SvelteKit (Svelte 5) app serving the admin backend and, eventually, the SSR public sites. Deploys to Cloudflare Workers (ADR 0011) via @sveltejs/adapter-cloudflare.

Local development #

npm install            # from the repo root (npm workspaces)
npm run db:migrate     # apply D1 migrations to the local database
npm run dev            # vite dev with emulated Workers bindings

Browse at http://127.0.0.1:5173, not localhost — with no OAuth key configured, the app runs as an atproto loopback OAuth client, and loopback redirect URIs must use 127.0.0.1.

To exercise the exact production runtime (workerd) instead of vite dev:

npm run build && npx wrangler dev

Configuration #

Secrets go in .dev.vars locally (see .dev.vars.example) and wrangler secret put in production:

OAUTH_PRIVATE_KEY_JWK — ES256 private key JWK (JSON). When set, the app is a confidential OAuth client serving its metadata at /client-metadata.json and keys at /jwks.json. When absent: loopback dev client.
SESSION_SECRET — HMAC key for the session cookie. Required in production.

Layout notes #

src/lib/server/oauth/ — atproto OAuth: workers-compat.ts is the shim layer that lets @atproto/oauth-client-node run on Workers (see docs/research/2026-08-03-oauth-workers-spike.md for why each shim exists), stores.ts the D1-backed state/session stores, client.ts the client factory.
migrations/ — D1 SQL migrations (wrangler d1 migrations apply).
The public-site renderer will be kept separable from this app (ADR 0005) when it lands.