Shared components and utilities for ASafariM web applications
05 /Engineering proof
What actually backs this platform
Architecture, security boundaries, deployment shape, shipped versions, and quality status — each with a source and a timestamp, not just an assertion. Operational details (hosts, credentials, internal logs) are deliberately excluded.
01 /Architecture
How the pieces connect
experience
Central sign-in gateway; every app redirects here when unauthenticated.
experience
Next.js 16 App Router apps sharing the design system and auth cookie.
shared
Auth.js v5 config, JWT sessions, RBAC helpers, app registry.
shared
CSS design tokens, AppShell, DataTable, and brand components.
shared
Locale resolution and dictionaries for en/nl/fr/de/lb.
data
Shared platform schema: users, RBAC, audit log, EduMatch, TimelineAI.
data
Per-app isolated Postgres instances, deliberately not shared.
data
Background job queues for Vionto's render pipeline and AppBuilder's AI generation.
02 /Security
SSO and RBAC boundaries
Hub issues a JWT session on a cookie scoped to the shared apex domain. Every other app validates that session; none of them hold a separate credential store.
Role/permission checks run in each app's own middleware and API routes against the shared platform schema — a client-side role flag is never trusted for access control.
Testora and AppBuilder each run against their own Postgres instance specifically so a bug in one app's queries can't reach platform user data.
API keys and connection strings are decrypted server-side from an age-encrypted file at deploy time; they are not present in any client bundle or public repository file.
03 /Deployment
Delivery topology
Docker Compose stack behind a reverse proxy, deployed by pushing to main. Each app builds as its own standalone Next.js image; a background worker process runs alongside the apps that need one (Vionto, AppBuilder).
- GitHub Actions triggers on push to main.
- The deploy job connects over SSH to the host and runs the repository's deploy script.
- The script pulls the latest commit, decrypts environment secrets from the committed encrypted file, and rebuilds images sequentially.
- The reverse proxy routes each subdomain to its container; the stack restarts with zero manual steps.
Host address, credentials, and internal service ports are intentionally not published here — see the Rules section above.
04 /Live status
Is it actually up right now
Polled from each app’s public /api/status endpoint at the moment you loaded this page — genuinely live, not a cached number.
Webunreachable
Hubok · 19ms
Showcaseok · 19ms
Adminok · 19ms
Viontook · 19ms
Testoraok · 19ms
AppBuilderok · 19ms
EduMatchok · 19ms
TimelineAIok · 19ms
05 /Quality
Build, accessibility, performance
Live
Passing
Method: GitHub Actions API: latest completed run of ci-status.yml on main (lint + typecheck + package tests — build excluded, needs CI secrets, tracked separately).
As of 2026-10-18
Live
100 / 100
Method: Lighthouse CI (treosh/lighthouse-ci-action) against the deployed showcase, on a daily schedule; committed snapshot read from main.
As of 2026-10-18
Live
70 / 100
Method: Lighthouse CI (treosh/lighthouse-ci-action) against the deployed showcase, on a daily schedule; committed snapshot read from main.
As of 2026-10-18
06 /Versions
Shipped packages and apps
Published on npm
35
live from the npm registry · 2026-10-19
All-time npm downloads
74,911
api.npmjs.org, summed per package
Workspace packages
21
packages/* · consumed via workspace:*
Apps in production
12
12 changed in the last 14 days
Published on npm
Open-source building blocks published from the @asafarim npm account and used across my apps. Sorted by all-time downloads; the bar is each package’s share of the most-downloaded one.
Secure, age-based encryption/decryption for .env files across multiple environments and monorepo app folders
A versatile React navigation component with unlimited multi-level dropdowns, four alignment options, mobile responsiveness, and customizable styling. Perfect for modern web applications.
A minimal, elegant, and highly customizable dropdown menu React component. Perfect for navbar, sidebar, or any dropdown needs with beautiful theming and smooth animations.
A comprehensive theme management system for React applications with automatic dark/light mode detection, custom theme creation, and smooth transitions.
A professional markdown viewer with file tree navigation, directory content browsing, and advanced YAML front matter support
ASafariM design tokens (CSS variables) with multi-theme support and 30 variable fonts (100-900).
A responsive React component for displaying paginated project cards with built-in search functionality
A shared i18n package for React applications
Responsive, paginated vertical changelog timeline using ASafariM design tokens
Reusable, framework-agnostic React navigation components (navbar, sidebar, drawer, dropdown) for ASafariM apps and beyond.
A React component for displaying project cards with title, image, description, tech stack, and links.
***Convert your project into a beautifully formatted Markdown file***
Comprehensive reusable dropdown components for React with TypeScript and mobile-first design
Accessible, themeable React progress bar components (linear, circular, step, segmented, threshold, vertical, spinner) built with CSS modules and design tokens.
A modern, accessible, reusable React + TypeScript country & language selector for navbars.
Pure utilities for file discovery and folder tree generation. No runtime dependencies.
A comprehensive React TypeScript package for GDPR/CCPA privacy consent management with customizable UI components
Google Calendar-style booking UI for FreelanceToolkit.Api
Browser-native AES-256-GCM encryption for files and data with password or public-key modes
A collapsible sidebar component for React applications
Config-driven local file and folder encryption CLI for AppSafe
A TypeScript package for recursively exploring markdown files and folders with lazy loading capabilities
Utility functions for markdown processing, metadata extraction, and content parsing
A flexible markdown viewer with support for both standalone and integrated routing usecases
A React component for displaying syntax-highlighted code blocks with copy functionality and theme support.
A shared design tokens package for use across multiple projects.
A reusable React component for exploring and viewing markdown files with file tree navigation
Express API wrapper for MD Exporter with tree generation capabilities.
A React package for theme switching between light and dark modes, utilizing a context provider and a switcher component.
Export files from a target folder into a single Markdown file
A React package for theme switching between light and dark modes, utilizing a context provider and a switcher component.
React toast notification system for ASafariM frontends.
A robust, fully-typed React component and headless hook to display the success or failure of password strength rules in real time.
A lightweight, environment-agnostic logging utility shared across all ASafariM applications.
Platform workspace packages
Internal to this monorepo and never published, so they don’t carry independent semver. Their real version is the last commit that touched the folder, linked below. A green dot means it changed in the last 14 days.
Cross-app user-activity adapters for the superadmin User 360 explorer
Vendor-neutral executable contracts and deterministic evidence evaluation for AI agents.
Vendor-neutral, append-only AI provider cost-event contract — Zod schemas, integer-micro money, exclusive usage buckets, pricing snapshots, effective-cost/coverage aggregation and timeline read-model types. No Next.js, database, auth, AI SDK or browser dependency; each app persists events in its own schema.
Server-only AI provider boundary and structured planning schemas for AppBuilder's M07 generation pipeline. The model may only propose allowlisted @asafarim/appbuilder-schema operations — this package never executes or returns arbitrary source code.
Approved component/template registry and metadata-driven preview renderer for AppBuilder generated apps — no database, auth, AI, or Next.js dependency.
Versioned AppBuilder application-specification contract and deterministic controlled-operation engine — no Next.js, database, auth, AI, or browser dependency.
Shared Auth.js v5 authentication for the ASafariM Platform
Shared TypeScript, ESLint, and Tailwind configuration for the ASafariM Platform
Shared PostgreSQL/Prisma database package for the ASafariM Platform
Dependency-free, fail-closed guard deciding whether a synthetic-data CLI may write a database: URL and machine signals, the asafarim-env database marker and its SQL. Shared by the TasksAI identities CLI and the TasksAI test-data CLI.
Typed, allowlisted seed-data providers shared by the Admin Console and the CLI seed scripts. Server-only.
Read-only client for Admin's internal platform-settings API, for apps on their own isolated database (Testora, AppBuilder, ResuMatch). No Next.js, database or auth dependency.
Shared S3-compatible object storage utilities
Versioned cross-app contract between Testora and TasksAI — artifact-bundle, provision, webhook-event and green-light schemas plus HMAC signing helpers. No Next.js, database, auth, AI or browser dependency.
Shared light/dark theme toggle for all ASafariM apps — provider, no-flash script, and a token-styled toggle button.
TimelineAI's canonical, dependency-free timeline contract: date values that keep their stated precision, the heuristic date-phrase parser, deterministic ordering, temporal conflict detection, and the versioned event-import shape other apps hand to TimelineAI. Owned by TimelineAI; TimelineAI's Zod schemas validate it.
Versioned, dependency-free handoff envelope and destination payloads for moving reviewed AI Workbench results into Testora, TasksAI, and TimelineAI as a file the signed-in user imports and confirms. Includes the validator every destination runs before previewing.
ASafariM Platform design system: tokens, brand, and creative building blocks
Apps
Each one ships as its own container on every push to main. Open the live app or read its source.
@asafarim/admin
ASafariM Admin - internal admin panel (admin.asafarim.com)
@asafarim/appbuilder
ASafariM AppBuilder - metadata-driven AI application factory (appbuilder.asafarim.com)
@asafarim/hub
ASafariM Hub - logged-in user dashboard (hub.asafarim.com)
@asafarim/labs
ASafariM Labs - experimental workbench for what's being explored next (labs.asafarim.com)
@asafarim/resumatch
ResuMatch - AI-powered CV tailoring: paste a job URL, tailor your resume to it (resumatch.asafarim.com)
@asafarim/showcase
ASafariM Showcase - public demos and portfolio experiments (showcase.asafarim.com)
@asafarim/tasks-ai
TasksAI - AI-native work execution: scattered intent to trusted execution (tasks-ai.asafarim.com)
@asafarim/web
Public ASafariM Digital website (asafarim.com)
edumatch
testora
E2E test automation platform: define functional requirements, suites, fixtures and cases, run them with TestCafe, and store results in PostgreSQL.
timelineai
TimelineAI: create polished, visual timelines — project, historical, roadmap, Gantt, calendar, and interactive.
vionto
07 /Changelog
Recently shipped
- 2026-10-18EduMatch: redact PII and secrets before student text reaches AI providers
- 2026-10-18Resumatch: per-workspace AI monthly budget override
- 2026-10-18Resumatch: cross-provider AI fallback (OpenAI ↔ Anthropic)
- 2026-10-17Resumatch: record one outcome row per AI provider call (#512)
- 2026-10-17Resumatch: flag thin job-posting fetches with a quality signal
- 2026-10-17Resumatch: read JobPosting JSON-LD before the page text strip
- 2026-10-17Resumatch: report profile versions extracted by stale extractor code
- 2026-10-17Resumatch: tiered job fetch, deterministic first, AI only when it fails
- 2026-10-17Resumatch: short-TTL dedup cache for extraction and job-fetch
- 2026-10-17Resumatch: ground cover-letter prose against the profile and job text
- 2026-10-13Edge: read-only edge cutover check script (#839)
- 2026-10-12Igs: automatic staging deploy through a forced-command SSH key (#833)
- 2026-10-11Igs: nightly encrypted Postgres backups to S3 + restore drill (#829)
- 2026-10-11Igs: health check with Discord alerts on change (#828)
- 2026-10-11Infra: igs-pharma.be staging stack, edge site and igs-deploy.sh (#822)
- 2026-10-05Hub: resume cookie across sign-in, "Try again" for expired tickets, hand-off comments (Fixes #801, Fixes #802)
- 2026-10-04Hub: ASafariM OS sign-in hand-off + read-only accounts view (Refs #782, P2.2)
- 2026-10-04Infra: wire in the shared edge, no port change (Refs #770, #774 phase 2)
- 2026-10-03Infra: asafarim.site placeholder landing (#775)
- 2026-10-03Testora: serve the public pages on testora.cloud (#762, phase A)