Software

Zephyr

node.js hosting billing automation platform - replaces WHMCS, Hostbill etc

latest v1.316.3

Read the docs

Features

plugin-kstack grew its whole capability surface — hosting, VPS, DNS, mail, databases, certificates and backups (
A brand-new install handed its owner an account that could sign in and administer nothing — found live on
better-auth email/password (Drizzle adapter)
Password-reset session invalidation hook
IP allow-list enforcement on staff logins
Login-attempts tracking
Magic-link invite acceptance
Magic-link sign-in (per-user opt-in)
Email-code 2FA (alternative to TOTP)
Staff impersonation of clients
RBAC roles + permissions
The dashboard was adding pence to cents — PLANV2 A6, the last item in the plan. The currency engine
Release artifacts are verified against a PINNED key, and an unsigned one is refused — PLANV2 E1. Thi
A rollback could not survive its own migration
"Up to date" and "never checked" were the same answer — PLANV2 E6, the silent deploy drift. readSta
Health signals a NOC can act on — including the one that would have caught the missing backups — PLANV2
Data-retention register and sweep — everything except the audit log was kept forever — PLANV2 D7. Ex
Evidence pack — and privilege changes were never audited at all — PLANV2 D8. One operator-runnable r
There were no database backups, and now there are — restored on every release — PLANV2 E3. scripts
The API's root privilege is now enumerable — and auto-install could never have worked — PLANV2 E2. T
SCIM Groups — IdP groups drive real Zephyr roles — finishes PLANV2 C2. A SCIM Group is an RBAC r
SCIM 2.0 provisioning and deprovisioning — PLANV2 C2, and the other half of C1: SSO decides who may
The audit ledger is now tamper-EVIDENT, not just append-only by convention — PLANV2 D5. The ledger w
Password policy and a staff IP allow-list, both with a way back in — PLANV2 C4, the rest of it. The
Active sessions, and a revocation that actually revokes — PLANV2 C4. Two halves: the listing that ne
"System-file state unknown" was permanent on every admin-button box — the banner said "the next deploy w
pnpm installed as root is invisible to the updater — the last link in the Node 26 chain, found live. Afte
The corepack shims that break every Node 26 upgrade — the root cause behind's symptoms, confirme
The Node upgrade failed silently, then lied about rolling back — three defects found by running'
Unit reconciliation took the live box down — the log dirs it bind-mounts were never created by an update
Alpine pre-flight: the installer called openssl 30 lines before installing it — found by pre-flighting th
A licensed install left the license inert
Alpine Linux support (and Ubuntu 26 confirmed) — Zephyr installs on Alpine 3.24+ as well as Ubuntu/Debian
Node 26
Dependency sweep: everything to latest, one deliberate exception — every outdated package on the System-s
The release gate now performs a real sign-in — the missing guard behind every other bug in this run. v1.
migrate reported success over a half-built database — every step inside migrate swallows its own erro
Password sign-in was impossible for every account on every install — the real cause of "invalid password
The API could not boot at all since — the live updater had been failing its health check and rol
Auth repair: the step-up gate was an unopenable door —'s step-up guard read the session cookie a
Break-glass for a deny-by-default RBAC lockout — RBAC grants nothing to a role-less staff account (C3), a
Step-up authentication on high-risk actions — PLANV2.md C5. Refunds, executing a payment run, impersonat
StaffGuard routes declare their permission — closing the zero-role escalation path — StaffGuard only pr
Audit export + retention — PLANV2.md D4. CSV/JSON export of the ledger honouring the viewer's live filte
Enterprise SSO — SAML 2.0 + OIDC with JIT role mapping — PLANV2.md C1, the hard gate on enterprise deals
Built-in bot defence — no third party required — adaptive proof-of-work on sign-in, sign-up and password
Deny-by-default for role-less staff — a staff account with zero role assignm
Staff users admin
API keys (issuance, scopes, guard)
Audit log (append-only)
SSH keys per user

Features

Products catalog (admin + public)
Pricing-cycle editor on the product edit page
Shopping cart
Orders pipeline
Quote requests (public + admin)
Cart abandonment recovery worker

Features

Checkout charges what the cart quoted — fromCart re-ran calculatePricing with neither promos nor t
The renewal sweep cannot double-bill, and clears a backlog in minutes not a day — two re
Release artifacts verified by Ed25519 signature, not just SHA-256 — the expected hash arrives in the same
Automatic payment from saved cards — AutoPayService + hourly billing.auto-pay-tick. chargeForInvoice
Account top-ups are no longer a dunnable debt — a top-up is a PREPAYMENT, but it was raised as an ordinar
Gapless document numbering, one shared counter
Pricing calculator (with tests)
Invoices controller + service
Renewals worker
Software-license renewals worker
Domain renewal billing
Plan-change proration
Plan-change quote, before anything is committed — POST /services/:id/change-plan/quote + POST /me/services/:id/ch
Upgrade → invoice → provision
Optional upgrade fee per path
Stuck plan changes are visible and retryable — the invoice-first flow can leave a customer PAID and still
The customer is told when their plan actually changes — the only mail a plan change ever produced was the
Subscription price updated on plan change
Hosting subscription creation
Recurring configurable-option money on renewals
Addon renewals + cascade cancel via — addons often never provision a services row, so serv
Subscription backfill (staff, dry-run first)
End-to-end software-products lifecycle: pull-on-webhook for release notes / install docs / features / screenshots — app
Slug-collision detection on import (buildSourceRepo-based)
Admin merge endpoint for stranded duplicate products
Unified (CMS + live upstream)
live fallback
Tabbed product pages — hero + tab bar over nested routes (pricing / features / docs / changelog / faq); a tab with no co
Product docs + changelog consolidated under with 308s from the old and /changelog
Operator-authored product pages at (built-in tabs win by route precedence) — apps/marketing/s
Product sites
Domain-ownership verification before the host flip
Product-site host map with stale-while-error caching — a failed refresh keeps the previous map rather than 404-ing every
Admin product-sites screen (claim → verify → go live)
HTML → CMS blocks importer — brings a hand-built marketing site into the page builder as editable, theme-aware block
AI whole-site generation — plans the page structure, then writes each page; reserved tab paths stripped so no page i
Per-seat proration (mid-cycle upgrade/downgrade)
Dunning worker
Late-fee on overdue invoices (configurable offsets + flat/percent) — apps/admin/src/app/(app)
Suspension executor
Refund requests workflow
Reseller billing schema
Accounting CSV/XLSX exports
Xero accounting plugin

Features

One payment records once
Credit is granted once, enforced by the database — the top-up listener guarded with a SELECT then INSE
New clients get the operator's currency, not hardcoded USD — client creation read defaults?.currency ??
Webhook registration works without — the button correctly refused rather than
Gateways register their own webhook endpoint — "Register webhook" on the plugin page calls Stripe's webh
The saved-methods pages survive a real row — both portals hand-declared gatewayPlugin: string and rende
Saving a card no longer depends on a webhook arriving — persistence used to happen ONLY if Stripe deliver
Saved payment-method vault
Stripe gateway plugin (Dynamic Payment Methods: card / wallets / BNPL / SEPA / iDEAL / Bancontact / etc.) — plugins/plu
PayPal gateway plugin
Mollie gateway plugin
GoCardless gateway plugin
Generic webhook receiver
Hosted-checkout confirm-on-return

Features

Built-in tax engine
Pluggable tax engine interface
VIES VAT lookup
Stripe Tax plugin
Tax schema

Features

The three lbreeze products are sold as , not catalog add-ons — they had been seeded as
A product page fills its own tabs from the repo it ships from — Features, Changelog and Docs come from Re
Type-aware product form — cloud product type + Standby provisioning card (backend, server type/plan, region, OS image
Product detail = editor for provisioning config (plan ref + Standby meta) — apps/admin/src/app/(app)/products/[id]/page
Standby catalog proxy (providers / datacenters / per-provider types+images+locations) — GET /admin/hosting/provisions/s
AI full website page generator for catalog products (hero + feature-grid + real-cycle pricing-table + cta + optional AI
Marketing block renderer (hero/feature-grid/pricing-table/faq/cta) + clean-URL fallback — apps/marketing/src/components

Features

Services CRUD + suspend/unsuspend/terminate
Provisioning pipeline (order.paid → plugin.create)
Internal provisioning callback
Provisioning retry sweep worker
Provisioning-failure alerts to staff
Admin failed-services filter + manual retry
Link a service to a control panel — imported / Standby-provisioned rows arrive unbound and every
Customer plan change (shared hosting)
Upgrade-path admin CRUD
Hosting package as a container
Usage history records the full resource matrix
Shared decimal byte formatter
Orphaned paid-order reconciler — provisioning.reconcile-orphans-tick (every 10 min) re-drives paid orde
Customer VPS resize
VPS server access — SSH keys passed at create; a generated credential is injected via cloud-init when the customer has n
VPS purchase configure step — GET /products/:id/server-options drives size/image/region/hostname from the plugin's rea
Quote → tailored package — accepted quote mints a client-private product + real order, so provisioning/subscriptions/ren
Per-client product entitlements
Customer "My packages" view
Guided plan-spec editor on quotes — provider-aware form over the SDK's NewManagedPlan (NOT Enhance's OAS NewPlan, wh
Entitlement count on the admin products list — flags an invite-only product with zero live grants, which nobody can bu
DSAR register — the staff side of GDPR — PLANV2 D6, the thing a DPO asks for in the first meeting.
Every package is typechecked — coverage went from 21 of 56 to 52 of 56 (the other four are empty
Provisioning scripts library
me service capabilities surface (mailbox/db/ssl/backups/apps)
Admin service-capability mirror

Features

Enhance
cPanel/WHM
DirectAdmin
Plesk
kstack
kstack pairing
Enhance changePlan addresses the subscription, not the website ref — the one lifecycle method reading ex

Features

Hetzner Cloud (VPS)
OpenStack (VPS)
Proxmox (VPS)
Hetzner Robot (dedicated)
Redfish (dedicated)
IPMI (dedicated)
Sell VPS/Cloud/Dedicated via Standby (§C) — order→provision, billing-driven auto-suspend/unsuspend, admin + portal — ap
Shared hosting: dual-backend provisioning — paid orders provision either direct to Enhance
Hosting reconciler — settles async §16 provisions (2-min cron), surfaces partial half-done accounts, rea
Customer VPS management
Standby-side follow-up — provisioning API exposes only create/suspend/unsuspend/terminate; reboot/start/stop/reinsta
Direct-provider VPS provisioning (Hetzner/OpenStack/Proxmox VPSModule into the order pipeline) — plugins implement full
VPS server access + purchase configure — SSH keys passed at create; a generated credential (AES-GCM, reve
Dedicated servers as a sellable product
Colocation — customer brings own hardware, rents rack U + power + bandwidth; shared DCIM (inventorysite

Features

Domain availability + cart + provisioning
WHOIS profiles + sub-contacts + custom fields
CentralNic / RRPproxy registrar plugin
eNom registrar plugin
OpenSRS registrar plugin
DNSSEC sync worker (Enhance ↔ registrar)
Registrant contact collection at checkout + pre-payment guard
Domain expiry reminders (60/30/14/7/1 day)
Transfer completion polling

Features

Local cache schema (dnszones / dnsrecords / dnssyncevents)
DnsCacheService (local-first CRUD + push + pull + drift detection)
DnsZoneCapable: Enhance
DnsZoneCapable: CentralNIC (RRPproxy DNS-zone)
DnsZoneCapable: eNom (GetHosts/SetHosts)
DnsZoneCapable: OpenSRS (dnszone get/set)
Admin + customer DNS endpoints
Reconciler cron + worker service
Enhance DNS webhook receiver (HMAC)
admin/dns hub + per-zone editor + sync-events viewer

Features

Let's Encrypt ACME v2 (HTTP-01 + DNS-01)
CentralNic SSL module
SSL certificate resale, built end to end
SSL go-live

Features

Enhance ops (backup health, reconciler)
Enhance custom-plan builder admin
Enhance per-instance admin (servers, branding)
Enhance backup-health + reconciler worker
Usage says why it is empty — not-linked / instance-unavailable / upstream-error instead of bare zer
Customer site overview — disk, traffic, quota, TLS, backups, mailbox + database counts and server facts i
Website screenshots actually resolve

Features

EmailServiceModule SDK type
Enhance implementation
email product type + quantity pricing
Provisioning on → createMailDomain with the purchased count; suspend/unsuspend/terminate wired for dunnin
Purchased-mailbox cap enforced at creation against the provider's live list, failing closed if the count can't be re
Customer mailbox management incl. quota, aliases, forwards, webmail SSO — each gated on a probed capability flag
Admin purchased-vs-actual drift, stated plainly on overage and separately when the provider read failed
Not yet run against a live Enhance cluster — spec-verified is not the same as working. The quota field is a bare
suspend/unsuspend/terminate still dispatch only to handle.server — fine while Enhance's email mo
Admin forwarder routes still hard-require handle.mailbox
OpenSRS Hosted Email + Google Workspace plugins
Renderer + SMTP transport + service
Built-in templates
AWS SES NotificationModule plugin
Email queue + worker
Email templates admin (list/preview/test-send)
Multi-account mailbox + unified inbox API
IMAP ticket ingest
Mail polling worker
Inbox dedupe CLI

Features

Tickets + departments + canned replies
SLA automation tick
AI ticket auto-reply
Reply notification email — a staff reply now emails the customer, and a customer reply emails the assigne

Features

A seeded placeholder page never outranks a built-in layout
Markdown → HTML + slug helpers + blocks
Posts / pages / KB / announcements / redirects
SEO controller
Footer-links / contact-info / auth-config / seo-config / maintenance
Visual page builder + live preview
Design controls on every block — an Appearance panel on each block in the builder: rotate, scale, space a
Free-canvas block — an artboard where text, images, icons and shapes are dragged, corner-resized and rota
Drag blocks to reorder — grip handle on each block card; dragging block 1 onto position 5 slides the rest
The builder says where a block will actually appear — product pages route blocks to tabs by type, and on
AI-generated pages are designed, not stacked — the appearance layer is in the site-builder prompts, so generated and
Marketing copy is cleaned of engineering detail — a software product's feature list comes from its repo's
Page templates — "New from template": hosting/VPS/cloud/dedicated/SSL/API-access(VIR)/legal; category page
AI full website pages
AI blog-writer — "Write with AI" in CMS Posts: brief → AI drafts a full blog post (title/slug/excerpt/mark
Software-product sync-health — software-products list shows "synced Nh ago" + amber/red badge when auto-sy
Shop range pages — one page per product group with every plan side by side, a deterministic spec
Product groups admin — list/rename/re-slug/reorder/delete the ranges the shop is organised into, with a w
Plan resources editor — per-product specs (storage/bandwidth/websites/mailboxes/CPU/RAM/…) that drive sho
AI menu builder — writes header and footer navigation from the site's real routes; invented link
Designable help centre + contact page
Pages resolve at their own URL — a root catch-all serves every published CMS page at its slug, and /p/<s
KB article feedback — "Was this helpful?" writes helpfulYes/helpfulNo, which had existed since the KB
Edit a page with AI, whole or one section — works on the blocks in front of you rather than replacing the
Built-in marketing pages are CMS-overridable
A missing page answers 404
Content editor with preview, media and AI editing — posts and KB articles share one Markdown edi
Posts and KB articles are recoverable — every save snapshots the previous content first, with a
The whole post/article is editable — category, tags, hero image, SEO title/description/noindex
News and changelog posts have somewhere to live
Checkout funnel — carts survive checkout stamped with what they became, so the dashboard funnel measures
AI page generation IN the builder — one unified page builder: "New with AI" (brief → any business page, dr

Features

Category management — create, rename and delete the categories a help centre is organised by; rows previo
AI KB tree generator for software products — outline → editable tree → per-article or bulk write → apply, drafted fr

Features

Availability measured against the published commitment — monthly rollups per service pulled from the infrastructure
Maintenance windows + notice-period enforcement — windows cached, judged against legal.maintenanceNoticeHours on a
Admin Operations → Service levels — commitment, breaches, uncredited periods, short-notice windows — apps/admin/src
Standby side of §O ( , ) — shapes pinned in CROSSPROJECTCON

Features

Bundled themes (default / lbreeze / corporate) + active-theme switch + token CSS — apps/api/src/themes/the
Quick token overrides editor (colour pickers, hex↔HSL)
Visual theme builder — create/duplicate/delete/import/export custom themes; per-mode (light/dark) token ed

Features

Built-in avatar set — 30 generated-SVG presets replacing AI avatar generation (which spent a billed image call per a
Avatars in support threads — messages carried only authorKind, so every reply looked identical; author name + avat
AI replies disclosed — AI-written ticket replies carry their own authorKind: 'ai' (distinct from rule-based syste
Tapping a field no longer zooms the phone — iOS Safari zooms whenever a focused control is under 16px and
minReviews on the reviews widget was a dead setting — the operator could set "minimum reviews before sh
Enabling the reviews widget no longer opts you into every page — the default was pathMode: 'blocklist'
Reviews strip stopped appearing twice, and on the 404 — the homepage rendered <ReviewsBlock /> hardcode
redirects to instead of 404ing
Registration reports leftover gateway endpoints — the Stripe plugin already listed every webhook endpoint
Webhook registration proves the URL works before storing it — the guard only ever checked that a base URL
Direct Debit works through Stripe, no second processor needed — the portal's Direct Debit page only ever
Direct Debit scheme-mapping guard — pins the portal's scheme list, the scheme→Stripe map, the SDK union a
Payment routes are probed before they are offered — the portal's Direct Debit page rendered the whole flo
Booking reminders say when the meeting actually is — the subject was the literal string Tomorrow: …, wr
Outbound email log — every transactional send and every failure is now recorded at the point of dispatch.
Customer quotes tab
Staff subscriptions page + API — the page never asked
Deleted clients are out of every metric, and deletion cancels the billing — the stakeholder pa
The revenue definition is code, not convention — decision V1: cash captured (succeeded payment
Unreconciled clearing account is a dashboard alert, not a panel someone has to visit — the liv
Audit log usable as a compliance artifact — staff actions and system events are separate views
Chart legends match their series — ECharts resolves legend swatches and tooltip markers from the series R
Dead-page guard — fails the build when a page renders an empty state ASSERTING there is no data while hav
Scheduled stakeholder delivery + saved report views
Metric + fact-layer contract test
Daily fact layer — the keystone the whole reporting area was missing
One metric layer, versioned — "revenue" meant three different things depending on the screen (payments.a
Cohort retention is real — rebuilt on the fact layer, so each column asks whether the client was paying *
Reports rebuilt: MRR, ARR, retention, movement waterfall, drill-through — every tile reads the metric lay
Stakeholder pack
Reports, Cohorts + dashboard tabs stop stating figures they cannot support
Renewal invoice lines name what is being renewed — the line read Renewal — monthly and nothing else, so
Web analytics tab on the dashboard — visitors, pageviews, bounce, live now and cookies accepted beside Ov
Dashboard KPI tiles link to the list the number came from — a dashboard figure is a question ("1 overdue
Ticket + feature-request counts aggregate server-side — both chip strips tallied the list the page had ju
Co-pilot moved to the top bar — reachable from wherever you are rather than a destination competing with
NOC card reads the envelope Standby sends — the normalisers accepted a bare array, {incidents} and {cu
Email subjects are no longer mojibake — every built-in template shipped its subject with a corrupted em d
Client invoices tab shows the invoice number — the page declared and rendered invoiceNo while the API s
"Shared hosting" renamed to "Web hosting" in every label — including the customer-facing storefront (app
Customer resource graphs, from our own recorded history — every usage figure a control panel can give is
Every byte formatter agrees with its own label — there were nine independent byte formatters and all
Disk and traffic no longer under-report the plan — the site-overview panel divided by 1024 while labellin
Plugin load order is deterministic — loadFromDb had no ORDER BY, and every capability lookup takes th
Resource chart appears within the hour, not two
A disabled plugin instance says so — the registry only loads enabled rows, so Test/sync on a disabled i
Admin sidebar reorganised so a group name predicts its contents — 12 groups → 15, all 104 items preserved
Customer portal nav grouped into sections — sixteen flat rows became six labelled sections (Buy · Your pr
Full-width toggle hidden where it does nothing — the 1760px cap applies to .app-content, so the 240px s
Monospace actually renders monospace — all three apps mapped font-mono/font-display onto --font-mono
System page reports system-file drift
Plugins page reports load state, not just intent — a plugin whose constructor throws at boot is skipped w
Admin dashboard empty states + validated palette — panels explain themselves instead of drawing axes for
Consistent content width + Wide/Fluid toggle — one .app-content container in both shells (max-width + re
Root error boundary — branded Reload page + digest instead of Next's opaque screen — apps/{admin,client}

Features

Native reviews API + aggregates
Trustpilot provider plugin
Google Business reviews plugin
G2 reviews plugin (scaffold; needs partner API key)
Review invitations worker
Unified review pull cron (reviews.pull-tick, hourly)
Auto-approve resolution per-instance → global → queue (default queue)
Staff respond dispatches to originating plugin for external reviews
Marketing reviews widget with placement (above-footer / below-header / off) + path allow/blocklist — apps/marketing/src
Admin Settings → Marketing tab (widget config + external auto-approve toggle) — apps/admin/src/app/(app)/settings/marke
Admin reviews source filter + coloured per-source badges
Operator-tunable display knobs (reviewLimit / reviewSort / theme / productFilter) + path-filter tester on settings page
Moderation speaks the API vocabulary — the admin used published/{ decision } against the API's approved/{ sta
Customer self-submit — POST /reviews was a stub that always threw; customers now leave reviews from the portal at
Invitation landing page
Purchase-verified authorship — a review requires an owned service or a held software licence; terminated/expired sti

Features

SocialAccountModule SDK type (multi-tenant, post/schedule/delete/listAccounts/pullMentions/getPostMetrics)
Schemas: (encrypted tokens, clientId for tenant scoping, daily-post cap), (state mach
API SocialModule
Worker crons social.dispatch-tick (every minute) + social.mentions-tick (every 15 min) via callInternalTick — app
plugin-social-stub — no-network reference impl for dev / CI / pre-OAuth testing
plugin-social-linkedin — UGC Posts API v2; needs Marketing Developer Platform app review for multi-tenant
plugin-social-facebook (+ Instagram add-on) — Graph API; needs Meta Business app review for multi-tenant
Admin + customer-portal UIs for compose / queue / accounts / automations / inbox (Phase 3 of social plan)
Event-source fan-out automations: post.published (CMS) / / partner.created / review.appr
AI social drafter via existing plugin-ai- registry (Phase 6)

Features

Consent categories have a screen
The consent ledger can be read
Cookies-accepted KPI on web analytics — a banner decision is a person who saw a dialog and clicked, which

Features

Embeddable chat widget (KB search + create ticket)
Live chat backend (Socket.IO)
AI chat bot integration

Features

KB search (keyword + optional AI)
KB embeddings indexer (OpenAI)

Features

Failure drills + runbook, and the crash they found
End-to-end journey gate — a customer can buy AND receive — scripts/check-journey-smoke.
zephyr doctor — pnpm -F @zephyr/api doctor (--json for machines): one paste for a
Orphan staff-endpoint guard — the API→UI direction of the seam class, which had only eve
release.sh builds the release on RepoMade itself — the tag-push hook fired for none of the last twe
Zephyr as one process on one port — for platforms that host a single Node
Ops scripts init-aware on Alpine
Compiled runtime + TypeScript 7
A release owns the files it installs outside the release tree
Database faults name their cause — drizzle ≥0.44 wraps driver errors so .message is the statement; th
Pre-tag deploy gate — 9 gates: version-bump freshness + schema↔column-patches consistency
System-page dependency + vulnerability scan actually runs — was shelling npm at a pnpm workspace:
Boot-probe gate on the release path
Test gate on the release path — pnpm -r --no-bail test is a hard gate in both
AI chat call contract
Plugin capability read contract
Document-numbering contract test — fails the build on any file that formats its own PREFIX-…padStart se
Emit/subscribe contract test
Money-format contract test
Byte-format guard extended into and — the original sweep only looked in apps/{adm
Signup-spam defence — honeypot field + email canonicalization (Gmail dot/+ trick)
Demo mode now refuses, instead of only announcing
One-button demo activation, refused on a real install
Demo seeder covers the whole catalogue, with real billing history — was one product type (shared-hosting) with 30
Brand-neutrality lint (preflight check 6/6) — greps for lbreeze.{com,cloud,net,dev} hostnames in shipped
SSRF guard on outgoing webhooks — subscription URLs rejected at create/update if non-http(s), credential-e
Per-IP rate limits on public endpoints — in-memory sliding-window limiter (apps/api/src/common/rate-limit
Strict backup mode
verify-email resend rate limit
Signup-guard fail-open health surface — the guard bumps an in-memory counter on every fail-open; GET /hea
Secret-rotation runbook
Money + gatekeeping test coverage — 45 new pure-logic tests: signup-guard (email canonicalization / dispos
Business verticals + module flags — Settings → Business & modules sets the business type + toggles featu
Multi-currency FX rates
Direct-provider VPS provisioning — bind a VPS/Cloud product to a Hetzner Cloud / OpenStack / Proxmox plugi
Edge auto-fallback on 5xx

Features

workers schema — staff identity layer over users (department / manager / employment lifecycle / Standby SCIM externa
schema — non-commerce grant state machine (open-vocab kind: mailbox / product-access / ssh-key
append-only audit log — same file
RBAC seed for 7 new lbreeze workforce roles (sales / engineer / sysadmin / secops / developer / manager / dpo) on top of
WorkforceService — worker CRUD + idempotent user create + role attachment + offboard-with-revoke; grant state machine pe
HMAC-signed inbound — receives worker.certified / worker.offboarded from Standby; walks
Standby SCIM client — minimal HTTP wrapper, POST /scim/v2/Users on create / DELETE on offboard; default-on when workfor
Role → entitlement map in — driven by Standby's worker.certified webhook
workforce.retry-tick cron — re-fires failed grants past their backoff
Admin UI for workforce
Enhance MailboxCapable wired to platform-owned org for staff mailboxes — executeMailboxGrant in apps/api/src/workfo
People dashboard
AI-drafted invitations + offer letters — AiDraftService.draftInvitation + .draftOfferLetter
One role resolver, and access waits for training — three sites each did an exact case-sensitive RBAC look
Offers carry real money, a real signature, and a lifecycle — structured compensation (integer minor units
Operational notify address is a setting with a sane default — resolution at send time: notifications.adm
Collapsible sidebar accordion — only one group expanded at a time, auto-switches to the group
Opt-in auto-install on tag — system.autoUpdate.{enabled,maxVersionJump,checkIntervalMinutes,notifyEmai

Features

Ready to be a kstack app — the Zephyr half of the one-click install from th
Zephyr checks its own licence through the update edge
Zephyr licenses itself online — apps/api/src/p
Ed25519-signed license keys library
licenses controller
me/software-licenses surface
RepoMade integration : additive fields on (status / allowedchannels / seatkind / seatli
GET /api/license/list paginated for RepoMade display cache (Bearer admin API key, licenses:read scope, opaque licens
POST /api/license/trial with double rate-limit + operator-tunable defaults + daily expiry cron — apps/api/src/license
Revocation push fan-out to RepoMade dev + edge mirrors ( env, default-on) — apps/api/src
Seat-metering heartbeat (POST /api/seats/heartbeat) + admin "Seats" column with over-cap badge — apps/api/src/seat-he
Per-license channel allowlist (allowedChannels jsonb) + trial state vocabulary
RepoMade pairing handshake — paste-once UI replaces shared-env-var HMAC. Accepts both bundled z

Features

Independent product entity
Six pricing models — onetime, lifetime, subscription, perseat, freemium, term
Per-license plan tracking
CRUD API — products + plans + import
Import-from-RepoMade wizard — 4 parallel calls to the build-source plugin (getRepo + getLatest + getInstallDoc
AI polish step — POST /admin/software-products/import/polish pipes description + features through the active AI pl
Admin UI — list + detail (Overview/Plans/Versions tabs) + import wizard with conditional model-aware plan editor
Marketing-page auto-gen on import + webhook
Automated documentation section
Webhook auto-sync softwareversions — RepoMade release-notify writes both vendorreleases AND softwareversions when
Screenshot management UI
Request-Demo flow
Customer cart integration
License issuance on order.paid — software-license items walked from orderitems, softwarelicenses rows inserted wit
Customer-facing /products/[slug] marketing page — server-rendered hero + install + pricing table with real Buy butto
Full backfill on import — import wizard inserts every historical version from the build-source's changelog
AI "Fill all sections" button — one button on the product detail header generates description + pitch + se
Real Overview tab — hero strip with image + name + pitch + description; configuration-gaps card with one-c
Auto-sync from build-source every 30 min — worker cron software.sync-tick calls POST /admin/software-pr
"Sync now" button — replaces "Refresh from RepoMade" on the product detail header; same code path as the c
AI hero-image generation — POST /admin/software-products/:slug/hero-image via MediaService (plugin-ai-op
Source & sync control tab — editable build-source repo, build-source plugin status with fix-it link, last
AI rich-features generator — POST :slug/ai-features writes themed sections with per-feature title + one
Visual features editor — sections + per-feature title/description, add/remove/reorder, AI-generate, raw-JS
Manual version / changelog authoring — "Add version" dialog (version + channel + released-at + markdown no

Features

cloud product type + Standby provisioning card — backend / server-type / region / OS image / provider / datacenter
Editable provisioning config on product detail + Standby catalog proxy GET /admin/hosting/provisions/standby-catalo
AI full website page generator for catalog products — hero + feature-grid + real-cycle pricing-table + cta + optiona
Marketing block renderer (hero/feature-grid/pricing-table/faq/cta) + clean-URL fallback — apps/marketing/src/compon

Features

Server-seeded brand (no flash)
Emails use operator brand

Features

Read-only assistant + memory — businesssummary / financepnl / recentleads / recentorders / listse
Gated write actions + Auto-mode — write tools (media / leads / campaigns / promo codes) proposed fo
Hardened agent loop — tool results folded into plain messages (OpenAI-compatible), provider errors caught
One tool registry across every AI surface — Co-pilot and the MCP endpoint had zero tools in comm
26 tools covering what operators actually ask — overdue invoices, renewals due, expiring domains, ticket
Native tool-calling with a working return path — providers could send tools but not receive r
Past conversations are reachable + answers cite their sources — the history endpoints had shipped with no
Support bots can use the same tools, and cannot write with them — explicit per-bot allowlist (empty by de

Features

Affiliate payouts have a screen — list, pay one affiliate's approved commissions, pay everyone at once, mark paid; f
Bank lines can be reconciled by hand — match / ignore / unmatch, with a manual match requiring a free-text reference
Legal documents can be sent for review — pinned to a specific version, so a stamp cannot outlive the words it approv
social — nine endpoints, no page, no sidebar entry. Decide whether it ships or is removed; see AUDITAPIUISWEEP
Remaining sweep candidates: balance snapshots, Stripe payout, invoice reposting, wages run, payroll rates, and ~50 unver

Features

Partners schema + admin CRUD — slug + name + tagline + logo + commissionPct + term + first-invoice-only + revenue-sh
Partner discount codes — % or fixed, applies-to (first / all / recurring), expiry, max-redemptions, redemption count
Single-attribution per client with source enum (code / landing / manual / webhook) + accrued-total + first-invoice a
Commission accrual on invoice.paid — subscribes via EVENTBUS, evaluates term + floor + per-client + per-month caps
Public validate-code + branded /partners/[slug] landing page — auto-applies primary code, signup CTA passes code thr
Admin partner detail page — dashboard cards (clients / accrued / redemptions / pending) + codes tab + attributions t
Signup-time partner-code capture — POST /me/partner-code/apply called from client portal signup when ?code= is on
Cart-side partner discount + order-create attribution — carts.partnerCode column + apply/clear endpoints + pricing

Features

me/software-licenses page

Features

Affiliates + commissions
Affiliate payouts (bulk + per)
Reseller surface

Features

WHMCS + HostBill importers
Read-only schema probe (POST /migration/probe) — reports matched tables, unresolved required fields, and unrecognised
Entity coverage — clients + contacts + addresses + credit, services + subscriptions, domains, invoices + lines, payments
Ingest transports
Migration console
Existing-client policy — merge (default, attach to the client already in Zephyr), separate (+tag address) or skip
Undo an import — POST /migration/runs/:id/revert deletes only rows that run created; a merged-into client is never tou
HostBill spec verified against a live 8.4 install
Admin-API transport (HostBill , WHMCS ) — needs live response samples first
Runbook

Features

Fraud-check evaluator + review queue
MaxMind minFraud plugin

Features

GeoIP package
MaxMind GeoLite2 plugin
Weekly Wed-04:00 update cron

Features

Locale resolution + ICU-lite formatter + catalog loader
DB-backed translation tables
next-intl on all UI apps
Admin locales endpoint
Themes admin (discover / activate / tokens)
Theme SDK
Three shipped themes: theme-default, theme-corporate, theme-lbreeze
Multi-brand configuration
Branding uploads (logo + favicon)
Uploaded files are served with security headers and validated by content — every upload-serving route shi
Avatar persistence is server-side, and stored URLs must be publicly routable — uploads stored wh
Stranded uploads are rescued at deploy

Features

Per-package telemetry grant — log-derived metrics (requests, unique visitors, referrers, WAF blocks) are
Consent ledger + cookie categories
Consent banner runtime
GDPR data export + account deletion
GDPR data export worker
A data export claimed by a dead worker is reclaimed, and a stalled one says so — tick flipped rows to
Customer export UI matches the async contract — request history with live state, 15s polling while preparing, and a real
Entitlement-gated portal nav
Single "My software" page — purchased software + hostname-locked licences (with FQDN rotation) on one screen; /my-softw

Features

Per-feature model routing — seven AI workloads each name their own provider instance and model
Whole-page AI generation for ranges — one call against the full 22-block vocabulary instead of three disc
AI legal documents with lawyer review — drafted from real business facts (company details, sub-p
One JSON parser for every model reply — handles markdown fences, surrounding prose and brace-containing s
The model never supplies a media URL — invented image paths are stripped, so a hero image can only come f
Help-centre gap finder — ranks what to write from failed KB searches, recurring resolved tickets and arti
OpenAI provider plugin (chat + streaming + embeddings)
Anthropic Claude provider plugin on the official SDK
Ollama (self-hosted) provider plugin
AI safety / PII redaction
AI features module (site builder + reply suggest)
AI bots (chat + ticket auto-reply)
AI budgets + caps + admin
AI budget recompute worker

Features

S3-compatible SigV4 signed URL service
Storage admin

Features

PDF package + invoice generator

Features

Plugin/theme/prompt-pack install API
Marketplace admin page

Features

api/v1 surface: clients, invoices, services, domains
HMAC-signed outgoing webhook subscriptions

Features

Plugin trust tiers — every catalogue entry carries trust: verified | beta | experimenta
Base Plugin class + lifecycle hooks
Module types: ServerModule, RegistrarModule, SSLModule, GatewayModule, VPSModule, DedicatedModule, AIModule, ReviewProvi
21 capability interfaces
Plugin registry
Plugin instance admin + helpers (Google Reviews accounts/locations)
Plugin API trace service

Features

JSON-RPC 2.0 McpServer class
tools/list + tools/call + initialize
Tools: findclientbyemail, listinvoicesforclient, listservicesforclient, kbsearch, replytoticket — apps/api
Staff-guarded HTTP transport

Features

In-app notifications + per-user prefs
Notifications that actually get produced — StaffNotifierService + CustomerNotifierService subscribe t
Customer notification centre
Notification-preference contract test — fails the build if a key is declared inApp: true with no produc
Slack notification plugin
Workflows engine (admin-defined rules)
Workflows builder UI

Features

Prometheus exporter — GET /api/v1/metrics in the text exposition format, bearer METRI
BullMQ cron registry (19 jobs)
Cron admin / DLQ inspector
Sentry error sink
Churn scoring worker
System info endpoint
Health check

Features

apps/api — NestJS, ~70 feature modules
apps/admin — Next.js 16 + React 19 admin UI, ~35 page groups
apps/client — Next.js 16 customer portal
apps/marketing — Next.js 16 public site (blog, KB, changelog, CMS, RSS, sitemap)
apps/worker — BullMQ workers + cron jobs
apps/proxy — Single-process host-based reverse proxy
apps/installer — One-page web wizard (writes .env, migrates, seeds admin, builds, starts pm2)
apps/importer

Features

Auth: login / forgot-password / reset / set-password
Dashboard
Clients (list / [id] / new), Products, Orders, Invoices, Subscriptions, Refund-requests
Services, Domains, Support, Reviews, CSAT
CMS hub (posts/pages/kb/announcements/redirects/footer/contact)
Languages, Themes, Brands, Email templates, Mailboxes + inbox
Chat (live), AI usage + budgets, AI bots
Automation (cron + DLQ), Workflows, Provisioning scripts, Fraud review
Affiliates, API keys + webhooks, Audit log, Marketplace, Plugins
Custom fields, Quotes, SEO, Security-headers, Permissions, Reports
Users (staff), System status
Settings: brand / dns / email / localisation / maintenance / security

Features

Auth: login / signup / forgot / reset / verify-email
Dashboard, Billing, Cart, Checkout, Shop
Services, Domains, Support, Announcements
Profile, Data-privacy (GDPR)
The careers page belongs to the operator, not the platform — four things on one page: it read NEXTPUBLI
Signing a contract emails the signed copy it always promised — the sign page stated "A copy was emailed t
Public links can no longer point at localhost
AI contract drafting — brief + type (MSA/reseller/SLA/NDA/DPA/SoW) + counterparty + governing law → a dra
Terminating a service now actually terminates it at Enhance — the cascade deleted the subscription at /o
The orchd spec is vendored and enforced
A refused plan change says why — the panel’s rejection arrived as a bare Error, so Nest rendered "Inter
seo-config is normalised, not asserted — the root layout read config.verification.google off an unval
The provisioning script stopped printing its exit code — die { echo "$" } printed every argument inc
There is a way to reach the cart — there wasn’t. The logged-out shop shell had a Cart button; the marketi
Domain intent survives the hop to the portal
Resource usage reads as usage, not a wall of numbers — UsageBar drew no bar at all, so eight resources
Usage history covers the whole resource matrix — the sweep stored websites, processes, page views and the
The header dropdown closes when you use it — it was pure CSS (group-hover + group-focus-within), and
Menu children can carry a description — optional one-liner under the label, editable per item under Websi
The homepage is findable in the page builder
The link to a published job vacancy renders
Custom profile fields actually render
The portal’s CSP nonce is stamped — its middleware minted a per-request nonce and the layout never read i
The website-preview card is gone — it could never have worked. Enhance (orchd 12.25.5) exposes three scre
Site thumbnails, if wanted, need a different source — capture from the public URL with a headless browser, which wor
Customers can set an avatar
One place talks to the image API — MediaService.renderImage extracted so the avatar path shares the r
Affiliate, Reseller, My-software

Features

Secrets masked in staff API responses — plugin-instance list/get return •••••••• for e
Committed, versioned migrations
Secrets at rest
Drizzle PostgreSQL config
postgres-js driver + drizzle PG client
30 schema files (all pgTable, integer, jsonb, timestamp({ precision: 3 }))
Idempotent migrator with column patches (native PG IF NOT EXISTS)
Seed script
UUIDv7 varchar(36) id helper
Committed SQL migrations
Post-baseline migrations are idempotent — every CREATE TABLE / CREATE INDEX / ADD COLUMN after the baseline ca

Features

Turborepo + pnpm workspaces
Per-app start scripts
Fresh-VPS installer (Ubuntu 24.04+ / Debian 12+) — — adds upstream apt repos (Node 24 LTS, Postg
Nginx site template (4 server blocks, WS upgrade, security headers)
Security-headers hardening → A+ (HSTS + deduped basics, no X-Powered-By at the nginx layer; per-request nonce CSP
One-shot Node 22→24 LTS upgrade (snapshot + native-ABI rebuild + 5-unit restart + health check + auto-rollback) — d
systemd units for api/worker/admin/client/marketing
Postgres bootstrap SQL
Subdomain routing ( , , , marketing on apex) with cross-subdomain Better-Auth cookies — COOKIEDO
Versioned-zip build script (always stages a wrapper)
Top-level legacy (Enhance path-based proxy)
PM2 ecosystem config
Backup script
Reset-password CLI
VPS install + Enhance install guides
Release-symlink layout ( + atomic symlink) with automatic migrati
Admin-gated self-update — pulls signed releases from RepoMade (vendor-update.sh --check on a 10-min timer, --appl
plugin-repomade — BuildSourceModule (new SDK module type) implementing the upstream release-artifact source. Drives

Features

Double-entry ledger spine — CoA + journal entries/lines (debit=credit invariant) + period lock
AR + Stripe-in + payout reconciliation → ledger (event-driven, idempotent) — apps/api/src/finance/finance-posting.modul
Tide bank feed + reconciliation engine (read-only, pluggable adapter)
Accounts payable + supplier sync (§B) + payroll ingest (§A)
Cost + metered-usage events → COGS/margin (§E)
Reporting cockpit (P&L, balance sheet, AR/AP aging, cash) + admin Finance page — apps/api/src/finance/finance-reports.m
UK VAT-return 9-box derivation
Human-gated payment runs (wages/VAT/AP) via Tide
Integration scaffolding (ZEPHYRSTANDBYHMAC signed-RPC + inbound guard)
Single-item ledger repairs
Historical ledger backfill — POST /admin/finance/backfill + "Backfill ledger" button sweeps pre- in
Gateway settlement sync — listSettlements SDK capability + Stripe impl paging balance-transactions for
Bank-line coding — autoReconcile only MATCHES lines to journal entries that already exist, so a freshly
PDF statement import — for issuers that only give you a PDF (Capital on Tap). Reconstructs table rows from
Bank statement CSV import — header-sniffing parser (signed-amount or paid-in/out, UK day-first dates, semi
Supplier costs admin — suppliers + purchase bills with per-line nominal + VAT rate, approve→post, record p
Recurring supplier bills — templates materialise draft bills on a schedule (daily ap.recurring-bills-tick
Ledger explorer — journals with source/period filters + line drill-down + reversal, trial balance grouped
Payment runs admin — propose from approved bills or VAT, approve, then type-to-confirm execute — apps/adm
Credit-card / liability accounts — 2400 Credit card control nominal + natural-balance signing so card de

Features

Append-only page versioning
Publish / unpublish / rollback — rollback COPIES an old version forward into a new one rather than moving
Data blocks + module registry — reviews and product-grid bind to live platform data instead of typed-i
Chart blocks — four presets (dual-axis-trend, lines-with-band, multi-line, stacked-bars) covering every ch
Shared block package
Fixed — DELETE /cms/admin/pages/:id existed in the admin UI but not the API

Features

Referral rewards reach a referee who signs up on their own, and a code no longer stops paying after its first referee
Leads CRM + rule-based segments (over leads + clients) + public capture
Campaigns → segment, A/B subject, open/click tracking, suppression
Automations / drip journeys (worker-ticked engine + event triggers)
Capture forms + hosted landing pages
Attribution + ROI (paid-invoice → first-touch source, ROAS)
Promo codes (apply at checkout) + referral program with auto reward fulfilment — apps/api/src/marketing/promos.module.t
Visual builders for segment rules + journey steps
Ad-click attribution (PLANMARKETINGADS.md A0) — a visitor who arrives from an ad (ChatGPT oppref, Google gclid
Attribution page: revenue by ad platform, recent tagged visits, and a capture-status banner that says outright when the
Form submissions keep / (both were dropped) and cap every UTM at the column width; an over-long
Guards: pins both seams (the component is mounted, sends credentials and the consent ke
Ads hub, read-only (PLANMARKETINGADS A1) — Marketing → Ads:
AdPlatformModule SDK kind ads (read half required, write half typed for A3) — packages/plugin-sdk/src/module-types
Hourly ads.sync-tick worker cron into , and . Money is stored as bigint
"Paid to date per client" defined once, in the metric layer
Guards: micros columns must be bigint . The journey gate connects the sample account as ChatGPT, s
Conversions sent back to the ad platforms (PLANMARKETINGADS A2) — a customer whose last ad click before signing up
plugin-ads-chatgpt Conversions API: pixel ID plus a separate Conversions API key, with a test mode; bu
Accounts tab "Conversions sent back" card (sent / waiting / failed / expired per platform, recent events, Send now), and
Journey gate: sending conversions twice delivers exactly one signup and one first purchase for the ChatGPT-ad customer
Ad campaigns run from Zephyr (PLANMARKETINGADS A3) — Marketing → Ad campaigns — apps/api/src/marketing/ad-plans.m
Money rails on every action that commits spend. Pause and End are never blocked, so stopping spend always works.
AdPlatformModule management half: publishCampaign (paused), setStatus, setLifetimeBudget. ChatGPT resolves count
The ad studio: one brief, every image size the platform wants - Marketing -> Ad campaigns -> a campaign -> Creatives
Guards:

Features

The builder drafts the whole product, priced (2026-09-20)
kstack is a Catalog Builder source, with families, locations and pages written from measured facts; Enhance is retired
Scout provider/registrar catalogs → AI drafts sellable products → operator approves → real products + AI marketing pages
Source adapters (normalized CatalogItem): cloud-hetzner (specs+cost), openstack/proxmox/standby (specs), enhance (shar
AI recommend → (markup-default retail + AI market-anchored suggestion, hallucinated-ref drop, slug dedu
Apply draft → product group + products (hidden) + cycles, binds provisionPluginInstanceId/provisionPlanRef; Enhance path

Features

Competitor price intelligence — operator-curated source URLs, daily fetch + AI extraction into append-only snapshots, "U
Product price history audit trail + canonical PriceBookService.setCyclePrice (the only sanctioned price mutation)
Strategy core — time-windowed playbooks (draft/scheduled/active/paused/completed) with full revert via before/after acti
Seasonal strategies — promo auto-create/restore (cart-wired codes), scheduled theme-token overrides, marketing-site canv
AI strategist — draft-from-brief grounded in catalog + competitor snapshots (always lands draft/suggest), mid-flight AI

Features

AI theme designer — full business theme (all color/typography/radius tokens, light + dark, WCAG-contrast prompted) from
Theme from any website — paste HTML or give a URL; AI extracts palette/typography/feel + designs a matching dark mode
Version history on custom themes — auto-snapshot on every save (cap 20), restore is itself undoable — themes.versions.<
Exports: re-importable JSON, ZIP bundle (theme.json + composed tokens.css + sparse overrides.css + design file + README

Features

UK PAYE / NI / pension calculation — deductions are computed rather than zeroed. PAYE is cumulative a
Import-from-Standby failures explained, not 500'd — a 404 from the unbuilt §A producer used to surface as
A wrong statutory figure, found the day the screen shipped
Statutory rates can be confirmed
Manual period entry — POST /runs/import-manual is the documented alternative when a period isn't in Sta
A posted run can be paid
RTI FPS/EPS submission to HMRC; Scottish/Welsh bands; K codes; student loans; salary sacrifice; statutory pay; directors
Not exercised against a real payroll run — typecheck, tests and build only; no period has been imported, no rates sa

Features

Tide (and any paid-in/paid-out) bank statements — dated balance-anchor pair (Balance (£) on <date>) mat
Long-form dates parse as UTC — "29 Jun 2026" fell through to new Date (local time), reporting the 28th, and "
Wrapped counterparties — payee lines above a dated row are adopted only on statements that actually wrap them; a noi
Card-vs-bank detection drives the invert toggle — it defaulted ON, right for a card statement and silently wrong for
Balance anchors are visible and can be added — GET/POST accounts/:id/snapshots had no screen. The deriv
The reconcile card checks the cause it names — it asserted "unmatched lines before that date are the usua
Multi-card statements can be imported — an account with more than one card prints every transaction twice
Cross-source duplicate guard — dedupe was keyed on externalRef, which is scheme-specific, so the same r
Preview always matches what will be imported — the dry-run is probed uninverted, re-run only when the det
Emitted fields bounded to their column widths — the rail wording is normalised into the short banktrans

Features

Calendar invites on every booking email
Meetings can be recorded as attended or a no-show — a sweep moves ended bookings to awaiting-outcome an
Reminder ladder — 24h plus 1h, each rung floored at the next so a short-notice booking is not reminded tw
External staff calendars are read — the page can no longer sell a slot the host committed elsewhere; busy
Per-type questions — a demo and a support call can ask for different qualifying information; answers vali
Team scheduling — host pool with fixed / round-robin / least-busy assignment, availability unioned across
The public booking page is a booking page — two-column layout with a sticky summary of what is being book
The booking form was not a <form> — a <div> with a type="button", so required and type="email"
Forward paging is bounded — booking types carry a maxAdvance the slots endpoint already applies, so pas
Unverified against anything live: the ICS attachments have not been opened in a mail client, and no real CalDAV serv
Declined 2026-08-16 (see ): Google + Microsoft calendar providers (OAuth app registration + ref

Features

Client product demos + partner calls on the Standby-owned meet server — MeetingsService mints a room via POST {standb
Admin — create (subject/kind/client-or-partner/schedule/moderator), copy link, open, join embedded (ifra
Standby-side (mirror session): POST /api/admin/meet/rooms (+ ) accepting std + X-Zephyr-Sig — see CROSSP
Scheduled-meeting shadow copy — booking a meeting with a scheduled time upserts it on the
Business-roster mirror — GET /api/standby/directory serves active staff only (custom
Standby-side (mirror session): accept PUT /api/admin/meet/scheduled/:id, serve GET /api/admin/directory, consume

Features

Consume Standby's approved → place vendor order → report ordered/received back (Standby bumps spa
Inbound webhook POST /api/finance/purchase-requests/webhook (IntegrationHmacGuard); admin queue (
Standby-side (mirror session): POST approved PR to Zephyr on approve; accept Zephyr's signed callback on

Features

One-paste mutual pairing with the monitoring backend ( handshake → push credential + pull token)
Zero-key auto-pairing — POST /api/license/pair-request, edge-HMAC over raw bytes (X-Edg
RepoMade-side (mirror session): the edge relay POST /api/v1/pair-request/{product}. Zephyr's endpoint is live but
NOC connector extensions

Features

Self-hosted analytics — tracking script + collect + sessions/sources/pages/realtime — apps/api/src/marketing/analytics.
Apps self-track via runtime hostname resolution (no env/rebuild)
Admin dashboard with 15s live auto-refresh + remove-site

Features

AI image generation (OpenAI-compatible) for promo/booth/product-page graphics + logos (transparent) — apps/api/src/medi
Upload from your computer — drag-drop or browse, multi-file, on the Media page itself; the endpoint and i
Edit an image with AI — a prompt against an existing asset (remove the background, extend for headline sp

Features

Admin refund calls the gateway — invoicesService.refund calls the gateway plugin's refund with a determinist
IMAP accounts from with as a dev fallback; missing config is handled, not
Workspace typecheck at zero errors
Brand logo in invoice PDF — brandLogoDataUrl on the invoice renderer, resolved from brand.logoUrl — packages/pd
plugin-geoip-maxmind — GeoIP as a plugin with its own config; see — plugins/plugin-geo
Worker drains the webhook-processing queue
domains.expire-pending-transfers cron registered and dispatched
API publishes on SMTP settings save; the worker subscribes — apps/api/src/settings/s
Admin health banner surfaces health:smtp-config-failed and the other health signals — apps/admin/src/components/h
Audit consumer for service.suspension-skipped
table
2FA (TOTP + OTP email) via better-auth twoFactor, magic links, passkeys, SSO

Features

plugin-virtualizor — VPSModule for Virtualizor hypervisor
plugin-solusvm — VPSModule for SolusVM hypervisor
Reseller support on cPanel / DirectAdmin / Plesk — extend existing plugins (Enhance already supports it) — P3
Per-slot & metered-overage reseller billing — beyond flat-quota (P3); sub-client billing (P4)
plugin-reviews-capterra — Capterra + G2 ReviewProvider — P4
plugin-reviews-facebook — Facebook ReviewProvider — P4
plugin-quickbooks-online — AccountingModule, US market — P3
plugin-sage — AccountingModule, EU enterprise — P3
E-invoicing — PEPPOL / UBL 2.1 / FatturaPA XML alongside PDFs — P3
plugin-tax-avalara — real-time US sales tax provider — P3
plugin-tax-taxjar — alternative US sales tax provider — P3
plugin-email-postmark — pluggable ESP transport (SES is built; Postmark/SendGrid remain) — P3
plugin-email-sendgrid — same — P3
Crypto payment gateway — BTCPay / Coinbase Commerce — P3
Apple Pay / Google Pay on checkout — toggleable Stripe PaymentElement method types
Quote-to-cash for enterprise deals — P3
Multi-currency FX policy controls — admin-tunable refresh / overrides — P3
Cohort analytics / cohort churn curves — beyond current MRR/ARR reporting
Export to BigQuery / Google Sheets — for revenue dashboards — P3
Encrypted columns for sensitive PII — per-column app-layer AES-GCM — P2 still outstanding
Translation-memory propagation across similar strings — i18n admin UX
DeepL / Google MT inline translation assist — in the language admin UI
Per-locale invoice/PDF localized labels — date/number/currency for EU compliance
AI-assisted changelog/blog drafting — generate from git commits / briefs — P4
Marketing → campaigns module — admin UI section — P4
Marketplace admin UI polish — P4
Vendor license-server (Standby integration)
Packaging-tier claims + — verify now emits tier/limits/features a
Stripe restricted keys + a real connection test
Software-product auto-publish
AI marketing-page generator — admin button on /admin/vendor-licensing → Product tab calls AI Site Builder with a p
Per-product docs surface

Features

Feature-request board
Affiliate payout gateway — beyond account-credit payouts — P4
Affiliate tax-form capture (W-9 / W-8BEN) — P4
Community prompt-pack marketplace — for the AI assistant — P4
SoftwareLicenseModule plugin category — bridge to external license systems (FastSpring, Paddle-style)
Case studies post type — future kind value in unified posts table
Stripe auto-renew via saved cards (off-session) — extractCustomerFromPm returns undefined; wire Customer-id for
Asset Manager
Email Workspace (OpenSRS + Google Workspace) — new EmailServiceModule + seat-based sibling SDK; plugin-opensrs-email
OpenSRS Email (standalone variant) — superseded by Email Workspace plan; same OAuth2 mailbox CRUD, ResellerCapable w
Payment Methods L — Stripe ACH Direct Debit; plugin-authorize-net (CIM); mandate-lifecycle listener (closes GoCardle
Plugin / Theme Upload
GeoIP auto-update cron
GeoIP-driven marketing defaults
GeoIP risk signals into fraud scorer — country-mismatch / high-risk-country flags at checkout. Still open: fraud.mo
Currency-precision map
column-patches.ts:297
column-patches.ts:295
column-patches.ts:284
Dedicated disputes table — still open; gateway-webhook.controller.ts:318 still records disputes on the fraudre
Live WCAG-AA contrast checker in the token editor — the colour pickers exist, the contrast warning does not
Self-hosted font upload (WOFF2) — font slots are text fields, with no curated list and no upload
Density control — compact / normal / comfortable; radius is editable, density is not
Logo / favicon / OG image / email-header upload slots — light + dark variants
Sanitized custom-CSS escape hatch — scoped to theme root
Per-page token overrides — seasonal campaigns and product-specific branding
runtime — stub; providers live as plugins, no shared lib
shared component library — stub; admin/client each ship their own Radix components
shared lib
shared lib
standalone app
Generated SQL migration files
MCP stdio transport — only HTTP POST /mcp is wired; no stdio entry script
Marketplace catalog data — module wired but no shipped catalog file
Workflow action library