtml). Same rules as freeform.body_html: use the inventory above, escape user-supplied content.
Tests
tests/testsmoke.py covers every template with a representative spec plus explicit security regressions (table escaping, script-tag breakout in prompttuner, attribute injection in flageditor, CSS-color injection, spec mutation in modulemap). tests/test_checker.py covers the check linter — one assertion per rule (fires on the violation, silent on the clean case). Run with:
python composing-html/tests/test_smoke.py # no pytest required
python composing-html/tests/test_checker.py # no pytest required
python -m pytest composing-html/tests -q # if pytest is available
When adding or changing a template, add a spec entry and any regression asserts before merging. When adding a checker rule, add it to both scripts/checker.py and a <!-- rule:ID --> anchor in the relevant guidance line, plus a test assertion.
