documentation.

architecture

the project registry supports explicit hostname and directory values for the apex site. the optional shell array lists additional public routes to precache for offline use; never include personalized or authenticated routes.

each project is an independent cloudflare module worker. product behavior and data stay in the project. libraries provides common request handling, navigation, design tokens, icons, pwa routes, account integration, and build and deployment tooling.

project.dorianmarie.com/
  AGENTS.md               project rules and resource identity
  package.json            build, test, deploy
  cloudflare.config.js    JavaScript Worker configuration
  src/                    application and Worker code
  public/                 optional browser assets
  scripts/                project-specific asset preparation
  dist/worker.js          generated deployment artifact

libraries.dorianmarie.com/src/
  auth.js                 host-only project sessions and PKCE
  platform.js             shared shell, responses, assets, PWA
  projects.js             project and Worker registry
  icons.js                white SVG glyphs on black
  service-worker.js       public shell cache and offline fallback

the shared implementation is bundled into each worker and served from that project's own origin under /_dm/. a documentation outage cannot break another project's ui. no runtime cdn or cross-origin script dependency is required. existing product-specific renderers remain responsible for their screens.

design

author interface copy in lowercase at the source, without emojis or css case conversion. preserve user-entered case, identifiers, source examples, and proxied content. every app uses the shared install app control; installed apps hide it.

white surfaces. black text, borders, and controls. system fonts. square controls, visible keyboard focus, responsive spacing, and reduced-motion support. icons use a black background with a white foreground, including png install icons and svg favicons. no emojis.

common navigation includes projects, documentation, login, register, the signed-in account, sign out, and an install app button with native installation or browser instructions. app-specific tools stay within the app.

one account

account.dorianmarie.com owns registration, email verification, password sign in, password recovery, and passkeys. applications never collect account passwords.

1. link to /sso/login or /sso/register on the current project.
2. the worker creates a random state and pkce verifier in a secure, http-only, host-only flow cookie.
3. the account service validates the registered callback and issues a short-lived, single-use authorization code.
4. the project exchanges the code through its ACCOUNT service binding and stores a host-only session cookie.
5. authenticated apis call ssoUser(request, env). identity stays server-side; tokens never enter local storage.

import {wrap, ssoUser} from '../../libraries.dorianmarie.com/src/auth.js';

const worker = {
  async fetch(request, env) {
    const user = await ssoUser(request, env);
    if (!user) return Response.json({error: 'sign in required'}, {status: 401});
    return Response.json({email: user.email}, {headers: {'Cache-Control': 'no-store'}});
  }
};
export default wrap(worker);

set ACCOUNT to the account worker. add new callback origins explicitly to the account service allowlist. project sign out revokes the parent session and uses a same-origin post to /sso/logout. sign out of all projects and password recovery revoke parent sessions at the account service. the existing sso/client.js entrypoint re-exports this implementation for compatibility.

authenticated requests fail closed if the account service is unavailable. the library does not cache api responses or authorization redirects.

installable, with a deliberate offline policy

every project exposes a standalone manifest, 192px and 512px png icons, a root service worker, and an accessible offline page. the public apex directory, time, weights, workout, and libraries shells work offline. weight entries and workout state retain the existing device storage behavior. account, habits, heartbeats, and proxy show a reconnect page rather than cache personalized html.

only allowlisted, same-origin public assets and shells enter the cache. api routes, sso routes, authorization, query urls, non-get requests, and session responses never enter it. releases are content-versioned. activation removes only this project's caches. installing a pwa depends on browser support and may require “add to home screen” on ios.

shared interface

browse and download the javascript source. source modules are served as text for inspection and vendoring. import the checked-in modules at build time; do not load worker modules in a browser.

build, verify, deploy

# From ~/dorianmariecom:
npm install
npm run build
npm test
npm run deploy

# Work on one project:
node scripts/build.mjs weights
node scripts/deploy.mjs weights

# Each project also exposes:
npm run build
npm run deploy

the workspace registry maps project domains to existing worker names. shared build tooling bundles javascript and embeds public assets. project preparation retains existing app asset pipelines. deployment reads existing remote settings, retains bindings and secrets, and updates the worker code. it does not run database migrations or recreate databases. new domains are configured explicitly. credentials stay in the local cloudflare profile and never enter public documentation.

cloudflare configuration uses javascript. logs and traces are enabled. tests cover account and session isolation, shared rendering, pwa cache exclusions, and product behavior. see the workspace and each project's agents.md before changing code.