NebulaKit

Blazing fast web applications with SvelteKit's powerful routing, server-side rendering, and reactive components. Zero-config TypeScript support included.

Deploy globally in seconds with Cloudflare's edge network. Lightning-fast responses from 300+ locations worldwide with D1, KV, R2, and Workers AI built-in.

Built-in authentication with session management, OAuth providers, and secure password hashing. Ready for email/password, Google, GitHub, and more.

SQLite at the edge with migrations, type-safe queries, and zero cold starts. Scale effortlessly with automatic backups and point-in-time recovery.

Pre-configured for AI integration with Cloudflare Workers AI. Add chat, embeddings, image generation, and LLM capabilities with a few lines of code.

Complete testing setup with Vitest and Playwright. Unit, integration, and E2E tests configured out of the box. TDD workflow with 90%+ coverage targets.

Beautiful light and dark themes with CSS custom properties. System preference detection, smooth transitions, and WCAG AA contrast compliance.

Power-user navigation with keyboard shortcuts (⌘K). Quick access to all features, search, and actions without touching the mouse.

Hot module replacement, TypeScript, ESLint, Prettier, and Git hooks configured. Build, test, and deploy with confidence using best practices.

Pre-configured with comprehensive Copilot instructions for TDD workflows, architectural patterns, and best practices. Accelerate development with AI-powered assistance.

Built-in support for Cloudflare Durable Objects and WebSockets. Build real-time applications like chat, notifications, and live updates with ease.

Clean API design with SvelteKit endpoints. Type-safe request/response handling, middleware support, and automatic validation for robust backend services.

Build pages by dragging blocks into place, then publish them at /p/your-slug. Pages are stored as data, never code. Every save keeps a revision, and a restore can be undone.

A public API under /api/v1, described by an OpenAPI file. Keys have scopes and an expiry. A key is shown once and stored hashed, and you can revoke it in one click.

Products, a cart and Stripe checkout. The server works out every price. Late payments, failed payments and expired sessions are handled, and a replay changes nothing twice.

Receipts and shipping notices through Resend. Each email goes out at most once per order. With no key set, nothing is sent and the log records what was skipped.

Lower prices where money buys more, using a World Bank price table. Off by default, and it only ever lowers a price. A VPN alone earns no discount.

Four roles: owner, superadmin, admin and user. Give each admin only the areas they need. You can only act on someone below your own role.

See who changed what. The log records changes only, and never a secret value. Sign-in tracking is off by default because it is the one place the site stores an IP address.

A small cron Worker runs your jobs on a schedule. Each job runs once per scheduled minute, retries are safe, and every run is recorded in the admin.

A site-wide JSON-LD graph, a redirect manager, canonical host handling and security.txt. A Lighthouse admin audits your public pages.

Security headers on every response, login throttling, and safer OAuth account linking. CI fails if anyone edits a committed migration.

AI keys and OAuth client secrets are encrypted with AES-256-GCM before they are saved. The admin shows only the last four characters. Rotate the key and old values are re-encrypted when read.