{title}

Saved in this browser on this device.

\n \n

\n {projects.map((project) => (\n

\n \n \n

\n ))}\n

\n {projects.length === 0 &&

No saved projects yet. Start a new one!

}\n

\n );\n}\n\nexport function ActivitySaveBar({ status, onProjects }: { status: Status; onProjects: () => void }) {\n return (\n

\n \n \n {status === \"saving\" ? \"● Saving…\" : status === \"error\" ? \"⚠ Couldn’t save\" : \"✓ Saved\"}\n \n

\n );\n}\n","deleted","label",[81,82,61],"frontend","components",{"_36":105,"_13":81,"_62":106,"_64":-5,"_66":67,"_68":73,"_70":71,"_38":107,"_17":34,"_74":108,"_76":-5,"_78":51,"_79":-5,"_93":109,"_18":110},{"_36":96,"_13":97,"_62":98,"_64":-5,"_66":67,"_68":99,"_70":71,"_38":100,"_17":101,"_74":24,"_76":102,"_78":51,"_79":-5,"_93":103,"_18":104},{"_36":86,"_13":87,"_62":88,"_64":-5,"_66":67,"_68":89,"_70":71,"_38":90,"_17":73,"_74":91,"_76":92,"_78":51,"_79":14,"_93":94,"_18":95},"c3f39a70-86c4-4b1c-bb8f-27abf5629b75","index.ts","019fb401-dc04-779a-98cc-bb5991078e25",79,["D",1785507616781],"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\n\nconst app = new Hono();\n\n// Serve the (never-cached) HTML shell at the root /\napp.get(\"/\", (c) => c.html(Root()));\n\n// Give YouTube embeds a normal web origin, including when a downloaded\n// project is opened directly from Files or a local folder.\napp.get(\"/youtube/:id\", (c) => {\n const id = c.req.param(\"id\");\n if (!/^[a-zA-Z0-9_-]{6,}$/.test(id)) return c.text(\"Invalid YouTube video\", 400);\n\n return c.html(`\n\n\n \n \n YouTube video\n \n\n\n \n\n`);\n});\n\n// Serve frontend files at the version-addressed URLs Root() stamps, cached immutably\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Add your API routes here\n// app.get(\"/api/data\", c => c.json({ hello: \"world\" }));\n\n// Unwrap and rethrow Hono errors as the original error\n// If you delete this, all errors will be \"Internal Server Error\"\napp.onError((err) => Promise.reject(err));\n\n// HTTP vals expect an exported \"fetch handler\"\n// This is how you \"run the server\" in Val Town with Hono\nexport default app.fetch;\n","children",[],[87],"0f644367-34a9-40c6-b1a6-ff78668eb63d","README.md","019fb401-dc04-779a-98cc-b5616de19757",116,["D",1785633881128],3,"# HTML Writing Lab\n\nA collection of beginner-friendly HTML writing activities for young web makers.\n\n## Activities\n\n- Make Your First Website\n- Tell a Hypertext Story\n- Choose Your Own Adventure\n- Make a Web Poem\n- Build a Whole Website\n- HTML Snippet Board\n\nThe activities introduce HTML structure, text, links, images, audio, video, and simple page-to-page navigation. Each builder includes a live preview and produces downloadable HTML.\n\nLive site: https://firstpage.val.run/\n\n## Architecture decision records\n\n### ADR-001: Sanitize student-authored HTML before rendering\n\n- **Status:** Accepted\n- **Date:** 2026-08-01\n\n#### Context\n\nThe advanced website activity stores each page body as an HTML string. React does not interpret a string as elements by default, so the visual editor and preview use `dangerouslySetInnerHTML` to turn that string into rendered HTML.\n\nThat API is necessary for the current visual editing experience, but unsanitized HTML is an injection sink. A script element inserted through `innerHTML` normally does not execute, but event attributes such as `onerror`, dangerous URL schemes such as `javascript:`, and other active markup can still execute in the application document.\n\nAlthough projects currently remain in the student's browser, students may paste examples from the web and future versions may support importing or sharing projects. User-authored HTML must therefore be treated as untrusted.\n\n#### Decision\n\nAll advanced-page HTML is sanitized with DOMPurify before it:\n\n1. Enters the WYSIWYG editor.\n2. Enters the visual preview.\n3. Is included in a downloaded website.\n4. Is accepted as rich HTML from the clipboard.\n\nThe sanitizer uses an allowlist intended for the lesson:\n\n- Elements: headings, paragraphs, emphasis, links, images, lists, blockquotes, and line breaks.\n- Attributes: `href`, `src`, `alt`, and `title`.\n\nScripts, event-handler attributes, embeds, styles, data attributes, ARIA attributes, and unsupported elements are removed. Toolbar-created web links and image URLs must use `http://` or `https://`. Internal page links continue to use controlled relative filenames.\n\nRaw text may still be written in HTML mode so students can see and correct their source, but only sanitized output is rendered or downloaded.\n\n#### Consequences\n\n- Student-authored HTML cannot execute JavaScript in the main First Page application through the supported editor flow.\n- Pasting formatted text continues to work, but unsupported formatting is removed.\n- Advanced users cannot add scripts, iframes, custom CSS, forms, or arbitrary attributes in this activity.\n- Adding a new supported HTML feature requires deliberately expanding the sanitizer allowlist.\n- Sanitization is the primary control. A sandboxed preview iframe and a strict Content Security Policy remain recommended defense-in-depth improvements.\n\n",[],[97],"17ae220a-6dc4-4ed9-bfd2-7ab3f582c2d3","019fb401-dc04-779a-98cc-ad389a503384",["D",1785431448217],"directory",[111,112,113,114,115,116],[81],{"_36":222,"_13":82,"_62":65,"_64":106,"_66":67,"_68":73,"_70":71,"_38":223,"_17":34,"_74":108,"_76":-5,"_78":51,"_79":-5,"_93":224,"_18":225},{"_36":149,"_13":150,"_62":151,"_64":106,"_66":67,"_68":152,"_70":71,"_38":153,"_17":34,"_74":108,"_76":-5,"_78":51,"_79":-5,"_93":154,"_18":155},{"_36":142,"_13":143,"_62":144,"_64":106,"_66":67,"_68":73,"_70":71,"_38":145,"_17":34,"_74":24,"_76":146,"_78":51,"_79":-5,"_93":147,"_18":148},{"_36":134,"_13":135,"_62":136,"_64":106,"_66":67,"_68":137,"_70":71,"_38":138,"_17":73,"_74":75,"_76":139,"_78":51,"_79":-5,"_93":140,"_18":141},{"_36":125,"_13":126,"_62":127,"_64":106,"_66":67,"_68":128,"_70":71,"_38":129,"_17":130,"_74":75,"_76":131,"_78":51,"_79":-5,"_93":132,"_18":133},{"_36":117,"_13":118,"_62":119,"_64":106,"_66":67,"_68":120,"_70":71,"_38":121,"_17":34,"_74":75,"_76":122,"_78":51,"_79":-5,"_93":123,"_18":124},"84a5946c-d0b4-4237-b01c-d9f7332acd95","storage.ts","e92977b8-9cc8-11f1-9e55-1607ee4eb77e",140,["D",1787252214343],"export type SavedFirstWebsite = {\n id: string;\n name: string;\n updatedAt: number;\n step: number;\n project: Record;\n};\n\nconst DB_NAME = \"firstpage\";\nconst DB_VERSION = 1;\nconst STORE = \"projects\";\n\nfunction openDatabase(): Promise {\n return new Promise((resolve, reject) => {\n const request = indexedDB.open(DB_NAME, DB_VERSION);\n request.onupgradeneeded = () => {\n const db = request.result;\n if (!db.objectStoreNames.contains(STORE)) {\n const store = db.createObjectStore(STORE, { keyPath: \"id\" });\n store.createIndex(\"updatedAt\", \"updatedAt\");\n }\n };\n request.onsuccess = () => resolve(request.result);\n request.onerror = () => reject(request.error);\n });\n}\n\nfunction requestResult(request: IDBRequest): Promise {\n return new Promise((resolve, reject) => {\n request.onsuccess = () => resolve(request.result);\n request.onerror = () => reject(request.error);\n });\n}\n\nexport async function listFirstWebsites(): Promise {\n const db = await openDatabase();\n try {\n const projects = await requestResult(db.transaction(STORE, \"readonly\").objectStore(STORE).getAll()) as SavedFirstWebsite[];\n return projects.sort((a, b) => b.updatedAt - a.updatedAt);\n } finally {\n db.close();\n }\n}\n\nexport async function getFirstWebsite(id: string): Promise {\n const db = await openDatabase();\n try {\n return await requestResult(db.transaction(STORE, \"readonly\").objectStore(STORE).get(id));\n } finally {\n db.close();\n }\n}\n\nexport async function saveFirstWebsite(project: SavedFirstWebsite): Promise {\n const db = await openDatabase();\n try {\n await requestResult(db.transaction(STORE, \"readwrite\").objectStore(STORE).put(project));\n } finally {\n db.close();\n }\n}\n\nexport async function deleteFirstWebsite(id: string): Promise {\n const db = await openDatabase();\n try {\n await requestResult(db.transaction(STORE, \"readwrite\").objectStore(STORE).delete(id));\n } finally {\n db.close();\n }\n}\n",[],[81,118],"55b836cf-367f-4bc6-a7f1-ac60212817fe","root.tsx","019fb401-dc04-779a-98cc-aa62523f023e",44,["D",1785442667213],4,"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport function Root() {\n return (\n <>\n {raw(\"\")}\n \n \n \n \n \n HTML Writing Lab\n \n \n \n \n `);\n\n return (\n

● ● ● LIVE WEBPAGE

{title}

{project.name}