Codebase
Project structure
V03 web, worker, browser, agent core, database, release, and operations layout.
The repository is a pnpm Turborepo.
Applications
apps/webcontains the public site, admin console, REST, WebMCP, agents, worker, scheduler, docs, and integration tests.apps/browser-workeris the isolated Playwright service. Next.js request handlers do not launch Chromium.apps/studiois local Prisma Studio tooling and is not deployed.
Inside apps/web:
agents/ versioned definitions, executor, durable runtime, review
app/(marketing)/ public pages
app/admin/ Site-scoped operations console
app/api/ REST, WebMCP, webhooks, downloads, health
lib/admin/ validated transactional mutation services
lib/ public reads, commerce, Push, task queue, delivery
operations/ long-running Worker and Scheduler entry points
scripts/ Postgres integration tests
content/ documentation and legal MDX
public/ service worker and static assets
Packages
packages/agent-coreis a pinned Git submodule with the shared 1.0 contract, provider policy, durable stores, SSRF-safe fetch, structured retries, evaluation, and tool authorization.packages/databasecontains the full Prisma schema, checked-in migrations, backfill, normalized data, seed, and migration tests.packages/paymentscontains Polar client configuration.packages/authcontains better-auth identity and the admin-shell role set.packages/design-system,seo,cms,observability,security, and shared configuration packages support the web application.
Operations and release
ecosystem.config.cjsandCaddyfiledefine the supported five-role VPS production topology.scripts/ops/contains migration, grant, bootstrap, kill-switch, and health controls.scripts/release/builds and scans the buyer artifact.release/contains the release manifest, SBOM/AIBOM inputs, Demo fixtures, templates, and compliance evidence.
Docker files retained in the source checkout are optional, unverified adapters. They are excluded from the V03 buyer artifact and production support promise.
Site-owned writes belong in a transactional service. Pages and route handlers stay thin and must not duplicate authorization or lifecycle logic.