Here's a concise, professional technical briefing for the learn-anything.xyz repository, written in the style of a senior AI engineer consultant report.

The Problem

This repository is a portfolio of six semi-independent projects sharing a monorepo structure, centered on organizing knowledge graphs with EdgeDB, a Solid-based website, a Tauri desktop app, and GraphQL/Grafbase plumbing. There is no single coherent architecture binding them together—each project has its own tech stack, entry points, and dependency management. The immediate pain point is the absence of basic SDLC guardrails: no CI/CD, no license, and no automated dependency updates, which makes the codebase risky for client engagements or external contribution.

What This Does

The repo contains six self-contained projects:

  • edgedb (62 files) – EdgeDB schema, dbschema, and EdgeQL-JS runtime. Contains 34 modules in circular import dependencies, with edgedb/dbschema/edgeql-js/typesystem as the highest-instability hub (24 importers, 4 imports, instability 0.14). Three files alone hold 630+ lines of logic, creating cognitive load for any change that ripples through 24 dependent modules. The EdgeDB client and type bindings are generated via bun db:ts-generate after bun db:init and schema migration.
  • website (44 files) – Solid-based website in website/src/. Uses file-system routes. Key entry is website/src/root.tsx, which has max indentation depth 8 across its control flow, and website/src/components/Topic/TopicNav.tsx with deep nesting. No CI runs on pushes, so the site’s build pipeline is un-gated.
  • app (64 files) – Tauri/Solid desktop app. Ships with app/src-tauri/src/main.rs and app/src/index.tsx. Contains duplicated 6-line blocks across 36 files (322 repetitions), particularly in app/src/GlobalContext/user.ts and app/src/components/CommandPalette.tsx, violating DRY. Also lacks a license, making redistribution legally undefined.
  • grafbase (10 files) – Provides the GraphQL API layer. Resolvers in grafbase/resolvers expose server functions. Configuration lives in grafbase/grafbase.config.ts. Minimal file count but tightly coupled to the EdgeDB and website layers.
  • lib (6 files) – Shared utility functions, thin but import-dependent across the estate.
  • api (6 files, 1 code file) – Contains api/stripe/src/index.ts, which configures CORS with a wildcard origin paired with credentials—a critical security misconfiguration. Any external page can invoke the Stripe-backed API with attached browser cookies, enabling unauthorized authenticated requests.

Recurring techniques across the estate: EdgeDB as the canonical data source, Bun workspaces for monorepo tooling, Tauri for desktop packaging, and Solid for the website UI. No single architecture ties them together; each project operates with its own package.json, Cargo.toml, and build pipeline.

How It Is Wired

Execution starts at the project level, not the repo level. There is no root-level entry point or monorepo orchestrator beyond Bun workspace scripts.

  • Website: bun dev (inferred from app/vite.config.ts and website/ tooling) starts the Solid dev server. Routes are file-system driven under website/src/routes/. The GraphQL gateway is proxied through Grafbase (grafbase/grafbase.config.ts), which itself calls EdgeDB via the EdgeQL-JS runtime. No CI config means bun build has never been automated on a push.
  • Desktop app: bun run tauri or pnpm tauri builds the Tauri app from app/src-tauri/src/main.rs. The app imports from app/src/index.tsx (Solid root) and depends on Rust logic in app/src-tauri/crates/wiki/src/lib.rs for wiki CRUD. EdgeDB bindings are generated into the Tauri crate via bun db:ts-generate.
  • API: api/stripe/src/index.ts exports an Express/HTTP handler with CORS configured as cors(). The wildcard origin (*) combined with credentials: true is the exact pattern browsers block for security reasons. The API touches EdgeDB through the EdgeQL-JS types and Stripe integration for payments.
  • EdgeDB: The schema lives in edgedb/dbschema/default.esdl. CRUD functions are in edgedb/topic.ts and edgedb/user.ts. Type bindings are generated to edgedb/dbschema/edgeql-js/. The internal import graph has 34 modules in cycles, primarily within edgedb/dbschema/edgeql-js/. The most unstable module is edgedb/dbschema/edgeql-js/syntax (2 importers, 18 imports, instability 0.9), meaning it is heavily depended on but depends heavily on others, making refactors high-risk.
  • Shared utilities (lib/): Small file set, but imports are scattered. No test coverage for these modules.

How To Use It

Setup requires Bun (the repo is configured for Bun workspaces). No Dockerfile or Makefile is present; all commands are Bun-native.

Setup commands (from README, verbatim):

bun i
bun dev-setup   # clones seed repo for some commands to work

EdgeDB:

# Install EdgeDB from https://www.edgedb.com
bun db:init       # follow prompts, name instance `learn-anything`
edgedb ui         # open GUI; explore schema
bun db:watch      # watch schema in `edgedb/dbschema/default.esdl`
bun db:ts-generate # generate TypeScript bindings

Website: bun dev in the website/ directory (or root bun dev if monorepo workspace resolves it).

Desktop app: bun run tauri dev from the root (Tauri CLI must be installed separately).

API: Run bun run dev or start api/stripe/src/index.ts directly with bun run start. CORS must be hardened before any production deployment.

Environment: No .env files are committed. The README mentions api/edgedb/sync/.env as an example for sync scripts, but no such file exists in the clone. No secrets are detected, but the lack of a license means no redistribution rights are granted.

Code Health & Issues

The static analysis (147 of 147 files) returned 76 findings across 6 kinds. The code health audit (6 findings, 0 critical) ranks as follows:

  • [HIGH] Add a LICENSE – root has no license file; default is all rights reserved. Evidence: no LICENSE at repository root. Fix: add MIT or Apache-2.0.
  • [HIGH] Add CI/CD workflow – 105 source files, no CI configuration. Evidence: no .github/ directory or build/test gate. Fix: add a workflow running the project build and test command on push and pull_request.
  • [HIGH] Replace wildcard CORS origin – api/stripe/src/index.ts pairs cors() with credentials. Evidence: cors() config. Fix: list explicit origins; never pair wildcard with credentials.
  • [MEDIUM] Enable Dependabot or Renovate – 6 manifest files, no update bot. Evidence: 6 package.json/Cargo.toml files with no .github/dependabot.yml. Fix: commit .github/dependabot.yml covering ecosystems plus github-actions.
  • [MEDIUM] Expand the test suite – 2 test files against 147 source files (ratio 0.014). Evidence: test coverage is effectively nonexistent for reviewer assumptions. Fix: add tests for highest fan-in modules first.
  • [LOW] Add convention files – missing .editorconfig, .gitattributes, formatter config. Evidence: structure lacks these guards. Fix: add the three files.

Beyond the measured findings: the repo has no Dockerfile, no committed secrets, and no license—three SDLC gaps directly supported by the file structure.

The Bottom Line

This is a portfolio-quality monorepo of six projects held together only by Bun workspace tooling. The website and desktop app are functional but un-gated; the EdgeDB schema has real circular-import instability that will slow any schema evolution; the API has a critical CORS security flaw; and the estate has no license, no CI, and no dependency automation. Use it as a reference implementation for EdgeDB + Tauri + Solid integration, not as a production-ready codebase until the license, CI, and CORS issues are resolved. Best suited for teams already invested in EdgeDB who need a custom knowledge-graph frontend and are comfortable adding their own guardrails.

End of briefing.