Sign in

Draft. This page may change before it is final.

Frameworks

Carnival hosts the output of a build: plain files. Run the project's build, then publish the contents of its output folder, with index.html at the top level. Never the project itself: source, package.json and node_modules are refused.

Output folders

Tool Build Publish the contents of Settings
Plain HTML none the folder that holds index.html none
Vite (React, Vue, Svelte and other Vite apps) npm run build (vite build) dist/ keep base at /
Astro npm run build (astro build) dist/ keep the default static output (output: 'static')
Next.js next build with output: 'export' out/ a static export only (below)
Eleventy npx @11ty/eleventy _site/ keep pathPrefix at /
Hugo hugo --baseURL / public/ links from the site's root (below)

Another tool: publish the folder its build writes, the one with index.html at its top. A site whose start page has another name needs it renamed to index.html.

Next.js

Carnival hosts a Next.js app as a static export. In next.config.mjs:

/** @type {import('next').NextConfig} */
const nextConfig = {
  output: 'export',
  images: { unoptimized: true }, // next/image without an image server
};

export default nextConfig;

next build then writes out/. A static export can't use what needs a server: API routes and route handlers that read the request, middleware, server actions, rewrites, redirects and headers in the config, incremental static regeneration, and dynamic routes that aren't generated at build time (generateStaticParams). An export usually has more than 30 files: send them over several calls with finalize=false (the recipe is in Read this first).

Hugo

Hugo writes absolute links from baseURL, and a Carnival site's address is only known after its first publish. Build with hugo --baseURL / so links start at the site's root.

Files Carnival accepts

Caching

Pages and most files revalidate on every visit, so the next visit after an update gets it (updates go live within about 12 seconds). Files whose names end in a build hash (like index-BxK3f9aQ.js or main.3f9a1c2b.css) are cached by browsers for a year: build tools give a changed file a new name. A hand-made name can look like one: change photo-20240101.jpg and it needs a new name too.

What sites can't do

Carnival sends the same fixed headers with every site's files:

Scripts, forms and embeds

House rules

Carnival checks every deploy against the content policy before it goes live. House rules are the technical part an agent can fix: a hit comes back in filter.reasons with rule, path, line and fix.

These stop the publish (CONTENT_REJECTED):

Rule The site has Do instead
H-PASSWORD a password field link to a service that hosts the sign-in
H-CARD card number, CVV or expiry fields link to a hosted checkout, or take payment on pickup
H-GOVID government ID fields (SSN, SIN, CURP, RFC, passport, driver's licence, tax ID) collect them in person or through a service built for it
H-SEED wallet recovery phrase or private key fields remove them
H-EXFIL-CHAT code sending data to Telegram bots, or Discord or Slack webhooks use a form service such as Formspree or Tally
H-SECRET-KEY a private or API key remove it, and tell the user to rotate the key
H-REDIRECT-ONLY a page that only sends visitors to another site publish the page's own content, or link to the other site
H-IFRAME-FULL another site shown full-screen in a frame link to it, or embed from a supported service
H-EXEC programs, installers or archives, or links to them link to the official app store or vendor page
H-PDF-ACTIVE a PDF with JavaScript, a launch action or an embedded file export it again as a plain PDF
H-MINER a cryptocurrency miner remove it
H-DRAINER wallet approval or signing requests link to the project's official app
H-IMAGE-BATCH more than 8 new images, or one over 2 MB, from a new account resize the images, publish, then add the rest in an update

These let the site go live, but Carnival may review it and take it down: apply the fix as an update.

Rule The site has Do instead
S-NOTIF a notification permission request when a page opens remove it
S-OTP one-time, 2FA or verification code fields remove them: a static site has nothing to verify
S-BANK bank account, routing, IBAN or PIN fields link to a hosted payment page
S-FORM-ODD a form that submits to an IP address, a link shortener, a data: URL or javascript: point it at a form service
S-REDIRECT a page that redirects visitors to another site use a normal link
S-SHORTENER links through URL shorteners link to the full address
S-OBF-PACKER, S-OBF-OBFUSCATOR, S-OBF-ESOTERIC packed, obfuscated or encoded JavaScript publish the normal build (minified is fine)
S-EVAL-DECODE code that runs decoded strings with eval, new Function or setTimeout ship the code directly
S-COOKIE-DOMAIN cookies set for a parent domain, or more than 4 KB of them drop the domain attribute; use localStorage
S-DOWNLOAD download links to files on other sites link to the page that offers the file
S-HIDDEN-TEXT a lot of hidden text make it visible or remove it; keep screen-reader-only text short

Scripts from unrecognised hosts, unrecognised form services, service workers and development builds come back as the warnings above, in warnings, not as rules.

This page as Markdown