Each chapter below is a rule of the engine and what it saves you from. Read it as rule → consequence.
01
FIELDFIELD rulesYour data stays safe, even when the AI makes a mistake
Server-side rules at FIELD level
?What is FIELD rules?
Prices, stock and customer records can only be changed by the people allowed to — checked on the server every single time. A bug on one screen cannot let a customer lower a price or a cashier open payroll.
?What is it for?
Checked on the server on every save
Web, app, API and AI all pass the same gate
New screens inherit the rules
How does it run?
Why is it better?
Usually
The AI forgets a permission check on one screen, and anyone can change prices.
With Vybev
Permissions live in the FIELD, not in screens. A buggy screen still cannot get past it.
field.block✓ Role allowed to translate?✓ Original exists, language on the site?✕ Price or stock sent along? Refused.
Rules per table, run on every write (web, app, API, agent) → the UI can be wrong, the data stays valid
Role, value and column checks in one place → no permission logic scattered across screens
New screens inherit the rules → no regression when the AI adds code later
02
ZIPZIP deployLive the same day
Zero-config deploy
?What is ZIP deploy?
Upload one file and your system runs on your domain. No server setup, no technician to wait for, no “it works on my machine”.
?What is it for?
Tables, roles and routes created for you
No build, no restart, no migrations by hand
Plain text blocks you can review
How does it run?
Why is it better?
Usually
Servers, environment variables and migrations by hand.
With Vybev
Upload one file; the engine creates the rest.
zip.block✓ Tables created from the manifest✓ Roles and FIELD rules attached✓ Routes live on your domain
Drop the ZIP → tables, roles and routes created; no manual migrations
No build step, no server restart → no environment drift between machines
Plain text blocks → reviewable diffs, easy to version
03
TOKENFlat token costChanges stay cheap and fast, year after year
One module in context
?What is Flat token cost?
Most AI-built software gets slower and pricier to change as it grows. Here each change touches one small piece, so day 300 costs what day 1 cost, and fixing one screen never breaks another.
?What is it for?
Each change touches one small module
Day 300 costs what day 1 cost
Fixing one screen never breaks another
How does it run?
Why is it better?
Usually
The whole codebase goes into the prompt; fixes break old features.
With Vybev
One module in context. Install or remove a module without touching the core.
token.block✓ module scope → its tables, roles, views✓ install / remove without touching the core✓ same cost per change as the project grows
The AI receives one module and its declared dependencies → token cost stays flat as the codebase grows
Scoped edits → no “AI got lost in a huge codebase”, a bad prompt cannot touch other modules
Install or remove modules without touching the core → clean diffs, easy review
04
DOMAINMany domainsOne purchase, many websites
Multi-tenant runtime: a domain and a database per project
?What is Many domains?
Run every brand, branch or client on one installation, each on its own domain. No extra server per site, no extra monthly fee, one update for all of them.
?What is it for?
Each project on its own domain
Shared or separate database
Update once, every project gets it
How does it run?
Why is it better?
Usually
Every client site is a new server setup, a new bill, a new thing to update.
With Vybev
30 client sites on one install. Update the engine once, every project gets it.
Domain and session routed at runtime → no Nginx vhost per client
Shared or isolated database per project → tenant isolation exactly where you need it
One engine upgrade → every project updated at once
05
LANGLanguages & currenciesSell in your customers' language and currency
i18n built into the engine
?What is Languages & currencies?
Visitors read your shop in their own language — products, pages and even web addresses — and see prices in their currency. Search engines find you in each language. Translate by hand or in one click with AI.
?What is it for?
Texts, content and web addresses per language
Prices in the visitor's currency
Translate by hand or with AI
How does it run?
Why is it better?
Usually
A translation plugin per site, URLs stay in English, prices in one currency.
With Vybev
Ready packs plus AI translation for any language. /checkout becomes /thanh-toan.
lang.block✓ /checkout — English✓ /thanh-toan — Tiếng Việt✓ /paiement — Français
Text-keyed translations plus language packs → no translation key files to maintain
Content rows translated as language + group of the original → price and stock keep one source of truth
Route slugs per language, resolved by the router → localized URLs without duplicate pages
06
QUEUEQueues & cronEmails and reminders go out on time, by themselves
Cron and queue workers on the server
?What is Queues & cron?
Order confirmations, cart reminders, appointment reminders and the morning report are sent by the server, day and night, even when nobody has the admin open. If a message fails, it tries again.
?What is it for?
Runs at 3 a.m., no browser open
Never sent twice
Every failure retried and visible
How does it run?
Why is it better?
Usually
A separate cron service to rent, or jobs that only run when someone visits.
With Vybev
Built in. Nothing is sent twice, every failure has a next retry you can see.
queue.block✓ 23:55 cart reminder sent✓ 00:10 order email, 2 minutes after the order✓ 07:00 low-stock report to the owner
QUEUE blocks on a per-minute or cron schedule → no external cron service to rent
Idempotent sends with retries → nothing sent twice, every failure visible
Runs without an open browser → reliable at 3 a.m.
07
PAYPaymentsTake payment any way your customers want
Order lifecycle hooks
?What is Payments?
Bank transfer with QR, cash on delivery, PayPal and Stripe are built in. Need VNPay, MoMo or another provider? The AI writes it as one payment method — checkout is not rebuilt. The invoice, the order e-mail and your after-payment steps follow by themselves when the money lands.
?What is it for?
Bank QR · COD · PayPal · Stripe · + your own
New gateway = one payment method
Invoice, mail, push, points follow
How does it run?
Why is it better?
Usually
Every new gateway means rebuilding checkout, invoices and emails.
With Vybev
One payment method per gateway. Stock checks and codes run before the order is written.
pay.block✓ Before the order: stock, codes, delivery fee✓ Money lands: invoice, e-mail, push, points✓ Close: revenue booked and reconciled
Before/after create order, after payment, after order success → plug in logic without forking checkout
A new gateway is one payment method written from the provider's docs → web and app get it at once
Stock, voucher and shipping validated before the write → no invalid order rows
08
MAILEvent emailsProfessional emails at every step, without a developer
Event templates with schema variables
?What is Event emails?
Order received, shipped, thank you, birthday, appointment: each has a template you edit like a document. Names, order codes and items fill themselves in.
?What is it for?
One template per event, edited like a document
Names, order codes and items fill themselves in
Sent through the queue, never twice
How does it run?
Why is it better?
Usually
Emails hard-coded in screens; change a word, redeploy the site.
With Vybev
Edit the template, keep the variables. The next email uses it.
mail.block✓ Hi {name}, order {code} is on its way✓ Your table at {time} is confirmed✓ Happy birthday, {points} points inside
One template per event, variables bound to schema fields → no hard-coded strings in screens
Delivery via SMTP or a provider API through the queue → sending decoupled from the request
Edit the template → the next send uses it, no redeploy
09
APPAndroid & iOS appYour own app on Google Play and the App Store
Native app source on the same backend
?What is Android & iOS app?
The same products, orders and customers as your website — an order on the phone shows in the back office at once. Scan, print receipts, check in by QR, take payment: whatever a phone can do.
?What is it for?
One backend, one database
Camera, QR, printer, GPS, push
Signed for your domain, built in the editor
How does it run?
Why is it better?
Usually
A second project in Flutter or React Native, a second database to keep in sync.
With Vybev
One backend, one database. An order placed in the app is in the back office at once.
app.block✓ APK for Google Play✓ IPA for the App Store✓ Same roles and data as the web
Full React Native / Flutter source → any native API: camera, POS printer, GPS, offline
Same API, roles and database as the web → no sync layer to build
APK and IPA builds → store-ready
010
AIAI agentAsk your software instead of digging through screens
Agents per module, bound by ACL
?What is AI agent?
Type “revenue by branch last month” or “10% off every drink until Sunday” and it is done — on your real numbers, and only within what that person is allowed to do.
?What is it for?
Reports, customer care, data entry in one sentence
Works with the role of whoever asks
Never holds the database keys
How does it run?
Why is it better?
Usually
A chatbot that guesses, with no idea who is allowed to see what.
With Vybev
A cashier asking for payroll gets nothing: the same rules as the screens.
ai.block✓ “Revenue by branch, worst first”✓ “Which staff voided the most orders?”✕ Cashier asks for payroll: refused
The agent reads the module's schema → no invented fields or joins
Runs with the caller's role → the same permissions as the UI
Ships inside the module → install the module, get the capability
011
MEDIAImages & videoImages and video, built into the engine
A file store: upload, resize, stream, Excel
?What is Images & video?
People upload photos, videos, Excel files and documents straight from the page. Images come back the right size on every screen, videos play and seek smoothly, and you decide what can be downloaded and what is view-only — all without paying for a separate storage service.
?What is it for?
Images resized, EXIF fixed
Video streams with seeking
Download or view-only per file
How does it run?
Why is it better?
Usually
Uploads land in a public folder; a .php renamed .jpg can run, and big videos download whole before they play.
With Vybev
Files sit outside the web root, the content is checked, and video streams with seeking. Download or view-only is a single flag.
One endpoint for one or many files; images resized and EXIF-rotated → many sizes from a single upload (srcset)
Video gets smaller copies made in the background → seeking over HTTP Range, no full download
Files live outside public/, content sniffed, download or view-only → nothing uploaded can run as code
Architecture
What happens between the ZIP and the app.
01ZIP package
Pages, modules, assets and a manifest. Nothing compiled.
02Vybev runtime
A fast PHP core in an isolated sandbox. One install runs many projects and domains, with no server restart.
03Auto migration + ACL
Tables, indexes, roles and FIELD rules from the manifest; a shared or separate database per project.
04Web + native shell
One package serves browser, Android and iOS from the same data layer.
One module is the whole context.
When you ask the AI to change one screen, it receives that module and its declared dependencies — not the project. That is where the saving comes from, and why a bad prompt cannot reach the rest of the system.
module scope → declared tables, roles, views
install / remove without touching the core
multi-domain routing resolved at runtime
1 module in context
E-commerce ready
Payments, invoices, mail and push already live in the engine.
A sale is never just a payment button. It is a gateway, an invoice, a confirmation mail, a push to the driver, loyalty points added at the right moment. Vybev opens every point in the order lifecycle as a hook you drop your code into, so you never rebuild the flow.
Add a gateway when you need it
Bank transfer (QR), COD, PayPal and Stripe are built in. Any other gateway (VNPay, MoMo, ZaloPay…): give the AI its documentation and it writes one payment method, used by web and app.
Run logic before and after the order
Check stock, lock quantity, apply a voucher, calculate shipping. All of it runs before the order is written, so a bad order never reaches the database.
Money lands, the chain runs
Issue the invoice, send the confirmation mail, push the kitchen and the driver, add loyalty points, call the warehouse API. All in one hook, with no cron job to wait for.
Close the order and reconcile
Book the revenue, reconcile with the gateway, issue the VAT invoice, sync it to accounting.
Email templates per event
One template per event, with variables read straight from your data. The server sends them through its queue, by SMTP or the mail service you choose.
Push straight to the app
The same hook pushes to that project's own Android and iOS app, because app and web run on one backend.
A clean API surface
Each module declares its own endpoints. Partners call in and you call out, both through the same permission layer.
An AI agent for any function you need
Describe the function you want and the agent does it: clear a stuck order, answer a customer, reprice a whole range, call an external service. It reads your data and the asker's role, so it works on real records within real permissions.
Four are built in. Any other gateway, you add when you need it.
Bank transfer · QRCash on deliveryPayPalStripe+ VNPay, MoMo, ZaloPay, your bank…
What the AI writes — one item, three tabs
Return Urlasks the gateway for a payment link and sends the buyer there
Payment Successchecks that the gateway's answer is genuine, then says paid or failed
Payment Cancelthe buyer came back without paying
Open the Payment method prompt in the editor, name the gateway, paste its docs. The merchant keys go in IDE → Payment Methods (test keys first) — never in the code.
What the platform already does
Creates the invoice from the cart and computes the amount
Locks the payment — a reload or a repeated gateway call never runs twice
Compares the amount paid with the invoice
Sets the status, sends the order e-mail, runs your “after payment” step once
Same checkout for the website and the app
Why Vybev for vibe coding
The best place to let an AI build real software.
Vibe coding breaks in the same places everywhere: the AI forgets a permission check, writes a query that dies at 100,000 rows, sends the same mail twice, or wires two systems in a way nobody can debug. Vybev takes those places out of the AI's hands and gives it a contract it cannot get wrong.
01A contract, not a guess
Each prompt defines exact blocks the engine imports: DB, API, FIELD, QUEUE, KAFKA, MAIL, PAYMENT. The importer checks every block and warns before anything is saved.
02The server checks everything
Permissions per table, FIELD rules on every save, signatures and idempotency on every call between projects. A wrong screen or a careless line of AI code cannot leak or corrupt data.
03The hard parts are done
Payments, invoices, mail, push, cron, queues, signed service calls, Kafka, single sign-on, cache, word search. The AI only writes what is specific to your business.
04One module at a time
The AI receives one module and its declared dependencies, never the whole project. Answers are cheaper and faster, and a bad answer cannot reach the rest of the system.
05Performance rules in every prompt
Indexes planned with the table, the first condition of every big query on an index, keyset paging, hot counters through the queue, old rows cleaned by a cron job. Generated features are written for millions of rows, not for the demo.
06A setup guide beside every prompt
Multi-service, Kafka and speed each come with a guide: every .env setting, what it is for and what breaks when it is wrong, plus the queue worker, the scheduler and the checks to run before launch.
07Your AI, your servers
Use Claude, ChatGPT or Codex. The output is plain PHP and Blade on your own servers and databases, with no per-request fees and no lock-in to a hosted builder.
A correct password still needs the one-time code sent by e-mail. For everyone, admins only, customers only, or people who switch it on. 4–8 digits, expiry, limits on wrong tries and resends, optional trusted device for N days.
Keycloak / OIDC
Shared sign-in with code + PKCE + state + nonce; the id_token signature is always checked. Roles follow Keycloak and are revoked when Keycloak removes them. Never grants super_admin.
VNeID and SSO
Sign in with VNeID (registered with C06). SSO: one Auth project keeps the accounts, every other project signs in through it.
Append-only audit tables
Declare a table as an audit log and nobody can update or delete its rows through the platform, not even super_admin.
Signed webhooks
Receive data from outside systems with HMAC-SHA256 or a token, optional IP list, duplicate and replay protection. The request only writes to an inbox table; a worker processes it.
Hardened outgoing calls
Project code calls other servers through a helper that refuses private and internal addresses (IPv6-mapped too), follows no redirects and caps the response size.
Pricing
Pay once. Ship for as long as you want.
From $59, lifetime. Free updates. Unlimited projects on your own server.