Read by what you're trying to do.
The docs are grouped by intent. Pick the one that matches the question you're holding.
122 docs · 8 intents
Start here
What GoFastr is, how a project is laid out, and a map of every feature, the newcomer narrative before the per-feature references.
Backend capability map
One row per job: scope rows to a user, add auth, run background work. Each row gives the symbols to compose and a command that proves the result.
Overview
What the framework is, the two layers, and a linked map of every capability.
The gofastr CLI
Every subcommand mapped to its doc: init, dev, migrate, generate, audit, upgrade.
Tutorial: app spec app
The optional app spec scaffolder end to end: one gofastr.yml becomes a UI + API you own, in about twenty minutes.
Project structure
Start flat; grow into internal/<domain> as real boundaries appear. Structure follows the app.
Comparison
Where GoFastr sits relative to other full-stack frameworks.
Upgrading
Move an app (and the CLI) to a newer release, plus gofastr upgrade, the guided helper.
What changed in v0.86.0
The UI-layer rebuild: headless components, fui-* classes, the layout primitive and owned styles, with every breaking change and how to move an app.
What changed in v0.87.0
The zinc theme and its tokens, entity Display and States, entityui screens and the admin rebuilt on them, with every breaking change and how to move an app.
API stability
Compatibility windows, deprecation rules, and the public v1 promise.
Modeling your domain
Declare entities, fields, relations. The framework generates schema, CRUD, validators, and code.
Entity declarations
JSON or Go. Both produce the same tables, routes, and tools.
Filter DSL
?status=published&views_gte=10&sort=-created_at parses to a typed Where.
Cursor pagination
Keyset by EntityConfig.CursorField. Opt in by sending ?cursor=.
Eager loading
?include=author.profile flattens the N+1.
Hooks & transactions
BeforeCreate / AfterUpdate hooks share the parent tx.
States
Named moves change a status field and write an audit row; all but System moves get a route and an MCP tool.
Custom endpoints
Declare a route in gofastr.settings.yml, link a typed handler, and get typed calls in the Go client, JS SDK and CLI.
Migrations
Versioned, ordered, reversible, versus the auto-migrate dev mode.
Multi-tenant scope
tenant_id column + automatic filter from request context.
Code generation
What lands on disk under gen/, and how to read it.
Project settings
gofastr.settings.yml: the one committed file that configures generate, verify and isolation for a project.
Unmounting a package
gofastr unmount copies a gofastr package into your app to change its code; gofastr remount goes back.
Ship your API as a CLI
gofastr generate cli: a branded terminal client for your customers, with scoped API-token auth.
Ship your API as SDKs
gofastr generate sdk: a downloadable Go module + JS/TS client, hosted by the app behind a live docs site.
Serving HTTP
Routes, middleware, sessions, auth, idempotency, security headers: everything between the wire and your handler.
Access control
RolePolicy, RequirePermission, custom Policy implementations.
Auth
Login, OAuth, magic-link, 2FA, password reset, each a plugin.
Idempotency
An Idempotency-Key header replays mutations safely.
API prefix & versioning
Mount the API under a prefix and evolve it across versions.
Cache
Memoize expensive reads with a pluggable backend and TTLs.
Security defaults
CSP, CSRF, rate limit, headers: all on by default.
Rate limiting
Throttle any route with the sliding-window limiter the auth flows use.
Health checks
/healthz + /readyz with plugin checks.
Webhooks
Signed outbound delivery with retry-with-backoff.
Notifications
Multi-channel fan-out with per-channel templates.
Batch endpoints
Create / update / delete many rows in one request.
Plugins
The lifecycle every battery and feature plugs into.
Modules
Runtime enable/disable for batteries with manifests.
Building UI
Start from a product job, then choose the state boundary, server-rendered islands, primitives, runtime, and theme.
UI capability map
Live dashboards, optimistic boards, master/detail, reactive state, static export, and SPA integration, mapped to proof and delivery semantics.
Live dashboards
Compose SSE island push, store.Computed, a bounded feed, and the connection-health banner, and the boundaries that decide when each is the right shape.
Getting started (UI)
The path: scaffold → theme → screen → custom component.
Composition recipes
Choose a page shape before composing framework-owned primitives.
Wiring UI into an app
framework.App + core-ui app + uihost, end to end in one annotated main.go.
Entity screens
framework/entityui: list, record, and create screens drawn from the entity's Display and States, with query-param state.
Screens and layouts
Layout chains: nesting with ScreenGroup, per-layer markers, deepest-shared-layer swaps, prefetch, scroll restore.
New components
The minimal-register + SSR-inline + hydrate contract.
Headless components
Structure, roles and hooks with no classes: parts, class maps, slots, binds, islands, and the harness that pins them.
Theming
The token catalog, dark mode, ui.Themed, and the --ui-* override vars.
Widget builder
Build islands that hydrate against a registered handler.
Forms
Server-validated forms with island-swapped error states.
Image pipeline
Pure-Go resize + WebP lossless encode.
Runtime modules
Carved per-feature so pages without X don't ship X's JS.
Print documents
Server-rendered print-friendly documents + PDF.
Dev livereload
SSE-driven reload while you edit. Zero config.
Static-site export
Render the whole app to static HTML + assets for apex or project-path hosting.
Site search
Full-text search over every rendered page: live from the server, or from index files in a static export.
PWA
uihost.WithPWA: installable manifest, versioned offline shell, and a safe service worker.
Desktop host
Experimental: run the app in the OS WebView from a CGO_ENABLED=0 binary, with a typed JS bridge to native capabilities (macOS today).
Application hosts
App.Run with a Host: the one lifecycle engine behind Start and Serve, ServicesHost for an App with no transport, ServicesReady, and the rules a native host follows.
Local apps
framework/localapp: the data directory a one-person app keeps on its own device (SQLite DB, session secret, owner identity), shared by the desktop, service and mobile hosts.
OS service host
Experimental: install the app binary as a per-user launchd, systemd or Task Scheduler service and sign the browser in to its loopback UI.
SEO
Meta tags, Open Graph, JSON-LD, sitemap, robots, and the one-image icon surface.
Accessibility
Built-in ARIA guarantees, the guided audit command, and the build gate.
Porting an existing frontend
The escape hatch for a foreign DOM contract: html/template screens + static.Mount, deliberately unsupported.
Strict mode
WithStrict: missing SEO and missing per-screen axe tests fail boot instead of shipping.
Reactivity model
The four-rung ladder of client signals, RPC, polling, and SSE push, plus the stateless-interactive-layer contract.
Interactive patterns
The data-cui-* vocabulary: RPC islands, signals, open-widget, optimistic actions, polling.
Optimistic UI
The mutation lifecycle, rollback vs authoritative refresh, and seven composed recipes: toggle, inline edit, create, delete, kanban, group mutex, and slow/failure.
Pane host
Master-detail split-pane layout that collapses to an overlay drawer on narrow screens.
Embeddable surfaces
Hand a screen to a website you don't control: single-use handshake nonce, exact origin allowlist, a frame runtime with no SPA navigation.
Plugin platform
Host third-party JS plugins in a sandboxed opaque-origin iframe with a capability-gated postMessage protocol.
Process modules
Third-party modules as isolated child processes: crash/upgrade/revoke without touching the host, capability-brokered data, sandbox trust tiers.
Runtime contract
The SSR/hydration/island/SSE model and the full data-cui-* attribute reference.
Signal store
Typed, namespaced client state that fans out to many consumers from one declaration.
Background compute
Registered Web Workers + WASM modules, content-addressed and CSP-safe, off the main thread.
Browser-local databases
IndexedDB databases declared in Go: records in the visitor's browser, ordered lists, transactions, and change events across tabs.
Local entities
Forms and lists over records saved in the visitor's browser, from Go and design-system components; no server table, no app JavaScript.
Persisting & migrating
SQLite and Postgres, dialect-aware, with the migration CLI and per-test isolation.
Audit log
WithAuditLog writes a row for every Create/Update/Delete.
Data export & import
Dump every entity's rows to a portable archive and restore it with validation.
Presence
Live 'who's here' rosters over the SSE lane: server-derived identity, cross-replica aggregation with WithFanout.
WebRTC rooms
Signaling-only rooms over StateChannel: server-derived identity, per-peer TURN credentials, mesh media that never touches Go.
Isolation
Linked git worktrees get isolated local DBs.
Testkit
Public helpers for host apps that need an isolated Postgres in integration tests.
Factories
Rails-style fixtures for tests.
Full-text search
Find records containing a term, dialect-aware.
Uploads
File + image fields with pluggable storage backends.
Storage backends
Local-filesystem and S3-compatible backends behind one Storage interface.
SMTP sending, a dev log sender, and template rendering.
Env / .env
core/dotenv auto-loaded by NewApp.
Core packages
A map of the exported core/* packages and when to reach for each directly.
The SQLite driver GoFastr ships
modernc.org/sqlite registered as sqlite3, the three DSN defaults every connection gets, and why an in-memory database needs one connection.
Working with agents
MCP tools, Kiln build mode (experimental), agent permissions, plan-gated destructive ops.
Agent-readiness
Discovery surface scanners (isitagentready.com) look for: llms.txt, A2A card, MCP/OAuth well-knowns, markdown negotiation.
MCP server
The core/mcp reference: JSON-RPC methods, registering tools, resources, templates, and prompts, per-caller gates, and cursor pagination.
Local run registry
Every running App writes a 0600 record of its URL and MCP entry; framework/localrun lists the live ones, pruning dead pids.
A2A task exchange
WithA2A mounts the Agent2Agent v1.0 exchange at /a2a: deterministic named skills, entity skills over MCP tools, tasks, streaming, and push.
Contracts
gofastr verify: one pipeline of rules with IDs, reasons, and fixes, plus semantic coverage and machine-readable diagnostics.
Kiln overview
Experimental: the agent-driven build-mode binary.
ACP server
core/acp speaks the Agent Client Protocol v1: sessions, streamed updates, permissioned tool calls.
WebMCP bridge
Experimental: expose server-declared tools to in-browser agents via the page's modelContext.
Agent host
The chat-host surface contract: RoleAgent, widget authoring with the document builder, and consuming host theme signals instead of shipping a palette.
Web Bot Auth
Publish your signing JWKS, and (experimental) verify RFC 9421 signatures on inbound agent traffic against draft-meunier-webbotauth-httpsig-protocol-02.
Generative UI
The position: models compose the design system, never emit markup or CSS; what that means per surface.
Semantic search
Local semantic search via brute-force cosine. No API key.
Audit deps
Detect packages an agent shouldn't import.
App specs
Reusable bundles of entities + screens an agent can apply.
Operations
Run it in production. Logging, metrics, feature flags, env, i18n.
Logging
Structured JSON logs with MCP query tools.
Observability
Metrics and tracing for the hot paths.
Deployment
Ship it: build, configure, and run GoFastr in production.
Backups and restore
Database backup commands for SQLite and Postgres, and how to prove a restore works.
First-run setup
A setup wizard (or headless env bootstrap) gates the app until first-boot state exists.
Horizontal scaling
What's process-local by default and the replica-safe alternative for each.
Job queue
Durable background jobs via battery/queue.
Feature flags
Rollout percentage, allow lists, env evaluator.
First-party relay
Same-origin reverse proxy for third-party services: fixed upstreams, method allow-lists, credentials stripped both ways.
Analytics recipes
PostHog and Statsig first-party through battery/relay: bootstrap script, SPA pageviews, identity, server-side flag gates.
i18n
JSON catalogs, plurals, Accept-Language negotiation.
Cron
Scheduled jobs with retry + jitter.
Events
In-process pub/sub for decoupled side effects.
Admin UI
An opt-in listing + form per entity.
Reference & internals
Performance numbers and the deeper design + tooling docs, surfaced so nothing is hidden.
Every doc · A–Z
The complete embedded reference: every page, alphabetical, featured or not. It is the same content as `gofastr docs`.