Hyperlambda
Lovable will build your app in five minutes. It is genuinely impressive.
Then your app moves in with Lovable.
Your database lives in their cloud. Your runtime runs on their metal. Your users authenticate against their infrastructure. And your app works exactly as long as you keep paying rent.
That is not a bug in the business model. That is the business model. Prompt-to-app platforms are landlords, and the app you just described into existence is a tenant.
The rental market
The big prompt-to-production platforms — Lovable, Replit, Bolt, v0 — all made the same architectural choice, because it is the choice that prints money: the builder and the hosting are inseparable. The AI generates your app into their cloud. Database on their Postgres, API on their serverless runtime, frontend on their CDN, auth on their identity service.
You can usually export the code. Congratulations — you own the furniture. The house it worked in stays behind: the managed database, the environment glue, the deployment pipeline, the auth. Reassembling all of that elsewhere is a real engineering project, which is precisely why almost nobody does it. The export button is not an exit. It is a clause in the lease that makes you feel better about signing.
Again — none of this is a scandal. Hosted businesses host. But it means "I built this with AI" quietly became "I rent this from the AI company," and most people signed without reading.
"But open source exists!"
It does, and credit where it is due.
Dyad is a genuinely good local, open-source app builder — no subscription, bring your own model. Bolt.diy is the community fork of Bolt, self-hosted, supporting whatever LLM provider you like. If your complaint is "I don't want to pay rent for the builder," both solve it.
Neither solves the landlord problem. They are builders, not runtimes.
Dyad emits a React/Node codebase and waves goodbye. Production still means Supabase for your data and Vercel for your hosting — you escaped one landlord by signing three smaller leases. Bolt.diy is the same story with an extra asterisk: it runs on WebContainers, StackBlitz's proprietary browser runtime, so even the toolchain is not fully open, and commercial use of that runtime may require a license. Even Dyad keeps a src/pro directory outside its Apache license.
And the open-source low-code platforms — Appsmith, ToolJet — get closest: they do serve their apps from your server. But they are internal-tool builders bolted onto a drag-and-drop paradigm, they connect to your databases rather than shipping the data tier as part of the deployable, and AI generation is a feature on the side, not the front door.
So here is the honest state of the market in one table.
The deed, in one table
| Lovable / Bolt / Replit | Dyad / bolt.diy | Appsmith-class | Magic | |
|---|---|---|---|---|
| Prompt-to-app | ✅ | ✅ | Partial | ✅ |
| Hosts your database | Their cloud | ❌ (Supabase et al.) | Connects only | ✅ Yours |
| Serves your API | Their runtime | ❌ (deploy elsewhere) | ✅ | ✅ |
| Serves your frontend | Their CDN | ❌ | ✅ | ✅ |
| Is the web server | Theirs | ❌ | ✅ | ✅ |
| Runs on your infra | ❌ | Builder only | ✅ | ✅ |
| 100% open source | ❌ | Mostly* | Open-core | ✅ MIT |
| AI operates the running system | ❌ | ❌ | ❌ | ✅ |
*bolt.diy depends on proprietary WebContainers; Dyad carves its pro features out of the Apache license.
One column has every checkmark. That is the entire argument of this article, so let me be precise about what the column means.
Magic is one deployable unit — a Docker container you put on your own server, your own VPS, your own metal under your own desk if that is how you live. Inside that unit: the database layer, the generated CRUD APIs, authentication and role-based access control, the file system serving your frontend, task scheduling, logging, and a native MCP server. When an AI agent vibe-codes an app on Magic, the thing it generates is already deployed. There is no second step where the code goes looking for a home. The builder and the production runtime are the same system, and you hold the deed to both — MIT-licensed, nothing gated, no cloud edition hoarding the good parts.
Why the landlords can't follow you here
This is the part worth understanding, because it explains why the gap in that table is structural rather than temporal.
The hosted platforms cannot open the runtime, because the runtime is the revenue. Lovable's margin is the delta between what their cloud costs them and what your subscription costs you. Open-sourcing the deployable would be corporate self-harm, and their investors funded a landlord, not a locksmith.
But there is a deeper reason, and it is technical. Handing a customer a self-hosted server that an AI continuously writes code into is, in every free-form language, a security nightmare you cannot support. Generated Python or JavaScript is arbitrary code execution — one prompt injection away from running an attacker's wishlist with your production credentials, on a box the platform vendor cannot see or patch. The hosted players solve this by keeping the runtime in their datacenter where they can sandbox, monitor, and kill it. Take away the datacenter and their safety model evaporates.
Magic can hand you the keys because Hyperlambda was built for exactly this. Generated code executes as an AST where every node must bind to a slot the runtime exposes, whitelisting constrains what any execution context may touch, and RBAC is enforced by the runtime at execution time — not by access checks the model hopefully remembered to generate. The agent operating your server cannot generate its way out of its permissions. The worst a bad generation can do is fail, inside its envelope, visibly.
That is why "open source" and "the AI operates your production server" appear together in exactly one column. It is not that nobody else thought of it. It is that free-form languages make it unsurvivable, and everyone else is built on free-form languages.
The fine print, up front
Big claims deserve precise edges.
Owning the building means holding the pager. Backups, TLS certificates, upgrades, uptime — on your infrastructure, those are yours. That is the actual price of no landlord, and for some people it is the wrong trade. If what you want is a managed service with someone else's name on the pager, rent — from Lovable, from Replit, or for that matter from AINIRO's hosted cloudlets, which run the exact same MIT-licensed code with nothing gated, so the door out is always open.
The claim is not "renting is stupid." Renting is a fine choice.
The claim is that everywhere else in vibe coding, renting is not a choice at all. It is the only door. Here, it is one of two — and both doors open onto the same open-source building.
The keys
Magic is MIT-licensed at github.com/polterguy/magic, with documentation at docs.ainiro.io. One container for the backend, one for the dashboard, and a copy-paste install on a $6 DigitalOcean droplet if you want the whole thing running in the next ten minutes.
Audit the deed yourself. That is the point of a deed.
The rent is zero. It always was. You just needed a stack that didn't need a landlord.