App artifacts & prototypes
How Nova composes, renders, publishes, and shares interactive HTML app artifacts — the chrome-at-render-time model and the sandboxed inline-JS runtime.
App artifacts are interactive HTML pages produced by Nova agents (most often the prototyper agent). They are kind:"html" records in the library that render full-bleed in a sandboxed iframe — including any inline JavaScript the agent wrote.
Chrome-at-render-time
An agent does not emit a whole self-contained HTML document with the Nova design-system CSS baked in. Instead it emits only the content area markup plus a chrome id. The full document is composed at render time by composeHtmlPrototype() (lib/library/html-prototype.ts), which wraps the content in the chosen chrome — and the chrome owns the shared CSS.
This keeps stored artifacts small and means a design-token change only has to happen in one place. There is a single composition function used by every renderer, editor, and download path, so what you preview is exactly what gets published.
The available chromes (HTML_CHROMES) are:
| Chrome | Use for |
|---|---|
marketing | A public-facing page a Nova user would publish — published-site navbar + content + footer. |
admin | A Nova product surface — toolbar with brand + user menu over a centered content column. |
canvas | The Nova /designer experience — topbar, multipage toolbar, canvas, and properties panel. |
The spec shape the renderer accepts:
// New shape — composed against a chrome at render time:
{ chrome: "marketing" | "admin" | "canvas", contentHtml: "<section>…</section>" }
// Legacy passthrough — a complete document is returned as-is:
{ html: "<!doctype html>…" }If a spec matches neither shape, the renderer returns a minimal empty document — it never throws.
Interactive inline JavaScript
App artifacts can include inline <script> — buttons, form logic, small interactions all run. They render inside an iframe with:
<iframe sandbox="allow-scripts" srcDoc={composedDocument} />allow-scripts is granted without allow-same-origin. Scripts execute, but the document is treated as a unique opaque origin: it cannot read cookies, localStorage, or anything tied to the Nova origin, and cannot reach back into the host page. This is what lets a generated prototype be interactive while staying fully isolated from the dashboard and from other users' data.
Publishing & sharing
An artifact is published by assigning it a slug in the unified publish framework. Once published it is reachable at the public reader URL:
/p/r/{slug}r is the publishable-type code for artifact (the reader also serves d documents, t threads, s skills, f flows, a agents, and c composio-presets). Public reader pages are marked noindex so they aren't ranked by search engines.
Who can view a published artifact is governed by its visibility tier and per-user share list — see Access & sharing.
The nova.* SDK (Preview)
Preview — not yet shipped. The following describes a planned capability. It is not available in the current runtime and there is no
nova.*global in published artifacts today.
A future SDK is planned to give app artifacts a small, sandboxed data API (for example nova.table(...) for persistence) without breaking the same-origin isolation described above. Until it ships, treat artifacts as self-contained: all state lives in the document, and any persistence must go through an agent/flow, not from inside the iframe. This section will be updated with the concrete surface when the SDK is released.
Authentication
How callers authenticate to the Nova Admin API — session cookies for the dashboard, API keys with scopes for programmatic access.
Access & sharing
The unified visibility model for published entities — public, workspace, and private tiers plus the per-user sharedWith ACL, and the /p/{type}/{slug} reader URL.