infrastructureNewTier 1 · MIT / Apache 2.0
Launch a Clutch-style B2B directory in a weekend.
Full Next.js 15 directory SaaS with Stripe tiered submissions, Resend transactional emails, statically generated SEO pages with Schema.org markup, category-filtered browse UI, featured listing tier, and pre-seeded data. TypeScript + Tailwind.
- ✓Statically generated SEO pages with Schema.org JSON-LD
- ✓Stripe two-tier submissions ($49 standard / $99 featured)
- ✓Resend confirmation + owner notification emails
- ✓Category-filtered browse with search bar
- ✓Featured listing tier with star badge
- ✓Pre-seeded data (30 listings) to solve cold start
- ✓TypeScript + Tailwind + Next.js 15 source code
Tier 1 open-core — MIT or Apache 2.0. Community improvement flywheel; no proprietary pipeline logic included. Pipeline integrity protocol excluded (Tier 3).
infrastructuremonitoringTier 2 · BSL 1.1
Wire attestation, verifier SDK, and pipeline hash hooks.
Drop-in integration kit for Flomisma protocol integrity: verifier SDK wiring, attestation consumer, pipeline root hash hooks, and public verify page patterns. Pairs with Settlement Ledger and Relay.
- ✓Verifier SDK + BFF proxy patterns
- ✓Attestation consumer middleware
- ✓Pipeline hash hooks for CI/CD
- ✓Public /verifier integration examples
- ✓Built-with-Flomisma badge token on license issue
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructuremonitoringTier 2 · BSL 1.1
Hash-chain attestation, self-hosted signing, optional RFC 3161 timestamp anchor.
Self-hosted attestation toolkit: hash-chain integrity, HMAC signing and verification with your own secret key, and an optional RFC 3161 third-party timestamp anchor for buyers who want independent, third-party-backed proof of when a hash existed — stronger than self-signing alone. Runs entirely on your own infrastructure. One-time purchase, no hosted service, no per-entity or per-attestation billing.
- ✓Hash-chain construction and integrity verification
- ✓Self-hosted HMAC signing and verification
- ✓Optional RFC 3161 timestamp anchor (works with any compliant TSA)
- ✓CLI for verifying a chain from a JSON file
- ✓npm package + CLI, TypeScript source
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructureNewTier 2 · BSL 1.1
Tickets, replies, and self-service KB for B2B SaaS.
Support ticket queue with staff replies and searchable knowledge base articles. Uses @flomisma/approval-workflow-kernel for status transitions. Next.js + Prisma.
Integrates @flomisma/approval-workflow-kernel (https://github.com/flomisma/approval-workflow-kernel) — the repo is the status FSM; this template adds tickets, KB, and Prisma persistence.
- ✓SupportTicket + TicketReply + KnowledgeBaseArticle Prisma models
- ✓Create ticket, reply, list, and KB search services
- ✓Approval workflow integration for ticket status
- ✓Tenant-scoped isolation pattern
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructureNewTier 2 · BSL 1.1
Consent logging and data-subject request queue.
GDPR consent records plus data-subject request queue with admin approve/deny. Built on @flomisma/gdpr-primitives. Pattern reference: Worksuite GDPR module (greenfield).
Integrates @flomisma/gdpr-primitives (https://github.com/flomisma/gdpr-primitives) — the repo is types and validators; this template adds consent logging and admin compliance queue.
- ✓ConsentRecord + DataSubjectRequest models
- ✓Public consent capture and removal request submission
- ✓Admin compliance queue with approve/deny
- ✓@flomisma/gdpr-primitives validators
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
financeinfrastructureNewTier 2 · BSL 1.1
Public estimate/proposal accept, decline, and e-sign.
Hash-based public URLs for estimates and proposals: view → accept/decline → signature audit trail. Uses @flomisma/public-link-token and @flomisma/e-sign-primitives.
Integrates @flomisma/public-link-token and @flomisma/e-sign-primitives (https://github.com/flomisma/public-link-token, https://github.com/flomisma/e-sign-primitives) — repos are token and signature utilities; this template adds document flow and UI.
- ✓AcceptanceDocument model with public hash URLs
- ✓Accept, decline, and e-sign audit hash flow
- ✓Document content SHA-256 binding
- ✓Signature pad integration pattern
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructureNewTier 2 · BSL 1.1
Lead capture and ticket forms with webhook dispatch.
Embeddable public lead and support ticket forms with GDPR consent and outbound webhooks. Uses @flomisma/form-schemas for validation.
Integrates @flomisma/form-schemas (https://github.com/flomisma/form-schemas) — the repo is Zod validators; this template adds form persistence and webhook dispatch.
- ✓EmbeddableForm + FormSubmission models
- ✓Lead and ticket form handlers
- ✓Webhook dispatch on submission
- ✓Zod validation via @flomisma/form-schemas
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructurefinanceNewTier 2 · BSL 1.1
Client-facing document and status portal.
Client portal with hash-based access keys for viewing documents and status. Complements Settlement & Ledger Starter for client-facing UX.
Integrates @flomisma/public-link-token (https://github.com/flomisma/public-link-token) — the repo is HMAC token utilities; this template adds client portal models and access-key auth.
- ✓PortalClient + PortalDocument models
- ✓Access-key based client authentication
- ✓Document listing and public hash URLs
- ✓@flomisma/public-link-token integration
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
aifinanceNewTier 2 · BSL 1.1
Non-custodial per-agent wallets with spend rules and audit trails.
Non-custodial agent wallet system — per-agent USDC wallets with configurable spend rules, scoped rule overrides, hash-chained audit trail, and zero-downtime key rotation. Includes escrow-funding and settlement-payout integration hooks plus a human-in-the-loop override flow for transfers that exceed policy.
- ✓Per-agent wallet creation with configurable spend rules
- ✓Scoped rule overrides with expiry pruning
- ✓Hash-chained audit trail with chain verification
- ✓Zero-downtime wallet key rotation
- ✓Escrow-funding and settlement-payout integration hooks
- ✓Human-in-the-loop override flow for policy-exceeding transfers
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
monitoringinfrastructureNewTier 2 · BSL 1.1
Self-hosted DNS, SSL, and header posture scanning with Merkle-rooted proofs.
Self-hosted infrastructure posture scanner — DNS configuration (SPF/DKIM/DMARC/DNSSEC), SSL/TLS certificate health, and HTTP security header scoring, combined into a single Merkle-rooted posture snapshot you can run on your own schedule instead of relying on a hosted scan.
- ✓DNS posture scoring (SPF, DKIM, DMARC, DNSSEC)
- ✓SSL/TLS certificate validity and configuration checks
- ✓HTTP security header scoring (CSP, HSTS, X-Frame-Options, Permissions-Policy)
- ✓Combined Merkle-rooted posture snapshot
- ✓Runs on your own schedule — no hosted dependency
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
financeNewTier 2 · BSL 1.1
Invoice condition verification, dispute routing, and 18dp reconciliation.
Invoice lifecycle engine for bank and B2B invoice workflows: condition verification against reported data, partial-payment tracking, dispute routing, counterparty risk screening, and multi-party reconciliation at ISO 20022 precision (18 decimal places). Built on @flomisma/invoice-primitives (MIT) for the underlying ledger schema.
- ✓Invoice condition verification against reported data
- ✓Partial-payment tracking
- ✓Dispute routing
- ✓Counterparty risk screening
- ✓Multi-party reconciliation at 18-decimal precision
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructureNewTier 2 · BSL 1.1
Tamper-evident encrypted secret storage with hash-chained access logs.
Self-hosted encrypted secret storage — per-tenant key derivation (KEK/DEK), envelope encryption for secrets, and a hash-chained, independently verifiable access log so every read is auditable after the fact.
- ✓Per-tenant KEK/DEK key derivation
- ✓Envelope encryption for stored secrets
- ✓Hash-chained access log with chain verification
- ✓HTTP client for integrating with an existing backend
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
financeTier 2 · BSL 1.1
Double-entry ledger, escrow, and audit trail. Production-ready.
Immutable double-entry ledger with escrow workflows, batch settlement, audit trail, and reconciliation. Prisma + Postgres. Drop into any Next.js app. Includes SOC2-adjacent compliance helpers, USD fiat settlement workflows, and integrity snapshots for audit evidence.
Integrates @flomisma/ledger-core, @flomisma/reconciliation, and @flomisma/escrow-state-machine — the repos are primitives; this template adds models, APIs, and UI.
- ✓Double-entry LedgerEntry model
- ✓Escrow lock / release / dispute flow
- ✓Batch settlement with atomic transactions
- ✓USD fiat settlement fee preview and batch settlement
- ✓Redacted audit logger with request context
- ✓SOC2 integrity snapshots (input/output hash)
- ✓Proof-of-reserves stubs
- ✓Invoice generation with React-PDF
- ✓Multi-party ledger reconciliation via @flomisma/reconciliation
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
relayinfrastructureTier 1 · MIT / Apache 2.0
WebSocket relay that never touches disk. Stateless by design.
The complete relay service from apps/relay/ — standalone, documented, and ready to deploy. Includes quota manager, room manager, API key rotation with zero-downtime grace slots, and metrics server. ESLint rules, strace CI, and readonlyRootFS config enforce zero persistence.
- ✓In-memory quota enforcement by tier
- ✓Tenant-isolated room namespacing
- ✓HMAC API key issuance and rotation (2-slot)
- ✓Metrics HTTP server (internal)
- ✓ESLint rules enforcing zero-persistence
- ✓Dockerfile with healthcheck + non-root
- ✓Stress tests (10k connections, 1k rooms)
Tier 1 open-core — MIT or Apache 2.0. Community improvement flywheel; no proprietary pipeline logic included. Pipeline integrity protocol excluded (Tier 3).
infrastructureTier 2 · BSL 1.1
Multi-tenant architecture foundation. You bring your own billing.
Architecture foundation for a multi-tenant Next.js 15 SaaS. Includes Supabase auth, Prisma, Row-Level Security, per-tenant branding, and admin dashboard. No Stripe or deployment script included — bring your own payment stack. The foundation that took 6 months of sprints to build — yours in one purchase.
- ✓Tenant isolation via Postgres RLS
- ✓Host-based and slug-based tenant routing
- ✓Supabase auth with per-tenant sessions
- ✓Admin dashboard with health monitoring
- ✓Per-tenant branding and custom domains
- ✓Does NOT include Stripe billing or deployment automation
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
aiTier 2 · BSL 1.1
Claude-powered brief parsing and provider matching
Natural language concierge that parses client briefs, matches providers via AI semantic matching, and orchestrates booking packages. Extracted from a production marketplace — works for any vertical.
- ✓Anthropic Claude-powered intent parsing from free-text briefs
- ✓Provider scoring and package assembly
- ✓Email and SMS notification orchestration
- ✓Human review guardrails above configurable thresholds
- ✓Vertical-agnostic — customize for any marketplace
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructureTier 2 · BSL 1.1
HMAC-signed verifiable credentials with SVG badges
Cryptographically signed credential verification system. Generates public credential JSON endpoints and tamper-proof SVG badge images. Verifiable without a central database — signature is the proof.
- ✓HMAC-SHA256 signed credential payloads
- ✓Public JSON + SVG badge endpoints per credential
- ✓Tamper-evident — signature verification without DB lookup
- ✓Provider profile embedding with metadata
- ✓Ideal for professional marketplaces and certification platforms
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
monitoringinfrastructureTier 2 · BSL 1.1
SLA monitoring, rate limiting, and incident detection
Production-grade automation infrastructure: SLA uptime monitoring with status escalation, token-bucket rate limiting per endpoint, security incident detection and logging, and health metrics collection. Grab-and-go for any marketplace backend.
- ✓SLA monitor with configurable thresholds and auto-escalation
- ✓Rate limiter with Redis-compatible token bucket
- ✓Security incident detection and audit trail capture
- ✓Health metrics aggregation with Prometheus-compatible output
- ✓Automation job scheduling with cron orchestration
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
aiinfrastructureTier 2 · BSL 1.1
Model Context Protocol for LLM tool execution
Expose your platform to AI agents via the Model Context Protocol (MCP). Includes agent-key authentication, typed tool definitions, and recommendation engine. Agents discover and invoke your APIs as tools — no custom integration code needed.
- ✓MCP-standard tool definitions with typed schemas
- ✓Agent-key authentication with least-privilege tenant scoping
- ✓Recommendation engine integration example
- ✓Next.js-native — deploy as API route
- ✓Future-proof for the AI agent ecosystem
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
financeaiTier 2 · BSL 1.1
7-factor risk scoring. Block HIGH/CRITICAL agents pre-transaction.
Real-time agent risk assessment for AI marketplace governance. Evaluates 7 factors — dispute rate, slash rate, cancel rate, audit failure rate, SLA breach rate, governance alert rate, and arbitration favorability — producing a 0–100 composite score mapped to 5 risk bands (LOW, MODERATE, ELEVATED, HIGH, CRITICAL). Includes immutable evidence log, SOC2-ready risk snapshots, and pre-transaction blocking. Drop into any Next.js + Prisma escrow marketplace.
Integrates @flomisma/agent-risk-scorer — the repo is the scoring primitive; this template adds persistence, admin dashboard, and marketplace hooks.
- ✓7-factor composite risk scoring engine
- ✓5 risk bands with configurable thresholds
- ✓Immutable EvalEvidence event log with idempotency
- ✓Pre-transaction HIGH/CRITICAL agent blocking
- ✓SOC2-ready risk score snapshots for audit
- ✓Admin risk dashboard with per-agent drill-down
- ✓Vercel Cron hourly recomputation
- ✓5-line integration into arbitration-service.ts
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).
infrastructureTier 2 · BSL 1.1
Same architecture + Stripe billing + one-command deploy.
Everything in the Multi-Tenant SaaS Starter, plus Stripe checkout and webhooks, subscription management, custom domain setup, and a one-command deployment script. Deploy a production-ready B2B SaaS in 10 minutes — not 6 months.
- ✓Everything in the Multi-Tenant SaaS Starter
- ✓Stripe checkout, webhooks, and subscription management
- ✓One-command deployment script
- ✓Custom domain and SSL setup
- ✓Per-tenant branded email templates
License: Business Source License (BSL 1.1) — non-commercial use free; commercial use requires a Flomisma license. Converts to Apache 2.0 after 4 years. Pipeline integrity protocol excluded (Tier 3).