Amino20 Labs

Anyone can browse, build a cart and see a subtotal. Prices are resolved on the server from the catalog on every render, never taken from the browser, and the cart is keyed to an HTTP-only cookie, so a cart built before signing in survives sign-in.

The gate is at checkout. The checkout page and the attestation step both call one server-side check, and no session, or no approved application, means no order.

Applications are scored against rules the admin sets: the email domain's type, whether it has MX records, a disposable-inbox list, business registration, address classification and phone. Clean results activate at once. Anything flagged goes to a review queue with the signals that fired, so a person can still approve a small lab on a free email address. A flag never rejects on its own.

Attestations are database rows, not just ticked boxes. The application and checkout each write one, and the application's row records the network address and browser it came from.

Buyers sign in with the store's own sessions: a signed JWT cookie and bcrypt-hashed passwords. Staff use Clerk with sign-up restricted, plus an allowlist checked on every admin page and inside every server action, because server actions can be posted to directly. A buyer session never grants staff access, and a staff account never grants ordering.

Adding an admin creates the account directly rather than sending an invitation, which restricted sign-up could never redeem. Removing one runs the last-admin check and the delete in a single locked transaction, so two admins can't remove each other at the same moment. Without Clerk keys the staff area answers 503 and the store carries on.

Display copy such as compound type names is editable in the admin. Every change is recorded with its author, the time, and the old and new values.

Dr. Amino is the store's assistant. Its system prompt is built from the live catalog, including names edited in the admin, so its answers follow what the site shows. The catalog part is cached between requests, and the owner's own instructions sit on top.

The owner picks the provider and model in the admin: Claude, or OpenAI, Gemini or Grok through the OpenAI-compatible API. Keys are encrypted at rest with AES-256-GCM and never reach the browser.

The model is only told which page the visitor is on when the page matches a known shape, so a crafted URL can't put text into its instructions. Conversations are capped at 20 turns of 2,000 characters, requests are throttled per address, and provider errors go to the server log while visitors get a plain message.

Product pages show interactive 3D structures. A build script looks each compound up in PubChem by CAS number, never by name, and uses the record only if its formula matches the catalog. Where PubChem publishes a 3D conformer it is used as is; otherwise RDKit computes one, and the viewer says the geometry is computed. 3Dmol.js loads only on pages that show a molecule, and the spin stops for reduced motion.

Storefront code imports commerce from one internal module only. Platform SDKs sit behind it as providers, Shopify and a mock, and an ESLint rule rejects any other import. The provider is chosen by configuration, so the commerce backend can change without touching the storefront.

Content is checked as well as code. A compliance check over the site copy runs before every build, and a separate script compares each stored literature citation with its PubMed record.