Primebrick v3 is an open-source framework that defines infrastructure, architecture, and coding rules according to best practices. MIT license: use it in commercial projects, no strings attached.
Everything is an entity — not just your domain models, but settings, configurations, and metadata too. Define your entities, and Primebrick handles the rest: database migrations, API endpoints, RBAC, backoffice UI, tests — all generated following your conventions.
Your infrastructure, your rules. No vendor lock-in: Primebrick runs identically from your laptop to the enterprise datacenter, from K8s cluster to the public cloud closest to your users.
Primebrick AI Chat is integrated into the backoffice, not bolted on. The LLM runs as a local container, the knowledge base lives in your PostgreSQL®, and conversations stay in your database. Zero cloud LLM calls by default — privacy is the default, not an option.
AI chat lives inside your backoffice. Prompts, responses, and conversations never leave your infrastructure. The LLM runs as a local container — zero cloud calls by default.
Default model: Qwen3™-4B-Instruct-2507, licensed under Apache 2.0. Runs on CPU with ~2.5GB RAM. No GPU required, no commercial licenses, no vendor lock-in.
The runtime exposes an OpenAI®-compatible API. Swap to OpenAI®, Anthropic™, Zhipu™ GLM™, DeepSeek™, Groq™, or any compatible provider by changing one config key. Your code stays the same.
All-Apache-2.0 stack (mistral.rs™, Qwen3™, Vercel AI SDK™, pgvector™). Air-gapped deployment supported. GDPR-aligned: no data transfer to third-party LLM providers. Suitable for regulated industries.
No data leaves your infrastructure. Default configuration runs 100% on-premise. Cloud LLM is optional and opt-in — you explicitly configure it if you want it.
Primebrick supports the full spectrum of development workflows. Use your IDE of choice for deep, hands-on coding. Or let AI agents build features directly from the web app — no local environment needed.
In-browser AI agents
Describe what you want, approve the plan, and AI agents build it directly in the web app. No local setup, no environment config. From idea to deployed feature without leaving the browser.
VS Code, Cursor, Windsurf
Clone, run locally, debug with breakpoints, full control. The traditional developer experience with all the framework conventions enforced by tooling.
Primebrick is opinionated about architecture but design-free about UI. Use any component library — vanilla HTML, Svelte™, or our own Primebrick UI Library. The micro-frontend architecture lets you build any page with any component, while the framework enforces best practices.
Settings, configurations, metadata — all entities. The same CRUD, RBAC, and validation patterns apply everywhere.
Best practices enforced by the framework. But you choose the UI: vanilla HTML, Svelte™, or our Primebrick UI Library.
Our own component library with best practices built in. Use it directly or as a reference for your own components.
Like microservices, but for the frontend. Each page is independent, deployable, and can use different component stacks.
Every backoffice starts well and ends in chaos. Primebrick v3 flips the perspective: we start from best practices and enforce them through the framework.
K8s manifests, Helm™ charts, Terraform® templates ready for staging and production.
Clean separation between domain, application, infrastructure, and UI. Testable by construction.
Linting, strict types, mandatory patterns: technical debt is prevented, not paid later.
OpenTelemetry, structured logging, health-checks integrated from the first commit.
We made the hard decisions once, so your teams don't make them every sprint. Every brick is tested, integrated, and documented.
/ AUTHOIDC, role management, granular schema-level permissions.
/ DATAPostgreSQL®: DB server AND vector server for generative AI. Soft-delete, audit fields, bulk operations.
/ UICRUD, tables, forms, filters generated from domain schemas.
/ OBSOpenTelemetry integrated, tracing, metrics, correlated logs.
/ MULTILogical and physical isolation for thousands of organizations.
/ SDKTypeScript® clients generated from endpoints, end-to-end type safety.
Every Primebrick module is a self-contained brick that follows the same shared standards. Start with the built-in bricks, then ship your own billing or inventory brick using the exact same pattern. The SDK and DAL do the heavy lifting; your module only declares its schema and its typed config.
ConfigEntityBase, ConfigLoader<TResult>, entity CRUD path conventions, OpenAPI meta — every brick inherits the same building blocks.
Each module owns its own PostgreSQL® schema (auth, emailsender, billing…). No cross-module coupling at the data layer.
Modules expose /meta + /openapi.json. The BE proxy, the FE ConfigTable, and the MCP™ server all discover capabilities dynamically — no hard-coding.
A new module is one or more domain entity, one config table, one route file, one FE route. The reusable ConfigTable component renders its settings page automatically.
Primebrick uses PostgreSQL® not just as a database, but as a vector server for generative AI. No separate vector database to manage. More database support coming soon.
See who’s editing in real time. When a colleague saves, their changes merge into your form silently — field by field, never the whole entity. If you both touched the same field, you pick which value wins. No refresh, no lost work, always in sync.
See who is reading or editing the same record. Avatars show the field being edited and the value in progress, in real time.
When a colleague saves, their changes merge into your form field by field. Untouched fields update silently with a transient green badge. No full-page reload.
Both editing the same field? The conflict panel shows your value, their value, and the original — side by side. Pick which wins, field by field.
State-of-the-art optimistic concurrency built in. No more silent overwrites, no more lost data — just safe, conflict-free saves.
Primebrick scales from a single-container laptop setup to enterprise datacenters behind a load balancer. Thanks to Redis®, no matter how the infrastructure scales up or down, every piece stays in sync — cache invalidation, session state, and cross-instance coordination all flow through one reliable backbone.
Mark any entity with @Cached(ttl) and hot single-row reads go to Redis® first. Omit the TTL for immutable data; pick a TTL that bounds staleness for mutable data. Zero DAL coupling — the cache lives entirely in the SDK.
Redis® keeps every instance on the same page. Writes go to PostgreSQL® first, then invalidate the cache. Reads always hit fresh data — no stale entries, no race conditions, no surprises.
Redis® is the shared cache. Pod #1 invalidates a key, pod #2 sees the miss and re-hydrates from PostgreSQL®. No NATS™ broadcaster needed. Scale the BE horizontally behind any LB — Docker®, K8s, Swarm, Azure® Container Apps, Cloud Run.
Redis® is the only cache implementation shipped today, but the CachePort interface is open. Implement your own cache port for Memcached™, DragonflyDB™, or any KV store — no SDK changes needed.
From browser to database — clear ports, protocols, and data flow. Dockerized for local dev, Terraform®-ready for production.
Docs are written as MDX in each repo, synced by CI, embedded locally with Transformers.js™, and stored in pgvector™. The AI microservice retrieves context and sends prompts to a separate LLM container — no cloud calls by default.
Frontend, Backend, Microservices, Libraries, Data — each layer has a clear responsibility and communicates through defined protocols.
SvelteKit™ Admin UI — communicates only with the Backend API
Express® API — Auth, RBAC, Service Registry, Proxy
Independent Docker® services — self-register via NATS™
@primebrick/sdk + @primebrick/dal-pg — shared across all services
PostgreSQL® — single data store, accessed via DAL
Primebrick is built accessibility-first. Automated WCAG 2.x + ARIA auditing runs on every route via axe-core. A downloadable VPAT 2.5 INT conformance report covers WCAG 2.0/2.1/2.2 (A/AA/AAA), Section 508, and EN 301 549 — so your compliance team has real evidence, not marketing claims.
Automated axe-core scans on every route, every build. Level A, AA, and AAA success criteria tested continuously.
Downloadable Voluntary Product Accessibility Template covering WCAG, Section 508, and EN 301 549. Generated from real scan data.
Full ARIA roles, states, and properties validated. Screen-reader-compatible components out of the box.
US Section 508 (Chapters 3–6) and EU EN 301 549 (Clauses 4–13) covered in the INT edition report.
Primebrick enforces modern authentication best practices. Passkey support via WebAuthn means users authenticate with Windows Hello™, Face ID™, or Touch ID™ — no passwords to phish, no OTP codes to intercept. Multi-factor authentication is integrated at the identity layer, not added as an afterthought.
FIDO2/WebAuthn passkey authentication. Phishing-resistant by design — no shared secrets, no replay attacks.
Biometric and PIN authentication on Windows 10/11 via Windows Hello™. No password required.
Biometric authentication on macOS and iOS via Face ID™ and Touch ID™. Seamless, secure, native.
Multi-factor authentication enforced at the identity provider (Casdoor™/OIDC). TOTP, hardware keys, and passkeys supported.
Primebrick enforces a strict security posture: every critical action — changing a user password, modifying RBAC permissions, altering security settings — requires an in-app security guard with admin re-login and MFA verification. No session reuse, no silent elevation. This follows NIST SP 800-63B step-up authentication and OWASP ASVS V3.4 session management requirements.
Critical actions trigger an in-app modal requiring admin credentials + MFA. No action proceeds without fresh verification.
Following NIST SP 800-63B: sensitive operations require a fresh authentication event, not just an existing session.
Existing JWT/session tokens are insufficient for critical actions. A new MFA challenge is always required.
Meets OWASP Application Security Verification Standard V3.4 (session management for high-value transactions).
An automated compliance scanner reads the Primebrick source code on every build and maps security controls to ISO 27001 Annex A, NIS2 Article 21(2), and OWASP Top 10 — with file:line evidence for each control. No manual questionnaires, no self-assessment spreadsheets. Download the full report as PDF and see exactly what is compliant, what is partial, and where the evidence lives.
17 controls mapped to Annex A (A.5, A.6, A.8) with evidence: RBAC, audit trail, encryption, access control, and more.
All 10 mandatory security measures covered: incident management, business continuity, supply chain security, cryptography.
Injection, auth failures, cryptographic failures, misconfiguration — mapped to actual code patterns with evidence.
Full compliance report generated as PDF on every build. Hand it to your auditors, compliance team, or security reviewers.
Primebrick implements GDPR and CCPA requirements at the code level: multi-tenant data isolation, soft-delete with recovery, audit trails for Article 30 records, data minimization via field-level access control. The automated scanner verifies these controls against the actual source code and produces a compliance report you can download.
Security of processing: encryption in transit, multi-tenant isolation, audit trails. Verified by code pattern scanning.
Right to erasure: soft-delete with deleted_at column and restore capability. Data is recoverable, not destroyed.
Consumer data protection: access controls, audit trails, and data minimization mapped to California Consumer Privacy Act.
Automated audit trail logging satisfies GDPR Article 30 record-of-processing requirements. Every CRUD operation is logged.
Clear structure, objective coding rules, DX designed for speed. Clone, run, and you're already in a best-practice environment — CI/CD, linting, types, tests, observability all ready.
MIT license, open and inspectable code, deploy where you decide. Reduce time-to-market and technical debt from minute zero. No vendor lock-in, no contractual surprises.
Primebrick v3 is released under the MIT license: you can use, modify, redistribute, and integrate it in commercial products without royalties. Code is public on GitHub®, design decisions are documented, contributions are welcome.
Clone the repo, follow the quick-start, and you're in production with an architecture your future developers will thank you for choosing.