Glossary

Plain-language definitions for kit-specific nouns and web concepts these docs lean on, grouped by topic and cross-linked to the owning page. Use Cmd-F to jump. Missing a term? Email the support address on the License page.

On This Page

Auth & SessionsBetter Auth, passkeys, 2FA, and the cookies behind a session.OrganizationsActive org, personal org, and the multi-tenant guards.Data & APIPrisma adapters, migrations, oRPC, packages, and uploads.Frontend & i18nStyling helpers, server vs client components, and locale routing.Billing & WebhooksStripe modes, signing secrets, and idempotent event handling.Security & AbuseCORS, CSP, CSRF, rate limits, and captcha.Email & ObservabilityTransactional mail, deliverability, analytics, and logs.Build & DeploymentEnv timing, capabilities, the setup doctor, and the monorepo.

Auth & Sessions

Term	Definition
Better Auth	The self-hosted auth library in packages/auth. Sessions, OAuth, 2FA, passkeys, and the organization plugin. Authentication.
Passkey	Phishing-resistant sign-in with a device-bound key pair (Touch ID, Windows Hello, hardware keys). WebAuthn via Better Auth's passkey plugin. What's Wired In.
Platform admin	A User.role = "admin" flag, separate from org roles. Gates /dashboard/admin and the admin oRPC namespace. Bootstrap with pnpm admin:bootstrap --email <email>. Platform Admin Role.
SameSite cookie	A cookie attribute (Strict / Lax / None) that controls cross-site sends. The kit sets sameSite=lax on session cookies to blunt CSRF without breaking inbound links.
Session cookie	Better Auth's opaque httpOnly, sameSite=lax cookie after sign-in. Signed and encrypted with BETTER_AUTH_SECRET. The session it represents includes activeOrganizationId. How Sessions Work.
Two-Factor Auth	A second sign-in factor: TOTP from an authenticator app, plus single-use backup codes. Better Auth's twoFactor plugin. What's Wired In.

Organizations

Term	Definition
Active organization	The org the current session is acting on. Stored as activeOrganizationId on the session. oRPC procedures that use withActiveOrganization load it onto context.organization. The Active Organization.
Last-owner protection	Blocks removing or demoting an org's only remaining owner. Uses a FOR UPDATE row lock so two concurrent demotions cannot race past the check. Guards Beyond The Role Check.
Personal organization	A normal org with isPersonalOrganization: true in metadata. Created on sign-up so every user starts with a home org. Same fields and roles as a team org. What An Organization Is.

Data & API

Term	Definition
Composite project	A TypeScript project (tsc -b) that emits declaration files for other packages. Used by packages/shared and packages/api so workspace consumers share their types.
Driver adapter	Prisma's pluggable Postgres driver layer. The kit picks @prisma/adapter-neon for *.neon.tech hosts and @prisma/adapter-pg everywhere else (always pg under Vitest). Pick a database.
Migration vs seed	A migration is a versioned schema change (prisma migrate). A seed loads starter data (prisma db seed). Seeds ship in three modes: bootstrap, demo, test. Seeding.
oRPC	The OpenAPI-native typed RPC framework behind packages/api. End-to-end TypeScript types, plus a generated spec at /api-reference. API.
Pre-signed URL	A short-lived S3 URL that lets the browser PUT bytes straight to a bucket key. Avoids serverless body-size limits. How An Upload Flows.
Subpath export	A package.json exports entry for one file under a sub-path (for example @syntaxkit/analytics/client). Consumers import only the client or server half. Package Map.

Frontend & i18n

Term	Definition
cn helper	clsx plus tailwind-merge, from @syntaxkit/ui/lib/utils. Caller-side className wins over the cva default. Base Components.
cva	class-variance-authority: turns Tailwind class strings into typed component variants. Every shadcn-style primitive uses it. Base Components.
Locale routing	Two strategies in parallel. Marketing and auth use a URL prefix (/en/..., /de/...). The dashboard reads a NEXT_LOCALE cookie and keeps paths locale-free. Two Locale Strategies.
next-intl	The i18n library behind both locale strategies. Internationalization.
OKLCH	A perceptually uniform color space (oklch(L C H)). Every color token in packages/ui uses it. Pick colors at oklch.com. Brand Tokens.
Server action	A Next.js "use server" function the client can call. Used sparingly (for example setLocale). Multi-instance deploys need a shared NEXT_SERVER_ACTIONS_ENCRYPTION_KEY. Operational Secrets.
Server component vs client component	App Router primitives. Server components render on the server and ship no client JS. Client components ("use client") ship interactive code. Calling The API From React.
shadcn/ui	A pattern (and CLI) for copying React primitives into your repo instead of installing them as a dependency. The kit's packages/ui is yours to edit. Customization.

Billing & Webhooks

Term	Definition
Best-effort side effect	An email or analytics dispatch wrapped so its failure does not fail the webhook. On failure the OutboundEffect claim is released so a later Stripe retry can try again. Best-Effort Side Effects.
Live mode vs test mode	Stripe's two environments. Test (sk_test_*) uses fake cards. Live (sk_live_*) charges real money. Signing secrets and price ids differ between them. Pricing And Stripe Live Mode.
OutboundEffect	A Postgres table keyed by (kind, key) that records each email or analytics dispatch. Semantic keys stop retries and related events from double-sending. Two-Layer Idempotency.
Stale processing recovery	Recovers Stripe events whose handler crashed mid-run. After 5 minutes (STALE_PROCESSING_WINDOW_MS), the next retry may re-claim the row (up to 5 reclaims) and re-run the handler. Stale Processing Recovery.
Stripe webhook signing secret	The secret Stripe uses to sign payloads. The kit verifies every event with stripe.webhooks.constructEvent. The production secret differs from the Stripe CLI one. Endpoint And Signature Verification.
StripeWebhookEvent	A Postgres table keyed by eventId. Claims each Stripe delivery so concurrent retries do not run the handler twice. One half of two-layer idempotency. Two-Layer Idempotency.
Two-layer idempotency	The webhook dedupe story. StripeWebhookEvent.eventId blocks duplicate event ids. OutboundEffect.(kind, key) blocks duplicate business actions (emails, analytics). Two-Layer Idempotency.

Security & Abuse

Term	Definition
CORS	Cross-Origin Resource Sharing. HTTP headers that decide whether a browser may call your API from another origin. proxy.ts scopes it to NEXT_PUBLIC_APP_URL. Edge: Headers, CSP, CORS.
CSP	Content Security Policy. An allow-list header that limits which origins can load scripts, styles, fonts, and similar. Built with Nosecone plus a curated allow-list. Edge: Headers, CSP, CORS.
CSRF	Cross-Site Request Forgery. Tricking a user's browser into an authenticated request to your site. Mitigated by httpOnly, sameSite=lax session cookies set explicitly in packages/auth/src/server.ts. Authentication: Sessions And Captcha.
Rate limit	A cap on how often a surface may be hit. Better Auth ships per-route limits on auth endpoints (Redis-backed when Upstash is set). Separately, Upstash sliding windows cover contact, auth email, chat, uploads, and billing. Built-in Auth Rate Limits and Abuse Protection (Upstash).
Turnstile	Cloudflare's captcha alternative. Used on auth flows (Better Auth captcha plugin) and the public contact form when both Turnstile env vars are set. Authentication: Sessions And Captcha.

Email & Observability

Term	Definition
OpenTelemetry	The observability standard behind the kit's structured logs. Records export over OTLP to PostHog Logs. Structured Logging.
PostHog	One vendor for product and web analytics, session replay, error tracking, and structured logs. Analytics and Monitoring.
Reverse proxy	A Next.js rewrite that routes /ingest/* to PostHog. Same-origin requests defeat many ad-blockers and simplify CSP. The Reverse Proxy.
Source map upload	A build step (withPostHogConfig) that uploads JS source maps to PostHog so stack traces de-minify. Needs POSTHOG_API_KEY and POSTHOG_PROJECT_ID at build time. Source Maps.
SPF, DKIM, DMARC	Three DNS records that prove your domain may send email. Without them, Gmail and Outlook deliverability drops sharply. Email Sender Configuration.
Transactional email	Email triggered by a specific user action (verification, receipt), not bulk marketing. Delivered via Plunk by default, templated with React Email. Email.

Build & Deployment

Term	Definition
Build-time vs runtime env	Every NEXT_PUBLIC_* var is inlined into the JS bundle at build time, so changing one needs a rebuild. Server secrets are read at runtime. Build-Time vs Runtime Env.
Capability	A boolean for whether an optional feature's env-var group is fully set (isBillingEnabled, and similar). From getSetupCapabilities in packages/shared. Missing config degrades that feature instead of crashing. How the Kit Reads Env.
dotenvx	The .env-loading CLI behind the kit's test, integration, E2E, and webserver scripts. Loads files by priority; --overload overrides host env. Tests.
Setup Doctor	The pnpm setup:doctor script. Validates the env file, lists which integrations are configured, and checks that the database is reachable. Run after a fresh clone. Setup, Tooling, And Deploy.
Standalone output	Next.js output: "standalone". Produces a self-contained Node server with only the deps actually used. Both apps use it to keep Docker images small. Deployment.
Turborepo	The monorepo task runner. Caches lint, check-types, build, and test, and orders tasks so ^db:generate runs before any build. Build pipeline.

Where To Go Next

Project Structure

Where every term in this glossary lives in the repo.

Conventions

Naming, types, and patterns these terms show up in.

Also useful: Commands And Scripts and FAQ.

Was this page helpful?YesNo