SyntaxKit 1.0

SyntaxKit 1.0 is out. It is a commercially licensed, production-ready SaaS foundation rather than a hosted platform: a pnpm and Turborepo monorepo containing a Next.js App Router product app, a separate Fumadocs documentation site, and a focused package behind every subsystem. You get the source and own every line.

The goal was never to hand you a demo. It was to remove the six months that every SaaS spends rebuilding authentication, multi-tenancy, subscription billing, and the operational glue around them before writing a single line of product code.

Here is what ships in 1.0.

Authentication and organizations

Better Auth handles identity. Email and password with required verification, GitHub and Google OAuth, passkeys over WebAuthn, and TOTP two-factor with backup codes are all enabled out of the box. Cloudflare Turnstile guards the auth forms once you add keys, and OAuth buttons stay visible but disabled until their credentials exist, so you can see where each integration plugs in.

Multi-tenancy is built into the data model rather than bolted on afterwards. Every user gets a personal organization on sign-up, and organizations carry owner, admin, and member roles alongside a separate billing permission. Invitations, seat limits, organization switching, role hierarchy checks, and last-owner protection are already handled. A platform admin area covers users, roles, bans, and active sessions, so you do not need to build a second control plane.

Billing that understands entitlements

Stripe subscriptions are scoped to organizations, not individual users. Hosted Checkout, the customer portal, in-app cancel and resume, monthly and yearly intervals, trials, promotion codes, and optional Stripe Tax are all wired up, with webhook signature verification and two layers of idempotency behind them.

The part that normally takes longest is the entitlement layer, and that ships too. A subscription moves through seven explicit states, from free and entitled through grace_period, recoverable, and lapsed, so a failed payment degrades access on a schedule you control instead of cutting a customer off mid-session. Plan limits become one-line guards through helpers like assertBillingFeature, assertWithinMemberLimit, and assertWithinAiResponseLimit, and AI usage is reserved atomically so concurrent requests cannot overrun a monthly cap.

Streaming AI chat

An organization-scoped chat lives at /dashboard/ai-chat, built on the Vercel AI SDK and routed through the Vercel AI Gateway so a single key reaches every model. It streams reasoning and sources, accepts image attachments, takes voice input, regenerates trailing turns, and titles conversations automatically.

Model access is gated by plan: the free tier is pinned to a default model, while paid plans unlock the model picker and web search. Every response is metered against the organization's monthly allowance through a usage ledger.

A type-safe path from database to browser

The API layer is oRPC, mounted at /rpc, with Zod validation on every input and output and a shared error vocabulary that maps cleanly onto HTTP. Middleware composes from base through authorized, active-organization scoping, and permission checks, so a procedure declares what it needs instead of re-implementing authorization. TanStack Query consumes the same contracts on the client, and server components call the API in-process.

Because oRPC is OpenAPI-native, the kit also generates a spec and an interactive reference at /api-reference, gated to platform admins.

Underneath, PostgreSQL and Prisma own the schema, split by domain across auth, billing, AI, and outbound-effect models. The right driver adapter is selected automatically from your connection string, and three seed modes cover a clean bootstrap, demo data, and test fixtures.

Skills your coding agent can read

SyntaxKit ships scoped skills for auth, billing, email, data, and deployment. They describe where a feature belongs and which checks prove it is finished, so your agent extends the product along the existing architecture instead of rediscovering it every session. They are plain files in the repo, so you extend them as your own conventions emerge.

Everything else

The unglamorous work is done too:

• Storage on any S3-compatible provider, using a presign, upload, finalize flow where the server re-encodes every image as the security boundary
• Transactional email as React Email templates with pluggable delivery, covering verification, password reset, invitations, and the full billing lifecycle
• Internationalization through next-intl, shipping English and German with locale-prefixed marketing routes
• Analytics and monitoring on PostHog, with typed events, session replay, error tracking, structured logs, and health probes
• Abuse protection through Upstash sliding windows per surface, plus per-route auth limits and a Nosecone-driven security header and CSP bundle

Tested and ready to deploy

Vitest covers unit and integration tests against a real Postgres, with an optional live Stripe suite, and Playwright covers the critical flows end to end: signup, onboarding, billing, two-factor, organization settings, and admin. Coverage gates are enforced per package.

Deployment configs ship for Vercel, Fly.io, Render, and Docker Compose, with a standalone Next.js output and container images published from GitHub Actions.

Getting started

Three environment variables and about five minutes:

cp apps/web/.env.example apps/web/.env
pnpm install
pnpm setup:doctor
pnpm db:migrate:dev
pnpm dev

Everything beyond a database, an app URL, and an auth secret is opt-in. OAuth, Stripe, storage, email, and analytics stay disabled until you configure them, and their UI surfaces stay visible with disabled-state messaging so you can find them later.

Every license includes lifetime updates, and this page is where they will show up.