The platform
Each application does one part of the work — and hands its evidence to the next. Use them together, or one at a time.
Platform overviewSee how the loop runs
DjiniousEngineeringOrchestration
DjiniousLabModelling & simulation
DjiniousWorkshopSystem integration
DjiniousSafeCertifiable code
DjiniousWorld3D replicas
DjiniousMapAgent GIS
DjiniousCCOperations & SCADA
DjiniousDataKnowledge base
DjiniousWorkflowAgent automation
DjiniousMapAgent GISDjiniousMap harvests geospatial data, measures what it actually contains, and refuses to draw it until the coordinates support a reading. What survives that becomes a live map, a spatial analysis, a workflow — or an answer an AI agent gives your team.
DjiniousMap
What it is
Most geospatial stacks are three products stitched together: something that ingests, something that draws, something that computes. Each keeps its own copy of who may see what. DjiniousMap is one control plane, and the isolation is enforced underneath all three.
A harvester pulls public datasets and registers them with their source URL, licence and classification. Registered is not the same as present: nothing is copied into the platform until you materialize it, and the catalogue says plainly which is which.
data.gouv.fr · your own sourcesThe publisher’s declared coordinate reference system is treated as a claim. The platform measures the coordinates, names the CRS they are actually in, and reports its confidence. When the two disagree, both are kept and the disagreement is shown.
EPSG · declared vs measuredExcess coordinate precision, stale data, invalid or null geometry — each finding explains what was measured, why it matters, and what to do. When there is nothing to judge by, the verdict is Undetermined rather than a guess dressed as a result.
with remediation, and with “undetermined”Compose materialized datasets into layers, style them, filter them, and add category, histogram, formula or time-series widgets that cross-filter the map. A map is a versioned asset, so a view can be published, shared and rolled back.
deck.gl · IGN basemapsRun isochrones, routes, forward and reverse geocoding, and spatial joins against materialized layers. Results land back in the catalogue as datasets of their own, so an analysis output is a first-class input to the next one.
isochrones · routing · geocodingAuthor a pipeline on a canvas, publish it as a versioned asset, and trigger it on a schedule or on an event — dataset.refreshed, for instance. Runs execute on a leased job queue and stream their progress live.
event and schedule triggersInside the product
Every capture below is the running product.
01 · 01 · Harvest
Register a dataset from the public catalogue or from one of your own connections. Registration records where the data lives, who publishes it, how it is licensed and how it is classified — public, internal, restricted or confidential. No features have moved yet.
DjiniousMap
02 · 02 · Profile
Materializing copies the features into the platform and profiles them: feature count, geometry types, spatial index, null and invalid geometry rates, the temporal columns, and the coordinate reference system the numbers are actually in. The profile is what everything downstream trusts — and a dataset cannot be drawn before it is profiled, because drawing it anyway is how a layer ends up in the Gulf of Guinea.
DjiniousMap03 · 03 · Compose
Bring materialized datasets together as layers on a map: style them, order them, filter them, and add widgets that cross-filter every other layer. The map is a document, versioned like any other asset, so a published view is reproducible and a bad edit is one version away from undone.
DjiniousMap
04 · Three dimensions
A polygon layer with a numeric attribute can be extruded by it. The obvious case is building height: BD TOPO ships a measured height on every footprint, so setting “Extrude by” to that column turns a plan into a massing model — and because the value is the building’s own, the volume is a reading rather than an illustration.
DjiniousMap
05 · 04 · Act
Run an analysis, publish a workflow, schedule it, share the result. Work that takes time runs on a leased job queue with heartbeats, so a worker that dies mid-run releases its lease instead of stranding the job — and every mutation lands in an append-only audit log on the way past.
DjiniousMap
06 · Watch it work
An external agent is asked which datasets the platform will refuse to draw. It searches the catalogue, reads two profiles, and explains the difference between a dataset with no inferable CRS and one whose publisher simply declared the wrong code. Its conversation appears in the assistant panel as it works.
DjiniousMapAI & agents
The assistant is not a wrapper that reads your screen. It calls the same API you do, as a principal the database recognises, under the same row-level policies — so there is no question of what it can reach, and no second permission model to keep in step with the first.
Asked for something consequential, the agent proposes a plan and stops. You see the analysis it intends to run and the layers it intends to touch, and it waits. An agent that runs first and reports afterwards is one you have to supervise; one that proposes is one you can direct.
The transcript shows each tool call with its arguments and its result as it happens — including the calls that returned an error. A tool that failed and was retried is part of the record, because a trace that only shows the successful path is a summary, not a trace.
When the agent talks about a dataset it renders the dataset’s card: the profile, the CRS reading, the findings. You are looking at the platform’s own view of the record, not at the agent’s paraphrase of it.
The agent signs in as a principal like any other. A query it should not be able to answer returns nothing, for the same reason it would for a person: the policy did not produce the rows. There is no agent-specific allowlist to get wrong.
Agents outside the app — a coding assistant, a scheduled analyst, your own tooling — reach the platform through a Model Context Protocol server, with the same tool surface the in-app assistant uses. Tokens are minted per agent and carry their own scopes, and revoking one leaves every other agent’s session untouched.
An external agent’s transcript renders in the app’s own assistant panel, badged and without a composer, because a mirror session has no run to start. The server allocates sequence numbers under a per-session lock, and the event kinds are the same closed set a native run appends.
A published map can be embedded with a chat panel beside it, scoped to that map’s data by the share token. A reader asks a question in words and gets an answer drawn from the layers on the map — without an account, and without reach beyond what the token already made public.
DjiniousMap
Capabilities
DjiniousMap is one Bun API over two databases, with a React client on top: what harvests data, what measures it, what draws it, what computes on it, and what keeps every tenant’s rows out of every other tenant’s queries.
A harvester registers datasets from data.gouv.fr, keeping the publisher’s own external identifier, source URL, licence and update frequency. Re-harvesting updates the registration in place rather than creating a duplicate.
Register your own sources and create datasets from them. A connection carries its credentials and its reachability separately from the datasets that use it, so rotating a secret does not orphan a catalogue entry.
Copying a dataset’s features into the platform is an explicit act with its own job. It downloads the source, detects the format, and inserts in batches into a table created for that dataset alone — one table per dataset, never a shared feature store.
GeoJSON, GeoPackage and the compressed variants the French open-data catalogue actually publishes, including gzipped GeoJSON measured in hundreds of megabytes. Ingest streams rather than buffering, so source size is bounded by disk, not by memory.
The coordinates are measured and matched against candidate projections, producing an inferred EPSG code and a confidence. The publisher’s declared code is recorded beside it and never overwritten. When the two disagree, the platform says so and draws from the measured one.
Feature count, geometry types, spatial index presence, null and invalid geometry rates, temporal columns, declared and inferred SRID, and the WGS 84 bounding box. The bbox is computed in PostGIS because ST_Transform lives there and nowhere else.
Each finding states what was measured, why it matters, and the remediation. Excess coordinate precision quantifies the implied accuracy against survey-grade GNSS; stale data names the column and the threshold; invalid geometry reports a rate rather than a verdict.
When the inputs a finding needs are missing — no declared update frequency, no owner, no date-shaped column — the verdict is Undetermined and the page says which inputs were absent. A guess presented as a measurement would be worse than no answer.
A dataset that cannot be placed on a map is flagged as unsuitable for visualization, with the finding that caused it. The table preview keeps working: the data is not unusable, it is unmappable, and the platform distinguishes the two.
Materialized datasets become layers with their own style, opacity, order and visibility. Fill, stroke, stroke width and point radius are set per layer, and the paint resolves through the product’s design tokens, so switching brand palette repaints the map along with the chrome.
Categorical, range and temporal filters per layer, composable and shareable. A filter authored by a widget is tracked back to it, so removing the widget removes the filters it authored — atomically, rather than leaving orphans behind.
Selecting in one widget filters the map and every other widget, which is what makes a multi-layer map explorable rather than merely legible.
Any column the profiler identified as temporal can drive a timeline: scrub it, or play it, and the map redraws over the period. The rail appears only when such a column exists, so it never implies a time dimension the data does not have.
A map is an asset with immutable published versions, a slug and a current version pointer — the same model as a workflow. Publishing freezes a document and hashes its body, so a shared view is exactly the one that was shared.
Run analyses over materialized layers and land the result back in the catalogue as a dataset of its own, profiled like any other. An output is therefore a first-class input, and the lineage is a catalogue relationship rather than a filename convention.
Travel-time polygons from a point or from every feature in a layer, through a pluggable routing provider. The result is a dataset, so it can be styled, filtered and joined like anything else.
Point-to-point routes with the same provider abstraction, returning a geometry the studio can draw.
Forward geocoding turns an address column into points; reverse geocoding turns points into addresses. Both run as jobs over a whole dataset rather than one row at a time.
Anything that takes time runs on a leased queue with heartbeats. A worker that dies mid-run stops heartbeating and its lease expires, so the job is picked up again instead of being stranded in a running state forever.
Author a pipeline as a graph, configure each node, and publish it as a versioned asset. A run streams its progress live, and the stream is durable: reconnecting replays the run from its event log rather than losing what happened while you were away.
Automations bind a trigger to a published workflow version. Schedule triggers fire on a cadence; event triggers fire on platform events such as dataset.refreshed, so a rebuild follows a harvest without anybody watching for it.
Each automation carries the outcome of its most recent run, so a pipeline that has been failing quietly for a week is visible on the list page rather than only in a log.
Publish a map behind a share token for readers with no account. The token scopes what is readable; it is not a bypass of the tenancy model but a principal within it.
The same viewer runs in embed mode for putting a live map inside another page — including a conversational embed, where the reader asks questions of the map rather than operating its controls.
Exposes the platform as a service to sibling Djinious applications: scoped service tokens, a versioned operation surface under /api/provider/v1, and /ready, /version and /metrics for the operator.
Trust
Multi-tenancy is usually a review problem: every new query is one missed WHERE clause away from a leak. DjiniousMap moves the boundary into the two databases, where a wrong query returns nothing rather than returning somebody else’s rows.
Every table is SCHEMAFULL and carries a PERMISSIONS clause for each verb, evaluated against the record the connection signed in as. A denied read returns nothing. A denied write returns nothing either — which is why every write checks that a row came back rather than assuming it landed.
SCHEMAFULL · PERMISSIONSFeature tables are governed by row-level security declared FORCE, so the policies apply to the owning role as well. That role is created nosuperuser and nobypassrls: there is no principal in the database that can read past a policy, including the one that created the table.
nosuperuser · nobypassrlsEvery request opens its transaction through a helper that sets the organization before any statement runs; the policies read that setting. A request that resolved no organization cannot open a transaction at all, so “forgot to scope it” is not a reachable state.
SET LOCAL, per transactionThe function that creates a dataset’s feature table first checks the dataset exists — a check that runs under the caller’s own row-level security. A tenant asking to materialize another tenant’s dataset sees no row and is refused by the database, not by a handler.
security definer, caller’s RLSThe cross-tenant test suite walks both stores and builds its expectations from the grants and policies it finds, rather than from a list somebody maintains. A table added without a policy fails the walk instead of passing because nobody remembered to add a case.
isolation testsPasswords are Argon2id, verified in the database. The session is a 256-bit random token in an HttpOnly cookie, of which only the SHA-256 hash is stored. Request headers are never consulted for identity, and there is no stub and no override. Login credentials federate to the shared Djinious core.
Argon2id · HttpOnly · SHA-256Every mutation lands in an append-only audit log on the mutation path. A scheduled maintenance sweep handles audit retention and session expiry, and a reconcile command enumerates both stores and exits non-zero when the projected rows disagree.
audit · reconcileIn the digital thread
DjiniousMap does its part of the engineering loop and passes its evidence along — and it works just as well on its own.
DjiniousMapAgent GISDjiniousMap is a complete geospatial platform on its own: harvest open data or your own sources, profile it honestly, compose it into versioned maps, run isochrones, routing and geocoding, and automate the pipeline — with tenancy enforced by the database rather than by application code.
Use cases
5 worked cases.
DjiniousMapTerritory · isochrones and routingAccess and service coverageAnswer “what is within twenty minutes of here” for every site in a layer, and keep the answer current as the source moves.DjiniousMap
Municipal open data · trees, cycle networks, sports facilitiesMunicipal asset inventoriesBring the small, messy, locally-published datasets together — and find out which of them can be trusted before you draw them.DjiniousMapNational reference data · BD TOPO® · IGNNational reference data, in three dimensionsExtrude a building layer by its own height attribute and read the city as volume rather than as outlines.DjiniousMapData governance · in-app assistant and MCPAgent-assisted catalogue reviewPut the question to an agent that can read every profile, and get an answer with the tool calls that produced it.DjiniousMapBook a demo
Bring the dataset you have argued about. Ninety minutes against your own data, not ours: we will profile it in front of you and read the result as it comes — including the parts where the platform declines to draw it, and why.
Along the thread
DjiniousEngineeringOrchestrationThe AI systems engineer: it takes the assignment and carries the whole project through a traceable System Ledger.
DjiniousWorld3D replicasReal environments reconstructed from LiDAR, photographs and video — the physical surroundings of the twin.
DjiniousWorkflowAgent automationGraph automation any stage can call on: build a process, run it, watch it and audit it.
Djinious
