Dynamic Bindings

Bindings let a page refer to dynamic data without copying database access or business logic into a catalog component.

Keep resolution in the host

A binding stored in page content is a description of permitted data. The host:

1. lists the sources available to this page and user;
2. validates the requested source and path;
3. resolves data inside the tenant boundary;
4. passes safe values to the renderer.

The browser must not be able to name arbitrary models, queries, or database columns.

Optional transport methods

A transport may implement:

• listBindingSources(pageId)
• resolveBindings(pageId, definition)

If those methods are absent, keep the bindings capability disabled.

Use widgets for dynamic behavior

An element slot may accept a widget. Widgets are registered React components whose structured props may contain bindings.

This keeps the page contract constrained:

• the host chooses which widgets exist;
• the section chooses which element kinds fit a slot;
• the binding resolver chooses which data is available;
• the page stores only structured references.

Security rule

Treat every binding as untrusted input until the server has resolved it against the current user, tenant, page, and catalog policy.