Everything You Need for
Production-Ready Apps
Comprehensive features organized by package. Each module works independently or together — with AI provider integrations, Docker support, and vibe coding templates so AI agents can extend the codebase from day one.
Mobile Apps Package
6 featuresCross-Platform Mobile App
React Native & Expo
Cross-platform mobile application built with React Native 0.81.5 and Expo ~54.0.31 for iOS, Android, and web deployment.
- React Native 0.81.5
- Expo ~54.0.31 with New Architecture
- TypeScript 5.9.2
- NativeWind 4.2.1 (Tailwind CSS)
Authentication
Complete authentication flow including registration, login, MFA, and password management synchronized with backend.
- User registration with email verification
- JWT-based login with token refresh
- MFA/TOTP with QR code support
- Password reset via email
User Management
Profile viewing and editing, password changes, email updates, and audit log access from mobile device.
- Profile management
- Password change with validation
- Email change workflow
- Audit log viewing
Security Features
Enterprise-grade security including SSL certificate pinning, rate limiting protection, and secure token storage.
- SSL certificate pinning
- JWT tokens in AsyncStorage
- Automatic token refresh
- Rate limiting handling
Navigation & UI
Modern navigation with React Navigation 7.x including stack and bottom tabs navigators, styled with NativeWind.
- Stack Navigator
- Bottom Tabs Navigator
- NativeWind styling
- React Context for state
API Integration
Seamless backend integration with Axios HTTP client, form handling with React Hook Form and Zod validation.
- Axios 1.13.2 HTTP client
- React Hook Form 7.70.0
- Zod 4.3.5 validation
- AsyncStorage for persistence
Auth Package
6 featuresAuthentication & Authorization implemented on Backend, Frontend, and Mobile
User Registration
Email/password registration with automatic username generation and configurable email verification requirement.
- Auto-generates unique usernames
- Optional email verification
- Registration toggle
Secure Login
JWT-based authentication with automatic token refresh, rate limiting to prevent brute force, and account lockout.
- 15-minute access token
- 7-day refresh token
- 5 attempts per minute limit
- Auto account lockout
Multi-Factor Authentication
Two-factor authentication with TOTP apps (Google Authenticator, Authy) and email-based OTP codes with backup codes.
- TOTP QR code generation
- 10 single-use backup codes
- Email OTP for login
- MFA enable/disable
Password Management
Secure password reset via email and password changes with current password validation using bcrypt hashing.
- Reset link via email
- Current password required
- 12-round bcrypt hashing
Session Management
Redis-backed session storage, view active sessions per device, revoke individual or all sessions remotely.
- Fast Redis sessions
- Device/browser tracking
- Force logout all devices
- Token blacklisting
Email Changes
Secure email change with verification to new address, sends confirmation to both old and new email addresses.
- New email verification
- Confirmation to old email
- Confirmation to new email
- 24-hour token expiry
Admin Package
6 featuresAdministrative Controls buiult to speed up development and managemenet.
User Management
Complete user CRUD operations: list, search, filter by role/status, update details, and soft delete users.
- Pagination & search
- Filter by role/status
- Update role/active status
- Soft delete
Session Control
View all user sessions across devices, revoke specific sessions or force logout from all devices remotely.
- Session listing
- Single session revoke
- Revoke all sessions
- Token blacklist
User Impersonation
Admin can temporarily impersonate users for support, with full audit trail and automatic session tracking.
- 15-minute sessions
- MFA required for admin
- Full audit logging
- End anytime
Audit Logs
Comprehensive security event logging for all actions with filtering by user, action type, date range, and search.
- All actions logged
- IP address tracking
- Date range filters
- User/action search
Email Logs
Track all emails sent through the system including verification, OTP, password reset, and notifications.
- Email type tracking
- Delivery status
- Per-user history
- Date filtering
MFA Management
Remotely disable MFA for users, resend verification emails, and send password reset on behalf of users.
- Disable user MFA
- Resend verification
- Trigger password reset
- Email lockout alerts
Email Package
5 featuresTransactional Email Service built for user authentication and notifications
Email Templates
6 pre-built email templates with Handlebars: verification, OTP, password reset, lockout, email change.
- Verification email
- MFA OTP code
- Password reset link
- Account lockout notice
Queue-Based Delivery
Bull queue for reliable background email processing with automatic retries and exponential backoff.
- 3 retry attempts
- Exponential backoff
- Job status tracking
- Failed job retention
SMTP Support
Full SMTP configuration with TLS/SSL support for any email provider (SendGrid, Mailgun, SES, Gmail).
- TLS/SSL support
- Any SMTP provider
- Environment config
- Fallback options
Email Logging
All sent emails logged to database for tracking, delivery status, and user history with metadata.
- Delivery logging
- Status tracking
- User email history
- Metadata storage
Email Change Flow
Complete email change workflow with verification to new email and confirmations to both addresses.
- New email verification
- Old email notification
- New email confirmation
- 24-hour expiry
Captcha Package
4 featuresBot Protection & Security for Registration, Login, and Password Reset
Multi-Provider Support
Choose from Google reCAPTCHA v2, Cloudflare Turnstile, or hCAPTCHA based on your preferences.
- Google reCAPTCHA
- Cloudflare Turnstile
- hCAPTCHA
- Provider selection
Frontend Integration
Easy widget integration with site key retrieval, automatic challenge display, and token handling.
- Site key retrieval
- Widget rendering
- Token generation
- Challenge handling
Server Verification
Backend token verification for each provider with graceful degradation when CAPTCHA is disabled.
- Token verification
- Provider-specific checks
- Graceful disable
- Logging
Configurable Per Action
Enable CAPTCHA for specific actions like registration, login, or password reset independently.
- Per-action config
- Registration protect
- Login protection
- Password reset guard
User Package
5 featuresUser Profile & Settings
Profile Management
View and update profile information including name, email with change verification, and activity stats.
- Name updates
- Email changes
- Profile view
- Activity stats
Password Changes
Secure password changes with current password verification and automatic session invalidation.
- Current password check
- Session invalidation
- Audit logging
- Email notification
Account Deletion
Self-service account deletion with configurable instant or scheduled (grace period) deletion modes.
- Instant deletion
- Scheduled deletion
- Grace period config
- Related data cleanup
Personal Audit Logs
Users can view their own security activity including logins, password changes, and profile updates.
- Login history
- Password changes
- Profile updates
- IP addresses
Activity Dashboard
View account creation date, last login, session count, and security status at a glance.
- Account age
- Last login
- Session count
- MFA status
AI Package
6 featuresMulti-Provider AI Integrations — Claude, OpenAI, Gemini & Groq
Multi-Provider Support
Connect to Anthropic Claude, OpenAI, Google Gemini, and Groq with a single unified API. A provider becomes active automatically when its API key is present in the environment.
- Anthropic Claude (claude-sonnet-4-6)
- OpenAI GPT (gpt-4o)
- Google Gemini (gemini-2.0-flash)
- Groq (llama-3.3-70b-versatile)
REST API Endpoints
Ready-to-use JWT-protected REST endpoints for listing configured providers, full-response chat, and real-time SSE streaming.
- GET /ai/providers — list + configured status
- POST /ai/chat — full response
- POST /ai/stream — SSE streaming
- JWT-authenticated, user-scoped
Frontend AI Components
Drop-in React components for AI-powered features — a full chat interface, provider & model selectors, and a flexible useAIChat hook for custom UIs.
- AIChatInterface drop-in component
- AIProviderSelector dropdowns
- useAIChat hook (stream + full response)
- Abort / stop streaming support
Streaming Support
Server-Sent Events streaming from all providers so responses appear word-by-word, with built-in abort control and error handling.
- SSE text/event-stream protocol
- Works with all 4 providers
- Client abort signal support
- Graceful error events
Provider Interface
Clean IAIProvider interface makes adding a new AI provider a 5-step process. Inject AIService into any NestJS module to add AI capabilities to any feature.
- IAIProvider contract
- Add any new provider in 5 steps
- Inject AIService anywhere
- Full TypeScript types
Fully Optional
The AI module is completely optional — no provider key means no active provider. Configure only the providers you need without touching the rest of the codebase.
- Zero-config default (all off)
- Per-provider API key toggle
- No breaking changes if unused
- Swagger docs auto-generated
Docker Package
6 featuresContainerization & DevOps for faster development and deployment
Backend Docker Setup
Complete Docker Compose setup with PostgreSQL, Redis, and NestJS backend with hot reload for development.
- PostgreSQL 15 container
- Redis 7 with password
- NestJS with hot reload
- Health check dependencies
Frontend Docker Setup
Containerized Next.js frontend with volume mounting for hot reload and environment-based configuration.
- Next.js container
- Hot reload in dev
- Env-based config
- Dev/prod parity
Database Containers
Pre-configured PostgreSQL and Redis containers with health checks, persistent volumes, and bridge networking.
- PostgreSQL with healthcheck
- Redis with auth
- Persistent volumes
- Bridge networking
Nginx — Separate Setup
Nginx reverse proxy is available as its own standalone configuration (not bundled in the base packages), giving you full control over how and where you deploy it.
- Separate nginx config included
- SSL/TLS termination
- Security headers & gzip
- Use only when needed
One-Command Startup
Start the entire stack with a single docker-compose command including database migrations and seed data.
- Auto migrations
- Health dependencies
- Volume persistence
- Container healthchecks
Development Ready
Hot reload for both frontend and backend with volume mounting for a smooth real-time development experience.
- Live code reloading
- Volume mounting
- Dev/prod parity
- Easy debugging
Frontend Deployment Package
6 featuresCloud & Kubernetes Deployment starting points for Advanced use-cases
AWS ECS Deployment
Frontend deployment configurations for AWS ECS including task definitions, service configuration, and auto-scaling settings.
- ECS task definition
- ECS service config
- Auto-scaling groups
- Load balancer integration
AWS EKS Kubernetes
Kubernetes manifests for frontend deployment on AWS EKS with namespace, deployments, and services.
- EKS deployment YAML
- Namespace config
- Service definitions
- Resource limits
GCP Cloud Run
Frontend deployment configuration for Cloud Run serverless containers on Google Cloud Platform.
- Cloud Run service YAML
- Container configuration
- Environment variables
- Scaling settings
GCP GKE Kubernetes
Kubernetes manifests for frontend deployment on Google GKE cluster with production-ready configurations.
- GKE deployment YAML
- Ingress configuration
- Horizontal pod autoscaling
- Resource quotas
Kubernetes cert-manager
Frontend cert-manager setup for automatic TLS certificate management with Let's Encrypt integration.
- ClusterIssuer setup
- Staging/prod certificates
- Automatic renewal
- DNS validation
Deployment Scripts
Automated deployment scripts for frontend to AWS ECS and GCP Cloud Run with environment configuration.
- Deploy to ECS script
- Deploy to CloudRun script
- Environment setup
- Rollback support
Redis Package
4 featuresCaching & Sessions
Session Storage
Fast Redis-based session storage with automatic expiration and session data retrieval.
- Fast storage
- Auto expiration
- Session retrieval
- Data persistence
Rate Limiting
IP-based rate limiting for authentication endpoints with configurable limits and window duration.
- IP tracking
- Configurable limits
- Window duration
- Auto reset
Token Blacklisting
Blacklist JWT tokens for immediate invalidation (logout, password change, admin revocation).
- Immediate invalidation
- TTL-based expiry
- Bulk blacklisting
- Fast lookup
Cache Layer
General-purpose key-value caching for application data with TTL support.
- Key-value storage
- TTL support
- Auto cleanup
- Data retrieval
Prisma Package
4 featuresDatabase Layer
User Model
Complete user model with profile, security fields, MFA settings, and soft delete support.
- Profile data
- Security fields
- MFA settings
- Soft delete
Session Model
Session tracking with IP address, user agent, creation/expiration timestamps, and revocation.
- IP tracking
- User agent
- Timestamps
- Revocation
Audit Log Model
Comprehensive audit logging for all actions with entity tracking and detail storage.
- Action tracking
- Entity types
- Detail storage
- IP logging
Email Log Model
Email delivery tracking with type, status, metadata, and recipient information.
- Type tracking
- Status logs
- Metadata
- Recipient info
Vibe Coding Package
4 featuresAI Agent Context & Templates for extending the codebase with AI tools
.context Folders
Every package ships with a .context folder containing structured markdown files — so your AI coding agent understands the architecture, conventions, and APIs without scanning the entire codebase.
- OVERVIEW.md — tech stack & quick start
- ARCHITECTURE.md — folder structure & patterns
- MODULES.md / COMPONENTS.md — API reference
- AI-INTEGRATIONS.md — AI provider details
Backend Vibe Template
A complete, working NestJS CRUD module (Notes) that AI agents can copy, rename, and register to scaffold any new backend feature in minutes.
- Controller, service, DTOs & interfaces
- Prisma model example with migration
- Search & replace rename guide
- 5-step registration checklist
Frontend Vibe Template
A full Next.js feature page (Notes) with server component, client component, custom hook, types, and reusable UI cards — ready to copy and rename.
- Server + client component split
- useFeature data-fetching hook
- Create form + card components
- API integration pattern
Mobile Vibe Template
A complete React Native screen (Notes) following the app's SSL-pinning and navigation patterns, ready for AI agents to copy for any new mobile feature.
- Screen, service & types
- SSL-pinning API pattern
- Navigation registration guide
- NativeWind styled components
Health Package
4 featuresMonitoring & Health Checks
Basic Health Check
Simple endpoint to verify application is running and responsive.
- Application status
- Response time
- Uptime check
- Basic metrics
Readiness Check
Verifies application is ready to accept traffic (database, Redis connections).
- DB connectivity
- Redis status
- Queue status
- Service health
Liveness Check
Kubernetes-style liveness probe for container orchestration.
- Process status
- Memory health
- CPU usage
- Restart logic
Dependency Status
Detailed status of all dependencies including database, Redis, and external services.
- PostgreSQL
- Redis
- SMTP
- External APIs
React Native
Deploy to Any Platform
Build once and deploy to iOS, Android, and web
iOS
iPhone & iPad with App Store distribution
Android
Google Play Store, APK & AAB builds
Web
Progressive web app via Expo web