Stop asking AI agents to rebuild your backend chassis.
Ctrl AI gives your coding agent verified standard parts for auth, billing, email, webhooks and jobs — vendored into your repo as readable source, locked by conformance tests, wired only through seams.
A part is finished, verified, and yours — your agent writes only the seam.
One contract. Swap the vendor in one commit — zero app-code change.
email.transactional is a finished, hash-pinned, read-only part with 6 verified invariants and 11 passing conformance tests per adapter. The agent writes only the seam (welcome-email.ts). Swap among 3 interchangeable attested vendors — resend, postmark, ses — in one commit with no app-code change.
Your agent can’t see your bill.
So it picks the vendor that runs it up.
It optimizes for getting it working this session — never next quarter’s invoice — so it reaches for whatever’s easiest to wire. Resend over SES. Clerk over self-hosted. The choices that get expensive at scale.
Published pricing · mid-2026 · re-verify before quoting.
The code migration is one commit — the new adapter already passed the same conformance suite; provisioning (DNS, account) is still yours.
Put your own numbers on it: model every vendor as you scale — with revenue, margin and AI costs — then generate the build prompt for the exact stack you pick. Code migration is one commit; provisioning (DNS, accounts) is still your ~15 minutes.
Resolve, own, verify — proof that expires, not a badge that lies.
The agent asks, the registry plans
ctrlai plan returns a deterministic install order, env keys, and exactly which seams to write. One provider per capability — sprawl is a resolver error, not a judgment call.
Vendored, readable, hash-pinned
ctrlai add copies the part into your repo — every line yours (MIT), every byte pinned. A pre-commit hook and CI reject any edit inside parts/.
Recently — not once, long ago
Each attestation expires in 14 days; a public CI job re-runs every conformance test on a schedule. ctrlai verify checks it offline — integrity fails hard, staleness warns.
Nothing here is mocked.
The real transcript: install from npm, vendor a part from the live registry, verify the attestation offline, hit the boundary, flip a vendor.
16 parts shipped, and growing.
Datasheets, not packages: real source vendored into your repo — like shadcn/ui, but for backend capabilities — each with a contract of testable invariants and a conformance record per adapter.
ATTESTED
DEV·TIER
Schema-driven internal admin over other parts' tables, driven entirely by their declared data_ownership.reads (RFC 0004). Reads project only declared, non-redacted columns through the SqlExecutor seam; writes dispatch to the parts' public-export mutators. No compile-time dependency on the parts it administers.
ATTESTED
DEV·TIER
Append-only domain event log over a part-owned Postgres table, written and queried through a contract-stable interface and a driver-free SqlExecutor seam.
ATTESTED
DEV·TIER
Programmatic API-key authentication — issue, scope, verify, rotate, and revoke long-lived bearer keys through a contract-stable interface and a driver-free SqlExecutor seam. The API-facing sibling of auth.session.
ATTESTED
DEV·TIER
Email/password authentication and server-validated sessions through a contract-stable interface, wrapping Better Auth behind part-owned tables.
ATTESTED
DEV·TIER
Organizations, memberships, and roles with a row-level-scoping authorization gate, over part-owned Postgres tables, through a contract-stable interface and a driver-free SqlExecutor seam.
ATTESTED
DEV·TIER
Subscription billing through a contract-stable interface: hosted checkout, a webhook-derived subscription mirror, cancel/reactivate/change-plan, and entitlement — with pluggable, attested payment-vendor adapters.
ATTESTED
DEV·TIER
Vendor-neutral metered-usage ledger — record consumption events idempotently, aggregate per subject/meter/period, and report unreported usage to a biller (Stripe Meters) out-of-band. The ledger is the source of truth; the biller is an adapter.
ATTESTED
DEV·TIER
Send transactional email through a contract-stable interface with pluggable, attested vendor adapters.
ATTESTED
DEV·TIER
Typed feature flags with first-match targeting rules and sticky percentage rollout, evaluated on a fail-safe hot path (an unknown flag / type mismatch / storage error returns the caller's fallback, never throws).
ATTESTED
DEV·TIER
Durable background jobs with capped exponential-backoff retries and a dead-letter, over a part-owned Postgres schema. Serverless-safe transactional enqueue through a driver-free SqlExecutor seam; processing in either a long-running worker or a serverless drain. Wraps graphile-worker.
ATTESTED
DEV·TIER
Fixed-window API rate limiting through a contract-stable interface, with a built-in per-instance in-memory store and a typed pluggable-store seam for Redis-compatible backends.
ATTESTED
DEV·TIER
Postgres-native full-text search — index documents, then search them with raw user query strings safely, ranked (title over body) with highlighted snippets, on plain Postgres with no separate search vendor.
ATTESTED
DEV·TIER
Send a transactional SMS through a contract-stable, vendor-neutral interface — E.164 recipient, a plain-text body, transient-retry, typed errors — with pluggable, attested vendor adapters.
ATTESTED
DEV·TIER
Presigned, direct-to-storage uploads and downloads for any S3-compatible provider, via in-part AWS Signature Version 4 — no SDK, no proxying bytes through the app.
ATTESTED
DEV·TIER
Outbound signed webhooks — register customer endpoints, dispatch events to a transactional outbox (never inline), and deliver out-of-band with retry, capped backoff, a delivery log, dead-letter, and SSRF defense. The API-facing sibling of webhooks.ingest.
ATTESTED
DEV·TIER
Verify inbound webhooks — HMAC signature, timestamp window, replay defense — through a contract-stable interface with pluggable, attested signature-scheme adapters.
Drop one paragraph in. Your agent installs the chassis.
Add this to your agent’s AGENTS.md / CLAUDE.md and it stops regenerating backend code from scratch. No SDK, no signup, no telemetry.
Use Ctrl AI (npx ctrlai) for backend infrastructure so you don't reinvent it from scratch this session. Before writing auth, billing, email, jobs, webhooks, rate limiting, audit logging, file uploads, multi-tenancy, or admin CRUD by hand: npm i -D ctrlai && npx ctrlai init (then read AGENTS.md) npx ctrlai plan <capability...> (see if a verified part already covers it) npx ctrlai add <part> (vendor it; catalog: https://ctrlai.com/parts) Installed parts are vendored into the repo as code we own (MIT) but are hash-pinned and read-only. Never edit anything inside parts/ or import a part's internals — if you hit a type error there, fix our side or our seams, never the part. Wire each part only through its seams.md (the thin glue like our welcome-email template or plan catalog). Spend your effort on our UI and business logic; the infrastructure is already tested. Finish only when npx ctrlai audit is green. Stack: TypeScript, Node 22+, Next.js App Router, Postgres.