The SaaS boilerplate built for the agent era.

Auth, billing, email, typed contracts — engineered so you and your agents can ship a real product without turning every change into an architecture recovery project.

Get Superslate try the live demo →

from the repo, today

Engineered, not assembled.

Most boilerplates are a weekend of glue. superslate is a maintained codebase with boundaries, tests, and documented change paths. You read source for a living — every claim here is checkable in the repo you receive.

verification: contracts through disposable-database integration tests
billing: Polar · Stripe · Dodo — one selected provider
agent context: 5 optional, local, read-only MCP tools
golden paths: maintained change and diagnosis recipes
server domains: 8, each with explicit boundaries
contract layer: @app/contracts — one Zod source of truth

the actual repository

The architecture, on the record.

apps/
  server/            bun + hono api
    src/domains/     auth · billing · deploy · marketing
                     notifications · tunnel · upload · users
  web/               react 19 spa
packages/
  contracts/         zod schemas — one source of truth
  billing/           polar · stripe · dodo adapters
  email/             react-email templates
  agent-context/     optional read-only local mcp
  agent-eval/        agent harness + architecture checks
docs/
  golden-paths/      maintained change + diagnosis recipes
  agent-navigation-contract.json
AGENTS.md            the root contract

boundaries are explicit: Eight server domains. Cross-domain reach-ins are a lint error, not a code-review argument.
contracts end-to-end: One Zod package feeds the API, the SPA, and the tests. Change a field and every consumer fails loudly.
docs are executable: Golden paths are change recipes verified against the codebase — the difference between documented and navigable.

why this stack

Opinionated, on purpose.

Most boilerplates compete on optionality. superslate makes the choices and defends them — every option you don't have is a decision that can't be made wrong.

01runtime: Bun + Honoover a five-tool Node pipeline; One runtime for the API, scripts, tests, and the production binary. A test loop in milliseconds makes agent iteration cheap.
02frontend: React 19 SPAover server-rendered ambiguity; Code runs in the browser or on the server, never "it depends". And React is the framework every coding model has read the most of.
03contracts: TypeScript + Zodover types by convention; One schema package: the API validates, the SPA infers. Change a field and every consumer fails at compile time.
04database: Postgres + SQL migrationsover an ORM DSL; Plain SQL and dbmate migrations you can read in full. Nothing translates between the agent and the database, so nothing hides.

not an AI sticker on an old template

Give your agent a map, boundaries, and checks.

"Agent-ready" usually means a renamed README. superslate ships the contract, the recipes, and the harness that make an agent's changes verifiable.

AGENTS.md — the root contract, verbatim

Preserve its current architecture unless reproducible evidence requires a change. Optimize for a buyer reaching a deployed, paid, maintainable product — not for framework novelty or feature count.
Prefer the smallest reversible change that fixes the evidenced problem.

Scoped per directory. Your agent reads the closest one before it edits.

docs/golden-paths/ — change recipes, verified

add-domain-end-to-end.md
add-billing-gated-feature.md
add-authenticated-route.md
add-transactional-email.md
add-database-migration.md
diagnose-failed-webhook.md
deploy-fresh-application.md
remove-optional-subsystem.md

Maintained routes through common changes and failures—not hidden rules.

packages/agent-eval/ — measure it, don't vibe it

Run an agent against a task, then score the diff for boundary violations before it reaches review.

Plus agent-navigation-contract.json — which rules apply to which change, deterministically.

packages/agent-context/ — local and read-only

Search the version-matched docs, map a change, load applicable invariants, and choose verification without exposing environment files or modifying source.

Optional STDIO context for Codex, Claude Code, and Cursor.

specifics over adjectives

What's inside.

auth: Better Auth; Sessions, sign-in flows, and typed session state wired through the API and the SPA.
billing: Polar · Stripe · Dodo; One billing contract, three adapters — checkout, webhooks, and entitlements behind one interface.
email: React Email + Resend; Transactional templates as React components — previewable in dev, sent from the server.
contracts: @app/contracts; Shared Zod schemas: the API validates, the SPA infers, the tests assert.
domains: 8 server domains; auth, billing, deploy, marketing, notifications, tunnel, upload, users — boundaries enforced.
deploy: OpenTofu · guided setup; Choose AWS, GCP, or Azure now or later; lock one path and remove the unused provider surface.

running right now

Not a screenshot. A running instance.

The demo is the same image the scaffold produces — Better Auth sessions against a real Postgres, the shipped table, inbox, and settings surfaces. No staged tour and no fake chrome: sign in and read it the way your own customer would, before you read a line of the source. The preview is read-only, so what you land in is what the scaffold produces, not a sandbox the last visitor left behind.

open the live demoemail sign-in · no card required · read-only

users: server-side search, status and plan filters, sorting, pagination
files: a private library per account — name, type, size, upload time
settings: profile, linked sign-in providers, plan and billing, notifications
inbox: bell popover, bottom sheet on mobile, and a deep-linkable page
shell: command palette, light and dark themes, three locales

one decision, one maintained path

Choose your cloud during setup.

Say yes in the CLI, choose a backend and static frontend, then commit the generated non-secret configuration. Say no and run pnpm deploy:configure when the product is ready. Once locked, unused provider roots and adapters are removed.

cloud	native frontend	external frontend	API	database	IaC
AWS	S3 + CloudFront	Vercel or Cloudflare	ECS Fargate + ALB	RDS PostgreSQL 18	OpenTofu
GCP	GCS + Cloud CDN	Vercel or Cloudflare	Cloud Run	Cloud SQL PostgreSQL 18	OpenTofu
Azure	Static Web Apps	Vercel or Cloudflare	Container Apps	Flexible Server PostgreSQL 18	OpenTofu

repository proof bootstrap, cost-first, and HA plansrelease gate nine live custom-domain combinations pending

where the weekend goes

Build the product. Not its floor.

Your weekend goes to your idea. The rest is below, already done.

Boundaries that keep routes, services, contracts, and tests from leaking.: Eight server domains, one contracts package, architecture checks.
Auth wired through the API and SPA, sessions covered.: Better Auth flows and typed session state, connected.
Checkout, webhooks, and access agreeing before someone pays you.: Provider-neutral billing — Polar, Stripe, Dodo — with entitlement and webhook tests.
Teaching a contributor — human or agent — what to change and how to prove it.: Scoped AGENTS.md contracts, 14 golden paths, an eval harness.
Cloud topology, state, release migrations, rollback, and three copies of unused IaC.: Guided AWS, GCP, or Azure setup that keeps one OpenTofu path and prunes the rest.

the license

Pay once. Own the source.

No subscription, no seat metering, no feature gating. Two licenses, the same complete source — the difference is who is allowed to build with it.

Individual

One founder shipping their own products.

founding price

Founding price $99~~standard price $199~~

One payment · lifetime updates

Limited release — $149 when it sells out

You, building your own products
Unlimited products you own — commercial use included
Ship, sell, and keep the revenue. No royalty, no runtime check-in.

Founding onlyLifetime updates, forever. Licenses sold after the founding window include 12 months.

Get founding Individual

Team

One company building products it owns.

founding price

Founding price $199~~standard price $399~~

One payment · lifetime updates

Limited release — $299 when it sells out

Your whole company — no seat count, no per-developer fee
Everything in Individual
Unlimited products owned by the licensed company

Founding onlyLifetime updates, forever. Licenses sold after the founding window include 12 months.

Get founding Team

The full source — GitHub access plus a versioned, checksummed archive
Every subsystem: auth, billing, email, contracts, uploads, notifications, deploy
A license key for entitlement and support — never runtime DRM
The agent contract: AGENTS.md, golden paths, eval harness

the fine print, in full

Build anything you want with it and keep every rupee. The one line: you cannot resell or redistribute superslate itself as a competing starter kit.

Unlimited support is not bundled. You get the private channel and the issue tracker, and the documentation is written to answer the rest.

Questions, answered straight.

What exactly do I receive?

The source repository on GitHub, a versioned archive with SHA-256 checksum, and a non-expiring license key — for entitlement and support, not runtime DRM.

Can I try it before I buy?

Yes. app.superslate.dev runs the same image the scaffold produces — sign in with your email and explore the real thing: the user table, files, organizations and roles, settings, and the notification inbox. No card required. It is a read-only preview, so writes are disabled and nothing you do changes it for the next visitor. Visitor accounts stay out of the directory, so the accounts listed there are staged data, never other visitors.

What does the license cover?

The proposed founding Individual license covers one developer. Team covers everyone in one company building products that company owns. Neither tier includes client delivery or redistribution rights. Final rights, update terms, and refund terms will be published consistently before checkout opens.

Why Bun and Hono instead of Next.js?

One fast runtime for the API, scripts, and tests; a router on standard web APIs. Your product is a SaaS, not a content site — an SPA plus a typed API keeps the boundaries clean.

Which coding agents does it work with?

Any of them. The contract is plain artifacts — markdown, JSON, runnable checks — read equally well by Claude Code, Cursor, Codex, or whatever ships next.

Can I swap or remove parts of the stack?

Yes — it's your source, and there's a golden path for it (remove-optional-subsystem.md). But the defaults are the maintained, tested route.

How does cloud deployment setup work?

The creator can configure deployment immediately or defer it. You choose AWS, GCP, or Azure; a native, Vercel, or Cloudflare static frontend; region; domains; and cost-first or HA. superslate writes the non-secret config and operator checklist, then removes unused provider paths. Cloud credentials and secret values stay in your provider and protected GitHub environment.

Do I have to use AI agents to benefit?

No. Explicit boundaries, typed contracts, and verified recipes make a good codebase for humans too. Agents are the multiplier, not the requirement.

How is "agent-ready" more than marketing here?

It ships as artifacts you can inspect: scoped AGENTS.md contracts, maintained golden paths, a deterministic navigation contract, an outcome eval harness, and an optional local read-only documentation MCP.

What happens after I buy?

Before checkout opens, the complete Polar flow will be proven end to end: order terms, repository access, a checksummed source archive, license record, receipt, refund path, and a human recovery contact. The live page will state the measured delivery time.

Start from a foundation you can inspect.

Own the source. Keep the boundaries. Make the next commit yours.

Get superslate read the docs →