Local development
Use the repository’s existing scripts. Do not place provider secrets in source files or frontend code.
Start the local environment
Section titled “Start the local environment”npm run db:localnpm run dev:pagesnpm run dev:pages builds the static Astro output and starts Cloudflare Pages locally with persisted D1 state. The local application origin is http://127.0.0.1:8788 unless the command is changed.
Apply local migrations before testing a fresh database:
npm run db:localKeep service credentials in the local environment. Never place provider, payment, email, Agent API, or Discord secrets in Astro pages, client JavaScript, documentation examples, or committed files.
Verification commands
Section titled “Verification commands”| Command | Coverage |
|---|---|
npm run qa:discord |
Discord OAuth, signatures, cards, and entitlement delivery |
npm run qa:agent-api |
Scoped keys, REST, MCP, quotas, idempotency, and tenant boundaries |
npm run qa:documentation |
Documentation routes, contracts, theme, and internal links |
npm run qa:security |
Authentication and dashboard security boundaries |
npm run qa:fresh-migrations |
Apply every migration to an empty local database |
npm run build |
Generate the complete Astro production output locally |
Local API mode
Section titled “Local API mode”Local demo workspaces issue lsk_test_... keys. Production workspaces issue lsk_live_... keys. Both are secrets and must follow the same storage rules.
The Agent API is fail-closed when AGENT_API_ENABLED is not enabled. Provider integrations also require their own server-side configuration before connection flows can complete.
Before release
Section titled “Before release”Run the focused test for the surface you changed, then the documentation, security, SEO, and build gates that cover its public contract. The repository’s release workflow contains additional runtime, migration, mobile, legal, and production-configuration gates.