A little app should be allowed to behave like a document.
Capsule packs an HTML interface, assets, and local SQLite-backed data into one .capsule file. Its current pitch is deliberately mundane: recipe books, todo lists, expense trackers, notes, flashcards, presentations, and time sheets that can be sent like a PDF instead of provisioned like SaaS.[1] That category has been underserved precisely because building the screen became easy while owning and moving the state stayed weird.
The project author’s Hacker News description adds the useful machinery: Capsule is built with Rust and Tauri 2.0; documents can use a key/value API or a collection-style API; assets can live in the database; data can leave as CSV or JSON. Files do not receive filesystem access by default and need permission for network access. The author also names the awkward bit rather than hiding it: two people editing copies create divergent files, so records carry UUIDs and timestamps to make future merging possible.[2]
The file is not merely storage. It is the deployment unit, branch, backup, and handoff.
Local-first is a topology, not a halo.
“No cloud” removes a vendor account and a remote database from the hot path. It does not automatically provide backup, collaboration, authentication, revocation, or conflict handling. A personal tracker can happily treat copy-on-share as a feature. A shared operational tool cannot pretend that two edited copies are one truth.
The same discipline applies to the runtime. Standard HTML and CSS make content inspectable, but a host capable of executing bundled application code still needs a permission model, a trustworthy update path, and clear file-format compatibility. Network-off-by-default is the right starting posture. The useful receipt is not “offline”; it is which capabilities this file requested, which the user granted, and what changed.
The browser version proves why storage details matter.
SQLite’s official WebAssembly documentation offers multiple persistence paths, not one magic “local” mode. Small key/value-backed databases face tight browser storage limits. OPFS can persist larger databases, but it operates in worker contexts, has browser-version constraints, and makes concurrency a real design decision. Some VFS options favor performance; others favor multiple-tab access. SQLite’s docs explicitly warn that desktop-grade concurrency is not something browser apps get for free.[3]
That makes Capsule’s web preview exactly what it calls itself: a preview. The site says it cannot directly open or save files on the computer, while the desktop player handles the portable artifact.[1] That boundary is healthy. Product surfaces should admit when the runtime changes the guarantee.
Ship the file with four things visible.
Runtime: name the player and minimum compatible version. Capabilities: show filesystem, network, model, camera, and other grants before code runs. Escape hatch: make CSV, JSON, media, and schema export boring and testable. Fork policy: declare whether a copy is a backup, a new branch, or mergeable state—and prove the merge on ugly conflicts, not only happy-path UUIDs.
This is not paperwork taped onto a clever format. It is what turns portable software from a demo into a durable object. The glovebox below replaces the vague “share app” button with a route-aware handoff manifest: choose where the file is going, close only the interlocks you actually enforce, and copy the resulting contract.