Open source · Stamping model · Zero runtime dependency

Installcompletefeatures.Own every line.

Codegen so smort it feels like AI.

Sedim stamps full-stack modules: frontend, backend, schema, and UI, directly into src/sedim/. You own every file. Zero runtime dependency after stamping.

$ npm i -g @sedim/cli

Read the docs

sedim - zsh

How sedim differs

Same problem space. Different model.

Runtime SDKs, headless libraries, UI kits, and AI codegen each solve part of the puzzle. Sedim targets the full vertical slice: backend, schema, and UI, as owned, editable code.

Approach	Examples	Ownership	Customization	Runtime lock-in
Runtime SDK	Clerk, Auth0, Supabase Auth	Vendor owns runtime	API surface only	High
Headless library	Better Auth, NextAuth	You configure it	Deep, but you wire everything	Medium
Copy-paste UI	shadcn/ui blocks	You own components	UI only, no backend	Low
AI codegen	Cursor, Claude, Copilot	You own output	Varies every run	Low
Sedim stamp model	sedim add auth	You own every file	Full - edit locally forever	None at runtime

The stamp model

The 80% is repetitive. Ship the 20%.

Standardized, secure boilerplate for full-stack features, stamped into your project, not imported at runtime.

Boilerplate, not an SDK

Treat Sedim as standardized implementation code you copy into your repo - not a dependency you call at runtime. Learn the patterns from docs, stamp them when needed, customize locally.

Framework & DB agnostic

Next.js full-stack, or Express/Hono with React/Vue. Drizzle or Prisma. PostgreSQL, MySQL, SQLite. The Detector adapts - no greenfield required.

Endless customization

Files land under src/sedim/. Edit, test, push. No vendor lock-in, no black box. The code you own is the best code - and AI agents skip straight to customization without wasting tokens on grunt work.

Proof, not promises

See the plan. Read the code.

Showbaby previews every file, dependency, and conflict before writing. What lands in your repo is production-grade source, not a runtime SDK.

Showbaby · plan preview

Plan - auth

+CREATE src/sedim/auth/core/session.ts

+CREATE src/sedim/auth/adapters/framework/operations.ts

+CREATE src/app/api/auth/[...all]/route.ts

→INSTALL argon2, @oslojs/crypto, jose

●ENV AUTH_SECRET - random 32+ char secret

●ENV GOOGLE_CLIENT_ID - OAuth client ID

!CONFLICT schema (users) - needs-migration: email_verified

12 files · 3 deps · 2 env groups · 1 partial conflict

What gets stampedsedim add auth

src/sedim/auth/
├── core/
│   ├── hash-password.ts      # Argon2id (OWASP params)
│   ├── session.ts            # sliding-window sessions
│   ├── pkce.ts               # RFC 7636 S256 only
│   ├── totp.ts               # RFC 6238 + encrypted secrets
│   ├── jwt.ts                # hybrid JWT + refresh tokens
│   └── rbac.ts               # role middleware factories
├── adapters/
│   ├── drizzle.ts            # your ORM adapter
│   └── framework/nextjs.ts   # route handler factory
├── ui/tailwind/              # or headless / themed
│   ├── LoginForm.tsx
│   └── SignupForm.tsx
├── schema.ts                 # users, sessions, oauth…
└── config.ts                 # wire db + providers
src/app/api/auth/[...all]/route.ts

Sedim CLI architecture: registry fetch, thinker plan, writer stamp into src/sedim — CLI engine fetches from the remote registry and stamps into src/sedim/moduleX

Remote registryEvery sedim add fetches the latest manifest and templates from GitHub. Small npm package, always current.
Conflict-aware planningDetects existing auth, schema collisions, and user-table migrations before a single byte is written.
Skip strategyCore logic files use overwriteStrategy: skip. Your customizations are never silently overwritten.
Resumable installsInterrupted mid-stamp? sedim continue picks up from the saved plan snapshot in .sedim/session.json.

Modules

One command. Full vertical slice.

Each module stamps backend logic, schema, adapters, and UI into your repo. Framework and DB agnostic, three UI tiers per module.

sedim add authIDENTITY

Sessions, OAuth, TOTP, magic links, JWT, RBAC/ABAC. Frontend + backend + schema, wired to your DB. The first POC - shipping now.

Start with auth →

sedim add paymentsCOMMERCE

Stripe checkout, webhooks, customer portal, recurring billing. Schema and UI included.

On the roadmap

sedim add notificationsMESSAGING

Email, push, and in-app notifications. Multi-channel dispatch with typed templates.

On the roadmap

sedim add chatREALTIME

WebSocket messaging, rooms, presence, and UI components. Scale modes from single-node to pub/sub.

On the roadmap

sedim add webrtcMEDIA

Peer-to-peer video and audio, screen share, TURN fallback. Self-hostable, inspectable code.

On the roadmap

sedim add ai-ragAI

RAG pipelines, embeddings, vector search, and chat UI. pgvector-first, model-agnostic.

On the roadmap

The pipeline

Four stages, one keystroke.

Scroll to walk through each stage. Every command runs through all four before a single file is written.

Detector

Reads your repository - framework, ORM, DB, folder conventions, lockfiles - and stores facts in sedim.config.ts.

Thinker

Loads the module manifest from the registry, maps it onto your stack, and builds an install plan - files, migrations, env vars.

Showbaby

Walks you through feature selection, shows diffs and conflicts in real time, and confirms the plan before anything writes.

Writer

Fetches remote source files and stamps them into src/sedim/. Core logic uses skip strategy - your edits stay safe.

How it works

Init to running. Four steps.

Detection, feature selection, plan review, stamping, migrations, and running code. Use plan, diff, or --dry-run when you want to preview first.

Install & init

sedim init

Install the CLI globally. Run init in your project - the Detector identifies your framework, ORM, and database, then writes sedim.config.ts.

Add a module

sedim add auth

Pick features (OAuth, TOTP, magic links, RBAC…), choose a UI tier, review the install plan, and confirm. Use plan, diff, or --dry-run first if you want.

Configure & migrate

drizzle-kit push

Set env vars step-by-step during the install flow. Sedim generates migrations for your ORM - run them, and the schema is ready.

Run & customize

npm run dev

Ship with working defaults immediately. Every stamped file lives under src/sedim/ - read it, edit it, test it, push it. No SDK to fight.

Full walkthrough · 13 min

Framework & DB agnostic

Your stack. Your rules.

Framework, DB, and ORM agnostic by design. The Detector adapts the stamp plan to whatever you already run.

Framework	Scope	Drizzle	Prisma
Next.js (App Router)	Full-stack - frontend + API routes	✓	✓
Express	Backend with React or Vue frontend	✓	✓
Hono	Backend with React or Vue frontend	✓	✓

Three UI tiers per module, just like shadcn

Headless

Bring your own design system

Zero CSS - pure logic and markup. Wire into your existing component library or design tokens without fighting pre-baked styles.

Styled

Tailwind out of the box

Fully styled with Tailwind classes that work with your existing config. Ship immediately, tweak classes locally.

Themed

CSS token themes

Pre-built themes with CSS custom properties - minimal, glass, and more. Swap tokens, keep the logic.

Auth module, shipping now

Production-grade security. Readable code.

The first module. Every feature below is stamped as source you own: Argon2id, PKCE S256, encrypted TOTP, non-enumerating magic links, and explicit scalability tradeoffs.

Password authArgon2id (OWASP params), lockout after 10 failed attempts

SessionsSHA-256 hashed tokens, httpOnly cookies, full revocation

OAuthGoogle, GitHub, Discord - PKCE S256 only (RFC 7636)

TOTP / 2FARFC 6238, AES-256-GCM encrypted secrets, backup codes

Magic linksNon-enumerating - always returns success

JWT hybridShort-lived signed JWTs + DB-backed refresh tokens

RBAC / ABACMiddleware factories you apply in your own routes

Rate limitingSliding window, in-memory default, Redis-ready interface

Auth roadmap

Redis-backed session and rate-limit store
Biometric auth flows
Additional OAuth providers
More frameworks and database adapters

See the CLI

Smart detection. Eight commands.

Detects conflicts, empty workspaces, and existing auth libraries before writing. Every command is predictable: init, add, plan, diff, continue, doctor, and --dry-run.

Smart detection demo

CLI commands demo

$ npm install -g @sedim/cliInstall the CLI from npm. Zero global state, zero side effects.

$ sedim initRun the Detector. Stores your stack into sedim.config.ts.

$ sedim add <module>Plan and inject a fully-wired module into your codebase.

$ sedim plan <module>Preview the install plan without writing any files.

$ sedim diff <module>Show per-file diffs of what a module install would change.

$ sedim continue [module]Resume an interrupted module install from where you left off.

$ sedim doctorValidate your setup and diagnose common issues before stamping.

$ sedim add <module> --dry-runFull interactive flow with zero writes. Review everything first.

Who it's for

Built for people who read diffs.

Hackathon tonight or enterprise audit tomorrow. Sedim meets you in the codebase you already have.

Hackathon & indie

Working defaults tonight

Stamp auth with OAuth and a styled UI in minutes. Skip the repetitive RFC research - customize only what makes your product unique.

Enterprise teams

Audit what you ship

Every security decision is readable source in your repo. Argon2id, PKCE, encrypted TOTP secrets - reviewable, not opaque SDK behavior.

AI-assisted dev

Skip the hallucinations

Agents customize stamped, production-hardened code instead of writing auth from scratch. No security gaps, no token waste on solved problems.

Existing codebases

Detects what you run

sedim init reads your stack before planning. Stamps into your folder structure, your ORM, your conventions - not a parallel universe.

Why sedim exists

Generators give you a template. Sedim gives you a teammate who already understood the repo before opening the file.

$ npm i -g @sedim/cli

Explore the docs