What shipped

The parts that turn a scaffold into a product.

• Billing. Stripe through the Better Auth plugin, with the organization as the customer. A browser-safe plan catalog renders the pricing page, the in-app billing page and drives the API’s limits. Checkout, customer portal, cancel and restore; per-seat plans follow the member count; trials, dunning emails and a payment-failed banner. Everything stays dormant until Stripe keys are set.
• Admin. Platform administrators (a role on the user, independent of organization roles) get user search, ban and unban, role changes, session revocation and one-hour impersonation; a tenant list with members, workspaces and subscription state; feature flags with a global default and per-organization overrides; and a system page with version, uptime, counts, database and migration state, and service health. The first admin is created from the command line.

• Component kit. shadcn-svelte components generated into the shared UI package, alongside the hand-written primitives. Design tokens as light-dark() pairs, so every surface follows the operating system without JavaScript; the app adds a Light/Dark/System toggle.
• Forms and data. sveltekit-superforms in SPA mode with Zod 4, validating the contract’s own schemas; TanStack Query with keys, fetchers and types derived from the contract.
• App shell. Skip link, responsive sidebar, command palette (Ctrl/⌘K), toasts, dialog confirmations, skeletons and empty states, error boundaries with a reference id, and an “Install app” button when the browser offers it.
• PWA. A service worker that precaches the build and serves a prerendered offline page, registered in production browsers only.
• Deployment switches. Sentry error tracking and PostHog analytics, both off until a key is set; PostHog loads only after the visitor accepts a consent banner.
• Accessibility. axe (WCAG 2.2 AA) runs on the public pages in the end-to-end suite; the authenticated pages passed the same checks in both color modes.

Accounts and tenancy, end to end.

• Email flows. Sign-up with email verification, password reset, change email confirmed from the old address, and account deletion confirmed by email. Emails print to the API console in development and go through Resend when a key is set.
• Social sign-in. GitHub and Google switch on when their credentials are present. The sign-in page asks the API which providers are live instead of keeping a second configuration.
• Two-factor and passkeys. TOTP with backup codes, and WebAuthn passkeys, managed from the security settings. Sessions can be listed and revoked.
• Rate limits. Better Auth’s own per-IP limits on the auth routes, plus a limiter on every procedure.
• Session guard. One universal load protects the app routes in server rendering and in the static SPA, so the same code redirects to sign-in on every target.
• Organizations. Create and switch organizations; members with owner, admin and member roles; email invitations that expire after seven days; teams that group members.
• Workspaces. The product container, scoped to an organization and optionally to a team, with unique slugs per organization and a reserved list for the app’s own routes.
• Access control. Roles and permissions are defined once and used by the auth server, the auth client (to hide what a role cannot do) and the API router (every workspace procedure refuses non-members).
• Plan limits and audit log. Workspace and seat limits enforced server-side and reported to the UI; an audit log records who did what per organization.

The scaffold: one Bun workspace, one HTTP API, every surface a thin client of it.

• Workspace and toolchain. Bun as runtime, package manager and test runner; Turborepo for build, check and test; Biome as the only linter and formatter; shared versions pinned once in the root catalog. Internal packages are consumed from source, with no build step.
• Shared packages. The oRPC + Zod API contract, the typed client, the Better Auth server instance and Svelte client, the Drizzle schema with the generated auth tables and the first migration, plan catalog, email provider abstraction, validated environment, and the shared UI package with the Tailwind tokens.
• API. Hono on Bun with Better Auth mounted at /api/auth/*, the oRPC router exposed as POST /rpc/* and as plain REST under /api/v1/*, and an OpenAPI 3.1 document at /api/v1/openapi.json.
• Application. SvelteKit 2 with Svelte 5, building for Node, Cloudflare Workers or as a static SPA from one ADAPTER variable; SSR and SPA share every route.
• Public sites. This Astro site and the Starlight documentation, both fully static.
• Native shell. A Tauri 2 project that wraps the static build with no IPC data layer. The shell talks to the API over HTTPS exactly like the browser.

• Compute service. An internal FastAPI service managed with uv, reachable only from the API with a service token.

• Infrastructure. Docker Compose for the whole stack (Postgres, API, web, AI service, Caddy), a Caddy configuration for public subdomains or a single origin, and a development compose file for Postgres.