Give your agents guardrails

Auth, security, migrations and 600+ tests, already bolted down. Server-rendered JSX on Bun and PostgreSQL — one codebase, one test runner, one deploy target. Your agent starts on your product, not on the parts every app needs.

Get Started View Stack

The problem

Left to their own choices, AI coding agents reach for what they know best: React with Next.js. The result is a thick-frontend app split across client and server, locked into a specific ecosystem, requiring multiple test systems to simulate browser state, and unnecessarily complex to deploy.

The approach

Single-instance server rendering with light-touch client JavaScript. Templates are deterministic functions of their props — given the same input, they produce the same HTML. Trivial to test without browser simulation. One process, one deploy target.

Capture your backpressure

AI agents work best when they get told they're wrong immediately — not by you, by the toolchain. Type errors, failing tests, lint warnings: that's backpressure. Every automated check that catches a mistake is one less time you have to context-switch back in to fix something a machine should have caught.

TypeScript strict modeType mismatches, missing properties, unused code

Biome lintingStyle violations, unsafe patterns, console usage

Pre-commit hooksAnything that slipped past the editor

Test suiteBehavioural regressions, broken templates, bad responses

What's included

Auth, security, database, testing, linting — the rails are laid so your agent can focus on building your product.

Authentication

Magic-link or password login, session management, guest sessions, admin roles

Security

CSRF protection, rate limiting, an optional proof-of-work captcha, a Content Security Policy, HSTS, and security headers on every response

Database

PostgreSQL via Bun.SQL, auto-migrations, seed scripts, parameterised queries

Testing

600+ tests, deterministic templates, real database testing, no browser simulation

Frontend

Server-rendered JSX, custom CSS via Bun bundler, opt-in client interactivity, flash messages

Code Quality

Biome linting, strict TypeScript, pre-commit hooks, structured logging

Built to a public standard

specification.website is an open, platform-agnostic checklist of the technical features a good website should have — 168 specs across foundations, SEO, accessibility, security, performance, and more. Billet works through it section by section, so the boring-but-critical baseline is in place before you write a line of product code.

FoundationsDoctype, charset, viewport, canonical URLs, Open Graph, favicons, theme-color

SEOrobots.txt, XML sitemap, JSON-LD, per-page metadata, an explicit indexing policy

AccessibilitySemantic landmarks, labelled forms, focus rings, reduced motion, captioned tables

SecuritySecurity headers on every response, a Content Security Policy, HSTS, security.txt, Subresource Integrity, Clear-Site-Data

Agent readinessAn llms.txt index, AI-crawler rules and Content-Signal in robots.txt, machine-readable Link headers, structured data, stable URLs

PerformanceBrotli and gzip compression, fingerprinted immutable assets, ETag revalidation with 304s, preconnect resource hints, minified bundles

Read the full standard