Serve the Burst ecosystem

The three projects share branding and assets but have separate delivery roles. Nothing in the web build publishes or deploys a site.

Build static artifacts

node web/build.mjs

The build copies the application assets into the Go control package. A subsequent sh scripts/build.sh dev embeds them in burst, so the console and authenticated APIs share one origin.

Preview public sites

node web/serve.mjs --site goburst.network --port 4173
node web/serve.mjs --site goburst.dev --port 4174

The preview server binds a loopback address and never proxies authenticated APIs or invents a session. A static application preview can show the sign-in interface; real application workflows require the configured Burst control service.

Cross-site links default to the owned domains. For a local three-port preview, set BURST_NETWORK_URL, BURST_DOCS_URL and BURST_APP_URL before building. Use HTTPS URLs or explicit loopback HTTP origins.

Deploy public surfaces

Prepared Cloudflare deployment

The repository includes Workers Static Assets configurations for goburst.network and goburst.dev, plus an application edge Worker for goburst.app.

node web/cloudflare/deploy.mjs all --dry-run
node web/cloudflare/deploy.mjs public

The actual public command requires authenticated account access and active Cloudflare zones. The registrar currently delegates to GoDaddy nameservers; preserve existing records and verify DNSSEC before changing delegation. No DNS changes or deployments have been applied in the current session.

For the app, supply the actual HTTPS Go origin with BURST_CONTROL_ORIGIN and run node web/cloudflare/deploy.mjs app. The edge preserves browser sessions and OAuth redirects, validates mutation origins and disables API caching. The Go authority must retain external origin https://goburst.app. Node mTLS paths remain separate from this browser proxy.

Serve the two public build directories from the static hosting platform of your choice. Configure each host with its matching canonical domain, HTTPS and the supplied security headers. Keep the documentation search index at the same origin as the site.

Fonts and scripts are self-hosted. The public pages do not use third-party analytics, CDNs or session cookies. Font licenses are included under /assets/fonts/.

Serve the authenticated application

Run the built burst control service with its external origin set to https://goburst.app, real OIDC client configuration, the matching redirect URI and appropriate TLS identities. Use an HTTPS reverse proxy where required; forward /auth/, /v1/, /assets/ and / to the same control service.

Do not deploy the static app as a separate origin that receives a broadly scoped session cookie. The application deliberately uses same-origin API requests and host-only sessions. CORS is not a replacement for this session design.

The public app build is an asset artifact, not a standalone authentication backend. It must not be configured with a public client secret, a fake login or an admin token in JavaScript.

Acceptance before exposure

• Verify provider login, callback handling, logout and expired sessions in a real browser.
• Exercise authorized and denied actions for operators and ordinary members.
• Verify CSRF rejection and cross-network/space isolation through the API.
• Exercise upload, policy simulation, group revocation, deletion and maintenance.
• Test keyboard navigation and responsive layouts, including dialogs and table overflow.
• Complete the live storage, issuer, key-custody and recovery gates for the deployment.

The initial sibling domain directories were empty. Sources and built artifacts are staged inside burst-kit/web/ because the active workspace does not permit writes to those sibling directories. Move or publish the reviewed artifacts from an environment authorized to manage those projects.