DraftDrop

Publish a self-contained HTML plan as a public static review link. DraftDrop needs no account, and every update creates an immutable version.

Quick start

Run the CLI without installing it globally:

npx --yes draftdrop upload ./plan.html

Or install the command:

npm install --global draftdrop
draftdrop upload ./plan.html

The CLI validates the HTML before uploading it. It stores the draft edit secret in ~/.draftdrop/drafts.json with file mode 0600. Uploading the same absolute file path updates the same draft and creates a new version.

DraftDrop automatically reads an existing ~/.planpub directory when ~/.draftdrop does not exist, so earlier draft edit secrets keep working.

Commands

Publish or update a plan:

draftdrop upload ./plan.html

Create a separate draft for the same file:

draftdrop upload ./plan.html --new

List plans known to this machine:

draftdrop list
draftdrop list --json

Use another DraftDrop server:

draftdrop config --api-url http://localhost:3000

You can also set DRAFTDROP_API_URL for one command:

DRAFTDROP_API_URL=http://localhost:3000 draftdrop upload ./plan.html

Security boundary

Published documents are public and served byte for byte with a restrictive Content Security Policy.

• Scripts and network requests cannot execute.
• DraftDrop rejects forms, iframes, embeds, external scripts, event handlers, unsafe URL schemes, and meta refresh.
• Inline CSS and HTTPS or data URL images are allowed.
• Each HTML document is limited to 512 KiB.
• Stored versions are limited to 2 GiB by default through MAX_STORAGE_BYTES.
• Updates require a random edit token stored by the CLI. A public draft URL cannot update a draft.

Do not publish private company information.

Run the server locally

npm install
npm test
PUBLIC_BASE_URL=http://localhost:3000 npm start

Persistent data defaults to .data/. The production container stores it in /data.

Publish the npm package

npm login
npm publish

The prepublishOnly script runs the complete test and syntax check before npm uploads the package.

Provenance

The HTML policy and wire format are compatible with ideas in the MIT-licensed [email protected] package. This implementation uses its own branding and adds draft-scoped edit secrets for anonymous updates. See NOTICE.