Nebutra-Sailor

Open-Source AI-Native SaaS Platform Baseline

Governed multi-tenant product infrastructure for AI gateways, billing, auth, compliance, and white-label delivery.

Website · Forge · Introduction · Tech Stack · Quick Start · Contributing

License at a glance — building a commercial product on this is free.
No fee, no licence key, no registration, no copyleft. Published npm packages
are MIT; this repository is FSL-1.1-ALv2, which permits every use
except selling a substitute for Sailor itself, and converts to Apache-2.0
two years after each release. Paid tiers sell support, SLAs, indemnity, and
trademark rights — never permission to use the software. See
License below, LICENSE-COMMERCIAL.md,
and docs/legal/licensing-faq.md.

Try it in 30 seconds — zero SaaS keys required:

npx create-sailor@latest my-app --preset=minimal --yes
cd my-app && pnpm dev   # → http://localhost:3000

The minimal preset scaffolds only apps/web + IAM + Postgres so the
golden path boots against a local DB. Add Creem / Clerk / Resend
later via nebutra add <provider>.

Introduction

Nebutra Sailor is an enterprise-grade, AI-native SaaS monorepo architecture designed for building governed multi-tenant platforms. It provides a practical baseline for AI gateways, agent workflows, billing, auth, compliance, and white-label product delivery.

Built with Next.js 16, React 19, Prisma 7, and the Vercel AI SDK, Sailor treats AI as a governed runtime surface: provider topology, model routing, observability, tenant isolation, and compliance hooks are part of the platform baseline.

Who's building this

Nebutra-Sailor is maintained by Wuxi Nebutra Intelligence Technology Co., Ltd. Day-to-day engineering lead is Tseka Luk (@tsekaluk · [email protected]). Building a commercial product on it is free for everyone, at any size — paid tiers sell support, SLAs, indemnity, and trademark rights rather than permission. See the License section.

We publish to npm under the @nebutra/* scope plus two CLIs (nebutra, create-sailor). Releases run through changesets on a manual workflow_dispatch gate; SBOMs are attested on every release (release.yml). Security reports → SECURITY.md; commercial / licensing inquiries → [email protected].

Brand Vision

Nebula • Nurture • Ultra • Future

• Nebula: Aggregate data, tools, and intelligence into usable products.
• Nurture: Incubate AI-native apps via automated toolchains and “digital employees.”
• Ultra: Ship reliable engineering and value-first outcomes.
• Future: Make AI productivity accessible to everyone.

About the Company

AI can help build the demo. Sailor focuses on the harder production layer: governance, security, architecture, scalability, and revenue operations.

Why Sailor?

For governed AI-native products: Sailor bridges the gap between "AI helped me build a demo" and "this is a product platform we can operate, audit, bill, and scale".

Highlights

AI‑native LLMs, vector search, MCP agents, and premium Nebutra UI chat interfaces.	Multi‑tenant by default Tenant context, RLS, scoped caching and rate limits baked in.	Enterprise‑ready Cloudflare WAF/R2, Inngest workflows, Sentry/Otel, Fly.io deployments.
Billing & Monetization Database-driven plans, Creem billing, usage metering, feature gates.	Security & Compliance RLS, WAF, Turnstile, GDPR/CCPA, cookie consent.	Marketing UI Kit Hero, Features, Pricing, Testimonials — conversion-optimized components.
Automated Governance Strict vitest.arch boundaries and semantic token linting.	Zero-Runtime CSS Pure CSS variables as SSOT. No CSS-in-JS runtime overhead.	Modular Local DX Docker Compose profiles (ai) to boot only what's needed.
Monetized MCP Registry Native Model Context Protocol with plan-based rate-limits & billing.	Distributed Saga Native TypeScript orchestrator with automatic transaction rollback.	Multi-Tenant Event Bus Tenant-isolated Pub/Sub supporting Fan-out & Request-Reply.
Unified Status Aggregation Concurrent checks across 9 services returning a standardized schema for OpenStatus & Atlassian.

Tech Stack

Frontend
UI / Design
Auth
BFF
Backend (Python)
Database
Cache / Rate-limit
Real-time
AI
Search
Queue
Storage / Uploads
Notifications
Webhooks
SMS (CN)
Payments
Email
CMS / Docs
Design Sync
CDN / Security
Workflows
Analytics
Observability
Build / Deploy

Platform Capabilities

Sailor is provider-agnostic: every platform package below auto-detects its backend from environment variables, so customers swap providers without changing application code. Each package ships an in-memory implementation for tests and a strict TypeScript contract enforced by architecture tests under tests/architecture/.

Project Structure

Nebutra-Sailor/
├── apps/                      # User-facing apps (Next.js)
│   ├── landing/      # Marketing site (nebutra.com)
│   ├── web/               # Main SaaS dashboard (app.nebutra.com)
│   ├── studio/            # Sanity CMS (studio.nebutra.com)
│   ├── sailor-docs/       # Public product docs (nebutra.com/docs)
│   ├── idp/               # Identity provider service (OAuth 2.0 / OIDC)
│   ├── storybook/         # Component playground
│   ├── mail-preview/      # Email template preview
│   ├── sleptons/          # Sleptons companion app
├── packages/                  # Shared TS libraries (categorized in W3b)
│   ├── ai/                # 42 pkgs — e.g. agents, agent-runtime, ai-providers, startup-os, knowledge-rag, mcp
│   ├── commerce/          # 9 pkgs — e.g. billing, metering, contracts, license, access-gate, waitlist
│   ├── design/            # 9 pkgs  — e.g. ui, tokens, design-tokens, brand, theme, icons, fonts
│   ├── iam/               # 8 pkgs — auth, audit, vault, oauth, permissions, tenant, identity, captcha
│   ├── integrations/      # 17 pkgs — e.g. queue, search, email, notifications, storage, webhooks, cache
│   ├── ops/               # 5 pkgs — cli, create-sailor, preset, sanity, china-compliance
│   └── platform/          # 21 pkgs — e.g. db, logger, repositories, rate-limit, feature-flags, i18n, status
├── backends/                  # No-UI backends (split by language à la vercel/vercel)
│   ├── gateway/               # TypeScript / Hono — BFF, auth, tenancy, routing
│   └── python/                # FastAPI — only when ML/batch/specialized libs justify
│       ├── _shared/           # Cross-service primitives (auth, db, queue client)
│       └── ai/                # LLM, embeddings, agent orchestration
├── infra/                     # Infrastructure (split by concern in W2.2)
│   ├── iac/                   # terraform + k8s + ecs + cloudflare + railway
│   ├── runtime/               # nginx + docker + analytics + compose files
│   ├── data/                  # database (RLS) + clickhouse (init + dbt)
│   └── ops/                   # observability + deployment scripts
├── ops/                       # Declared provider state per brand, checked daily by platform-reconcile
├── workflows/                 # Event-driven business workflows (extracted in W2.3)
│   ├── inngest/               # Serverless background jobs + cron
│   └── pusher/                # Real-time messaging glue
├── e2e/                       # Playwright E2E tests (smoke / golden / sleptons)
├── tests/                     # Architecture invariants + load tests + UI governance
└── docs/                      # Architecture documentation

Documentation

Each component has its own README with setup instructions and API documentation:

CLI & Website

Use the CLI from npm

For new projects, start from npm instead of cloning and pruning the full monorepo:

# Scaffold a new Sailor project
npx create-sailor@latest
npm create sailor@latest
pnpm create sailor@latest
bunx create-sailor@latest

# Operate an existing Sailor project
npx nebutra --help
npm install -g nebutra

nebutra.com

nebutra.com is the public product surface for Nebutra Sailor and the place where we dogfood the platform ourselves. We will use it to publish product updates, commercial licensing, hosted capabilities, launch workflows, and real examples built on this monorepo.

The public tool station lives at forge.nebutra.com — codecs, text, hashing, documents, and image tools, with the same implementations available over API / MCP.

Getting Started

Prerequisites

Quick Start

# Clone the repository
git clone https://github.com/Nebutra/Nebutra-Sailor.git
cd Nebutra-Sailor

# Install dependencies
pnpm install

# Set up environment variables
cp .env.example .env

# Generate Prisma client & run dev servers
pnpm db:generate && pnpm dev

Commands

White-label

Fork this repo and customize it for your own brand:

# Interactive setup wizard
pnpm brand:init

# Add your logos to brand.config/assets/

# Apply your branding
pnpm brand:apply

See WHITELABEL.md for full documentation.

Contributing

We love our contributors! Here's how you can help:

Development Workflow

1. Fork the repository
2. Create a feature branch (git checkout -b feat/amazing-feature)
3. Commit your changes (git commit -m 'feat: add amazing feature')
4. Push to the branch (git push origin feat/amazing-feature)
5. Open a Pull Request

Versioning & Release Cadence

Every published package is in the 0.x range while public APIs are still
settling. Per SemVer §4, the major-version-zero
contract means any 0.x release may include breaking changes — pin to an
exact version ("nebutra": "0.3.1") rather than a caret range in production
until we cut a 1.0.

• Versioning is driven by changesets. Each PR that touches a published package must include a .changeset/*.md declaring patch/minor/major intent — CI enforces this gate.
• Per-package CHANGELOG.md is generated by changeset version and committed alongside the version bump (see e.g. packages/ops/cli/CHANGELOG.md).
• The Release workflow is manual (workflow_dispatch) — no surprise releases on PR merges. We batch related changes and cut a coordinated release.
• Pre-1.0 major API moves (e.g. CLI command renames, package categorization) ship as a release candidate first: [email protected] lands on the next dist-tag, soaks for ≥ 1 week, then graduates to latest. Install RCs with npm i nebutra@next.
• npm publishes carry provenance attestations once npm trusted-publishing is enabled at the registry side (the workflow side is already wired — see release.yml NPM_CONFIG_PROVENANCE: "true"). Verify a published tarball with npm view <pkg> --json | jq .dist.attestations.

We will signal API stability by cutting a 1.0.0 release. Until then,
treat the surface as "production-ready in shape, evolving in detail."

License

Building a commercial product on Nebutra-Sailor is free. No fee, no
licence key, no registration, no revenue or headcount threshold, no copyleft.

The only thing the code licence does not permit is making Nebutra Sailor
available to others in a commercial product or service that substitutes for it.
Build products with it, don't sell it. That restriction expires: every
version becomes Apache-2.0 on its second anniversary, and the grant is made
irrevocably in advance.

Trademarks are separate — neither FSL nor Apache-2.0 grants them. Naming your
own product something unrelated needs no permission; using the Nebutra
name or white-labelling the platform needs a trademark licence
(TRADEMARK.md).

Paid tiers do not sell permission. They sell what a code licence cannot
give you: a support commitment, response SLAs, indemnification, compliance
paperwork (DPA, security pack, continuity undertaking), and trademark rights.
Community $0 · Team $2,000/yr · Enterprise from $30,000/yr — see
LICENSE-COMMERCIAL.md.

Copyright is held by Wuxi Nebutra Intelligence Technology Co., Ltd.

Previously AGPL-3.0-only with an Independent Developer tier and a $799/yr
Startup tier. Both retired on 2026-07-26; pre-existing grants are
irrevocable and unaffected. See
docs/legal/license-history.md.

Licensing questions: [email protected] ·
Licensing FAQ

Brand Assets & Trademarks

While the source code is open-source, the brand assets (the "Nebutra" name, "Nebutra Sailor", logos, icons, and illustrations) are protected trademarks of Wuxi Nebutra Intelligence Technology Co., Ltd.

You may not use our brand assets to endorse your own products or services. If you clone or fork this repository to build your own product, you must replace all Nebutra logos and branding with your own.

Please see our Trademark Policy and Brand Guidelines for more information.

Every release, growth goes live.

_{Made by Nebutra Intelligence · © 2024-present Wuxi Nebutra Intelligence Technology Co., Ltd.}

Website

X

Discord

Contact