Skip to main content
Neuron’s content pipeline lets Script return rich objects instead of manually concatenating HTML. Installed encoders render tables, graphs, images, XML, Markdown, semantic data, and other types according to the requested content type.

​
Dynamic Markdown

Use a Script block or the page’s supported inline-expression syntax to calculate values during rendering. Keep queries above the presentation and return a small view model to the Markdown layer. Conceptually:
The returned matrix/table is rendered by the active Markdown/content renderer.

​
Generate XML

Script has a native XML syntax with embedded expressions and XML pattern matching. Prefer it over string concatenation because names, attributes, and values are encoded structurally. Use XML for:
  • contract machine-readable sections;
  • XMPP information queries;
  • gateway/module configuration;
  • interoperable IoT payloads and schemas;
  • transformations through XSL.
Validate generated XML against its XSD before signing or publishing it.

​
Content negotiation

The runtime’s InternetContent system selects encoders and decoders by media type. A dynamic resource should:
  1. inspect the request Accept header;
  2. produce a typed result;
  3. let the content system choose an encoder;
  4. set explicit cache and privacy headers;
  5. return 406 Not Acceptable when no safe representation exists.

​
Web control flow

Web extensions can issue redirects and client/server HTTP errors from Script. Use explicit status codes, avoid reflecting raw exception text, and return machine-readable errors for APIs.

​
Graphs and documents

Installed modules provide:
  • 2D and 3D graphs;
  • palettes and fractals;
  • Layout2D documents;
  • Markdown-to-HTML and Markdown-to-PDF;
  • XML and XSL transforms;
  • QR codes and image processing;
  • semantic formats.
Expensive renderers such as Graphviz, PlantUML, OCR, or PDF may depend on external programs. Check those dependencies during package setup and bound input size and execution time.

​
Security

  • Treat request variables and uploaded content as untrusted.
  • Do not evaluate user-provided Script.
  • Encode values through typed renderers.
  • Restrict file and network access from public pages.
  • Avoid returning .NET objects that expose unintended public properties.
  • Set CSP/CORS per resource, not globally for convenience.