SvelteKit on Cloudflare, with the eight gates already wired in.

Twelve skills, five commands, two hook bridges. Everything your agent needs for D1, KV, R2 and AI Gateway.

The validator is the point: a bundle that mounts nothing looks exactly like one that works.

$dsh plugin --profile web add @jujubalandia/dsh-sveltekit-cloudflare
Install in three stepsSee the pipeline
Fig. 01 · What the bundle mounts
Database
cloudflare-d1
Cache
cloudflare-kv
Objects
cloudflare-r2
LLM calls
cloudflare-ai-gateway
Auth
sveltekit-auth
Reactivity
sveltekit-runes
Hardening
cloudflare-security
Leaks
security-leaks
OWASP
owasp-top10
Complexity
code-complexity
Git
git-flow
Review
agentic-code-review
Twelve skills, discovered from .agents/skills. No provider row to configure, no list to keep in sync.
12
Skills that load themselves, per binding
5
Commands from a sentence to production
8
Security gates wired into the pipeline
2
Hook bridges running on every edit
The pipeline

Five commands carry a sentence to production.

Each stage writes a real artifact, and the next stage refuses to start without it. Nothing stays the vague part you deal with later.

/sveflare-spec01
Spec
One command turns a sentence into docs/SPEC.md: acceptance criteria, explicit non-goals, and the security gates this change touches.
docs/SPEC.md
/sveflare-plan02
Plan
The spec becomes a technical plan. D1 schema, endpoints, folder layout, atomic tasks, reviewed before anyone writes code.
docs/PLAN.md
/sveflare-goal03
Goal
Scope is frozen in .agents/goals/current.md. The agent cannot declare the task done without evidence measured against it.
.agents/goals/current.md
PreToolUse hook04
Build
Every edit fires a PreToolUse check naming the skill for that file, then a PostToolUse check that lints and runs the focused test.
.agents/hooks.json
/sveflare-verify05
Verify
One command runs check, lint, tests, build, OWASP and complexity, then consolidates the output into a single report.
verification report
/sveflare-ship06
Ship
Staging, smoke test, then production behind an approval gate. D1 migrations run in order, never by hand.
staging, then production
Load
Skills that arrive on their own
Twelve skills ship in the bundle. Open a D1 query and the D1 rules are already in context. No prompt engineering, no copy-paste, no remembering to load the skill first.
Guard
Two hooks on every edit
PreToolUse names the relevant skill and the security gates for the file you are about to touch. PostToolUse lints it and runs the focused test. Neither one can block your edit, because they are guides and not gates.
Prove
A validator for the silent failure
The failure mode of a harness bundle is that it installs, appears in --dump-config, and registers nothing at all. validate-kit.mjs checks the patch dialect, the skill frontmatter and the hook events, and fails loudly.
What ships

Six pieces that stop you re-deciding the same things.

01
Twelve skills
D1, KV, R2, AI Gateway, SvelteKit auth and runes, Cloudflare hardening, OWASP Top 10, secret leaks, complexity, git flow and code review. Each one a loaded body, not a stub.
cloudflare-*sveltekit-*
02
Five commands
/sveflare-spec, /sveflare-plan, /sveflare-goal, /sveflare-verify and /sveflare-ship, registered by lib/commands.mjs from the prompts in .agents/commands/.
lib/commands.mjsctx.commands.register
03
Hook bridges
PreToolUse and PostToolUse mount through @deepseek-ai/dsh-hooks-claude-code. hook-dispatch.mjs turns the stdin payload into context your model actually reads.
hooks.jsonadditionalContext
04
Eight gates
Secrets, input validation, prepared statements, private R2 with signed URLs, AI Gateway guardrails, OWASP Top 10, prompt injection and the production approval gate.
pre-commitpre-push
05
The validator
One script checks the manifest contract, the patch dialect, all twelve SKILL.md frontmatters, the hook events and the relative plugin paths. It is the difference between a bundle that works and one that only looks installed.
scripts/validate-kit.mjs
06
A project too
There is also a wrangler config, two D1 migrations, Playwright and Stryker configs, husky hooks and a green CI. Use it as a GitHub template and the whole repository is yours.
Use this templatewrangler.toml
Live from the terminal

It tells you what it mounted.

Three commands matter. One installs the bundle, one proves the bundle is intact, and one shows the exact rows it inserted into your profile.

~/projects/my-app
$ dsh plugin --profile web add \
@jujubalandia/dsh-sveltekit-cloudflare
→ resolving bundle …
✓ appended to dsh.profile.bundles
✓ 12 skills discovered in .agents/skills
✓ 5 commands registered from lib/commands.mjs
✓ hooks bridge mounted (PreToolUse, PostToolUse)
Ready. Next: dsh web
$
Get started

Three steps. Under two minutes.

Prereqs: Node 22.12 or newer, pnpm 9, git, and a DSH install whose dsh is on your PATH.
01
Check the prereqs
Node 22.12 or newer, pnpm 9, git and a DSH install with dsh on your PATH. The bundle itself has no build step, so there is nothing to compile.
node -v # 22.12 or newer pnpm -v # 9 or newer dsh --version
02
Install the bundle
One command into your profile. Or install straight from git if you would rather pin an exact commit.
dsh plugin --profile web add \ @jujubalandia/dsh-sveltekit-cloudflare # or install straight from git # and pin a commit dsh plugin --profile web add \ github:Jujubalandia/dsh-sveltekit-cloudflare
03
Verify what was mounted
validate-kit.mjs checks the contract locally, and --dump-config shows the two rows the bundle inserts into the composed profile.
node scripts/validate-kit.mjs dsh --profile web --dump-config | grep sveflare
04
Run a command
Open a session and type /sveflare-spec followed by one sentence. It writes docs/SPEC.md and the pipeline starts from there.
dsh web > /sveflare-spec add avatar uploads to R2
05
Wire it to your project
The repository is a GitHub template as well. Create yours from it and the wrangler config, the migrations and the husky hooks come along.
> /sveflare-verify # or drive it from the shell ./scripts/verify.sh && ./scripts/security-scan.sh
View on GitHubPublic repo. Install it, fork it, open a PR.
Open source

It is public now. Come break it.

Clone it, run the validator, and send the rule or the check you wish had been there. Every skill is a markdown file, so a fix is a paragraph rather than a rewrite.

01
Clone it
HTTPS, no key. git clone https://github.com/Jujubalandia/dsh-sveltekit-cloudflare
02
Prove it still works
node scripts/validate-kit.mjs and ./test-install.sh. A PR lands with both green or it does not land.
03
Try it for real
Install it into a throwaway profile and run /sveflare-goal on a small task before you open the PR.