DEV Community

Shivam Kumar
Shivam Kumar

Posted on

139 Free Business Tools, One Static Codebase: Inside the VisionQuantech Business Suite

#javascript #opensource #webdev

I recently dug through vq-business-suite — 139 free tools for Indian SMEs (GST, accounting, HR, invoicing, cash-flow, tenders...) — and the interesting part isn't the count. It's the engineering discipline underneath: 100% static, no backend, no build step, pure functions first, 376 passing Node assertions. Here's how it's built.

The core constraint: everything runs from file://

The entire suite is HTML + vanilla JS + CSS. No npm, no frameworks, no CDNs, no fetch() to any server — the app contract literally forbids backend calls. That's what makes the privacy story true: there is no server to send your data to.

Eight shared modules in core/ do the heavy lifting:

  • shell.js / shell.css — design system + auto-injected header/nav/footer. Mobile-first: ≥44px touch targets, single-column under 640px.
  • uid.js — local profiles (name + business) in localStorage. Explicitly not auth.
  • vault.js — per-app namespaced storage (vqs:vault:<app>:<key>, ≤25 items/app). Optional passphrase → PBKDF2-SHA256 (100k iterations) → AES-GCM-256 with a random IV per record via WebCrypto. Passphrase lives in memory only; closing the tab locks the vault.
  • freemium.js — metering. Apps call Freemium.check(slug, 20) before metered actions; denial renders an upsell banner. Reading saved data is never blocked.
  • ads.js, seo.js — AdSense slots and JSON-LD helpers.
  • apps.json — the registry. The landing page's tool grid renders from it.

The per-app contract

Every tool is apps/<slug>/ with index.html + app.js (+ optional README). The contract: body[data-app], one <h1>, full SEO head (EN+Hindi keywords, canonical, OG, FAQ JSON-LD), core scripts in fixed order, 2 ad slots, FAQ blocks — and pure functions first in app.js, exported via module.exports so they run under Node for tests. Browser UI comes after.

Real example — the cash-flow forecaster's core is genuinely testable:

function projectCashFlow(opening, entries, months) {
  // entries: [{type:'in'|'out', amount, recur:'once'|'monthly', start}]
  // → {rows, minBalance, minMonth, survivalMonths, neverNegative}
}
Enter fullscreen mode Exit fullscreen mode

Same file: summarize() (plain-language readout), cashChartSVG() (accessible SVG chart built as a pure string — no chart lib), fmtINR() (Indian number formatting). All rendered output passes through an esc() HTML escaper. File/paste inputs are size-capped client-side (a 2026-09-26 hardening audit found and fixed 2 real issues — documented in HARDENING.md).

Adding a tool

Create apps/<slug>/, follow the contract, register in core/apps.json, add tests. The tests/ directory runs per-team Node suites — 376 assertions, 0 failures. ARCHITECTURE.md maps everything onto a "U-STACK lite" (identity, vault, metering, registry...) with documented upgrade paths to server-backed versions later.

Honest status

Working client-side, tested, not deployed. Pro tier (₹299/mo) checkout is stubbed; the Enterprise API is docs-only (waitlist). The code is the real thing though — a static-site architecture done with unusual rigor.

Try it: clone the repo, open index.html from file://, run the cash-flow forecaster. If you build for SMEs, the per-app contract is worth studying.

Top comments (0)