STACK / BUILD
Build it, then put it online on the stack
Create an agent-ready starter with the Profullstack modules you need. Download the full source for free, or publish its Web/PWA starter page to your own HTTPS subdomain while you keep building.
Free source ZIP$2.99 to publish$2/month after the first 30 days
Surfaces
House modules
Only modules that serve the ticked surfaces are shown. Ops modules always are.
Get it
Put your starter on a live URL
Publish a branded Web/PWA starter page at my-app.dev.profullstack.com for $2.99. Your first 30 days are included, then hosting is $2/month. Keep the full source ZIP free and keep building while your starter is live.
- Live HTTPS URL on a Profullstack subdomain
- Connect your own domain from the private management page
- Monthly renewal is manual through CoinPay; no automatic charges
Hosted publishing serves a static Web/PWA starter page. Your full Next.js, API, and other source files stay in the free ZIP or GitHub repo.
Files
# My app: agent instructions
This repo is a boilerplate from the Profullstack /stack builder (https://profullstack.com/stack/build).
You are the agent taking it over. Build the app it describes.
## Your job
1. Read this whole file. The stack and house rules below are not optional.
2. Ask the owner what the app is for if the README does not say.
3. Put shared logic in `src/core/`. Every surface calls the core and nothing else.
4. Wire each module from `src/modules/`. The snippets are starting points; finish them.
5. Add tests next to the code (`bun test`). Keep CI green.
6. Ship through `bin/install.sh` (OpenInstall) or sh1pt. No manual setup steps.
## What was picked
- **App:** My app (`my-app`)
- **Surfaces:** `web`, `pwa`
- **Modules:** none picked yet
## Where each surface lives
- **web:** `app/`: Next app router. The browser talks only to `/api`.
- **pwa:** `public/manifest.webmanifest`, `public/sw.js`, `app/register-sw.tsx`.
## Hard rules
- No Stripe and no card checkout. Payments are CoinPay (crypto) and x402.
- The browser talks only to `/api`. No database client in client code.
- Auth is magic link plus passkeys.
- Secrets live in the vault and the platform env, never in a committed `.env`.
- Copy has no em dashes and no LLM flourishes. Short sentences.
---
# The stack (from https://profullstack.com/stack.md)
# The Profullstack stack
> Profullstack runs about 170 active repos on a small number of deliberate combinations. Pick the combo that matches the job, inherit the shared defaults, follow the house rules, and reuse the published packages before writing anything new.
>
> Human page: https://profullstack.com/stack · JSON: https://profullstack.com/stack.json · Skill: https://profullstack.com/skill.md · Updated 2026-10-29
## 1. Pick a combo
There is no single stack. Match the job to one of the combos below, then apply the shared defaults and house rules.
| If you are building | Use | Why |
| --- | --- | --- |
| A new product with a web UI | `web-app` | Next 16 on Turso with a Hono API inside the app. This is the default for anything new. |
| A change to an existing SaaS on Supabase or Postgres | `web-app-postgres` | Stay on the database it has. Do not migrate an app to Turso as a side effect of a feature. |
| A real-time 3D game, in the browser and on the desktop | `games` | Babylon on a pure rules core, server-authoritative multiplayer, and art generated by committed scripts rather than modelled by hand. |
| An API, crawler, poller or data service with little or no UI | `api-service` | Hono on Turso, Bun or Node, one Railway service with a health check. |
| A command-line or terminal tool, or an agent-facing bridge | `cli-tui` | Node, TypeScript, commander, hqtui for dashboards, MCP where an agent should drive it, published to npm. |
| A desktop app | `desktop` | Electron with the CLI bundled inside it, so one install gives both surfaces. |
| A mobile app | `mobile` | Expo inside the product monorepo, sharing the API and packages. |
| Code two or more products need | `library` | A runtime-neutral @profullstack/* package with subpath exports, released from GitHub. |
| Something that must be a single fast binary | `systems` | Rust (tokio, axum, clap), or Go when the upstream ecosystem is Go. |
## 2. Shared defaults (every combo)
| Concern | Choice | Notes |
| --- | --- | --- |
| Language | TypeScript, ESM | "type": "module" everywhere. Kebab-case filenames, semicolons, printWidth 100. JavaScript with JSDoc is fine in small packages. |
| Runtime | Node 22 or 24 (floor is 20) | Bun 1.4 where the repo pins it in packageManager. Runtimes are managed with mise on dev boxes. |
| Package manager | pnpm, pinned in packageManager | Bun on Bun repos. Never mix lockfiles. Workspaces via pnpm-workspace.yaml for monorepos (apps/, packages/, services/). |
| Hosting | Railway | One project per product, railway.json per service with healthcheckPath, deploys on push to the default branch. Custom domain before any URL is written down. |
| Web server | Caddy | Hosts, reverse proxies and static sites with automatic HTTPS (it gets and renews certificates itself) and IPv6 on by default. Its localhost admin API lets agents and the w3bs CLI add a site without editing config. The default web server on W3BS OS and in front of pit.world and Moshpit names (moshpit-proxy). nginx boxes keep nginx until they are moved. |
| DNS | Porkbun | No Cloudflare DNS requirement. |
| Secrets | logicsrc team vault + Railway service variables | Set on the service, record in the vault. No .env files in repos; a framework-required .env.local is a local cache, never the source. |
| Auth | Magic link + passkeys | The magic link doubles as signup. Passkeys via @simplewebauthn. An optional password only for devices that cannot open mail or hold a passkey (TVs). |
| Email | Resend + @profullstack/email-queue (in development) | Resend is the intended application provider. The shared queue source is not published and is not yet deployed portfolio-wide. PostgreSQL audit integration, service API, CLI, MCP, admin PWA, production monitoring and migrations remain incomplete. Gmail sending is restricted to approved one-off use. |
| Payments | CoinPay (crypto) and x402 | Crypto through @profullstack/coinpay. x402 sells access to agents and crawlers, settled by CoinPay. No Stripe and no card checkout. |
| Crawler policy | @profullstack/x402-gateway + @profullstack/throttle | Training crawlers get 402 with a daily pass to buy, robots.txt is generated from the same lists, and every route is limited to 100 req/min with a price instead of a 429. |
| Media playback | @profullstack/player | Every audio and video player: MP4, HLS, MPEG-TS and audio with one control bar. `attachSource` when a site keeps its own UI. A third-party player bump that breaks means move to it, not migrate the old player. |
| Modern CSS | @profullstack/modern-css | Subgrid cards, squircle corners, stuck headers, grid gap rules, height:auto accordions, reading-flow and @function helpers (--fluid, --alpha, --inner-radius) as opt-in classes in the components layer. Reach for these before JS or extra DOM. Every one is progressive enhancement: write the plain value first. |
| Analytics | CrawlProof stats.js | Every public site loads crawlproof.com/stats.js. Careers pages are fed from CrawlProof. |
| Referrals | @profullstack/stack/referrals | Tracked in the request proxy, 60/20 split. |
| Testing | vitest | `vitest run` in CI. `node --test` for small CLIs, `bun test` on Bun repos, Playwright for browser flows. |
| Lint + format | Prettier + ESLint | Biome or Oxlint where a repo already uses it. Do not add a second formatter to a repo. |
| CI | GitHub Actions | ci.yml, codeql.yml and threatcrush-scan.yml on every repo. Release after merge with gh release; a merged PR reaches nobody until the release is cut. |
| AI | c0mpute via @profullstack/ai-providers, MCP via @modelcontextprotocol/sdk | Every text or JSON model call goes through @profullstack/ai-providers: c0mpute peer nodes first, OpenAI and Anthropic only as alternating fallbacks. One Infernet trusted-client key (ifc_) per app as C0MPUTE_API_KEY. Never import openai or @anthropic-ai/sdk directly for text. Anything an agent should operate ships an MCP bridge. |
| Promotion | myna (mynaposter.com) | The last phase of every ship: socials, both blogs and a CrawlProof ad from one command. Syndicated copies carry rel=canonical back to our page. |
| Data | NicheDB, RSS Amplifier, r4ck | Datasets come from and go back to nichedb.dev. Feeds are submitted through @profullstack/submit-feed. OpenProfile.md for people, /.well-known/openaccess.json for access terms. |
## 3. Combos
### Web app (`web-app`)
The default for a new product. Next 16 renders the UI, a Hono app mounted inside it serves the API, Turso holds the data, and one Railway service runs web and worker together.
**Use it when:**
- You are starting a product that has a UI and a database.
- The data fits SQLite semantics: one writer, modest joins, no Postgres extensions.
- You want one service, one deploy, one domain.
| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Next 16, React 19 | App Router. proxy.ts, not middleware.ts. Server components by default. |
| API | Hono inside Next | Mounted under /api. Versioned routes live at /api/v1/... and OAuth callbacks at /api/v1/<provider>/<function>/<endpoint>. |
| Database | Turso (libSQL) via @libsql/client | Forward-only SQL migrations in packages/db, or Drizzle with dialect turso. Migrations must be safe to run twice concurrently. |
| UI | Tailwind 4 + shadcn/ui | Scoped behind a ui.css without preflight when adding to an existing site. Plain CSS modules on marketing sites. |
| Realtime | Server-Sent Events | WebSockets only for chat, terminals and multiplayer. |
| Background work | A worker process in the same container | Supervised by the entrypoint; the container exits non-zero when either process dies. BullMQ on Redis only when the queue is the product. |
| Storage | Railway volume or Cloudflare R2 | R2 buckets private, served through signed or proxied routes. |
| Layout | apps/web, packages/db, services/worker | Root-only vitest config, tsconfig.base.json with strict flags. Copy nightcell7 or reeleel rather than inventing a layout. |
**Notes:**
- Next inlines process.env.NAME at build time, so read runtime secrets through a non-literal key.
- A 200 on /api/health proves nothing about the worker. Check the logs for its up line after a deploy.
**Examples:** [rssamplifier.com](https://rssamplifier.com) · [p0dcasters](https://github.com/profullstack/p0dcasters) · [c0upons](https://github.com/profullstack/c0upons) · [opensourcelegends.com](https://opensourcelegends.com) · [sorrycheck](https://github.com/profullstack/sorrycheck) · [sinkstate](https://github.com/profullstack/sinkstate) · [bufferoverride](https://github.com/profullstack/bufferoverride) · [nightcell7](https://github.com/profullstack/nightcell7)
### Web app on Postgres (`web-app-postgres`)
The previous generation of the same shape, and still the largest by count. Next 16 on Supabase, or on a self-hosted Postgres in the same Railway project. Kept where the data needs Postgres or the app already lives there.
**Use it when:**
- The app is already on Supabase or Postgres. Stay there.
- You need row-level security, pgvector, heavy relational joins, or a queue on Redis next to the database.
- Several services share one database and the write volume is real.
| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Next 16, React 19 | Same conventions as web-app. |
| Database | Supabase Postgres, or self-hosted Postgres on Railway | Supabase client via @profullstack/stack/supabase. New Postgres apps self-host on Railway (w3bs.org is the reference). Index every foreign key you will cascade through. |
| Auth | Magic link + passkeys on the app's own users table | Supabase Auth exists in older apps; the local users.id is always the primary key. |
| Queues | BullMQ on Redis | Custom job ids must not contain a colon. |
| Migrations | supabase/migrations or plain SQL | Applied in CI or on boot, never by hand in the dashboard. |
**Notes:**
- Do not move an app to Turso as part of a feature. Classify it first: easy Turso, needs Postgres, or consolidate.
- coinpayportal is public with 19 forks. Never put real data in a fixture there.
**Examples:** [coinpayportal.com](https://coinpayportal.com) · [ugig.net](https://ugig.net) · [crawlproof.com](https://crawlproof.com) · [marksyncr.com](https://marksyncr.com) · [logicsrc.com](https://logicsrc.com) · [w3bs.org](https://w3bs.org) · [brisk.news](https://brisk.news) · [icemap.app](https://icemap.app)
### API service (`api-service`)
Hono on Turso with no framework in front of it. For pollers, crawlers, data APIs, MCP servers and anything whose UI is a few server-rendered pages or none at all. Bun or Node, chosen per repo and pinned.
**Use it when:**
- The product is an API, a feed, a dataset or a daemon.
- The UI is small enough to render from Hono (JSX or templates) or lives in a separate app.
- You want the smallest possible service: one process, one SQLite file or one Turso database.
| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Hono 4 | Web-standard Request/Response. Same app runs on Bun and Node; the router is the only Hono-specific code. |
| Runtime | Bun or Node, pinned | Bun for stream-heavy or IO-heavy services (genrewatch, tipoffwatch, niche-db, r4ck). Node + pnpm when the service shares code with a Next app or a CLI. |
| Database | Turso (libSQL) | Embedded replica or remote. FTS5 for search, with the raw query escaped; libSQL cannot bind undefined. |
| Rate limiting | @profullstack/throttle | Credentialed callers get 600/min, anonymous 100/min, over the limit is a 402 with an offer. |
| Agent surface | MCP bridge in the CLI package | One query vocabulary across page, API, CLI and MCP. |
| Deploy | Railway, Dockerfile or Nixpacks | railway.json with healthcheckPath. Pin pnpm 10 on Nixpacks; corepack cannot launch pnpm 11. |
**Notes:**
- Bun-only gotchas: Bun.serve idleTimeout kills long streams, and Bun's SQL client stringifies arrays. Keep those behind small adapters.
**Examples:** [nichedb.dev](https://nichedb.dev) · [r4ck.dev](https://r4ck.dev) · [genrewatch.com](https://genrewatch.com) · [tipoffwatch.com](https://tipoffwatch.com) · [watchnews.now](https://watchnews.now) · [agenticjobs](https://github.com/profullstack/agenticjobs) · [tronbrowser.dev](https://tronbrowser.dev) · [reeleel](https://github.com/profullstack/reeleel)
### CLI and TUI (`cli-tui`)
Terminal tools for people and agents. Node and TypeScript, commander for arguments, hqtui for anything with a screen, an MCP bridge so an agent can drive the same commands, published to npm under @profullstack.
**Use it when:**
- The user is a developer, an operator or an agent.
- The tool wraps a site or API we run (nichedb, rssamplifier, coinpay, r4ck, readm3).
- You need a dashboard in a terminal rather than a browser.
| Concern | Choice | Notes |
| --- | --- | --- |
| Runtime | Node 20+ (Bun optional) | Node is required: CLIs run in GitHub Actions and on customer machines. Bun is fine for development. |
| Arguments | commander | Subcommands map one to one onto MCP tools. |
| TUI | @profullstack/hqtui | btop-grade dashboards, one import. A mouse must work: one click unfolds, hover highlights. |
| Config | ~/.<tool>.json + @profullstack/synconfig | Allowlisted snapshot synced with the tool's cloud. |
| Install | npm i -g @profullstack/<tool> and curl | sh | The installer does the whole job. Never document a manual follow-up step. |
| Testing | node --test or vitest | bun test on Bun repos; mock.module is process-wide there. |
| Release | GitHub release workflow publishes to npm | Bump before testing. A brand-new scoped package 404s for minutes after publish. |
**Examples:** [@profullstack/hqtui](https://www.npmjs.com/package/@profullstack/hqtui) · [@profullstack/nichedb](https://www.npmjs.com/package/@profullstack/nichedb) · [@profullstack/coinpay](https://www.npmjs.com/package/@profullstack/coinpay) · [@profullstack/readm3](https://www.npmjs.com/package/@profullstack/readm3) · [@profullstack/g1tz](https://www.npmjs.com/package/@profullstack/g1tz) · [@profullstack/r3q](https://www.npmjs.com/package/@profullstack/r3q) · [@profullstack/billing](https://www.npmjs.com/package/@profullstack/billing) · [cli-tools](https://github.com/profullstack/cli-tools)
### Desktop (`desktop`)
Electron, with the product's CLI bundled inside the app. A desktop install gives the CLI too, with no system Node, and the two surfaces cannot disagree because they are the same build.
**Use it when:**
- The product needs a tray, a window, the filesystem or OS input.
- A CLI already exists and the desktop app is a second surface for it.
| Concern | Choice | Notes |
| --- | --- | --- |
| Shell | Electron | Tauri was tried and retired. |
| Inside | Hono or Next, same as the web surface | The renderer is the web app; the main process hosts the API locally. |
| CLI | Bundled via extraResources | The installer writes a shim: ELECTRON_RUN_AS_NODE=1 exec app resources/cli/dist/bin.js. Build the bundle with pnpm deploy --prod --legacy. |
| Native modules | N-API only | Electron's ABI differs from system Node. @libsql/* passes; anything with V8 symbols does not. |
| Distribution | GitHub releases + curl installer | Headless machines get a CLI-only tarball. Homebrew, apt, rpm, scoop and nix repos exist for pairux. |
| Auto-update | From GitHub releases | Set the tool's NO_AUTO_UPDATE env when testing a dev binary. |
**Examples:** [mynaposter](https://github.com/profullstack/mynaposter) · [diskpush](https://github.com/profullstack/diskpush) · [threatcrush](https://github.com/profullstack/threatcrush) · [pairux.com](https://pairux.com) · [nixamp](https://github.com/profullstack/nixamp) · media2markdown · [r4ck.dev](https://github.com/profullstack/r4ck.dev)
### Games (`games`)
Babylon in the browser, with every gameplay rule in a package that cannot import a renderer. The same rules run in the client, in the authoritative match server and in tests, so a rule exists exactly once.
**Use it when:**
- The product is a real-time 3D scene the player acts inside, not a page they read.
- It has to run in a browser first, with the desktop build as a second surface rather than the only one.
| Concern | Choice | Notes |
| --- | --- | --- |
| Renderer | Babylon.js | WebGPU where the browser has it, WebGL2 fallback. The fallback is a supported path, not a degraded one. |
| Physics | Havok via @babylonjs/havok | Only where real collision response is needed; most props are static. |
| Rules | A pure game-core package | No Babylon, no DOM, no Electron imports. This is the rule that makes a client and a server able to agree. |
| UI | Preact, outside the frame loop | The component layer never owns a per-frame transform. HUD readouts are text-node writes behind a change check, not a render pass. |
| Multiplayer | Server-authoritative over WSS | The client sends input intent. The server owns movement validation, damage, death, respawn and score. Shared messages live in their own protocol package. |
| Build | Vite + vite-plugin-pwa | Set registerType and actually wire the update prompt; prompt with no handler means returning players never get a new build. |
| API and data | Hono, Drizzle, Postgres | Same as api-service. Never cache /api, matchmaking or tickets in the service worker. |
| Desktop | Electron | The desktop combo applies unchanged; the renderer is the same web build. |
| Art | Generated by committed Blender scripts | No asset without provenance. One Blender metre is one game metre, GLB with glTF-compatible PBR, COL_ colliders and SOCKET_ attachment points. |
**Notes:**
- Distant point lights and glows are camera-facing sprites held at a fixed screen size, never scaled geometry. A 25 mm firefly is sub-pixel past 30 m and no amount of scaling the mesh fixes that.
- Budget the shell download. Models ship geometry, UVs and a named material slot; the engine binds the real textures by that name so one atlas is not shipped ten times.
**Examples:** [nightcell7](https://github.com/profullstack/nightcell7) · [nightcell7.com](https://nightcell7.com)
### Mobile (`mobile`)
Expo and React Native, as apps/mobile inside the product monorepo. It shares the API client and packages with the web app rather than living in its own repo.
**Use it when:**
- The product needs to be in the app stores or on a phone home screen with native capabilities.
- A PWA is not enough (push, background, camera, payments in-app).
| Concern | Choice | Notes |
| --- | --- | --- |
| Framework | Expo (React Native) | React 19. Shares types and the API client with apps/web. |
| Layout | apps/mobile in the product monorepo | Standalone *-mobile repos are the old pattern and are dormant. |
| Backend | The product's own api-service or web-app | No separate mobile backend. |
| Store release | sh1pt | One codebase to every store, registry and channel. |
**Notes:**
- Start with the PWA. Most products never need this combo.
**Examples:** [threatcrush](https://github.com/profullstack/threatcrush) · [pairux.com](https://github.com/profullstack/pairux.com) · [postammo.com](https://postammo.com) · [reeleel](https://github.com/profullstack/reeleel) · [tronbrowser.dev](https://github.com/profullstack/tronbrowser.dev)
### Library (`library`)
Code that two or more products need becomes a @profullstack/* package. Runtime-neutral core, subpath exports, one npm package per concern, released from GitHub.
**Use it when:**
- You are about to copy a module from one repo into another.
- A site needs a component another site already ships (player, leaderboard, feed submission, contact-form guard).
| Concern | Choice | Notes |
| --- | --- | --- |
| Shape | ESM, TypeScript, subpath exports | `@profullstack/stack/referrals`, `/email`, `/supabase`, `/feedback`, `/coinpay`, `/crawlproof` is the pattern. Peer-depend on next, react and clients rather than bundling them. |
| Core | Web-standard APIs | fetch, Request, Response, URL, crypto.subtle, ReadableStream. Runtime-specific code behind an adapter. A /core entry must never import a node: module. |
| Build | tsup or plain tsc | Node type-stripping needs .ts specifiers; pair with rewriteRelativeImportExtensions so dist still emits .js. |
| Tests | vitest | Contract tests where the package defines a protocol (x402, submit-feed, OpenProfile). |
| Release | Bump, merge, gh release | A release workflow publishes. Ship pkg@latest in docs, never update -g. pnpm 11 refuses packages younger than a day unless excluded from minimumReleaseAge. |
**Examples:** [@profullstack/stack](https://github.com/profullstack/stack) · [@profullstack/x402-gateway](https://github.com/profullstack/x402-gateway) · [@profullstack/throttle](https://github.com/profullstack/throttle) · [@profullstack/player](https://github.com/profullstack/player) · [@profullstack/modern-css](https://github.com/profullstack/modern-css) · [@profullstack/leaderboard](https://github.com/profullstack/leaderboard) · [@profullstack/form-guard](https://github.com/profullstack/form-guard) · [@profullstack/submit-feed](https://github.com/profullstack/submit-feed)
### Systems (`systems`)
Rust when the product is a single static binary that has to be fast (benchmarks, transports, agents on servers). Go when the upstream ecosystem is Go. Python only for security tooling that lives in that world.
**Use it when:**
- A JavaScript runtime would be the bottleneck or the dependency you cannot ship.
- The upstream you build on is in that language (LiveKit for agentbbs, nmap and Kali tooling).
| Concern | Choice | Notes |
| --- | --- | --- |
| Rust | tokio, axum, clap, reqwest | c0mpute is the reference. Auto-update from GitHub releases on first run. |
| Go | Standard library + the upstream SDK | agentbbs pins livekit server-sdk-go and protocol together. |
| Python | Managed by mise, venv per project | Security tooling and GitHub Actions only (vu1nz). |
| Distribution | GitHub releases, curl installer, homebrew tap | Same installer rule: it does the whole job. |
**Examples:** [c0mpute](https://github.com/profullstack/c0mpute) · [agentbbs](https://github.com/profullstack/agentbbs) · [fiche-agentic](https://github.com/profullstack/fiche-agentic) · [vu1nz.com](https://vu1nz.com) · [kali](https://github.com/profullstack/kali)
## 4. House rules
- **Ship it, never stop at in progress.** An agent does not end its turn on "still running, I will report when it lands". Work handed to a subagent, CI or a deploy is driven to merged, released and verified live in the same turn, then reported once with the result. Stop early only for a real blocker a person must clear: a login, or a decision that is theirs.
- **Every site takes payment from launch.** Launching a site includes taking crypto: npx @profullstack/coinpay-onboard site <name> --webhook <public url> makes its CoinPay business, copies the payout wallets in, sets the webhook and writes the COINPAY_* keys into the site vault. Idempotent; every step must print a check before the launch is announced.
- **Launch on a Moshpit name.** New products launch on a Moshpit name (pit.moshcode.sh), not a new ICANN domain, served from our own box with a registry-signed certificate and listed on the Moshpit ring. Announcements give the <name>.pit.world address for browsers without Moshpit DNS.
- **Reuse the house package first.** Before adding a dependency or writing a component, grep the repo for @profullstack/ and check npm. The package usually exists and is often already installed.
- **Secrets live in the vault.** Set production secrets on the Railway service and record them in the logicsrc team vault. Never write one into a .env in the repo, and never ask a person to.
- **Auth is magic link plus passkeys.** The link proves the address and the address is the account. Passwords are optional and only for devices that cannot do either.
- **Signup asks for the profile.** Every signup collects email, first_name, last_name, company_domain, job_title and linkedin_url through @profullstack/profile, in that order. Email and name are required; the other three are optional. The company is filled from a work email.
- **Every API offers webhooks.** An app with an API and accounts lets customers register webhook endpoints for its events through @profullstack/webhooks: the /api/v1/webhooks routes, a CLI command and MCP tools over them, and emit() wherever something happens. Never hand-roll signing or retries; apps on their own scheme move to it, sending their old header alongside until receivers switch.
- **User keys are sealed by the user.** Any key, token or password a user gives an app (exchange and wallet keys, BYO AI keys, OAuth tokens, SMTP passwords) is sealed with @profullstack/sealed-secrets under a passphrase the user holds, with a one-time recovery key. No server key, env var or database dump can open it. Servers write new secrets through the seal inbox; workers use them only inside an UnlockStore session the user opened. The Settings "Key vault" card, its browser code and the /my/vault routes come from the same package (vault-card, vault-ui/auto, vault-server); never hand-roll one. Operator secrets stay in the logicsrc team vault.
- **Installers do the whole job.** If a feature needs a component, the installer or update command installs it. No documented manual follow-up step. DNS routing is the one thing that stays explicit.
- **Push to the default branch deploys.** PRs are merged, not parked. Release after merge. Then announce through myna, with rel=canonical on every syndicated copy.
- **Our domains only.** Add the custom domain before writing any URL down. Never publish a *.up.railway.app address.
- **Migrations run twice.** Web and worker both migrate on boot. Ledger writes are insert-or-ignore and every migration is safe to apply concurrently.
- **Large catalogues use a sitemap index.** /sitemap.xml is an index; entities are chunked by month of creation so past files never change.
- **OAuth callbacks are namespaced.** /api/v1/<provider>/<function>/<endpoint>, using whatever API prefix the project already has.
- **Every product is a customer of another.** Wire products together when the integration is load-bearing: x402 settles through CoinPay, blogs open CrawlProof ads, myna distributes every ship, NicheDB sells the data.
- **Copy has no LLM tells.** Short sentences, no em dashes, no rule-of-three flourishes. This applies to posts, READMEs and announcements.
- **A wedged process restarts without a person.** Every container gets a HEALTHCHECK that hits its own /healthz, so a blocked event loop shows as unhealthy. watchdog-autoheal restarts what Docker marks unhealthy, three times an hour at most, then emails. In-process, watchDependencies exits when the shared DB or Redis client stops answering.
- **Agents get a first-class surface.** A site ships its data as Markdown or JSON at a stable URL, a CLI ships an MCP bridge, and training crawlers pay through x402 rather than being blocked.
## 5. Reuse these packages before writing anything
Every package in the `@profullstack` npm scope (353) and every public github.com/profullstack repo (263), regenerated from npm and GitHub on 2026-11-03. Check `grep -r "@profullstack/" package.json` in the repo first: the package is often already installed. Install `pkg@latest`. Line format: `name` latest version: purpose. **Use when** is hand-written guidance; **Avoid** means do not add it to new work.
### Build (53)
The app layer: shared modules, accounts, data, UI, terminals and media.
- `@profullstack/footer` 0.6.19: Profullstack's distributed footer engine for remote, agent-friendly site branding and navigation. **Use when:** Every fleet site footer and webring row. · src github.com/profullstack/footer
- `@profullstack/profile` 0.1.8: The signup profile every property collects: email, first_name, last_name, company_domain, job_title, linkedin_url. **Use when:** Every signup: collect the six profile fields with this, not a custom form. · src github.com/profullstack/profile
- `@profullstack/hqtui` 0.12.0: Terminal UI for TypeScript: btop-grade dashboards from one import. **Use when:** Any terminal UI or dashboard. Do not reach for blessed, ink or a hand-rolled ANSI loop. · src github.com/profullstack/hqtui
- `@profullstack/synconfig` 0.1.3: Sync a tool's config files with its cloud: allowlisted snapshot, digest, optimistic replace. **Use when:** A CLI that syncs its config files with its cloud. · src github.com/profullstack/mynaposter
- `@profullstack/auth-system` 0.8.3: Flexible authentication system with user registration, login/logout, password reset, and session management **Use when:** Legacy apps only: it is password + JWT. New apps use magic link + passkey. · src github.com/profullstack/auth-system
- `@profullstack/notifications` 0.1.4: Web push for any app: VAPID keys from env, subscribe from the page, one service worker handler. **Use when:** Web push from any app. · src github.com/profullstack/notifications
- `@profullstack/live-translate` 0.3.0: Live speech translation for streams and meetings: hear (ElevenLabs Scribe), translate (pluggable), re-voice (ElevenLabs Flash), with per-listener language... **Use when:** Live speech translation for a stream or meeting. · src github.com/profullstack/live-translate
- `@profullstack/form-guard` 0.3.0: Contact-form spam stopped with a signed proof-of-render token, not a captcha. **Use when:** Any public form that must stop spam. No captcha. · src github.com/profullstack/form-guard
- `@profullstack/stack` 0.6.0: Shared modules for Next apps: referrals, email, supabase, feedback widget, coinpay, crawlproof. Used by 37 repos. **Use when:** A Next or Node app needs referrals, email, CoinPay or CrawlProof wiring in one import. · src github.com/profullstack/stack
- `@profullstack/contact-form` 0.4.0: The Profullstack contact form: customizable questions with generic defaults, form-guard spam protection (signed proof-of-render token, honeypot, fill time... **Use when:** A site needs a contact or lead form. This is THE fleet contact form. · src github.com/profullstack/contact-form
- `@profullstack/libsql-pg` 0.1.4: A drop-in @libsql/client that talks to Postgres, plus the tools to move a Turso database over. **Use when:** Moving a Turso app to Postgres, or running @libsql/client code against Postgres. · src github.com/profullstack/libsql-pg
- `@profullstack/player` 0.17.0: One web player for MP4, HLS, MPEG-TS and audio with one control bar. Knows that Chrome lies about native HLS. **Use when:** Any video or audio on a page. Never add hls.js or video.js directly. · src github.com/profullstack/player
- `@profullstack/hqtui-demo` 0.12.0: The HQTUI reference dashboard: a btop-grade terminal system monitor. Runs on real system metrics or a deterministic simulation. **Use when:** A reference for how an hqtui dashboard is built. Depend on @profullstack/hqtui. · src github.com/profullstack/hqtui
- `@profullstack/leaderboard` 0.3.1: Public leaderboard with badges, streaks and a commission ladder for any site. **Use when:** A public leaderboard, badges or streaks. · src github.com/profullstack/leaderboard
- `@profullstack/spa-router` 1.14.0: Simple SPA router with smooth transitions, component loading, and Shadow DOM support · src github.com/profullstack/spa-router
- `@profullstack/text-type-detection` 1.0.0: Detect text format types (plain, markdown, ascii art, code, html, json, xml) from strings · src github.com/profullstack/text-type-detection
- `@profullstack/autoblog` 0.4.0: CloudEvents and Standard Webhooks SDK for publishing posts to the blogs. **Use when:** Publishing posts to the fleet blogs from an app. · src github.com/profullstack/autoblog
- `@profullstack/r3q` 0.2.0: A REST client for your terminal. Requests are files you can commit; the TUI is just a good way to look at them. · src github.com/profullstack/r3q
- `@profullstack/favicon-generator` 1.2.1: Generate PNG icons from an SVG or PNG source for iOS and PWA compatibility · src github.com/profullstack/favicon-generator
- `@profullstack/webhooks` 0.2.1: Webhooks as a feature of any app: customers register endpoints (URL, whsec_ signing key, event patterns like room.*), the app calls emit(owner, type, data)... **Use when:** An API offers webhooks to customers. Every API should. · src github.com/profullstack/webhooks
- `@profullstack/submit-feed` 0.1.3: One way to add a feed to a directory, shared by rssamplifier and p0dcasters. **Use when:** A directory accepts feed submissions. · src github.com/profullstack/submit-feed
- `@profullstack/partners` 0.2.0: Let the people whose work is in your dataset sell it: signup, domain verification, payouts. **Use when:** Letting contributors to a dataset sell it and get paid. · src github.com/profullstack/partners
- `@profullstack/scraper-daemon` 0.3.0: txt, per-host serial fetching, 429 hold-back, SSRF checks and SQLite or Postgres state. com. **Use when:** A listing site needs its updater: jobs, refresh queues, polite fetching. · src github.com/profullstack/scraper-daemon
- `@profullstack/api-key-manager` 0.3.0: Simple API key management system with generation, validation, and rate limiting · src github.com/profullstack/api-key-manager
- `@profullstack/orgs` 0.2.0: Orgs, teams, members, roles and invites for Postgres. Brings no users table and owns its schema through migrate(). **Use when:** Multi-tenancy: orgs, teams, roles, invites on Postgres. · src github.com/profullstack/orgs
- `@profullstack/modern-css` 0.2.0: Modern CSS as opt-in classes and @function helpers: subgrid cards, squircles, stuck headers, gap rules, height:auto accordions. **Use when:** Card grids, squircles, sticky headers, accordions. Before writing layout JS. · src github.com/profullstack/modern-css
- `@profullstack/state-manager` 0.8.0: Enhanced state manager with web component integration, persistence, and subscription management · src github.com/profullstack/state-manager
- `@profullstack/localizer` 0.8.0: Simple localization and internationalization library with RTL support · src github.com/profullstack/localizer
- `@profullstack/summary-forge-module` 1.10.2: An intelligent tool that uses AI to create comprehensive summaries of technical books · src github.com/profullstack/summary-forge-module
- `@profullstack/websocket-client` 0.3.0: Robust WebSocket client with connection management, reconnection logic, and message handling · src github.com/profullstack/websocket-client
- `@profullstack/transcoder` 1.9.14: A server-side module for transcoding videos, audio, and images using FFmpeg with smart presets and optimizations · src github.com/profullstack/transcoder
- `@profullstack/enhanced-router` 0.4.0: Enhanced SPA router with transition management, i18n integration, and layout management · src github.com/profullstack/enhanced-router
- `@profullstack/document-converters` 0.4.0: Simple document conversion utilities for various formats · src github.com/profullstack/document-converters
- `@profullstack/multiview` 0.1.0: Several live streams on one screen, driven by mouse, finger or TV remote. **Use when:** Several live streams in one grid. · src github.com/profullstack/multiview
- `@profullstack/remote-input` 0.2.4: Cross-platform OS input injection for remote control (macOS, Windows, Linux X11 and Wayland) · src github.com/profullstack/pairux.com
- `@profullstack/social-poster` 1.1.0: A CLI tool for posting to multiple social media platforms with browser-based authentication · src github.com/profullstack/social-poster
- `@profullstack/ferroframe` 0.3.4: A Svelte-host TUI framework for Node.js - Build terminal interfaces with the power of Svelte · src github.com/profullstack/ferroframe
- `@profullstack/g1tz` 0.2.2: A git TUI that shows you the repository, not a menu of git commands. · src github.com/profullstack/g1tz
- `@profullstack/sans-ui` 1.0.3: A cross-platform native UI library which supports iOS, Android, Windows, macOS, and Linux using NodeGUI for desktop and NativeScript for mobile.
- `@profullstack/storage-service` 0.4.0: Flexible storage service abstraction for file storage, retrieval, and metadata management · src github.com/profullstack/storage-service
- `@profullstack/syncfg` 0.1.3: Alias of @profullstack/synconfig. **Use when:** Never directly: depend on @profullstack/synconfig. · src github.com/profullstack/mynaposter
- `@profullstack/lead-generator` 1.2.4: A CLI tool for sending mass lead emails to prospective clients from CSV files with AI-powered personalization · src github.com/profullstack/lead-generator
- `@profullstack/autopost` 0.1.0: Typed Node SDK for posting to social platforms via a Crawlproof account. · src github.com/profullstack/autopost
- `@profullstack/socials` 0.1.0: Safe Playwright scaffolding for authorized social account login automation. · src github.com/profullstack/socials
- `@profullstack/ai-providers` 0.1.0: One text-model call for every Profullstack app: c0mpute first, OpenAI and Anthropic as alternating fallbacks, dead keys parked. Zero dependencies. **Use when:** Any text or JSON from a model. c0mpute first, OpenAI/Anthropic as alternating fallbacks, dead keys parked. Not for images or embeddings. · src github.com/profullstack/ai-providers
- `@profullstack/bridges` 0.2.0: Let a host site's signed-in users into an app over OAuth 2.1 with PKCE. No second signup. **Use when:** Users of a host site should land signed in to another app (OAuth 2.1 + PKCE). · src github.com/profullstack/bridges
- `@profullstack/browser-fingerprint` 0.1.0: One vote per browser, not per IP: a salted device fingerprint, a signed challenge, a bot score and limits for anonymous writes. **Use when:** Any anonymous write (votes, sign-ups, quotes, submissions): limit per browser, not per IP. Keeps only a salted hash. · src github.com/profullstack/browser-fingerprint
- `@profullstack/email-queue` 0.2.1: Development package in MyNaPoster. · src github.com/profullstack/mynaposter
- `@profullstack/pairux-embed` 0.1.0: End-to-end encrypted voice, video and screen sharing for any web app, on PairUX's SFU. The host app supplies the media key; the server only forwards ciphertext. · src github.com/profullstack/pairux.com
- `@profullstack/sealed-secrets` 0.2.0: Store the keys and secrets users give an app so only they can open them: a random data key wrapped under the user's passphrase (PBKDF2-SHA256 600k + HKDF +... **Use when:** Storing keys or secrets a user gives the app, so only they can open them; and the Settings Key vault card (vault-card, vault-ui, vault-server) that unlocks them. · src github.com/profullstack/sealed-secrets
- `@profullstack/stream-providers` 0.1.1: Sign a reader into their own streaming or radio account and pull lineups and playable stream URLs from it, one adapter per provider behind one interface... · src github.com/profullstack/stream-providers
- ~~`@profullstack/stripe-config`~~ 2.0.7: CLI tool and ESM module for managing Stripe products, prices, and Connect accounts across multiple projects **Avoid:** No Stripe anywhere (house rule).
- ~~`@profullstack/post-quantum-helper`~~ 1.0.0: Post-quantum encryption helper using ML-KEM (Kyber) + ChaCha20-Poly1305 **Avoid:** Superseded by @profullstack/encrypt.
### Agents (18)
MCP servers, agent tooling and documents an agent can read.
- `@profullstack/readm3` 0.32.0: Markdown editing and sharing for people and teams. Web/PWA, CLI, API and MCP with version history, view/edit links, and a terminal reader. · src github.com/profullstack/readm3
- `@profullstack/group-call` 0.6.1: A group call on a phone number: dial in, key a room code, talk with everyone else who did, people and AI agents alike. · src github.com/profullstack/group-call
- `@profullstack/media2markdown-core` 0.2.1: Deterministic media-to-Markdown pipeline: ffmpeg, whisper.cpp, OCR and PDF parsers. No LLM in the loop.
- `@profullstack/agenticjobs` 0.23.0: An agent-friendly job board you self host. It posts its own jobs and never scrapes anyone else's. **Use when:** Self-hosting an agent-friendly job board. · src github.com/profullstack/agenticjobs
- `@profullstack/media2md` 0.2.1: Turn any video, audio file or book into a chaptered Markdown bundle for an LLM. MCP server available. **Use when:** Turning video, audio or a book into Markdown for an LLM.
- `@profullstack/media2markdown-mcp` 0.2.1: MCP server for media2markdown, let an agent turn a link, video or book into chaptered Markdown itself.
- `@profullstack/adnetwork` 0.3.0: network: run ads, or earn from your site, in crypto. Paste a link and a budget, or paste one tag and add a wallet.
- `@profullstack/mcp-server` 1.6.0: Generic modular MCP server. **Use when:** Building an MCP server: add a module, not a new server. · src github.com/profullstack/mcp-server
- `@profullstack/submitfleet` 0.3.0: SubmitFleet: launch your product on 339 launch sites and directories from one profile. · src github.com/profullstack/submitfleet
- `@profullstack/proxy` 0.2.0: Call the web through residential proxies, with each provider behind one interface. **Use when:** Fetching the web through residential proxies. · src github.com/profullstack/proxy
- `@profullstack/tsbb-mcp` 0.12.1: MCP server for a tsbb bulletin board. Lets an AI assistant read and post on any board, as the member whose token it holds. · src github.com/profullstack/tsbb
- `@profullstack/ai-dot-txt` 1.1.0: CLI tool to generate ai.txt and llms.txt files for AI/LLM policies
- `@profullstack/ai` 1.1.1: A simple AI agent CLI tool for interactive conversations with AI · src github.com/profullstack/ai
- `@profullstack/bot.seo` 0.1.1: seo: paste your domains, get an SEO audit, a strategy and a content plan for each, and articles written on autopilot.
- `@profullstack/fineprint` 0.1.1: An AI lawyer for terms of service and privacy policies: give it a domain or a link, get what you agree to, the liabilities, where your data goes, red flags...
- `@profullstack/openprofile` 0.2.0: Read, write, merge and de-duplicate OpenProfile.md documents. **Use when:** Reading or writing OpenProfile.md for people or agents. · src github.com/profullstack/mynaposter
- `@profullstack/voice-agent` 0.1.1: Phone voice agents that hold a real conversation: define one in code (persona, voice, model, webhook tools), deploy it to ElevenLabs Conversational AI with... **Use when:** A phone agent that talks: persona, voice and tools in code. · src github.com/profullstack/voice-agent
- ~~`@profullstack/pairux`~~ 0.1.0: PairUX CLI: bring AI agents into a live PairUX session as participants **Avoid:** Deprecated on npm: Published by mistake. Use the pairux command from the PairUX installer: https://pairux.com/docs/agents
### Money (15)
Crypto checkout, x402, credits, referrals and invoices.
- `@profullstack/affiliates` 0.3.0: Scarce invite codes (a few per user, single use, hashed, expiring, who-invited-whom) plus open affiliate links with first-touch attribution. **Use when:** Scarce invite codes and affiliate links. · src github.com/profullstack/affiliates
- `@profullstack/redeem-credits` 0.2.0: Redeemable credit codes for any site: mint a scarce code (CR-7K3M-QX9D-2F8H-W4TN, 80 bits, stored only as a sha256 hash), redeem it once per user for... **Use when:** Credit codes that redeem for a balance or a monthly allowance. · src github.com/profullstack/redeem-credits
- `@profullstack/keys` 0.1.0: Ed25519-signed Power Keys: one key that unlocks every Profullstack service. **Use when:** Checking a Profullstack Power Key on a service. · src github.com/profullstack/keys
- `@profullstack/throttle` 0.4.1: App-wide rate limit whose answer to going over is a price, not a 429. **Use when:** Any rate limit. Over the limit is a price, not a 429. · src github.com/profullstack/throttle
- `@profullstack/referrals` 0.1.0: Referral codes, links, discounts and commission, with React and Next adapters. Bring your own store. **Use when:** Referral codes, links and commission math. · src github.com/profullstack/referrals
- `@profullstack/x402-gateway` 0.16.1: Sell crawl access to AI training crawlers by the day over x402, settled by CoinPay. Next and Hono adapters, generated robots.txt. **Use when:** Charging AI crawlers instead of blocking them. · src github.com/profullstack/x402-gateway
- `@profullstack/coinpay-onboard` 0.4.0: Take crypto on CoinPay, set up in one pass: Sign in with CoinPay helpers, an idempotent onboard() (business, payout wallets, webhook), webhook verification... **Use when:** Launching a site: one pass to Sign in with CoinPay, business, wallets and webhook. · src github.com/profullstack/coinpay-onboard
- `@profullstack/coinpay` 0.29.0: CoinPay SDK and CLI: crypto payments, x402 verify and settle, finances TUI. **Use when:** Taking crypto payments, verifying x402 payments. The payment rail for every site. · src github.com/profullstack/coinpayportal
- `@profullstack/x402-client` 0.4.1: Pay x402 402s from JavaScript with a local key: fetch, CLI, adapters for axios and got. **Use when:** Code or an agent that must pay an x402 402. · src github.com/profullstack/x402-client
- `@profullstack/b1dz` 0.3.10: b1dz CLI and TUI: crypto arbitrage terminal for b1dz.com (dashboard, backtests, quote observer, account setup). · src github.com/profullstack/b1dz.com
- `@profullstack/ringhuman` 0.1.0: RingHuman command line: search support routes, place calls that ring you when a human answers, watch events, check credits.
- `@profullstack/basis-engine` 0.1.0: Wallet-by-wallet cost basis tracking for digital assets (Rev. Proc. 2024-28), producing Form 8949 rows and Schedule D totals. · src github.com/profullstack/basis-engine
- `@profullstack/timer` 0.2.0: Time tracker for the terminal and for agents. **Use when:** Tracking billable time from a terminal or an agent. · src github.com/profullstack/timer
- `@profullstack/key-rotation` 0.1.0: Sell automatic key rotation by the term: CoinPay checkout, signed webhook, idempotent settle, expiry and renewal emails, over any SQL store. **Use when:** Selling automatic key rotation (or any auto-approve switch) by the term: CoinPay checkout, webhook, expiry and renewal email. · src github.com/profullstack/key-rotation
- ~~`@profullstack/payment-gateway`~~ 0.4.0: Unified payment gateway abstraction for multiple payment providers **Avoid:** Old provider abstraction. Use @profullstack/coinpay.
### Ship + operate (15)
Deploy, secure, watch and keep the fleet up.
- `@profullstack/emailer` 1.0.3: Resend API delivery for transactional and bulk email. No SMTP or Gmail transport. Queue integration is planned but is not available in production. **Use when:** Sending email in bulk or transactionally over Resend. · src github.com/profullstack/emailer
- `@profullstack/threatcrush` 0.13.69: An all-in-one security daemon: monitor, detect, scan and protect servers in real time. **Use when:** Server security monitoring and scans. · src github.com/profullstack/threatcrush
- `@profullstack/cli` 0.2.0: The commands every Profullstack CLI shares: `update` and `uninstall`, done the same way the tool was installed (curl installer, npm, bun, pnpm or yarn). **Use when:** Every fleet CLI: shared update and uninstall commands. · src github.com/profullstack/cli
- `@profullstack/sh1pt` 0.3.7: One codebase to every store, registry, CDN and channel. **Use when:** Releasing one codebase to stores, registries, CDNs and channels. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-target-deploy-ssh` 0.1.2: Railway-style deploys to a server you own: git push in, a running app with a domain, TLS, a database and secrets out. No Docker, no Kubernetes, no PaaS. **Use when:** Railway-style git-push deploys to a box we own. · src github.com/profullstack/sh1pt
- `@profullstack/deploy` 0.1.0: Deploy in batches, 3 at a time: a box-wide deploy gate (bash + flock) every deploy takes a slot from, and a batch runner for rolling one change out to many... **Use when:** Any fan-out deploy: the box-wide gate, three at a time. · src github.com/profullstack/deploy
- `@profullstack/nmaptui` 0.1.0: An admin console for nmap in the terminal: build scans from profiles, watch them run live, browse hosts and services, triage findings, diff scans over time... · src github.com/profullstack/nmaptui
- `@profullstack/crawlproof` 0.5.0: What the fleet costs and what it returns, in a live terminal dashboard over your traffic. **Use when:** Watching fleet traffic, cost and return from a terminal. · src github.com/profullstack/crawlproof.com
- `@profullstack/kali` 0.1.0: Unofficial one-command installer for popular Kali-style security tools (web app pentesting toolkit) on Debian/Ubuntu. · src github.com/profullstack/kali
- `@profullstack/scanner` 1.1.2: A comprehensive CLI and Node.js module for web application security scanning with OWASP compliance, supporting multiple scanning tools and detailed... · src github.com/profullstack/scanner
- `@profullstack/quantum-database-backups` 1.0.1: CLI tool for creating post-quantum encrypted Supabase database backups · src github.com/profullstack/quantum-database-backups
- `@profullstack/encrypt` 0.1.0: Quantum-resistant encryption: ML-KEM-1024 plus ChaCha20-Poly1305, wire compatible with qrypt.chat. **Use when:** Any encryption need. Use before writing crypto code. · src github.com/profullstack/encrypt
- `@profullstack/fleet` 0.1.1: Read an OpenDevice inventory (servers, desktops, phones, tablets), add up what the fleet costs a month, observe each box's public metadata, and export the... **Use when:** Adding up what the box fleet costs from an OpenDevice inventory. · src github.com/profullstack/fleet
- `@profullstack/fleetbar` 0.2.0: One fleet monitoring panel for every Profullstack site: a dependency-free <fleet-bar> web component (SSH login, HTTP, keyword, SSL and TCP checks run 24/7... · src github.com/profullstack/fleetbar
- `@profullstack/watchdog` 0.3.0: Restart instead of hanging. **Use when:** Every long-running service: exit when Postgres or Redis wedges. · src github.com/profullstack/watchdog
### Product clients (28)
The CLI, TUI or MCP client for one Profullstack product. Use it to drive that product, not as a library.
- `@profullstack/qryptchat` 0.14.2: qc: qrypt.chat in your terminal. A full-screen end-to-end encrypted chat client (ML-KEM-1024), plus a scriptable CLI and an MCP server. · src github.com/profullstack/qryptchat-web
- `@profullstack/nichedb` 0.58.0: CLI and MCP bridge for NicheDB collections, sources and feeds. **Use when:** Reading or writing NicheDB collections, sources and feeds. · src github.com/profullstack/niche-db
- `@profullstack/payagent` 0.8.0: pay.agent: get paid in crypto with one link, Venmo for the agentic web. Sign in with CoinPay; pay anyone by handle from the web, API, CLI, TUI or MCP.
- `@profullstack/demomovie` 0.5.0: Make a narrated product demo video from a URL. The command line for demo.movie.
- `@profullstack/demomovie-mcp` 0.5.0: MCP server for demo.movie, so an agent can film the feature it just shipped.
- `@profullstack/groupcall` 0.7.1: call: a party line for people and AI agents. Make a room, get a four-digit code, everyone dials one number and keys it.
- `@profullstack/residentalerts` 0.8.0: alerts: live 911 incidents near you on a map, push alerts for the places you care about, and the police and fire radio for your county. 99 once.
- `@profullstack/tleehealth` 0.5.2: tleehealth from the terminal: the CLI, the front-desk TUI, and the API client the MCP server uses. · src github.com/profullstack/tleehealth.com
- `@profullstack/tleehealth-mcp` 0.5.2: MCP server for tleehealth.com: read the practice schedule, the navigation caseload and superbill, and log navigation time from any MCP client. · src github.com/profullstack/tleehealth.com
- `@profullstack/watchwallet` 0.2.1: wallet: know the second your wallet moves.
- `@profullstack/builtindie` 0.8.0: indie: launch your indie product with one URL. txt, OpenSite and OpenProfile from your homepage; people upvote; you get a badge.
- `@profullstack/wx93` 0.4.1: wx93.me from the terminal: shorten links, see their stats, print QR codes, all in an hqtui TUI too, plus a stdio MCP server for agents. · src github.com/profullstack/wx93.me
- `@profullstack/saasrow` 0.4.0: Command-line client for saasrow.com: search the software directory, and create and manage your free listings and API keys from the terminal. · src github.com/profullstack/saasrow-web
- `@profullstack/wx93-mcp` 0.4.1: MCP server for wx93.me: let any MCP client shorten URLs, list links and read click stats. Same tools as the hosted https://wx93.me/mcp. · src github.com/profullstack/wx93.me
- `@profullstack/smshub` 1.11.0: Rent a phone number and receive SMS / verification codes from your terminal, scripts and AI agents (CLI, TUI, MCP) via smshub.dev · src github.com/profullstack/smshub
- `@profullstack/r4ck` 0.3.0: CLI and MCP bridge for the hosting search engine. · src github.com/profullstack/r4ck.dev
- `@profullstack/deadman` 0.1.3: switch: a dead man's switch for your crypto. Seal where the keys are, check in now and then, and if you stop, the people you chose get it.
- `@profullstack/billing` 0.3.1: Clients, rates and invoices from the terminal; integer money. **Use when:** Invoicing clients from the terminal. · src github.com/profullstack/billing
- `@profullstack/torlink` 1.5.1: A sleek, zero-setup torrent finder and downloader that lives right in your terminal. (profullstack fork) · src github.com/profullstack/torlink
- `@profullstack/typeheard-mcp` 0.1.0: MCP server for typeheard.com: transcribe audio and video files from any MCP client. · src github.com/profullstack/typeheard.com
- `@profullstack/bl0ggers` 0.2.0: Post to your bl0ggers.com publications from the terminal: blog posts, newsletter issues, podcast episodes.
- `@profullstack/pwamart` 0.11.0: pwamart from the terminal: search the web-app store, install PWAs as app windows, publish your own, and browse it all in an hqtui TUI. · src github.com/profullstack/pwamart.com
- `@profullstack/typeheard` 0.1.0: Transcribe audio and video from the terminal: typeheard <file>. Also a TUI and the client the MCP server uses. · src github.com/profullstack/typeheard.com
- `@profullstack/tsbb-tui` 0.12.1: Terminal client for a tsbb bulletin board. Reads and posts against any centralised install. · src github.com/profullstack/tsbb
- `@profullstack/rssamplifier` 0.4.0: CLI for the feed directory: search, OPML export, submit.
- `@profullstack/qrypt-decrypt` 1.1.3: CLI tool to decrypt QryptChat encrypted key files
- `@profullstack/d0rz` 0.1.0: d0rz.com from your terminal and your agents: CLI, TUI and MCP server for the local help marketplace (asks, offers, responses, messages).
- `@profullstack/pwamart-mcp` 0.11.0: MCP server for pwamart.com: search the web-app store, get install steps for any platform, and submit and publish your PWAs from any MCP client. · src github.com/profullstack/pwamart.com
### sh1pt adapters (208)
Plugins for sh1pt. Install them through sh1pt, never on their own.
- `@profullstack/sh1pt-core` 0.3.7: Core interfaces and contract-test runners for sh1pt adapters. **Use when:** Writing a sh1pt adapter. · src github.com/profullstack/sh1pt
- ~~`@profullstack/sh1pt-payment-stripe`~~ 0.1.11: No description on npm. **Avoid:** No Stripe anywhere (house rule).
- `@profullstack/sh1pt-openapi` 0.3.7: OpenAPI loader/IR + generators for SDKs, MCP servers, and docs sites, plus a breaking-change diff. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-policy` 0.3.7: Store-policy linter for sh1pt, catches rejections before submission. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-actions-fleet-core` 0.3.7: Action-pack schema, validator, deterministic renderer, and catalog loader for sh1pt Actions Fleet. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-sdk` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-recipe-waitlist-crypto-investor` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-target-console-steam` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-api` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-observability-sentry` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-security-snyk` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-target-web-static` 0.1.11: No description on npm. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-action-packs` 0.3.7: Built-in sh1pt actions and workflow templates for the Actions Store. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-automation-browser` 0.3.7: Reusable Playwright recipes for the console chores that have no API: OAuth consent screens, app review settings, redirect URIs. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-migrate` 0.1.15: Move an application and its data between platforms, in either direction. · src github.com/profullstack/sh1pt
- `@profullstack/sh1pt-agent-*` (3, 0.1.11): claude, codex, qwen
- `@profullstack/sh1pt-bot-*` (14, 0.1.11): core, discord, irc, matrix, phonenumbers, signal, slack, teams, telegram, telnyx, twilio, twitch, wechat, whatsapp
- `@profullstack/sh1pt-bridge-*` (8, 0.1.11): discord, irc, mastodon, matrix, nostr, signal, slack, telegram
- `@profullstack/sh1pt-captcha-*` (2, 0.1.11): 2captcha, solver
- `@profullstack/sh1pt-cloud-*` (12, 0.1.11, 0.1.15): atlantic, cloudflare, digitalocean, firebase, fly, hetzner, netcup, nvidia, railway, runpod, supabase, vultr
- `@profullstack/sh1pt-dns-*` (2, 0.1.11): cloudflare, porkbun
- `@profullstack/sh1pt-docs-*` (4, 0.1.11): gslides, lumin, marp, pandoc
- `@profullstack/sh1pt-entity-*` (25, 0.1.11): au, bb, bw, ca, dao-wy, fj, gh, hk, ie, in, jm, ke, my, ng, nz, pk, sg, tt, tz, ug, uk, us, za, zm, zw
- `@profullstack/sh1pt-merch-*` (2, 0.1.11): printful, printify
- `@profullstack/sh1pt-outreach-*` (3, 0.1.11): listennotes, producthunt, resend
- `@profullstack/sh1pt-payment-*` (5, 0.1.15, 0.1.11): bitnob, coinpay, paypal, transfi, worldremit
- `@profullstack/sh1pt-promo-*` (14, 0.1.11): angellist, apple-search, capitalreach, google, kickstarter, linkedin, meta, microsoft, openvc, reddit, tiktok, wefunder, x, youtube
- `@profullstack/sh1pt-secrets-*` (4, 0.1.11, 0.3.7): doppler, dotenvx, env-updater, onepassword
- `@profullstack/sh1pt-social-*` (34, 0.1.11): 4claw, blossom, bluesky, codenewbie, devto, facebook, forem, hackernews, hackernoon, hashnode, indiehackers, instagram, klawdin, linkedin, mastodon, medium, moltbook, moltexchange, moltfounders, moltywork, openwork, primal, quora, reddit, secureclaw, stackernews, the-colony, threads, tikclawk, tiktok, toku-agency, ugig, x, youtube
- `@profullstack/sh1pt-target-browser-*` (4, 0.1.11): chrome, edge, firefox, safari
- `@profullstack/sh1pt-target-chat-*` (5, 0.1.11): discord, signal, slack, telegram, whatsapp
- `@profullstack/sh1pt-target-deploy-*` (8, 0.1.11): denodeploy, firebase, fly, netlify, railway, render, vercel, workers
- `@profullstack/sh1pt-target-desktop-*` (4, 0.1.11): linux, mac, steamos, win
- `@profullstack/sh1pt-target-mobile-*` (3, 0.1.11): android, expo, ios
- `@profullstack/sh1pt-target-pkg-*` (16, 0.1.11): apt, aube, aur, cdn, deno, docker, fdroid, flatpak, ghpackages, homebrew, jsr, nix, npm, scoop, snap, winget
- `@profullstack/sh1pt-target-plugin-*` (2, 0.1.11): jetbrains, vscode
- `@profullstack/sh1pt-target-tv-*` (5, 0.1.11): androidtv, firetv, roku, tvos, webos
- `@profullstack/sh1pt-target-xr-*` (6, 0.1.11): meta-quest, pico, sidequest, steamvr, visionos, webxr
- `@profullstack/sh1pt-vcs-*` (3, 0.1.11): gitea, github, gitlab
- `@profullstack/sh1pt-webhooks-*` (5, 0.1.11): discord, generic, slack, teams, telegram
### Uncategorised (16)
Published, not yet sorted. Read the README before depending on one.
- `@profullstack/outreachgraph` 0.27.0: og: OutreachGraph from a terminal. Approval queue, prospects, campaigns and imports over the /api/v1 API. · src github.com/profullstack/outreachgraph
- `@profullstack/pluginstore` 0.1.2: Reusable plugin store contracts and helpers for Profullstack apps · src github.com/profullstack/pluginstore
- `@profullstack/therapy` 1.5.14: CLI tool for interacting with an AI therapist · src github.com/profullstack/therapy
- `@profullstack/mediaanalyzer` 0.4.0: Describe and sort photos, videos, audio and documents with AI: a searchable description next to every file, and every file in the right folder.
- `@profullstack/sans-db` 1.0.3: No description on npm.
- `@profullstack/fasting` 1.6.4: A comprehensive CLI and Node.js module for 16:8 intermittent fasting with meal tracking, weight monitoring, and fast history with visual charts · src github.com/profullstack/fasting
- `@profullstack/reeleel` 0.4.0: The ReelEel command line. Same services as the desktop app, scriptable. · src github.com/profullstack/reeleel
- `@profullstack/tsbb` 0.12.1: A TypeScript bulletin board. Forums, plugins, avatars, signatures and a terminal client. · src github.com/profullstack/tsbb
- `@profullstack/sans-api` 1.0.3: No description on npm.
- `@profullstack/places` 1.0.2: CLI tool to scrape business place data from ValueSERP API
- `@profullstack/viral-video` 0.1.1: CLI to generate 60s vertical video kits and optionally render MP4 using ffmpeg · src github.com/profullstack/viral-video
- `@profullstack/bufferoverride` 0.1.0: bo, capture a real failure with its environment, redact the secrets, and find the existing answer before you ask. · src github.com/profullstack/bufferoverride
- `@profullstack/myna-plugin-agenticjobs` 0.1.0: Post jobs to an agenticjobs board from myna. A job posting is a publication, not a status update, so it is never part of a fan-out. · src github.com/profullstack/agenticjobs
- `@profullstack/neon-builder` 1.0.1: A production-ready CLI tool for generating digital product bundles with AI-powered content, branded PDFs, and automated packaging · src github.com/profullstack/neon-builder
- `@profullstack/networking-bots` 1.2.0: A CLI social media networking bot to automate outreach and account management. · src github.com/profullstack/networking-bots
- ~~`@profullstack/cli-updater`~~ 0.1.0: Shared version-checked update, upgrade, remove, and auto-update helpers for Profullstack CLIs **Avoid:** Deprecated on npm: Use @profullstack/cli; it is the maintained shared lifecycle package.
### Public repos without a package
Apps, sites and tools whose source is public at github.com/profullstack/<name>. Read one before building the same thing. 35 archived or forked repos left out (they are in /stack.json).
- .github: Profullstack organization profile and community health files
- advis0r.com (TypeScript): Executive-transcript stock discovery CLI: turns public exec communications + Alpaca market data + SEC fundamentals into a ranked, evidence-backed research watchlist. Research aid, not financial advice.
- agentbbs (Go): A modern BBS over SSH for humans and AI agents, arcade (DOOM), agent game ladders, personal Linux pods ($1/mo via CoinPay), and the AgentAd marketplace. Go + wish + bubbletea.
- agentic-era-book (HTML): Software Engineering in the Agentic Era: a free field guide to building software with AI agent fleets. Markdown + pandoc to HTML, PDF, EPUB.
- ai-dot-text (JavaScript): ai.txt cli for generating LLMs.txt and ai.txt readable files on web apps.
- aiornot.vote (TypeScript): A photorealistic image/video guessing game. Verified users decide whether media is AI-generated or real, track a personal history, compete on leaderboards, and subscribe to every list by RSS.
- amazon-affiliate (JavaScript): 🎬 Automated Amazon affiliate video creation with AI voiceover and YouTube publishing
- bg0ne.com (JavaScript): BG, gone. FOSS background removal on open models. Free previews, pay by the image in USDC, or self-host the whole thing.
- bitchin.net (V)
- bitcoinlatte (TypeScript): BitcoinLatte is a map for finding coffeeshops that take Bitcoin.
- bookmarklets
- botspm (JavaScript): AI bot management platform for conducting "lives" on TikTok, YouTube or X
- brand-assets (HTML): Brand and marketing assets for Profullstack, Inc. and #Moshcoding, logos, avatars, banners, badges, ad cards and video. Live kit: https://anthony.dev.profullstack.com/assets/
- c0mpute (Rust): Open compute network: run a node with one command and help pool 100,000 CPUs/GPUs for open-weight AI. Inference, transcoding, storage. CLI-first, MIT.
- c0upons (TypeScript): Coupons platform built with Vite + React and SQLite Cloud
- cache.follows.lol (Julia)
- chovy.com (CSS): Terminal-style microblog, short thoughts, nothing over 240 chars
- cl1s.tech (JavaScript): Open advertising network for CLI tools and AI agents, built on the AgentAd standard. Disclosed, agent-readable, terminal-native ads.
- cli-tools (TypeScript)
- coinpay-php (PHP): Read-only split mirror of php/coinpay in profullstack/x402-ports. Do not open pull requests here.
- coinpaybot (TypeScript)
- coldfollow-web (JavaScript)
- commandboard.run (TypeScript): CommandBoard.run hosted product and reference implementation for LogicSRC
- cookiebanner-web (CSS)
- css (CSS): Semantic-first, agent-friendly CSS for humans and the interfaces they build together.
- d1sks.com (JavaScript): The OpenDisk marketplace and OpenObject reference store: every disk that serves /.well-known/opendisk.json, listed by free GiB, price, country and policy.
- d3vices.com (JavaScript): Open-source hardware diagnostics that run on your device. Test your mic, camera, screen, keyboard, sensors and network, in the browser, as a PWA, or on the desktop.
- datamart.help (TypeScript): datamart.help (placeholder)
- diskpush (TypeScript): Push files fast. Sync only what changed. A desktop app and CLI for rsync: browse servers like FileZilla, transfer with rsync, and move files directly between two servers.
- dot-skills (JavaScript): A portable, verifiable inventory of agent-executable skills. Every entry states how far it has actually been proven.
- ethshot-web (JavaScript): A viral Ethereum-powered game where users pay 0.001 ETH per shot for a 1% chance to win the jackpot.
- fleetsysops.com (TypeScript): The Fleet SysOps Manifesto: how one human runs a fleet of coding agents (fleet coding), served as nothing but Markdown
- follows-web (JavaScript)
- fullstack-api (JavaScript): API written in node.js, koa and mongodb
- fullstack-ui (Vue): User interface written in vue.js
- genrewatch.com (JavaScript): A release calendar for every genre. Follow a genre or a name, get told before it drops.
- gentoo-pairux (Shell): Gentoo overlay for PairUX - collaborative screen sharing
- gentoo-tronbrowser (Shell): Gentoo overlay for TronBrowser - privacy-first, AI-native browser
- getprivacycode (TypeScript)
- hdtilt.com (JavaScript): Open-source IPTV player like TiviMate: M3U, Xtream Codes, XMLTV guide, catch-up. Web/PWA, desktop, CLI, TUI, MCP and API.
- homebrew-infernet (Ruby): Homebrew tap for the Infernet Protocol CLI
- homebrew-pairux (Ruby): Homebrew tap for PairUX
- homebrew-tap (Ruby): Homebrew tap for Profullstack apps. brew tap profullstack/tap
- hqsh (Go): A terminal session that survives disconnects like mosh, but carries the raw stream: images and every escape reach your terminal.
- hqterm (TypeScript): Persistent terminal sessions that survive disconnects, with images and HD emoji. Built on hqtui + hqsh.
- hynt-mobile (JavaScript)
- icemap.app (TypeScript): Anonymous, real-time incident reporting on a map. No accounts. No tracking. Posts auto-delete after 8 hours.
- interviews (Python)
- intr0s (Shell)
- invoicer (JavaScript)
- irc-bot (JavaScript)
- kynfi (HTML): Secure file & photo sync across all your devices.
- launch.anapp.now (TypeScript): Top-of-funnel campaign site for Chovy: type the idea, launch it now.
- launchpadder-web (JavaScript): The platform enables frictionless URL submission with automated metadata scraping, AI-generated descriptions, and federated submissions across multiple directories.
- link-directories (JavaScript)
- linkedin-networking-bot (HTML)
- links-aggregator (JavaScript): Aggregation of onion sites with random redirect button
- logicsrc (TypeScript): LogicSRC is an open standards initiative for human and AI agent coordination, maintained by Profullstack, Inc.
- makedemo (JavaScript): A CLI tool that automates generating high-quality web demo MP4 videos by intelligently interacting with websites using AI-driven decision making.
- malware-test-prs (Python): testing malware scanners on github and other ci/cd paltforms.
- marketng-networking-bot
- marksyncr.com (JavaScript): MarkSyncr is a cross-browser extension that enables two-way bookmark synchronization between browsers and external storage sources (local files, GitHub repos, Dropbox).
- media-streamer (TypeScript): A comprehensive multi-media streaming platform that allows users to stream music, movies, books, and live TV from torrents and IPTV sources - without downloading content until playback.
- meshhook (JavaScript): MeshHook is an MIT-licensed, webhook-first workflow engine with a visual builder (SvelteKit/Svelte 5) and Temporal-like durability via event sourcing on Postgres (Supabase).
- modules (Shell): module system
- moshpit-proxy (TypeScript): Registry-pinned TLS proxy for Moshpit names. Verifies the origin's key against the registry instead of a certificate authority.
- moshpit-transport (TypeScript): Post-quantum authenticated transport for native Moshpit clients. Hybrid X25519 + ML-KEM-768, ML-DSA-65 identity, no TLS and no certificates.
- mums.flower (TypeScript): Flowers for moms: remember mom's birthday and Mother's Day, flower meanings, bouquet cards. Web, PWA, API, MCP, CLI.
- music (JavaScript): My new vibe coding band Velocity Vibe
- nightcell7 (TypeScript): NIGHTCELL 7: FALSE DAWN, premium episodic FPS. Two operatives, two countries, one manufactured war. Babylon.js + TypeScript monorepo with server-authoritative multiplayer.
- nixamp (TypeScript): It really whips the terminal's ass. Open-source streaming platform: turn a folder into a live radio station, TV channel or film night anyone can tune into. Terminal player, web app and desktop app on one engine, with a...
- onion-ssr-boilerplate (JavaScript)
- openemoji (CSS): Every standard emoji, drawn by an image model as one family, packed as an OpenEmoji set: PNG, WebP, SVG, colour fonts
- openicon (HTML): 370 UI icons (259 drawn, 111 brand logos) as SVG, PNG and terminal glyphs: Nerd Font, Unicode, ASCII. An OpenIcon set.
- opensourcelegends.com (TypeScript): Trading cards for the people who built the software the world runs on.
- othr-web (JavaScript)
- p0dcasters (TypeScript): Directory of independent, self-hosted podcasts, 22,386 shows on their own domains
- pairux-apt: APT repository for PairUX - Debian/Ubuntu packages
- pairux-nix (Nix): Nix flake for PairUX - collaborative screen sharing
- pairux-rpm: RPM repository for PairUX - Fedora/RHEL packages
- parklookup.com (JavaScript): A Progressive Web App (PWA) for discovering and exploring U.S. National and State Parks.
- paybadge (JavaScript): A sleek, professional payment badge system for accepting cryptocurrency donations directly from your GitHub README files.
- png2svg.sh
- poly (JavaScript): Svelte 4 LTS fork
- prazium
- profullstack
- profullstack-dao (JavaScript)
- qaaas-test-app (HTML): Deliberately buggy todo app for testing QAaaS.dev and PRaaS (Pull Requests as a Service)
- recipepdfs.com (TypeScript)
- reddit-networking-bot (JavaScript)
- relay.follows.lol (C++)
- rss-amplifier (JavaScript): A CLI tool for contextual RSS amplification with AI-driven snippet generation and social media posting.
- rssamplifier.com (JavaScript): An open, agent-first directory of independent blogs. Submit a URL, a list or an OPML file; every blog gets its own page. JSON API, OPML and llms.txt for agents.
- sans-demo (JavaScript): Demo app built using Sans UI
- scoop-bucket: Scoop bucket for Profullstack apps. scoop bucket add profullstack https://github.com/profullstack/scoop-bucket
- scoop-pairux: Scoop bucket for PairUX
- scripts (JavaScript): Hand-written command-line tools
- sinkstate (TypeScript): Find the states your agent graph can enter but never leave. Dead-state analysis for LangGraph, CrewAI and n8n.
- smashlang (Rust): A fully programmable, multi-platform, syntax-slick modern language. Let’s finish this strong. 💪
- smashlang-windsurf (JavaScript): SmashLang code highlighting support for WindSurf
- sorrycheck (TypeScript): Does that proof actually check? A public verdict registry for papers and repos claiming machine-checked proofs.
- svgcrusher (JavaScript): CLI-first SVG optimization for svgcrusher.com
- sysops.ceo (HTML): sysops.ceo
- thesoundofpi.com (HTML)
- tipoffwatch.com (JavaScript): Sports calendar and reminder PWA. Follow any team in the world; get told before they play.
- tronbrowser.dev (TypeScript): Open-source, privacy-first, AI-native browser built on a Chromium fork. No telemetry, no ads, no sponsored tabs.
- tutorlinkup-web (JavaScript): A marketplace platform connecting individuals who need test-taking services with qualified test-takers, featuring secure cryptocurrency payments.
- ugig.net (TypeScript): A marketplace for AI-assisted engineers and skilled workers.
- unyunddit (JavaScript): Reddit clone for .onion
- uyunlist (PHP): Self-hosted, anonymous onion classifieds marketplace, PHP + self-hosted Supabase + a Tor hidden service, one-command deploy to a DigitalOcean droplet.
- venuedating-web (JavaScript): Venue Dating is a modern Progressive Web App (PWA) that connects people at their favorite venues.
- vibe-stack (JavaScript): A modern, AI-first framework built for rapid development of Progressive Web Apps (PWAs). Designed for versatility and speed, it provides an optimized boilerplate for creating, testing, and deploying full-stack...
- vicoa-coinpay-overlay (Python): CoinPay crypto billing overlay for self-hosted Vicoa: sell Pro passes for USDC/BTC/ETH
- vu1nz-gh-actions (Python): vu1nz Github Actions Scanner
- w3bs.org (JavaScript): W3BS: the open Web for humans, agents and devices. Community drafts and reference stack.
- watchnews.now (JavaScript): WatchNews, follow a news desk or a newsroom, read what it published, and watch the channels covering it. A brand of the tipoffwatch platform (BRAND=watchnews).
- web-engineer-education: Educational videos, courses, lectures, texts, and blogs for web engineers
- webcomponents (JavaScript): Web components library using vanilla JavaScript, CSS and HTML
- wiresniff-desktop-electron (TypeScript)
- x402-gateway-php (PHP): Read-only split mirror of php/x402-gateway in profullstack/x402-ports. Do not open pull requests here.
- x402-ports (Rust): x402-gateway in Python, Go, Rust, Ruby, PHP, Elixir and Zig, plus the CoinPay CLI from every package manager. One monorepo, one fixture file.
- zymo-mobile (TypeScript)
### Drop-in wiring (curated)
**@profullstack/coinpay-onboard**
```sh
npm install @profullstack/coinpay-onboard
```
```js
npx @profullstack/coinpay-onboard site <name> --webhook <url>
```
**@profullstack/x402-gateway**
```sh
npm install @profullstack/x402-gateway
```
```js
import { createGateway } from '@profullstack/x402-gateway';
import { x402Gateway } from '@profullstack/x402-gateway/hono';
export const gateway = createGateway({ siteUrl: process.env.SITE_URL ?? '', coinpay: { apiKey: process.env.COINPAY_X402_KEY }, payTo: process.env.CRAWL_PAY_TO });
export const crawlGateway = x402Gateway(gateway); // app.use('*', crawlGateway)
```
**@profullstack/x402-client**
```sh
npm install @profullstack/x402-client
```
```js
import { createClient } from '@profullstack/x402-client';
export const payer = createClient({ key: process.env.X402_PRIVATE_KEY, maxUsd: 5 });
// const res = await payer.fetch(url); pays a 402 once, then presents the pass
```
**@profullstack/throttle**
```sh
npm install @profullstack/throttle
```
```js
import { createThrottle } from '@profullstack/throttle';
export const throttle = createThrottle({ limit: 100, rules: [{ path: '/health', open: true }] });
// const answer = await throttle.handle(request); if (answer) return answer;
```
**@profullstack/coinpay**
```sh
npm install @profullstack/coinpay
```
```js
import { CoinPayClient } from '@profullstack/coinpay';
export const coinpay = new CoinPayClient({ apiKey: process.env.COINPAY_API_KEY ?? '' });
// await coinpay.createPayment({ businessId, amount, currency: 'USD', blockchain })
```
**@profullstack/watchdog**
```sh
npm install @profullstack/watchdog
```
```js
import { watchDependencies } from '@profullstack/watchdog';
// Pass probes, not clients: postgres resolves truthy, redis answers PONG. Call stop() first on SIGTERM.
export const startWatchdogs = (probes: Parameters<typeof watchDependencies>[0]) => watchDependencies(probes);
// startWatchdogs({ postgres: () => healthcheck(), redis: () => redis.ping() })
```
**@profullstack/emailer**
```sh
npm install @profullstack/emailer
```
```js
import { createEmailer } from '@profullstack/emailer';
export const emailer = createEmailer({ resendApiKey: process.env.RESEND_API_KEY });
// await emailer.send({ from, to, subject, html, text })
```
**@profullstack/email-queue**
```sh
Not published to npm. Source: github.com/profullstack/mynaposter/tree/main/packages/email-queue
```
```js
Do not treat as a production service until its API, worker deployment, PostgreSQL schema, quotas, monitoring and application migrations are complete.
```
**@profullstack/autoblog**
```sh
npm install @profullstack/autoblog
```
```js
import { buildEvent, sendWebhook, verifyAndParse } from '@profullstack/autoblog';
export { buildEvent, sendWebhook, verifyAndParse };
// sendWebhook(url, buildEvent(post, { source: SITE_URL }), { secret: process.env.WEBHOOK_SECRET })
```
**@profullstack/hqtui**
```sh
npm install @profullstack/hqtui
```
```js
import { createApp } from '@profullstack/hqtui';
export const tui = await createApp();
// tui.render(({ ui }) => ui.panel({ title: 'Hello' }, (p) => p.text('Hello'))); await tui.start();
```
**@profullstack/player**
```sh
npm install @profullstack/player
```
```js
import { createPlayer } from '@profullstack/player';
import '@profullstack/player/player.css';
export const mountPlayer = (el: HTMLElement, src: string) => createPlayer(el, { src });
```
**@profullstack/modern-css**
```sh
npm install @profullstack/modern-css
```
```js
import '@profullstack/modern-css';
// <ul class="subgrid-cards" style="--card-rows: 3"><li class="subgrid-card squircle">...</li></ul>
// h1 { font-size: 3.6rem; font-size: --fluid(2.6rem, 3.6rem); }
```
**@profullstack/leaderboard**
```sh
npm install @profullstack/leaderboard
```
```js
import { createLeaderboard, sqlStore } from '@profullstack/leaderboard';
export const createBoards = (execute: (q: { sql: string; args: unknown[] }) => Promise<{ rows: Record<string, unknown>[] }>) =>
createLeaderboard({ siteName: process.env.SITE_NAME ?? '', siteUrl: process.env.SITE_URL ?? '', store: sqlStore({ execute }), boards: { top: { label: 'Top', metric: 'points' } } });
```
**@profullstack/notifications**
```sh
npm install @profullstack/notifications
```
```js
import { vapidKeysFromEnv, sendPushToMany } from '@profullstack/notifications/server';
export const vapidKeys = vapidKeysFromEnv(); // VAPID_PUBLIC_KEY + VAPID_PRIVATE_KEY
export { sendPushToMany };
```
**@profullstack/referrals**
```sh
npm install @profullstack/referrals
```
```js
import { createCode, buildReferralUrl, applyReferral, calculateReferral } from '@profullstack/referrals';
export { createCode, buildReferralUrl, applyReferral, calculateReferral };
// createCode(userId, store) needs a ReferralStore wired to your database
```
**@profullstack/affiliates**
```sh
npm install @profullstack/affiliates
```
```js
import { Affiliates, sqliteStore, postgresStore } from '@profullstack/affiliates';
export const aff = new Affiliates(sqliteStore(db)); // or postgresStore(pool); tables aff_* created on first use
// signup: const r = await aff.redeemInvite(code, userId); if (!r.ok) reject(r.reason)
// await aff.createInvite(userId) throws 'no invites left' past the quota (default 3)
```
**@profullstack/redeem-credits**
```sh
npm install @profullstack/redeem-credits
```
```js
import { Credits, sqliteStore, postgresStore } from '@profullstack/redeem-credits';
export const credits = new Credits(sqliteStore(db)); // or postgresStore(pool); tables credit_* created on first use
// const { code } = await credits.mint({ grant: { unit: 'minutes', amount: 1000, every: 'month' } })
// await credits.redeem(code, userId); await credits.spend(userId, 'minutes', 12)
```
**@profullstack/webhooks**
```sh
npm install @profullstack/webhooks
```
```js
import { Webhooks, sqliteStore, webhooksApi } from '@profullstack/webhooks';
export const hooks = new Webhooks({ store: sqliteStore(db), source: SITE_URL, eventTypes: ['invoice.paid'] }).start(); // or postgresStore(pool)
const api = webhooksApi(hooks, { basePath: '/api/v1/webhooks', owner: async (req) => (await userFrom(req))?.id });
app.all('/api/v1/webhooks/*', async (c) => (await api(c.req.raw)) ?? c.notFound());
// await hooks.emit(user.id, 'invoice.paid', { id, amount })
```
**@profullstack/sealed-secrets**
```sh
npm install @profullstack/sealed-secrets
```
```js
import { createSealer, UnlockStore } from '@profullstack/sealed-secrets';
const sealer = createSealer({ app: 'myapp' });
// browser/CLI: const { dek, seal, recoveryKey } = await sealer.createSeal(passphrase, user.id);
// const blob = await sealer.sealSecrets(dek, { GITHUB_TOKEN }, user.id); // store seal + blob, show recoveryKey once
// later: const key = await sealer.unlockSeal(seal, passphrase, user.id); await sealer.unsealSecrets(key, blob, user.id);
// worker: if (await sealer.verifyDataKey(key, seal, user.id)) sessions.unlock(user.id, key, 8 * 3600);
// Key vault UI: raw(keyVaultCardHtml({ app, scope, userId, vault, scriptSrc })) + bundle '@profullstack/sealed-secrets/vault-ui/auto' (IIFE)
// mountVaultRoutes(app, { userId: (c) => requireUser(c).id, handlers: createVaultHandlers({ sealer, store, onUnlock, onLock, status }) });
```
**@profullstack/orgs**
```sh
npm install @profullstack/orgs
```
```js
import { migrate, createOrg, addMember, can, inviteToOrg, acceptInvite } from '@profullstack/orgs';
export { migrate, createOrg, addMember, can, inviteToOrg, acceptInvite };
// await migrate(sql) on boot, with a postgres.js client
```
**@profullstack/profile**
```sh
npm install @profullstack/profile
```
```js
import { createProfileStore, validateProfile, saveSignupProfile, createProfileHandlers } from '@profullstack/profile';
import { ProfileFields } from '@profullstack/profile/react';
const profiles = createProfileStore(sql); // postgres.js, Bun SQL, pg, libSQL, libsql-pg, bun:sqlite, supabase
await profiles.migrate();
```
**@profullstack/form-guard**
```sh
npm install @profullstack/form-guard
```
```js
import { createFormGuard } from '@profullstack/form-guard';
export const formGuard = createFormGuard({ secret: process.env.FORM_GUARD_SECRET ?? '', binding: 'contact' });
// const verdict = await formGuard.check({ fields: body, headers: request.headers });
```
**@profullstack/scraper-daemon**
```sh
npm install @profullstack/scraper-daemon
```
```js
import { createDaemon, sqliteStore } from '@profullstack/scraper-daemon';
export const daemon = createDaemon({ name: 'my-site', store: sqliteStore(db) });
// daemon.job({ name, every, run }), daemon.queue({ name, every, items, run }), daemon.start()
```
## 6. Not in the stack
- **Hetzner:** Ruled out permanently. Railway hosts the fleet; a netcup box and DigitalOcean droplets cover what needs a VM.
- **Vercel, Fly.io, Cloudflare Workers:** Not deploy targets. One repo has a fly.toml and none have a wrangler config. Railway is the host.
- **Supabase for a new app:** Turso is the default. Supabase and Postgres stay where they already are.
- **.env files as the source of secrets:** The vault and the platform env are the authority. A file is a stale copy.
- **Password-first auth, next-auth:** Magic link plus passkeys. @profullstack/auth-system is password-only and is the exception, not the pattern.
- **SvelteKit, Primate + SurrealDB, Express for new work:** Earlier generations still in maintenance. Do not start anything new on them.
- **Tauri:** Retired in favour of Electron with the bundled CLI.
- **mocha, jest, Prisma:** vitest and plain SQL or Drizzle.
- **Oxc, Oxlint, Oxfmt, Rolldown as a default:** On the roadmap since June and present in six repos. Use the repo's existing lint and format setup until parity is proven.
- **Hand-rolled players, rate limiters, contact-form guards, feed forms:** Each of these is a published package already.
- **video.js, plyr, a bare hls.js or mpegts.js:** @profullstack/player wraps hls.js and mpegts.js already. video.js 10 ships no player at all: it throws VJS8_LEGACY_* on v8 code.
- ***.up.railway.app URLs:** Our domains only.
## 7. Contact
Profullstack, Inc. · anthony@profullstack.com · https://profullstack.com
