ARI
GET STARTED

ARI

Layered Architecture

v2.0.6 · read bottom-up as “what builds on what”, top-down as request flow

02 AI-NATIVE

AI-Native platform, not a bolt-on

External AI agents and clients enter here - the entire surface below is built to be driven by them.

→
11 provider integrations
OpenRouter · Claude · OpenAI · Gemini · xAI · Mistral · DeepSeek · Groq · Perplexity · ElevenLabs (voice) · Ollama (local)
→
Per-module “brain”
each module selects its own provider + model
→
AI modules
Agents · Chat · Board of Advisors · Morning Brief · Brainstorm
→
Agent-ready surface
OpenAPI spec + API keys let external AI agents drive ARI
03 APIS

Everything in ARI is reachable over REST

→
Module APIs
/api/modules/{module}/…
→
Core app APIs
auth · users · settings · storage · backup · health · license
→
Autogenerated OpenAPI Documentation
a machine-readable openapi.json spec is generated automatically from the route registry · interactive docs at /api-docs
→
Interactive Scalar API explorer
browse, try, and send live requests to every endpoint straight from the docs
→
API keys
API key manager to let external applications securely access your data. Keys can auto-expire.
→
Zod validation + rate limiting
all endpoints validated · 5 sign-ins / 5 min · 3 sign-ups / 5 min · 5 TOTP verifies / min
04 GUARDRAILS

Security & permissions - every request passes through here

Isolation model (docs/SECURITY.md): middleware auth → API-layer filtering → RLS. Also: AES-256-GCM encrypted secrets at rest · disabled-account lockout (sessions rejected, API keys stop working).

→
Session middleware
every route authenticated by default · security headers (CSP · HSTS · X-Frame-Options · X-Content-Type-Options · Referrer-Policy · Permissions-Policy)
→
Account security
Argon2id · 18-char min passwords · TOTP MFA · rate limiting & brute-force protection · public sign-up disabled at the middleware
→
Roles & permissions
admin/user roles · granular keys · always resolved fresh from the DB, never the cookie-cached session
→
Audit Logs
every user and system action is tracked and timestamped for full visibility and accountability
→
Tenant isolation
per-user vs shared data model · API-layer user_id filtering
→
Database deployment control
local Postgres, local Supabase in Docker, or Supabase Cloud - choose the data layer that fits your security and infrastructure model
01 MODULES

Modules

Each module code is entirely self-contained in its own directory, which means they are fully portable. Fork them and share with colleagues.

Modules can declare their own npm dependencies (auto-installed on module install).

ARI supports trusted native modules with unrestricted flexibility and guardrailed modules with enforced isolation and permissions.

Native Modules
Tasks Dashboard Contacts Documents Knowledge Manager Notepad Quotes Motivation Brainstorm Chat Focus Timer Music Player Health Data Morning Brief Board of Advisors Havoc Companions Module Template Agents Fitness Users (ari-users) Portfolio Bible Study Task Monsters Airport Tasks Timezones
Sandboxed Modules
Invoice Manager Asset Manager CRM Shipping Manager ERP
→
Uniform by construction
every module is generated from one fully-commented canonical template — same structure, same API shape, auth, validation, RLS, and theming inherited automatically · committed CLAUDE.md / AGENTS.md rules steer any AI builder (Claude Code, Codex), so the architecture is enforced on the builder, not left to convention
→
ARI Module Library
premium module distribution via api.ari.software, unlocked by license key. Modules hosted on private Cloudflare R2.
→
Idempotent Module Updates
automatic self-healing updates · dependency health handled automatically, auto-installed on module install (with version-conflict detection)
→
Module semver versioning
every module declares its own major.minor.patch version · updates are compatibility-checked before install, and breaking changes require an explicit major-version upgrade
06 ARI FOUNDATION

Self-hosted core platform

→
Next.js 16 + React 19
App Router
→
Better Auth
email/password · Argon2id hashing · HTTP-only cookie sessions
→
Module System runtime
auto-discovery · generated registry · module lifecycle
→
UI shell
sidebar · ⌘K command palette · dashboard widgets · TanStack Query
→
Themes
built-in light & dark themes, fully customizable to match your brand's colors and identity
→
Backup & restore
dynamic table discovery · checksummed SQL export/import
→
Self-healing cache
update-aware guard · stale build caches detected & cleared automatically · no manual resets after updates
→
Health diagnostics
automatic 355+ health checks to proactively detect issues.
→
Telemetry
lib/telemetry
→
Tenant Isolation
per-tenant data separation · scoped queries · isolated storage
→
Deploy anywhere
localhost · LAN · one-click Vercel Deploy Button (boots with zero env vars) · Supabase Cloud — guided /welcome setup wizard configures the database, admin account, and secrets on first visit
05 STORAGE
Database - row-level security + Drizzle ORM
→
PostgreSQL
3 interchangeable backends: local Postgres · local Supabase · Supabase Cloud (ARI_DB_MODE)
→
withRLS()
on every query - defense-in-depth; API-layer filtering is the real tenant boundary
→
Idempotent schema
lib/db/setup.sql + per-module schema.sql, auto-applied on boot/enable
Media Storage Layer
→
Filesystem (default)
data/storage/{user_id}/{bucket}/
→
AWS S3 · Cloudflare R2
+ Supabase Storage (S3-compatible)
Authenticated endpoints only (/api/storage/…) - no public file URLs.