XRAPH/Projects

Every system

One list, no curation. Everything public across /xraph and /juicycleff, plus the work that is still private.

Projects
37
Stars
5,776
Languages
5
Fields
6
01

Flagships

Most used
SaaS starter

Ultimate Backend

A multi-tenant SaaS starter on NestJS: microservices behind Apollo Federation, CQRS backed by EventStoreDB, tenant resolution, billing and authentication already wired to each other. I wrote it because I kept rebuilding the same first two weeks of every project, and it is still the repository most people know me from.

TypeScript2899
Engine embedding

Flutter Unity Widget

A Flutter widget that hosts a Unity player and passes messages both ways. It started as a weekend attempt to put a 3D configurator inside a Flutter app and became the package most people use for that. Six years and several thousand issues later, GameFramework is the rewrite.

Dart2305
AR demo

Flutter Unity ARKit

A working ARKit scene driven by Unity inside a Flutter app. Written mostly as a reply to the same question turning up in the widget’s issue tracker every week.

C#235
Event sourcing

NestJS Event Store

A NestJS CQRS module that speaks to EventStoreDB, with persistent subscriptions, catch-up subscriptions, and the plumbing that makes @nestjs/cqrs durable. Pulled out of Ultimate Backend once people started asking for only that part.

TypeScript205
Flutter × engines

GameFramework

The rewrite of Flutter Unity Widget, as a Dart workspace with one API and a plugin per engine. Unity works today; Unreal is in progress. Typed messaging in both directions, automatic pause, resume and destroy on Flutter lifecycle events, and builds for Android, iOS, macOS, Windows and Linux.

C#16
Auth engine

Authsome

Authentication for Go with every method as a plugin: password, social OAuth2, magic links, passkeys, TOTP and SMS second factors, API keys, SAML. Users, sessions, organizations, teams, RBAC and device tracking sit in the core; you compile in the methods you actually use. Ships with a dashboard.

Go7
Go framework

Forge

An opinionated Go framework: DI container, router, layered config, health checks, migrations and ordered shutdown, plus around twenty extensions you switch on when you need them: Postgres and Mongo, Kafka, MQTT, gRPC, GraphQL, WebRTC, Raft consensus, MCP. `forge init` scaffolds, `forge dev` hot-reloads. Everything else at xraph is built on it.

Go7
Data fabric

Fabriq

One write path for applications that outgrew a single database. A command commits state, a versioned event and an outbox row in the same Postgres transaction; a leader-elected relay publishes to Redis Streams; the graph (FalkorDB) and search (Elasticsearch) projections are rebuilt from that log rather than written to directly. Tenancy is structural, using row level security, a graph per tenant and index routing, rather than a WHERE clause you can forget.

Go1
Agent runtime

Cortex

An agent framework that describes an agent the way you would describe a colleague: what they can do, how they think, how they talk, what they notice, and what they habitually do when something happens. Runs, steps and tool calls are tracked end to end, checkpoints pause a run for human approval, and memory is scoped per agent per tenant.

Go0
API gateway

Octopus

A gateway in Rust that builds its own routing table. Services publish a FARP manifest carrying their OpenAPI, gRPC and GraphQL schemas; Octopus finds them over mDNS, Consul, Kubernetes or DNS and derives routes as instances appear and disappear. Static config works too, and the two modes run side by side.

Rust0
02

Open Source Ledger

By stars
01Ultimate BackendA multi-tenant SaaS starter on NestJS: microservices behind Apollo Federation, CQRS backed by EventStoreDB, tenant resolution, billing and authentication already wired to each other. I wrote it because I kept rebuilding the same first two weeks of every project, and it is still the repository most people know me from.TypeScript289902Flutter Unity WidgetA Flutter widget that hosts a Unity player and passes messages both ways. It started as a weekend attempt to put a 3D configurator inside a Flutter app and became the package most people use for that. Six years and several thousand issues later, GameFramework is the rewrite.Dart230503Flutter Unity ARKitA working ARKit scene driven by Unity inside a Flutter app. Written mostly as a reply to the same question turning up in the widget’s issue tracker every week.C#23504NestJS Event StoreA NestJS CQRS module that speaks to EventStoreDB, with persistent subscriptions, catch-up subscriptions, and the plumbing that makes @nestjs/cqrs durable. Pulled out of Ultimate Backend once people started asking for only that part.TypeScript20505Ultimate (Rust)A first attempt at a microservice framework in Rust. I stopped after about a year: the ergonomics I wanted needed language features that were not there yet, and the type signatures had stopped being readable by the people the framework was for.Rust3506NorthThe second attempt, with better instincts. North got the lifecycle model right and the ergonomics wrong. Both lessons went into Forge, which is why Forge’s startup is an inspectable graph rather than an init function.Rust1707GameFrameworkThe rewrite of Flutter Unity Widget, as a Dart workspace with one API and a plugin per engine. Unity works today; Unreal is in progress. Typed messaging in both directions, automatic pause, resume and destroy on Flutter lifecycle events, and builds for Android, iOS, macOS, Windows and Linux.C#1608Flutter Unity CLICommand-line tooling for teams running Unity and Flutter in the same repository: export the Unity project, sync it into the Flutter build, and keep the two in step across branches. The first draft of what became Game CLI.Dart809ForgeUIServer-rendered UI for Go, built on templ with a templui component set and Tailwind. Alpine and HTMX helpers where you need interactivity, an esbuild and Tailwind asset pipeline with fingerprinting, a Go-to-JavaScript RPC bridge, and about 1,600 Lucide icons. Bastion’s dashboard is written in it.Go810AuthsomeAuthentication for Go with every method as a plugin: password, social OAuth2, magic links, passkeys, TOTP and SMS second factors, API keys, SAML. Users, sessions, organizations, teams, RBAC and device tracking sit in the core; you compile in the methods you actually use. Ships with a dashboard.Go711ForgeAn opinionated Go framework: DI container, router, layered config, health checks, migrations and ordered shutdown, plus around twenty extensions you switch on when you need them: Postgres and Mongo, Kafka, MQTT, gRPC, GraphQL, WebRTC, Raft consensus, MCP. `forge init` scaffolds, `forge dev` hot-reloads. Everything else at xraph is built on it.Go712GuardianAn auth server in Rust covering OAuth, sessions, email templates and the usual set. A learning project that later shaped how Authsome splits authentication methods into plugins instead of configuration flags.Rust513FrankA standalone multi-tenant auth server with a three-tier user model: platform staff, the customer organizations they serve, and those organizations’ own end users. Written before Authsome, and largely the reason Authsome exists as a library instead of a service.TypeScript514SmartFormForms defined as data instead of code: 25-plus field types, conditional visibility and enablement, cascading options loaded from an API, and validation rules that can depend on other fields. A Go builder produces the definition, a React renderer consumes it.TypeScript515GroveAn ORM that emits each database’s own dialect instead of a lowest common denominator: DISTINCT ON and JSONB operators on Postgres, ON DUPLICATE KEY UPDATE on MySQL, BSON aggregation pipelines on Mongo, PREWHERE and SAMPLE on ClickHouse. On the insert benchmark it runs about 9% over raw database/sql, against 111% for Bun and 156% for GORM.Go416FARPThe manifest format Octopus and Bastion consume. A service describes its own API surface across OpenAPI, AsyncAPI, gRPC, GraphQL, oRPC, Thrift and Avro, along with health and capability hints, and publishes it through Consul, etcd, Kubernetes, Redis or mDNS. FARP is the spec and the Go library. It deliberately does no routing itself.Go417ShieldContent safety arranged in layers that can short-circuit, roughly the way people react to danger. Instincts catch injection and exfiltration in under 10ms. Awareness spots PII, topic and intent. Boundaries are hard deny lists. Values apply toxicity and brand rules, and judgment scores grounding and compliance last, because it is the expensive one.Go218LedgerUsage-based billing for SaaS: meter events in batches, check entitlements, price them with graduated, volume, flat or hybrid tiers, and generate invoices with taxes and discounts. Money is integer-only throughout. Entitlement checks are cached and sub-millisecond because they end up on the hot path of every request.Go219AI SDKOne Go client across providers, with the parts you end up writing anyway included: structured output through generics and JSON Schema, tool discovery from function signatures, multi-tier memory, budget tracking, circuit breakers and retries. Still alpha, so the API moves.Go120WeaveThe RAG pipeline as swappable parts, covering loaders, chunkers, embedders, vector stores and retrievers, with token-budgeted assembly and citations at the end. Postgres, SQLite or memory for metadata; pgvector or memory for vectors. Runs standalone or as a Forge extension with its own HTTP surface.Go121VaultSecrets, feature flags and runtime config in one library. AES-256-GCM at rest with a new version archived on every write, flags with tenant, user, percentage-rollout and schedule targeting, and config entries that fire Watch callbacks when they change. Rotation runs in the background with a per-key callback.Go122WardenRBAC, ABAC and Zanzibar-style relation tuples behind one Check call. Precedence is fixed and stated up front, explicit deny beating allow beating default deny, so you can layer a role model, attribute conditions and a relationship graph without guessing which one wins.Go123FabriqOne write path for applications that outgrew a single database. A command commits state, a versioned event and an outbox row in the same Postgres transaction; a leader-elected relay publishes to Redis Streams; the graph (FalkorDB) and search (Elasticsearch) projections are rebuilt from that log rather than written to directly. Tenancy is structural, using row level security, a graph per tenant and index routing, rather than a WHERE clause you can forget.Go124CtrlplaneProvisions and manages per-tenant instances on whatever you already run: Docker, Kubernetes, ECS or Fly. Rolling, blue-green and canary strategies, health checks over HTTP, TCP, gRPC or a command, custom domains and certificates, per-tenant quotas, and an audit trail of every action.Go125DispatchBackground jobs, durable workflows and leader-elected cron as a library you import rather than a service you operate. Workflow steps checkpoint, so a worker that dies mid-run resumes where it stopped instead of starting over. Exhausted retries land in a dead-letter queue you can inspect and replay.Go126SentinelEvaluation for LLM output: 22 scorers across eight scenario types, saved baselines so you can tell a prompt improvement from a regression, and five red-team generators that throw prompt injection, jailbreaks, PII extraction, hallucination bait and bias probes at your own system before someone else does.Go027NexusA gateway for LLM traffic that you compile into your own binary. Route across providers by cost, latency or priority; cache responses with optional semantic matching; redact PII and block prompt injection on the way through; enforce per-tenant budgets. It also exposes an OpenAI-compatible endpoint, so existing SDKs point at it unchanged.Go028CortexAn agent framework that describes an agent the way you would describe a colleague: what they can do, how they think, how they talk, what they notice, and what they habitually do when something happens. Runs, steps and tool calls are tracked end to end, checkpoints pause a run for human approval, and memory is scoped per agent per tenant.Go029ChronicleAn append-only audit log where every event carries the hash of the one before it, so an edit or a deletion breaks the chain and shows up in verification. Per-subject encryption means a GDPR erasure request destroys a key rather than a row, and the chain still verifies afterwards. Exports SOC 2, HIPAA and EU AI Act reports.Go030KeysmithAPI key lifecycle: create, validate, rotate with a grace window, revoke, suspend, and record per-request usage for analytics. The raw key is returned once at creation and never stored, since only its SHA-256 hash is kept, so a leaked database dump does not hand over live credentials.Go031TroveOne object-storage API across local disk, memory, S3, GCS, Azure and SFTP, with middleware you stack on the read and write paths for encryption, compression or virus scanning. Content-addressed storage with reference counting and GC, and an io/fs.FS view so a flat bucket reads like a directory tree.Go032VesselThe DI container underneath Forge, extracted so it can be used on its own. Generic type-safe resolution, uber/dig-style constructor injection, singleton, transient and request-scoped lifetimes, circular-dependency detection, and Start/Stop/Health on every registered service.Go033ConfyConfig loading that stays out of the way: files, environment variables, Consul and Kubernetes ConfigMaps, typed getters with defaults, struct binding with a `default` tag, and hot reload on file change. Auto-discovery walks up from a nested service directory until it finds the repo’s config, which matters in a monorepo.Go034SteelA Go router with typed handlers. Declare the request struct and you get path, query and body binding, validation, and an OpenAPI 3 document generated from the same types. WebSocket and SSE routes produce AsyncAPI. Forge’s router grew out of it.Go035RelayWebhook delivery as a library. Event types register at runtime with an optional JSON Schema, every delivery is signed with HMAC-SHA256, retries back off from five seconds to two hours, and anything that still fails waits in the DLQ until the customer fixes their endpoint and you replay it.Go036BastionThe same idea as Octopus, but as a Forge extension for teams who want the gateway inside their own Go process. HTTP, WebSocket, SSE and gRPC proxying, per-target circuit breakers, traffic splitting for canary and shadow releases, and an admin dashboard written in ForgeUI.Go037OctopusA gateway in Rust that builds its own routing table. Services publish a FARP manifest carrying their OpenAPI, gRPC and GraphQL schemas; Octopus finds them over mDNS, Consul, Kubernetes or DNS and derives routes as instances appear and disappear. Static config works too, and the two modes run side by side.Rust0