chore: remove spike package and references (#29)

Remove the spike package which was used for early PDS testing but is no longer needed. Updates all documentation references in CLAUDE.md, README.md, environment files, and planning docs.

Changes:
- Delete packages/spike directory
- Update CLAUDE.md: remove spike from packages table and commands
- Update README.md: remove spike from packages table
- Update .env.example and .env.production.example
- Update docs: atproto-forum-plan.md, oauth-implementation-summary.md, write-endpoints-design.md
- Update pnpm-lock.yaml via pnpm install

.env.example

···
 # WEB_PORT=3001  # set in web package, or override here
 APPVIEW_URL=http://localhost:3000
 
-# Forum Service Account credentials (for spike and AppView writes)
+# Forum Service Account credentials (for AppView writes)
 FORUM_HANDLE=your-forum-handle
 FORUM_PASSWORD=your-forum-password
 

.env.production.example

···
 #   - Bluesky PDS: https://bsky.social
 PDS_URL=https://pds.example.com
 
-# Note: FORUM_HANDLE and FORUM_PASSWORD are only used by the spike test script,
-# not by the production applications. The appview and web services do not require
-# forum credentials to operate.
-
 # ============================================================================
 # Application URLs
 # ============================================================================

CLAUDE.md

···
 |---------|-------------|
 | `@atbb/db` | Drizzle ORM schema and connection factory for PostgreSQL |
 | `@atbb/lexicon` | AT Proto lexicon definitions (YAML) + generated TypeScript types |
-| `@atbb/spike` | PDS read/write test script for validating AT Proto operations |
 
 **Dependency chain:** `@atbb/lexicon` and `@atbb/db` build first, then `@atbb/appview` and `@atbb/web` build in parallel. Turbo handles this via `^build`.
 
···
 pnpm --filter @atbb/appview db:migrate  # run database migrations
 pnpm --filter @atbb/appview dev # run a single package
 pnpm --filter @atbb/appview test # run tests for a single package
-pnpm --filter @atbb/spike spike # run the PDS spike script
 ```
 
 ### Environment Variables
···
 - `FORUM_DID` — the forum's AT Proto DID
 - `PDS_URL` — URL of the forum's PDS
 - `APPVIEW_URL` — URL the web package uses to reach the appview API
-- `FORUM_HANDLE`, `FORUM_PASSWORD` — forum service account credentials (for spike/writes)
+- `FORUM_HANDLE`, `FORUM_PASSWORD` — forum service account credentials
 
 **OAuth & session management (required for production):**
 - `OAUTH_PUBLIC_URL` — public URL where AppView is accessible (used for client_id and redirect_uri)
···
 - **Hono JSX `children`:** Use `PropsWithChildren<T>` from `hono/jsx` for components that accept children. Unlike React, Hono's `FC<T>` does not include `children` implicitly.
 - **HTMX attributes in JSX:** The `typed-htmx` package provides types for `hx-*` attributes. See `apps/web/src/global.d.ts` for the augmentation.
 - **Glob expansion in npm scripts:** `@atproto/lex-cli` needs file paths, not globs. Use `bash -c 'shopt -s globstar && ...'` to expand `**/*.json` in npm scripts.
-- **`.env` loading:** Dev and spike scripts use Node's `--env-file=../../.env` flag to load the root `.env` file. No `dotenv` dependency needed.
+- **`.env` loading:** Dev scripts use Node's `--env-file=../../.env` flag to load the root `.env` file. No `dotenv` dependency needed.
 - **API endpoint parameter type guards:** Never trust TypeScript types for user input. Change handler parameter types from `string` to `unknown` and add explicit `typeof` checks. TypeScript types are erased at runtime — a request missing the `text` field will pass type checking but crash with `TypeError: text.trim is not a function`.
   ```typescript
   // ❌ BAD: Assumes text is always a string at runtime

README.md

···
 |---------|-------------|
 | [`packages/db`](packages/db) | Drizzle ORM schema and connection factory for PostgreSQL |
 | [`packages/lexicon`](packages/lexicon) | AT Proto lexicon schemas (YAML) and generated TypeScript types |
-| [`packages/spike`](packages/spike) | PDS read/write test script |
 
 ## Getting Started
 

docs/atproto-forum-plan.md

···
 - [x] Audit existing `space.atbb.*` lexicons — **Result:** 2 existing (`forum.forum`, `post`), 5 new needed for MVP. No separate topic type; unified post model with reply refs.
 - [x] Review prior Rust AppView — **Result:** Axum/SQLx scaffold with jetstream-oxide firehose, minimal DB schema. Reference for route structure and Docker setup; MVP will be Node/TS rewrite.
 - [x] Define new lexicons in YAML: `forum.category`, `forum.role`, `membership`, `reaction`, `modAction` — **Result:** All 5 defined in `packages/lexicon/lexicons/`, with YAML→JSON→TypeScript build pipeline via `@atproto/lex-cli`.
-- [x] Set up project scaffolding: monorepo with `packages/lexicon`, `apps/appview`, `apps/web` — **Result:** Turborepo + pnpm workspaces, devenv for Nix toolchain. AppView (Hono JSON API, port 3000), Web (Hono JSX + HTMX, port 3001), plus `packages/spike` for PDS testing. Apps live in `apps/`, shared libraries in `packages/`.
+- [x] Set up project scaffolding: monorepo with `packages/lexicon`, `apps/appview`, `apps/web` — **Result:** Turborepo + pnpm workspaces, devenv for Nix toolchain. AppView (Hono JSON API, port 3000), Web (Hono JSX + HTMX, port 3001). Apps live in `apps/`, shared libraries in `packages/`.
 - [x] Create Forum Service Account (generate DID, set up PDS or use existing hosting) — **Complete:** Forum DID configured in `.env`, PDS credentials set (ATB-5)
-- [x] Spike: write a test record to a PDS, read it back via AT Proto API — **Complete:** Full implementation in `packages/spike/src/index.ts` validates write/read/list/delete for all MVP record types (ATB-6)
+- [x] Spike: write a test record to a PDS, read it back via AT Proto API — **Complete:** Validated write/read/list/delete for all MVP record types (ATB-6)
 
 #### Phase 1: AppView Core (Week 3–4)
 - [x] Implement firehose subscription — connect to relay, filter for `space.atbb.*` records — **Complete:** Production-ready implementation in `apps/appview/src/lib/firehose.ts` with Jetstream WebSocket client, cursor persistence, circuit breaker, and exponential backoff reconnection logic (ATB-9)
···
 - [x] Docker Compose with Postgres, AppView, Web UI — **Complete:** `docker-compose.example.yml` with service orchestration (ATB-28)
 - [x] Config file: forum name, domain, admin DID, categories — **Complete:** `.env.example` with all required variables documented
 - [x] README: setup guide, architecture overview — **Complete:** README.md includes setup, architecture diagram, deployment instructions
-- [ ] Seed script for initial forum + categories — **Deferred:** Manual setup via spike script currently; automated wizard tracked in Future Roadmap
+- [ ] Seed script for initial forum + categories — **Deferred:** Automated wizard tracked in Future Roadmap
 - [x] Basic health check / status endpoint — **Complete:** `GET /api/healthz` and `GET /api/healthz/ready` implemented (ATB-9)
 
 ### Key Risks & Open Questions
···
 React Native + Expo cross-platform apps consuming the same `/api/*` endpoints as the web UI. Phased rollout: read-only browse → write/interact → push notifications → offline support & app store release. Full plan in [`docs/mobile-apps-plan.md`](mobile-apps-plan.md).
 
 ### Other Future Work
-- **Setup wizard for first-time initialization** — Interactive web-based wizard for administrators to initialize a new forum instance (create forum record on PDS, configure categories, set admin roles). Currently requires manual spike script execution or direct PDS API calls.
+- **Setup wizard for first-time initialization** — Interactive web-based wizard for administrators to initialize a new forum instance (create forum record on PDS, configure categories, set admin roles). Currently requires manual PDS API calls.
 - Nested/threaded replies
 - Full-text search (maybe Meilisearch)
 - User profiles & post history

docs/oauth-implementation-summary.md

···
 
 ## Migration from Password Auth
 
-### Current State (packages/spike)
-
-The spike package uses password-based authentication:
-```typescript
-const agent = new AtpAgent({ service: pdsUrl });
-await agent.login({ identifier: handle, password });
-```
+### OAuth Implementation
 
-### Future State (OAuth)
+OAuth flow:
 
 Replace with OAuth flow:
 ```typescript
···
 
 1. ✅ **OAuth implemented** — Users can now log in via web UI
 2. ⬜ **Update write endpoints** — Use OAuth sessions instead of password auth
-3. ⬜ **Deprecate password auth** — Remove spike password logic (keep for admin operations?)
-4. ⬜ **Admin login** — Decide: OAuth or keep password for forum service account?
+3. ⬜ **Admin login** — Decide: OAuth or keep password for forum service account?
 
 ## Next Steps
 
···
 **Tests:**
 - `apps/appview/src/lib/__tests__/config.test.ts` — Configuration validation tests
 - `apps/appview/src/lib/__tests__/test-context.ts` — Test helper for OAuth context
-
-**Reference:**
-- `packages/spike/src/index.ts` — Old password auth (for comparison)
 
 ### Related Issues
 

docs/plans/2026-02-09-write-endpoints-design.md

···
 
 **Files to reference:**
 - `apps/appview/src/middleware/auth.ts` - Use `requireAuth` from ATB-14
-- `packages/spike/src/index.ts` - Reference for `putRecord` usage (lines 54-73)
 - `packages/lexicon/lexicons/space/atbb/post.yaml` - Source of truth for record structure
 
 **Dependencies:**

packages/spike/package.json

···
-{
-  "name": "@atbb/spike",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "spike": "tsx --env-file=../../.env src/index.ts",
-    "lint": "tsc --noEmit",
-    "lint:fix": "oxlint --fix src/",
-    "clean": "rm -rf dist"
-  },
-  "dependencies": {
-    "@atbb/lexicon": "workspace:*",
-    "@atproto/api": "^0.15.0",
-    "@atproto/common-web": "^0.4.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsx": "^4.0.0",
-    "typescript": "^5.7.0"
-  }
-}

packages/spike/src/index.ts

···
-import { AtpAgent } from "@atproto/api";
-import { TID } from "@atproto/common-web";
-
-const PDS_URL = process.env.PDS_URL ?? "";
-const HANDLE = process.env.FORUM_HANDLE ?? "";
-const PASSWORD = process.env.FORUM_PASSWORD ?? "";
-
-if (!PDS_URL || !HANDLE || !PASSWORD) {
-  console.error(
-    "Missing required env vars: PDS_URL, FORUM_HANDLE, FORUM_PASSWORD"
-  );
-  console.error("Copy .env.example to .env and fill in your credentials.");
-  process.exit(1);
-}
-
-async function main() {
-  // 1. Authenticate
-  const agent = new AtpAgent({ service: PDS_URL });
-  await agent.login({ identifier: HANDLE, password: PASSWORD });
-  const did = agent.session!.did;
-  console.log(`Authenticated as: ${did}\n`);
-
-  // 2. Write a forum record (space.atbb.forum.forum, key: self)
-  console.log("--- Writing forum record ---");
-  const forumResult = await agent.com.atproto.repo.putRecord({
-    repo: did,
-    collection: "space.atbb.forum.forum",
-    rkey: "self",
-    record: {
-      $type: "space.atbb.forum.forum",
-      name: "Test Forum",
-      description: "A test forum created by the PDS spike",
-    },
-  });
-  console.log(`Forum record written: ${forumResult.data.uri}`);
-
-  // 3. Write a category record (space.atbb.forum.category, key: tid)
-  console.log("\n--- Writing category record ---");
-  const categoryTid = TID.nextStr();
-  const categoryResult = await agent.com.atproto.repo.putRecord({
-    repo: did,
-    collection: "space.atbb.forum.category",
-    rkey: categoryTid,
-    record: {
-      $type: "space.atbb.forum.category",
-      name: "General Discussion",
-      description: "Talk about anything",
-      slug: "general",
-      sortOrder: 0,
-      createdAt: new Date().toISOString(),
-    },
-  });
-  console.log(`Category record written: ${categoryResult.data.uri}`);
-
-  // 4. Write a post record (space.atbb.post, key: tid)
-  console.log("\n--- Writing post record ---");
-  const postTid = TID.nextStr();
-  const postResult = await agent.com.atproto.repo.putRecord({
-    repo: did,
-    collection: "space.atbb.post",
-    rkey: postTid,
-    record: {
-      $type: "space.atbb.post",
-      text: "Hello from the atBB spike!",
-      forum: {
-        forum: {
-          uri: forumResult.data.uri,
-          cid: forumResult.data.cid,
-        },
-      },
-      createdAt: new Date().toISOString(),
-    },
-  });
-  console.log(`Post record written: ${postResult.data.uri}`);
-
-  // 5. Read records back
-  console.log("\n--- Reading records back ---");
-
-  const readForum = await agent.com.atproto.repo.getRecord({
-    repo: did,
-    collection: "space.atbb.forum.forum",
-    rkey: "self",
-  });
-  console.log("Forum:", JSON.stringify(readForum.data.value, null, 2));
-
-  const readCategory = await agent.com.atproto.repo.getRecord({
-    repo: did,
-    collection: "space.atbb.forum.category",
-    rkey: categoryTid,
-  });
-  console.log("Category:", JSON.stringify(readCategory.data.value, null, 2));
-
-  const readPost = await agent.com.atproto.repo.getRecord({
-    repo: did,
-    collection: "space.atbb.post",
-    rkey: postTid,
-  });
-  console.log("Post:", JSON.stringify(readPost.data.value, null, 2));
-
-  // 6. List records in a collection
-  console.log("\n--- Listing forum.category records ---");
-  const listResult = await agent.com.atproto.repo.listRecords({
-    repo: did,
-    collection: "space.atbb.forum.category",
-    limit: 10,
-  });
-  console.log(`Found ${listResult.data.records.length} category records`);
-  for (const rec of listResult.data.records) {
-    console.log(`  - ${rec.uri}`);
-  }
-
-  // 7. Clean up test records
-  console.log("\n--- Cleaning up test records ---");
-  await agent.com.atproto.repo.deleteRecord({
-    repo: did,
-    collection: "space.atbb.post",
-    rkey: postTid,
-  });
-  console.log("Deleted post record");
-
-  await agent.com.atproto.repo.deleteRecord({
-    repo: did,
-    collection: "space.atbb.forum.category",
-    rkey: categoryTid,
-  });
-  console.log("Deleted category record");
-
-  await agent.com.atproto.repo.deleteRecord({
-    repo: did,
-    collection: "space.atbb.forum.forum",
-    rkey: "self",
-  });
-  console.log("Deleted forum record");
-
-  console.log("\nSpike complete!");
-}
-
-main().catch((err) => {
-  console.error("Spike failed:", err);
-  process.exit(1);
-});

packages/spike/tsconfig.json

···
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src"
-  },
-  "include": ["src/**/*.ts"]
-}

pnpm-lock.yaml

···
         specifier: ^2.7.0
         version: 2.8.2
 
-  packages/spike:
-    dependencies:
-      '@atbb/lexicon':
-        specifier: workspace:*
-        version: link:../lexicon
-      '@atproto/api':
-        specifier: ^0.15.0
-        version: 0.15.27
-      '@atproto/common-web':
-        specifier: ^0.4.0
-        version: 0.4.16
-    devDependencies:
-      '@types/node':
-        specifier: ^22.0.0
-        version: 22.19.9
-      tsx:
-        specifier: ^4.0.0
-        version: 4.21.0
-      typescript:
-        specifier: ^5.7.0
-        version: 5.9.3
-
 packages:
 
   '@atcute/atproto@3.1.10':