# Browser apps and games
## Supported now
Upload one self-contained HTML file or a ZIP of a finished browser distribution: HTML, CSS, JavaScript, supported assets and WASM. Eight serves it from an isolated content origin. It does not run uploaded code in the platform's server runtime.

## Bundle contract
| Requirement | Current value |
| --- | --- |
| Entry point | HTML; default `index.html` |
| Multipart upload ceiling | 50 MiB |
| MCP inline file ceiling | 4 MiB |
| Expanded bundle ceiling | 50 MiB |
| Bundle file count | Up to 200 |
| ZIP compression | Stored or standard deflate |
| Optional network origins | Up to five declared public HTTPS origins |

Use relative asset paths. Export a Vite distribution with a relative base, for example `vite build --base=./`, then ZIP the built files. Keep the chosen entry and its assets at the paths you declare. Do not upload a source repository expecting Eight to run npm install or a build.

Absolute, traversal, hidden, duplicate or unsupported archive paths are rejected. The upload response returns a real artifact ID, work ID, version and preview URL.

## Runtime
Scripts, pointer lock and downloads are permitted within the sandbox. The native content policy deliberately omits `allow-same-origin`; localStorage, IndexedDB and other persistent browser state are not part of the current contract. Service workers, nested frames, arbitrary forms and app server processes are not supported. See [storage](/docs/storage).

The viewer leaves arrow keys available to the focused game. Provide touch controls and a layout that works in both orientations. Do not depend on the parent page's DOM or Eight's cookies.

## External assets and APIs
Bundle assets when possible. Otherwise declare exact HTTPS origins in the optional `network` array when uploading. The destination must also allow your browser request, including CORS from an opaque origin where necessary. Declaring an origin does not create an API, grant a subscription or make it safe to embed a secret.

## Test before publication
Check a real private preview on desktop and phone, keyboard/touch input, resize, audio activation and reload. Test what a signed-out visitor receives after publication. Record any unavailable feature honestly.

## Bundle asset extensions
The current allowlist is .html, .htm, .css, .js, .mjs, .json, .wasm, .png, .jpg, .jpeg, .webp, .gif, .svg, .ico, .woff, .woff2, .ttf, .otf, .mp3, .wav, .ogg, .mp4, .webm, .txt, .md, .pdf, .glb, .gltf and .bin. A file allowed inside a bundle is not necessarily accepted as a standalone media upload.

For the underlying browser behavior, see [the HTML sandbox specification](https://html.spec.whatwg.org/dev/iframe-embed-object.html). Eight's deployed content policy remains the supported product contract.