hi

\",\"name\":\"release\",\"kind\":\"html\"}'\n\n# List all artifacts (metadata only)\ncurl \"$BASE/api/artifacts\" -H \"Authorization: Bearer $KEY\"\n```\n\n`POST /api/artifacts` returns `201` with `{ \"id\", \"url\" }` (an absolute URL);\n`GET /api/artifacts` returns the artifact list. The browser UI's `/upload`\nroute is unchanged and stays open.\n\n## How it works\n\n```\nmain.tsx Hono routes (the HTTP entry)\nbackend/\n db.ts SQLite metadata + val-scoped blob contents\n render.ts Markdown → HTML; HTML passes through as-is\nfrontend/\n Layout.tsx HTML shell\n Landing.tsx overview and dashboard link\n Dashboard.tsx list, upload, rename, and delete artifacts\n Viewer.tsx sandboxed iframe for one artifact\n upload.client.ts drag-and-drop browser script\nexamples/ seed artifacts\n```\n\n## Storage\n\nSQLite stores each artifact's id, name, kind, blob key, uploader, and creation\ntime. The uploaded source lives under the `artifacts/` prefix in this val's\nproject-scoped blob storage. New remixes therefore start with isolated data.\n\n## Security model\n\nArtifacts are untrusted content, including Markdown that contains raw HTML:\n\n- They render in an iframe without `allow-same-origin`. JavaScript can run, but\n it cannot read the app's cookies or call app routes as the viewer.\n- `/a/:id/raw` also sends `Content-Security-Policy: sandbox`, so opening it\n directly keeps the same opaque-origin boundary.\n- Markdown goes through the same sandbox as uploaded HTML.\n\nIf the app is restricted, anyone allowed through the Val Town access gate can\nupload, rename, and delete artifacts.",[],[107],"fc899a6a-9bd2-4344-8789-467a49713f55","frontend","01a01be0-4032-74fe-b778-9660538c09f1",["D",1787174076294],[120,121,122,123,124],[115],{"_36":153,"_13":154,"_63":155,"_65":116,"_67":68,"_69":70,"_71":72,"_38":156,"_17":34,"_74":75,"_76":157,"_78":51,"_79":-5,"_103":158,"_18":159},{"_36":146,"_13":147,"_63":148,"_65":116,"_67":68,"_69":70,"_71":72,"_38":149,"_17":34,"_74":75,"_76":150,"_78":51,"_79":-5,"_103":151,"_18":152},{"_36":139,"_13":140,"_63":141,"_65":116,"_67":68,"_69":70,"_71":72,"_38":142,"_17":34,"_74":75,"_76":143,"_78":51,"_79":-5,"_103":144,"_18":145},{"_36":132,"_13":133,"_63":134,"_65":116,"_67":68,"_69":70,"_71":72,"_38":135,"_17":34,"_74":75,"_76":136,"_78":51,"_79":-5,"_103":137,"_18":138},{"_36":125,"_13":126,"_63":127,"_65":116,"_67":68,"_69":70,"_71":72,"_38":128,"_17":34,"_74":75,"_76":129,"_78":51,"_79":-5,"_103":130,"_18":131},"084d3e5b-7141-4487-98a9-1d5a73eff7ee","upload.client.ts","01a01be0-4032-74fe-b778-9054966e8bd4",["D",1787174076294],"// Drag-and-drop / file-picker uploader for the dashboard, plus a small\n// confirm() for delete forms. Kept out of the markup per house style.\n\nconst zone = document.getElementById(\"dropzone\");\nconst input = document.getElementById(\"fileInput\") as HTMLInputElement | null;\nconst statusEl = document.getElementById(\"dropStatus\");\n\nfunction setStatus(msg: string) {\n if (statusEl) statusEl.textContent = msg;\n}\n\nif (zone && input) {\n const highlight = (on: boolean) =>\n zone.classList.toggle(\"border-blue-400\", on);\n\n zone.addEventListener(\"dragover\", (e) => {\n e.preventDefault();\n highlight(true);\n });\n zone.addEventListener(\"dragleave\", (e) => {\n // dragleave also fires when the pointer moves onto a child element; only\n // clear the highlight when it actually leaves the zone.\n if (!zone.contains((e as DragEvent).relatedTarget as Node | null)) {\n highlight(false);\n }\n });\n zone.addEventListener(\"drop\", (e) => {\n e.preventDefault();\n highlight(false);\n const files = (e as DragEvent).dataTransfer?.files;\n if (files && files.length) uploadAll(files);\n });\n input.addEventListener(\"change\", () => {\n if (input.files && input.files.length) uploadAll(input.files);\n });\n}\n\nasync function uploadAll(files: FileList) {\n const list = [...files].filter(\n (f) =>\n /\\.(html?|md|markdown)$/i.test(f.name) ||\n f.type === \"text/html\" ||\n f.type === \"text/markdown\",\n );\n if (!list.length) {\n setStatus(\"Please drop .html or .md files.\");\n return;\n }\n setStatus(`Uploading ${list.length} file${list.length > 1 ? \"s\" : \"\"}…`);\n let lastUrl = \"\";\n try {\n for (const file of list) {\n const body = new FormData();\n body.set(\"file\", file);\n body.set(\"name\", file.name);\n const res = await fetch(\"/upload\", { method: \"POST\", body });\n if (!res.ok) throw new Error(await res.text());\n lastUrl = (await res.json()).url;\n }\n } catch (err) {\n setStatus(\n \"Upload failed: \" + (err instanceof Error ? err.message : String(err)),\n );\n return;\n }\n location.href = list.length === 1 ? lastUrl : \"/dashboard\";\n}\n\n// Confirm before submitting any form marked with data-confirm.\nfor (\n const form of document.querySelectorAll(\"form[data-confirm]\")\n) {\n form.addEventListener(\"submit\", (e) => {\n if (!confirm(form.getAttribute(\"data-confirm\") || \"Are you sure?\")) {\n e.preventDefault();\n }\n });\n}\n",[],[115,126],"0efb2b8c-5422-4261-a003-117975194855","Viewer.tsx","01a01be0-4032-74fe-b778-8fc6f65f6622",["D",1787174076294],"/** @jsxImportSource npm:hono@4/jsx */\nimport type { Artifact } from \"../backend/db.ts\";\n\nexport function Viewer(props: { artifact?: Artifact; notFound?: boolean }) {\n if (props.notFound || !props.artifact) {\n return (\n

\n That artifact doesn't exist.{\" \"}\n Back to artifacts\n

\n );\n }\n const a = props.artifact;\n return (\n

\n \n ← all\n \n \n {a.name}\n \n \n by {a.createdBy}\n \n

\n \n

\n );\n}\n",[],[115,133],"905e99a1-65b0-4877-85c7-cd0cdf080fe5","Layout.tsx","01a01be0-4032-74fe-b778-8858b4e1a17a",["D",1787174076294],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport function Layout(\n props: { title: string; bare?: boolean; children: any },\n) {\n return (\n \n \n \n \n {props.title}\n \n \n \n \n {props.bare ? props.children : (\n

\n {props.children}\n

\n )}\n \n \n );\n}\n\nfunction Footer() {\n return (\n \n );\n}\n",[],[115,140],"c5eed6c1-68e4-45a3-bbb8-ad53f288c2fa","Landing.tsx","01a01be0-4031-7689-ba3a-0eb72c04f2ca",["D",1787174076294],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport function Landing(props: { org: string }) {\n return (\n

\n \n Built for{\" \"}\n @{props.org}\n

\n Artifacts\n

\n A simple place to host and share HTML pages and Markdown docs. Drop in an{\" \"}\n \n .html\n {\" \"}\n or{\" \"}\n \n .md\n {\" \"}\n file and get a link you can share.\n

\n\n

\n \n Open artifacts\n \n

\n\n

\n \n \n \n

\n );\n}\n\nfunction Feature(props: { title: string; body: string }) {\n return (\n

{props.title}

{props.body}

\n );\n}\n",[],[115,147],"c08c3529-1254-4626-8e2b-18aaedae61fa","Dashboard.tsx","01a01be0-4031-7689-ba3a-08eb8304f1d2",["D",1787174076294],"/** @jsxImportSource npm:hono@4/jsx */\nimport type { Artifact } from \"../backend/db.ts\";\n\nexport function Dashboard(\n props: { org: string; artifacts: Artifact[]; readOnly?: boolean },\n) {\n const count = props.artifacts.length;\n return (\n

\n Artifacts\n

\n @{props.org} · {count} {count === 1 ? \"page\" : \"pages\"}\n

\n \n about\n \n

\n\n {props.readOnly && (\n

\n Note:{\" \"}\n for this demo, uploads are not enabled. When you remix this val, your\n team will be able to upload / rename / delete artifacts!\n

\n )}\n\n \n \n

\n Drop an HTML or Markdown file here\n

\n .html or .md · or click to choose · published instantly\n

\n \n\n {count === 0\n ? (\n

\n No artifacts yet. Drop an HTML or Markdown file above to create your\n first one.\n

\n )\n : (\n

\n ))}\n

\n )}\n\n {!props.readOnly && (\n \n )}\n

\n );\n}\n\nfunction Row(props: { a: Artifact; readOnly?: boolean }) {\n const a = props.a;\n return (\n

\n \n

\n {a.name}\n \n {a.kind === \"md\" ? \"MD\" : \"HTML\"}\n \n

\n by {a.createdBy} · /a/{a.id}\n

\n \n

\n \n open\n \n {props.readOnly\n ? (\n <>\n \n rename\n \n \n delete\n \n \n )\n : (\n <>\n

\n rename\n

\n \n \n \n save\n \n \n

\n \n \n delete\n \n \n \n )}\n

\n );\n}",[],[115,154],"cdb4cc12-92d2-416d-ab46-ad136c432475","examples","01a01be0-4031-7689-ba3a-05c7ed77db47",["D",1787174076294],[166,167,168],[161],{"_36":183,"_13":184,"_63":185,"_65":162,"_67":68,"_69":70,"_71":72,"_38":186,"_17":34,"_74":24,"_76":187,"_78":51,"_79":-5,"_103":188,"_18":189},{"_36":176,"_13":177,"_63":178,"_65":162,"_67":68,"_69":70,"_71":72,"_38":179,"_17":34,"_74":24,"_76":180,"_78":51,"_79":-5,"_103":181,"_18":182},{"_36":169,"_13":170,"_63":171,"_65":162,"_67":68,"_69":70,"_71":72,"_38":172,"_17":34,"_74":24,"_76":173,"_78":51,"_79":-5,"_103":174,"_18":175},"2e80b4a6-2a15-4999-9917-dc0e1bf8cf63","welcome.html","01a01be0-4031-7689-ba3a-03136df79e0c",["D",1787174076294],"\n\n\n \n \n Welcome\n \n\n\n

👋 This is an artifact

It's a single HTML file, hosted and shared from Val Town.

Make your own by dragging an .html file onto the dashboard.

\n\n\n",[],[161,170],"493b1e06-1bbf-462c-a929-2a5554195212","markdown-demo.md","01a01be0-4031-7689-ba39-fe49d862ceb7",["D",1787174076294],"# Welcome to Team Artifacts\n\nThis is a **Markdown** artifact. Drop a `.md` file on the dashboard and it\nrenders as a clean, readable page — no build step, no HTML required.\n\n## What renders\n\n- **Bold**, _italic_, and `inline code`\n- Lists, like this one\n- [Links](https://val.town) to anywhere\n- Tables, quotes, and fenced code blocks\n\n```ts\n// Code blocks get monospace styling.\nexport function hello(name: string) {\n return `Hi, ${name}!`;\n}\n```\n\n> Markdown artifacts render in the same sandboxed iframe as HTML ones, so the\n> security model is identical.\n\n| Format | Extension | Rendered as |\n| ------ | -------------- | ------------------------ |\n| HTML | `.html` | served as-is |\n| Markdown | `.md` / `.markdown` | converted to HTML |\n\nDelete this example whenever you like — it won't come back.\n",[],[161,177],"2aaf54cc-d9ec-4ea5-afa9-01fb435991f1","live-clock.html","01a01be0-4031-7689-ba39-f908feee3757",["D",1787174076294],"\n\n\n \n \n Live clock\n \n\n\n

--:--:--

This artifact runs JavaScript — inside a sandboxed frame.

\n \n

\n \n\n\n",[],[161,184],["D",1787174076294],[193,194],[19],{"_36":81,"_13":82,"_63":83,"_65":66,"_67":68,"_69":70,"_71":72,"_38":198,"_17":34,"_74":75,"_76":85,"_78":51,"_79":-5,"_103":199,"_18":200},{"_36":61,"_13":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_38":195,"_17":34,"_74":75,"_76":77,"_78":51,"_79":-5,"_103":196,"_18":197},["D",1787174076294],[],[19,62],["D",1787174076294],[],[19,82],"07b94020-6885-4991-b086-21112c61d98c",["D",1787174076294],"legacyEnvVars","httpPrivacy","description","Host and share HTML and Markdown artifacts with your team","imageUrl","userId","5d1042a9-7b0b-499d-8a72-3a8ac7a4e185","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","5f80108f-7ca4-4327-b77b-089dbe4b5a82","tursoName","07b9402068854991b08621112c61d98c","tursoHostname","07b9402068854991b08621112c61d98c-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789521640046],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_247":243},"org",{"_11":12,"_241":-5,"_242":243,"_208":209,"_244":245,"_246":51},"branch",{"_17":109,"_13":16,"_36":68,"_42":201,"_45":37,"_46":44,"_238":53,"_239":43,"_240":57,"_58":14,"_54":12},"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","displayName","avatar","https://secure.gravatar.com/avatar/0129a541b7b3574e92c4afd06c5e32da&d=identicon","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":201,"_13":14,"_38":333,"_49":-5,"_203":51,"_52":53,"_204":53,"_205":206,"_207":-5,"_208":209,"_210":98,"_211":72,"_212":-5,"_213":-5,"_214":34,"_56":215,"_216":217,"_218":219,"_220":334,"_222":-5,"_223":224,"_225":224,"_226":227,"_228":227,"_229":227,"_230":224,"_231":224,"_232":335,"_234":336,"_236":337,"_50":51},[288,291,295,301,302],"files",[288,289,290,291,292,293,294,295,296,297,298,299,300,301,302],"counts",{"_279":34,"_280":70,"_281":34,"_35":282,"_283":284},[275,276],{"_36":87,"_67":68,"_63":66,"_13":19,"_76":-5,"_74":89,"_17":34,"_65":-5,"_38":273,"_69":70,"_79":-5,"_18":274},"upstreamProject",{"_36":43,"_13":14,"_205":206,"_207":-5,"_52":53,"_232":271},"upstreamBranch",{"_36":37,"_38":269,"_40":270,"_13":16,"_42":43,"_17":44,"_45":-5,"_46":-5,"_47":48,"_49":-5,"_50":51,"_52":53,"_54":55,"_56":57,"_58":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1781376559305],["D",1786052184563],{"_11":55,"_247":272},"https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/129cab32-3bd7-4c3e-f39b-f12900c76100/square512?exp=1789588383&sig=06604447a2cf9a076e2f692010042678a0587429b132b22286d6aea764ad194b",["D",1787174076294],[19],{"_36":81,"_13":82,"_63":83,"_65":66,"_67":68,"_69":70,"_71":72,"_38":84,"_17":34,"_74":75,"_76":85,"_78":51,"_79":-5,"_18":278},{"_36":61,"_13":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_38":73,"_17":34,"_74":75,"_76":77,"_78":51,"_79":-5,"_18":277},[19,62],[19,82],"pulls","branches","forks",{"_285":70,"_287":34},"connections",{"_285":34,"_286":34},"count","unfilledCount","emptyCount",{"_36":87,"_13":19,"_63":66,"_65":-5,"_67":68,"_69":70,"_71":72,"_38":190,"_17":34,"_74":89,"_76":-5,"_78":51,"_79":-5,"_103":331,"_18":332},{"_36":81,"_13":82,"_63":83,"_65":66,"_67":68,"_69":70,"_71":72,"_38":198,"_17":34,"_74":75,"_76":85,"_78":51,"_79":-5,"_103":329,"_18":330},{"_36":61,"_13":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_38":195,"_17":34,"_74":75,"_76":77,"_78":51,"_79":-5,"_103":327,"_18":328},{"_36":160,"_13":161,"_63":162,"_65":-5,"_67":68,"_69":70,"_71":72,"_38":163,"_17":34,"_74":89,"_76":-5,"_78":51,"_79":-5,"_103":325,"_18":326},{"_36":183,"_13":184,"_63":185,"_65":162,"_67":68,"_69":70,"_71":72,"_38":186,"_17":34,"_74":24,"_76":187,"_78":51,"_79":-5,"_103":323,"_18":324},{"_36":176,"_13":177,"_63":178,"_65":162,"_67":68,"_69":70,"_71":72,"_38":179,"_17":34,"_74":24,"_76":180,"_78":51,"_79":-5,"_103":321,"_18":322},{"_36":169,"_13":170,"_63":171,"_65":162,"_67":68,"_69":70,"_71":72,"_38":172,"_17":34,"_74":24,"_76":173,"_78":51,"_79":-5,"_103":319,"_18":320},{"_36":114,"_13":115,"_63":116,"_65":-5,"_67":68,"_69":70,"_71":72,"_38":117,"_17":34,"_74":89,"_76":-5,"_78":51,"_79":-5,"_103":317,"_18":318},{"_36":153,"_13":154,"_63":155,"_65":116,"_67":68,"_69":70,"_71":72,"_38":156,"_17":34,"_74":75,"_76":157,"_78":51,"_79":-5,"_103":315,"_18":316},{"_36":146,"_13":147,"_63":148,"_65":116,"_67":68,"_69":70,"_71":72,"_38":149,"_17":34,"_74":75,"_76":150,"_78":51,"_79":-5,"_103":313,"_18":314},{"_36":139,"_13":140,"_63":141,"_65":116,"_67":68,"_69":70,"_71":72,"_38":142,"_17":34,"_74":75,"_76":143,"_78":51,"_79":-5,"_103":311,"_18":312},{"_36":132,"_13":133,"_63":134,"_65":116,"_67":68,"_69":70,"_71":72,"_38":135,"_17":34,"_74":75,"_76":136,"_78":51,"_79":-5,"_103":309,"_18":310},{"_36":125,"_13":126,"_63":127,"_65":116,"_67":68,"_69":70,"_71":72,"_38":128,"_17":34,"_74":75,"_76":129,"_78":51,"_79":-5,"_103":307,"_18":308},{"_36":106,"_13":107,"_63":108,"_65":-5,"_67":68,"_69":109,"_71":72,"_38":110,"_17":70,"_74":24,"_76":111,"_78":51,"_79":-5,"_103":305,"_18":306},{"_36":96,"_13":97,"_63":98,"_65":-5,"_67":68,"_69":32,"_71":72,"_38":99,"_17":100,"_74":101,"_76":102,"_78":51,"_79":-5,"_103":303,"_18":304},[],[97],[],[107],[],[115,126],[],[115,133],[],[115,140],[],[115,147],[],[115,154],[296,297,298,299,300],[115],[],[161,170],[],[161,177],[],[161,184],[292,293,294],[161],[],[19,62],[],[19,82],[289,290],[19],["D",1787174076294],["D",1789521640046],{"_11":12,"_247":243},{"_11":12,"_241":-5,"_242":243,"_208":209,"_244":245,"_246":51},{"_17":109,"_13":16,"_36":68,"_42":201,"_45":37,"_46":44,"_238":53,"_239":43,"_240":57,"_58":14,"_54":12},"ctx",{"_232":-5,"_266":371,"_372":373,"_374":375,"_376":51,"_377":51,"_378":51,"_379":72,"_380":-5,"_381":-7,"_382":-7,"_383":34,"_384":51,"_385":51,"_386":-5,"_387":51,"_388":51,"_389":51,"_390":-5},"ENV",{"_342":343,"_344":345,"_346":16,"_347":348,"_349":350,"_351":352,"_353":354,"_355":356,"_357":358,"_359":360,"_361":362,"_363":364,"_365":366,"_367":368,"_369":370},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]