Documentation platform

Web documentation selected

Creator guide · Web selected

Build and publish a browser-native prototype.

Use HTML, CSS, and JavaScript directly, or export a client-side project built with Three.js, Phaser, React, Svelte, Vue, Vite, or other browser tooling. The selector above updates setup, export, manifest, SDK, and testing guidance without leaving this page.

Currently reading

Web

Direct browser build · HTML, CSS, JavaScript, and frameworks

Your selection is reflected in the URL, saved on this device, and applied to every platform-specific section.

01 / Web setup

Build with Web

Selected: Web

This section changes with the platform selector. Shared packaging, publishing, page, and community guidance stays below it.

01 · Build

Create a static client

Bundle application code, fonts, images, audio, models, and data. Use relative paths for local files.

02 · Integrate

Add platform features

Load the browser SDK for readiness, analytics, scores, storage, seeded randomness, and managed AI.

03 · Package

ZIP the built files

Place index.html at the ZIP root and upload only the files a browser needs at runtime.

Good fit

Choose Web when the browser is your native target

This is the most direct path for interface prototypes, browser games, visualizations, interactive articles, and projects already built with JavaScript or a client-side framework.

Current boundary

Use an engine when the project already depends on one

Do not rebuild an existing Unity or Godot project as hand-written Web code just for Prototir. Select that engine above and follow its supported Web export profile.

Install and connect

Prepare the Web integration

Load the small browser SDK before your application module.

index.html
<script src="https://cdn.prototir.com/sdk/v0.0.1/prototir.js"></script>
<script type="module" src="./app.js"></script>

First integration

Call ready only after the first meaningful interaction is possible.

app.js
Prototir.ready();
Prototir.event('scene_ready');

Supported profile

Design for the browser sandbox

  • Use local assets and relative URLs
  • Declare curated CDN modules in prototir.json
  • Keep JavaScript in external files when possible
  • Use Prototir storage instead of localStorage
  • Request pointer lock from a visitor action
  • Test touch, keyboard, Escape, resize, and fullscreen
  • Do not depend on arbitrary external APIs or sockets

Input and player behavior

Capture intentionally and always give the cursor back

Request pointer lock from a click or pointer action, react to pointerlockchange, and pause when lock is lost. Escape releases pointer lock and restores the cursor automatically.

Test keyboard, touch, focus, Escape, and fullscreen in the Prototir player
Never imitate pointer capture with cursor: none
Disable selection and touch gestures only on a game surface, never across an app by default
Pointer lock lifecycle
const canvas = document.querySelector('canvas');

canvas.addEventListener('click', () => canvas.requestPointerLock());

document.addEventListener('pointerlockchange', () => {
  const locked = document.pointerLockElement === canvas;
  game.setPaused(!locked);
});

// Escape releases pointer lock and restores the cursor automatically.
Optional game-surface CSS
.game-surface,
.game-surface * {
  user-select: none;
  -webkit-user-select: none;
  -webkit-touch-callout: none;
  -webkit-tap-highlight-color: transparent;
}

.game-surface {
  touch-action: none;
}

Text selection and standard page gestures remain enabled by default. Apply this to the gameplay surface only; keep instructions, inputs, and readable app content selectable and scrollable. This styling does not require the Prototir SDK.

02 / Shared contract

Export first, then package the browser-ready result

Prototir hosts finished client files, not a source repository, editor project, or development server. Every build path ends with a ZIP whose root contains an HTML entry and all files required at runtime.

Example · Web build output

Web archive root
my-prototype/
|-- index.html
|-- app.js
|-- styles.css
|-- assets/
|   `-- cover.webp
`-- prototir.json
  • Run the production build or Web export before creating the ZIP.
  • ZIP the output folder's contents, not the output folder itself.
  • Keep assets local and paths relative. Do not require your own server, arbitrary sockets, or undeclared services.
  • Use the runtime-specific Prototir SDK for storage and platform capabilities.
  • Keep the compressed ZIP within the current plan limit: Free 10 MB, Pro 25 MB, Team 50 MB, Enterprise 75 MB.

Web is selected. Changing the platform above updates this export, setup, manifest, SDK syntax, and testing guidance together.

03 / Manifest

Describe the export and its device needs

A root-level prototir.json lets the upload pipeline validate the correct runtime profile, entry, devices, permissions, thumbnail, and platform features. The Unity and Godot SDKs generate it during export; Web creators can write it directly.

Web prototir.json
{
  "entry": "index.html",
  "thumbnail": "auto",
  "devices": ["desktop", "mobile"],
  "orientation": "any",
  "runtime": { "engine": "web", "profile": "standard" },
  "modules": ["three@0.170.0"],
  "permissions": [],
  "ai": { "mode": "disabled" }
}
fieldaccepted valuespurpose
runtimeweb, unity, or godot · standard profileDeclares the engine and exact engine version so Prototir can validate the exported shape.
entryrelative HTML pathUse a generated entry outside the root, which Prototir copies to the served root.
thumbnailauto, or a bundle-relative image pathauto captures the first available visual frame after upload, including an intro or cutscene. A bundle-relative PNG, JPEG, or WebP travels with the ZIP and prototir.json, bypasses runtime capture, and is the deterministic choice when the representative scene appears later. Alternatively, upload a Prototir-hosted custom image (up to 2 MB); it overrides the portable source until you switch back in Studio. The last source you save wins. Use 1280×800 (16:10) where possible. Cards center-crop it to 16:10 and 16:9.
modulesWeb builds · exact name@version specsInjects a validated import map for browser-code projects. Unity and Godot dependencies must be included by their exporter.
permissionscamera, microphoneLets the player ask the visitor before granting device access.
devicesarray of desktop, mobile, xrDeclares every supported device target. Legacy desktop, mobile, and both strings remain accepted.
xrmodes and WebXR featuresRequired when devices contains xr; controls explicit WebXR capability delegation.
orientationany, portrait, landscapeShows the intended viewport orientation.
aidisabled, managedEnables Prototir's provider-neutral managed gateway. API keys, provider names, and model ids do not belong in the manifest.

The curated Web module catalog appears below the SDK section on this page.

Desktop

Supported by every build path. Test keyboard, pointer, focus, audio, resize, and fullscreen.

Mobile

Supported by every path when the experience has touch controls, responsive layout, and a tested orientation.

XR

Use only a target guide that explicitly supports your WebXR stack. Declare xr devices, modes, and features before requesting a session.

04 / SDK

Tell the shell what happened

Web, Unity, and Godot expose the same platform capabilities through APIs shaped for their runtime. The selector above is currently showing Web. Call Ready only after the first meaningful interaction is possible. Preview generation does not wait for this signal, so a cutscene should report readiness only when control reaches the visitor.

JavaScript quickstart
Prototir.ready();
Prototir.event('level_complete', { level: 2 });
Prototir.score(1200);

const random = Prototir.rng('daily-2026-08-24');
CapabilityKindWhat it can do
ReadyfunctionStarts a real session after the prototype becomes interactive.
EventfunctionRecords a small, non-personal milestone. Its normalized name, sessions reached, and total triggers appear in creator analytics. Use stable names made from letters, numbers, _, -, ., or :.
ScorefunctionReports the current numeric score.
StoragememberContains asynchronous get, set, and remove functions for device-local strings scoped to the prototype and signed-in player. Each scope supports up to 64 keys and 64 KiB of UTF-8 data per value.
Managed AImemberContains provider-neutral generate. It is available only when managed AI is enabled.
Seeded RNGfunctionReturns deterministic local randomness. Currently exposed by the browser SDK.

Managed AI

Managed AI is a Pro-and-above feature, and it runs on your plan's daily allowance, never a visitor's. Creators and players do not supply provider keys or pick a vendor. Prototir selects the provider and model behind the tier you choose, automatically falling back to another provider if one is briefly unavailable, scans prompts and replies, and shows an AI-powered disclosure in the player shell. Prompt text leaves the device.

JavaScript storage
await Prototir.storage.set('difficulty', 'hard');
const difficulty = await Prototir.storage.get('difficulty');
await Prototir.storage.remove('difficulty');
JavaScript managed AI
try {
  const answer = await Prototir.ai.generate({
    prompt: 'Give the player a short quest hook.',
    maxTokens: 80
  });
} catch (error) {
  console.warn(error.code, error.message);
}
  • prompt is required and limited to 32,000 characters.
  • maxTokens is optional, must be positive, and is capped at 4,096 output tokens or the remaining allowance.
  • The call rejects with { code, message }. Handle sign_in_required, quota_exceeded, team_fair_share_exceeded, prototype_allowance_exceeded, ai_rate_limited, ai_blocked, moderation errors, provider_error, and timeout.
  • Calls are stateless. Prototir does not maintain a conversation, tools, retrieval, or long-term memory for the prototype.
  • Browser-local inference is not part of this capability yet. Use managed AI for consistent device support.

The rest is configured on the prototype's own page, not in code, under "AI (Prototir.ai)": mode, model tier (fast, cheap and low-latency, or quality, higher-capability and costlier), whether a visitor must sign in to use it, and an optional daily token cap per visitor on top of your own budget. Defaults (managed off, fast tier, sign-in required, your full daily budget per visitor) are chosen to be safe and cheap out of the box. Turning off sign-in lets anonymous visitors use AI too, metered per visitor by IP instead of by account. You still pay either way; there's just no account to individually rate-limit, so it's a frictionless-demo versus coarser-abuse-protection trade.

Fast and Quality each have their own included daily allowance, sized for what they actually cost to run, not one shared number. Once a day's allowance for the tier you're using is spent, AI keeps working out of any purchased AI credits (one-time top-ups you buy from the same panel). Once both are spent, managed AI pauses until the next daily reset, or more credits. A Team org's daily allowances and credits are shared across every prototype the org owns.

Useful events

First action, onboarding completion, important tool use, level completion, creation/export, retry, and a clearly named abandonment point.

Keep telemetry safe

Use stable short names and small values. Never place names, email addresses, free-form messages, secrets, or other personal data in event payloads.

Web only / Curated modules

Reuse browser dependencies without rebundling them

Add exact name@version specs to prototir.json. Prototir validates them, injects the import map, and serves shared files from its CDN. Unity packages and Godot addons belong in their engine projects instead.

Starter modules

Small Prototir-built scaffolds imported into Web code.

modulesizeneedsstatuswhat it does
prefab-audio@0.1.1 2KB-availableGame/app audio over raw Web Audio: load samples from your bundle, play with volume/rate/loop, zero-asset beeps. Replaces maintenance-mode audio shims.
prefab-audio-features@0.1.1 2KBmicavailableAudio-reactive features from a native AnalyserNode: rms, energy, spectral centroid + raw bins. Mic (with consent) or any AudioNode/MediaStream.
prefab-sketch@0.1.1 1KB-availableThe byte-light creative-coding loop: full-window 2D canvas, dpr scaling, resize, draw(ctx, {t, dt, mouse}) — p5 ergonomics at ~1KB.
prefab-hand-controls@0.1.2 7.6MBmediapipe-vision · cameraavailableHand landmarks → pointer/pinch events; camera + MediaPipe HandLandmarker + its model weights bundled in, no separate model pack needed. Reported pointer position is smoothed (configurable) to cut per-frame detector jitter without adding lag to pinch detection.
prefab-voice-input@0.1.0 -model-whisper-tiny · micplannedPush-to-talk → local transcript events.
prefab-i18n@0.1.1 3KB-availableLocalized strings and voice-over from your own bundle: Intl plurals/number/date, per-locale lazy loading, audio fallback chain.
prefab-input@0.2.0 --availableOne input API for desktop and mobile: keyboard, or fully customizable virtual controls — any number of buttons/joysticks/d-pads with position, size, shape and short/long-press semantics; same axes/pressed()/onPress() reads either way.
prefab-shader-canvas@0.1.1 --availableFull-screen fragment shader boilerplate: uniforms for time/mouse/resolution.
prefab-map@0.1.6 3640.0MB on CDN, streamedmaplibre-glavailableEmbeddable vector map: markers, popups, GeoJSON overlays, light/dark/grayscale themes, click/fly-to/pan-and-zoom. Real OpenStreetMap-derived roads, water, and towns worldwide, up to zoom 10 anywhere on Earth - no external tile host or API key, no CSP change, mandatory OSM/Protomaps attribution. The basemap is served on demand over ranged CDN fetches, like a shared image or model asset, not downloaded in full by every prototype that uses it.

Libraries

Third-party browser libraries served from the Prototir CDN and cached across prototypes.

modulesizeneedsstatuswhat it does
three@0.185.1 404KB-available3D rendering — the workhorse for game/art prototypes. (r185 splits into module+core files, both platform-served; r170 stays available.)
pixi@8.6.0 180KB-availableFast 2D WebGL renderer.
phaser@4.2.1 1.4MB-availableBatteries-included 2D game framework (scenes, tilemaps, arcade physics). (Phaser 4; the 3.87 API stays available as phaser@3.87.0.)
p5@2.0.2 309KB-availableCreative coding (p5 2.x). For byte-light sketches see prefab-sketch.
rapier3d@0.19.3 1.4MBwasmavailable3D physics (WASM). Pairs with three. (0.19 fetches its .wasm beside the module instead of embedding it; 0.14 stays available.)
matter@0.20.0 26KB-availableLightweight 2D physics (no WASM).
tone@15.0.4 81KB-availableWeb Audio synthesis & scheduling.
lil-gui@0.20.0 14KB-availableTiny tweak-panel for exposing prototype parameters.
motion@12.42.2 46KB-availableAnimation library (vanilla Motion One API).
chart@4.4.7 69KB-availableCharts for dashboard/tool prototypes.
d3@7.9.0 93KB-availableData-driven documents for bespoke viz.
maplibre-gl@6.0.0 138KB-availableInteractive vector maps (WebGL). The base for prefab-map; import it directly for custom map styling/layers beyond what the prefab exposes.
simplex-noise@4.0.3 3KB-availableProcedural noise.
onnxruntime-web@1.27.0 3.5MBwasmavailableONNX inference runtime (WASM + WebGPU) — the base for model packs.
transformers@3.2.0 800KBwasmplannedPipelines over ONNX: detection, segmentation, depth, ASR, embeddings.
mediapipe-vision@0.10.18 9.8MBcamera · wasmavailableHands / pose / face landmarks — realtime body-driven interaction.

Model packs

Weights and data for a runtime library, shared across compatible Web prototypes.

modulesizeneedsstatuswhat it does
model-rfdetr-nano@1.0.0 30.0MBonnxruntime-webplannedRF-DETR nano object detection weights — real-time DETR in the browser. (YOLOv8 excluded: AGPL.)
model-whisper-tiny@1.0.0 40.0MBtransformers · micplannedLocal speech-to-text — voice-controlled prototypes with zero API cost.
model-depth-anything-small@1.0.0 50.0MBtransformersplannedMonocular depth from the webcam — parallax/AR-ish effects.

Capabilities

Platform features brokered by the SDK rather than import-map downloads.

modulesizeneedsstatuswhat it does
capability-ai@sdk SDK-availableProvider-neutral managed AI generation through Prototir.ai. The sandbox has connect-src 'none'; requests hop through the shell to a metered, moderated gateway. Prototir owns credentials and routing, while the prototype owner's paid plan and AI credits fund usage; signed-in visitors never spend their own allowance.
capability-storage@sdk SDK-availablePer-prototype key-value persistence. Opaque-origin iframes have no reliable localStorage; the shell stores device-local values per prototype and isolates signed-in players on shared browsers.
capability-permissions@sdk SDK-availableCamera/microphone: declared in prototir.json, granted via iframe allow= after an explicit shell-level user consent prompt.

05 / Quality

Design for an unfamiliar visitor

First ten seconds

Show what can be touched, clicked, typed, dragged, or controlled. Avoid an unexplained blank canvas or loader with no progress.

Viewport

Fill the available player, react to resize and fullscreen changes, avoid fixed desktop-only dimensions, and honor the declared orientation.

Input

Test keyboard, pointer, touch, focus, Escape, and visible controls using the APIs or input system of your selected runtime. Pointer lock must start from a visitor action and release cleanly.

Recovery

Give visitors a restart path, useful empty states, and a clear response when an optional permission, storage call, or AI request is denied.

Performance

Compress exported assets, defer secondary content, cap rendering cost, and test the first load on a real phone and ordinary connection.

Accessibility

Use readable contrast, semantic or accessible controls, labels, keyboard access, reduced-motion handling, and alternatives to audio-only or color-only information.

The selected platform's interaction details stay in context

The Web input, fullscreen, canvas, and sandbox checks are in the setup section above. Change the platform selector to replace them without opening another guide.

06 / Page setup

Help the right people understand it

  • Title: identify the idea, not its internal build number.
  • Category: choose game, app, art, or showcase as the broad format.
  • Prototype tags: add up to five descriptors for mechanics, audience, technology, or subject. Existing normalized tags are reused despite case, spacing, or underscore differences.
  • Description: explain what to try, what is unfinished, intended device/input, and the question you need answered. Links open through Prototir's external-site warning.
  • Feedback tags: these are separate from prototype tags. They structure what commenters observed, such as confusing, delightful, slow, or would-use.
A useful description: “Try creating a two-stop route on mobile. The map is mock data. I want to learn whether the order controls are understandable without a tutorial.”

07 / Source

Make reuse traceable

Only publish files you own or are allowed to distribute. Keep third-party license and attribution files in the bundle. If you enable source download, choose a license that actually grants the permissions you intend.

Open source

Visitors can download the source under your stated license. Platform-generated provenance is added to the downloaded manifest.

Remix

Declare the source slug or re-upload a Prototir download. The origin remains linked and conflicting lineage is rejected.

Template

A template is a complete open-source starter prototype. Its downloads carry template provenance into later uploads.

Explore templates

08 / Protection

Protect the master, publish the runtime copy

Anything a browser renders is delivered to that browser. An authorized visitor can inspect network requests and save JavaScript, models, textures, audio, video, WebAssembly, and data. Private visibility prevents anonymous access, but it cannot stop an invited viewer from capturing files they are allowed to run. This is equally true for direct Web code, Unity WebAssembly, and Godot Web exports.

What build protection does

The publisher can rewrite served .js files into compact, less-readable code. This deters casual copying; it is not encryption or DRM. It does not transform WebAssembly, engine data files, .mjs, inline code, source maps, models, textures, or other assets. Unity and Godot already compile/package much of their runtime output, but that output is still downloadable. The retained original ZIP remains unchanged.

How to publish valuable 3D work

Keep production masters outside the ZIP. Export a runtime derivative: remove editor data and source maps, reduce geometry and texture resolution, use formats such as GLB with Draco or Meshopt and KTX2 where appropriate, and consider a visible or forensic watermark. Compression and renamed files add friction, but do not make client-rendered assets secret.

Rule of thumb: if disclosure would cause serious harm, do not include that file in a browser-delivered prototype. Use a reduced derivative, a watermark, or a server-side rendering approach instead.

09 / Publish

Run the release checklist

  1. 1. Build locally. Open the production output through a local static server, not directly from the filesystem.
  2. 2. Test the sandbox assumptions. Remove arbitrary network dependencies, externalize scripts, and test without hidden environment variables.
  3. 3. ZIP the output contents. Check the archive root, compressed size, entry file, relative assets, manifest, and license files.
  4. 4. Complete the public page. Choose the publishing identity, category, tags, description, lineage, and rights confirmation.
  5. 5. Set publication behavior. Review visibility, comments, tips, source downloads/templates, embed access and domains, badge visibility, build protection, and optional release details before submitting.
  6. 6. Verify after processing. Prototir runs the candidate in the same opaque-origin sandbox and keeps it unlisted if startup throws an uncaught error. A failed Studio row opens a prefilled repair editor on the same prototype: it identifies the failed check with a stable diagnostic code, explains what to change, and lets you edit metadata, upload a replacement ZIP, or delete the prototype. New manifest values are shown as highlighted changes before the replacement is queued. Runtime-failing builds remain available to their owner and collaborators for testing while forced unlisted. After a build passes, try the player on desktop and mobile and check permissions and analytics events.

Replace without spending another slot

A replacement is an internal build of the same prototype. It keeps the stable URL, comments, and aggregate analytics, and does not count as another Free, Pro, or Team prototype. The current build stays live while the candidate is tested.

Choose rollback or cleanup

Keep the previous ZIP/build for instant rollback, or remove those files automatically only after the new build passes. Studio can also remove an inactive build later. Comment attribution remains, and active or event-pinned builds are protected. Publish a separate public release only when you want another listing, URL, and prototype slot.

Open the publisher

10 / Events

Use a jam or challenge for a focused question

Jam

A creation event with prototype entries. It can run online, in person, or as a hybrid, with a public venue and an optional HTTPS participation link where appropriate.

  • Choose visibility independently: public is listed, unlisted works by link, and private is visible only to invited accounts and entrants.
  • Choose admission independently: open entry, host approval after an application, or invitation only. Private jams always require invitations.
  • Accept an existing live prototype or a new upload.
  • Set the submission window, optional separate voting window, bundle limit, and winner method: community, invited jury, or host selection.
  • The judged version is captured at submission time.
  • A user-hosted merit prize needs a named provider and official rules. The host handles eligibility, legal compliance, judging, delivery, taxes, and disputes.
Browse jams

Challenge

A score race on one of the host's live prototypes. The prototype reports scores through the SDK and real sessions form the leaderboard.

  • Public challenges require a real-use history.
  • Choose a general, creator-regular, or category-expert participation gate.
  • Private challenges remove the experience wall and admit named participants.
  • Use seeded randomness when every run should be comparable.
Browse challenges
Before hosting: write one clear prompt, define who may enter, give enough time to build and test, state the judging method, publish conduct and eligibility rules, and explain how results are announced. For a physical event, publish only a suitable public venue. For prizes, read the event terms and obtain legal advice where needed. Creating either event currently requires Pro or higher.
Host an event