About poi-bot
One bot and one dashboard covering the jobs a working Discord server actually has: keeping order, answering questions, running the community, and taking money without sending anyone to an external link.
How it is built
A pnpm monorepo in TypeScript. The dashboard is Next.js on Vercel, the gateway is discord.js on Railway, and both talk to one Postgres database through Prisma. Shared logic — encryption, tenancy, rate limiting, redaction, the delivery outbox — lives in packages both sides import, so the bot and the dashboard can never drift on a rule that matters.
Configuration changes propagate through an HMAC-signed push from the dashboard to the gateway, with a 30-second poll behind it as a fallback. That combination is why a change is normally instant and is never simply lost.
19 slash commands are registered on invite, using a permission set that is verified against discord.js rather than hand-maintained.
What it will not do
There is no music playback, no cryptocurrency settlement, and no feature that requires us to hold your funds. Each of those was considered and left out because it either belongs in a dedicated tool or turns this into a regulated business.
Principles
Moderation stays free
Automod, verification and tickets are the reason a server installs a bot at all. Gating them trades away adoption for revenue that never materialises, because the server never gets far enough to want a paid feature. We gate what costs us money to run instead: commerce, integrations, storage.
Your money is your money
Commerce runs on your own Stripe account. We are not in the payment path, we hold no funds, and we are not your payment processor. That is a deliberate constraint: it keeps you the merchant of record and keeps us out of a business we have no licence to be in.
One tenant cannot reach another
Every server is an isolated tenant with its own config, credentials, limits and plan. Credentials are encrypted under a per-row key and decrypted in memory for a single call. There is no regex automod rule type, because a pattern authored by one tenant and run on every message is a denial-of-service risk against every other one.
Fail closed, fail loud
A lapsed subscription resolves to the free tier even if a webhook never arrived. Fulfilment is idempotent, so a redelivered payment event never delivers twice. The bot validates its entire environment at startup rather than discovering a missing secret during someone's first purchase.