= {};
+ const jwkRaw = env.OAUTH_PRIVATE_KEY_JWK?.trim();
+ if (!jwkRaw) {
+ problems.push(
+ 'OAUTH_PRIVATE_KEY_JWK is required (ES256 private JWK; generate with `deno task generate-key`)'
+ );
+ } else {
+ try {
+ oauthPrivateKeyJwk = JSON.parse(jwkRaw);
+ if (oauthPrivateKeyJwk.kty !== 'EC' || oauthPrivateKeyJwk.crv !== 'P-256') {
+ problems.push('OAUTH_PRIVATE_KEY_JWK must be an EC P-256 (ES256) key');
+ }
+ if (!oauthPrivateKeyJwk.d) problems.push('OAUTH_PRIVATE_KEY_JWK must be a private key');
+ if (!oauthPrivateKeyJwk.kid) problems.push('OAUTH_PRIVATE_KEY_JWK must include a kid');
+ } catch {
+ problems.push('OAUTH_PRIVATE_KEY_JWK is not valid JSON');
+ }
+ }
+
+ if (problems.length > 0) {
+ throw new Error(`Invalid configuration:\n - ${problems.join('\n - ')}`);
+ }
+
+ return { appUrl, allowedDids, dbPath: dbPath!, oauthPrivateKeyJwk };
+}
+
+let cached: Config | null = null;
+
+export function getConfig(): Config {
+ cached ??= loadConfig();
+ return cached;
+}
diff --git a/src/lib/server/db.test.ts b/src/lib/server/db.test.ts
new file mode 100644
index 0000000..2e6376d
--- /dev/null
+++ b/src/lib/server/db.test.ts
@@ -0,0 +1,52 @@
+///
+import { openDatabase, runMigrations } from './db.ts';
+
+const MIGRATIONS_DIR = new URL('../../../migrations', import.meta.url).pathname.replace(
+ /^\/([A-Za-z]:)/,
+ '$1'
+);
+
+Deno.test('migrations apply once and are idempotent across runs', () => {
+ const dbPath = join(Deno.makeTempDirSync(), 'test.db');
+ const db = openDatabase(dbPath, MIGRATIONS_DIR);
+
+ const versions = db.prepare('SELECT version, name FROM schema_version ORDER BY version').all();
+ if (versions.length === 0) throw new Error('no migrations applied');
+
+ // second run applies nothing
+ const applied = runMigrations(db, MIGRATIONS_DIR);
+ if (applied !== 0) throw new Error(`expected 0 re-applied migrations, got ${applied}`);
+ db.close();
+});
+
+Deno.test('built-in Transfer category is seeded', () => {
+ const dbPath = join(Deno.makeTempDirSync(), 'test.db');
+ const db = openDatabase(dbPath, MIGRATIONS_DIR);
+ const row = db
+ .prepare('SELECT name, kind, builtin FROM categories WHERE name = ?')
+ .get('Transfer') as { name: string; kind: string; builtin: number } | undefined;
+ if (!row || row.kind !== 'transfer' || row.builtin !== 1) {
+ throw new Error(`Transfer category missing or wrong: ${JSON.stringify(row)}`);
+ }
+ db.close();
+});
+
+Deno.test('foreign keys are enforced', () => {
+ const dbPath = join(Deno.makeTempDirSync(), 'test.db');
+ const db = openDatabase(dbPath, MIGRATIONS_DIR);
+ let threw = false;
+ try {
+ db.prepare(
+ `INSERT INTO transactions (account_id, sfin_id, amount_cents, description, created_at)
+ VALUES ('nonexistent', 't1', 100, 'x', ?)`
+ ).run(new Date().toISOString());
+ } catch {
+ threw = true;
+ }
+ if (!threw) throw new Error('expected FK violation');
+ db.close();
+});
+
+function join(...parts: string[]) {
+ return parts.join('/');
+}
diff --git a/src/lib/server/db.ts b/src/lib/server/db.ts
new file mode 100644
index 0000000..7417ea5
--- /dev/null
+++ b/src/lib/server/db.ts
@@ -0,0 +1,70 @@
+import { DatabaseSync } from 'node:sqlite';
+import { mkdirSync, readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+const MIGRATION_FILE = /^(\d+)_.*\.sql$/;
+
+let instance: DatabaseSync | null = null;
+
+/** Process-wide database handle, initialized once at server startup. */
+export function initDb(dbPath: string, migrationsDir: string): DatabaseSync {
+ instance ??= openDatabase(dbPath, migrationsDir);
+ return instance;
+}
+
+export function getDb(): DatabaseSync {
+ if (!instance) throw new Error('Database not initialized — initDb() runs at server startup');
+ return instance;
+}
+
+export function openDatabase(dbPath: string, migrationsDir: string): DatabaseSync {
+ if (dbPath !== ':memory:') mkdirSync(dirname(dbPath), { recursive: true });
+ const db = new DatabaseSync(dbPath);
+ db.exec('PRAGMA journal_mode = WAL');
+ db.exec('PRAGMA foreign_keys = ON');
+ runMigrations(db, migrationsDir);
+ return db;
+}
+
+export function runMigrations(db: DatabaseSync, migrationsDir: string): number {
+ db.exec(`CREATE TABLE IF NOT EXISTS schema_version (
+ version INTEGER PRIMARY KEY,
+ name TEXT NOT NULL,
+ applied_at TEXT NOT NULL
+ )`);
+
+ const applied = new Set(
+ (db.prepare('SELECT version FROM schema_version').all() as { version: number }[]).map(
+ (r) => r.version
+ )
+ );
+
+ const migrations = readdirSync(migrationsDir)
+ .map((file) => {
+ const match = file.match(MIGRATION_FILE);
+ return match ? { version: Number(match[1]), file } : null;
+ })
+ .filter((m) => m !== null)
+ .sort((a, b) => a.version - b.version);
+
+ let count = 0;
+ for (const { version, file } of migrations) {
+ if (applied.has(version)) continue;
+ const sql = readFileSync(join(migrationsDir, file), 'utf-8');
+ db.exec('BEGIN');
+ try {
+ db.exec(sql);
+ db.prepare('INSERT INTO schema_version (version, name, applied_at) VALUES (?, ?, ?)').run(
+ version,
+ file,
+ new Date().toISOString()
+ );
+ db.exec('COMMIT');
+ } catch (err) {
+ db.exec('ROLLBACK');
+ throw new Error(`Migration ${file} failed: ${err instanceof Error ? err.message : err}`);
+ }
+ count++;
+ }
+ return count;
+}
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
new file mode 100644
index 0000000..9cebde5
--- /dev/null
+++ b/src/routes/+layout.svelte
@@ -0,0 +1,11 @@
+
+
+
+
+
+
+{@render children()}
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
new file mode 100644
index 0000000..cc88df0
--- /dev/null
+++ b/src/routes/+page.svelte
@@ -0,0 +1,2 @@
+Welcome to SvelteKit
+Visit svelte.dev/docs/kit to read the documentation
diff --git a/src/routes/healthz/+server.ts b/src/routes/healthz/+server.ts
new file mode 100644
index 0000000..60261a6
--- /dev/null
+++ b/src/routes/healthz/+server.ts
@@ -0,0 +1,5 @@
+import { json } from '@sveltejs/kit';
+
+export function GET() {
+ return json({ ok: true });
+}
diff --git a/static/robots.txt b/static/robots.txt
new file mode 100644
index 0000000..b6dd667
--- /dev/null
+++ b/static/robots.txt
@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:
diff --git a/tsconfig.json b/tsconfig.json
new file mode 100644
index 0000000..a201a2c
--- /dev/null
+++ b/tsconfig.json
@@ -0,0 +1,23 @@
+{
+ "extends": "./.svelte-kit/tsconfig.json",
+ "compilerOptions": {
+ "rewriteRelativeImportExtensions": true,
+ "allowJs": true,
+ "checkJs": true,
+ "esModuleInterop": true,
+ "forceConsistentCasingInFileNames": true,
+ "resolveJsonModule": true,
+ "skipLibCheck": true,
+ "sourceMap": true,
+ "strict": true,
+ "moduleResolution": "bundler"
+ },
+ // *.test.ts files run (and are type-checked) under `deno test` with Deno globals;
+ // they are excluded here so svelte-check only covers app code.
+ "exclude": ["node_modules/**", "src/**/*.test.ts"]
+ // Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+ // except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+ //
+ // To make changes to top-level options such as include and exclude, we recommend extending
+ // the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+}
diff --git a/vite.config.ts b/vite.config.ts
new file mode 100644
index 0000000..b213906
--- /dev/null
+++ b/vite.config.ts
@@ -0,0 +1,18 @@
+import adapter from '@sveltejs/adapter-node';
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+ plugins: [
+ sveltekit({
+ compilerOptions: {
+ // Force runes mode for the project, except for libraries. Can be removed in svelte 6.
+ runes: ({ filename }) =>
+ filename.split(/[/\\]/).includes('node_modules') ? undefined : true
+ },
+
+ // adapter-node output runs under Deno in production (deno task start)
+ adapter: adapter()
+ })
+ ]
+});