Banodoco bundle starter

A minimal working starter for a bundle-mode post on Banodoco. Bundle mode lets you upload a pre-built static site (HTML + CSS + JS + assets) as a ZIP; Banodoco renders it inside a sandboxed iframe on your post page.

Quick start

gh repo clone banodoco/bundle-starter my-post
cd my-post
# edit index.html, post.json, add assets
zip -r bundle.zip post.json index.html README.md
# upload bundle.zip from the Bundle tab on https://banodoco.com/submit/post

That's it. No build step required. If you want a build step (Vite, Parcel, Next static export, etc.), point the output at a dist/ directory and zip dist/* — post.json and index.html must sit at the ZIP root.

What's in this starter

bundle-starter/
├── post.json   # manifest — describes your bundle to Banodoco
├── index.html  # entry point, with a postMessage resize snippet for inline-auto
└── README.md   # this file

The manifest — post.json

{
  "schemaVersion": 1,
  "title": "Your post title",
  "summary": "Plain-text description, 0–200 chars. Used for SEO meta and link previews.",
  "entry": "index.html",
  "layout": {
    "mode": "inline-auto",
    "minHeight": 320,
    "maxHeight": 1600
  },
  "capabilities": {
    "scripts": true,
    "popups": false,
    "pointerLock": false
  }
}

Layout modes

• inline-auto (default, recommended): Banodoco resizes the iframe to fit your content. Your page must emit postMessage({ type: 'banodoco:resize', v: 1, height: N }, '*') whenever its height changes — the snippet in index.html does this.
• inline-fixed: you pick a height. Replace minHeight/maxHeight with "height": 600 (px) or "height": "70vh".
• fullscreen: your bundle fills the viewport minus a thin back-button + attribution chrome.

Capabilities

Off by default. Opt in by setting to true:

• popups: needed if you open new tabs via window.open() or target="_blank".
• pointerLock: needed for FPS-style mouse capture.

What you can do

Anything client-side: WebGL, Three.js, D3, Canvas, Web Audio, Web Workers, WebAssembly, client-side ML (ONNX, TFJS), interactive essays, games, simulations, portfolios. unsafe-eval is allowed so Three.js / shader compilation / WASM all work.

What you can't do (by default)

• No external network. CSP locks you to connect-src 'self'. If you need to fetch from your own API, declare the origin in post.json as "external_origins": ["https://api.example.com"] — admin review will confirm before public serving.
• No parent-page access. Bundles run on a cross-origin iframe; you can't read Banodoco cookies, the viewer's identity, or the parent DOM.
• No forms, no modals (alert / confirm / prompt), no downloads, no top-navigation. These sandbox permissions are intentionally off.
• Camera / microphone / geolocation / payment are blocked by Permissions Policy.
• No server code. The bundle is fully static; Banodoco does not run your code server-side.

Limits

• 20 MB ZIP compressed max
• 20 MB uncompressed total
• 10 MB per file
• 500 files
• 50:1 expansion ratio cap (zip-bomb protection)
• File extensions allowlisted: .html .css .js .mjs .json .svg .png .jpg .jpeg .webp .gif .avif .ico .mp4 .webm .ogg .mp3 .wav .woff .woff2 .ttf .otf .txt .md .wasm
• No .., absolute paths, or symlinks

Using with an AI coding agent

Paste the prompt from the Bundle tab's "Copy agent prompt" button into Claude Code, Cursor, Aider, or any coding agent. The prompt encodes all the rules above plus the post.json shape so the agent builds a compliant bundle without reading the full design doc.

Full spec

See docs/posts-bundle-mode.md in the main Banodoco website repo for the authoritative design: CSP directives, iframe sandbox tokens, manifest validation rules, error codes, and the admin review workflow.

License

Public domain — do what you want with this starter.