---
name: profullstack-stack
description: What Profullstack builds with, per use case: web apps, API services, CLIs, desktop, mobile, libraries and systems code, plus the defaults and house rules every repo shares.
version: 2026.10.17
updated: 2026-10-29
canonical: https://profullstack.com/stack
json: https://profullstack.com/stack.json
catalog_generated: 2026-11-03T01:25:57.476Z
npm_packages: 353
public_repos: 263
---

# The Profullstack stack

> Profullstack runs about 170 active repos on a small number of deliberate combinations. Pick the combo that matches the job, inherit the shared defaults, follow the house rules, and reuse the published packages before writing anything new.
>
> Human page: https://profullstack.com/stack · JSON: https://profullstack.com/stack.json · Skill: https://profullstack.com/skill.md · Updated 2026-10-29

## 1. Pick a combo

There is no single stack. Match the job to one of the combos below, then apply the shared defaults and house rules.

| If you are building | Use | Why |
| --- | --- | --- |
| A new product with a web UI | `web-app` | Next 16 on Turso with a Hono API inside the app. This is the default for anything new. |
| A change to an existing SaaS on Supabase or Postgres | `web-app-postgres` | Stay on the database it has. Do not migrate an app to Turso as a side effect of a feature. |
| A real-time 3D game, in the browser and on the desktop | `games` | Babylon on a pure rules core, server-authoritative multiplayer, and art generated by committed scripts rather than modelled by hand. |
| An API, crawler, poller or data service with little or no UI | `api-service` | Hono on Turso, Bun or Node, one Railway service with a health check. |
| A command-line or terminal tool, or an agent-facing bridge | `cli-tui` | Node, TypeScript, commander, hqtui for dashboards, MCP where an agent should drive it, published to npm. |
| A desktop app | `desktop` | Electron with the CLI bundled inside it, so one install gives both surfaces. |
| A mobile app | `mobile` | Expo inside the product monorepo, sharing the API and packages. |
| Code two or more products need | `library` | A runtime-neutral @profullstack/* package with subpath exports, released from GitHub. |
| Something that must be a single fast binary | `systems` | Rust (tokio, axum, clap), or Go when the upstream ecosystem is Go. |

## 2. Shared defaults (every combo)

| Concern | Choice | Notes |
| --- | --- | --- |
| Language | TypeScript, ESM | "type": "module" everywhere. Kebab-case filenames, semicolons, printWidth 100. JavaScript with JSDoc is fine in small packages. |
| Runtime | Node 22 or 24 (floor is 20) | Bun 1.4 where the repo pins it in packageManager. Runtimes are managed with mise on dev boxes. |
| Package manager | pnpm, pinned in packageManager | Bun on Bun repos. Never mix lockfiles. Workspaces via pnpm-workspace.yaml for monorepos (apps/, packages/, services/). |
| Hosting | Railway | One project per product, railway.json per service with healthcheckPath, deploys on push to the default branch. Custom domain before any URL is written down. |
| Web server | Caddy | Hosts, reverse proxies and static sites with automatic HTTPS (it gets and renews certificates itself) and IPv6 on by default. Its localhost admin API lets agents and the w3bs CLI add a site without editing config. The default web server on W3BS OS and in front of pit.world and Moshpit names (moshpit-proxy). nginx boxes keep nginx until they are moved. |
| DNS | Porkbun | No Cloudflare DNS requirement. |
| Secrets | logicsrc team vault + Railway service variables | Set on the service, record in the vault. No .env files in repos; a framework-required .env.local is a local cache, never the source. |
| Auth | Magic link + passkeys | The magic link doubles as signup. Passkeys via @simplewebauthn. An optional password only for devices that cannot open mail or hold a passkey (TVs). |
| Email | Resend + @profullstack/email-queue (in development) | Resend is the intended application provider. The shared queue source is not published and is not yet deployed portfolio-wide. PostgreSQL audit integration, service API, CLI, MCP, admin PWA, production monitoring and migrations remain incomplete. Gmail sending is restricted to approved one-off use. |
| Payments | CoinPay (crypto) and x402 | Crypto through @profullstack/coinpay. x402 sells access to agents and crawlers, settled by CoinPay. No Stripe and no card checkout. |
| Crawler policy | @profullstack/x402-gateway + @profullstack/throttle | Training crawlers get 402 with a daily pass to buy, robots.txt is generated from the same lists, and every route is limited to 100 req/min with a price instead of a 429. |
| Media playback | @profullstack/player | Every audio and video player: MP4, HLS, MPEG-TS and audio with one control bar. `attachSource` when a site keeps its own UI. A third-party player bump that breaks means move to it, not migrate the old player. |
| Modern CSS | @profullstack/modern-css | Subgrid cards, squircle corners, stuck headers, grid gap rules, height:auto accordions, reading-flow and @function helpers (--fluid, --alpha, --inner-radius) as opt-in classes in the components layer. Reach for these before JS or extra DOM. Every one is progressive enhancement: write the plain value first. |
| Analytics | CrawlProof stats.js | Every public site loads crawlproof.com/stats.js. Careers pages are fed from CrawlProof. |
| Referrals | @profullstack/stack/referrals | Tracked in the request proxy, 60/20 split. |
| Testing | vitest | `vitest run` in CI. `node --test` for small CLIs, `bun test` on Bun repos, Playwright for browser flows. |
| Lint + format | Prettier + ESLint | Biome or Oxlint where a repo already uses it. Do not add a second formatter to a repo. |
| CI | GitHub Actions | ci.yml, codeql.yml and threatcrush-scan.yml on every repo. Release after merge with gh release; a merged PR reaches nobody until the release is cut. |
| AI | c0mpute via @profullstack/ai-providers, MCP via @modelcontextprotocol/sdk | Every text or JSON model call goes through @profullstack/ai-providers: c0mpute peer nodes first, OpenAI and Anthropic only as alternating fallbacks. One Infernet trusted-client key (ifc_) per app as C0MPUTE_API_KEY. Never import openai or @anthropic-ai/sdk directly for text. Anything an agent should operate ships an MCP bridge. |
| Promotion | myna (mynaposter.com) | The last phase of every ship: socials, both blogs and a CrawlProof ad from one command. Syndicated copies carry rel=canonical back to our page. |
| Data | NicheDB, RSS Amplifier, r4ck | Datasets come from and go back to nichedb.dev. Feeds are submitted through @profullstack/submit-feed. OpenProfile.md for people, /.well-known/openaccess.json for access terms. |

## 3. Combos

### Web app (`web-app`)

The default for a new product. Next 16 renders the UI, a Hono app mounted inside it serves the API, Turso holds the data, and one Railway service runs web and worker together.

**Use it when:**

- You are starting a product that has a UI and a database.
- The data fits SQLite semantics: one writer, modest joins, no Postgres extensions.
- You want one service, one deploy, one domain.

| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Next 16, React 19 | App Router. proxy.ts, not middleware.ts. Server components by default. |
| API | Hono inside Next | Mounted under /api. Versioned routes live at /api/v1/... and OAuth callbacks at /api/v1/<provider>/<function>/<endpoint>. |
| Database | Turso (libSQL) via @libsql/client | Forward-only SQL migrations in packages/db, or Drizzle with dialect turso. Migrations must be safe to run twice concurrently. |
| UI | Tailwind 4 + shadcn/ui | Scoped behind a ui.css without preflight when adding to an existing site. Plain CSS modules on marketing sites. |
| Realtime | Server-Sent Events | WebSockets only for chat, terminals and multiplayer. |
| Background work | A worker process in the same container | Supervised by the entrypoint; the container exits non-zero when either process dies. BullMQ on Redis only when the queue is the product. |
| Storage | Railway volume or Cloudflare R2 | R2 buckets private, served through signed or proxied routes. |
| Layout | apps/web, packages/db, services/worker | Root-only vitest config, tsconfig.base.json with strict flags. Copy nightcell7 or reeleel rather than inventing a layout. |

**Notes:**

- Next inlines process.env.NAME at build time, so read runtime secrets through a non-literal key.
- A 200 on /api/health proves nothing about the worker. Check the logs for its up line after a deploy.

**Examples:** [rssamplifier.com](https://rssamplifier.com) · [p0dcasters](https://github.com/profullstack/p0dcasters) · [c0upons](https://github.com/profullstack/c0upons) · [opensourcelegends.com](https://opensourcelegends.com) · [sorrycheck](https://github.com/profullstack/sorrycheck) · [sinkstate](https://github.com/profullstack/sinkstate) · [bufferoverride](https://github.com/profullstack/bufferoverride) · [nightcell7](https://github.com/profullstack/nightcell7)

### Web app on Postgres (`web-app-postgres`)

The previous generation of the same shape, and still the largest by count. Next 16 on Supabase, or on a self-hosted Postgres in the same Railway project. Kept where the data needs Postgres or the app already lives there.

**Use it when:**

- The app is already on Supabase or Postgres. Stay there.
- You need row-level security, pgvector, heavy relational joins, or a queue on Redis next to the database.
- Several services share one database and the write volume is real.

| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Next 16, React 19 | Same conventions as web-app. |
| Database | Supabase Postgres, or self-hosted Postgres on Railway | Supabase client via @profullstack/stack/supabase. New Postgres apps self-host on Railway (w3bs.org is the reference). Index every foreign key you will cascade through. |
| Auth | Magic link + passkeys on the app's own users table | Supabase Auth exists in older apps; the local users.id is always the primary key. |
| Queues | BullMQ on Redis | Custom job ids must not contain a colon. |
| Migrations | supabase/migrations or plain SQL | Applied in CI or on boot, never by hand in the dashboard. |

**Notes:**

- Do not move an app to Turso as part of a feature. Classify it first: easy Turso, needs Postgres, or consolidate.
- coinpayportal is public with 19 forks. Never put real data in a fixture there.

**Examples:** [coinpayportal.com](https://coinpayportal.com) · [ugig.net](https://ugig.net) · [crawlproof.com](https://crawlproof.com) · [marksyncr.com](https://marksyncr.com) · [logicsrc.com](https://logicsrc.com) · [w3bs.org](https://w3bs.org) · [brisk.news](https://brisk.news) · [icemap.app](https://icemap.app)

### API service (`api-service`)

Hono on Turso with no framework in front of it. For pollers, crawlers, data APIs, MCP servers and anything whose UI is a few server-rendered pages or none at all. Bun or Node, chosen per repo and pinned.

**Use it when:**

- The product is an API, a feed, a dataset or a daemon.
- The UI is small enough to render from Hono (JSX or templates) or lives in a separate app.
- You want the smallest possible service: one process, one SQLite file or one Turso database.

| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Hono 4 | Web-standard Request/Response. Same app runs on Bun and Node; the router is the only Hono-specific code. |
| Runtime | Bun or Node, pinned | Bun for stream-heavy or IO-heavy services (genrewatch, tipoffwatch, niche-db, r4ck). Node + pnpm when the service shares code with a Next app or a CLI. |
| Database | Turso (libSQL) | Embedded replica or remote. FTS5 for search, with the raw query escaped; libSQL cannot bind undefined. |
| Rate limiting | @profullstack/throttle | Credentialed callers get 600/min, anonymous 100/min, over the limit is a 402 with an offer. |
| Agent surface | MCP bridge in the CLI package | One query vocabulary across page, API, CLI and MCP. |
| Deploy | Railway, Dockerfile or Nixpacks | railway.json with healthcheckPath. Pin pnpm 10 on Nixpacks; corepack cannot launch pnpm 11. |

**Notes:**

- Bun-only gotchas: Bun.serve idleTimeout kills long streams, and Bun's SQL client stringifies arrays. Keep those behind small adapters.

**Examples:** [nichedb.dev](https://nichedb.dev) · [r4ck.dev](https://r4ck.dev) · [genrewatch.com](https://genrewatch.com) · [tipoffwatch.com](https://tipoffwatch.com) · [watchnews.now](https://watchnews.now) · [agenticjobs](https://github.com/profullstack/agenticjobs) · [tronbrowser.dev](https://tronbrowser.dev) · [reeleel](https://github.com/profullstack/reeleel)

### CLI and TUI (`cli-tui`)

Terminal tools for people and agents. Node and TypeScript, commander for arguments, hqtui for anything with a screen, an MCP bridge so an agent can drive the same commands, published to npm under @profullstack.

**Use it when:**

- The user is a developer, an operator or an agent.
- The tool wraps a site or API we run (nichedb, rssamplifier, coinpay, r4ck, readm3).
- You need a dashboard in a terminal rather than a browser.

| Concern | Choice | Notes |
| --- | --- | --- |
| Runtime | Node 20+ (Bun optional) | Node is required: CLIs run in GitHub Actions and on customer machines. Bun is fine for development. |
| Arguments | commander | Subcommands map one to one onto MCP tools. |
| TUI | @profullstack/hqtui | btop-grade dashboards, one import. A mouse must work: one click unfolds, hover highlights. |
| Config | ~/.<tool>.json + @profullstack/synconfig | Allowlisted snapshot synced with the tool's cloud. |
| Install | npm i -g @profullstack/<tool> and curl | sh | The installer does the whole job. Never document a manual follow-up step. |
| Testing | node --test or vitest | bun test on Bun repos; mock.module is process-wide there. |
| Release | GitHub release workflow publishes to npm | Bump before testing. A brand-new scoped package 404s for minutes after publish. |

**Examples:** [@profullstack/hqtui](https://www.npmjs.com/package/@profullstack/hqtui) · [@profullstack/nichedb](https://www.npmjs.com/package/@profullstack/nichedb) · [@profullstack/coinpay](https://www.npmjs.com/package/@profullstack/coinpay) · [@profullstack/readm3](https://www.npmjs.com/package/@profullstack/readm3) · [@profullstack/g1tz](https://www.npmjs.com/package/@profullstack/g1tz) · [@profullstack/r3q](https://www.npmjs.com/package/@profullstack/r3q) · [@profullstack/billing](https://www.npmjs.com/package/@profullstack/billing) · [cli-tools](https://github.com/profullstack/cli-tools)

### Desktop (`desktop`)

Electron, with the product's CLI bundled inside the app. A desktop install gives the CLI too, with no system Node, and the two surfaces cannot disagree because they are the same build.

**Use it when:**

- The product needs a tray, a window, the filesystem or OS input.
- A CLI already exists and the desktop app is a second surface for it.

| Concern | Choice | Notes |
| --- | --- | --- |
| Shell | Electron | Tauri was tried and retired. |
| Inside | Hono or Next, same as the web surface | The renderer is the web app; the main process hosts the API locally. |
| CLI | Bundled via extraResources | The installer writes a shim: ELECTRON_RUN_AS_NODE=1 exec app resources/cli/dist/bin.js. Build the bundle with pnpm deploy --prod --legacy. |
| Native modules | N-API only | Electron's ABI differs from system Node. @libsql/* passes; anything with V8 symbols does not. |
| Distribution | GitHub releases + curl installer | Headless machines get a CLI-only tarball. Homebrew, apt, rpm, scoop and nix repos exist for pairux. |
| Auto-update | From GitHub releases | Set the tool's NO_AUTO_UPDATE env when testing a dev binary. |

**Examples:** [mynaposter](https://github.com/profullstack/mynaposter) · [diskpush](https://github.com/profullstack/diskpush) · [threatcrush](https://github.com/profullstack/threatcrush) · [pairux.com](https://pairux.com) · [nixamp](https://github.com/profullstack/nixamp) · media2markdown · [r4ck.dev](https://github.com/profullstack/r4ck.dev)

### Games (`games`)

Babylon in the browser, with every gameplay rule in a package that cannot import a renderer. The same rules run in the client, in the authoritative match server and in tests, so a rule exists exactly once.

**Use it when:**

- The product is a real-time 3D scene the player acts inside, not a page they read.
- It has to run in a browser first, with the desktop build as a second surface rather than the only one.

| Concern | Choice | Notes |
| --- | --- | --- |
| Renderer | Babylon.js | WebGPU where the browser has it, WebGL2 fallback. The fallback is a supported path, not a degraded one. |
| Physics | Havok via @babylonjs/havok | Only where real collision response is needed; most props are static. |
| Rules | A pure game-core package | No Babylon, no DOM, no Electron imports. This is the rule that makes a client and a server able to agree. |
| UI | Preact, outside the frame loop | The component layer never owns a per-frame transform. HUD readouts are text-node writes behind a change check, not a render pass. |
| Multiplayer | Server-authoritative over WSS | The client sends input intent. The server owns movement validation, damage, death, respawn and score. Shared messages live in their own protocol package. |
| Build | Vite + vite-plugin-pwa | Set registerType and actually wire the update prompt; prompt with no handler means returning players never get a new build. |
| API and data | Hono, Drizzle, Postgres | Same as api-service. Never cache /api, matchmaking or tickets in the service worker. |
| Desktop | Electron | The desktop combo applies unchanged; the renderer is the same web build. |
| Art | Generated by committed Blender scripts | No asset without provenance. One Blender metre is one game metre, GLB with glTF-compatible PBR, COL_ colliders and SOCKET_ attachment points. |

**Notes:**

- Distant point lights and glows are camera-facing sprites held at a fixed screen size, never scaled geometry. A 25 mm firefly is sub-pixel past 30 m and no amount of scaling the mesh fixes that.
- Budget the shell download. Models ship geometry, UVs and a named material slot; the engine binds the real textures by that name so one atlas is not shipped ten times.

**Examples:** [nightcell7](https://github.com/profullstack/nightcell7) · [nightcell7.com](https://nightcell7.com)

### Mobile (`mobile`)

Expo and React Native, as apps/mobile inside the product monorepo. It shares the API client and packages with the web app rather than living in its own repo.

**Use it when:**

- The product needs to be in the app stores or on a phone home screen with native capabilities.
- A PWA is not enough (push, background, camera, payments in-app).

| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Expo (React Native) | React 19. Shares types and the API client with apps/web. |
| Layout | apps/mobile in the product monorepo | Standalone *-mobile repos are the old pattern and are dormant. |
| Backend | The product's own api-service or web-app | No separate mobile backend. |
| Store release | sh1pt | One codebase to every store, registry and channel. |

**Notes:**

- Start with the PWA. Most products never need this combo.

**Examples:** [threatcrush](https://github.com/profullstack/threatcrush) · [pairux.com](https://github.com/profullstack/pairux.com) · [postammo.com](https://postammo.com) · [reeleel](https://github.com/profullstack/reeleel) · [tronbrowser.dev](https://github.com/profullstack/tronbrowser.dev)

### Library (`library`)

Code that two or more products need becomes a @profullstack/* package. Runtime-neutral core, subpath exports, one npm package per concern, released from GitHub.

**Use it when:**

- You are about to copy a module from one repo into another.
- A site needs a component another site already ships (player, leaderboard, feed submission, contact-form guard).

| Concern | Choice | Notes |
| --- | --- | --- |
| Shape | ESM, TypeScript, subpath exports | `@profullstack/stack/referrals`, `/email`, `/supabase`, `/feedback`, `/coinpay`, `/crawlproof` is the pattern. Peer-depend on next, react and clients rather than bundling them. |
| Core | Web-standard APIs | fetch, Request, Response, URL, crypto.subtle, ReadableStream. Runtime-specific code behind an adapter. A /core entry must never import a node: module. |
| Build | tsup or plain tsc | Node type-stripping needs .ts specifiers; pair with rewriteRelativeImportExtensions so dist still emits .js. |
| Tests | vitest | Contract tests where the package defines a protocol (x402, submit-feed, OpenProfile). |
| Release | Bump, merge, gh release | A release workflow publishes. Ship pkg@latest in docs, never update -g. pnpm 11 refuses packages younger than a day unless excluded from minimumReleaseAge. |

**Examples:** [@profullstack/stack](https://github.com/profullstack/stack) · [@profullstack/x402-gateway](https://github.com/profullstack/x402-gateway) · [@profullstack/throttle](https://github.com/profullstack/throttle) · [@profullstack/player](https://github.com/profullstack/player) · [@profullstack/modern-css](https://github.com/profullstack/modern-css) · [@profullstack/leaderboard](https://github.com/profullstack/leaderboard) · [@profullstack/form-guard](https://github.com/profullstack/form-guard) · [@profullstack/submit-feed](https://github.com/profullstack/submit-feed)

### Systems (`systems`)

Rust when the product is a single static binary that has to be fast (benchmarks, transports, agents on servers). Go when the upstream ecosystem is Go. Python only for security tooling that lives in that world.

**Use it when:**

- A JavaScript runtime would be the bottleneck or the dependency you cannot ship.
- The upstream you build on is in that language (LiveKit for agentbbs, nmap and Kali tooling).

| Concern | Choice | Notes |
| --- | --- | --- |
| Rust | tokio, axum, clap, reqwest | c0mpute is the reference. Auto-update from GitHub releases on first run. |
| Go | Standard library + the upstream SDK | agentbbs pins livekit server-sdk-go and protocol together. |
| Python | Managed by mise, venv per project | Security tooling and GitHub Actions only (vu1nz). |
| Distribution | GitHub releases, curl installer, homebrew tap | Same installer rule: it does the whole job. |

**Examples:** [c0mpute](https://github.com/profullstack/c0mpute) · [agentbbs](https://github.com/profullstack/agentbbs) · [fiche-agentic](https://github.com/profullstack/fiche-agentic) · [vu1nz.com](https://vu1nz.com) · [kali](https://github.com/profullstack/kali)

## 4. House rules

- **Ship it, never stop at in progress.** An agent does not end its turn on "still running, I will report when it lands". Work handed to a subagent, CI or a deploy is driven to merged, released and verified live in the same turn, then reported once with the result. Stop early only for a real blocker a person must clear: a login, or a decision that is theirs.
- **Every site takes payment from launch.** Launching a site includes taking crypto: npx @profullstack/coinpay-onboard site <name> --webhook <public url> makes its CoinPay business, copies the payout wallets in, sets the webhook and writes the COINPAY_* keys into the site vault. Idempotent; every step must print a check before the launch is announced.
- **Launch on a Moshpit name.** New products launch on a Moshpit name (pit.moshcode.sh), not a new ICANN domain, served from our own box with a registry-signed certificate and listed on the Moshpit ring. Announcements give the <name>.pit.world address for browsers without Moshpit DNS.
- **Reuse the house package first.** Before adding a dependency or writing a component, grep the repo for @profullstack/ and check npm. The package usually exists and is often already installed.
- **Secrets live in the vault.** Set production secrets on the Railway service and record them in the logicsrc team vault. Never write one into a .env in the repo, and never ask a person to.
- **Auth is magic link plus passkeys.** The link proves the address and the address is the account. Passwords are optional and only for devices that cannot do either.
- **Signup asks for the profile.** Every signup collects email, first_name, last_name, company_domain, job_title and linkedin_url through @profullstack/profile, in that order. Email and name are required; the other three are optional. The company is filled from a work email.
- **Every API offers webhooks.** An app with an API and accounts lets customers register webhook endpoints for its events through @profullstack/webhooks: the /api/v1/webhooks routes, a CLI command and MCP tools over them, and emit() wherever something happens. Never hand-roll signing or retries; apps on their own scheme move to it, sending their old header alongside until receivers switch.
- **User keys are sealed by the user.** Any key, token or password a user gives an app (exchange and wallet keys, BYO AI keys, OAuth tokens, SMTP passwords) is sealed with @profullstack/sealed-secrets under a passphrase the user holds, with a one-time recovery key. No server key, env var or database dump can open it. Servers write new secrets through the seal inbox; workers use them only inside an UnlockStore session the user opened. The Settings "Key vault" card, its browser code and the /my/vault routes come from the same package (vault-card, vault-ui/auto, vault-server); never hand-roll one. Operator secrets stay in the logicsrc team vault.
- **Installers do the whole job.** If a feature needs a component, the installer or update command installs it. No documented manual follow-up step. DNS routing is the one thing that stays explicit.
- **Push to the default branch deploys.** PRs are merged, not parked. Release after merge. Then announce through myna, with rel=canonical on every syndicated copy.
- **Our domains only.** Add the custom domain before writing any URL down. Never publish a *.up.railway.app address.
- **Migrations run twice.** Web and worker both migrate on boot. Ledger writes are insert-or-ignore and every migration is safe to apply concurrently.
- **Large catalogues use a sitemap index.** /sitemap.xml is an index; entities are chunked by month of creation so past files never change.
- **OAuth callbacks are namespaced.** /api/v1/<provider>/<function>/<endpoint>, using whatever API prefix the project already has.
- **Every product is a customer of another.** Wire products together when the integration is load-bearing: x402 settles through CoinPay, blogs open CrawlProof ads, myna distributes every ship, NicheDB sells the data.
- **Copy has no LLM tells.** Short sentences, no em dashes, no rule-of-three flourishes. This applies to posts, READMEs and announcements.
- **A wedged process restarts without a person.** Every container gets a HEALTHCHECK that hits its own /healthz, so a blocked event loop shows as unhealthy. watchdog-autoheal restarts what Docker marks unhealthy, three times an hour at most, then emails. In-process, watchDependencies exits when the shared DB or Redis client stops answering.
- **Agents get a first-class surface.** A site ships its data as Markdown or JSON at a stable URL, a CLI ships an MCP bridge, and training crawlers pay through x402 rather than being blocked.

## 5. Reuse these packages before writing anything

Every package in the `@profullstack` npm scope (353) and every public github.com/profullstack repo (263), regenerated from npm and GitHub on 2026-11-03. Check `grep -r "@profullstack/" package.json` in the repo first: the package is often already installed. Install `pkg@latest`. Line format: `name` latest version: purpose. **Use when** is hand-written guidance; **Avoid** means do not add it to new work.

### Build (53)

The app layer: shared modules, accounts, data, UI, terminals and media.

- `@profullstack/footer` 0.6.19: Profullstack's distributed footer engine for remote, agent-friendly site branding and navigation. **Use when:** Every fleet site footer and webring row. · src github.com/profullstack/footer
- `@profullstack/profile` 0.1.8: The signup profile every property collects: email, first_name, last_name, company_domain, job_title, linkedin_url. **Use when:** Every signup: collect the six profile fields with this, not a custom form. · src github.com/profullstack/profile
- `@profullstack/hqtui` 0.12.0: Terminal UI for TypeScript: btop-grade dashboards from one import. **Use when:** Any terminal UI or dashboard. Do not reach for blessed, ink or a hand-rolled ANSI loop. · src github.com/profullstack/hqtui
- `@profullstack/synconfig` 0.1.3: Sync a tool's config files with its cloud: allowlisted snapshot, digest, optimistic replace. **Use when:** A CLI that syncs its config files with its cloud. · src github.com/profullstack/mynaposter
- `@profullstack/auth-system` 0.8.3: Flexible authentication system with user registration, login/logout, password reset, and session management **Use when:** Legacy apps only: it is password + JWT. New apps use magic link + passkey. · src github.com/profullstack/auth-system
- `@profullstack/notifications` 0.1.4: Web push for any app: VAPID keys from env, subscribe from the page, one service worker handler. **Use when:** Web push from any app. · src github.com/profullstack/notifications
- `@profullstack/live-translate` 0.3.0: Live speech translation for streams and meetings: hear (ElevenLabs Scribe), translate (pluggable), re-voice (ElevenLabs Flash), with per-listener language... **Use when:** Live speech translation for a stream or meeting. · src github.com/profullstack/live-translate
- `@profullstack/form-guard` 0.3.0: Contact-form spam stopped with a signed proof-of-render token, not a captcha. **Use when:** Any public form that must stop spam. No captcha. · src github.com/profullstack/form-guard
- `@profullstack/stack` 0.6.0: Shared modules for Next apps: referrals, email, supabase, feedback widget, coinpay, crawlproof. Used by 37 repos. **Use when:** A Next or Node app needs referrals, email, CoinPay or CrawlProof wiring in one import. · src github.com/profullstack/stack
- `@profullstack/contact-form` 0.4.0: The Profullstack contact form: customizable questions with generic defaults, form-guard spam protection (signed proof-of-render token, honeypot, fill time... **Use when:** A site needs a contact or lead form. This is THE fleet contact form. · src github.com/profullstack/contact-form
- `@profullstack/libsql-pg` 0.1.4: A drop-in @libsql/client that talks to Postgres, plus the tools to move a Turso database over. **Use when:** Moving a Turso app to Postgres, or running @libsql/client code against Postgres. · src github.com/profullstack/libsql-pg
- `@profullstack/player` 0.17.0: One web player for MP4, HLS, MPEG-TS and audio with one control bar. Knows that Chrome lies about native HLS. **Use when:** Any video or audio on a page. Never add hls.js or video.js directly. · src github.com/profullstack/player
- `@profullstack/hqtui-demo` 0.12.0: The HQTUI reference dashboard: a btop-grade terminal system monitor. Runs on real system metrics or a deterministic simulation. **Use when:** A reference for how an hqtui dashboard is built. Depend on @profullstack/hqtui. · src github.com/profullstack/hqtui
- `@profullstack/leaderboard` 0.3.1: Public leaderboard with badges, streaks and a commission ladder for any site. **Use when:** A public leaderboard, badges or streaks. · src github.com/profullstack/leaderboard
- `@profullstack/spa-router` 1.14.0: Simple SPA router with smooth transitions, component loading, and Shadow DOM support · src github.com/profullstack/spa-router
- `@profullstack/text-type-detection` 1.0.0: Detect text format types (plain, markdown, ascii art, code, html, json, xml) from strings · src github.com/profullstack/text-type-detection
- `@profullstack/autoblog` 0.4.0: CloudEvents and Standard Webhooks SDK for publishing posts to the blogs. **Use when:** Publishing posts to the fleet blogs from an app. · src github.com/profullstack/autoblog
- `@profullstack/r3q` 0.2.0: A REST client for your terminal. Requests are files you can commit; the TUI is just a good way to look at them. · src github.com/profullstack/r3q
- `@profullstack/favicon-generator` 1.2.1: Generate PNG icons from an SVG or PNG source for iOS and PWA compatibility · src github.com/profullstack/favicon-generator
- `@profullstack/webhooks` 0.2.1: Webhooks as a feature of any app: customers register endpoints (URL, whsec_ signing key, event patterns like room.*), the app calls emit(owner, type, data)... **Use when:** An API offers webhooks to customers. Every API should. · src github.com/profullstack/webhooks
- `@profullstack/submit-feed` 0.1.3: One way to add a feed to a directory, shared by rssamplifier and p0dcasters. **Use when:** A directory accepts feed submissions. · src github.com/profullstack/submit-feed
- `@profullstack/partners` 0.2.0: Let the people whose work is in your dataset sell it: signup, domain verification, payouts. **Use when:** Letting contributors to a dataset sell it and get paid. · src github.com/profullstack/partners
- `@profullstack/scraper-daemon` 0.3.0: txt, per-host serial fetching, 429 hold-back, SSRF checks and SQLite or Postgres state. com. **Use when:** A listing site needs its updater: jobs, refresh queues, polite fetching. · src github.com/profullstack/scraper-daemon
- `@profullstack/api-key-manager` 0.3.0: Simple API key management system with generation, validation, and rate limiting · src github.com/profullstack/api-key-manager
- `@profullstack/orgs` 0.2.0: Orgs, teams, members, roles and invites for Postgres. Brings no users table and owns its schema through migrate(). **Use when:** Multi-tenancy: orgs, teams, roles, invites on Postgres. · src github.com/profullstack/orgs
- `@profullstack/modern-css` 0.2.0: Modern CSS as opt-in classes and @function helpers: subgrid cards, squircles, stuck headers, gap rules, height:auto accordions. **Use when:** Card grids, squircles, sticky headers, accordions. Before writing layout JS. · src github.com/profullstack/modern-css
- `@profullstack/state-manager` 0.8.0: Enhanced state manager with web component integration, persistence, and subscription management · src github.com/profullstack/state-manager
- `@profullstack/localizer` 0.8.0: Simple localization and internationalization library with RTL support · src github.com/profullstack/localizer
- `@profullstack/summary-forge-module` 1.10.2: An intelligent tool that uses AI to create comprehensive summaries of technical books · src github.com/profullstack/summary-forge-module
- `@profullstack/websocket-client` 0.3.0: Robust WebSocket client with connection management, reconnection logic, and message handling · src github.com/profullstack/websocket-client
- `@profullstack/transcoder` 1.9.14: A server-side module for transcoding videos, audio, and images using FFmpeg with smart presets and optimizations · src github.com/profullstack/transcoder
- `@profullstack/enhanced-router` 0.4.0: Enhanced SPA router with transition management, i18n integration, and layout management · src github.com/profullstack/enhanced-router
- `@profullstack/document-converters` 0.4.0: Simple document conversion utilities for various formats · src github.com/profullstack/document-converters
- `@profullstack/multiview` 0.1.0: Several live streams on one screen, driven by mouse, finger or TV remote. **Use when:** Several live streams in one grid. · src github.com/profullstack/multiview
- `@profullstack/remote-input` 0.2.4: Cross-platform OS input injection for remote control (macOS, Windows, Linux X11 and Wayland) · src github.com/profullstack/pairux.com
- `@profullstack/social-poster` 1.1.0: A CLI tool for posting to multiple social media platforms with browser-based authentication · src github.com/profullstack/social-poster
- `@profullstack/ferroframe` 0.3.4: A Svelte-host TUI framework for Node.js - Build terminal interfaces with the power of Svelte · src github.com/profullstack/ferroframe
- `@profullstack/g1tz` 0.2.2: A git TUI that shows you the repository, not a menu of git commands. · src github.com/profullstack/g1tz
- `@profullstack/sans-ui` 1.0.3: A cross-platform native UI library which supports iOS, Android, Windows, macOS, and Linux using NodeGUI for desktop and NativeScript for mobile.
- `@profullstack/storage-service` 0.4.0: Flexible storage service abstraction for file storage, retrieval, and metadata management · src github.com/profullstack/storage-service
- `@profullstack/syncfg` 0.1.3: Alias of @profullstack/synconfig. **Use when:** Never directly: depend on @profullstack/synconfig. · src github.com/profullstack/mynaposter
- `@profullstack/lead-generator` 1.2.4: A CLI tool for sending mass lead emails to prospective clients from CSV files with AI-powered personalization · src github.com/profullstack/lead-generator
- `@profullstack/autopost` 0.1.0: Typed Node SDK for posting to social platforms via a Crawlproof account. · src github.com/profullstack/autopost
- `@profullstack/socials` 0.1.0: Safe Playwright scaffolding for authorized social account login automation. · src github.com/profullstack/socials
- `@profullstack/ai-providers` 0.1.0: One text-model call for every Profullstack app: c0mpute first, OpenAI and Anthropic as alternating fallbacks, dead keys parked. Zero dependencies. **Use when:** Any text or JSON from a model. c0mpute first, OpenAI/Anthropic as alternating fallbacks, dead keys parked. Not for images or embeddings. · src github.com/profullstack/ai-providers
- `@profullstack/bridges` 0.2.0: Let a host site's signed-in users into an app over OAuth 2.1 with PKCE. No second signup. **Use when:** Users of a host site should land signed in to another app (OAuth 2.1 + PKCE). · src github.com/profullstack/bridges
- `@profullstack/browser-fingerprint` 0.1.0: One vote per browser, not per IP: a salted device fingerprint, a signed challenge, a bot score and limits for anonymous writes. **Use when:** Any anonymous write (votes, sign-ups, quotes, submissions): limit per browser, not per IP. Keeps only a salted hash. · src github.com/profullstack/browser-fingerprint
- `@profullstack/email-queue` 0.2.1: Development package in MyNaPoster. · src github.com/profullstack/mynaposter
- `@profullstack/pairux-embed` 0.1.0: End-to-end encrypted voice, video and screen sharing for any web app, on PairUX's SFU. The host app supplies the media key; the server only forwards ciphertext. · src github.com/profullstack/pairux.com
- `@profullstack/sealed-secrets` 0.2.0: Store the keys and secrets users give an app so only they can open them: a random data key wrapped under the user's passphrase (PBKDF2-SHA256 600k + HKDF +... **Use when:** Storing keys or secrets a user gives the app, so only they can open them; and the Settings Key vault card (vault-card, vault-ui, vault-server) that unlocks them. · src github.com/profullstack/sealed-secrets
- `@profullstack/stream-providers` 0.1.1: Sign a reader into their own streaming or radio account and pull lineups and playable stream URLs from it, one adapter per provider behind one interface... · src github.com/profullstack/stream-providers
- ~~`@profullstack/stripe-config`~~ 2.0.7: CLI tool and ESM module for managing Stripe products, prices, and Connect accounts across multiple projects **Avoid:** No Stripe anywhere (house rule).
- ~~`@profullstack/post-quantum-helper`~~ 1.0.0: Post-quantum encryption helper using ML-KEM (Kyber) + ChaCha20-Poly1305 **Avoid:** Superseded by @profullstack/encrypt.

### Agents (18)

MCP servers, agent tooling and documents an agent can read.

- `@profullstack/readm3` 0.32.0: Markdown editing and sharing for people and teams. Web/PWA, CLI, API and MCP with version history, view/edit links, and a terminal reader. · src github.com/profullstack/readm3
- `@profullstack/group-call` 0.6.1: A group call on a phone number: dial in, key a room code, talk with everyone else who did, people and AI agents alike. · src github.com/profullstack/group-call
- `@profullstack/media2markdown-core` 0.2.1: Deterministic media-to-Markdown pipeline: ffmpeg, whisper.cpp, OCR and PDF parsers. No LLM in the loop.
- `@profullstack/agenticjobs` 0.23.0: An agent-friendly job board you self host. It posts its own jobs and never scrapes anyone else's. **Use when:** Self-hosting an agent-friendly job board. · src github.com/profullstack/agenticjobs
- `@profullstack/media2md` 0.2.1: Turn any video, audio file or book into a chaptered Markdown bundle for an LLM. MCP server available. **Use when:** Turning video, audio or a book into Markdown for an LLM.
- `@profullstack/media2markdown-mcp` 0.2.1: MCP server for media2markdown, let an agent turn a link, video or book into chaptered Markdown itself.
- `@profullstack/adnetwork` 0.3.0: network: run ads, or earn from your site, in crypto. Paste a link and a budget, or paste one tag and add a wallet.
- `@profullstack/mcp-server` 1.6.0: Generic modular MCP server. **Use when:** Building an MCP server: add a module, not a new server. · src github.com/profullstack/mcp-server
- `@profullstack/submitfleet` 0.3.0: SubmitFleet: launch your product on 339 launch sites and directories from one profile. · src github.com/profullstack/submitfleet
- `@profullstack/proxy` 0.2.0: Call the web through residential proxies, with each provider behind one interface. **Use when:** Fetching the web through residential proxies. · src github.com/profullstack/proxy
- `@profullstack/tsbb-mcp` 0.12.1: MCP server for a tsbb bulletin board. Lets an AI assistant read and post on any board, as the member whose token it holds. · src github.com/profullstack/tsbb
- `@profullstack/ai-dot-txt` 1.1.0: CLI tool to generate ai.txt and llms.txt files for AI/LLM policies
- `@profullstack/ai` 1.1.1: A simple AI agent CLI tool for interactive conversations with AI · src github.com/profullstack/ai
- `@profullstack/bot.seo` 0.1.1: seo: paste your domains, get an SEO audit, a strategy and a content plan for each, and articles written on autopilot.
- `@profullstack/fineprint` 0.1.1: An AI lawyer for terms of service and privacy policies: give it a domain or a link, get what you agree to, the liabilities, where your data goes, red flags...
- `@profullstack/openprofile` 0.2.0: Read, write, merge and de-duplicate OpenProfile.md documents. **Use when:** Reading or writing OpenProfile.md for people or agents. · src github.com/profullstack/mynaposter
- `@profullstack/voice-agent` 0.1.1: Phone voice agents that hold a real conversation: define one in code (persona, voice, model, webhook tools), deploy it to ElevenLabs Conversational AI with... **Use when:** A phone agent that talks: persona, voice and tools in code. · src github.com/profullstack/voice-agent
- ~~`@profullstack/pairux`~~ 0.1.0: PairUX CLI: bring AI agents into a live PairUX session as participants **Avoid:** Deprecated on npm: Published by mistake. Use the pairux command from the PairUX installer: https://pairux.com/docs/agents

### Money (15)

Crypto checkout, x402, credits, referrals and invoices.

- `@profullstack/affiliates` 0.3.0: Scarce invite codes (a few per user, single use, hashed, expiring, who-invited-whom) plus open affiliate links with first-touch attribution. **Use when:** Scarce invite codes and affiliate links. · src github.com/profullstack/affiliates
- `@profullstack/redeem-credits` 0.2.0: Redeemable credit codes for any site: mint a scarce code (CR-7K3M-QX9D-2F8H-W4TN, 80 bits, stored only as a sha256 hash), redeem it once per user for... **Use when:** Credit codes that redeem for a balance or a monthly allowance. · src github.com/profullstack/redeem-credits
- `@profullstack/keys` 0.1.0: Ed25519-signed Power Keys: one key that unlocks every Profullstack service. **Use when:** Checking a Profullstack Power Key on a service. · src github.com/profullstack/keys
- `@profullstack/throttle` 0.4.1: App-wide rate limit whose answer to going over is a price, not a 429. **Use when:** Any rate limit. Over the limit is a price, not a 429. · src github.com/profullstack/throttle
- `@profullstack/referrals` 0.1.0: Referral codes, links, discounts and commission, with React and Next adapters. Bring your own store. **Use when:** Referral codes, links and commission math. · src github.com/profullstack/referrals
- `@profullstack/x402-gateway` 0.16.1: Sell crawl access to AI training crawlers by the day over x402, settled by CoinPay. Next and Hono adapters, generated robots.txt. **Use when:** Charging AI crawlers instead of blocking them. · src github.com/profullstack/x402-gateway
- `@profullstack/coinpay-onboard` 0.4.0: Take crypto on CoinPay, set up in one pass: Sign in with CoinPay helpers, an idempotent onboard() (business, payout wallets, webhook), webhook verification... **Use when:** Launching a site: one pass to Sign in with CoinPay, business, wallets and webhook. · src github.com/profullstack/coinpay-onboard
- `@profullstack/coinpay` 0.29.0: CoinPay SDK and CLI: crypto payments, x402 verify and settle, finances TUI. **Use when:** Taking crypto payments, verifying x402 payments. The payment rail for every site. · src github.com/profullstack/coinpayportal
- `@profullstack/x402-client` 0.4.1: Pay x402 402s from JavaScript with a local key: fetch, CLI, adapters for axios and got. **Use when:** Code or an agent that must pay an x402 402. · src github.com/profullstack/x402-client
- `@profullstack/b1dz` 0.3.10: b1dz CLI and TUI: crypto arbitrage terminal for b1dz.com (dashboard, backtests, quote observer, account setup). · src github.com/profullstack/b1dz.com
- `@profullstack/ringhuman` 0.1.0: RingHuman command line: search support routes, place calls that ring you when a human answers, watch events, check credits.
- `@profullstack/basis-engine` 0.1.0: Wallet-by-wallet cost basis tracking for digital assets (Rev. Proc. 2024-28), producing Form 8949 rows and Schedule D totals. · src github.com/profullstack/basis-engine
- `@profullstack/timer` 0.2.0: Time tracker for the terminal and for agents. **Use when:** Tracking billable time from a terminal or an agent. · src github.com/profullstack/timer
- `@profullstack/key-rotation` 0.1.0: Sell automatic key rotation by the term: CoinPay checkout, signed webhook, idempotent settle, expiry and renewal emails, over any SQL store. **Use when:** Selling automatic key rotation (or any auto-approve switch) by the term: CoinPay checkout, webhook, expiry and renewal email. · src github.com/profullstack/key-rotation
- ~~`@profullstack/payment-gateway`~~ 0.4.0: Unified payment gateway abstraction for multiple payment providers **Avoid:** Old provider abstraction. Use @profullstack/coinpay.

### Ship + operate (15)

Deploy, secure, watch and keep the fleet up.

- `@profullstack/emailer` 1.0.3: Resend API delivery for transactional and bulk email. No SMTP or Gmail transport. Queue integration is planned but is not available in production. **Use when:** Sending email in bulk or transactionally over Resend. · src github.com/profullstack/emailer
- `@profullstack/threatcrush` 0.13.69: An all-in-one security daemon: monitor, detect, scan and protect servers in real time. **Use when:** Server security monitoring and scans. · src github.com/profullstack/threatcrush
- `@profullstack/cli` 0.2.0: The commands every Profullstack CLI shares: `update` and `uninstall`, done the same way the tool was installed (curl installer, npm, bun, pnpm or yarn). **Use when:** Every fleet CLI: shared update and uninstall commands. · src github.com/profullstack/cli
- `@profullstack/sh1pt` 0.3.7: One codebase to every store, registry, CDN and channel. **Use when:** Releasing one codebase to stores, registries, CDNs and channels. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-target-deploy-ssh` 0.1.2: Railway-style deploys to a server you own: git push in, a running app with a domain, TLS, a database and secrets out. No Docker, no Kubernetes, no PaaS. **Use when:** Railway-style git-push deploys to a box we own. · src github.com/profullstack/sh1pt
- `@profullstack/deploy` 0.1.0: Deploy in batches, 3 at a time: a box-wide deploy gate (bash + flock) every deploy takes a slot from, and a batch runner for rolling one change out to many... **Use when:** Any fan-out deploy: the box-wide gate, three at a time. · src github.com/profullstack/deploy
- `@profullstack/nmaptui` 0.1.0: An admin console for nmap in the terminal: build scans from profiles, watch them run live, browse hosts and services, triage findings, diff scans over time... · src github.com/profullstack/nmaptui
- `@profullstack/crawlproof` 0.5.0: What the fleet costs and what it returns, in a live terminal dashboard over your traffic. **Use when:** Watching fleet traffic, cost and return from a terminal. · src github.com/profullstack/crawlproof.com
- `@profullstack/kali` 0.1.0: Unofficial one-command installer for popular Kali-style security tools (web app pentesting toolkit) on Debian/Ubuntu. · src github.com/profullstack/kali
- `@profullstack/scanner` 1.1.2: A comprehensive CLI and Node.js module for web application security scanning with OWASP compliance, supporting multiple scanning tools and detailed... · src github.com/profullstack/scanner
- `@profullstack/quantum-database-backups` 1.0.1: CLI tool for creating post-quantum encrypted Supabase database backups · src github.com/profullstack/quantum-database-backups
- `@profullstack/encrypt` 0.1.0: Quantum-resistant encryption: ML-KEM-1024 plus ChaCha20-Poly1305, wire compatible with qrypt.chat. **Use when:** Any encryption need. Use before writing crypto code. · src github.com/profullstack/encrypt
- `@profullstack/fleet` 0.1.1: Read an OpenDevice inventory (servers, desktops, phones, tablets), add up what the fleet costs a month, observe each box's public metadata, and export the... **Use when:** Adding up what the box fleet costs from an OpenDevice inventory. · src github.com/profullstack/fleet
- `@profullstack/fleetbar` 0.2.0: One fleet monitoring panel for every Profullstack site: a dependency-free <fleet-bar> web component (SSH login, HTTP, keyword, SSL and TCP checks run 24/7... · src github.com/profullstack/fleetbar
- `@profullstack/watchdog` 0.3.0: Restart instead of hanging. **Use when:** Every long-running service: exit when Postgres or Redis wedges. · src github.com/profullstack/watchdog

### Product clients (28)

The CLI, TUI or MCP client for one Profullstack product. Use it to drive that product, not as a library.

- `@profullstack/qryptchat` 0.14.2: qc: qrypt.chat in your terminal. A full-screen end-to-end encrypted chat client (ML-KEM-1024), plus a scriptable CLI and an MCP server. · src github.com/profullstack/qryptchat-web
- `@profullstack/nichedb` 0.58.0: CLI and MCP bridge for NicheDB collections, sources and feeds. **Use when:** Reading or writing NicheDB collections, sources and feeds. · src github.com/profullstack/niche-db
- `@profullstack/payagent` 0.8.0: pay.agent: get paid in crypto with one link, Venmo for the agentic web. Sign in with CoinPay; pay anyone by handle from the web, API, CLI, TUI or MCP.
- `@profullstack/demomovie` 0.5.0: Make a narrated product demo video from a URL. The command line for demo.movie.
- `@profullstack/demomovie-mcp` 0.5.0: MCP server for demo.movie, so an agent can film the feature it just shipped.
- `@profullstack/groupcall` 0.7.1: call: a party line for people and AI agents. Make a room, get a four-digit code, everyone dials one number and keys it.
- `@profullstack/residentalerts` 0.8.0: alerts: live 911 incidents near you on a map, push alerts for the places you care about, and the police and fire radio for your county. 99 once.
- `@profullstack/tleehealth` 0.5.2: tleehealth from the terminal: the CLI, the front-desk TUI, and the API client the MCP server uses. · src github.com/profullstack/tleehealth.com
- `@profullstack/tleehealth-mcp` 0.5.2: MCP server for tleehealth.com: read the practice schedule, the navigation caseload and superbill, and log navigation time from any MCP client. · src github.com/profullstack/tleehealth.com
- `@profullstack/watchwallet` 0.2.1: wallet: know the second your wallet moves.
- `@profullstack/builtindie` 0.8.0: indie: launch your indie product with one URL. txt, OpenSite and OpenProfile from your homepage; people upvote; you get a badge.
- `@profullstack/wx93` 0.4.1: wx93.me from the terminal: shorten links, see their stats, print QR codes, all in an hqtui TUI too, plus a stdio MCP server for agents. · src github.com/profullstack/wx93.me
- `@profullstack/saasrow` 0.4.0: Command-line client for saasrow.com: search the software directory, and create and manage your free listings and API keys from the terminal. · src github.com/profullstack/saasrow-web
- `@profullstack/wx93-mcp` 0.4.1: MCP server for wx93.me: let any MCP client shorten URLs, list links and read click stats. Same tools as the hosted https://wx93.me/mcp. · src github.com/profullstack/wx93.me
- `@profullstack/smshub` 1.11.0: Rent a phone number and receive SMS / verification codes from your terminal, scripts and AI agents (CLI, TUI, MCP) via smshub.dev · src github.com/profullstack/smshub
- `@profullstack/r4ck` 0.3.0: CLI and MCP bridge for the hosting search engine. · src github.com/profullstack/r4ck.dev
- `@profullstack/deadman` 0.1.3: switch: a dead man's switch for your crypto. Seal where the keys are, check in now and then, and if you stop, the people you chose get it.
- `@profullstack/billing` 0.3.1: Clients, rates and invoices from the terminal; integer money. **Use when:** Invoicing clients from the terminal. · src github.com/profullstack/billing
- `@profullstack/torlink` 1.5.1: A sleek, zero-setup torrent finder and downloader that lives right in your terminal. (profullstack fork) · src github.com/profullstack/torlink
- `@profullstack/typeheard-mcp` 0.1.0: MCP server for typeheard.com: transcribe audio and video files from any MCP client. · src github.com/profullstack/typeheard.com
- `@profullstack/bl0ggers` 0.2.0: Post to your bl0ggers.com publications from the terminal: blog posts, newsletter issues, podcast episodes.
- `@profullstack/pwamart` 0.11.0: pwamart from the terminal: search the web-app store, install PWAs as app windows, publish your own, and browse it all in an hqtui TUI. · src github.com/profullstack/pwamart.com
- `@profullstack/typeheard` 0.1.0: Transcribe audio and video from the terminal: typeheard <file>. Also a TUI and the client the MCP server uses. · src github.com/profullstack/typeheard.com
- `@profullstack/tsbb-tui` 0.12.1: Terminal client for a tsbb bulletin board. Reads and posts against any centralised install. · src github.com/profullstack/tsbb
- `@profullstack/rssamplifier` 0.4.0: CLI for the feed directory: search, OPML export, submit.
- `@profullstack/qrypt-decrypt` 1.1.3: CLI tool to decrypt QryptChat encrypted key files
- `@profullstack/d0rz` 0.1.0: d0rz.com from your terminal and your agents: CLI, TUI and MCP server for the local help marketplace (asks, offers, responses, messages).
- `@profullstack/pwamart-mcp` 0.11.0: MCP server for pwamart.com: search the web-app store, get install steps for any platform, and submit and publish your PWAs from any MCP client. · src github.com/profullstack/pwamart.com

### sh1pt adapters (208)

Plugins for sh1pt. Install them through sh1pt, never on their own.

- `@profullstack/sh1pt-core` 0.3.7: Core interfaces and contract-test runners for sh1pt adapters. **Use when:** Writing a sh1pt adapter. · src github.com/profullstack/sh1pt
- ~~`@profullstack/sh1pt-payment-stripe`~~ 0.1.11: No description on npm. **Avoid:** No Stripe anywhere (house rule).
- `@profullstack/sh1pt-openapi` 0.3.7: OpenAPI loader/IR + generators for SDKs, MCP servers, and docs sites, plus a breaking-change diff. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-policy` 0.3.7: Store-policy linter for sh1pt, catches rejections before submission. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-actions-fleet-core` 0.3.7: Action-pack schema, validator, deterministic renderer, and catalog loader for sh1pt Actions Fleet. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-sdk` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-recipe-waitlist-crypto-investor` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-target-console-steam` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-api` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-observability-sentry` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-security-snyk` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-target-web-static` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-action-packs` 0.3.7: Built-in sh1pt actions and workflow templates for the Actions Store. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-automation-browser` 0.3.7: Reusable Playwright recipes for the console chores that have no API: OAuth consent screens, app review settings, redirect URIs. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-migrate` 0.1.15: Move an application and its data between platforms, in either direction. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-agent-*` (3, 0.1.11): claude, codex, qwen
- `@profullstack/sh1pt-bot-*` (14, 0.1.11): core, discord, irc, matrix, phonenumbers, signal, slack, teams, telegram, telnyx, twilio, twitch, wechat, whatsapp
- `@profullstack/sh1pt-bridge-*` (8, 0.1.11): discord, irc, mastodon, matrix, nostr, signal, slack, telegram
- `@profullstack/sh1pt-captcha-*` (2, 0.1.11): 2captcha, solver
- `@profullstack/sh1pt-cloud-*` (12, 0.1.11, 0.1.15): atlantic, cloudflare, digitalocean, firebase, fly, hetzner, netcup, nvidia, railway, runpod, supabase, vultr
- `@profullstack/sh1pt-dns-*` (2, 0.1.11): cloudflare, porkbun
- `@profullstack/sh1pt-docs-*` (4, 0.1.11): gslides, lumin, marp, pandoc
- `@profullstack/sh1pt-entity-*` (25, 0.1.11): au, bb, bw, ca, dao-wy, fj, gh, hk, ie, in, jm, ke, my, ng, nz, pk, sg, tt, tz, ug, uk, us, za, zm, zw
- `@profullstack/sh1pt-merch-*` (2, 0.1.11): printful, printify
- `@profullstack/sh1pt-outreach-*` (3, 0.1.11): listennotes, producthunt, resend
- `@profullstack/sh1pt-payment-*` (5, 0.1.15, 0.1.11): bitnob, coinpay, paypal, transfi, worldremit
- `@profullstack/sh1pt-promo-*` (14, 0.1.11): angellist, apple-search, capitalreach, google, kickstarter, linkedin, meta, microsoft, openvc, reddit, tiktok, wefunder, x, youtube
- `@profullstack/sh1pt-secrets-*` (4, 0.1.11, 0.3.7): doppler, dotenvx, env-updater, onepassword
- `@profullstack/sh1pt-social-*` (34, 0.1.11): 4claw, blossom, bluesky, codenewbie, devto, facebook, forem, hackernews, hackernoon, hashnode, indiehackers, instagram, klawdin, linkedin, mastodon, medium, moltbook, moltexchange, moltfounders, moltywork, openwork, primal, quora, reddit, secureclaw, stackernews, the-colony, threads, tikclawk, tiktok, toku-agency, ugig, x, youtube
- `@profullstack/sh1pt-target-browser-*` (4, 0.1.11): chrome, edge, firefox, safari
- `@profullstack/sh1pt-target-chat-*` (5, 0.1.11): discord, signal, slack, telegram, whatsapp
- `@profullstack/sh1pt-target-deploy-*` (8, 0.1.11): denodeploy, firebase, fly, netlify, railway, render, vercel, workers
- `@profullstack/sh1pt-target-desktop-*` (4, 0.1.11): linux, mac, steamos, win
- `@profullstack/sh1pt-target-mobile-*` (3, 0.1.11): android, expo, ios
- `@profullstack/sh1pt-target-pkg-*` (16, 0.1.11): apt, aube, aur, cdn, deno, docker, fdroid, flatpak, ghpackages, homebrew, jsr, nix, npm, scoop, snap, winget
- `@profullstack/sh1pt-target-plugin-*` (2, 0.1.11): jetbrains, vscode
- `@profullstack/sh1pt-target-tv-*` (5, 0.1.11): androidtv, firetv, roku, tvos, webos
- `@profullstack/sh1pt-target-xr-*` (6, 0.1.11): meta-quest, pico, sidequest, steamvr, visionos, webxr
- `@profullstack/sh1pt-vcs-*` (3, 0.1.11): gitea, github, gitlab
- `@profullstack/sh1pt-webhooks-*` (5, 0.1.11): discord, generic, slack, teams, telegram

### Uncategorised (16)

Published, not yet sorted. Read the README before depending on one.

- `@profullstack/outreachgraph` 0.27.0: og: OutreachGraph from a terminal. Approval queue, prospects, campaigns and imports over the /api/v1 API. · src github.com/profullstack/outreachgraph
- `@profullstack/pluginstore` 0.1.2: Reusable plugin store contracts and helpers for Profullstack apps · src github.com/profullstack/pluginstore
- `@profullstack/therapy` 1.5.14: CLI tool for interacting with an AI therapist · src github.com/profullstack/therapy
- `@profullstack/mediaanalyzer` 0.4.0: Describe and sort photos, videos, audio and documents with AI: a searchable description next to every file, and every file in the right folder.
- `@profullstack/sans-db` 1.0.3: No description on npm.
- `@profullstack/fasting` 1.6.4: A comprehensive CLI and Node.js module for 16:8 intermittent fasting with meal tracking, weight monitoring, and fast history with visual charts · src github.com/profullstack/fasting
- `@profullstack/reeleel` 0.4.0: The ReelEel command line. Same services as the desktop app, scriptable. · src github.com/profullstack/reeleel
- `@profullstack/tsbb` 0.12.1: A TypeScript bulletin board. Forums, plugins, avatars, signatures and a terminal client. · src github.com/profullstack/tsbb
- `@profullstack/sans-api` 1.0.3: No description on npm.
- `@profullstack/places` 1.0.2: CLI tool to scrape business place data from ValueSERP API
- `@profullstack/viral-video` 0.1.1: CLI to generate 60s vertical video kits and optionally render MP4 using ffmpeg · src github.com/profullstack/viral-video
- `@profullstack/bufferoverride` 0.1.0: bo, capture a real failure with its environment, redact the secrets, and find the existing answer before you ask. · src github.com/profullstack/bufferoverride
- `@profullstack/myna-plugin-agenticjobs` 0.1.0: Post jobs to an agenticjobs board from myna. A job posting is a publication, not a status update, so it is never part of a fan-out. · src github.com/profullstack/agenticjobs
- `@profullstack/neon-builder` 1.0.1: A production-ready CLI tool for generating digital product bundles with AI-powered content, branded PDFs, and automated packaging · src github.com/profullstack/neon-builder
- `@profullstack/networking-bots` 1.2.0: A CLI social media networking bot to automate outreach and account management. · src github.com/profullstack/networking-bots
- ~~`@profullstack/cli-updater`~~ 0.1.0: Shared version-checked update, upgrade, remove, and auto-update helpers for Profullstack CLIs **Avoid:** Deprecated on npm: Use @profullstack/cli; it is the maintained shared lifecycle package.

### Public repos without a package

Apps, sites and tools whose source is public at github.com/profullstack/<name>. Read one before building the same thing. 35 archived or forked repos left out (they are in /stack.json).

- .github: Profullstack organization profile and community health files
- advis0r.com (TypeScript): Executive-transcript stock discovery CLI: turns public exec communications + Alpaca market data + SEC fundamentals into a ranked, evidence-backed research watchlist. Research aid, not financial advice.
- agentbbs (Go): A modern BBS over SSH for humans and AI agents, arcade (DOOM), agent game ladders, personal Linux pods ($1/mo via CoinPay), and the AgentAd marketplace. Go + wish + bubbletea.
- agentic-era-book (HTML): Software Engineering in the Agentic Era: a free field guide to building software with AI agent fleets. Markdown + pandoc to HTML, PDF, EPUB.
- ai-dot-text (JavaScript): ai.txt cli for generating LLMs.txt and ai.txt readable files on web apps.
- aiornot.vote (TypeScript): A photorealistic image/video guessing game. Verified users decide whether media is AI-generated or real, track a personal history, compete on leaderboards, and subscribe to every list by RSS.
- amazon-affiliate (JavaScript): 🎬 Automated Amazon affiliate video creation with AI voiceover and YouTube publishing
- bg0ne.com (JavaScript): BG, gone. FOSS background removal on open models. Free previews, pay by the image in USDC, or self-host the whole thing.
- bitchin.net (V)
- bitcoinlatte (TypeScript): BitcoinLatte is a map for finding coffeeshops that take Bitcoin.
- bookmarklets
- botspm (JavaScript): AI bot management platform for conducting "lives" on TikTok, YouTube or X
- brand-assets (HTML): Brand and marketing assets for Profullstack, Inc. and #Moshcoding, logos, avatars, banners, badges, ad cards and video. Live kit: https://anthony.dev.profullstack.com/assets/
- c0mpute (Rust): Open compute network: run a node with one command and help pool 100,000 CPUs/GPUs for open-weight AI. Inference, transcoding, storage. CLI-first, MIT.
- c0upons (TypeScript): Coupons platform built with Vite + React and SQLite Cloud
- cache.follows.lol (Julia)
- chovy.com (CSS): Terminal-style microblog, short thoughts, nothing over 240 chars
- cl1s.tech (JavaScript): Open advertising network for CLI tools and AI agents, built on the AgentAd standard. Disclosed, agent-readable, terminal-native ads.
- cli-tools (TypeScript)
- coinpay-php (PHP): Read-only split mirror of php/coinpay in profullstack/x402-ports. Do not open pull requests here.
- coinpaybot (TypeScript)
- coldfollow-web (JavaScript)
- commandboard.run (TypeScript): CommandBoard.run hosted product and reference implementation for LogicSRC
- cookiebanner-web (CSS)
- css (CSS): Semantic-first, agent-friendly CSS for humans and the interfaces they build together.
- d1sks.com (JavaScript): The OpenDisk marketplace and OpenObject reference store: every disk that serves /.well-known/opendisk.json, listed by free GiB, price, country and policy.
- d3vices.com (JavaScript): Open-source hardware diagnostics that run on your device. Test your mic, camera, screen, keyboard, sensors and network, in the browser, as a PWA, or on the desktop.
- datamart.help (TypeScript): datamart.help (placeholder)
- diskpush (TypeScript): Push files fast. Sync only what changed. A desktop app and CLI for rsync: browse servers like FileZilla, transfer with rsync, and move files directly between two servers.
- dot-skills (JavaScript): A portable, verifiable inventory of agent-executable skills. Every entry states how far it has actually been proven.
- ethshot-web (JavaScript): A viral Ethereum-powered game where users pay 0.001 ETH per shot for a 1% chance to win the jackpot.
- fleetsysops.com (TypeScript): The Fleet SysOps Manifesto: how one human runs a fleet of coding agents (fleet coding), served as nothing but Markdown
- follows-web (JavaScript)
- fullstack-api (JavaScript): API written in node.js, koa and mongodb
- fullstack-ui (Vue): User interface written in vue.js
- genrewatch.com (JavaScript): A release calendar for every genre. Follow a genre or a name, get told before it drops.
- gentoo-pairux (Shell): Gentoo overlay for PairUX - collaborative screen sharing
- gentoo-tronbrowser (Shell): Gentoo overlay for TronBrowser - privacy-first, AI-native browser
- getprivacycode (TypeScript)
- hdtilt.com (JavaScript): Open-source IPTV player like TiviMate: M3U, Xtream Codes, XMLTV guide, catch-up. Web/PWA, desktop, CLI, TUI, MCP and API.
- homebrew-infernet (Ruby): Homebrew tap for the Infernet Protocol CLI
- homebrew-pairux (Ruby): Homebrew tap for PairUX
- homebrew-tap (Ruby): Homebrew tap for Profullstack apps. brew tap profullstack/tap
- hqsh (Go): A terminal session that survives disconnects like mosh, but carries the raw stream: images and every escape reach your terminal.
- hqterm (TypeScript): Persistent terminal sessions that survive disconnects, with images and HD emoji. Built on hqtui + hqsh.
- hynt-mobile (JavaScript)
- icemap.app (TypeScript): Anonymous, real-time incident reporting on a map. No accounts. No tracking. Posts auto-delete after 8 hours.
- interviews (Python)
- intr0s (Shell)
- invoicer (JavaScript)
- irc-bot (JavaScript)
- kynfi (HTML): Secure file & photo sync across all your devices.
- launch.anapp.now (TypeScript): Top-of-funnel campaign site for Chovy: type the idea, launch it now.
- launchpadder-web (JavaScript): The platform enables frictionless URL submission with automated metadata scraping, AI-generated descriptions, and federated submissions across multiple directories.
- link-directories (JavaScript)
- linkedin-networking-bot (HTML)
- links-aggregator (JavaScript): Aggregation of onion sites with random redirect button
- logicsrc (TypeScript): LogicSRC is an open standards initiative for human and AI agent coordination, maintained by Profullstack, Inc.
- makedemo (JavaScript): A CLI tool that automates generating high-quality web demo MP4 videos by intelligently interacting with websites using AI-driven decision making.
- malware-test-prs (Python): testing malware scanners on github and other ci/cd paltforms.
- marketng-networking-bot
- marksyncr.com (JavaScript): MarkSyncr is a cross-browser extension that enables two-way bookmark synchronization between browsers and external storage sources (local files, GitHub repos, Dropbox).
- media-streamer (TypeScript): A comprehensive multi-media streaming platform that allows users to stream music, movies, books, and live TV from torrents and IPTV sources - without downloading content until playback.
- meshhook (JavaScript): MeshHook is an MIT-licensed, webhook-first workflow engine with a visual builder (SvelteKit/Svelte 5) and Temporal-like durability via event sourcing on Postgres (Supabase).
- modules (Shell): module system
- moshpit-proxy (TypeScript): Registry-pinned TLS proxy for Moshpit names. Verifies the origin's key against the registry instead of a certificate authority.
- moshpit-transport (TypeScript): Post-quantum authenticated transport for native Moshpit clients. Hybrid X25519 + ML-KEM-768, ML-DSA-65 identity, no TLS and no certificates.
- mums.flower (TypeScript): Flowers for moms: remember mom's birthday and Mother's Day, flower meanings, bouquet cards. Web, PWA, API, MCP, CLI.
- music (JavaScript): My new vibe coding band Velocity Vibe
- nightcell7 (TypeScript): NIGHTCELL 7: FALSE DAWN, premium episodic FPS. Two operatives, two countries, one manufactured war. Babylon.js + TypeScript monorepo with server-authoritative multiplayer.
- nixamp (TypeScript): It really whips the terminal's ass. Open-source streaming platform: turn a folder into a live radio station, TV channel or film night anyone can tune into. Terminal player, web app and desktop app on one engine, with a...
- onion-ssr-boilerplate (JavaScript)
- openemoji (CSS): Every standard emoji, drawn by an image model as one family, packed as an OpenEmoji set: PNG, WebP, SVG, colour fonts
- openicon (HTML): 370 UI icons (259 drawn, 111 brand logos) as SVG, PNG and terminal glyphs: Nerd Font, Unicode, ASCII. An OpenIcon set.
- opensourcelegends.com (TypeScript): Trading cards for the people who built the software the world runs on.
- othr-web (JavaScript)
- p0dcasters (TypeScript): Directory of independent, self-hosted podcasts, 22,386 shows on their own domains
- pairux-apt: APT repository for PairUX - Debian/Ubuntu packages
- pairux-nix (Nix): Nix flake for PairUX - collaborative screen sharing
- pairux-rpm: RPM repository for PairUX - Fedora/RHEL packages
- parklookup.com (JavaScript): A Progressive Web App (PWA) for discovering and exploring U.S. National and State Parks.
- paybadge (JavaScript): A sleek, professional payment badge system for accepting cryptocurrency donations directly from your GitHub README files.
- png2svg.sh
- poly (JavaScript): Svelte 4 LTS fork
- prazium
- profullstack
- profullstack-dao (JavaScript)
- qaaas-test-app (HTML): Deliberately buggy todo app for testing QAaaS.dev and PRaaS (Pull Requests as a Service)
- recipepdfs.com (TypeScript)
- reddit-networking-bot (JavaScript)
- relay.follows.lol (C++)
- rss-amplifier (JavaScript): A CLI tool for contextual RSS amplification with AI-driven snippet generation and social media posting.
- rssamplifier.com (JavaScript): An open, agent-first directory of independent blogs. Submit a URL, a list or an OPML file; every blog gets its own page. JSON API, OPML and llms.txt for agents.
- sans-demo (JavaScript): Demo app built using Sans UI
- scoop-bucket: Scoop bucket for Profullstack apps. scoop bucket add profullstack https://github.com/profullstack/scoop-bucket
- scoop-pairux: Scoop bucket for PairUX
- scripts (JavaScript): Hand-written command-line tools
- sinkstate (TypeScript): Find the states your agent graph can enter but never leave. Dead-state analysis for LangGraph, CrewAI and n8n.
- smashlang (Rust): A fully programmable, multi-platform, syntax-slick modern language. Let’s finish this strong. 💪
- smashlang-windsurf (JavaScript): SmashLang code highlighting support for WindSurf
- sorrycheck (TypeScript): Does that proof actually check? A public verdict registry for papers and repos claiming machine-checked proofs.
- svgcrusher (JavaScript): CLI-first SVG optimization for svgcrusher.com
- sysops.ceo (HTML): sysops.ceo
- thesoundofpi.com (HTML)
- tipoffwatch.com (JavaScript): Sports calendar and reminder PWA. Follow any team in the world; get told before they play.
- tronbrowser.dev (TypeScript): Open-source, privacy-first, AI-native browser built on a Chromium fork. No telemetry, no ads, no sponsored tabs.
- tutorlinkup-web (JavaScript): A marketplace platform connecting individuals who need test-taking services with qualified test-takers, featuring secure cryptocurrency payments.
- ugig.net (TypeScript): A marketplace for AI-assisted engineers and skilled workers.
- unyunddit (JavaScript): Reddit clone for .onion
- uyunlist (PHP): Self-hosted, anonymous onion classifieds marketplace, PHP + self-hosted Supabase + a Tor hidden service, one-command deploy to a DigitalOcean droplet.
- venuedating-web (JavaScript): Venue Dating is a modern Progressive Web App (PWA) that connects people at their favorite venues.
- vibe-stack (JavaScript): A modern, AI-first framework built for rapid development of Progressive Web Apps (PWAs). Designed for versatility and speed, it provides an optimized boilerplate for creating, testing, and deploying full-stack...
- vicoa-coinpay-overlay (Python): CoinPay crypto billing overlay for self-hosted Vicoa: sell Pro passes for USDC/BTC/ETH
- vu1nz-gh-actions (Python): vu1nz Github Actions Scanner
- w3bs.org (JavaScript): W3BS: the open Web for humans, agents and devices. Community drafts and reference stack.
- watchnews.now (JavaScript): WatchNews, follow a news desk or a newsroom, read what it published, and watch the channels covering it. A brand of the tipoffwatch platform (BRAND=watchnews).
- web-engineer-education: Educational videos, courses, lectures, texts, and blogs for web engineers
- webcomponents (JavaScript): Web components library using vanilla JavaScript, CSS and HTML
- wiresniff-desktop-electron (TypeScript)
- x402-gateway-php (PHP): Read-only split mirror of php/x402-gateway in profullstack/x402-ports. Do not open pull requests here.
- x402-ports (Rust): x402-gateway in Python, Go, Rust, Ruby, PHP, Elixir and Zig, plus the CoinPay CLI from every package manager. One monorepo, one fixture file.
- zymo-mobile (TypeScript)

### Drop-in wiring (curated)

**@profullstack/coinpay-onboard**

```sh
npm install @profullstack/coinpay-onboard
```

```js
npx @profullstack/coinpay-onboard site <name> --webhook <url>
```

**@profullstack/x402-gateway**

```sh
npm install @profullstack/x402-gateway
```

```js
import { createGateway } from '@profullstack/x402-gateway';
import { x402Gateway } from '@profullstack/x402-gateway/hono';
export const gateway = createGateway({ siteUrl: process.env.SITE_URL ?? '', coinpay: { apiKey: process.env.COINPAY_X402_KEY }, payTo: process.env.CRAWL_PAY_TO });
export const crawlGateway = x402Gateway(gateway); // app.use('*', crawlGateway)
```

**@profullstack/x402-client**

```sh
npm install @profullstack/x402-client
```

```js
import { createClient } from '@profullstack/x402-client';
export const payer = createClient({ key: process.env.X402_PRIVATE_KEY, maxUsd: 5 });
// const res = await payer.fetch(url); pays a 402 once, then presents the pass
```

**@profullstack/throttle**

```sh
npm install @profullstack/throttle
```

```js
import { createThrottle } from '@profullstack/throttle';
export const throttle = createThrottle({ limit: 100, rules: [{ path: '/health', open: true }] });
// const answer = await throttle.handle(request); if (answer) return answer;
```

**@profullstack/coinpay**

```sh
npm install @profullstack/coinpay
```

```js
import { CoinPayClient } from '@profullstack/coinpay';
export const coinpay = new CoinPayClient({ apiKey: process.env.COINPAY_API_KEY ?? '' });
// await coinpay.createPayment({ businessId, amount, currency: 'USD', blockchain })
```

**@profullstack/watchdog**

```sh
npm install @profullstack/watchdog
```

```js
import { watchDependencies } from '@profullstack/watchdog';
// Pass probes, not clients: postgres resolves truthy, redis answers PONG. Call stop() first on SIGTERM.
export const startWatchdogs = (probes: Parameters<typeof watchDependencies>[0]) => watchDependencies(probes);
// startWatchdogs({ postgres: () => healthcheck(), redis: () => redis.ping() })
```

**@profullstack/emailer**

```sh
npm install @profullstack/emailer
```

```js
import { createEmailer } from '@profullstack/emailer';
export const emailer = createEmailer({ resendApiKey: process.env.RESEND_API_KEY });
// await emailer.send({ from, to, subject, html, text })
```

**@profullstack/email-queue**

```sh
Not published to npm. Source: github.com/profullstack/mynaposter/tree/main/packages/email-queue
```

```js
Do not treat as a production service until its API, worker deployment, PostgreSQL schema, quotas, monitoring and application migrations are complete.
```

**@profullstack/autoblog**

```sh
npm install @profullstack/autoblog
```

```js
import { buildEvent, sendWebhook, verifyAndParse } from '@profullstack/autoblog';
export { buildEvent, sendWebhook, verifyAndParse };
// sendWebhook(url, buildEvent(post, { source: SITE_URL }), { secret: process.env.WEBHOOK_SECRET })
```

**@profullstack/hqtui**

```sh
npm install @profullstack/hqtui
```

```js
import { createApp } from '@profullstack/hqtui';
export const tui = await createApp();
// tui.render(({ ui }) => ui.panel({ title: 'Hello' }, (p) => p.text('Hello'))); await tui.start();
```

**@profullstack/player**

```sh
npm install @profullstack/player
```

```js
import { createPlayer } from '@profullstack/player';
import '@profullstack/player/player.css';
export const mountPlayer = (el: HTMLElement, src: string) => createPlayer(el, { src });
```

**@profullstack/modern-css**

```sh
npm install @profullstack/modern-css
```

```js
import '@profullstack/modern-css';
// <ul class="subgrid-cards" style="--card-rows: 3"><li class="subgrid-card squircle">...</li></ul>
// h1 { font-size: 3.6rem; font-size: --fluid(2.6rem, 3.6rem); }
```

**@profullstack/leaderboard**

```sh
npm install @profullstack/leaderboard
```

```js
import { createLeaderboard, sqlStore } from '@profullstack/leaderboard';
export const createBoards = (execute: (q: { sql: string; args: unknown[] }) => Promise<{ rows: Record<string, unknown>[] }>) =>
  createLeaderboard({ siteName: process.env.SITE_NAME ?? '', siteUrl: process.env.SITE_URL ?? '', store: sqlStore({ execute }), boards: { top: { label: 'Top', metric: 'points' } } });
```

**@profullstack/notifications**

```sh
npm install @profullstack/notifications
```

```js
import { vapidKeysFromEnv, sendPushToMany } from '@profullstack/notifications/server';
export const vapidKeys = vapidKeysFromEnv(); // VAPID_PUBLIC_KEY + VAPID_PRIVATE_KEY
export { sendPushToMany };
```

**@profullstack/referrals**

```sh
npm install @profullstack/referrals
```

```js
import { createCode, buildReferralUrl, applyReferral, calculateReferral } from '@profullstack/referrals';
export { createCode, buildReferralUrl, applyReferral, calculateReferral };
// createCode(userId, store) needs a ReferralStore wired to your database
```

**@profullstack/affiliates**

```sh
npm install @profullstack/affiliates
```

```js
import { Affiliates, sqliteStore, postgresStore } from '@profullstack/affiliates';
export const aff = new Affiliates(sqliteStore(db)); // or postgresStore(pool); tables aff_* created on first use
// signup: const r = await aff.redeemInvite(code, userId); if (!r.ok) reject(r.reason)
// await aff.createInvite(userId) throws 'no invites left' past the quota (default 3)
```

**@profullstack/redeem-credits**

```sh
npm install @profullstack/redeem-credits
```

```js
import { Credits, sqliteStore, postgresStore } from '@profullstack/redeem-credits';
export const credits = new Credits(sqliteStore(db)); // or postgresStore(pool); tables credit_* created on first use
// const { code } = await credits.mint({ grant: { unit: 'minutes', amount: 1000, every: 'month' } })
// await credits.redeem(code, userId); await credits.spend(userId, 'minutes', 12)
```

**@profullstack/webhooks**

```sh
npm install @profullstack/webhooks
```

```js
import { Webhooks, sqliteStore, webhooksApi } from '@profullstack/webhooks';
export const hooks = new Webhooks({ store: sqliteStore(db), source: SITE_URL, eventTypes: ['invoice.paid'] }).start(); // or postgresStore(pool)
const api = webhooksApi(hooks, { basePath: '/api/v1/webhooks', owner: async (req) => (await userFrom(req))?.id });
app.all('/api/v1/webhooks/*', async (c) => (await api(c.req.raw)) ?? c.notFound());
// await hooks.emit(user.id, 'invoice.paid', { id, amount })
```

**@profullstack/sealed-secrets**

```sh
npm install @profullstack/sealed-secrets
```

```js
import { createSealer, UnlockStore } from '@profullstack/sealed-secrets';
const sealer = createSealer({ app: 'myapp' });
// browser/CLI: const { dek, seal, recoveryKey } = await sealer.createSeal(passphrase, user.id);
// const blob = await sealer.sealSecrets(dek, { GITHUB_TOKEN }, user.id); // store seal + blob, show recoveryKey once
// later: const key = await sealer.unlockSeal(seal, passphrase, user.id); await sealer.unsealSecrets(key, blob, user.id);
// worker: if (await sealer.verifyDataKey(key, seal, user.id)) sessions.unlock(user.id, key, 8 * 3600);
// Key vault UI: raw(keyVaultCardHtml({ app, scope, userId, vault, scriptSrc })) + bundle '@profullstack/sealed-secrets/vault-ui/auto' (IIFE)
// mountVaultRoutes(app, { userId: (c) => requireUser(c).id, handlers: createVaultHandlers({ sealer, store, onUnlock, onLock, status }) });
```

**@profullstack/orgs**

```sh
npm install @profullstack/orgs
```

```js
import { migrate, createOrg, addMember, can, inviteToOrg, acceptInvite } from '@profullstack/orgs';
export { migrate, createOrg, addMember, can, inviteToOrg, acceptInvite };
// await migrate(sql) on boot, with a postgres.js client
```

**@profullstack/profile**

```sh
npm install @profullstack/profile
```

```js
import { createProfileStore, validateProfile, saveSignupProfile, createProfileHandlers } from '@profullstack/profile';
import { ProfileFields } from '@profullstack/profile/react';
const profiles = createProfileStore(sql); // postgres.js, Bun SQL, pg, libSQL, libsql-pg, bun:sqlite, supabase
await profiles.migrate();
```

**@profullstack/form-guard**

```sh
npm install @profullstack/form-guard
```

```js
import { createFormGuard } from '@profullstack/form-guard';
export const formGuard = createFormGuard({ secret: process.env.FORM_GUARD_SECRET ?? '', binding: 'contact' });
// const verdict = await formGuard.check({ fields: body, headers: request.headers });
```

**@profullstack/scraper-daemon**

```sh
npm install @profullstack/scraper-daemon
```

```js
import { createDaemon, sqliteStore } from '@profullstack/scraper-daemon';
export const daemon = createDaemon({ name: 'my-site', store: sqliteStore(db) });
// daemon.job({ name, every, run }), daemon.queue({ name, every, items, run }), daemon.start()
```

## 6. Not in the stack

- **Hetzner:** Ruled out permanently. Railway hosts the fleet; a netcup box and DigitalOcean droplets cover what needs a VM.
- **Vercel, Fly.io, Cloudflare Workers:** Not deploy targets. One repo has a fly.toml and none have a wrangler config. Railway is the host.
- **Supabase for a new app:** Turso is the default. Supabase and Postgres stay where they already are.
- **.env files as the source of secrets:** The vault and the platform env are the authority. A file is a stale copy.
- **Password-first auth, next-auth:** Magic link plus passkeys. @profullstack/auth-system is password-only and is the exception, not the pattern.
- **SvelteKit, Primate + SurrealDB, Express for new work:** Earlier generations still in maintenance. Do not start anything new on them.
- **Tauri:** Retired in favour of Electron with the bundled CLI.
- **mocha, jest, Prisma:** vitest and plain SQL or Drizzle.
- **Oxc, Oxlint, Oxfmt, Rolldown as a default:** On the roadmap since June and present in six repos. Use the repo's existing lint and format setup until parity is proven.
- **Hand-rolled players, rate limiters, contact-form guards, feed forms:** Each of these is a published package already.
- **video.js, plyr, a bare hls.js or mpegts.js:** @profullstack/player wraps hls.js and mpegts.js already. video.js 10 ships no player at all: it throws VJS8_LEGACY_* on v8 code.
- ***.up.railway.app URLs:** Our domains only.

## 7. Contact

Profullstack, Inc. · anthony@profullstack.com · https://profullstack.com